CVE-2015-5296: s3:libsmb: force signing when requiring encryption in SMBC_server_inte...
[sfrench/samba-autobuild/.git] / source3 / libsmb / unexpected.c
index 109e2b454abf3623efb094f21cbc60ae3d0a4302..27d21b61f00e4fb1f0169edea72639eddd255e1f 100644 (file)
-/* 
-   Unix SMB/Netbios implementation.
-   Version 3.0
+/*
+   Unix SMB/CIFS implementation.
    handle unexpected packets
    Copyright (C) Andrew Tridgell 2000
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-   
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
 */
 
 #include "includes.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "lib/tsocket/tsocket.h"
+#include "libsmb/nmblib.h"
+#include "lib/util/sys_rw.h"
+
+static const char *nmbd_socket_dir(void)
+{
+       return lp_parm_const_string(-1, "nmbd", "socket dir",
+                                   get_dyn_NMBDSOCKETDIR());
+}
 
-extern int DEBUGLEVEL;
+struct nb_packet_query {
+       enum packet_type type;
+       size_t mailslot_namelen;
+       int trn_id;
+};
 
-static TDB_CONTEXT *tdbd = NULL;
+struct nb_packet_client;
 
-/* the key type used in the unexpeceted packet database */
-struct unexpected_key {
-       enum packet_type packet_type;
-       time_t timestamp;
-       int count;
+struct nb_packet_server {
+       struct tevent_context *ev;
+       int listen_sock;
+       struct tevent_fd *listen_fde;
+       int max_clients;
+       int num_clients;
+       struct nb_packet_client *clients;
 };
 
+struct nb_packet_client {
+       struct nb_packet_client *prev, *next;
+       struct nb_packet_server *server;
+
+       enum packet_type type;
+       int trn_id;
+       char *mailslot_name;
 
+       struct {
+               uint8_t byte;
+               struct iovec iov[1];
+       } ack;
 
-/****************************************************************************
- all unexpected packets are passed in here, to be stored in a unexpected
- packet database. This allows nmblookup and other tools to receive packets
- erroneoously sent to the wrong port by broken MS systems
-  **************************************************************************/
-void unexpected_packet(struct packet_struct *p)
+       struct tstream_context *sock;
+       struct tevent_queue *out_queue;
+};
+
+static int nb_packet_server_destructor(struct nb_packet_server *s);
+static void nb_packet_server_listener(struct tevent_context *ev,
+                                     struct tevent_fd *fde,
+                                     uint16_t flags,
+                                     void *private_data);
+
+NTSTATUS nb_packet_server_create(TALLOC_CTX *mem_ctx,
+                                struct tevent_context *ev,
+                                int max_clients,
+                                struct nb_packet_server **presult)
 {
-       static int count;
-       TDB_DATA kbuf, dbuf;
-       struct unexpected_key key;
-       char buf[1024];
-       int len=0;
-
-       if (!tdbd) {
-               tdbd = tdb_open_log(lock_path("unexpected.tdb"), 1, 
-                              TDB_CLEAR_IF_FIRST|USE_TDB_MMAP_FLAG,
-                              O_RDWR | O_CREAT, 0644);
-               if (!tdbd) {
-                       DEBUG(0,("Failed to open unexpected.tdb\n"));
+       struct nb_packet_server *result;
+       NTSTATUS status;
+       int rc;
+
+       result = talloc_zero(mem_ctx, struct nb_packet_server);
+       if (result == NULL) {
+               status = NT_STATUS_NO_MEMORY;
+               goto fail;
+       }
+       result->ev = ev;
+       result->max_clients = max_clients;
+
+       result->listen_sock = create_pipe_sock(
+               nmbd_socket_dir(), "unexpected", 0755);
+       if (result->listen_sock == -1) {
+               status = map_nt_error_from_unix(errno);
+               goto fail;
+       }
+       rc = listen(result->listen_sock, 5);
+       if (rc < 0) {
+               status = map_nt_error_from_unix(errno);
+               goto fail;
+       }
+       talloc_set_destructor(result, nb_packet_server_destructor);
+
+       result->listen_fde = tevent_add_fd(ev, result,
+                                          result->listen_sock,
+                                          TEVENT_FD_READ,
+                                          nb_packet_server_listener,
+                                          result);
+       if (result->listen_fde == NULL) {
+               status = NT_STATUS_NO_MEMORY;
+               goto fail;
+       }
+
+       *presult = result;
+       return NT_STATUS_OK;
+fail:
+       TALLOC_FREE(result);
+       return status;
+}
+
+static int nb_packet_server_destructor(struct nb_packet_server *s)
+{
+       TALLOC_FREE(s->listen_fde);
+
+       if (s->listen_sock != -1) {
+               close(s->listen_sock);
+               s->listen_sock = -1;
+       }
+       return 0;
+}
+
+static int nb_packet_client_destructor(struct nb_packet_client *c);
+static ssize_t nb_packet_client_more(uint8_t *buf, size_t buflen,
+                                    void *private_data);
+static void nb_packet_got_query(struct tevent_req *req);
+static void nb_packet_client_ack_done(struct tevent_req *req);
+static void nb_packet_client_read_done(struct tevent_req *req);
+
+static void nb_packet_server_listener(struct tevent_context *ev,
+                                     struct tevent_fd *fde,
+                                     uint16_t flags,
+                                     void *private_data)
+{
+       struct nb_packet_server *server = talloc_get_type_abort(
+               private_data, struct nb_packet_server);
+       struct nb_packet_client *client;
+       struct tevent_req *req;
+       struct sockaddr_un sunaddr;
+       socklen_t len;
+       int sock;
+       int ret;
+
+       len = sizeof(sunaddr);
+
+       sock = accept(server->listen_sock, (struct sockaddr *)(void *)&sunaddr,
+                     &len);
+       if (sock == -1) {
+               return;
+       }
+       DEBUG(6,("accepted socket %d\n", sock));
+
+       client = talloc_zero(server, struct nb_packet_client);
+       if (client == NULL) {
+               DEBUG(10, ("talloc failed\n"));
+               close(sock);
+               return;
+       }
+       ret = tstream_bsd_existing_socket(client, sock, &client->sock);
+       if (ret != 0) {
+               DEBUG(10, ("tstream_bsd_existing_socket failed\n"));
+               close(sock);
+               return;
+       }
+
+       client->server = server;
+       talloc_set_destructor(client, nb_packet_client_destructor);
+
+       client->out_queue = tevent_queue_create(
+               client, "unexpected packet output");
+       if (client->out_queue == NULL) {
+               DEBUG(10, ("tevent_queue_create failed\n"));
+               TALLOC_FREE(client);
+               return;
+       }
+
+       req = tstream_read_packet_send(client, ev, client->sock,
+                                      sizeof(struct nb_packet_query),
+                                      nb_packet_client_more, NULL);
+       if (req == NULL) {
+               DEBUG(10, ("tstream_read_packet_send failed\n"));
+               TALLOC_FREE(client);
+               return;
+       }
+       tevent_req_set_callback(req, nb_packet_got_query, client);
+
+       DLIST_ADD(server->clients, client);
+       server->num_clients += 1;
+
+       if (server->num_clients > server->max_clients) {
+               DEBUG(10, ("Too many clients, dropping oldest\n"));
+
+               /*
+                * no TALLOC_FREE here, don't mess with the list structs
+                */
+               talloc_free(server->clients->prev);
+       }
+}
+
+static ssize_t nb_packet_client_more(uint8_t *buf, size_t buflen,
+                                    void *private_data)
+{
+       struct nb_packet_query q;
+       if (buflen > sizeof(struct nb_packet_query)) {
+               return 0;
+       }
+       /* Take care of alignment */
+       memcpy(&q, buf, sizeof(q));
+       if (q.mailslot_namelen > 1024) {
+               DEBUG(10, ("Got invalid mailslot namelen %d\n",
+                          (int)q.mailslot_namelen));
+               return -1;
+       }
+       return q.mailslot_namelen;
+}
+
+static int nb_packet_client_destructor(struct nb_packet_client *c)
+{
+       tevent_queue_stop(c->out_queue);
+       TALLOC_FREE(c->sock);
+
+       DLIST_REMOVE(c->server->clients, c);
+       c->server->num_clients -= 1;
+       return 0;
+}
+
+static void nb_packet_got_query(struct tevent_req *req)
+{
+       struct nb_packet_client *client = tevent_req_callback_data(
+               req, struct nb_packet_client);
+       struct nb_packet_query q;
+       uint8_t *buf;
+       ssize_t nread;
+       int err;
+
+       nread = tstream_read_packet_recv(req, talloc_tos(), &buf, &err);
+       TALLOC_FREE(req);
+       if (nread < (ssize_t)sizeof(struct nb_packet_query)) {
+               DEBUG(10, ("read_packet_recv returned %d (%s)\n",
+                          (int)nread,
+                          (nread == -1) ? strerror(err) : "wrong length"));
+               TALLOC_FREE(client);
+               return;
+       }
+
+       /* Take care of alignment */
+       memcpy(&q, buf, sizeof(q));
+
+       if (nread != sizeof(struct nb_packet_query) + q.mailslot_namelen) {
+               DEBUG(10, ("nb_packet_got_query: Invalid mailslot namelength\n"));
+               TALLOC_FREE(client);
+               return;
+       }
+
+       client->trn_id = q.trn_id;
+       client->type = q.type;
+       if (q.mailslot_namelen > 0) {
+               client->mailslot_name = talloc_strndup(
+                       client, (char *)buf + sizeof(q),
+                       q.mailslot_namelen);
+               if (client->mailslot_name == NULL) {
+                       TALLOC_FREE(client);
                        return;
                }
        }
 
-       memset(buf,'\0',sizeof(buf));
-       
-       len = build_packet(buf, p);
+       client->ack.byte = 0;
+       client->ack.iov[0].iov_base = &client->ack.byte;
+       client->ack.iov[0].iov_len = 1;
+       req = tstream_writev_queue_send(client, client->server->ev,
+                                       client->sock,
+                                       client->out_queue,
+                                       client->ack.iov, 1);
+       if (req == NULL) {
+               DEBUG(10, ("tstream_writev_queue_send failed\n"));
+               TALLOC_FREE(client);
+               return;
+       }
+       tevent_req_set_callback(req, nb_packet_client_ack_done, client);
+
+       req = tstream_read_packet_send(client, client->server->ev,
+                                      client->sock, 1, NULL, NULL);
+       if (req == NULL) {
+               DEBUG(10, ("Could not activate reader for client exit "
+                          "detection\n"));
+               TALLOC_FREE(client);
+               return;
+       }
+       tevent_req_set_callback(req, nb_packet_client_read_done,
+                               client);
+}
+
+static void nb_packet_client_ack_done(struct tevent_req *req)
+{
+       struct nb_packet_client *client = tevent_req_callback_data(
+               req, struct nb_packet_client);
+       ssize_t nwritten;
+       int err;
 
-       key.packet_type = p->packet_type;
-       key.timestamp = p->timestamp;
-       key.count = count++;
+       nwritten = tstream_writev_queue_recv(req, &err);
 
-       kbuf.dptr = (char *)&key;
-       kbuf.dsize = sizeof(key);
-       dbuf.dptr = buf;
-       dbuf.dsize = len;
+       TALLOC_FREE(req);
 
-       tdb_store(tdbd, kbuf, dbuf, TDB_REPLACE);
+       if (nwritten == -1) {
+               DEBUG(10, ("tstream_writev_queue_recv failed: %s\n",
+                          strerror(err)));
+               TALLOC_FREE(client);
+               return;
+       }
 }
 
+static void nb_packet_client_read_done(struct tevent_req *req)
+{
+       struct nb_packet_client *client = tevent_req_callback_data(
+               req, struct nb_packet_client);
+       ssize_t nread;
+       uint8_t *buf;
+       int err;
+
+       nread = tstream_read_packet_recv(req, talloc_tos(), &buf, &err);
+       TALLOC_FREE(req);
+       if (nread == 1) {
+               DEBUG(10, ("Protocol error, received data on write-only "
+                          "unexpected socket: 0x%2.2x\n", (*buf)));
+       }
+       TALLOC_FREE(client);
+}
 
-static time_t lastt;
+static void nb_packet_client_send(struct nb_packet_client *client,
+                                 struct packet_struct *p);
 
-/****************************************************************************
-delete the record if it is too old
-  **************************************************************************/
-static int traverse_fn(TDB_CONTEXT *ttdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
+void nb_packet_dispatch(struct nb_packet_server *server,
+                       struct packet_struct *p)
 {
-       struct unexpected_key key;
+       struct nb_packet_client *c;
+       uint16_t trn_id;
+
+       switch (p->packet_type) {
+       case NMB_PACKET:
+               trn_id = p->packet.nmb.header.name_trn_id;
+               break;
+       case DGRAM_PACKET:
+               trn_id = p->packet.dgram.header.dgm_id;
+               break;
+       default:
+               DEBUG(10, ("Got invalid packet type %d\n",
+                          (int)p->packet_type));
+               return;
+       }
+       for (c = server->clients; c != NULL; c = c->next) {
 
-       memcpy(&key, kbuf.dptr, sizeof(key));
+               if (c->type != p->packet_type) {
+                       DEBUG(10, ("client expects packet %d, got %d\n",
+                                  c->type, p->packet_type));
+                       continue;
+               }
 
-       if (lastt - key.timestamp > NMBD_UNEXPECTED_TIMEOUT) {
-               tdb_delete(ttdb, kbuf);
+               if (p->packet_type == NMB_PACKET) {
+                       /*
+                        * See if the client specified transaction
+                        * ID. Filter if it did.
+                        */
+                       if ((c->trn_id != -1) &&
+                           (c->trn_id != trn_id)) {
+                               DEBUG(10, ("client expects trn %d, got %d\n",
+                                          c->trn_id, trn_id));
+                               continue;
+                       }
+               } else {
+                       /*
+                        * See if the client specified a mailslot
+                        * name. Filter if it did.
+                        */
+                       if ((c->mailslot_name != NULL) &&
+                           !match_mailslot_name(p, c->mailslot_name)) {
+                               continue;
+                       }
+               }
+               nb_packet_client_send(c, p);
        }
-
-       return 0;
 }
 
+struct nb_packet_client_header {
+       size_t len;
+       enum packet_type type;
+       time_t timestamp;
+       struct in_addr ip;
+       int port;
+};
+
+struct nb_packet_client_state {
+       struct nb_packet_client *client;
+       struct iovec iov[2];
+       struct nb_packet_client_header hdr;
+       char buf[1024];
+};
+
+static void nb_packet_client_send_done(struct tevent_req *req);
 
-/****************************************************************************
-delete all old unexpected packets
-  **************************************************************************/
-void clear_unexpected(time_t t)
+static void nb_packet_client_send(struct nb_packet_client *client,
+                                 struct packet_struct *p)
 {
-       if (!tdbd) return;
+       struct nb_packet_client_state *state;
+       struct tevent_req *req;
+
+       if (tevent_queue_length(client->out_queue) > 10) {
+               /*
+                * Skip clients that don't listen anyway, some form of DoS
+                * protection
+                */
+               return;
+       }
+
+       state = talloc_zero(client, struct nb_packet_client_state);
+       if (state == NULL) {
+               DEBUG(10, ("talloc failed\n"));
+               return;
+       }
 
-       if ((lastt != 0) && (t < lastt + NMBD_UNEXPECTED_TIMEOUT))
+       state->client = client;
+
+       state->hdr.ip = p->ip;
+       state->hdr.port = p->port;
+       state->hdr.timestamp = p->timestamp;
+       state->hdr.type = p->packet_type;
+       state->hdr.len = build_packet(state->buf, sizeof(state->buf), p);
+
+       state->iov[0].iov_base = (char *)&state->hdr;
+       state->iov[0].iov_len = sizeof(state->hdr);
+       state->iov[1].iov_base = state->buf;
+       state->iov[1].iov_len = state->hdr.len;
+
+       req = tstream_writev_queue_send(state, client->server->ev,
+                                       client->sock,
+                                       client->out_queue,
+                                       state->iov, 2);
+       if (req == NULL) {
+               DEBUG(10, ("tstream_writev_queue_send failed\n"));
                return;
+       }
+       tevent_req_set_callback(req, nb_packet_client_send_done, state);
+}
+
+static void nb_packet_client_send_done(struct tevent_req *req)
+{
+       struct nb_packet_client_state *state = tevent_req_callback_data(
+               req, struct nb_packet_client_state);
+       struct nb_packet_client *client = state->client;
+       ssize_t nwritten;
+       int err;
 
-       lastt = t;
+       nwritten = tstream_writev_queue_recv(req, &err);
 
-       tdb_traverse(tdbd, traverse_fn, NULL);
+       TALLOC_FREE(req);
+       TALLOC_FREE(state);
+
+       if (nwritten == -1) {
+               DEBUG(10, ("tstream_writev_queue failed: %s\n", strerror(err)));
+               TALLOC_FREE(client);
+               return;
+       }
 }
 
+struct nb_packet_reader {
+       struct tstream_context *sock;
+};
+
+struct nb_packet_reader_state {
+       struct tevent_context *ev;
+       struct nb_packet_query query;
+       const char *mailslot_name;
+       struct iovec iov[2];
+       char c;
+       struct nb_packet_reader *reader;
+};
 
-static struct packet_struct *matched_packet;
-static int match_id;
-static enum packet_type match_type;
-static char *match_name;
+static void nb_packet_reader_connected(struct tevent_req *subreq);
+static void nb_packet_reader_sent_query(struct tevent_req *subreq);
+static void nb_packet_reader_got_ack(struct tevent_req *subreq);
 
-/****************************************************************************
-tdb traversal fn to find a matching 137 packet
-  **************************************************************************/
-static int traverse_match(TDB_CONTEXT *ttdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
+struct tevent_req *nb_packet_reader_send(TALLOC_CTX *mem_ctx,
+                                        struct tevent_context *ev,
+                                        enum packet_type type,
+                                        int trn_id,
+                                        const char *mailslot_name)
 {
-       struct unexpected_key key;
-       struct packet_struct *p;
+       struct tevent_req *req, *subreq;
+       struct nb_packet_reader_state *state;
+       struct tsocket_address *laddr;
+       char *rpath;
+       struct tsocket_address *raddr;
+       int ret;
+
+       req = tevent_req_create(mem_ctx, &state,
+                               struct nb_packet_reader_state);
+       if (req == NULL) {
+               return NULL;
+       }
+       state->ev = ev;
+       state->query.trn_id = trn_id;
+       state->query.type = type;
+       state->mailslot_name = mailslot_name;
 
-       memcpy(&key, kbuf.dptr, sizeof(key));
+       if (mailslot_name != NULL) {
+               state->query.mailslot_namelen = strlen(mailslot_name);
+       }
+
+       state->reader = talloc_zero(state, struct nb_packet_reader);
+       if (tevent_req_nomem(state->reader, req)) {
+               return tevent_req_post(req, ev);
+       }
 
-       if (key.packet_type != match_type) return 0;
+       ret = tsocket_address_unix_from_path(state, "", &laddr);
+       if (ret != 0) {
+               tevent_req_nterror(req, map_nt_error_from_unix(errno));
+               return tevent_req_post(req, ev);
+       }
+       rpath = talloc_asprintf(state, "%s/%s", nmbd_socket_dir(),
+                              "unexpected");
+       if (tevent_req_nomem(rpath, req)) {
+               return tevent_req_post(req, ev);
+       }
+       ret = tsocket_address_unix_from_path(state, rpath, &raddr);
+       if (ret != 0) {
+               tevent_req_nterror(req, map_nt_error_from_unix(errno));
+               return tevent_req_post(req, ev);
+       }
 
-       p = parse_packet(dbuf.dptr, dbuf.dsize, match_type);
+       subreq = tstream_unix_connect_send(state, ev, laddr, raddr);
+       if (tevent_req_nomem(subreq, req)) {
+               return tevent_req_post(req, ev);
+       }
+       tevent_req_set_callback(subreq, nb_packet_reader_connected, req);
+       return req;
+}
 
-       if ((match_type == NMB_PACKET && 
-            p->packet.nmb.header.name_trn_id == match_id) ||
-           (match_type == DGRAM_PACKET && 
-            match_mailslot_name(p, match_name))) {
-               matched_packet = p;
-               return -1;
+static void nb_packet_reader_connected(struct tevent_req *subreq)
+{
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct nb_packet_reader_state *state = tevent_req_data(
+               req, struct nb_packet_reader_state);
+       int res, err;
+       int num_iovecs = 1;
+
+       res = tstream_unix_connect_recv(subreq, &err, state->reader,
+                                       &state->reader->sock);
+       TALLOC_FREE(subreq);
+       if (res == -1) {
+               DEBUG(10, ("tstream_unix_connect failed: %s\n", strerror(err)));
+               tevent_req_nterror(req, map_nt_error_from_unix(err));
+               return;
        }
 
-       free_packet(p);
+       state->iov[0].iov_base = (char *)&state->query;
+       state->iov[0].iov_len = sizeof(state->query);
 
-       return 0;
+       if (state->mailslot_name != NULL) {
+               num_iovecs = 2;
+               state->iov[1].iov_base = discard_const_p(
+                       char, state->mailslot_name);
+               state->iov[1].iov_len = state->query.mailslot_namelen;
+       }
+
+       subreq = tstream_writev_send(state, state->ev, state->reader->sock,
+                                    state->iov, num_iovecs);
+       if (tevent_req_nomem(subreq, req)) {
+               return;
+       }
+       tevent_req_set_callback(subreq, nb_packet_reader_sent_query, req);
+}
+
+static void nb_packet_reader_sent_query(struct tevent_req *subreq)
+{
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct nb_packet_reader_state *state = tevent_req_data(
+               req, struct nb_packet_reader_state);
+       ssize_t written;
+       int err;
+
+       written = tstream_writev_recv(subreq, &err);
+       TALLOC_FREE(subreq);
+       if (written == -1) {
+               tevent_req_nterror(req, map_nt_error_from_unix(err));
+               return;
+       }
+       if (written != sizeof(state->query) + state->query.mailslot_namelen) {
+               tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
+               return;
+       }
+       subreq = tstream_read_packet_send(state, state->ev,
+                                         state->reader->sock,
+                                         sizeof(state->c), NULL, NULL);
+       if (tevent_req_nomem(subreq, req)) {
+               return;
+       }
+       tevent_req_set_callback(subreq, nb_packet_reader_got_ack, req);
+}
+
+static void nb_packet_reader_got_ack(struct tevent_req *subreq)
+{
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct nb_packet_reader_state *state = tevent_req_data(
+               req, struct nb_packet_reader_state);
+       ssize_t nread;
+       int err;
+       uint8_t *buf;
+
+       nread = tstream_read_packet_recv(subreq, state, &buf, &err);
+       TALLOC_FREE(subreq);
+       if (nread == -1) {
+               DEBUG(10, ("read_packet_recv returned %s\n",
+                          strerror(err)));
+               tevent_req_nterror(req, map_nt_error_from_unix(err));
+               return;
+       }
+       if (nread != sizeof(state->c)) {
+               DEBUG(10, ("read = %d, expected %d\n", (int)nread,
+                          (int)sizeof(state->c)));
+               tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
+               return;
+       }
+       tevent_req_done(req);
+}
+
+NTSTATUS nb_packet_reader_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+                              struct nb_packet_reader **preader)
+{
+       struct nb_packet_reader_state *state = tevent_req_data(
+               req, struct nb_packet_reader_state);
+       NTSTATUS status;
+
+       if (tevent_req_is_nterror(req, &status)) {
+               tevent_req_received(req);
+               return status;
+       }
+       *preader = talloc_move(mem_ctx, &state->reader);
+       tevent_req_received(req);
+       return NT_STATUS_OK;
 }
 
+struct nb_packet_read_state {
+       struct nb_packet_client_header hdr;
+       uint8_t *buf;
+       size_t buflen;
+};
+
+static ssize_t nb_packet_read_more(uint8_t *buf, size_t buflen, void *p);
+static void nb_packet_read_done(struct tevent_req *subreq);
 
-/****************************************************************************
-check for a particular packet in the unexpected packet queue
-  **************************************************************************/
-struct packet_struct *receive_unexpected(enum packet_type packet_type, int id, 
-                                        char *mailslot_name)
+struct tevent_req *nb_packet_read_send(TALLOC_CTX *mem_ctx,
+                                      struct tevent_context *ev,
+                                      struct nb_packet_reader *reader)
 {
-       TDB_CONTEXT *tdb2;
+       struct tevent_req *req, *subreq;
+       struct nb_packet_read_state *state;
+
+       req = tevent_req_create(mem_ctx, &state, struct nb_packet_read_state);
+       if (req == NULL) {
+               return NULL;
+       }
+       subreq = tstream_read_packet_send(state, ev, reader->sock,
+                                         sizeof(struct nb_packet_client_header),
+                                         nb_packet_read_more, state);
+       if (tevent_req_nomem(subreq, req)) {
+               return tevent_req_post(req, ev);
+       }
+       tevent_req_set_callback(subreq, nb_packet_read_done, req);
+       return req;
+}
 
-       tdb2 = tdb_open(lock_path("unexpected.tdb"), 0, 0, O_RDONLY, 0);
-       if (!tdb2) return NULL;
+static ssize_t nb_packet_read_more(uint8_t *buf, size_t buflen, void *p)
+{
+       struct nb_packet_read_state *state = talloc_get_type_abort(
+               p, struct nb_packet_read_state);
+
+       if (buflen > sizeof(struct nb_packet_client_header)) {
+               /*
+                * Been here, done
+                */
+               return 0;
+       }
+       memcpy(&state->hdr, buf, sizeof(struct nb_packet_client_header));
+       return state->hdr.len;
+}
 
-       matched_packet = NULL;
-       match_id = id;
-       match_type = packet_type;
-       match_name = mailslot_name;
+static void nb_packet_read_done(struct tevent_req *subreq)
+{
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct nb_packet_read_state *state = tevent_req_data(
+               req, struct nb_packet_read_state);
+       ssize_t nread;
+       int err;
+
+       nread = tstream_read_packet_recv(subreq, state, &state->buf, &err);
+       if (nread == -1) {
+               tevent_req_nterror(req, map_nt_error_from_unix(err));
+               return;
+       }
+       state->buflen = nread;
+       tevent_req_done(req);
+}
 
-       tdb_traverse(tdb2, traverse_match, NULL);
+NTSTATUS nb_packet_read_recv(struct tevent_req *req,
+                            struct packet_struct **ppacket)
+{
+       struct nb_packet_read_state *state = tevent_req_data(
+               req, struct nb_packet_read_state);
+       struct nb_packet_client_header hdr;
+       struct packet_struct *packet;
+       NTSTATUS status;
+
+       if (tevent_req_is_nterror(req, &status)) {
+               tevent_req_received(req);
+               return status;
+       }
 
-       tdb_close(tdb2);
+       memcpy(&hdr, state->buf, sizeof(hdr));
 
-       return matched_packet;
+       packet = parse_packet(
+               (char *)state->buf + sizeof(struct nb_packet_client_header),
+               state->buflen - sizeof(struct nb_packet_client_header),
+               state->hdr.type, state->hdr.ip, state->hdr.port);
+       if (packet == NULL) {
+               tevent_req_received(req);
+               return NT_STATUS_INVALID_NETWORK_RESPONSE;
+       }
+       *ppacket = packet;
+       tevent_req_received(req);
+       return NT_STATUS_OK;
 }