auth/credentials: don't ignore "client use kerberos" and --use-kerberos for machine...
[samba.git] / source3 / smbd / smbXsrv_open.c
index 3566dc25918fb62b5c84af3ab179937b0beb78a0..6fd64a028c952385569026c306e1c15aa9d5cb71 100644 (file)
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include "smbXsrv_open.h"
 #include "includes.h"
 #include "system/filesys.h"
+#include "lib/util/server_id.h"
 #include "smbd/smbd.h"
 #include "smbd/globals.h"
 #include "dbwrap/dbwrap.h"
 #include "messages.h"
 #include "lib/util/util_tdb.h"
 #include "librpc/gen_ndr/ndr_smbXsrv.h"
-#include <ccan/hash/hash.h>
 #include "serverid.h"
+#include "source3/include/util_tdb.h"
+#include "lib/util/idtree_random.h"
+#include "lib/util/time_basic.h"
 
 struct smbXsrv_open_table {
        struct {
-               struct db_context *db_ctx;
+               struct idr_context *idr;
+               struct db_context *replay_cache_db_ctx;
                uint32_t lowest_id;
                uint32_t highest_id;
                uint32_t max_opens;
@@ -49,27 +54,27 @@ static struct db_context *smbXsrv_open_global_db_ctx = NULL;
 
 NTSTATUS smbXsrv_open_global_init(void)
 {
-       const char *global_path = NULL;
+       char *global_path = NULL;
        struct db_context *db_ctx = NULL;
 
        if (smbXsrv_open_global_db_ctx != NULL) {
                return NT_STATUS_OK;
        }
 
-       global_path = lock_path("smbXsrv_open_global.tdb");
+       global_path = lock_path(talloc_tos(), "smbXsrv_open_global.tdb");
+       if (global_path == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
        db_ctx = db_open(NULL, global_path,
-                        0, /* hash_size */
-                        TDB_DEFAULT |
-                        TDB_CLEAR_IF_FIRST |
-                        TDB_INCOMPATIBLE_HASH,
+                        SMBD_VOLATILE_TDB_HASH_SIZE,
+                        SMBD_VOLATILE_TDB_FLAGS,
                         O_RDWR | O_CREAT, 0600,
-                        DBWRAP_LOCK_ORDER_1);
+                        DBWRAP_LOCK_ORDER_1,
+                        DBWRAP_FLAG_NONE);
+       TALLOC_FREE(global_path);
        if (db_ctx == NULL) {
-               NTSTATUS status;
-
-               status = map_nt_error_from_unix_common(errno);
-
+               NTSTATUS status = map_nt_error_from_unix_common(errno);
                return status;
        }
 
@@ -87,64 +92,17 @@ NTSTATUS smbXsrv_open_global_init(void)
  * TODO: implement string based key
  */
 
-#define SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
-
-static TDB_DATA smbXsrv_open_global_id_to_key(uint32_t id,
-                                             uint8_t *key_buf)
-{
-       TDB_DATA key;
-
-       RSIVAL(key_buf, 0, id);
-
-       key = make_tdb_data(key_buf, SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE);
-
-       return key;
-}
-
-#if 0
-static NTSTATUS smbXsrv_open_global_key_to_id(TDB_DATA key, uint32_t *id)
-{
-       if (id == NULL) {
-               return NT_STATUS_INVALID_PARAMETER;
-       }
-
-       if (key.dsize != SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE) {
-               return NT_STATUS_INTERNAL_DB_CORRUPTION;
-       }
-
-       *id = RIVAL(key.dptr, 0);
-
-       return NT_STATUS_OK;
-}
-#endif
-
-#define SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
-
-static TDB_DATA smbXsrv_open_local_id_to_key(uint32_t id,
-                                            uint8_t *key_buf)
-{
-       TDB_DATA key;
-
-       RSIVAL(key_buf, 0, id);
-
-       key = make_tdb_data(key_buf, SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE);
-
-       return key;
-}
+struct smbXsrv_open_global_key_buf { uint8_t buf[sizeof(uint32_t)]; };
 
-static NTSTATUS smbXsrv_open_local_key_to_id(TDB_DATA key, uint32_t *id)
+static TDB_DATA smbXsrv_open_global_id_to_key(
+       uint32_t id, struct smbXsrv_open_global_key_buf *key_buf)
 {
-       if (id == NULL) {
-               return NT_STATUS_INVALID_PARAMETER;
-       }
-
-       if (key.dsize != SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE) {
-               return NT_STATUS_INTERNAL_DB_CORRUPTION;
-       }
+       RSIVAL(key_buf->buf, 0, id);
 
-       *id = RIVAL(key.dptr, 0);
-
-       return NT_STATUS_OK;
+       return (TDB_DATA) {
+               .dptr = key_buf->buf,
+               .dsize = sizeof(key_buf->buf),
+       };
 }
 
 static NTSTATUS smbXsrv_open_table_init(struct smbXsrv_connection *conn,
@@ -152,6 +110,7 @@ static NTSTATUS smbXsrv_open_table_init(struct smbXsrv_connection *conn,
                                        uint32_t highest_id,
                                        uint32_t max_opens)
 {
+       struct smbXsrv_client *client = conn->client;
        struct smbXsrv_open_table *table;
        NTSTATUS status;
        uint64_t max_range;
@@ -168,13 +127,18 @@ static NTSTATUS smbXsrv_open_table_init(struct smbXsrv_connection *conn,
                return NT_STATUS_INTERNAL_ERROR;
        }
 
-       table = talloc_zero(conn, struct smbXsrv_open_table);
+       table = talloc_zero(client, struct smbXsrv_open_table);
        if (table == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       table->local.db_ctx = db_open_rbt(table);
-       if (table->local.db_ctx == NULL) {
+       table->local.idr = idr_init(table);
+       if (table->local.idr == NULL) {
+               TALLOC_FREE(table);
+               return NT_STATUS_NO_MEMORY;
+       }
+       table->local.replay_cache_db_ctx = db_open_rbt(table);
+       if (table->local.replay_cache_db_ctx == NULL) {
                TALLOC_FREE(table);
                return NT_STATUS_NO_MEMORY;
        }
@@ -190,216 +154,17 @@ static NTSTATUS smbXsrv_open_table_init(struct smbXsrv_connection *conn,
 
        table->global.db_ctx = smbXsrv_open_global_db_ctx;
 
-       conn->open_table = table;
+       client->open_table = table;
        return NT_STATUS_OK;
 }
 
-struct smbXsrv_open_local_allocate_state {
-       const uint32_t lowest_id;
-       const uint32_t highest_id;
-       uint32_t last_id;
-       uint32_t useable_id;
-       NTSTATUS status;
-};
-
-static int smbXsrv_open_local_allocate_traverse(struct db_record *rec,
-                                                  void *private_data)
-{
-       struct smbXsrv_open_local_allocate_state *state =
-               (struct smbXsrv_open_local_allocate_state *)private_data;
-       TDB_DATA key = dbwrap_record_get_key(rec);
-       uint32_t id = 0;
-       NTSTATUS status;
-
-       status = smbXsrv_open_local_key_to_id(key, &id);
-       if (!NT_STATUS_IS_OK(status)) {
-               state->status = status;
-               return -1;
-       }
-
-       if (id <= state->last_id) {
-               state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
-               return -1;
-       }
-       state->last_id = id;
-
-       if (id > state->useable_id) {
-               state->status = NT_STATUS_OK;
-               return -1;
-       }
-
-       if (state->useable_id == state->highest_id) {
-               state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
-               return -1;
-       }
-
-       state->useable_id +=1;
-       return 0;
-}
-
-static NTSTATUS smbXsrv_open_local_allocate_id(struct db_context *db,
-                                              uint32_t lowest_id,
-                                              uint32_t highest_id,
-                                              TALLOC_CTX *mem_ctx,
-                                              struct db_record **_rec,
-                                              uint32_t *_id)
-{
-       struct smbXsrv_open_local_allocate_state state = {
-               .lowest_id = lowest_id,
-               .highest_id = highest_id,
-               .last_id = 0,
-               .useable_id = lowest_id,
-               .status = NT_STATUS_INTERNAL_ERROR,
-       };
-       uint32_t i;
-       uint32_t range;
-       NTSTATUS status;
-       int count = 0;
-
-       *_rec = NULL;
-       *_id = 0;
-
-       if (lowest_id > highest_id) {
-               return NT_STATUS_INSUFFICIENT_RESOURCES;
-       }
-
-       /*
-        * first we try randomly
-        */
-       range = (highest_id - lowest_id) + 1;
-
-       for (i = 0; i < (range / 2); i++) {
-               uint32_t id;
-               uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
-               TDB_DATA key;
-               TDB_DATA val;
-               struct db_record *rec = NULL;
-
-               id = generate_random() % range;
-               id += lowest_id;
-
-               if (id < lowest_id) {
-                       id = lowest_id;
-               }
-               if (id > highest_id) {
-                       id = highest_id;
-               }
-
-               key = smbXsrv_open_local_id_to_key(id, key_buf);
-
-               rec = dbwrap_fetch_locked(db, mem_ctx, key);
-               if (rec == NULL) {
-                       return NT_STATUS_INSUFFICIENT_RESOURCES;
-               }
-
-               val = dbwrap_record_get_value(rec);
-               if (val.dsize != 0) {
-                       TALLOC_FREE(rec);
-                       continue;
-               }
-
-               *_rec = rec;
-               *_id = id;
-               return NT_STATUS_OK;
-       }
-
-       /*
-        * if the range is almost full,
-        * we traverse the whole table
-        * (this relies on sorted behavior of dbwrap_rbt)
-        */
-       status = dbwrap_traverse_read(db, smbXsrv_open_local_allocate_traverse,
-                                     &state, &count);
-       if (NT_STATUS_IS_OK(status)) {
-               if (NT_STATUS_IS_OK(state.status)) {
-                       return NT_STATUS_INTERNAL_ERROR;
-               }
-
-               if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
-                       return state.status;
-               }
-
-               if (state.useable_id <= state.highest_id) {
-                       state.status = NT_STATUS_OK;
-               } else {
-                       return NT_STATUS_INSUFFICIENT_RESOURCES;
-               }
-       } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
-               /*
-                * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
-                *
-                * If we get anything else it is an error, because it
-                * means we did not manage to find a free slot in
-                * the db.
-                */
-               return NT_STATUS_INSUFFICIENT_RESOURCES;
-       }
-
-       if (NT_STATUS_IS_OK(state.status)) {
-               uint32_t id;
-               uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
-               TDB_DATA key;
-               TDB_DATA val;
-               struct db_record *rec = NULL;
-
-               id = state.useable_id;
-
-               key = smbXsrv_open_local_id_to_key(id, key_buf);
-
-               rec = dbwrap_fetch_locked(db, mem_ctx, key);
-               if (rec == NULL) {
-                       return NT_STATUS_INSUFFICIENT_RESOURCES;
-               }
-
-               val = dbwrap_record_get_value(rec);
-               if (val.dsize != 0) {
-                       TALLOC_FREE(rec);
-                       return NT_STATUS_INTERNAL_DB_CORRUPTION;
-               }
-
-               *_rec = rec;
-               *_id = id;
-               return NT_STATUS_OK;
-       }
-
-       return state.status;
-}
-
-struct smbXsrv_open_local_fetch_state {
-       struct smbXsrv_open *op;
-       NTSTATUS status;
-};
-
-static void smbXsrv_open_local_fetch_parser(TDB_DATA key, TDB_DATA data,
-                                           void *private_data)
-{
-       struct smbXsrv_open_local_fetch_state *state =
-               (struct smbXsrv_open_local_fetch_state *)private_data;
-       void *ptr;
-
-       if (data.dsize != sizeof(ptr)) {
-               state->status = NT_STATUS_INTERNAL_DB_ERROR;
-               return;
-       }
-
-       memcpy(&ptr, data.dptr, data.dsize);
-       state->op = talloc_get_type_abort(ptr, struct smbXsrv_open);
-       state->status = NT_STATUS_OK;
-}
-
 static NTSTATUS smbXsrv_open_local_lookup(struct smbXsrv_open_table *table,
                                          uint32_t open_local_id,
                                          uint32_t open_global_id,
                                          NTTIME now,
                                          struct smbXsrv_open **_open)
 {
-       struct smbXsrv_open_local_fetch_state state = {
-               .op = NULL,
-               .status = NT_STATUS_INTERNAL_ERROR,
-       };
-       uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
-       TDB_DATA key;
-       NTSTATUS status;
+       struct smbXsrv_open *op = NULL;
 
        *_open = NULL;
 
@@ -412,241 +177,133 @@ static NTSTATUS smbXsrv_open_local_lookup(struct smbXsrv_open_table *table,
                return NT_STATUS_FILE_CLOSED;
        }
 
-       if (table->local.db_ctx == NULL) {
+       if (table->local.idr == NULL) {
                return NT_STATUS_INTERNAL_ERROR;
        }
 
-       key = smbXsrv_open_local_id_to_key(open_local_id, key_buf);
-
-       status = dbwrap_parse_record(table->local.db_ctx, key,
-                                    smbXsrv_open_local_fetch_parser,
-                                    &state);
-       if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
-               return NT_STATUS_FILE_CLOSED;
-       } else if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-       if (!NT_STATUS_IS_OK(state.status)) {
-               return state.status;
-       }
-
-       if (NT_STATUS_EQUAL(state.op->status, NT_STATUS_FILE_CLOSED)) {
+       op = idr_find(table->local.idr, open_local_id);
+       if (op == NULL) {
                return NT_STATUS_FILE_CLOSED;
        }
 
        if (open_global_id == 0) {
                /* make the global check a no-op for SMB1 */
-               open_global_id = state.op->global->open_global_id;
+               open_global_id = op->global->open_global_id;
        }
 
-       if (state.op->global->open_global_id != open_global_id) {
+       if (op->global->open_global_id != open_global_id) {
                return NT_STATUS_FILE_CLOSED;
        }
 
-       state.op->idle_time = now;
-
-       *_open = state.op;
-       return state.op->status;
-}
-
-static int smbXsrv_open_global_destructor(struct smbXsrv_open_global0 *global)
-{
-       return 0;
-}
-
-static void smbXsrv_open_global_verify_record(struct db_record *db_rec,
-                                       bool *is_free,
-                                       bool *was_free,
-                                       TALLOC_CTX *mem_ctx,
-                                       struct smbXsrv_open_global0 **_g);
-
-static NTSTATUS smbXsrv_open_global_allocate(struct db_context *db,
-                                       TALLOC_CTX *mem_ctx,
-                                       struct smbXsrv_open_global0 **_global)
-{
-       uint32_t i;
-       struct smbXsrv_open_global0 *global = NULL;
-       uint32_t last_free = 0;
-       const uint32_t min_tries = 3;
-
-       *_global = NULL;
-
-       global = talloc_zero(mem_ctx, struct smbXsrv_open_global0);
-       if (global == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       talloc_set_destructor(global, smbXsrv_open_global_destructor);
-
-       /*
-        * Here we just randomly try the whole 32-bit space
-        *
-        * We use just 32-bit, because we want to reuse the
-        * ID for SRVSVC.
-        */
-       for (i = 0; i < UINT32_MAX; i++) {
-               bool is_free = false;
-               bool was_free = false;
-               uint32_t id;
-               uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
-               TDB_DATA key;
-
-               if (i >= min_tries && last_free != 0) {
-                       id = last_free;
-               } else {
-                       id = generate_random();
-               }
-               if (id == 0) {
-                       id++;
-               }
-               if (id == UINT32_MAX) {
-                       id--;
-               }
-
-               key = smbXsrv_open_global_id_to_key(id, key_buf);
-
-               global->db_rec = dbwrap_fetch_locked(db, mem_ctx, key);
-               if (global->db_rec == NULL) {
-                       talloc_free(global);
-                       return NT_STATUS_INSUFFICIENT_RESOURCES;
-               }
-
-               smbXsrv_open_global_verify_record(global->db_rec,
-                                                 &is_free,
-                                                 &was_free,
-                                                 NULL, NULL);
-
-               if (!is_free) {
-                       TALLOC_FREE(global->db_rec);
-                       continue;
-               }
-
-               if (!was_free && i < min_tries) {
-                       /*
-                        * The session_id is free now,
-                        * but was not free before.
-                        *
-                        * This happens if a smbd crashed
-                        * and did not cleanup the record.
-                        *
-                        * If this is one of our first tries,
-                        * then we try to find a real free one.
-                        */
-                       if (last_free == 0) {
-                               last_free = id;
-                       }
-                       TALLOC_FREE(global->db_rec);
-                       continue;
-               }
-
-               global->open_global_id = id;
-
-               *_global = global;
-               return NT_STATUS_OK;
+       if (now != 0) {
+               op->idle_time = now;
        }
 
-       /* should not be reached */
-       talloc_free(global);
-       return NT_STATUS_INTERNAL_ERROR;
+       *_open = op;
+       return NT_STATUS_OK;
 }
 
-static void smbXsrv_open_global_verify_record(struct db_record *db_rec,
-                                       bool *is_free,
-                                       bool *was_free,
-                                       TALLOC_CTX *mem_ctx,
-                                       struct smbXsrv_open_global0 **_g)
+static NTSTATUS smbXsrv_open_global_parse_record(
+       TALLOC_CTX *mem_ctx,
+       TDB_DATA key,
+       TDB_DATA val,
+       struct smbXsrv_open_global0 **global)
 {
-       TDB_DATA key;
-       TDB_DATA val;
-       DATA_BLOB blob;
+       DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
        struct smbXsrv_open_globalB global_blob;
        enum ndr_err_code ndr_err;
-       struct smbXsrv_open_global0 *global = NULL;
-       bool exists;
+       NTSTATUS status;
        TALLOC_CTX *frame = talloc_stackframe();
 
-       *is_free = false;
-
-       if (was_free) {
-               *was_free = false;
-       }
-       if (_g) {
-               *_g = NULL;
-       }
-
-       key = dbwrap_record_get_key(db_rec);
-
-       val = dbwrap_record_get_value(db_rec);
-       if (val.dsize == 0) {
-               TALLOC_FREE(frame);
-               *is_free = true;
-               if (was_free) {
-                       *was_free = true;
-               }
-               return;
-       }
-
-       blob = data_blob_const(val.dptr, val.dsize);
-
        ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
                        (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_globalB);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-               NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
-               DEBUG(1,("smbXsrv_open_global_verify_record: "
+               DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
                         "key '%s' ndr_pull_struct_blob - %s\n",
-                        hex_encode_talloc(frame, key.dptr, key.dsize),
-                        nt_errstr(status)));
-               TALLOC_FREE(frame);
-               return;
+                        tdb_data_dbg(key),
+                        ndr_errstr(ndr_err)));
+               status = ndr_map_error2ntstatus(ndr_err);
+               goto done;
        }
 
-       DEBUG(10,("smbXsrv_open_global_verify_record\n"));
+       DBG_DEBUG("\n");
        if (CHECK_DEBUGLVL(10)) {
                NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
        }
 
        if (global_blob.version != SMBXSRV_VERSION_0) {
-               DEBUG(0,("smbXsrv_open_global_verify_record: "
-                        "key '%s' use unsupported version %u\n",
-                        hex_encode_talloc(frame, key.dptr, key.dsize),
-                        global_blob.version));
-               NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
-               TALLOC_FREE(frame);
-               return;
+               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+               DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
+                        "key '%s' unsupported version - %d - %s\n",
+                        tdb_data_dbg(key),
+                        (int)global_blob.version,
+                        nt_errstr(status)));
+               goto done;
        }
 
-       global = global_blob.info.info0;
+       if (global_blob.info.info0 == NULL) {
+               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+               DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
+                        "key '%s' info0 NULL pointer - %s\n",
+                        tdb_data_dbg(key),
+                        nt_errstr(status)));
+               goto done;
+       }
 
-       if (server_id_is_disconnected(&global->server_id)) {
-               exists = true;
-       } else {
-               exists = serverid_exists(&global->server_id);
-       }
-       if (!exists) {
-               DEBUG(2,("smbXsrv_open_global_verify_record: "
-                        "key '%s' server_id %s does not exist.\n",
-                        hex_encode_talloc(frame, key.dptr, key.dsize),
-                        server_id_str(frame, &global->server_id)));
-               if (CHECK_DEBUGLVL(2)) {
-                       NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
-               }
-               TALLOC_FREE(frame);
-               dbwrap_record_delete(db_rec);
-               *is_free = true;
-               return;
+       *global = talloc_move(mem_ctx, &global_blob.info.info0);
+       status = NT_STATUS_OK;
+done:
+       talloc_free(frame);
+       return status;
+}
+
+static NTSTATUS smbXsrv_open_global_verify_record(
+       TDB_DATA key,
+       TDB_DATA val,
+       TALLOC_CTX *mem_ctx,
+       struct smbXsrv_open_global0 **_global0)
+{
+       struct smbXsrv_open_global0 *global0 = NULL;
+       struct server_id_buf buf;
+       NTSTATUS status;
+
+       if (val.dsize == 0) {
+               return NT_STATUS_NOT_FOUND;
+       }
+
+       status = smbXsrv_open_global_parse_record(mem_ctx, key, val, &global0);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_WARNING("smbXsrv_open_global_parse_record for %s failed: "
+                           "%s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(status));
+               return status;
        }
+       *_global0 = global0;
 
-       if (_g) {
-               *_g = talloc_move(mem_ctx, &global);
+       if (server_id_is_disconnected(&global0->server_id)) {
+               return NT_STATUS_OK;
        }
-       TALLOC_FREE(frame);
+       if (serverid_exists(&global0->server_id)) {
+               return NT_STATUS_OK;
+       }
+
+       DBG_WARNING("smbd %s did not clean up record %s\n",
+                   server_id_str_buf(global0->server_id, &buf),
+                   tdb_data_dbg(key));
+
+       return NT_STATUS_FATAL_APP_EXIT;
 }
 
-static NTSTATUS smbXsrv_open_global_store(struct smbXsrv_open_global0 *global)
+static NTSTATUS smbXsrv_open_global_store(
+       struct db_record *rec,
+       TDB_DATA key,
+       TDB_DATA oldval,
+       struct smbXsrv_open_global0 *global)
 {
        struct smbXsrv_open_globalB global_blob;
        DATA_BLOB blob = data_blob_null;
-       TDB_DATA key;
-       TDB_DATA val;
+       TDB_DATA val = { .dptr = NULL, };
        NTSTATUS status;
        enum ndr_err_code ndr_err;
 
@@ -656,96 +313,186 @@ static NTSTATUS smbXsrv_open_global_store(struct smbXsrv_open_global0 *global)
         * store the information in the old format.
         */
 
-       if (global->db_rec == NULL) {
-               return NT_STATUS_INTERNAL_ERROR;
-       }
-
-       key = dbwrap_record_get_key(global->db_rec);
-       val = dbwrap_record_get_value(global->db_rec);
+       global_blob = (struct smbXsrv_open_globalB) {
+               .version = smbXsrv_version_global_current(),
+       };
 
-       ZERO_STRUCT(global_blob);
-       global_blob.version = smbXsrv_version_global_current();
-       if (val.dsize >= 8) {
-               global_blob.seqnum = IVAL(val.dptr, 4);
+       if (oldval.dsize >= 8) {
+               global_blob.seqnum = IVAL(oldval.dptr, 4);
        }
        global_blob.seqnum += 1;
        global_blob.info.info0 = global;
 
-       ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
+       ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &global_blob,
                        (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_globalB);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-               status = ndr_map_error2ntstatus(ndr_err);
-               DEBUG(1,("smbXsrv_open_global_store: key '%s' ndr_push - %s\n",
-                        hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
-                        nt_errstr(status)));
-               TALLOC_FREE(global->db_rec);
-               return status;
+               DBG_WARNING("key '%s' ndr_push - %s\n",
+                           tdb_data_dbg(key),
+                           ndr_map_error2string(ndr_err));
+               return ndr_map_error2ntstatus(ndr_err);
        }
 
        val = make_tdb_data(blob.data, blob.length);
-       status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
+       status = dbwrap_record_store(rec, val, TDB_REPLACE);
+       TALLOC_FREE(blob.data);
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(1,("smbXsrv_open_global_store: key '%s' store - %s\n",
-                        hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
-                        nt_errstr(status)));
-               TALLOC_FREE(global->db_rec);
+               DBG_WARNING("key '%s' store - %s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(status));
                return status;
        }
 
        if (CHECK_DEBUGLVL(10)) {
-               DEBUG(10,("smbXsrv_open_global_store: key '%s' stored\n",
-                        hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
+               DBG_DEBUG("key '%s' stored\n", tdb_data_dbg(key));
                NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
        }
 
-       TALLOC_FREE(global->db_rec);
-
        return NT_STATUS_OK;
 }
 
-static NTSTATUS smbXsrv_open_global_lookup(struct smbXsrv_open_table *table,
-                                          uint32_t open_global_id,
-                                          TALLOC_CTX *mem_ctx,
-                                          struct smbXsrv_open_global0 **_global)
+struct smbXsrv_open_global_allocate_state {
+       uint32_t id;
+       struct smbXsrv_open_global0 *global;
+       NTSTATUS status;
+};
+
+static void smbXsrv_open_global_allocate_fn(
+       struct db_record *rec, TDB_DATA oldval, void *private_data)
 {
-       TDB_DATA key;
-       uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
-       struct db_record *global_rec = NULL;
-       bool is_free = false;
+       struct smbXsrv_open_global_allocate_state *state = private_data;
+       struct smbXsrv_open_global0 *global = state->global;
+       struct smbXsrv_open_global0 *tmp_global0 = NULL;
+       TDB_DATA key = dbwrap_record_get_key(rec);
 
-       *_global = NULL;
+       state->status = smbXsrv_open_global_verify_record(
+               key, oldval, talloc_tos(), &tmp_global0);
 
-       if (table->global.db_ctx == NULL) {
-               return NT_STATUS_INTERNAL_ERROR;
+       if (NT_STATUS_IS_OK(state->status)) {
+               /*
+                * Found an existing record
+                */
+               TALLOC_FREE(tmp_global0);
+               state->status = NT_STATUS_RETRY;
+               return;
        }
 
-       key = smbXsrv_open_global_id_to_key(open_global_id, key_buf);
-
-       global_rec = dbwrap_fetch_locked(table->global.db_ctx, mem_ctx, key);
-       if (global_rec == NULL) {
-               DEBUG(0, ("smbXsrv_open_global_lookup(0x%08x): "
-                         "Failed to lock global key '%s'\n",
-                         open_global_id,
-                         hex_encode_talloc(talloc_tos(), key.dptr,
-                                           key.dsize)));
-               return NT_STATUS_INTERNAL_DB_ERROR;
+       if (NT_STATUS_EQUAL(state->status, NT_STATUS_NOT_FOUND)) {
+               /*
+                * Found an empty slot
+                */
+               global->open_global_id = state->id;
+               global->open_persistent_id = state->id;
+
+               state->status = smbXsrv_open_global_store(
+                       rec, key, (TDB_DATA) { .dsize = 0, }, state->global);
+               if (!NT_STATUS_IS_OK(state->status)) {
+                       DBG_WARNING("smbXsrv_open_global_store() for "
+                                   "id %"PRIu32" failed: %s\n",
+                                   state->id,
+                                   nt_errstr(state->status));
+               }
+               return;
        }
 
-       smbXsrv_open_global_verify_record(global_rec,
-                                         &is_free,
-                                         NULL,
-                                         mem_ctx,
-                                         _global);
-       if (is_free) {
-               talloc_free(global_rec);
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       if (NT_STATUS_EQUAL(state->status, NT_STATUS_FATAL_APP_EXIT)) {
+               NTSTATUS status;
+
+               TALLOC_FREE(tmp_global0);
+
+               /*
+                * smbd crashed
+                */
+               status = dbwrap_record_delete(rec);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_WARNING("dbwrap_record_delete() failed "
+                                   "for record %"PRIu32": %s\n",
+                                   state->id,
+                                   nt_errstr(status));
+                       state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                       return;
+               }
+               return;
        }
+}
 
-       (*_global)->db_rec = talloc_move(*_global, &global_rec);
+static NTSTATUS smbXsrv_open_global_allocate(
+       struct db_context *db, struct smbXsrv_open_global0 *global)
+{
+       struct smbXsrv_open_global_allocate_state state = {
+               .global = global,
+       };
+       uint32_t i;
+       uint32_t last_free = 0;
+       const uint32_t min_tries = 3;
 
-       talloc_set_destructor(*_global, smbXsrv_open_global_destructor);
+       /*
+        * Here we just randomly try the whole 32-bit space
+        *
+        * We use just 32-bit, because we want to reuse the
+        * ID for SRVSVC.
+        */
+       for (i = 0; i < UINT32_MAX; i++) {
+               struct smbXsrv_open_global_key_buf key_buf;
+               TDB_DATA key;
+               NTSTATUS status;
 
-       return NT_STATUS_OK;
+               if (i >= min_tries && last_free != 0) {
+                       state.id = last_free;
+               } else {
+                       generate_nonce_buffer(
+                               (uint8_t *)&state.id, sizeof(state.id));
+                       state.id = MAX(state.id, 1);
+                       state.id = MIN(state.id, UINT32_MAX-1);
+               }
+
+               key = smbXsrv_open_global_id_to_key(state.id, &key_buf);
+
+               status = dbwrap_do_locked(
+                       db, key, smbXsrv_open_global_allocate_fn, &state);
+
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_WARNING("dbwrap_do_locked() failed: %s\n",
+                                   nt_errstr(status));
+                       return NT_STATUS_INTERNAL_DB_ERROR;
+               }
+
+               if (NT_STATUS_IS_OK(state.status)) {
+                       /*
+                        * Found an empty slot, done.
+                        */
+                       DBG_DEBUG("Found slot %"PRIu32"\n", state.id);
+                       return NT_STATUS_OK;
+               }
+
+               if (NT_STATUS_EQUAL(state.status, NT_STATUS_FATAL_APP_EXIT)) {
+
+                       if ((i < min_tries) && (last_free == 0)) {
+                               /*
+                                * Remember "id" as free but also try
+                                * others to not recycle ids too
+                                * quickly.
+                                */
+                               last_free = state.id;
+                       }
+                       continue;
+               }
+
+               if (NT_STATUS_EQUAL(state.status, NT_STATUS_RETRY)) {
+                       /*
+                        * Normal collision, try next
+                        */
+                       DBG_DEBUG("Found record for id %"PRIu32"\n",
+                                 state.id);
+                       continue;
+               }
+
+               DBG_WARNING("smbXsrv_open_global_allocate_fn() failed: %s\n",
+                           nt_errstr(state.status));
+               return state.status;
+       }
+
+       /* should not be reached */
+       return NT_STATUS_INTERNAL_ERROR;
 }
 
 static int smbXsrv_open_destructor(struct smbXsrv_open *op)
@@ -769,32 +516,24 @@ NTSTATUS smbXsrv_open_create(struct smbXsrv_connection *conn,
                             NTTIME now,
                             struct smbXsrv_open **_open)
 {
-       struct smbXsrv_open_table *table = conn->open_table;
-       struct db_record *local_rec = NULL;
+       struct smbXsrv_open_table *table = conn->client->open_table;
        struct smbXsrv_open *op = NULL;
-       void *ptr = NULL;
-       TDB_DATA val;
        struct smbXsrv_open_global0 *global = NULL;
        NTSTATUS status;
        struct dom_sid *current_sid = NULL;
        struct security_token *current_token = NULL;
+       int local_id;
 
        if (session_info == NULL) {
                return NT_STATUS_INVALID_HANDLE;
        }
        current_token = session_info->security_token;
 
-       if (current_token == NULL) {
-               return NT_STATUS_INVALID_HANDLE;
-       }
-
-       if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
-               current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
-       }
-
-       if (current_sid == NULL) {
+       if ((current_token == NULL) ||
+           (current_token->num_sids <= PRIMARY_USER_SID_INDEX)) {
                return NT_STATUS_INVALID_HANDLE;
        }
+       current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
 
        if (table->local.num_opens >= table->local.max_opens) {
                return NT_STATUS_INSUFFICIENT_RESOURCES;
@@ -808,63 +547,60 @@ NTSTATUS smbXsrv_open_create(struct smbXsrv_connection *conn,
        op->status = NT_STATUS_OK; /* TODO: start with INTERNAL_ERROR */
        op->idle_time = now;
 
-       status = smbXsrv_open_global_allocate(table->global.db_ctx,
-                                             op, &global);
-       if (!NT_STATUS_IS_OK(status)) {
+       global = talloc_zero(op, struct smbXsrv_open_global0);
+       if (global == NULL) {
                TALLOC_FREE(op);
-               return status;
+               return NT_STATUS_NO_MEMORY;
        }
        op->global = global;
 
-       status = smbXsrv_open_local_allocate_id(table->local.db_ctx,
-                                               table->local.lowest_id,
-                                               table->local.highest_id,
-                                               op,
-                                               &local_rec,
-                                               &op->local_id);
-       if (!NT_STATUS_IS_OK(status)) {
+       /*
+        * We mark every slot as invalid using 0xFF.
+        * Valid values are masked with 0xF.
+        */
+       memset(global->lock_sequence_array, 0xFF,
+              sizeof(global->lock_sequence_array));
+
+       local_id = idr_get_new_random(
+               table->local.idr,
+               op,
+               table->local.lowest_id,
+               table->local.highest_id);
+       if (local_id == -1) {
                TALLOC_FREE(op);
-               return status;
+               return NT_STATUS_INSUFFICIENT_RESOURCES;
        }
+       op->local_id = local_id;
 
-       global->open_persistent_id = global->open_global_id;
        global->open_volatile_id = op->local_id;
 
-       global->server_id = messaging_server_id(conn->msg_ctx);
+       global->server_id = messaging_server_id(conn->client->msg_ctx);
        global->open_time = now;
        global->open_owner = *current_sid;
        if (conn->protocol >= PROTOCOL_SMB2_10) {
                global->client_guid = conn->smb2.client.guid;
        }
 
-       ptr = op;
-       val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
-       status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
-       TALLOC_FREE(local_rec);
+       status = smbXsrv_open_global_allocate(table->global.db_ctx,
+                                             global);
        if (!NT_STATUS_IS_OK(status)) {
+               int ret = idr_remove(table->local.idr, local_id);
+               SMB_ASSERT(ret == 0);
+
+               DBG_WARNING("smbXsrv_open_global_allocate() failed: %s\n",
+                           nt_errstr(status));
                TALLOC_FREE(op);
                return status;
        }
-       table->local.num_opens += 1;
 
+       table->local.num_opens += 1;
        talloc_set_destructor(op, smbXsrv_open_destructor);
 
-       status = smbXsrv_open_global_store(global);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0,("smbXsrv_open_create: "
-                        "global_id (0x%08x) store failed - %s\n",
-                        op->global->open_global_id,
-                        nt_errstr(status)));
-               TALLOC_FREE(op);
-               return status;
-       }
-
        if (CHECK_DEBUGLVL(10)) {
-               struct smbXsrv_openB open_blob;
-
-               ZERO_STRUCT(open_blob);
-               open_blob.version = SMBXSRV_VERSION_0;
-               open_blob.info.info0 = op;
+               struct smbXsrv_openB open_blob = {
+                       .version = SMBXSRV_VERSION_0,
+                       .info.info0 = op,
+               };
 
                DEBUG(10,("smbXsrv_open_create: global_id (0x%08x) stored\n",
                         op->global->open_global_id));
@@ -875,207 +611,254 @@ NTSTATUS smbXsrv_open_create(struct smbXsrv_connection *conn,
        return NT_STATUS_OK;
 }
 
-uint32_t smbXsrv_open_hash(struct smbXsrv_open *_open)
+static NTSTATUS smbXsrv_open_set_replay_cache(struct smbXsrv_open *op)
 {
-       uint8_t buf[8+8+8];
-       uint32_t ret;
+       struct GUID *create_guid;
+       struct GUID_txt_buf buf;
+       char *guid_string;
+       struct db_context *db = op->table->local.replay_cache_db_ctx;
+       struct smbXsrv_open_replay_cache rc = {
+               .idle_time = op->idle_time,
+               .local_id = op->local_id,
+       };
+       uint8_t data[SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE] = { 0 };
+       DATA_BLOB blob = { .data = data, .length = sizeof(data), };
+       enum ndr_err_code ndr_err;
+       NTSTATUS status;
+       TDB_DATA val;
+
+       if (!(op->flags & SMBXSRV_OPEN_NEED_REPLAY_CACHE)) {
+               return NT_STATUS_OK;
+       }
+
+       if (op->flags & SMBXSRV_OPEN_HAVE_REPLAY_CACHE) {
+               return NT_STATUS_OK;
+       }
+
+       create_guid = &op->global->create_guid;
+       guid_string = GUID_buf_string(create_guid, &buf);
 
-       SBVAL(buf,  0, _open->global->open_persistent_id);
-       SBVAL(buf,  8, _open->global->open_volatile_id);
-       SBVAL(buf, 16, _open->global->open_time);
+       ndr_err = ndr_push_struct_into_fixed_blob(&blob, &rc,
+               (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_replay_cache);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               status = ndr_map_error2ntstatus(ndr_err);
+               return status;
+       }
+       val = make_tdb_data(blob.data, blob.length);
 
-       ret = hash(buf, sizeof(buf), 0);
+       status = dbwrap_store_bystring(db, guid_string, val, TDB_REPLACE);
 
-       if (ret == 0) {
-               ret = 1;
+       if (NT_STATUS_IS_OK(status)) {
+               op->flags |= SMBXSRV_OPEN_HAVE_REPLAY_CACHE;
+               op->flags &= ~SMBXSRV_OPEN_NEED_REPLAY_CACHE;
        }
 
-       return ret;
+       return status;
 }
 
-NTSTATUS smbXsrv_open_update(struct smbXsrv_open *op)
+NTSTATUS smbXsrv_open_purge_replay_cache(struct smbXsrv_client *client,
+                                        const struct GUID *create_guid)
 {
-       struct smbXsrv_open_table *table = op->table;
+       struct GUID_txt_buf buf;
        NTSTATUS status;
-       uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
-       TDB_DATA key;
 
-       if (op->global->db_rec != NULL) {
-               DEBUG(0, ("smbXsrv_open_update(0x%08x): "
-                         "Called with db_rec != NULL'\n",
-                         op->global->open_global_id));
-               return NT_STATUS_INTERNAL_ERROR;
+       if (client->open_table == NULL) {
+               return NT_STATUS_OK;
        }
 
-       key = smbXsrv_open_global_id_to_key(op->global->open_global_id,
-                                           key_buf);
+       status = dbwrap_purge_bystring(
+               client->open_table->local.replay_cache_db_ctx,
+               GUID_buf_string(create_guid, &buf));
+       return status;
+}
 
-       op->global->db_rec = dbwrap_fetch_locked(table->global.db_ctx,
-                                                op->global, key);
-       if (op->global->db_rec == NULL) {
-               DEBUG(0, ("smbXsrv_open_update(0x%08x): "
-                         "Failed to lock global key '%s'\n",
-                         op->global->open_global_id,
-                         hex_encode_talloc(talloc_tos(), key.dptr,
-                                           key.dsize)));
-               return NT_STATUS_INTERNAL_DB_ERROR;
+static NTSTATUS smbXsrv_open_clear_replay_cache(struct smbXsrv_open *op)
+{
+       struct GUID *create_guid;
+       struct GUID_txt_buf buf;
+       struct db_context *db;
+       NTSTATUS status;
+
+       if (op->table == NULL) {
+               return NT_STATUS_OK;
        }
 
-       status = smbXsrv_open_global_store(op->global);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0,("smbXsrv_open_update: "
-                        "global_id (0x%08x) store failed - %s\n",
-                        op->global->open_global_id,
-                        nt_errstr(status)));
-               return status;
+       db = op->table->local.replay_cache_db_ctx;
+
+       if (!(op->flags & SMBXSRV_OPEN_HAVE_REPLAY_CACHE)) {
+               return NT_STATUS_OK;
        }
 
-       if (CHECK_DEBUGLVL(10)) {
-               struct smbXsrv_openB open_blob;
+       create_guid = &op->global->create_guid;
+       if (GUID_all_zero(create_guid)) {
+               return NT_STATUS_OK;
+       }
 
-               ZERO_STRUCT(open_blob);
-               open_blob.version = SMBXSRV_VERSION_0;
-               open_blob.info.info0 = op;
+       status = dbwrap_purge_bystring(db, GUID_buf_string(create_guid, &buf));
 
-               DEBUG(10,("smbXsrv_open_update: global_id (0x%08x) stored\n",
-                         op->global->open_global_id));
-               NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
+       if (NT_STATUS_IS_OK(status)) {
+               op->flags &= ~SMBXSRV_OPEN_HAVE_REPLAY_CACHE;
        }
 
-       return NT_STATUS_OK;
+       return status;
 }
 
-NTSTATUS smbXsrv_open_close(struct smbXsrv_open *op, NTTIME now)
+struct smbXsrv_open_update_state {
+       struct smbXsrv_open_global0 *global;
+       NTSTATUS status;
+};
+
+static void smbXsrv_open_update_fn(
+       struct db_record *rec, TDB_DATA oldval, void *private_data)
 {
-       struct smbXsrv_open_table *table;
-       struct db_record *local_rec = NULL;
-       struct db_record *global_rec = NULL;
+       struct smbXsrv_open_update_state *state = private_data;
+       TDB_DATA key = dbwrap_record_get_key(rec);
+
+       state->status = smbXsrv_open_global_store(
+               rec, key, oldval, state->global);
+}
+
+NTSTATUS smbXsrv_open_update(struct smbXsrv_open *op)
+{
+       struct smbXsrv_open_update_state state = { .global = op->global, };
+       struct smbXsrv_open_table *table = op->table;
+       struct smbXsrv_open_global_key_buf key_buf;
+       TDB_DATA key = smbXsrv_open_global_id_to_key(
+               op->global->open_global_id, &key_buf);
        NTSTATUS status;
-       NTSTATUS error = NT_STATUS_OK;
 
-       if (op->table == NULL) {
-               return NT_STATUS_OK;
+       status = dbwrap_do_locked(
+               table->global.db_ctx, key, smbXsrv_open_update_fn, &state);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_WARNING("global_id (0x%08x) dbwrap_do_locked failed: %s\n",
+                           op->global->open_global_id,
+                           nt_errstr(status));
+               return NT_STATUS_INTERNAL_DB_ERROR;
        }
 
-       table = op->table;
-       op->table = NULL;
+       if (!NT_STATUS_IS_OK(state.status)) {
+               DBG_WARNING("global_id (0x%08x) smbXsrv_open_global_store "
+                           "failed: %s\n",
+                           op->global->open_global_id,
+                           nt_errstr(state.status));
+               return state.status;
+       }
 
-       op->status = NT_STATUS_FILE_CLOSED;
-       op->global->disconnect_time = now;
-       server_id_set_disconnected(&op->global->server_id);
+       status = smbXsrv_open_set_replay_cache(op);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_ERR("smbXsrv_open_set_replay_cache failed: %s\n",
+                       nt_errstr(status));
+               return status;
+       }
 
-       global_rec = op->global->db_rec;
-       op->global->db_rec = NULL;
-       if (global_rec == NULL) {
-               uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
-               TDB_DATA key;
+       if (CHECK_DEBUGLVL(10)) {
+               struct smbXsrv_openB open_blob = {
+                       .version = SMBXSRV_VERSION_0,
+                       .info.info0 = op,
+               };
 
-               key = smbXsrv_open_global_id_to_key(
-                                               op->global->open_global_id,
-                                               key_buf);
-
-               global_rec = dbwrap_fetch_locked(table->global.db_ctx,
-                                                op->global, key);
-               if (global_rec == NULL) {
-                       DEBUG(0, ("smbXsrv_open_close(0x%08x): "
-                                 "Failed to lock global key '%s'\n",
-                                 op->global->open_global_id,
-                                 hex_encode_talloc(global_rec, key.dptr,
-                                                   key.dsize)));
-                       error = NT_STATUS_INTERNAL_ERROR;
-               }
+               DEBUG(10,("smbXsrv_open_update: global_id (0x%08x) stored\n",
+                         op->global->open_global_id));
+               NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
        }
 
-       if (global_rec != NULL && op->global->durable) {
-               /*
-                * If it is a durable open we need to update the global part
-                * instead of deleting it
-                */
-               op->global->db_rec = global_rec;
-               status = smbXsrv_open_global_store(op->global);
-               if (NT_STATUS_IS_OK(status)) {
-                       /*
-                        * smbXsrv_open_global_store does the free
-                        * of op->global->db_rec
-                        */
-                       global_rec = NULL;
-               }
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(0,("smbXsrv_open_close(0x%08x)"
-                                "smbXsrv_open_global_store() failed - %s\n",
-                                op->global->open_global_id,
-                                nt_errstr(status)));
-                       error = status;
-               }
+       return NT_STATUS_OK;
+}
+
+struct smbXsrv_open_close_state {
+       struct smbXsrv_open *op;
+       NTSTATUS status;
+};
+
+static void smbXsrv_open_close_fn(
+       struct db_record *rec, TDB_DATA oldval, void *private_data)
+{
+       struct smbXsrv_open_close_state *state = private_data;
+       struct smbXsrv_open_global0 *global = state->op->global;
+       TDB_DATA key = dbwrap_record_get_key(rec);
 
-               if (NT_STATUS_IS_OK(status) && CHECK_DEBUGLVL(10)) {
-                       struct smbXsrv_openB open_blob;
+       if (global->durable) {
+               /*
+                * Durable open -- we need to update the global part
+                * instead of deleting it
+                */
+               state->status = smbXsrv_open_global_store(
+                       rec, key, oldval, global);
+               if (!NT_STATUS_IS_OK(state->status)) {
+                       DBG_WARNING("failed to store global key '%s': %s\n",
+                                   tdb_data_dbg(key),
+                                   nt_errstr(state->status));
+                       return;
+               }
 
-                       ZERO_STRUCT(open_blob);
-                       open_blob.version = SMBXSRV_VERSION_0;
-                       open_blob.info.info0 = op;
+               if (CHECK_DEBUGLVL(10)) {
+                       struct smbXsrv_openB open_blob = {
+                               .version = SMBXSRV_VERSION_0,
+                               .info.info0 = state->op,
+                       };
 
-                       DEBUG(10,("smbXsrv_open_close(0x%08x): "
-                                 "stored disconnect\n",
-                                 op->global->open_global_id));
+                       DBG_DEBUG("(0x%08x) stored disconnect\n",
+                                 global->open_global_id);
                        NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
                }
+               return;
        }
 
-       if (global_rec != NULL) {
-               status = dbwrap_record_delete(global_rec);
-               if (!NT_STATUS_IS_OK(status)) {
-                       TDB_DATA key = dbwrap_record_get_key(global_rec);
-
-                       DEBUG(0, ("smbXsrv_open_close(0x%08x): "
-                                 "failed to delete global key '%s': %s\n",
-                                 op->global->open_global_id,
-                                 hex_encode_talloc(global_rec, key.dptr,
-                                                   key.dsize),
-                                 nt_errstr(status)));
-                       error = status;
-               }
+       state->status = dbwrap_record_delete(rec);
+       if (!NT_STATUS_IS_OK(state->status)) {
+               DBG_WARNING("failed to delete global key '%s': %s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(state->status));
        }
-       TALLOC_FREE(global_rec);
+}
 
-       local_rec = op->db_rec;
-       if (local_rec == NULL) {
-               uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
-               TDB_DATA key;
+NTSTATUS smbXsrv_open_close(struct smbXsrv_open *op, NTTIME now)
+{
+       struct smbXsrv_open_close_state state = { .op = op, };
+       struct smbXsrv_open_global0 *global = op->global;
+       struct smbXsrv_open_table *table;
+       NTSTATUS status;
+       NTSTATUS error = NT_STATUS_OK;
+       struct smbXsrv_open_global_key_buf key_buf;
+       TDB_DATA key = smbXsrv_open_global_id_to_key(
+               global->open_global_id, &key_buf);
+       int ret;
 
-               key = smbXsrv_open_local_id_to_key(op->local_id, key_buf);
-
-               local_rec = dbwrap_fetch_locked(table->local.db_ctx,
-                                               op, key);
-               if (local_rec == NULL) {
-                       DEBUG(0, ("smbXsrv_open_close(0x%08x): "
-                                 "Failed to lock local key '%s'\n",
-                                 op->global->open_global_id,
-                                 hex_encode_talloc(local_rec, key.dptr,
-                                                   key.dsize)));
-                       error = NT_STATUS_INTERNAL_ERROR;
-               }
+       error = smbXsrv_open_clear_replay_cache(op);
+       if (!NT_STATUS_IS_OK(error)) {
+               DBG_ERR("smbXsrv_open_clear_replay_cache failed: %s\n",
+                       nt_errstr(error));
        }
 
-       if (local_rec != NULL) {
-               status = dbwrap_record_delete(local_rec);
-               if (!NT_STATUS_IS_OK(status)) {
-                       TDB_DATA key = dbwrap_record_get_key(local_rec);
-
-                       DEBUG(0, ("smbXsrv_open_close(0x%08x): "
-                                 "failed to delete local key '%s': %s\n",
-                                 op->global->open_global_id,
-                                 hex_encode_talloc(local_rec, key.dptr,
-                                                   key.dsize),
-                                 nt_errstr(status)));
-                       error = status;
-               }
-               table->local.num_opens -= 1;
+       if (op->table == NULL) {
+               return error;
        }
-       if (op->db_rec == NULL) {
-               TALLOC_FREE(local_rec);
+
+       table = op->table;
+       op->table = NULL;
+
+       op->status = NT_STATUS_FILE_CLOSED;
+       global->disconnect_time = now;
+       server_id_set_disconnected(&global->server_id);
+
+       status = dbwrap_do_locked(
+               table->global.db_ctx, key, smbXsrv_open_close_fn, &state);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_WARNING("dbwrap_do_locked() for %s failed: %s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(status));
+               error = status;
+       } else if (!NT_STATUS_IS_OK(state.status)) {
+               DBG_WARNING("smbXsrv_open_close_fn() for %s failed: %s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(state.status));
+               error = state.status;
        }
-       op->db_rec = NULL;
+
+       ret = idr_remove(table->local.idr, op->local_id);
+       SMB_ASSERT(ret == 0);
+
+       table->local.num_opens -= 1;
 
        if (op->compat) {
                op->compat->op = NULL;
@@ -1098,7 +881,7 @@ NTSTATUS smb1srv_open_table_init(struct smbXsrv_connection *conn)
         *
         * 0 and 0xFFFF are no valid ids.
         */
-       max_opens = conn->sconn->real_max_open_files;
+       max_opens = conn->client->sconn->real_max_open_files;
        max_opens = MIN(max_opens, UINT16_MAX - 1);
 
        return smbXsrv_open_table_init(conn, 1, UINT16_MAX - 1, max_opens);
@@ -1108,7 +891,7 @@ NTSTATUS smb1srv_open_lookup(struct smbXsrv_connection *conn,
                             uint16_t fnum, NTTIME now,
                             struct smbXsrv_open **_open)
 {
-       struct smbXsrv_open_table *table = conn->open_table;
+       struct smbXsrv_open_table *table = conn->client->open_table;
        uint32_t local_id = fnum;
        uint32_t global_id = 0;
 
@@ -1118,6 +901,7 @@ NTSTATUS smb1srv_open_lookup(struct smbXsrv_connection *conn,
 NTSTATUS smb2srv_open_table_init(struct smbXsrv_connection *conn)
 {
        uint32_t max_opens;
+       uint32_t highest_id;
 
        /*
         * Allow a range from 1..4294967294.
@@ -1132,10 +916,17 @@ NTSTATUS smb2srv_open_table_init(struct smbXsrv_connection *conn)
         * transport connection (as we still have a 1:1 mapping
         * between process and transport connection).
         */
-       max_opens = conn->sconn->real_max_open_files;
+       max_opens = conn->client->sconn->real_max_open_files;
        max_opens = MIN(max_opens, UINT16_MAX - 1);
 
-       return smbXsrv_open_table_init(conn, 1, UINT32_MAX - 1, max_opens);
+       /*
+        * idtree uses "int" for local IDs. Limit the maximum ID to
+        * what "int" can hold.
+        */
+       highest_id = UINT32_MAX-1;
+       highest_id = MIN(highest_id, INT_MAX);
+
+       return smbXsrv_open_table_init(conn, 1, highest_id, max_opens);
 }
 
 NTSTATUS smb2srv_open_lookup(struct smbXsrv_connection *conn,
@@ -1144,11 +935,12 @@ NTSTATUS smb2srv_open_lookup(struct smbXsrv_connection *conn,
                             NTTIME now,
                             struct smbXsrv_open **_open)
 {
-       struct smbXsrv_open_table *table = conn->open_table;
+       struct smbXsrv_open_table *table = conn->client->open_table;
        uint32_t local_id = volatile_id & UINT32_MAX;
        uint64_t local_zeros = volatile_id & 0xFFFFFFFF00000000LLU;
        uint32_t global_id = persistent_id & UINT32_MAX;
        uint64_t global_zeros = persistent_id & 0xFFFFFFFF00000000LLU;
+       NTSTATUS status;
 
        if (local_zeros != 0) {
                return NT_STATUS_FILE_CLOSED;
@@ -1162,173 +954,391 @@ NTSTATUS smb2srv_open_lookup(struct smbXsrv_connection *conn,
                return NT_STATUS_FILE_CLOSED;
        }
 
-       return smbXsrv_open_local_lookup(table, local_id, global_id, now, _open);
+       status = smbXsrv_open_local_lookup(table, local_id, global_id, now,
+                                          _open);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       /*
+        * Clear the replay cache for this create_guid if it exists:
+        * This is based on the assumption that this lookup will be
+        * triggered by a client request using the file-id for lookup.
+        * Hence the client has proven that it has in fact seen the
+        * reply to its initial create call. So subsequent create replays
+        * should be treated as invalid. Hence the index for create_guid
+        * lookup needs to be removed.
+        */
+       status = smbXsrv_open_clear_replay_cache(*_open);
+
+       return status;
 }
 
-NTSTATUS smb2srv_open_recreate(struct smbXsrv_connection *conn,
-                              struct auth_session_info *session_info,
-                              uint64_t persistent_id,
-                              const struct GUID *create_guid,
-                              NTTIME now,
-                              struct smbXsrv_open **_open)
+/*
+ * This checks or marks the replay cache, we have the following
+ * cases:
+ *
+ * 1. There is no record in the cache
+ *    => we add the passes caller_req_guid as holder_req_guid
+ *       together with local_id as 0.
+ *    => We return STATUS_FWP_RESERVED in order to indicate
+ *       that the caller holds the current reservation
+ *
+ * 2. There is a record in the cache and holder_req_guid
+ *    is already the same as caller_req_guid and local_id is 0
+ *    => We return STATUS_FWP_RESERVED in order to indicate
+ *       that the caller holds the current reservation
+ *
+ * 3. There is a record in the cache with a holder_req_guid
+ *    other than caller_req_guid (and local_id is 0):
+ *    => We return NT_STATUS_FILE_NOT_AVAILABLE to indicate
+ *       the original request is still pending
+ *
+ * 4. There is a record in the cache with a zero holder_req_guid
+ *    and a valid local_id:
+ *    => We lookup the existing open by local_id
+ *    => We return NT_STATUS_OK together with the smbXsrv_open
+ *
+ *
+ * With NT_STATUS_OK the caller can continue the replay processing.
+ *
+ * With STATUS_FWP_RESERVED the caller should continue the normal
+ * open processing:
+ * - On success:
+ *   - smbXsrv_open_update()/smbXsrv_open_set_replay_cache()
+ *     will convert the record to a zero holder_req_guid
+ *     with a valid local_id.
+ * - On failure:
+ *   - smbXsrv_open_purge_replay_cache() should cleanup
+ *     the reservation.
+ *
+ * All other values should be returned to the client,
+ * while NT_STATUS_FILE_NOT_AVAILABLE will trigger the
+ * retry loop on the client.
+ */
+NTSTATUS smb2srv_open_lookup_replay_cache(struct smbXsrv_connection *conn,
+                                         struct GUID caller_req_guid,
+                                         struct GUID create_guid,
+                                         const char *name,
+                                         NTTIME now,
+                                         struct smbXsrv_open **_open)
 {
-       struct smbXsrv_open_table *table = conn->open_table;
-       struct db_record *local_rec = NULL;
+       TALLOC_CTX *frame = talloc_stackframe();
+       NTSTATUS status;
+       struct smbXsrv_open_table *table = conn->client->open_table;
+       struct db_context *db = table->local.replay_cache_db_ctx;
+       struct GUID_txt_buf tmp_guid_buf;
+       struct GUID_txt_buf _create_guid_buf;
+       const char *create_guid_str = GUID_buf_string(&create_guid, &_create_guid_buf);
+       TDB_DATA create_guid_key = string_term_tdb_data(create_guid_str);
+       struct db_record *db_rec = NULL;
        struct smbXsrv_open *op = NULL;
-       void *ptr = NULL;
+       struct smbXsrv_open_replay_cache rc = {
+               .holder_req_guid = caller_req_guid,
+               .idle_time = now,
+               .local_id = 0,
+       };
+       enum ndr_err_code ndr_err;
+       DATA_BLOB blob = data_blob_null;
        TDB_DATA val;
-       uint32_t global_id = persistent_id & UINT32_MAX;
-       uint64_t global_zeros = persistent_id & 0xFFFFFFFF00000000LLU;
-       NTSTATUS status;
-       struct security_token *current_token = NULL;
 
-       if (session_info == NULL) {
-               return NT_STATUS_INVALID_HANDLE;
-       }
-       current_token = session_info->security_token;
+       *_open = NULL;
 
-       if (current_token == NULL) {
-               return NT_STATUS_INVALID_HANDLE;
+       db_rec = dbwrap_fetch_locked(db, frame, create_guid_key);
+       if (db_rec == NULL) {
+               TALLOC_FREE(frame);
+               return NT_STATUS_INTERNAL_DB_ERROR;
        }
 
-       if (global_zeros != 0) {
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       val = dbwrap_record_get_value(db_rec);
+       if (val.dsize == 0) {
+               uint8_t data[SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE];
+
+               blob = data_blob_const(data, ARRAY_SIZE(data));
+               ndr_err = ndr_push_struct_into_fixed_blob(&blob, &rc,
+                       (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_replay_cache);
+               if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                       status = ndr_map_error2ntstatus(ndr_err);
+                       TALLOC_FREE(frame);
+                       return status;
+               }
+
+               val = make_tdb_data(blob.data, blob.length);
+               status = dbwrap_record_store(db_rec, val, TDB_REPLACE);
+               if (!NT_STATUS_IS_OK(status)) {
+                       TALLOC_FREE(frame);
+                       return status;
+               }
+
+               /*
+                * We're the new holder
+                */
+               *_open = NULL;
+               TALLOC_FREE(frame);
+               return NT_STATUS_FWP_RESERVED;
        }
 
-       op = talloc_zero(table, struct smbXsrv_open);
-       if (op == NULL) {
-               return NT_STATUS_NO_MEMORY;
+       if (val.dsize != SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE) {
+               TALLOC_FREE(frame);
+               return NT_STATUS_INTERNAL_DB_CORRUPTION;
        }
-       op->table = table;
 
-       status = smbXsrv_open_global_lookup(table, global_id, op, &op->global);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(op);
+       blob = data_blob_const(val.dptr, val.dsize);
+       ndr_err = ndr_pull_struct_blob_all_noalloc(&blob, &rc,
+                       (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_replay_cache);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               status = ndr_map_error2ntstatus(ndr_err);
+               TALLOC_FREE(frame);
                return status;
        }
+       if (rc.local_id != 0) {
+               if (GUID_equal(&rc.holder_req_guid, &caller_req_guid)) {
+                       /*
+                        * This should not happen
+                        */
+                       status = NT_STATUS_INTERNAL_ERROR;
+                       DBG_ERR("caller %s already holds local_id %u for create %s [%s] - %s\n",
+                               GUID_buf_string(&caller_req_guid, &tmp_guid_buf),
+                               (unsigned)rc.local_id,
+                               create_guid_str,
+                               name,
+                               nt_errstr(status));
+
+                       TALLOC_FREE(frame);
+                       return status;
+               }
+
+               status = smbXsrv_open_local_lookup(table,
+                                                  rc.local_id,
+                                                  0, /* global_id */
+                                                  now,
+                                                  &op);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_ERR("holder %s stale for local_id %u for create %s [%s] - %s\n",
+                               GUID_buf_string(&rc.holder_req_guid, &tmp_guid_buf),
+                               (unsigned)rc.local_id,
+                               create_guid_str,
+                               name,
+                               nt_errstr(status));
+
+                       TALLOC_FREE(frame);
+                       return status;
+               }
+
+               /*
+                * We found an open the caller can reuse.
+                */
+               SMB_ASSERT(op != NULL);
+               *_open = op;
+               TALLOC_FREE(frame);
+               return NT_STATUS_OK;
+       }
+
+       if (GUID_equal(&rc.holder_req_guid, &caller_req_guid)) {
+               /*
+                * We're still the holder
+                */
+               *_open = NULL;
+               TALLOC_FREE(frame);
+               return NT_STATUS_FWP_RESERVED;
+       }
+
+       /*
+        * The original request (or a former replay) is still
+        * pending, ask the client to retry by sending FILE_NOT_AVAILABLE.
+        */
+       status = NT_STATUS_FILE_NOT_AVAILABLE;
+       DBG_DEBUG("holder %s still pending for create %s [%s] - %s\n",
+                  GUID_buf_string(&rc.holder_req_guid, &tmp_guid_buf),
+                  create_guid_str,
+                  name,
+                  nt_errstr(status));
+       TALLOC_FREE(frame);
+       return status;
+}
+
+struct smb2srv_open_recreate_state {
+       struct smbXsrv_open *op;
+       const struct GUID *create_guid;
+       struct security_token *current_token;
+       struct server_id me;
+
+       NTSTATUS status;
+};
+
+static void smb2srv_open_recreate_fn(
+       struct db_record *rec, TDB_DATA oldval, void *private_data)
+{
+       struct smb2srv_open_recreate_state *state = private_data;
+       TDB_DATA key = dbwrap_record_get_key(rec);
+       struct smbXsrv_open_global0 *global = NULL;
+
+       state->status = smbXsrv_open_global_verify_record(
+               key, oldval, state->op, &state->op->global);
+       if (!NT_STATUS_IS_OK(state->status)) {
+               DBG_WARNING("smbXsrv_open_global_verify_record for %s "
+                           "failed: %s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(state->status));
+               goto not_found;
+       }
+       global = state->op->global;
 
        /*
         * If the provided create_guid is NULL, this means that
         * the reconnect request was a v1 request. In that case
-        * we should skipt the create GUID verification, since
+        * we should skip the create GUID verification, since
         * it is valid to v1-reconnect a v2-opened handle.
         */
-       if ((create_guid != NULL) &&
-           !GUID_equal(&op->global->create_guid, create_guid))
-       {
-               TALLOC_FREE(op);
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       if ((state->create_guid != NULL) &&
+           !GUID_equal(&global->create_guid, state->create_guid)) {
+               struct GUID_txt_buf buf1, buf2;
+               DBG_NOTICE("%s != %s in %s\n",
+                          GUID_buf_string(&global->create_guid, &buf1),
+                          GUID_buf_string(state->create_guid, &buf2),
+                          tdb_data_dbg(key));
+               goto not_found;
+       }
+
+       if (!security_token_is_sid(
+                   state->current_token, &global->open_owner)) {
+               struct dom_sid_buf buf;
+               DBG_NOTICE("global owner %s not in our token in %s\n",
+                          dom_sid_str_buf(&global->open_owner, &buf),
+                          tdb_data_dbg(key));
+               goto not_found;
+       }
+
+       if (!global->durable) {
+               DBG_NOTICE("%"PRIu64"/%"PRIu64" not durable in %s\n",
+                          global->open_persistent_id,
+                          global->open_volatile_id,
+                          tdb_data_dbg(key));
+               goto not_found;
+       }
+
+       global->open_volatile_id = state->op->local_id;
+       global->server_id = state->me;
+
+       state->status = smbXsrv_open_global_store(rec, key, oldval, global);
+       if (!NT_STATUS_IS_OK(state->status)) {
+               DBG_WARNING("smbXsrv_open_global_store for %s failed: %s\n",
+                           tdb_data_dbg(key),
+                           nt_errstr(state->status));
+               return;
        }
+       return;
 
-       if (!security_token_is_sid(current_token, &op->global->open_owner)) {
-               TALLOC_FREE(op);
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+not_found:
+       state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
+}
+
+NTSTATUS smb2srv_open_recreate(struct smbXsrv_connection *conn,
+                              struct auth_session_info *session_info,
+                              uint64_t persistent_id,
+                              const struct GUID *create_guid,
+                              NTTIME now,
+                              struct smbXsrv_open **_open)
+{
+       struct smbXsrv_open_table *table = conn->client->open_table;
+       struct smb2srv_open_recreate_state state = {
+               .create_guid = create_guid,
+               .me = messaging_server_id(conn->client->msg_ctx),
+       };
+       struct smbXsrv_open_global_key_buf key_buf;
+       TDB_DATA key = smbXsrv_open_global_id_to_key(
+               persistent_id & UINT32_MAX, &key_buf);
+       int ret, local_id;
+       NTSTATUS status;
+
+       if (session_info == NULL) {
+               DEBUG(10, ("session_info=NULL\n"));
+               return NT_STATUS_INVALID_HANDLE;
        }
+       state.current_token = session_info->security_token;
 
-       if (!op->global->durable) {
-               TALLOC_FREE(op);
+       if (state.current_token == NULL) {
+               DEBUG(10, ("current_token=NULL\n"));
+               return NT_STATUS_INVALID_HANDLE;
+       }
+
+       if ((persistent_id & 0xFFFFFFFF00000000LLU) != 0) {
+               /*
+                * We only use 32 bit for the persistent ID
+                */
+               DBG_DEBUG("persistent_id=%"PRIx64"\n", persistent_id);
                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
        }
 
        if (table->local.num_opens >= table->local.max_opens) {
-               TALLOC_FREE(op);
                return NT_STATUS_INSUFFICIENT_RESOURCES;
        }
 
-       status = smbXsrv_open_local_allocate_id(table->local.db_ctx,
-                                               table->local.lowest_id,
-                                               table->local.highest_id,
-                                               op,
-                                               &local_rec,
-                                               &op->local_id);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(op);
-               return status;
+       state.op = talloc_zero(table, struct smbXsrv_open);
+       if (state.op == NULL) {
+               return NT_STATUS_NO_MEMORY;
        }
+       state.op->table = table;
 
-       op->idle_time = now;
-       op->status = NT_STATUS_FILE_CLOSED;
-
-       op->global->open_volatile_id = op->local_id;
-       op->global->server_id = messaging_server_id(conn->msg_ctx);
-
-       ptr = op;
-       val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
-       status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
-       TALLOC_FREE(local_rec);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(op);
-               return status;
+       local_id =  idr_get_new_random(
+               table->local.idr,
+               state.op,
+               table->local.lowest_id,
+               table->local.highest_id);
+       if (local_id == -1) {
+               TALLOC_FREE(state.op);
+               return NT_STATUS_INSUFFICIENT_RESOURCES;
        }
+       state.op->local_id = local_id;
+       SMB_ASSERT(state.op->local_id == local_id); /* No coercion loss */
+
        table->local.num_opens += 1;
 
-       talloc_set_destructor(op, smbXsrv_open_destructor);
+       state.op->idle_time = now;
+       state.op->status = NT_STATUS_FILE_CLOSED;
 
-       status = smbXsrv_open_global_store(op->global);
+       status = dbwrap_do_locked(
+               table->global.db_ctx, key, smb2srv_open_recreate_fn, &state);
        if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(op);
-               return status;
+               DBG_DEBUG("dbwrap_do_locked() for %s failed: %s\n",
+                         tdb_data_dbg(key),
+                         nt_errstr(status));
+               goto fail;
        }
 
-       if (CHECK_DEBUGLVL(10)) {
-               struct smbXsrv_openB open_blob;
+       if (!NT_STATUS_IS_OK(state.status)) {
+               status = state.status;
+               DBG_DEBUG("smb2srv_open_recreate_fn for %s failed: %s\n",
+                         tdb_data_dbg(key),
+                         nt_errstr(status));
+               goto fail;
+       }
 
-               ZERO_STRUCT(open_blob);
-               open_blob.version = 0;
-               open_blob.info.info0 = op;
+       talloc_set_destructor(state.op, smbXsrv_open_destructor);
 
-               DEBUG(10,("smbXsrv_open_recreate: global_id (0x%08x) stored\n",
-                        op->global->open_global_id));
+       if (CHECK_DEBUGLVL(10)) {
+               struct smbXsrv_openB open_blob = {
+                       .info.info0 = state.op,
+               };
+               DBG_DEBUG("global_id (0x%08x) stored\n",
+                         state.op->global->open_global_id);
                NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
        }
 
-       *_open = op;
-       return NT_STATUS_OK;
-}
-
-
-static NTSTATUS smbXsrv_open_global_parse_record(TALLOC_CTX *mem_ctx,
-                                                struct db_record *rec,
-                                                struct smbXsrv_open_global0 **global)
-{
-       TDB_DATA key = dbwrap_record_get_key(rec);
-       TDB_DATA val = dbwrap_record_get_value(rec);
-       DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
-       struct smbXsrv_open_globalB global_blob;
-       enum ndr_err_code ndr_err;
-       NTSTATUS status;
-       TALLOC_CTX *frame = talloc_stackframe();
-
-       ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
-                       (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_globalB);
-       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-               DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
-                        "key '%s' ndr_pull_struct_blob - %s\n",
-                        hex_encode_talloc(frame, key.dptr, key.dsize),
-                        ndr_errstr(ndr_err)));
-               status = ndr_map_error2ntstatus(ndr_err);
-               goto done;
-       }
+       *_open = state.op;
 
-       if (global_blob.version != SMBXSRV_VERSION_0) {
-               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
-               DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
-                        "key '%s' unsuported version - %d - %s\n",
-                        hex_encode_talloc(frame, key.dptr, key.dsize),
-                        (int)global_blob.version,
-                        nt_errstr(status)));
-               goto done;
-       }
+       return NT_STATUS_OK;
+fail:
+       table->local.num_opens -= 1;
 
-       *global = talloc_move(mem_ctx, &global_blob.info.info0);
-       status = NT_STATUS_OK;
-done:
-       talloc_free(frame);
+       ret = idr_remove(table->local.idr, state.op->local_id);
+       SMB_ASSERT(ret == 0);
+       TALLOC_FREE(state.op);
        return status;
 }
 
 struct smbXsrv_open_global_traverse_state {
-       int (*fn)(struct smbXsrv_open_global0 *, void *);
+       int (*fn)(struct db_record *rec, struct smbXsrv_open_global0 *, void *);
        void *private_data;
 };
 
@@ -1337,23 +1347,25 @@ static int smbXsrv_open_global_traverse_fn(struct db_record *rec, void *data)
        struct smbXsrv_open_global_traverse_state *state =
                (struct smbXsrv_open_global_traverse_state*)data;
        struct smbXsrv_open_global0 *global = NULL;
+       TDB_DATA key = dbwrap_record_get_key(rec);
+       TDB_DATA val = dbwrap_record_get_value(rec);
        NTSTATUS status;
        int ret = -1;
 
-       status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &global);
+       status = smbXsrv_open_global_parse_record(
+               talloc_tos(), key, val, &global);
        if (!NT_STATUS_IS_OK(status)) {
                return -1;
        }
 
-       global->db_rec = rec;
-       ret = state->fn(global, state->private_data);
+       ret = state->fn(rec, global, state->private_data);
        talloc_free(global);
        return ret;
 }
 
 NTSTATUS smbXsrv_open_global_traverse(
-                       int (*fn)(struct smbXsrv_open_global0 *, void *),
-                       void *private_data)
+       int (*fn)(struct db_record *rec, struct smbXsrv_open_global0 *, void *),
+       void *private_data)
 {
 
        NTSTATUS status;
@@ -1381,79 +1393,114 @@ NTSTATUS smbXsrv_open_global_traverse(
        return status;
 }
 
-NTSTATUS smbXsrv_open_cleanup(uint64_t persistent_id)
-{
+struct smbXsrv_open_cleanup_state {
+       uint32_t global_id;
        NTSTATUS status;
-       TALLOC_CTX *frame = talloc_stackframe();
-       struct smbXsrv_open_global0 *op = NULL;
-       uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
-       TDB_DATA key;
-       struct db_record *rec;
+};
+
+static void smbXsrv_open_cleanup_fn(
+       struct db_record *rec, TDB_DATA oldval, void *private_data)
+{
+       struct smbXsrv_open_cleanup_state *state = private_data;
+       struct smbXsrv_open_global0 *global = NULL;
+       TDB_DATA key = dbwrap_record_get_key(rec);
        bool delete_open = false;
-       uint32_t global_id = persistent_id & UINT32_MAX;
 
-       key = smbXsrv_open_global_id_to_key(global_id, key_buf);
-       rec = dbwrap_fetch_locked(smbXsrv_open_global_db_ctx, frame, key);
-       if (rec == NULL) {
-               status = NT_STATUS_NOT_FOUND;
-               DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
-                         "failed to fetch record from %s - %s\n",
-                          global_id, dbwrap_name(smbXsrv_open_global_db_ctx),
-                          nt_errstr(status)));
-               goto done;
+       if (oldval.dsize == 0) {
+               DBG_DEBUG("[global: 0x%08x] "
+                         "empty record in %s, skipping...\n",
+                         state->global_id,
+                         dbwrap_name(dbwrap_record_get_db(rec)));
+               state->status = NT_STATUS_OK;
+               return;
        }
 
-       status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &op);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
-                         "failed to read record: %s\n",
-                         global_id, nt_errstr(status)));
-               goto done;
+       state->status = smbXsrv_open_global_parse_record(
+               talloc_tos(), key, oldval, &global);
+       if (!NT_STATUS_IS_OK(state->status)) {
+               DBG_WARNING("[global: %x08x] "
+                           "smbXsrv_open_global_parse_record() in %s "
+                           "failed: %s, deleting record\n",
+                           state->global_id,
+                           dbwrap_name(dbwrap_record_get_db(rec)),
+                           nt_errstr(state->status));
+               delete_open = true;
+               goto do_delete;
        }
 
-       if (server_id_is_disconnected(&op->server_id)) {
-               struct timeval now, disconnect_time;
+       if (server_id_is_disconnected(&global->server_id)) {
+               struct timeval now = timeval_current();
+               struct timeval disconnect_time;
+               struct timeval_buf buf;
                int64_t tdiff;
-               now = timeval_current();
-               nttime_to_timeval(&disconnect_time, op->disconnect_time);
+
+               nttime_to_timeval(&disconnect_time, global->disconnect_time);
                tdiff = usec_time_diff(&now, &disconnect_time);
-               delete_open = (tdiff >= 1000*op->durable_timeout_msec);
-
-               DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
-                          "disconnected at [%s] %us ago with "
-                          "timeout of %us -%s reached\n",
-                          global_id,
-                          nt_time_string(frame, op->disconnect_time),
-                          (unsigned)(tdiff/1000000),
-                          op->durable_timeout_msec / 1000,
-                          delete_open ? "" : " not"));
-       } else if (!serverid_exists(&op->server_id)) {
-               DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
-                          "server[%s] does not exist\n",
-                          global_id, server_id_str(frame, &op->server_id)));
+               delete_open = (tdiff >= 1000*global->durable_timeout_msec);
+
+               DBG_DEBUG("[global: 0x%08x] "
+                         "disconnected at [%s] %"PRIi64"s ago with "
+                         "timeout of %"PRIu32"s -%s reached\n",
+                         state->global_id,
+                         timeval_str_buf(&disconnect_time,
+                                         false,
+                                         false,
+                                         &buf),
+                         tdiff/1000000,
+                         global->durable_timeout_msec / 1000,
+                         delete_open ? "" : " not");
+       } else if (!serverid_exists(&global->server_id)) {
+               struct server_id_buf idbuf;
+               DBG_DEBUG("[global: 0x%08x] "
+                         "server[%s] does not exist\n",
+                         state->global_id,
+                         server_id_str_buf(global->server_id, &idbuf));
                delete_open = true;
        }
 
        if (!delete_open) {
-               goto done;
+               state->status = NT_STATUS_OK;
+               return;
+       }
+do_delete:
+       state->status = dbwrap_record_delete(rec);
+       if (!NT_STATUS_IS_OK(state->status)) {
+               DBG_WARNING("[global: 0x%08x] "
+                           "failed to delete record "
+                           "from %s: %s\n",
+                           state->global_id,
+                           dbwrap_name(dbwrap_record_get_db(rec)),
+                           nt_errstr(state->status));
+               return;
        }
 
-       status = dbwrap_record_delete(rec);
+       DBG_DEBUG("[global: 0x%08x] "
+                 "deleted record from %s\n",
+                 state->global_id,
+                 dbwrap_name(dbwrap_record_get_db(rec)));
+}
+
+NTSTATUS smbXsrv_open_cleanup(uint64_t persistent_id)
+{
+       struct smbXsrv_open_cleanup_state state = {
+               .global_id = persistent_id & UINT32_MAX,
+       };
+       struct smbXsrv_open_global_key_buf key_buf;
+       TDB_DATA key = smbXsrv_open_global_id_to_key(
+               state.global_id, &key_buf);
+       NTSTATUS status;
+
+       status = dbwrap_do_locked(
+               smbXsrv_open_global_db_ctx,
+               key,
+               smbXsrv_open_cleanup_fn,
+               &state);
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
-                         "failed to delete record"
-                         "from %s: %s\n", global_id,
-                         dbwrap_name(smbXsrv_open_global_db_ctx),
-                         nt_errstr(status)));
-               goto done;
+               DBG_DEBUG("[global: 0x%08x] dbwrap_do_locked failed: %s\n",
+                         state.global_id,
+                         nt_errstr(status));
+               return status;
        }
 
-       DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
-                  "delete record from %s\n",
-                  global_id,
-                  dbwrap_name(smbXsrv_open_global_db_ctx)));
-
-done:
-       talloc_free(frame);
-       return status;
+       return state.status;
 }