s4:ldap_server: rewrite to socket layer to use tstream

This should make our sasl and tls handling much more robust
against partial sent pdus.

metze

4 files changed, 697 insertions, 308 deletions

diff --git a/source4/ldap_server/ldap_bind.c b/source4/ldap_server/ldap_bind.c
index c97211cb2c..5036353a4b 100644
--- a/source4/ldap_server/ldap_bind.c
+++ b/source4/ldap_server/ldap_bind.c
@@ -25,7 +25,9 @@
 #include "lib/ldb/include/ldb_errors.h"
 #include "dsdb/samdb/samdb.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_tstream.h"
 #include "param/param.h"
+#include "../lib/util/tevent_ntstatus.h"
 
 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
 {
@@ -94,20 +96,42 @@ static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
 	return NT_STATUS_OK;
 }
 
-struct ldapsrv_sasl_context {
+struct ldapsrv_sasl_postprocess_context {
 	struct ldapsrv_connection *conn;
-	struct socket_context *sasl_socket;
+	struct tstream_context *sasl;
 };
 
-static void ldapsrv_set_sasl(void *private_data)
+struct ldapsrv_sasl_postprocess_state {
+	uint8_t dummy;
+};
+
+static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
+						struct tevent_context *ev,
+						void *private_data)
 {
-	struct ldapsrv_sasl_context *ctx = talloc_get_type(private_data, struct ldapsrv_sasl_context);
-	talloc_steal(ctx->conn->connection, ctx->sasl_socket);
-	talloc_unlink(ctx->conn->connection, ctx->conn->connection->socket);
+	struct ldapsrv_sasl_postprocess_context *context =
+		talloc_get_type_abort(private_data,
+		struct ldapsrv_sasl_postprocess_context);
+	struct tevent_req *req;
+	struct ldapsrv_sasl_postprocess_state *state;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_sasl_postprocess_state);
+	if (req == NULL) {
+		return NULL;
+	}
 
-	ctx->conn->sockets.sasl = ctx->sasl_socket;
-	ctx->conn->connection->socket = ctx->sasl_socket;
-	packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
+	TALLOC_FREE(context->conn->sockets.sasl);
+	context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
+	context->conn->sockets.active = context->conn->sockets.sasl;
+
+	tevent_req_done(req);
+	return tevent_req_post(req, ev);
+}
+
+static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
 }
 
 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
@@ -152,7 +176,7 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 			errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s", 
 						 nt_errstr(status));
 		} else {
-		
+
 			gensec_want_feature(conn->gensec, GENSEC_FEATURE_SIGN);
 			gensec_want_feature(conn->gensec, GENSEC_FEATURE_SEAL);
 			gensec_want_feature(conn->gensec, GENSEC_FEATURE_ASYNC_REPLIES);
@@ -193,27 +217,41 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 		errstr = NULL;
 	} else if (NT_STATUS_IS_OK(status)) {
 		struct auth_session_info *old_session_info=NULL;
-		struct ldapsrv_sasl_context *ctx;
+		struct ldapsrv_sasl_postprocess_context *context = NULL;
 
 		result = LDAP_SUCCESS;
 		errstr = NULL;
 
-		ctx = talloc(call, struct ldapsrv_sasl_context); 
+		if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
+		    gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
 
-		if (!ctx) {
-			status = NT_STATUS_NO_MEMORY;
-		} else {
-			ctx->conn = conn;
-			status = gensec_socket_init(conn->gensec, 
-						    conn->connection,
-						    conn->connection->socket,
-						    conn->connection->event.ctx, 
-						    stream_io_handler_callback,
-						    conn->connection,
-						    &ctx->sasl_socket);
-		} 
-
-		if (!ctx || !NT_STATUS_IS_OK(status)) {
+			context = talloc(call, struct ldapsrv_sasl_postprocess_context);
+
+			if (!context) {
+				status = NT_STATUS_NO_MEMORY;
+			}
+		}
+
+		if (context && conn->sockets.tls) {
+			TALLOC_FREE(context);
+			status = NT_STATUS_NOT_SUPPORTED;
+			result = LDAP_UNWILLING_TO_PERFORM;
+			errstr = talloc_asprintf(reply,
+						 "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
+						 req->creds.SASL.mechanism);
+		}
+
+		if (context) {
+			context->conn = conn;
+			status = gensec_create_tstream(context,
+						       context->conn->gensec,
+						       context->conn->sockets.raw,
+						       &context->sasl);
+		}
+
+		if (result != LDAP_SUCCESS) {
+			conn->session_info = old_session_info;
+		} else if (!NT_STATUS_IS_OK(status)) {
 			conn->session_info = old_session_info;
 			result = LDAP_OPERATIONS_ERROR;
 			errstr = talloc_asprintf(reply, 
@@ -221,9 +259,6 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 						 req->creds.SASL.mechanism, nt_errstr(status));
 		} else {
 
-			call->send_callback = ldapsrv_set_sasl;
-			call->send_private = ctx;
-		
 			old_session_info = conn->session_info;
 			conn->session_info = NULL;
 			status = gensec_session_info(conn->gensec, &conn->session_info);
@@ -251,6 +286,12 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 				}
 			}
 		}
+
+		if (NT_STATUS_IS_OK(status) && context) {
+			call->postprocess_send = ldapsrv_sasl_postprocess_send;
+			call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
+			call->postprocess_private = context;
+		}
 	} else {
 		status = auth_nt_status_squash(status);
 		if (result == 0) {
diff --git a/source4/ldap_server/ldap_extended.c b/source4/ldap_server/ldap_extended.c
index 78fd43caac..f70b8084d7 100644
--- a/source4/ldap_server/ldap_extended.c
+++ b/source4/ldap_server/ldap_extended.c
@@ -22,28 +22,91 @@
 #include "../lib/util/dlinklist.h"
 #include "lib/tls/tls.h"
 #include "smbd/service_stream.h"
+#include "../lib/util/tevent_ntstatus.h"
 
-struct ldapsrv_starttls_context {
+struct ldapsrv_starttls_postprocess_context {
 	struct ldapsrv_connection *conn;
-	struct socket_context *tls_socket;
 };
 
-static void ldapsrv_start_tls(void *private_data)
+struct ldapsrv_starttls_postprocess_state {
+	struct ldapsrv_connection *conn;
+};
+
+static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq);
+
+static struct tevent_req *ldapsrv_starttls_postprocess_send(TALLOC_CTX *mem_ctx,
+						struct tevent_context *ev,
+						void *private_data)
+{
+	struct ldapsrv_starttls_postprocess_context *context =
+		talloc_get_type_abort(private_data,
+		struct ldapsrv_starttls_postprocess_context);
+	struct ldapsrv_connection *conn = context->conn;
+	struct tevent_req *req;
+	struct ldapsrv_starttls_postprocess_state *state;
+	struct tevent_req *subreq;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_starttls_postprocess_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	state->conn = conn;
+
+	subreq = tstream_tls_accept_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.raw,
+					 conn->service->tls_params);
+	if (tevent_req_nomem(subreq, req)) {
+		return tevent_req_post(req, ev);
+	}
+	tevent_req_set_callback(subreq, ldapsrv_starttls_postprocess_done, req);
+
+	return req;
+}
+
+static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq)
 {
-	struct ldapsrv_starttls_context *ctx = talloc_get_type(private_data, struct ldapsrv_starttls_context);
-	talloc_steal(ctx->conn->connection, ctx->tls_socket);
+	struct tevent_req *req =
+		tevent_req_callback_data(subreq,
+		struct tevent_req);
+	struct ldapsrv_starttls_postprocess_state *state =
+		tevent_req_data(req,
+		struct ldapsrv_starttls_postprocess_state);
+	struct ldapsrv_connection *conn = state->conn;
+	int ret;
+	int sys_errno;
+
+	ret = tstream_tls_accept_recv(subreq, &sys_errno,
+				      conn, &conn->sockets.tls);
+	TALLOC_FREE(subreq);
+	if (ret == -1) {
+		NTSTATUS status = map_nt_error_from_unix(sys_errno);
+
+		DEBUG(1,("ldapsrv_starttls_postprocess_done: accept_tls_loop: "
+			 "tstream_tls_accept_recv() - %d:%s => %s",
+			 sys_errno, strerror(sys_errno), nt_errstr(status)));
+
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	conn->sockets.active = conn->sockets.tls;
+
+	tevent_req_done(req);
+}
 
-	ctx->conn->sockets.tls = ctx->tls_socket;
-	ctx->conn->connection->socket = ctx->tls_socket;
-	packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
-	packet_set_unreliable_select(ctx->conn->packet);
+static NTSTATUS ldapsrv_starttls_postprocess_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
 }
 
 static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
 				 struct ldapsrv_reply *reply,
 				 const char **errstr)
 {
-	struct ldapsrv_starttls_context *ctx;
+	struct ldapsrv_starttls_postprocess_context *context;
 
 	(*errstr) = NULL;
 
@@ -58,21 +121,19 @@ static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
 		return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
 	}
 
-	ctx = talloc(call, struct ldapsrv_starttls_context);
-	NT_STATUS_HAVE_NO_MEMORY(ctx);
-
-	ctx->conn = call->conn;
-	ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
-					  call->conn->connection->socket,
-					  call->conn->connection->event.fde, 
-					  NULL);
-	if (!ctx->tls_socket) {
-		(*errstr) = talloc_asprintf(reply, "START-TLS: Failed to setup TLS socket");
+	if (call->conn->sockets.sasl) {
+		(*errstr) = talloc_asprintf(reply, "START-TLS: SASL is already enabled on this LDAP session");
 		return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
 	}
 
-	call->send_callback = ldapsrv_start_tls;
-	call->send_private  = ctx;
+	context = talloc(call, struct ldapsrv_starttls_postprocess_context);
+	NT_STATUS_HAVE_NO_MEMORY(context);
+
+	context->conn = call->conn;
+
+	call->postprocess_send = ldapsrv_starttls_postprocess_send;
+	call->postprocess_recv = ldapsrv_starttls_postprocess_recv;
+	call->postprocess_private = context;
 
 	reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
 	reply->msg->r.ExtendedResponse.response.errormessage = NULL;
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index e975590d43..56e1bdc126 100644
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -22,6 +22,7 @@
 */
 
 #include "includes.h"
+#include "system/network.h"
 #include "lib/events/events.h"
 #include "auth/auth.h"
 #include "auth/credentials/credentials.h"
@@ -42,173 +43,97 @@
 #include "lib/socket/netif.h"
 #include "dsdb/samdb/samdb.h"
 #include "param/param.h"
-/*
-  close the socket and shutdown a server_context
-*/
-void ldapsrv_terminate_connection(struct ldapsrv_connection *conn, 
-					 const char *reason)
-{
-	packet_recv_disable(conn->packet);
-	TALLOC_FREE(conn->packet);
-	TALLOC_FREE(conn->sockets.tls);
-	stream_terminate_connection(conn->connection, reason);
-}
+#include "../lib/tsocket/tsocket.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "../libcli/util/tstream.h"
 
-/*
-  handle packet errors
-*/
-static void ldapsrv_error_handler(void *private_data, NTSTATUS status)
-{
-	struct ldapsrv_connection *conn = talloc_get_type(private_data,
-							  struct ldapsrv_connection);
-	ldapsrv_terminate_connection(conn, nt_errstr(status));
-}
+static void ldapsrv_terminate_connection_done(struct tevent_req *subreq);
 
 /*
-  process a decoded ldap message
+  close the socket and shutdown a server_context
 */
-static void ldapsrv_process_message(struct ldapsrv_connection *conn,
-				    struct ldap_message *msg)
+static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
+					 const char *reason)
 {
-	struct ldapsrv_call *call;
-	NTSTATUS status;
-	DATA_BLOB blob;
+	struct tevent_req *subreq;
 
-	call = talloc(conn, struct ldapsrv_call);
-	if (!call) {
-		ldapsrv_terminate_connection(conn, "no memory");
-		return;		
-	}
-
-	call->request = talloc_steal(call, msg);
-	call->conn = conn;
-	call->replies = NULL;
-	call->send_callback = NULL;
-	call->send_private = NULL;
-
-	/* make the call */
-	status = ldapsrv_do_call(call);
-	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(call);
-		return;
-	}
-
-	blob = data_blob(NULL, 0);
-
-	if (call->replies == NULL) {
-		talloc_free(call);
+	if (conn->limits.reason) {
 		return;
 	}
 
-	/* build all the replies into a single blob */
-	while (call->replies) {
-		DATA_BLOB b;
-		bool ret;
+	conn->limits.endtime = timeval_current_ofs(0, 500);
 
-		msg = call->replies->msg;
-		if (!ldap_encode(msg, samba_ldap_control_handlers(), &b, call)) {
-			DEBUG(0,("Failed to encode ldap reply of type %d\n", msg->type));
-			talloc_free(call);
-			return;
-		}
+	DEBUG(2,("ldapsrv_terminate_connection: %s - disconnecting\n",
+		 reason));
 
-		ret = data_blob_append(call, &blob, b.data, b.length);
-		data_blob_free(&b);
-
-		talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
-
-		if (!ret) {
-			talloc_free(call);
-			return;
-		}
-
-		DLIST_REMOVE(call->replies, call->replies);
+	tevent_queue_stop(conn->sockets.send_queue);
+	if (conn->active_call) {
+		tevent_req_cancel(conn->active_call);
+		conn->active_call = NULL;
 	}
 
-	packet_send_callback(conn->packet, blob, 
-			     call->send_callback, call->send_private);
-	talloc_free(call);
-	return;
-}
-
-/*
-  disable packets on other sockets while processing this one
- */
-static void ldapsrv_disable_recv(struct ldapsrv_connection *conn)
-{
-	struct ldapsrv_packet_interfaces *p;
-	for (p=conn->service->packet_interfaces; p; p=p->next) {
-		if (p->packet != conn->packet) {
-			packet_recv_disable(p->packet);
-		}
+	conn->limits.reason = talloc_strdup(conn, reason);
+	if (conn->limits.reason == NULL) {
+		TALLOC_FREE(conn->sockets.tls);
+		TALLOC_FREE(conn->sockets.sasl);
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection, reason);
+		return;
 	}
-}
 
-/*
-  disable packets on other sockets while processing this one
- */
-static void ldapsrv_enable_recv(struct ldapsrv_connection *conn)
-{
-	struct ldapsrv_packet_interfaces *p;
-	for (p=conn->service->packet_interfaces; p; p=p->next) {
-		if (p->packet != conn->packet) {
-			packet_recv_enable(p->packet);
-		}
+	subreq = tstream_disconnect_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.active);
+	if (subreq == NULL) {
+		TALLOC_FREE(conn->sockets.tls);
+		TALLOC_FREE(conn->sockets.sasl);
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection, reason);
+		return;
 	}
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       conn->limits.endtime);
+	tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
 }
 
-/*
-  decode/process data
-*/
-static NTSTATUS ldapsrv_decode(void *private_data, DATA_BLOB blob)
+static void ldapsrv_terminate_connection_done(struct tevent_req *subreq)
 {
-	NTSTATUS status;
-	struct ldapsrv_connection *conn = talloc_get_type(private_data,
-							  struct ldapsrv_connection);
-	struct asn1_data *asn1 = asn1_init(conn);
-	struct ldap_message *msg = talloc(conn, struct ldap_message);
+	struct ldapsrv_connection *conn =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_connection);
+	int ret;
+	int sys_errno;
 
-	if (asn1 == NULL || msg == NULL) {
-		return NT_STATUS_NO_MEMORY;
-	}
+	ret = tstream_disconnect_recv(subreq, &sys_errno);
+	TALLOC_FREE(subreq);
 
-	if (!asn1_load(asn1, blob)) {
-		talloc_free(msg);
-		talloc_free(asn1);
-		return NT_STATUS_NO_MEMORY;
+	if (conn->sockets.active == conn->sockets.raw) {
+		TALLOC_FREE(conn->sockets.tls);
+		TALLOC_FREE(conn->sockets.sasl);
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection,
+					    conn->limits.reason);
+		return;
 	}
 
-	status = ldap_decode(asn1, samba_ldap_control_handlers(), msg);
-	if (!NT_STATUS_IS_OK(status)) {
-		asn1_free(asn1);
-		return status;
+	TALLOC_FREE(conn->sockets.tls);
+	TALLOC_FREE(conn->sockets.sasl);
+	conn->sockets.active = conn->sockets.raw;
+
+	subreq = tstream_disconnect_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.active);
+	if (subreq == NULL) {
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection,
+					    conn->limits.reason);
+		return;
 	}
-
-	data_blob_free(&blob);
-	talloc_steal(conn, msg);
-	asn1_free(asn1);
-
-	/* disable messages on other sockets while processing this one */
-	ldapsrv_disable_recv(conn);
-
-	ldapsrv_process_message(conn, msg);
-
-	ldapsrv_enable_recv(conn);
-
-	return NT_STATUS_OK;
-}
-
-/*
- Idle timeout handler
-*/
-static void ldapsrv_conn_idle_timeout(struct tevent_context *ev,
-				      struct tevent_timer *te,
-				      struct timeval t,
-				      void *private_data)
-{
-	struct ldapsrv_connection *conn = talloc_get_type(private_data, struct ldapsrv_connection);
-
-	ldapsrv_terminate_connection(conn, "Timeout. No requests after bind");
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       conn->limits.endtime);
+	tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
 }
 
 /*
@@ -216,25 +141,7 @@ static void ldapsrv_conn_idle_timeout(struct tevent_context *ev,
 */
 void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
 {
-	struct ldapsrv_connection *conn = 
-		talloc_get_type(c->private_data, struct ldapsrv_connection);
-
-	if (conn->limits.ite) { /* clean initial timeout if any */
-		talloc_free(conn->limits.ite);
-		conn->limits.ite = NULL;
-	}
-
-	if (conn->limits.te) { /* clean idle timeout if any */
-		talloc_free(conn->limits.te);
-		conn->limits.te = NULL;
-	}
-
-	packet_recv(conn->packet);
-
-	/* set idle timeout */
-	conn->limits.te = event_add_timed(c->event.ctx, conn, 
-					   timeval_current_ofs(conn->limits.conn_idle_time, 0),
-					   ldapsrv_conn_idle_timeout, conn);
+	smb_panic(__location__);
 }
 
 /*
@@ -242,20 +149,7 @@ void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
 */
 static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
 {
-	struct ldapsrv_connection *conn = 
-		talloc_get_type(c->private_data, struct ldapsrv_connection);
-
-	packet_queue_run(conn->packet);
-}
-
-static void ldapsrv_conn_init_timeout(struct tevent_context *ev,
-				      struct tevent_timer *te,
-				      struct timeval t,
-				      void *private_data)
-{
-	struct ldapsrv_connection *conn = talloc_get_type(private_data, struct ldapsrv_connection);
-
-	ldapsrv_terminate_connection(conn, "Timeout. No requests after initial connection");
+	smb_panic(__location__);
 }
 
 static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
@@ -356,14 +250,14 @@ failed:
 	return -1;
 }
 
-/*
-  remove a packet interface from the service level list
- */
-static int packet_interface_destructor(struct ldapsrv_packet_interfaces *packet_interface)
-{
-	DLIST_REMOVE(packet_interface->service->packet_interfaces, packet_interface);
-	return 0;
-}
+static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
+						    struct tevent_context *ev,
+						    struct tevent_queue *call_queue,
+						    struct ldapsrv_call *call);
+static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req);
+
+static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn);
+static void ldapsrv_accept_tls_done(struct tevent_req *subreq);
 
 /*
   initialise a server_context from a open socket and register a event handler
@@ -379,6 +273,9 @@ static void ldapsrv_accept(struct stream_connection *c,
 	struct socket_address *socket_address;
 	NTSTATUS status;
 	int port;
+	int ret;
+	struct tevent_req *subreq;
+	struct timeval endtime;
 
 	conn = talloc_zero(c, struct ldapsrv_connection);
 	if (!conn) {
@@ -386,10 +283,31 @@ static void ldapsrv_accept(struct stream_connection *c,
 		return;
 	}
 
-	conn->packet      = NULL;
+	conn->sockets.send_queue = tevent_queue_create(conn, "ldapsev send queue");
+	if (conn->sockets.send_queue == NULL) {
+		stream_terminate_connection(c,
+					    "ldapsrv_accept: tevent_queue_create failed");
+		return;
+	}
+
+	TALLOC_FREE(c->event.fde);
+
+	/*
+	 * Clone the fd that the connection isn't closed if we create a client
+	 * connection.
+	 */
+	ret = tstream_bsd_existing_socket(conn,
+					  socket_get_fd(c->socket),
+					  &conn->sockets.raw);
+	if (ret == -1) {
+		stream_terminate_connection(c,
+					    "ldapsrv_accept: out of memory");
+		return;
+	}
+	socket_set_flags(c->socket, SOCKET_FLAG_NOCLOSE);
+
 	conn->connection  = c;
 	conn->service     = ldapsrv_service;
-	conn->sockets.raw = c->socket;
 	conn->lp_ctx      = ldapsrv_service->task->lp_ctx;
 
 	c->private_data   = conn;
@@ -401,54 +319,9 @@ static void ldapsrv_accept(struct stream_connection *c,
 	}
 	port = socket_address->port;
 	talloc_free(socket_address);
-
-	if (port == 636) {
-		struct socket_context *tls_socket = tls_init_server(ldapsrv_service->tls_params, c->socket, 
-								    c->event.fde, NULL);
-		if (!tls_socket) {
-			ldapsrv_terminate_connection(conn, "ldapsrv_accept: tls_init_server() failed");
-			return;
-		}
-		talloc_steal(c, tls_socket);
-		c->socket = tls_socket;
-		conn->sockets.tls = tls_socket;
-
-	} else if (port == 3268) /* Global catalog */ {
+	if (port == 3268) /* Global catalog */ {
 		conn->global_catalog = true;
 	}
-	conn->packet = packet_init(conn);
-	if (conn->packet == NULL) {
-		ldapsrv_terminate_connection(conn, "out of memory");
-		return;
-	}
-
-	packet_set_private(conn->packet, conn);
-	packet_set_socket(conn->packet, c->socket);
-	packet_set_callback(conn->packet, ldapsrv_decode);
-	packet_set_full_request(conn->packet, ldap_full_packet);
-	packet_set_error_handler(conn->packet, ldapsrv_error_handler);
-	packet_set_event_context(conn->packet, c->event.ctx);
-	packet_set_fde(conn->packet, c->event.fde);
-	packet_set_serialise(conn->packet);
-
-	if (conn->sockets.tls) {
-		packet_set_unreliable_select(conn->packet);
-	}
-
-	/* Ensure we don't get packets until the database is ready below */
-	packet_recv_disable(conn->packet);
-
-	/* add to the service level list of packet interfaces, to
-	 * allow us to serialise between connections
-	 */
-	conn->packet_interface = talloc(conn, struct ldapsrv_packet_interfaces);
-	if (conn->packet_interface == NULL) {
-		ldapsrv_terminate_connection(conn, "out of memory");
-	}
-	conn->packet_interface->service = ldapsrv_service;
-	conn->packet_interface->packet = conn->packet;
-	DLIST_ADD(conn->service->packet_interfaces, conn->packet_interface);
-	talloc_set_destructor(conn->packet_interface, packet_interface_destructor);
 
 	server_credentials = cli_credentials_init(conn);
 	if (!server_credentials) {
@@ -477,13 +350,405 @@ static void ldapsrv_accept(struct stream_connection *c,
 	/* register the server */	
 	irpc_add_name(c->msg_ctx, "ldap_server");
 
-	/* set connections limits */
-	conn->limits.ite = event_add_timed(c->event.ctx, conn, 
-					   timeval_current_ofs(conn->limits.initial_timeout, 0),
-					   ldapsrv_conn_init_timeout, conn);
+	conn->sockets.active = conn->sockets.raw;
+
+	if (port != 636) {
+		ldapsrv_call_read_next(conn);
+		return;
+	}
+
+	endtime = timeval_current_ofs(conn->limits.conn_idle_time, 0);
+
+	subreq = tstream_tls_accept_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.raw,
+					 conn->service->tls_params);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_accept: "
+				"no memory for tstream_tls_accept_send");
+		return;
+	}
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       endtime);
+	tevent_req_set_callback(subreq, ldapsrv_accept_tls_done, conn);
+}
+
+static void ldapsrv_accept_tls_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_connection *conn =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_connection);
+	int ret;
+	int sys_errno;
+
+	ret = tstream_tls_accept_recv(subreq, &sys_errno,
+				      conn, &conn->sockets.tls);
+	TALLOC_FREE(subreq);
+	if (ret == -1) {
+		const char *reason;
+
+		reason = talloc_asprintf(conn, "ldapsrv_accept_tls_loop: "
+					 "tstream_tls_accept_recv() - %d:%s",
+					 sys_errno, strerror(sys_errno));
+		if (!reason) {
+			reason = "ldapsrv_accept_tls_loop: "
+				 "tstream_tls_accept_recv() - failed";
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	conn->sockets.active = conn->sockets.tls;
+	ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_call_read_done(struct tevent_req *subreq);
 
-	packet_recv_enable(conn->packet);
+static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn)
+{
+	struct tevent_req *subreq;
 
+	if (timeval_is_zero(&conn->limits.endtime)) {
+		conn->limits.endtime =
+			timeval_current_ofs(conn->limits.initial_timeout, 0);
+	} else {
+		conn->limits.endtime =
+			timeval_current_ofs(conn->limits.conn_idle_time, 0);
+	}
+
+	/*
+	 * The minimun size of a LDAP pdu is 7 bytes
+	 *
+	 * dumpasn1 -hh ldap-unbind-min.dat
+	 *
+	 *     <30 05 02 01 09 42 00>
+	 *    0    5: SEQUENCE {
+	 *     <02 01 09>
+	 *    2    1:   INTEGER 9
+	 *     <42 00>
+	 *    5    0:   [APPLICATION 2]
+	 *          :     Error: Object has zero length.
+	 *          :   }
+	 *
+	 * dumpasn1 -hh ldap-unbind-windows.dat
+	 *
+	 *     <30 84 00 00 00 05 02 01 09 42 00>
+	 *    0    5: SEQUENCE {
+	 *     <02 01 09>
+	 *    6    1:   INTEGER 9
+	 *     <42 00>
+	 *    9    0:   [APPLICATION 2]
+	 *          :     Error: Object has zero length.
+	 *          :   }
+	 *
+	 * This means using an initial read size
+	 * of 7 is ok.
+	 */
+	subreq = tstream_read_pdu_blob_send(conn,
+					    conn->connection->event.ctx,
+					    conn->sockets.active,
+					    7, /* initial_read_size */
+					    ldap_full_packet,
+					    conn);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_call_read_next: "
+				"no memory for tstream_read_pdu_blob_send");
+		return false;
+	}
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       conn->limits.endtime);
+	tevent_req_set_callback(subreq, ldapsrv_call_read_done, conn);
+	return true;
+}
+
+static void ldapsrv_call_process_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_read_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_connection *conn =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_connection);
+	NTSTATUS status;
+	struct ldapsrv_call *call;
+	struct asn1_data *asn1;
+	DATA_BLOB blob;
+
+	call = talloc_zero(conn, struct ldapsrv_call);
+	if (!call) {
+		ldapsrv_terminate_connection(conn, "no memory");
+		return;
+	}
+
+	call->conn = conn;
+
+	status = tstream_read_pdu_blob_recv(subreq,
+					    call,
+					    &blob);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_loop: "
+					 "tstream_read_pdu_blob_recv() - %s",
+					 nt_errstr(status));
+		if (!reason) {
+			reason = nt_errstr(status);
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	asn1 = asn1_init(call);
+	if (asn1 == NULL) {
+		ldapsrv_terminate_connection(conn, "no memory");
+		return;
+	}
+
+	call->request = talloc(call, struct ldap_message);
+	if (call->request == NULL) {
+		ldapsrv_terminate_connection(conn, "no memory");
+		return;
+	}
+
+	if (!asn1_load(asn1, blob)) {
+		ldapsrv_terminate_connection(conn, "asn1_load failed");
+		return;
+	}
+
+	status = ldap_decode(asn1, samba_ldap_control_handlers(),
+			     call->request);
+	if (!NT_STATUS_IS_OK(status)) {
+		ldapsrv_terminate_connection(conn, nt_errstr(status));
+		return;
+	}
+
+	data_blob_free(&blob);
+
+
+	/* queue the call in the global queue */
+	subreq = ldapsrv_process_call_send(call,
+					   conn->connection->event.ctx,
+					   conn->service->call_queue,
+					   call);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_process_call_send failed");
+		return;
+	}
+	tevent_req_set_callback(subreq, ldapsrv_call_process_done, call);
+	conn->active_call = subreq;
+}
+
+static void ldapsrv_call_writev_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_process_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_null;
+
+	conn->active_call = NULL;
+
+	status = ldapsrv_process_call_recv(subreq);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		ldapsrv_terminate_connection(conn, nt_errstr(status));
+		return;
+	}
+
+	/* build all the replies into a single blob */
+	while (call->replies) {
+		DATA_BLOB b;
+		bool ret;
+
+		if (!ldap_encode(call->replies->msg, samba_ldap_control_handlers(), &b, call)) {
+			DEBUG(0,("Failed to encode ldap reply of type %d\n",
+				 call->replies->msg->type));
+			ldapsrv_terminate_connection(conn, "ldap_encode failed");
+			return;
+		}
+
+		ret = data_blob_append(call, &blob, b.data, b.length);
+		data_blob_free(&b);
+
+		talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
+
+		if (!ret) {
+			ldapsrv_terminate_connection(conn, "data_blob_append failed");
+			return;
+		}
+
+		DLIST_REMOVE(call->replies, call->replies);
+	}
+
+	if (blob.length == 0) {
+		TALLOC_FREE(call);
+
+		ldapsrv_call_read_next(conn);
+		return;
+	}
+
+	call->out_iov.iov_base = blob.data;
+	call->out_iov.iov_len = blob.length;
+
+	subreq = tstream_writev_queue_send(call,
+					   conn->connection->event.ctx,
+					   conn->sockets.active,
+					   conn->sockets.send_queue,
+					   &call->out_iov, 1);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "stream_writev_queue_send failed");
+		return;
+	}
+	tevent_req_set_callback(subreq, ldapsrv_call_writev_done, call);
+}
+
+static void ldapsrv_call_postprocess_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_writev_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	int sys_errno;
+	int rc;
+
+	rc = tstream_writev_queue_recv(subreq, &sys_errno);
+	TALLOC_FREE(subreq);
+	if (rc == -1) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_writev_done: "
+					 "tstream_writev_queue_recv() - %d:%s",
+					 sys_errno, strerror(sys_errno));
+		if (reason == NULL) {
+			reason = "ldapsrv_call_writev_done: "
+				 "tstream_writev_queue_recv() failed";
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	if (call->postprocess_send) {
+		subreq = call->postprocess_send(call,
+						conn->connection->event.ctx,
+						call->postprocess_private);
+		if (subreq == NULL) {
+			ldapsrv_terminate_connection(conn, "ldapsrv_call_writev_done: "
+					"call->postprocess_send - no memory");
+			return;
+		}
+		tevent_req_set_callback(subreq,
+					ldapsrv_call_postprocess_done,
+					call);
+		return;
+	}
+
+	TALLOC_FREE(call);
+
+	ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_call_postprocess_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	NTSTATUS status;
+
+	status = call->postprocess_recv(subreq);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_postprocess_done: "
+					 "call->postprocess_recv() - %s",
+					 nt_errstr(status));
+		if (reason == NULL) {
+			reason = nt_errstr(status);
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	TALLOC_FREE(call);
+
+	ldapsrv_call_read_next(conn);
+}
+
+struct ldapsrv_process_call_state {
+	struct ldapsrv_call *call;
+};
+
+static void ldapsrv_process_call_trigger(struct tevent_req *req,
+					 void *private_data);
+
+static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
+						    struct tevent_context *ev,
+						    struct tevent_queue *call_queue,
+						    struct ldapsrv_call *call)
+{
+	struct tevent_req *req;
+	struct ldapsrv_process_call_state *state;
+	bool ok;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_process_call_state);
+	if (req == NULL) {
+		return req;
+	}
+
+	state->call = call;
+
+	ok = tevent_queue_add(call_queue, ev, req,
+			      ldapsrv_process_call_trigger, NULL);
+	if (!ok) {
+		tevent_req_nomem(NULL, req);
+		return tevent_req_post(req, ev);
+	}
+
+	return req;
+}
+
+static void ldapsrv_process_call_trigger(struct tevent_req *req,
+					 void *private_data)
+{
+	struct ldapsrv_process_call_state *state =
+		tevent_req_data(req,
+		struct ldapsrv_process_call_state);
+	NTSTATUS status;
+
+	/* make the call */
+	status = ldapsrv_do_call(state->call);
+	if (!NT_STATUS_IS_OK(status)) {
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	tevent_req_done(req);
+}
+
+static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req)
+{
+	NTSTATUS status;
+
+	if (tevent_req_is_nterror(req, &status)) {
+		tevent_req_received(req);
+		return status;
+	}
+
+	tevent_req_received(req);
+	return NT_STATUS_OK;
 }
 
 static void ldapsrv_accept_nonpriv(struct stream_connection *c)
@@ -562,7 +827,7 @@ static NTSTATUS add_socket(struct tevent_context *event_context,
 		return status;
 	}
 
-	if (tls_support(ldap_service->tls_params)) {
+	if (tstream_tls_params_enabled(ldap_service->tls_params)) {
 		/* add ldaps server */
 		port = 636;
 		status = stream_setup_socket(event_context, lp_ctx,
@@ -616,6 +881,7 @@ static void ldapsrv_task_init(struct task_server *task)
 #ifdef WITH_LDAPI_PRIV_SOCKET
 	char *priv_dir;
 #endif
+	const char *dns_host_name;
 	struct ldapsrv_service *ldap_service;
 	NTSTATUS status;
 	const struct model_ops *model_ops;
@@ -645,8 +911,28 @@ static void ldapsrv_task_init(struct task_server *task)
 
 	ldap_service->task = task;
 
-	ldap_service->tls_params = tls_initialise(ldap_service, task->lp_ctx);
-	if (ldap_service->tls_params == NULL) goto failed;
+	dns_host_name = talloc_asprintf(ldap_service, "%s.%s",
+					lpcfg_netbios_name(task->lp_ctx),
+					lpcfg_dnsdomain(task->lp_ctx));
+	if (dns_host_name == NULL) goto failed;
+
+	status = tstream_tls_params_server(ldap_service,
+					   dns_host_name,
+					   lpcfg_tls_enabled(task->lp_ctx),
+					   lpcfg_tls_keyfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_certfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_cafile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_crlfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_dhpfile(ldap_service, task->lp_ctx),
+					   &ldap_service->tls_params);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("ldapsrv failed tstream_tls_patams_server - %s\n",
+			 nt_errstr(status)));
+		goto failed;
+	}
+
+	ldap_service->call_queue = tevent_queue_create(ldap_service, "ldapsrv_call_queue");
+	if (ldap_service->call_queue == NULL) goto failed;
 
 	if (lpcfg_interfaces(task->lp_ctx) && lpcfg_bind_interfaces_only(task->lp_ctx)) {
 		struct interface *ifaces;
diff --git a/source4/ldap_server/ldap_server.h b/source4/ldap_server/ldap_server.h
index 0fb8d2f4ac..4d5cae49fc 100644
--- a/source4/ldap_server/ldap_server.h
+++ b/source4/ldap_server/ldap_server.h
@@ -21,6 +21,7 @@
 #include "libcli/ldap/libcli_ldap.h"
 #include "lib/socket/socket.h"
 #include "lib/stream/packet.h"
+#include "system/network.h"
 
 struct ldapsrv_connection {
 	struct loadparm_context *lp_ctx;
@@ -32,26 +33,25 @@ struct ldapsrv_connection {
 	struct ldb_context *ldb;
 
 	struct {
-		struct socket_context *raw;
-		struct socket_context *tls;
-		struct socket_context *sasl;
+		struct tevent_queue *send_queue;
+		struct tstream_context *raw;
+		struct tstream_context *tls;
+		struct tstream_context *sasl;
+		struct tstream_context *active;
 	} sockets;
 
 	bool global_catalog;
 
-	struct packet_context *packet;
-
 	struct {
 		int initial_timeout;
 		int conn_idle_time;
 		int max_page_size;
 		int search_timeout;
-		
-		struct tevent_timer *ite;
-		struct tevent_timer *te;
+		struct timeval endtime;
+		const char *reason;
 	} limits;
 
-	struct ldapsrv_packet_interfaces *packet_interface;
+	struct tevent_req *active_call;
 };
 
 struct ldapsrv_call {
@@ -61,18 +61,19 @@ struct ldapsrv_call {
 		struct ldapsrv_reply *prev, *next;
 		struct ldap_message *msg;
 	} *replies;
-	packet_send_callback_fn_t send_callback;
-	void *send_private;
+	struct iovec out_iov;
+
+	struct tevent_req *(*postprocess_send)(TALLOC_CTX *mem_ctx,
+					       struct tevent_context *ev,
+					       void *private_data);
+	NTSTATUS (*postprocess_recv)(struct tevent_req *req);
+	void *postprocess_private;
 };
 
 struct ldapsrv_service {
-	struct tls_params *tls_params;
+	struct tstream_tls_params *tls_params;
 	struct task_server *task;
-	struct ldapsrv_packet_interfaces {
-		struct ldapsrv_packet_interfaces *next, *prev;
-		struct packet_context *packet;
-		struct ldapsrv_service *service;
-	} *packet_interfaces;
+	struct tevent_queue *call_queue;
 };
 
 #include "ldap_server/proto.h"