2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2002
7 Copyright (C) Volker Lendecke 2004,2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * We fork a child per domain to be able to act non-blocking in the main
25 * winbind daemon. A domain controller thousands of miles away being being
26 * slow replying with a 10.000 user list should not hold up netlogon calls
27 * that can be handled locally.
32 #include "rpc_client/rpc_client.h"
33 #include "nsswitch/wb_reqtrans.h"
35 #include "../lib/util/select.h"
36 #include "../libcli/security/security.h"
37 #include "system/select.h"
39 #include "../lib/util/tevent_unix.h"
40 #include "lib/param/loadparm.h"
41 #include "lib/util/sys_rw.h"
42 #include "lib/util/sys_rw_data.h"
46 #define DBGC_CLASS DBGC_WINBIND
48 extern bool override_logfile
;
50 static void forall_domain_children(bool (*fn
)(struct winbindd_child
*c
,
54 struct winbindd_domain
*d
;
56 for (d
= domain_list(); d
!= NULL
; d
= d
->next
) {
59 for (i
= 0; i
< lp_winbind_max_domain_connections(); i
++) {
60 struct winbindd_child
*c
= &d
->children
[i
];
67 ok
= fn(c
, private_data
);
75 static void forall_children(bool (*fn
)(struct winbindd_child
*c
,
79 struct winbindd_child
*c
;
84 ok
= fn(c
, private_data
);
92 ok
= fn(c
, private_data
);
98 forall_domain_children(fn
, private_data
);
101 /* Read some data from a client connection */
103 static NTSTATUS
child_read_request(int sock
, struct winbindd_request
*wreq
)
107 status
= read_data_ntstatus(sock
, (char *)wreq
, sizeof(*wreq
));
108 if (!NT_STATUS_IS_OK(status
)) {
109 DEBUG(3, ("child_read_request: read_data failed: %s\n",
114 if (wreq
->extra_len
== 0) {
115 wreq
->extra_data
.data
= NULL
;
119 DEBUG(10, ("Need to read %d extra bytes\n", (int)wreq
->extra_len
));
121 wreq
->extra_data
.data
= SMB_MALLOC_ARRAY(char, wreq
->extra_len
+ 1);
122 if (wreq
->extra_data
.data
== NULL
) {
123 DEBUG(0, ("malloc failed\n"));
124 return NT_STATUS_NO_MEMORY
;
127 /* Ensure null termination */
128 wreq
->extra_data
.data
[wreq
->extra_len
] = '\0';
130 status
= read_data_ntstatus(sock
, wreq
->extra_data
.data
,
132 if (!NT_STATUS_IS_OK(status
)) {
133 DEBUG(0, ("Could not read extra data: %s\n",
139 static NTSTATUS
child_write_response(int sock
, struct winbindd_response
*wrsp
)
144 iov
[0].iov_base
= (void *)wrsp
;
145 iov
[0].iov_len
= sizeof(struct winbindd_response
);
148 if (wrsp
->length
> sizeof(struct winbindd_response
)) {
149 iov
[1].iov_base
= (void *)wrsp
->extra_data
.data
;
150 iov
[1].iov_len
= wrsp
->length
-iov
[0].iov_len
;
154 DEBUG(10, ("Writing %d bytes to parent\n", (int)wrsp
->length
));
156 if (write_data_iov(sock
, iov
, iov_count
) != wrsp
->length
) {
157 DEBUG(0, ("Could not write result\n"));
158 return NT_STATUS_INVALID_HANDLE
;
165 * Do winbind child async request. This is not simply wb_simple_trans. We have
166 * to do the queueing ourselves because while a request is queued, the child
167 * might have crashed, and we have to re-fork it in the _trigger function.
170 struct wb_child_request_state
{
171 struct tevent_context
*ev
;
172 struct tevent_req
*queue_subreq
;
173 struct tevent_req
*subreq
;
174 struct winbindd_child
*child
;
175 struct winbindd_request
*request
;
176 struct winbindd_response
*response
;
179 static bool fork_domain_child(struct winbindd_child
*child
);
181 static void wb_child_request_waited(struct tevent_req
*subreq
);
182 static void wb_child_request_done(struct tevent_req
*subreq
);
183 static void wb_child_request_orphaned(struct tevent_req
*subreq
);
185 static void wb_child_request_cleanup(struct tevent_req
*req
,
186 enum tevent_req_state req_state
);
188 struct tevent_req
*wb_child_request_send(TALLOC_CTX
*mem_ctx
,
189 struct tevent_context
*ev
,
190 struct winbindd_child
*child
,
191 struct winbindd_request
*request
)
193 struct tevent_req
*req
;
194 struct wb_child_request_state
*state
;
195 struct tevent_req
*subreq
;
197 req
= tevent_req_create(mem_ctx
, &state
,
198 struct wb_child_request_state
);
204 state
->child
= child
;
207 * We have to make a copy of "request", because our caller
208 * might drop us via talloc_free().
210 * The talloc_move() magic in wb_child_request_cleanup() keeps
211 * all the requests, but if we are sitting deep within
212 * writev_send() down to the client, we have given it the
213 * pointer to "request". As our caller lost interest, it will
214 * just free "request", while writev_send still references it.
217 state
->request
= talloc_memdup(state
, request
, sizeof(*request
));
218 if (tevent_req_nomem(state
->request
, req
)) {
219 return tevent_req_post(req
, ev
);
222 if (request
->extra_data
.data
!= NULL
) {
223 state
->request
->extra_data
.data
= talloc_memdup(
225 request
->extra_data
.data
,
227 if (tevent_req_nomem(state
->request
->extra_data
.data
, req
)) {
228 return tevent_req_post(req
, ev
);
232 subreq
= tevent_queue_wait_send(state
, ev
, child
->queue
);
233 if (tevent_req_nomem(subreq
, req
)) {
234 return tevent_req_post(req
, ev
);
236 tevent_req_set_callback(subreq
, wb_child_request_waited
, req
);
237 state
->queue_subreq
= subreq
;
239 tevent_req_set_cleanup_fn(req
, wb_child_request_cleanup
);
244 static void wb_child_request_waited(struct tevent_req
*subreq
)
246 struct tevent_req
*req
= tevent_req_callback_data(
247 subreq
, struct tevent_req
);
248 struct wb_child_request_state
*state
= tevent_req_data(
249 req
, struct wb_child_request_state
);
252 ok
= tevent_queue_wait_recv(subreq
);
258 * We need to keep state->queue_subreq
259 * in order to block the queue.
263 if ((state
->child
->sock
== -1) && (!fork_domain_child(state
->child
))) {
264 tevent_req_error(req
, errno
);
268 tevent_fd_set_flags(state
->child
->monitor_fde
, 0);
270 subreq
= wb_simple_trans_send(state
, global_event_context(), NULL
,
271 state
->child
->sock
, state
->request
);
272 if (tevent_req_nomem(subreq
, req
)) {
276 state
->subreq
= subreq
;
277 tevent_req_set_callback(subreq
, wb_child_request_done
, req
);
278 tevent_req_set_endtime(req
, state
->ev
, timeval_current_ofs(300, 0));
281 static void wb_child_request_done(struct tevent_req
*subreq
)
283 struct tevent_req
*req
= tevent_req_callback_data(
284 subreq
, struct tevent_req
);
285 struct wb_child_request_state
*state
= tevent_req_data(
286 req
, struct wb_child_request_state
);
289 ret
= wb_simple_trans_recv(subreq
, state
, &state
->response
, &err
);
290 /* Freeing the subrequest is deferred until the cleanup function,
291 * which has to know whether a subrequest exists, and consequently
292 * decide whether to shut down the pipe to the child process.
295 tevent_req_error(req
, err
);
298 tevent_req_done(req
);
301 static void wb_child_request_orphaned(struct tevent_req
*subreq
)
303 struct winbindd_child
*child
=
304 (struct winbindd_child
*)tevent_req_callback_data_void(subreq
);
306 DBG_WARNING("cleanup orphaned subreq[%p]\n", subreq
);
309 if (child
->domain
!= NULL
) {
311 * If the child is attached to a domain,
312 * we need to make sure the domain queue
313 * can move forward, after the orphaned
316 tevent_queue_start(child
->domain
->queue
);
320 int wb_child_request_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
321 struct winbindd_response
**presponse
, int *err
)
323 struct wb_child_request_state
*state
= tevent_req_data(
324 req
, struct wb_child_request_state
);
326 if (tevent_req_is_unix_error(req
, err
)) {
329 *presponse
= talloc_move(mem_ctx
, &state
->response
);
333 static void wb_child_request_cleanup(struct tevent_req
*req
,
334 enum tevent_req_state req_state
)
336 struct wb_child_request_state
*state
=
337 tevent_req_data(req
, struct wb_child_request_state
);
339 if (state
->subreq
== NULL
) {
340 /* nothing to cleanup */
344 if (req_state
== TEVENT_REQ_RECEIVED
) {
345 struct tevent_req
*subreq
= NULL
;
348 * Our caller gave up, but we need to keep
349 * the low level request (wb_simple_trans)
350 * in order to maintain the parent child protocol.
352 * We also need to keep the child queue blocked
353 * until we got the response from the child.
356 subreq
= talloc_move(state
->child
->queue
, &state
->subreq
);
357 talloc_move(subreq
, &state
->queue_subreq
);
358 talloc_move(subreq
, &state
->request
);
359 tevent_req_set_callback(subreq
,
360 wb_child_request_orphaned
,
363 DBG_WARNING("keep orphaned subreq[%p]\n", subreq
);
367 TALLOC_FREE(state
->subreq
);
368 TALLOC_FREE(state
->queue_subreq
);
370 tevent_fd_set_flags(state
->child
->monitor_fde
, TEVENT_FD_READ
);
372 if (state
->child
->domain
!= NULL
) {
374 * If the child is attached to a domain,
375 * we need to make sure the domain queue
376 * can move forward, after the request
379 tevent_queue_start(state
->child
->domain
->queue
);
382 if (req_state
== TEVENT_REQ_DONE
) {
383 /* transmitted request and got response */
388 * Failed to transmit and receive response, or request
389 * cancelled while being serviced.
390 * The basic parent/child communication broke, close
393 TALLOC_FREE(state
->child
->monitor_fde
);
394 close(state
->child
->sock
);
395 state
->child
->sock
= -1;
398 static void child_socket_readable(struct tevent_context
*ev
,
399 struct tevent_fd
*fde
,
403 struct winbindd_child
*child
= private_data
;
405 if ((flags
& TEVENT_FD_READ
) == 0) {
409 TALLOC_FREE(child
->monitor_fde
);
412 * We're only active when there is no outstanding child
413 * request. Arriving here means the child closed its socket,
414 * it died. Do the same here.
417 SMB_ASSERT(child
->sock
!= -1);
423 static struct winbindd_child
*choose_domain_child(struct winbindd_domain
*domain
)
425 struct winbindd_child
*shortest
= &domain
->children
[0];
426 struct winbindd_child
*current
;
429 for (i
=0; i
<lp_winbind_max_domain_connections(); i
++) {
430 size_t shortest_len
, current_len
;
432 current
= &domain
->children
[i
];
433 current_len
= tevent_queue_length(current
->queue
);
435 if (current_len
== 0) {
440 shortest_len
= tevent_queue_length(shortest
->queue
);
442 if (current_len
< shortest_len
) {
450 struct dcerpc_binding_handle
*dom_child_handle(struct winbindd_domain
*domain
)
452 return domain
->binding_handle
;
455 struct wb_domain_request_state
{
456 struct tevent_context
*ev
;
457 struct tevent_queue_entry
*queue_entry
;
458 struct winbindd_domain
*domain
;
459 struct winbindd_child
*child
;
460 struct winbindd_request
*request
;
461 struct winbindd_request
*init_req
;
462 struct winbindd_response
*response
;
463 struct tevent_req
*pending_subreq
;
466 static void wb_domain_request_cleanup(struct tevent_req
*req
,
467 enum tevent_req_state req_state
)
469 struct wb_domain_request_state
*state
= tevent_req_data(
470 req
, struct wb_domain_request_state
);
473 * If we're completely done or got a failure.
474 * we should remove ourself from the domain queue,
475 * after removing the child subreq from the child queue
476 * and give the next one in the queue the chance
477 * to check for an idle child.
479 TALLOC_FREE(state
->pending_subreq
);
480 TALLOC_FREE(state
->queue_entry
);
481 tevent_queue_start(state
->domain
->queue
);
484 static void wb_domain_request_trigger(struct tevent_req
*req
,
486 static void wb_domain_request_gotdc(struct tevent_req
*subreq
);
487 static void wb_domain_request_initialized(struct tevent_req
*subreq
);
488 static void wb_domain_request_done(struct tevent_req
*subreq
);
490 struct tevent_req
*wb_domain_request_send(TALLOC_CTX
*mem_ctx
,
491 struct tevent_context
*ev
,
492 struct winbindd_domain
*domain
,
493 struct winbindd_request
*request
)
495 struct tevent_req
*req
;
496 struct wb_domain_request_state
*state
;
498 req
= tevent_req_create(mem_ctx
, &state
,
499 struct wb_domain_request_state
);
504 state
->domain
= domain
;
506 state
->request
= request
;
508 tevent_req_set_cleanup_fn(req
, wb_domain_request_cleanup
);
510 state
->queue_entry
= tevent_queue_add_entry(
511 domain
->queue
, state
->ev
, req
,
512 wb_domain_request_trigger
, NULL
);
513 if (tevent_req_nomem(state
->queue_entry
, req
)) {
514 return tevent_req_post(req
, ev
);
520 static void wb_domain_request_trigger(struct tevent_req
*req
,
523 struct wb_domain_request_state
*state
= tevent_req_data(
524 req
, struct wb_domain_request_state
);
525 struct winbindd_domain
*domain
= state
->domain
;
526 struct tevent_req
*subreq
= NULL
;
527 size_t shortest_queue_length
;
529 state
->child
= choose_domain_child(domain
);
530 shortest_queue_length
= tevent_queue_length(state
->child
->queue
);
531 if (shortest_queue_length
> 0) {
533 * All children are busy, we need to stop
534 * the queue and untrigger our own queue
535 * entry. Once a pending request
536 * is done it calls tevent_queue_start
537 * and we get retriggered.
540 tevent_queue_stop(state
->domain
->queue
);
541 tevent_queue_entry_untrigger(state
->queue_entry
);
545 if (domain
->initialized
) {
546 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
548 if (tevent_req_nomem(subreq
, req
)) {
551 tevent_req_set_callback(subreq
, wb_domain_request_done
, req
);
552 state
->pending_subreq
= subreq
;
555 * Once the domain is initialized and
556 * once we placed our real request into the child queue,
557 * we can remove ourself from the domain queue
558 * and give the next one in the queue the chance
559 * to check for an idle child.
561 TALLOC_FREE(state
->queue_entry
);
565 state
->init_req
= talloc_zero(state
, struct winbindd_request
);
566 if (tevent_req_nomem(state
->init_req
, req
)) {
570 if (IS_DC
|| domain
->primary
|| domain
->internal
) {
571 /* The primary domain has to find the DC name itself */
572 state
->init_req
->cmd
= WINBINDD_INIT_CONNECTION
;
573 fstrcpy(state
->init_req
->domain_name
, domain
->name
);
574 state
->init_req
->data
.init_conn
.is_primary
= domain
->primary
;
575 fstrcpy(state
->init_req
->data
.init_conn
.dcname
, "");
577 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
579 if (tevent_req_nomem(subreq
, req
)) {
582 tevent_req_set_callback(subreq
, wb_domain_request_initialized
,
584 state
->pending_subreq
= subreq
;
589 * This is *not* the primary domain,
590 * let's ask our DC about a DC name.
592 * We prefer getting a dns name in dc_unc,
593 * which is indicated by DS_RETURN_DNS_NAME.
594 * For NT4 domains we still get the netbios name.
596 subreq
= wb_dsgetdcname_send(state
, state
->ev
,
598 NULL
, /* domain_guid */
599 NULL
, /* site_name */
600 DS_RETURN_DNS_NAME
); /* flags */
601 if (tevent_req_nomem(subreq
, req
)) {
604 tevent_req_set_callback(subreq
, wb_domain_request_gotdc
, req
);
605 state
->pending_subreq
= subreq
;
609 static void wb_domain_request_gotdc(struct tevent_req
*subreq
)
611 struct tevent_req
*req
= tevent_req_callback_data(
612 subreq
, struct tevent_req
);
613 struct wb_domain_request_state
*state
= tevent_req_data(
614 req
, struct wb_domain_request_state
);
615 struct netr_DsRGetDCNameInfo
*dcinfo
= NULL
;
617 const char *dcname
= NULL
;
619 state
->pending_subreq
= NULL
;
621 status
= wb_dsgetdcname_recv(subreq
, state
, &dcinfo
);
623 if (tevent_req_nterror(req
, status
)) {
626 dcname
= dcinfo
->dc_unc
;
627 while (dcname
!= NULL
&& *dcname
== '\\') {
630 state
->init_req
->cmd
= WINBINDD_INIT_CONNECTION
;
631 fstrcpy(state
->init_req
->domain_name
, state
->domain
->name
);
632 state
->init_req
->data
.init_conn
.is_primary
= False
;
633 fstrcpy(state
->init_req
->data
.init_conn
.dcname
,
638 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
640 if (tevent_req_nomem(subreq
, req
)) {
643 tevent_req_set_callback(subreq
, wb_domain_request_initialized
, req
);
644 state
->pending_subreq
= subreq
;
647 static void wb_domain_request_initialized(struct tevent_req
*subreq
)
649 struct tevent_req
*req
= tevent_req_callback_data(
650 subreq
, struct tevent_req
);
651 struct wb_domain_request_state
*state
= tevent_req_data(
652 req
, struct wb_domain_request_state
);
653 struct winbindd_response
*response
;
656 state
->pending_subreq
= NULL
;
658 ret
= wb_child_request_recv(subreq
, talloc_tos(), &response
, &err
);
661 tevent_req_error(req
, err
);
665 if (!string_to_sid(&state
->domain
->sid
,
666 response
->data
.domain_info
.sid
)) {
667 DEBUG(1,("init_child_recv: Could not convert sid %s "
668 "from string\n", response
->data
.domain_info
.sid
));
669 tevent_req_error(req
, EINVAL
);
673 talloc_free(state
->domain
->name
);
674 state
->domain
->name
= talloc_strdup(state
->domain
,
675 response
->data
.domain_info
.name
);
676 if (state
->domain
->name
== NULL
) {
677 tevent_req_error(req
, ENOMEM
);
681 if (response
->data
.domain_info
.alt_name
[0] != '\0') {
682 talloc_free(state
->domain
->alt_name
);
684 state
->domain
->alt_name
= talloc_strdup(state
->domain
,
685 response
->data
.domain_info
.alt_name
);
686 if (state
->domain
->alt_name
== NULL
) {
687 tevent_req_error(req
, ENOMEM
);
692 state
->domain
->native_mode
= response
->data
.domain_info
.native_mode
;
693 state
->domain
->active_directory
=
694 response
->data
.domain_info
.active_directory
;
695 state
->domain
->initialized
= true;
697 TALLOC_FREE(response
);
699 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
701 if (tevent_req_nomem(subreq
, req
)) {
704 tevent_req_set_callback(subreq
, wb_domain_request_done
, req
);
705 state
->pending_subreq
= subreq
;
708 * Once the domain is initialized and
709 * once we placed our real request into the child queue,
710 * we can remove ourself from the domain queue
711 * and give the next one in the queue the chance
712 * to check for an idle child.
714 TALLOC_FREE(state
->queue_entry
);
717 static void wb_domain_request_done(struct tevent_req
*subreq
)
719 struct tevent_req
*req
= tevent_req_callback_data(
720 subreq
, struct tevent_req
);
721 struct wb_domain_request_state
*state
= tevent_req_data(
722 req
, struct wb_domain_request_state
);
725 state
->pending_subreq
= NULL
;
727 ret
= wb_child_request_recv(subreq
, talloc_tos(), &state
->response
,
731 tevent_req_error(req
, err
);
734 tevent_req_done(req
);
737 int wb_domain_request_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
738 struct winbindd_response
**presponse
, int *err
)
740 struct wb_domain_request_state
*state
= tevent_req_data(
741 req
, struct wb_domain_request_state
);
743 if (tevent_req_is_unix_error(req
, err
)) {
746 *presponse
= talloc_move(mem_ctx
, &state
->response
);
750 static void child_process_request(struct winbindd_child
*child
,
751 struct winbindd_cli_state
*state
)
753 struct winbindd_domain
*domain
= child
->domain
;
754 const struct winbindd_child_dispatch_table
*table
= child
->table
;
756 /* Free response data - we may be interrupted and receive another
757 command before being able to send this data off. */
759 state
->response
->result
= WINBINDD_ERROR
;
760 state
->response
->length
= sizeof(struct winbindd_response
);
762 /* as all requests in the child are sync, we can use talloc_tos() */
763 state
->mem_ctx
= talloc_tos();
765 /* Process command */
767 for (; table
->name
; table
++) {
768 if (state
->request
->cmd
== table
->struct_cmd
) {
769 DEBUG(10,("child_process_request: request fn %s\n",
771 state
->response
->result
= table
->struct_fn(domain
, state
);
776 DEBUG(1, ("child_process_request: unknown request fn number %d\n",
777 (int)state
->request
->cmd
));
778 state
->response
->result
= WINBINDD_ERROR
;
781 void setup_child(struct winbindd_domain
*domain
, struct winbindd_child
*child
,
782 const struct winbindd_child_dispatch_table
*table
,
783 const char *logprefix
,
786 const struct loadparm_substitution
*lp_sub
=
787 loadparm_s3_global_substitution();
789 if (logprefix
&& logname
) {
790 char *logbase
= NULL
;
792 if (*lp_logfile(talloc_tos(), lp_sub
)) {
795 if (asprintf(&logbase
, "%s", lp_logfile(talloc_tos(), lp_sub
)) < 0) {
796 smb_panic("Internal error: asprintf failed");
799 if ((end
= strrchr_m(logbase
, '/'))) {
803 if (asprintf(&logbase
, "%s", get_dyn_LOGFILEBASE()) < 0) {
804 smb_panic("Internal error: asprintf failed");
808 if (asprintf(&child
->logfilename
, "%s/%s-%s",
809 logbase
, logprefix
, logname
) < 0) {
811 smb_panic("Internal error: asprintf failed");
816 smb_panic("Internal error: logprefix == NULL && "
822 child
->domain
= domain
;
823 child
->table
= table
;
824 child
->queue
= tevent_queue_create(NULL
, "winbind_child");
825 SMB_ASSERT(child
->queue
!= NULL
);
826 if (domain
== NULL
) {
827 child
->binding_handle
= wbint_binding_handle(NULL
, NULL
, child
);
828 SMB_ASSERT(child
->binding_handle
!= NULL
);
832 struct winbind_child_died_state
{
834 struct winbindd_child
*child
;
837 static bool winbind_child_died_fn(struct winbindd_child
*child
,
840 struct winbind_child_died_state
*state
= private_data
;
842 if (child
->pid
== state
->pid
) {
843 state
->child
= child
;
849 void winbind_child_died(pid_t pid
)
851 struct winbind_child_died_state state
= { .pid
= pid
};
853 forall_children(winbind_child_died_fn
, &state
);
855 if (state
.child
== NULL
) {
856 DEBUG(5, ("Already reaped child %u died\n", (unsigned int)pid
));
860 state
.child
->pid
= 0;
863 /* Ensure any negative cache entries with the netbios or realm names are removed. */
865 void winbindd_flush_negative_conn_cache(struct winbindd_domain
*domain
)
867 flush_negative_conn_cache_for_domain(domain
->name
);
868 if (domain
->alt_name
!= NULL
) {
869 flush_negative_conn_cache_for_domain(domain
->alt_name
);
874 * Parent winbindd process sets its own debug level first and then
875 * sends a message to all the winbindd children to adjust their debug
876 * level to that of parents.
879 struct winbind_msg_relay_state
{
880 struct messaging_context
*msg_ctx
;
885 static bool winbind_msg_relay_fn(struct winbindd_child
*child
,
888 struct winbind_msg_relay_state
*state
= private_data
;
890 DBG_DEBUG("sending message to pid %u.\n",
891 (unsigned int)child
->pid
);
893 messaging_send(state
->msg_ctx
, pid_to_procid(child
->pid
),
894 state
->msg_type
, state
->data
);
898 void winbind_msg_debug(struct messaging_context
*msg_ctx
,
901 struct server_id server_id
,
904 struct winbind_msg_relay_state state
= {
905 .msg_ctx
= msg_ctx
, .msg_type
= msg_type
, .data
= data
908 DEBUG(10,("winbind_msg_debug: got debug message.\n"));
910 debug_message(msg_ctx
, private_data
, MSG_DEBUG
, server_id
, data
);
912 forall_children(winbind_msg_relay_fn
, &state
);
915 void winbind_disconnect_dc_parent(struct messaging_context
*msg_ctx
,
918 struct server_id server_id
,
921 struct winbind_msg_relay_state state
= {
922 .msg_ctx
= msg_ctx
, .msg_type
= msg_type
, .data
= data
925 DBG_DEBUG("Got disconnect_dc message\n");
927 forall_children(winbind_msg_relay_fn
, &state
);
930 /* Set our domains as offline and forward the offline message to our children. */
932 struct winbind_msg_on_offline_state
{
933 struct messaging_context
*msg_ctx
;
937 static bool winbind_msg_on_offline_fn(struct winbindd_child
*child
,
940 struct winbind_msg_on_offline_state
*state
= private_data
;
942 if (child
->domain
->internal
) {
947 * Each winbindd child should only process requests for one
948 * domain - make sure we only set it online / offline for that
951 DBG_DEBUG("sending message to pid %u for domain %s.\n",
952 (unsigned int)child
->pid
, child
->domain
->name
);
954 messaging_send_buf(state
->msg_ctx
,
955 pid_to_procid(child
->pid
),
957 (const uint8_t *)child
->domain
->name
,
958 strlen(child
->domain
->name
)+1);
963 void winbind_msg_offline(struct messaging_context
*msg_ctx
,
966 struct server_id server_id
,
969 struct winbind_msg_on_offline_state state
= {
971 .msg_type
= MSG_WINBIND_OFFLINE
,
973 struct winbindd_domain
*domain
;
975 DEBUG(10,("winbind_msg_offline: got offline message.\n"));
977 if (!lp_winbind_offline_logon()) {
978 DEBUG(10,("winbind_msg_offline: rejecting offline message.\n"));
982 /* Set our global state as offline. */
983 if (!set_global_winbindd_state_offline()) {
984 DEBUG(10,("winbind_msg_offline: offline request failed.\n"));
988 /* Set all our domains as offline. */
989 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
990 if (domain
->internal
) {
993 DEBUG(5,("winbind_msg_offline: marking %s offline.\n", domain
->name
));
994 set_domain_offline(domain
);
997 forall_domain_children(winbind_msg_on_offline_fn
, &state
);
1000 /* Set our domains as online and forward the online message to our children. */
1002 void winbind_msg_online(struct messaging_context
*msg_ctx
,
1005 struct server_id server_id
,
1008 struct winbind_msg_on_offline_state state
= {
1010 .msg_type
= MSG_WINBIND_ONLINE
,
1012 struct winbindd_domain
*domain
;
1014 DEBUG(10,("winbind_msg_online: got online message.\n"));
1016 if (!lp_winbind_offline_logon()) {
1017 DEBUG(10,("winbind_msg_online: rejecting online message.\n"));
1021 /* Set our global state as online. */
1022 set_global_winbindd_state_online();
1024 smb_nscd_flush_user_cache();
1025 smb_nscd_flush_group_cache();
1027 /* Set all our domains as online. */
1028 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1029 if (domain
->internal
) {
1032 DEBUG(5,("winbind_msg_online: requesting %s to go online.\n", domain
->name
));
1034 winbindd_flush_negative_conn_cache(domain
);
1035 set_domain_online_request(domain
);
1037 /* Send an online message to the idmap child when our
1038 primary domain comes back online */
1040 if ( domain
->primary
) {
1041 struct winbindd_child
*idmap
= idmap_child();
1043 if ( idmap
->pid
!= 0 ) {
1044 messaging_send_buf(msg_ctx
,
1045 pid_to_procid(idmap
->pid
),
1047 (const uint8_t *)domain
->name
,
1048 strlen(domain
->name
)+1);
1053 forall_domain_children(winbind_msg_on_offline_fn
, &state
);
1056 static const char *collect_onlinestatus(TALLOC_CTX
*mem_ctx
)
1058 struct winbindd_domain
*domain
;
1061 if ((buf
= talloc_asprintf(mem_ctx
, "global:%s ",
1062 get_global_winbindd_state_offline() ?
1063 "Offline":"Online")) == NULL
) {
1067 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1068 if ((buf
= talloc_asprintf_append_buffer(buf
, "%s:%s ",
1071 "Online":"Offline")) == NULL
) {
1076 buf
= talloc_asprintf_append_buffer(buf
, "\n");
1078 DEBUG(5,("collect_onlinestatus: %s", buf
));
1083 void winbind_msg_onlinestatus(struct messaging_context
*msg_ctx
,
1086 struct server_id server_id
,
1089 TALLOC_CTX
*mem_ctx
;
1090 const char *message
;
1092 DEBUG(5,("winbind_msg_onlinestatus received.\n"));
1094 mem_ctx
= talloc_init("winbind_msg_onlinestatus");
1095 if (mem_ctx
== NULL
) {
1099 message
= collect_onlinestatus(mem_ctx
);
1100 if (message
== NULL
) {
1101 talloc_destroy(mem_ctx
);
1105 messaging_send_buf(msg_ctx
, server_id
, MSG_WINBIND_ONLINESTATUS
,
1106 (const uint8_t *)message
, strlen(message
) + 1);
1108 talloc_destroy(mem_ctx
);
1111 void winbind_msg_dump_domain_list(struct messaging_context
*msg_ctx
,
1114 struct server_id server_id
,
1117 TALLOC_CTX
*mem_ctx
;
1118 const char *message
= NULL
;
1119 const char *domain
= NULL
;
1122 struct winbindd_domain
*dom
= NULL
;
1124 DEBUG(5,("winbind_msg_dump_domain_list received.\n"));
1126 mem_ctx
= talloc_init("winbind_msg_dump_domain_list");
1131 if (data
->length
> 0) {
1132 domain
= (const char *)data
->data
;
1137 DEBUG(5,("winbind_msg_dump_domain_list for domain: %s\n",
1140 message
= NDR_PRINT_STRUCT_STRING(mem_ctx
, winbindd_domain
,
1141 find_domain_from_name_noinit(domain
));
1143 talloc_destroy(mem_ctx
);
1147 messaging_send_buf(msg_ctx
, server_id
,
1148 MSG_WINBIND_DUMP_DOMAIN_LIST
,
1149 (const uint8_t *)message
, strlen(message
) + 1);
1151 talloc_destroy(mem_ctx
);
1156 DEBUG(5,("winbind_msg_dump_domain_list all domains\n"));
1158 for (dom
= domain_list(); dom
; dom
=dom
->next
) {
1159 message
= NDR_PRINT_STRUCT_STRING(mem_ctx
, winbindd_domain
, dom
);
1161 talloc_destroy(mem_ctx
);
1165 s
= talloc_asprintf_append(s
, "%s\n", message
);
1167 talloc_destroy(mem_ctx
);
1172 status
= messaging_send_buf(msg_ctx
, server_id
,
1173 MSG_WINBIND_DUMP_DOMAIN_LIST
,
1174 (uint8_t *)s
, strlen(s
) + 1);
1175 if (!NT_STATUS_IS_OK(status
)) {
1176 DEBUG(0,("failed to send message: %s\n",
1177 nt_errstr(status
)));
1180 talloc_destroy(mem_ctx
);
1183 static void account_lockout_policy_handler(struct tevent_context
*ctx
,
1184 struct tevent_timer
*te
,
1188 struct winbindd_child
*child
=
1189 (struct winbindd_child
*)private_data
;
1190 TALLOC_CTX
*mem_ctx
= NULL
;
1191 struct samr_DomInfo12 lockout_policy
;
1194 DEBUG(10,("account_lockout_policy_handler called\n"));
1196 TALLOC_FREE(child
->lockout_policy_event
);
1198 if ( !winbindd_can_contact_domain( child
->domain
) ) {
1199 DEBUG(10,("account_lockout_policy_handler: Removing myself since I "
1200 "do not have an incoming trust to domain %s\n",
1201 child
->domain
->name
));
1206 mem_ctx
= talloc_init("account_lockout_policy_handler ctx");
1208 result
= NT_STATUS_NO_MEMORY
;
1210 result
= wb_cache_lockout_policy(child
->domain
, mem_ctx
,
1213 TALLOC_FREE(mem_ctx
);
1215 if (!NT_STATUS_IS_OK(result
)) {
1216 DEBUG(10,("account_lockout_policy_handler: lockout_policy failed error %s\n",
1217 nt_errstr(result
)));
1220 child
->lockout_policy_event
= tevent_add_timer(global_event_context(), NULL
,
1221 timeval_current_ofs(3600, 0),
1222 account_lockout_policy_handler
,
1226 static time_t get_machine_password_timeout(void)
1228 /* until we have gpo support use lp setting */
1229 return lp_machine_password_timeout();
1232 static bool calculate_next_machine_pwd_change(const char *domain
,
1235 time_t pass_last_set_time
;
1241 pw
= secrets_fetch_machine_password(domain
,
1242 &pass_last_set_time
,
1246 DEBUG(0,("cannot fetch own machine password ????"));
1252 timeout
= get_machine_password_timeout();
1254 DEBUG(10,("machine password never expires\n"));
1258 tv
.tv_sec
= pass_last_set_time
;
1259 DEBUG(10, ("password last changed %s\n",
1260 timeval_string(talloc_tos(), &tv
, false)));
1261 tv
.tv_sec
+= timeout
;
1262 DEBUGADD(10, ("password valid until %s\n",
1263 timeval_string(talloc_tos(), &tv
, false)));
1265 if (time(NULL
) < (pass_last_set_time
+ timeout
)) {
1266 next_change
= pass_last_set_time
+ timeout
;
1267 DEBUG(10,("machine password still valid until: %s\n",
1268 http_timestring(talloc_tos(), next_change
)));
1269 *t
= timeval_set(next_change
, 0);
1271 if (lp_clustering()) {
1274 * When having a cluster, we have several
1275 * winbinds racing for the password change. In
1276 * the machine_password_change_handler()
1277 * function we check if someone else was
1278 * faster when the event triggers. We add a
1279 * 255-second random delay here, so that we
1280 * don't run to change the password at the
1281 * exact same moment.
1283 generate_random_buffer(&randbuf
, sizeof(randbuf
));
1284 DEBUG(10, ("adding %d seconds randomness\n",
1286 t
->tv_sec
+= randbuf
;
1291 DEBUG(10,("machine password expired, needs immediate change\n"));
1293 *t
= timeval_zero();
1298 static void machine_password_change_handler(struct tevent_context
*ctx
,
1299 struct tevent_timer
*te
,
1303 struct messaging_context
*msg_ctx
= global_messaging_context();
1304 struct winbindd_child
*child
=
1305 (struct winbindd_child
*)private_data
;
1306 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
1307 struct netlogon_creds_cli_context
*netlogon_creds_ctx
= NULL
;
1309 struct timeval next_change
;
1311 DEBUG(10,("machine_password_change_handler called\n"));
1313 TALLOC_FREE(child
->machine_password_change_event
);
1315 if (!calculate_next_machine_pwd_change(child
->domain
->name
,
1317 DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
1321 DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
1322 timeval_string(talloc_tos(), &next_change
, false)));
1324 if (!timeval_expired(&next_change
)) {
1325 DEBUG(10, ("Someone else has already changed the pw\n"));
1329 if (!winbindd_can_contact_domain(child
->domain
)) {
1330 DEBUG(10,("machine_password_change_handler: Removing myself since I "
1331 "do not have an incoming trust to domain %s\n",
1332 child
->domain
->name
));
1336 result
= cm_connect_netlogon_secure(child
->domain
,
1338 &netlogon_creds_ctx
);
1339 if (!NT_STATUS_IS_OK(result
)) {
1340 DEBUG(10,("machine_password_change_handler: "
1341 "failed to connect netlogon pipe: %s\n",
1342 nt_errstr(result
)));
1346 result
= trust_pw_change(netlogon_creds_ctx
,
1348 netlogon_pipe
->binding_handle
,
1349 child
->domain
->name
,
1350 child
->domain
->dcname
,
1353 DEBUG(10, ("machine_password_change_handler: "
1354 "trust_pw_change returned %s\n",
1355 nt_errstr(result
)));
1357 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1358 DEBUG(3,("machine_password_change_handler: password set returned "
1359 "ACCESS_DENIED. Maybe the trust account "
1360 "password was changed and we didn't know it. "
1361 "Killing connections to domain %s\n",
1362 child
->domain
->name
));
1363 invalidate_cm_connection(child
->domain
);
1366 if (!calculate_next_machine_pwd_change(child
->domain
->name
,
1368 DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
1372 DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
1373 timeval_string(talloc_tos(), &next_change
, false)));
1375 if (!NT_STATUS_IS_OK(result
)) {
1378 * In case of failure, give the DC a minute to recover
1380 tmp
= timeval_current_ofs(60, 0);
1381 next_change
= timeval_max(&next_change
, &tmp
);
1385 child
->machine_password_change_event
= tevent_add_timer(global_event_context(), NULL
,
1387 machine_password_change_handler
,
1391 /* Deal with a request to go offline. */
1393 static void child_msg_offline(struct messaging_context
*msg
,
1396 struct server_id server_id
,
1399 struct winbindd_domain
*domain
;
1400 struct winbindd_domain
*primary_domain
= NULL
;
1401 const char *domainname
= (const char *)data
->data
;
1403 if (data
->data
== NULL
|| data
->length
== 0) {
1407 DEBUG(5,("child_msg_offline received for domain %s.\n", domainname
));
1409 if (!lp_winbind_offline_logon()) {
1410 DEBUG(10,("child_msg_offline: rejecting offline message.\n"));
1414 primary_domain
= find_our_domain();
1416 /* Mark the requested domain offline. */
1418 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1419 if (domain
->internal
) {
1422 if (strequal(domain
->name
, domainname
)) {
1423 DEBUG(5,("child_msg_offline: marking %s offline.\n", domain
->name
));
1424 set_domain_offline(domain
);
1425 /* we are in the trusted domain, set the primary domain
1427 if (domain
!= primary_domain
) {
1428 set_domain_offline(primary_domain
);
1434 /* Deal with a request to go online. */
1436 static void child_msg_online(struct messaging_context
*msg
,
1439 struct server_id server_id
,
1442 struct winbindd_domain
*domain
;
1443 struct winbindd_domain
*primary_domain
= NULL
;
1444 const char *domainname
= (const char *)data
->data
;
1446 if (data
->data
== NULL
|| data
->length
== 0) {
1450 DEBUG(5,("child_msg_online received for domain %s.\n", domainname
));
1452 if (!lp_winbind_offline_logon()) {
1453 DEBUG(10,("child_msg_online: rejecting online message.\n"));
1457 primary_domain
= find_our_domain();
1459 /* Set our global state as online. */
1460 set_global_winbindd_state_online();
1462 /* Try and mark everything online - delete any negative cache entries
1463 to force a reconnect now. */
1465 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1466 if (domain
->internal
) {
1469 if (strequal(domain
->name
, domainname
)) {
1470 DEBUG(5,("child_msg_online: requesting %s to go online.\n", domain
->name
));
1471 winbindd_flush_negative_conn_cache(domain
);
1472 set_domain_online_request(domain
);
1474 /* we can be in trusted domain, which will contact primary domain
1475 * we have to bring primary domain online in trusted domain process
1476 * see, winbindd_dual_pam_auth() --> winbindd_dual_pam_auth_samlogon()
1477 * --> contact_domain = find_our_domain()
1479 if (domain
!= primary_domain
) {
1480 winbindd_flush_negative_conn_cache(primary_domain
);
1481 set_domain_online_request(primary_domain
);
1487 struct winbindd_reinit_after_fork_state
{
1488 const struct winbindd_child
*myself
;
1491 static bool winbindd_reinit_after_fork_fn(struct winbindd_child
*child
,
1494 struct winbindd_reinit_after_fork_state
*state
= private_data
;
1496 if (child
== state
->myself
) {
1500 /* Destroy all possible events in child list. */
1501 TALLOC_FREE(child
->lockout_policy_event
);
1502 TALLOC_FREE(child
->machine_password_change_event
);
1505 * Children should never be able to send each other messages,
1506 * all messages must go through the parent.
1508 child
->pid
= (pid_t
)0;
1511 * Close service sockets to all other children
1513 if (child
->sock
!= -1) {
1521 NTSTATUS
winbindd_reinit_after_fork(const struct winbindd_child
*myself
,
1522 const char *logfilename
)
1524 struct winbindd_reinit_after_fork_state state
= { .myself
= myself
};
1525 struct winbindd_domain
*domain
;
1528 status
= reinit_after_fork(
1529 global_messaging_context(),
1530 global_event_context(),
1532 if (!NT_STATUS_IS_OK(status
)) {
1533 DEBUG(0,("reinit_after_fork() failed\n"));
1536 initialize_password_db(true, global_event_context());
1538 close_conns_after_fork();
1540 if (!override_logfile
&& logfilename
) {
1541 lp_set_logfile(logfilename
);
1545 if (!winbindd_setup_sig_term_handler(false))
1546 return NT_STATUS_NO_MEMORY
;
1547 if (!winbindd_setup_sig_hup_handler(override_logfile
? NULL
:
1549 return NT_STATUS_NO_MEMORY
;
1551 /* Stop zombies in children */
1554 /* Don't handle the same messages as our parent. */
1555 messaging_deregister(global_messaging_context(),
1556 MSG_SMB_CONF_UPDATED
, NULL
);
1557 messaging_deregister(global_messaging_context(),
1558 MSG_SHUTDOWN
, NULL
);
1559 messaging_deregister(global_messaging_context(),
1560 MSG_WINBIND_OFFLINE
, NULL
);
1561 messaging_deregister(global_messaging_context(),
1562 MSG_WINBIND_ONLINE
, NULL
);
1563 messaging_deregister(global_messaging_context(),
1564 MSG_WINBIND_ONLINESTATUS
, NULL
);
1565 messaging_deregister(global_messaging_context(),
1566 MSG_WINBIND_DUMP_DOMAIN_LIST
, NULL
);
1567 messaging_deregister(global_messaging_context(),
1570 messaging_deregister(global_messaging_context(),
1571 MSG_WINBIND_DOMAIN_OFFLINE
, NULL
);
1572 messaging_deregister(global_messaging_context(),
1573 MSG_WINBIND_DOMAIN_ONLINE
, NULL
);
1575 /* We have destroyed all events in the winbindd_event_context
1576 * in reinit_after_fork(), so clean out all possible pending
1577 * event pointers. */
1579 /* Deal with check_online_events. */
1581 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1582 TALLOC_FREE(domain
->check_online_event
);
1585 /* Ensure we're not handling a credential cache event inherited
1586 * from our parent. */
1588 ccache_remove_all_after_fork();
1590 forall_children(winbindd_reinit_after_fork_fn
, &state
);
1592 return NT_STATUS_OK
;
1596 * In a child there will be only one domain, reference that here.
1598 static struct winbindd_domain
*child_domain
;
1600 struct winbindd_domain
*wb_child_domain(void)
1602 return child_domain
;
1605 struct child_handler_state
{
1606 struct winbindd_child
*child
;
1607 struct winbindd_cli_state cli
;
1610 static void child_handler(struct tevent_context
*ev
, struct tevent_fd
*fde
,
1611 uint16_t flags
, void *private_data
)
1613 struct child_handler_state
*state
=
1614 (struct child_handler_state
*)private_data
;
1617 /* fetch a request from the main daemon */
1618 status
= child_read_request(state
->cli
.sock
, state
->cli
.request
);
1620 if (!NT_STATUS_IS_OK(status
)) {
1621 /* we lost contact with our parent */
1625 DEBUG(4,("child daemon request %d\n",
1626 (int)state
->cli
.request
->cmd
));
1628 ZERO_STRUCTP(state
->cli
.response
);
1629 state
->cli
.request
->null_term
= '\0';
1630 state
->cli
.mem_ctx
= talloc_tos();
1631 child_process_request(state
->child
, &state
->cli
);
1633 DEBUG(4, ("Finished processing child request %d\n",
1634 (int)state
->cli
.request
->cmd
));
1636 SAFE_FREE(state
->cli
.request
->extra_data
.data
);
1638 status
= child_write_response(state
->cli
.sock
, state
->cli
.response
);
1639 if (!NT_STATUS_IS_OK(status
)) {
1644 static bool fork_domain_child(struct winbindd_child
*child
)
1647 struct child_handler_state state
;
1648 struct winbindd_request request
;
1649 struct winbindd_response response
;
1650 struct winbindd_domain
*primary_domain
= NULL
;
1653 struct tevent_fd
*fde
;
1655 if (child
->domain
) {
1656 DEBUG(10, ("fork_domain_child called for domain '%s'\n",
1657 child
->domain
->name
));
1659 DEBUG(10, ("fork_domain_child called without domain.\n"));
1662 if (socketpair(AF_UNIX
, SOCK_STREAM
, 0, fdpair
) != 0) {
1663 DEBUG(0, ("Could not open child pipe: %s\n",
1669 state
.child
= child
;
1670 state
.cli
.pid
= getpid();
1671 state
.cli
.request
= &request
;
1672 state
.cli
.response
= &response
;
1674 child
->pid
= fork();
1676 if (child
->pid
== -1) {
1677 DEBUG(0, ("Could not fork: %s\n", strerror(errno
)));
1683 if (child
->pid
!= 0) {
1689 nread
= sys_read(fdpair
[1], &status
, sizeof(status
));
1690 if (nread
!= sizeof(status
)) {
1691 DEBUG(1, ("fork_domain_child: Could not read child status: "
1692 "nread=%d, error=%s\n", (int)nread
,
1697 if (!NT_STATUS_IS_OK(status
)) {
1698 DEBUG(1, ("fork_domain_child: Child status is %s\n",
1699 nt_errstr(status
)));
1704 child
->monitor_fde
= tevent_add_fd(global_event_context(),
1705 global_event_context(),
1708 child_socket_readable
,
1710 if (child
->monitor_fde
== NULL
) {
1711 DBG_WARNING("tevent_add_fd failed\n");
1716 child
->sock
= fdpair
[1];
1717 set_blocking(child
->sock
, false);
1722 child_domain
= child
->domain
;
1724 DEBUG(10, ("Child process %d\n", (int)getpid()));
1726 state
.cli
.sock
= fdpair
[0];
1729 status
= winbindd_reinit_after_fork(child
, child
->logfilename
);
1731 nwritten
= sys_write(state
.cli
.sock
, &status
, sizeof(status
));
1732 if (nwritten
!= sizeof(status
)) {
1733 DEBUG(1, ("fork_domain_child: Could not write status: "
1734 "nwritten=%d, error=%s\n", (int)nwritten
,
1738 if (!NT_STATUS_IS_OK(status
)) {
1739 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
1740 nt_errstr(status
)));
1744 if (child_domain
!= NULL
) {
1745 setproctitle("domain child [%s]", child_domain
->name
);
1746 } else if (child
== idmap_child()) {
1747 setproctitle("idmap child");
1750 /* Handle online/offline messages. */
1751 messaging_register(global_messaging_context(), NULL
,
1752 MSG_WINBIND_OFFLINE
, child_msg_offline
);
1753 messaging_register(global_messaging_context(), NULL
,
1754 MSG_WINBIND_ONLINE
, child_msg_online
);
1755 messaging_register(global_messaging_context(), NULL
,
1756 MSG_DEBUG
, debug_message
);
1757 messaging_register(global_messaging_context(), NULL
,
1758 MSG_WINBIND_IP_DROPPED
,
1759 winbind_msg_ip_dropped
);
1760 messaging_register(global_messaging_context(), NULL
,
1761 MSG_WINBIND_DISCONNECT_DC
,
1762 winbind_msg_disconnect_dc
);
1764 primary_domain
= find_our_domain();
1766 if (primary_domain
== NULL
) {
1767 smb_panic("no primary domain found");
1770 /* It doesn't matter if we allow cache login,
1771 * try to bring domain online after fork. */
1772 if ( child
->domain
) {
1773 child
->domain
->startup
= True
;
1774 child
->domain
->startup_time
= time_mono(NULL
);
1775 /* we can be in primary domain or in trusted domain
1776 * If we are in trusted domain, set the primary domain
1777 * in start-up mode */
1778 if (!(child
->domain
->internal
)) {
1779 set_domain_online_request(child
->domain
);
1780 if (!(child
->domain
->primary
)) {
1781 primary_domain
->startup
= True
;
1782 primary_domain
->startup_time
= time_mono(NULL
);
1783 set_domain_online_request(primary_domain
);
1789 * We are in idmap child, make sure that we set the
1790 * check_online_event to bring primary domain online.
1792 if (child
== idmap_child()) {
1793 set_domain_online_request(primary_domain
);
1796 /* We might be in the idmap child...*/
1797 if (child
->domain
&& !(child
->domain
->internal
) &&
1798 lp_winbind_offline_logon()) {
1800 set_domain_online_request(child
->domain
);
1802 if (primary_domain
&& (primary_domain
!= child
->domain
)) {
1803 /* We need to talk to the primary
1804 * domain as well as the trusted
1805 * domain inside a trusted domain
1808 * set_dc_type_and_flags_trustinfo()
1811 set_domain_online_request(primary_domain
);
1814 child
->lockout_policy_event
= tevent_add_timer(
1815 global_event_context(), NULL
, timeval_zero(),
1816 account_lockout_policy_handler
,
1820 if (child
->domain
&& child
->domain
->primary
&&
1821 !USE_KERBEROS_KEYTAB
&&
1822 lp_server_role() == ROLE_DOMAIN_MEMBER
) {
1824 struct timeval next_change
;
1826 if (calculate_next_machine_pwd_change(child
->domain
->name
,
1828 child
->machine_password_change_event
= tevent_add_timer(
1829 global_event_context(), NULL
, next_change
,
1830 machine_password_change_handler
,
1835 fde
= tevent_add_fd(global_event_context(), NULL
, state
.cli
.sock
,
1836 TEVENT_FD_READ
, child_handler
, &state
);
1838 DEBUG(1, ("tevent_add_fd failed\n"));
1845 TALLOC_CTX
*frame
= talloc_stackframe();
1847 ret
= tevent_loop_once(global_event_context());
1849 DEBUG(1, ("tevent_loop_once failed: %s\n",
1854 if (child
->domain
&& child
->domain
->startup
&&
1855 (time_mono(NULL
) > child
->domain
->startup_time
+ 30)) {
1856 /* No longer in "startup" mode. */
1857 DEBUG(10,("fork_domain_child: domain %s no longer in 'startup' mode.\n",
1858 child
->domain
->name
));
1859 child
->domain
->startup
= False
;
1866 void winbind_msg_ip_dropped_parent(struct messaging_context
*msg_ctx
,
1869 struct server_id server_id
,
1872 struct winbind_msg_relay_state state
= {
1874 .msg_type
= msg_type
,
1878 winbind_msg_ip_dropped(msg_ctx
, private_data
, msg_type
,
1881 forall_children(winbind_msg_relay_fn
, &state
);