2 * Unix SMB/CIFS implementation.
6 * Copyright (c) 2011 Andreas Schneider <asn@samba.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 #include "lib/id_cache.h"
29 #include "../lib/tsocket/tsocket.h"
30 #include "lib/server_prefork.h"
31 #include "lib/server_prefork_util.h"
32 #include "librpc/rpc/dcerpc_ep.h"
34 #include "rpc_server/rpc_server.h"
35 #include "rpc_server/rpc_ep_register.h"
36 #include "rpc_server/rpc_sock_helper.h"
38 #include "librpc/gen_ndr/srv_lsa.h"
39 #include "librpc/gen_ndr/srv_samr.h"
40 #include "librpc/gen_ndr/srv_netlogon.h"
42 #define DAEMON_NAME "lsasd"
43 #define LSASD_MAX_SOCKETS 64
45 static struct server_id parent_id
;
46 static struct prefork_pool
*lsasd_pool
= NULL
;
47 static int lsasd_child_id
= 0;
49 static struct pf_daemon_config default_pf_lsasd_cfg
= {
50 .prefork_status
= PFH_INIT
,
54 .max_allowed_clients
= 100,
55 .child_min_life
= 60 /* 1 minute minimum life time */
57 static struct pf_daemon_config pf_lsasd_cfg
= { 0 };
59 void start_lsasd(struct tevent_context
*ev_ctx
,
60 struct messaging_context
*msg_ctx
);
62 static void lsasd_reopen_logs(int child_id
)
64 char *lfile
= lp_logfile(talloc_tos());
69 rc
= asprintf(&extension
, "%s.%d", DAEMON_NAME
, child_id
);
71 rc
= asprintf(&extension
, "%s", DAEMON_NAME
);
78 if (lfile
== NULL
|| lfile
[0] == '\0') {
79 rc
= asprintf(&lfile
, "%s/log.%s",
80 get_dyn_LOGFILEBASE(), extension
);
82 if (strstr(lfile
, extension
) == NULL
) {
84 rc
= asprintf(&lfile
, "%s.%d",
85 lp_logfile(talloc_tos()),
88 rc
= asprintf(&lfile
, "%s.%s",
89 lp_logfile(talloc_tos()),
96 lp_set_logfile(lfile
);
100 SAFE_FREE(extension
);
105 static void lsasd_smb_conf_updated(struct messaging_context
*msg
,
108 struct server_id server_id
,
111 struct tevent_context
*ev_ctx
;
113 DEBUG(10, ("Got message saying smb.conf was updated. Reloading.\n"));
114 ev_ctx
= talloc_get_type_abort(private_data
, struct tevent_context
);
116 change_to_root_user();
117 lp_load_global(get_dyn_CONFIGFILE());
119 lsasd_reopen_logs(lsasd_child_id
);
120 if (lsasd_child_id
== 0) {
121 pfh_daemon_config(DAEMON_NAME
,
123 &default_pf_lsasd_cfg
);
124 pfh_manage_pool(ev_ctx
, msg
, &pf_lsasd_cfg
, lsasd_pool
);
128 static void lsasd_sig_term_handler(struct tevent_context
*ev
,
129 struct tevent_signal
*se
,
135 rpc_netlogon_shutdown();
137 rpc_lsarpc_shutdown();
139 DEBUG(0, ("termination signal\n"));
143 static void lsasd_setup_sig_term_handler(struct tevent_context
*ev_ctx
)
145 struct tevent_signal
*se
;
147 se
= tevent_add_signal(ev_ctx
,
150 lsasd_sig_term_handler
,
153 DEBUG(0, ("failed to setup SIGTERM handler\n"));
158 static void lsasd_sig_hup_handler(struct tevent_context
*ev
,
159 struct tevent_signal
*se
,
166 change_to_root_user();
167 lp_load_global(get_dyn_CONFIGFILE());
169 lsasd_reopen_logs(lsasd_child_id
);
170 pfh_daemon_config(DAEMON_NAME
,
172 &default_pf_lsasd_cfg
);
174 /* relay to all children */
175 prefork_send_signal_to_all(lsasd_pool
, SIGHUP
);
178 static void lsasd_setup_sig_hup_handler(struct tevent_context
*ev_ctx
)
180 struct tevent_signal
*se
;
182 se
= tevent_add_signal(ev_ctx
,
185 lsasd_sig_hup_handler
,
188 DEBUG(0, ("failed to setup SIGHUP handler\n"));
193 /**********************************************************
195 **********************************************************/
197 static void lsasd_chld_sig_hup_handler(struct tevent_context
*ev
,
198 struct tevent_signal
*se
,
204 change_to_root_user();
205 lsasd_reopen_logs(lsasd_child_id
);
208 static bool lsasd_setup_chld_hup_handler(struct tevent_context
*ev_ctx
)
210 struct tevent_signal
*se
;
212 se
= tevent_add_signal(ev_ctx
,
215 lsasd_chld_sig_hup_handler
,
218 DEBUG(1, ("failed to setup SIGHUP handler"));
225 static void parent_ping(struct messaging_context
*msg_ctx
,
228 struct server_id server_id
,
232 /* The fact we received this message is enough to let make the event
233 * loop if it was idle. lsasd_children_main will cycle through
234 * lsasd_next_client at least once. That function will take whatever
235 * action is necessary */
237 DEBUG(10, ("Got message that the parent changed status.\n"));
241 static bool lsasd_child_init(struct tevent_context
*ev_ctx
,
243 struct pf_worker_data
*pf
)
246 struct messaging_context
*msg_ctx
= server_messaging_context();
249 status
= reinit_after_fork(msg_ctx
, ev_ctx
,
250 true, "lsasd-child");
251 if (!NT_STATUS_IS_OK(status
)) {
252 DEBUG(0,("reinit_after_fork() failed\n"));
253 smb_panic("reinit_after_fork() failed");
255 initialize_password_db(true, ev_ctx
);
257 lsasd_child_id
= child_id
;
258 lsasd_reopen_logs(child_id
);
260 ok
= lsasd_setup_chld_hup_handler(ev_ctx
);
265 messaging_register(msg_ctx
, ev_ctx
,
266 MSG_SMB_CONF_UPDATED
, lsasd_smb_conf_updated
);
267 messaging_register(msg_ctx
, ev_ctx
,
268 MSG_PREFORK_PARENT_EVENT
, parent_ping
);
269 id_cache_register_msgs(msg_ctx
);
271 status
= rpc_lsarpc_init(NULL
);
272 if (!NT_STATUS_IS_OK(status
)) {
273 DEBUG(0, ("Failed to register lsarpc rpc interface! (%s)\n",
278 status
= rpc_samr_init(NULL
);
279 if (!NT_STATUS_IS_OK(status
)) {
280 DEBUG(0, ("Failed to register samr rpc interface! (%s)\n",
285 status
= rpc_netlogon_init(NULL
);
286 if (!NT_STATUS_IS_OK(status
)) {
287 DEBUG(0, ("Failed to register netlogon rpc interface! (%s)\n",
295 struct lsasd_children_data
{
296 struct tevent_context
*ev_ctx
;
297 struct messaging_context
*msg_ctx
;
298 struct pf_worker_data
*pf
;
303 static void lsasd_next_client(void *pvt
);
305 static int lsasd_children_main(struct tevent_context
*ev_ctx
,
306 struct messaging_context
*msg_ctx
,
307 struct pf_worker_data
*pf
,
313 struct lsasd_children_data
*data
;
317 ok
= lsasd_child_init(ev_ctx
, child_id
, pf
);
322 data
= talloc(ev_ctx
, struct lsasd_children_data
);
327 data
->ev_ctx
= ev_ctx
;
328 data
->msg_ctx
= msg_ctx
;
329 data
->listen_fd_size
= listen_fd_size
;
330 data
->listen_fds
= listen_fds
;
332 /* loop until it is time to exit */
333 while (pf
->status
!= PF_WORKER_EXITING
) {
334 /* try to see if it is time to schedule the next client */
335 lsasd_next_client(data
);
337 ret
= tevent_loop_once(ev_ctx
);
339 DEBUG(0, ("tevent_loop_once() exited with %d: %s\n",
340 ret
, strerror(errno
)));
341 pf
->status
= PF_WORKER_EXITING
;
348 static void lsasd_client_terminated(void *pvt
)
350 struct lsasd_children_data
*data
;
352 data
= talloc_get_type_abort(pvt
, struct lsasd_children_data
);
354 pfh_client_terminated(data
->pf
);
356 lsasd_next_client(pvt
);
359 struct lsasd_new_client
{
360 struct lsasd_children_data
*data
;
363 static void lsasd_handle_client(struct tevent_req
*req
);
365 static void lsasd_next_client(void *pvt
)
367 struct tevent_req
*req
;
368 struct lsasd_children_data
*data
;
369 struct lsasd_new_client
*next
;
371 data
= talloc_get_type_abort(pvt
, struct lsasd_children_data
);
373 if (!pfh_child_allowed_to_accept(data
->pf
)) {
374 /* nothing to do for now we are already listening
375 * or we are not allowed to listen further */
379 next
= talloc_zero(data
, struct lsasd_new_client
);
381 DEBUG(1, ("Out of memory!?\n"));
386 req
= prefork_listen_send(next
,
389 data
->listen_fd_size
,
392 DEBUG(1, ("Failed to make listening request!?\n"));
396 tevent_req_set_callback(req
, lsasd_handle_client
, next
);
399 static void lsasd_handle_client(struct tevent_req
*req
)
401 struct lsasd_children_data
*data
;
402 struct lsasd_new_client
*client
;
403 const DATA_BLOB ping
= data_blob_null
;
407 struct tsocket_address
*srv_addr
;
408 struct tsocket_address
*cli_addr
;
410 client
= tevent_req_callback_data(req
, struct lsasd_new_client
);
413 tmp_ctx
= talloc_stackframe();
414 if (tmp_ctx
== NULL
) {
415 DEBUG(1, ("Failed to allocate stackframe!\n"));
419 rc
= prefork_listen_recv(req
,
425 /* this will free the request too */
429 DEBUG(6, ("No client connection was available after all!\n"));
433 /* Warn parent that our status changed */
434 messaging_send(data
->msg_ctx
, parent_id
,
435 MSG_PREFORK_CHILD_EVENT
, &ping
);
437 DEBUG(2, ("LSASD preforked child %d got client connection!\n",
438 (int)(data
->pf
->pid
)));
440 if (tsocket_address_is_inet(srv_addr
, "ip")) {
441 DEBUG(3, ("Got a tcpip client connection from %s on interface %s\n",
442 tsocket_address_string(cli_addr
, tmp_ctx
),
443 tsocket_address_string(srv_addr
, tmp_ctx
)));
445 dcerpc_ncacn_accept(data
->ev_ctx
,
453 } else if (tsocket_address_is_unix(srv_addr
)) {
457 p
= tsocket_address_unix_path(srv_addr
, tmp_ctx
);
459 talloc_free(tmp_ctx
);
470 if (strstr(p
, "/np/")) {
471 named_pipe_accept_function(data
->ev_ctx
,
475 lsasd_client_terminated
,
478 dcerpc_ncacn_accept(data
->ev_ctx
,
488 DEBUG(0, ("ERROR: Unsupported socket!\n"));
492 talloc_free(tmp_ctx
);
499 static void child_ping(struct messaging_context
*msg_ctx
,
502 struct server_id server_id
,
505 struct tevent_context
*ev_ctx
;
507 ev_ctx
= talloc_get_type_abort(private_data
, struct tevent_context
);
509 DEBUG(10, ("Got message that a child changed status.\n"));
510 pfh_manage_pool(ev_ctx
, msg_ctx
, &pf_lsasd_cfg
, lsasd_pool
);
513 static bool lsasd_schedule_check(struct tevent_context
*ev_ctx
,
514 struct messaging_context
*msg_ctx
,
515 struct timeval current_time
);
517 static void lsasd_check_children(struct tevent_context
*ev_ctx
,
518 struct tevent_timer
*te
,
519 struct timeval current_time
,
522 static void lsasd_sigchld_handler(struct tevent_context
*ev_ctx
,
523 struct prefork_pool
*pfp
,
526 struct messaging_context
*msg_ctx
;
528 msg_ctx
= talloc_get_type_abort(pvt
, struct messaging_context
);
530 /* run pool management so we can fork/retire or increase
531 * the allowed connections per child based on load */
532 pfh_manage_pool(ev_ctx
, msg_ctx
, &pf_lsasd_cfg
, lsasd_pool
);
535 static bool lsasd_setup_children_monitor(struct tevent_context
*ev_ctx
,
536 struct messaging_context
*msg_ctx
)
540 /* add our oun sigchld callback */
541 prefork_set_sigchld_callback(lsasd_pool
, lsasd_sigchld_handler
, msg_ctx
);
543 ok
= lsasd_schedule_check(ev_ctx
, msg_ctx
, tevent_timeval_current());
548 static bool lsasd_schedule_check(struct tevent_context
*ev_ctx
,
549 struct messaging_context
*msg_ctx
,
550 struct timeval current_time
)
552 struct tevent_timer
*te
;
553 struct timeval next_event
;
555 /* check situation again in 10 seconds */
556 next_event
= tevent_timeval_current_ofs(10, 0);
558 /* TODO: check when the socket becomes readable, so that children
559 * are checked only when there is some activity ? */
560 te
= tevent_add_timer(ev_ctx
, lsasd_pool
, next_event
,
561 lsasd_check_children
, msg_ctx
);
563 DEBUG(2, ("Failed to set up children monitoring!\n"));
570 static void lsasd_check_children(struct tevent_context
*ev_ctx
,
571 struct tevent_timer
*te
,
572 struct timeval current_time
,
575 struct messaging_context
*msg_ctx
;
577 msg_ctx
= talloc_get_type_abort(pvt
, struct messaging_context
);
579 pfh_manage_pool(ev_ctx
, msg_ctx
, &pf_lsasd_cfg
, lsasd_pool
);
581 lsasd_schedule_check(ev_ctx
, msg_ctx
, current_time
);
588 static bool lsasd_create_sockets(struct tevent_context
*ev_ctx
,
589 struct messaging_context
*msg_ctx
,
593 struct dcerpc_binding_vector
*v
, *v_orig
;
601 tmp_ctx
= talloc_stackframe();
602 if (tmp_ctx
== NULL
) {
606 status
= dcerpc_binding_vector_new(tmp_ctx
, &v_orig
);
607 if (!NT_STATUS_IS_OK(status
)) {
611 /* Create only one tcpip listener for all services */
612 status
= rpc_create_tcpip_sockets(&ndr_table_lsarpc
,
617 if (!NT_STATUS_IS_OK(status
)) {
621 /* Start to listen on tcpip sockets */
622 for (i
= 0; i
< *listen_fd_size
; i
++) {
623 rc
= listen(listen_fd
[i
], pf_lsasd_cfg
.max_allowed_clients
);
625 DEBUG(0, ("Failed to listen on tcpip socket - %s\n",
632 fd
= create_named_pipe_socket("lsarpc");
637 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
639 DEBUG(0, ("Failed to listen on lsarpc pipe - %s\n",
643 listen_fd
[*listen_fd_size
] = fd
;
646 fd
= create_named_pipe_socket("lsass");
651 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
653 DEBUG(0, ("Failed to listen on lsass pipe - %s\n",
657 listen_fd
[*listen_fd_size
] = fd
;
660 fd
= create_dcerpc_ncalrpc_socket("lsarpc");
665 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
667 DEBUG(0, ("Failed to listen on lsarpc ncalrpc - %s\n",
671 listen_fd
[*listen_fd_size
] = fd
;
675 v
= dcerpc_binding_vector_dup(tmp_ctx
, v_orig
);
680 status
= dcerpc_binding_vector_replace_iface(&ndr_table_lsarpc
, v
);
681 if (!NT_STATUS_IS_OK(status
)) {
685 status
= dcerpc_binding_vector_add_np_default(&ndr_table_lsarpc
, v
);
686 if (!NT_STATUS_IS_OK(status
)) {
690 status
= dcerpc_binding_vector_add_unix(&ndr_table_lsarpc
, v
, "lsarpc");
691 if (!NT_STATUS_IS_OK(status
)) {
695 status
= rpc_ep_register(ev_ctx
, msg_ctx
, &ndr_table_lsarpc
, v
);
696 if (!NT_STATUS_IS_OK(status
)) {
701 fd
= create_named_pipe_socket("samr");
706 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
708 DEBUG(0, ("Failed to listen on samr pipe - %s\n",
712 listen_fd
[*listen_fd_size
] = fd
;
715 fd
= create_dcerpc_ncalrpc_socket("samr");
720 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
722 DEBUG(0, ("Failed to listen on samr ncalrpc - %s\n",
726 listen_fd
[*listen_fd_size
] = fd
;
730 v
= dcerpc_binding_vector_dup(tmp_ctx
, v_orig
);
735 status
= dcerpc_binding_vector_replace_iface(&ndr_table_samr
, v
);
736 if (!NT_STATUS_IS_OK(status
)) {
740 status
= dcerpc_binding_vector_add_np_default(&ndr_table_samr
, v
);
741 if (!NT_STATUS_IS_OK(status
)) {
745 status
= dcerpc_binding_vector_add_unix(&ndr_table_lsarpc
, v
, "samr");
746 if (!NT_STATUS_IS_OK(status
)) {
750 status
= rpc_ep_register(ev_ctx
, msg_ctx
, &ndr_table_samr
, v
);
751 if (!NT_STATUS_IS_OK(status
)) {
756 fd
= create_named_pipe_socket("netlogon");
761 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
763 DEBUG(0, ("Failed to listen on samr pipe - %s\n",
767 listen_fd
[*listen_fd_size
] = fd
;
770 fd
= create_dcerpc_ncalrpc_socket("netlogon");
775 rc
= listen(fd
, pf_lsasd_cfg
.max_allowed_clients
);
777 DEBUG(0, ("Failed to listen on netlogon ncalrpc - %s\n",
781 listen_fd
[*listen_fd_size
] = fd
;
785 v
= dcerpc_binding_vector_dup(tmp_ctx
, v_orig
);
790 status
= dcerpc_binding_vector_replace_iface(&ndr_table_netlogon
, v
);
791 if (!NT_STATUS_IS_OK(status
)) {
795 status
= dcerpc_binding_vector_add_np_default(&ndr_table_netlogon
, v
);
796 if (!NT_STATUS_IS_OK(status
)) {
800 status
= dcerpc_binding_vector_add_unix(&ndr_table_lsarpc
, v
, "netlogon");
801 if (!NT_STATUS_IS_OK(status
)) {
805 status
= rpc_ep_register(ev_ctx
, msg_ctx
, &ndr_table_netlogon
, v
);
806 if (!NT_STATUS_IS_OK(status
)) {
815 talloc_free(tmp_ctx
);
819 void start_lsasd(struct tevent_context
*ev_ctx
,
820 struct messaging_context
*msg_ctx
)
823 int listen_fd
[LSASD_MAX_SOCKETS
];
824 int listen_fd_size
= 0;
829 DEBUG(1, ("Forking LSA Service Daemon\n"));
832 * Block signals before forking child as it will have to
833 * set its own handlers. Child will re-enable SIGHUP as
834 * soon as the handlers are set up.
836 BlockSignals(true, SIGTERM
);
837 BlockSignals(true, SIGHUP
);
841 DEBUG(0, ("Failed to fork LSASD [%s], aborting ...\n",
846 /* parent or error */
849 /* Re-enable SIGHUP before returnig */
850 BlockSignals(false, SIGTERM
);
851 BlockSignals(false, SIGHUP
);
856 status
= smbd_reinit_after_fork(msg_ctx
, ev_ctx
, true, "lsasd-master");
857 if (!NT_STATUS_IS_OK(status
)) {
858 DEBUG(0,("reinit_after_fork() failed\n"));
859 smb_panic("reinit_after_fork() failed");
861 initialize_password_db(true, ev_ctx
);
863 /* save the parent process id so the children can use it later */
864 parent_id
= messaging_server_id(msg_ctx
);
866 lsasd_reopen_logs(0);
867 pfh_daemon_config(DAEMON_NAME
,
869 &default_pf_lsasd_cfg
);
871 lsasd_setup_sig_term_handler(ev_ctx
);
872 lsasd_setup_sig_hup_handler(ev_ctx
);
874 BlockSignals(false, SIGTERM
);
875 BlockSignals(false, SIGHUP
);
877 ok
= lsasd_create_sockets(ev_ctx
, msg_ctx
, listen_fd
, &listen_fd_size
);
882 /* start children before any more initialization is done */
883 ok
= prefork_create_pool(ev_ctx
, /* mem_ctx */
888 pf_lsasd_cfg
.min_children
,
889 pf_lsasd_cfg
.max_children
,
890 &lsasd_children_main
,
897 messaging_register(msg_ctx
,
899 MSG_SMB_CONF_UPDATED
,
900 lsasd_smb_conf_updated
);
901 messaging_register(msg_ctx
, ev_ctx
,
902 MSG_PREFORK_CHILD_EVENT
, child_ping
);
904 status
= rpc_lsarpc_init(NULL
);
905 if (!NT_STATUS_IS_OK(status
)) {
906 DEBUG(0, ("Failed to register lsarpc rpc interface in lsasd! (%s)\n",
911 status
= rpc_samr_init(NULL
);
912 if (!NT_STATUS_IS_OK(status
)) {
913 DEBUG(0, ("Failed to register samr rpc interface in lsasd! (%s)\n",
918 status
= rpc_netlogon_init(NULL
);
919 if (!NT_STATUS_IS_OK(status
)) {
920 DEBUG(0, ("Failed to register netlogon rpc interface in lsasd! (%s)\n",
925 ok
= lsasd_setup_children_monitor(ev_ctx
, msg_ctx
);
927 DEBUG(0, ("Failed to setup children monitoring!\n"));
931 DEBUG(1, ("LSASD Daemon Started (%u)\n", (unsigned int)getpid()));
934 rc
= tevent_loop_wait(ev_ctx
);
936 /* should not be reached */
937 DEBUG(0,("lsasd: tevent_loop_wait() exited with %d - %s\n",
938 rc
, (rc
== 0) ? "out of events" : strerror(errno
)));