2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2002
7 Copyright (C) Volker Lendecke 2004,2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * We fork a child per domain to be able to act non-blocking in the main
25 * winbind daemon. A domain controller thousands of miles away being being
26 * slow replying with a 10.000 user list should not hold up netlogon calls
27 * that can be handled locally.
32 #include "rpc_client/rpc_client.h"
33 #include "nsswitch/wb_reqtrans.h"
35 #include "../lib/util/select.h"
36 #include "winbindd_traceid.h"
37 #include "../libcli/security/security.h"
38 #include "system/select.h"
40 #include "../lib/util/tevent_unix.h"
41 #include "lib/param/loadparm.h"
42 #include "lib/util/sys_rw.h"
43 #include "lib/util/sys_rw_data.h"
45 #include "lib/util/string_wrappers.h"
46 #include "lib/global_contexts.h"
48 #include "libcli/auth/netlogon_creds_cli.h"
49 #include "../lib/util/pidfile.h"
50 #include "librpc/gen_ndr/ndr_winbind_c.h"
53 #define DBGC_CLASS DBGC_WINBIND
55 static void forall_domain_children(bool (*fn
)(struct winbindd_child
*c
,
59 struct winbindd_domain
*d
;
61 for (d
= domain_list(); d
!= NULL
; d
= d
->next
) {
64 for (i
= 0; i
< lp_winbind_max_domain_connections(); i
++) {
65 struct winbindd_child
*c
= &d
->children
[i
];
72 ok
= fn(c
, private_data
);
80 static void forall_children(bool (*fn
)(struct winbindd_child
*c
,
84 struct winbindd_child
*c
;
89 ok
= fn(c
, private_data
);
97 ok
= fn(c
, private_data
);
103 forall_domain_children(fn
, private_data
);
106 /* Read some data from a client connection */
108 static NTSTATUS
child_read_request(int sock
, struct winbindd_request
*wreq
)
112 status
= read_data_ntstatus(sock
, (char *)wreq
, sizeof(*wreq
));
113 if (!NT_STATUS_IS_OK(status
)) {
114 DEBUG(3, ("child_read_request: read_data failed: %s\n",
119 if (wreq
->extra_len
== 0) {
120 wreq
->extra_data
.data
= NULL
;
124 DEBUG(10, ("Need to read %d extra bytes\n", (int)wreq
->extra_len
));
126 wreq
->extra_data
.data
= SMB_MALLOC_ARRAY(char, wreq
->extra_len
+ 1);
127 if (wreq
->extra_data
.data
== NULL
) {
128 DEBUG(0, ("malloc failed\n"));
129 return NT_STATUS_NO_MEMORY
;
132 /* Ensure null termination */
133 wreq
->extra_data
.data
[wreq
->extra_len
] = '\0';
135 status
= read_data_ntstatus(sock
, wreq
->extra_data
.data
,
137 if (!NT_STATUS_IS_OK(status
)) {
138 DEBUG(0, ("Could not read extra data: %s\n",
144 static NTSTATUS
child_write_response(int sock
, struct winbindd_response
*wrsp
)
149 iov
[0].iov_base
= (void *)wrsp
;
150 iov
[0].iov_len
= sizeof(struct winbindd_response
);
153 if (wrsp
->length
> sizeof(struct winbindd_response
)) {
154 iov
[1].iov_base
= (void *)wrsp
->extra_data
.data
;
155 iov
[1].iov_len
= wrsp
->length
-iov
[0].iov_len
;
159 DEBUG(10, ("Writing %d bytes to parent\n", (int)wrsp
->length
));
161 if (write_data_iov(sock
, iov
, iov_count
) != wrsp
->length
) {
162 DEBUG(0, ("Could not write result\n"));
163 return NT_STATUS_INVALID_HANDLE
;
170 * Do winbind child async request. This is not simply wb_simple_trans. We have
171 * to do the queueing ourselves because while a request is queued, the child
172 * might have crashed, and we have to re-fork it in the _trigger function.
175 struct wb_child_request_state
{
176 struct tevent_context
*ev
;
177 struct tevent_req
*queue_subreq
;
178 struct tevent_req
*subreq
;
179 struct winbindd_child
*child
;
180 struct winbindd_request
*request
;
181 struct winbindd_response
*response
;
184 static bool fork_domain_child(struct winbindd_child
*child
);
186 static void wb_child_request_waited(struct tevent_req
*subreq
);
187 static void wb_child_request_done(struct tevent_req
*subreq
);
188 static void wb_child_request_orphaned(struct tevent_req
*subreq
);
190 static void wb_child_request_cleanup(struct tevent_req
*req
,
191 enum tevent_req_state req_state
);
193 struct tevent_req
*wb_child_request_send(TALLOC_CTX
*mem_ctx
,
194 struct tevent_context
*ev
,
195 struct winbindd_child
*child
,
196 struct winbindd_request
*request
)
198 struct tevent_req
*req
;
199 struct wb_child_request_state
*state
;
200 struct tevent_req
*subreq
;
202 req
= tevent_req_create(mem_ctx
, &state
,
203 struct wb_child_request_state
);
209 state
->child
= child
;
212 * We have to make a copy of "request", because our caller
213 * might drop us via talloc_free().
215 * The talloc_move() magic in wb_child_request_cleanup() keeps
216 * all the requests, but if we are sitting deep within
217 * writev_send() down to the client, we have given it the
218 * pointer to "request". As our caller lost interest, it will
219 * just free "request", while writev_send still references it.
222 state
->request
= talloc_memdup(state
, request
, sizeof(*request
));
223 if (tevent_req_nomem(state
->request
, req
)) {
224 return tevent_req_post(req
, ev
);
227 state
->request
->traceid
= debug_traceid_get();
229 if (request
->extra_data
.data
!= NULL
) {
230 state
->request
->extra_data
.data
= talloc_memdup(
232 request
->extra_data
.data
,
234 if (tevent_req_nomem(state
->request
->extra_data
.data
, req
)) {
235 return tevent_req_post(req
, ev
);
239 subreq
= tevent_queue_wait_send(state
, ev
, child
->queue
);
240 if (tevent_req_nomem(subreq
, req
)) {
241 return tevent_req_post(req
, ev
);
243 tevent_req_set_callback(subreq
, wb_child_request_waited
, req
);
244 state
->queue_subreq
= subreq
;
246 tevent_req_set_cleanup_fn(req
, wb_child_request_cleanup
);
251 static void wb_child_request_waited(struct tevent_req
*subreq
)
253 struct tevent_req
*req
= tevent_req_callback_data(
254 subreq
, struct tevent_req
);
255 struct wb_child_request_state
*state
= tevent_req_data(
256 req
, struct wb_child_request_state
);
259 ok
= tevent_queue_wait_recv(subreq
);
265 * We need to keep state->queue_subreq
266 * in order to block the queue.
270 if ((state
->child
->sock
== -1) && (!fork_domain_child(state
->child
))) {
271 tevent_req_error(req
, errno
);
275 tevent_fd_set_flags(state
->child
->monitor_fde
, 0);
277 subreq
= wb_simple_trans_send(state
, global_event_context(), NULL
,
278 state
->child
->sock
, state
->request
);
279 if (tevent_req_nomem(subreq
, req
)) {
283 state
->subreq
= subreq
;
284 tevent_req_set_callback(subreq
, wb_child_request_done
, req
);
285 tevent_req_set_endtime(req
, state
->ev
, timeval_current_ofs(300, 0));
288 static void wb_child_request_done(struct tevent_req
*subreq
)
290 struct tevent_req
*req
= tevent_req_callback_data(
291 subreq
, struct tevent_req
);
292 struct wb_child_request_state
*state
= tevent_req_data(
293 req
, struct wb_child_request_state
);
296 ret
= wb_simple_trans_recv(subreq
, state
, &state
->response
, &err
);
297 /* Freeing the subrequest is deferred until the cleanup function,
298 * which has to know whether a subrequest exists, and consequently
299 * decide whether to shut down the pipe to the child process.
302 tevent_req_error(req
, err
);
305 tevent_req_done(req
);
308 static void wb_child_request_orphaned(struct tevent_req
*subreq
)
310 struct winbindd_child
*child
=
311 (struct winbindd_child
*)tevent_req_callback_data_void(subreq
);
313 DBG_WARNING("cleanup orphaned subreq[%p]\n", subreq
);
316 if (child
->domain
!= NULL
) {
318 * If the child is attached to a domain,
319 * we need to make sure the domain queue
320 * can move forward, after the orphaned
323 tevent_queue_start(child
->domain
->queue
);
327 int wb_child_request_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
328 struct winbindd_response
**presponse
, int *err
)
330 struct wb_child_request_state
*state
= tevent_req_data(
331 req
, struct wb_child_request_state
);
333 if (tevent_req_is_unix_error(req
, err
)) {
336 *presponse
= talloc_move(mem_ctx
, &state
->response
);
340 static void wb_child_request_cleanup(struct tevent_req
*req
,
341 enum tevent_req_state req_state
)
343 struct wb_child_request_state
*state
=
344 tevent_req_data(req
, struct wb_child_request_state
);
346 if (state
->subreq
== NULL
) {
347 /* nothing to cleanup */
351 if (req_state
== TEVENT_REQ_RECEIVED
) {
352 struct tevent_req
*subreq
= NULL
;
355 * Our caller gave up, but we need to keep
356 * the low level request (wb_simple_trans)
357 * in order to maintain the parent child protocol.
359 * We also need to keep the child queue blocked
360 * until we got the response from the child.
363 subreq
= talloc_move(state
->child
->queue
, &state
->subreq
);
364 talloc_move(subreq
, &state
->queue_subreq
);
365 talloc_move(subreq
, &state
->request
);
366 tevent_req_set_callback(subreq
,
367 wb_child_request_orphaned
,
370 DBG_WARNING("keep orphaned subreq[%p]\n", subreq
);
374 TALLOC_FREE(state
->subreq
);
375 TALLOC_FREE(state
->queue_subreq
);
377 tevent_fd_set_flags(state
->child
->monitor_fde
, TEVENT_FD_READ
);
379 if (state
->child
->domain
!= NULL
) {
381 * If the child is attached to a domain,
382 * we need to make sure the domain queue
383 * can move forward, after the request
386 tevent_queue_start(state
->child
->domain
->queue
);
389 if (req_state
== TEVENT_REQ_DONE
) {
390 /* transmitted request and got response */
395 * Failed to transmit and receive response, or request
396 * cancelled while being serviced.
397 * The basic parent/child communication broke, close
400 TALLOC_FREE(state
->child
->monitor_fde
);
401 close(state
->child
->sock
);
402 state
->child
->sock
= -1;
405 static void child_socket_readable(struct tevent_context
*ev
,
406 struct tevent_fd
*fde
,
410 struct winbindd_child
*child
= private_data
;
412 if ((flags
& TEVENT_FD_READ
) == 0) {
416 TALLOC_FREE(child
->monitor_fde
);
419 * We're only active when there is no outstanding child
420 * request. Arriving here means the child closed its socket,
421 * it died. Do the same here.
424 SMB_ASSERT(child
->sock
!= -1);
430 static struct winbindd_child
*choose_domain_child(struct winbindd_domain
*domain
)
432 struct winbindd_child
*shortest
= &domain
->children
[0];
433 struct winbindd_child
*current
;
436 for (i
=0; i
<lp_winbind_max_domain_connections(); i
++) {
437 size_t shortest_len
, current_len
;
439 current
= &domain
->children
[i
];
440 current_len
= tevent_queue_length(current
->queue
);
442 if (current_len
== 0) {
447 shortest_len
= tevent_queue_length(shortest
->queue
);
449 if (current_len
< shortest_len
) {
457 struct dcerpc_binding_handle
*dom_child_handle(struct winbindd_domain
*domain
)
459 return domain
->binding_handle
;
462 struct wb_domain_request_state
{
463 struct tevent_context
*ev
;
464 struct tevent_queue_entry
*queue_entry
;
465 struct winbindd_domain
*domain
;
466 struct winbindd_child
*child
;
467 struct winbindd_request
*request
;
468 struct winbindd_request
*init_req
;
469 struct winbindd_response
*response
;
470 struct tevent_req
*pending_subreq
;
471 struct wbint_InitConnection r
;
474 static void wb_domain_request_cleanup(struct tevent_req
*req
,
475 enum tevent_req_state req_state
)
477 struct wb_domain_request_state
*state
= tevent_req_data(
478 req
, struct wb_domain_request_state
);
481 * If we're completely done or got a failure.
482 * we should remove ourself from the domain queue,
483 * after removing the child subreq from the child queue
484 * and give the next one in the queue the chance
485 * to check for an idle child.
487 TALLOC_FREE(state
->pending_subreq
);
488 TALLOC_FREE(state
->queue_entry
);
489 tevent_queue_start(state
->domain
->queue
);
492 static void wb_domain_request_trigger(struct tevent_req
*req
,
494 static void wb_domain_request_gotdc(struct tevent_req
*subreq
);
495 static void wb_domain_request_initialized(struct tevent_req
*subreq
);
496 static void wb_domain_request_done(struct tevent_req
*subreq
);
498 struct tevent_req
*wb_domain_request_send(TALLOC_CTX
*mem_ctx
,
499 struct tevent_context
*ev
,
500 struct winbindd_domain
*domain
,
501 struct winbindd_request
*request
)
503 struct tevent_req
*req
;
504 struct wb_domain_request_state
*state
;
506 req
= tevent_req_create(mem_ctx
, &state
,
507 struct wb_domain_request_state
);
512 state
->domain
= domain
;
514 state
->request
= request
;
516 tevent_req_set_cleanup_fn(req
, wb_domain_request_cleanup
);
518 state
->queue_entry
= tevent_queue_add_entry(
519 domain
->queue
, state
->ev
, req
,
520 wb_domain_request_trigger
, NULL
);
521 if (tevent_req_nomem(state
->queue_entry
, req
)) {
522 return tevent_req_post(req
, ev
);
528 static void wb_domain_request_trigger(struct tevent_req
*req
,
531 struct wb_domain_request_state
*state
= tevent_req_data(
532 req
, struct wb_domain_request_state
);
533 struct winbindd_domain
*domain
= state
->domain
;
534 struct tevent_req
*subreq
= NULL
;
535 size_t shortest_queue_length
;
537 state
->child
= choose_domain_child(domain
);
538 shortest_queue_length
= tevent_queue_length(state
->child
->queue
);
539 if (shortest_queue_length
> 0) {
541 * All children are busy, we need to stop
542 * the queue and untrigger our own queue
543 * entry. Once a pending request
544 * is done it calls tevent_queue_start
545 * and we get retriggered.
548 tevent_queue_stop(state
->domain
->queue
);
549 tevent_queue_entry_untrigger(state
->queue_entry
);
553 if (domain
->initialized
) {
554 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
556 if (tevent_req_nomem(subreq
, req
)) {
559 tevent_req_set_callback(subreq
, wb_domain_request_done
, req
);
560 state
->pending_subreq
= subreq
;
563 * Once the domain is initialized and
564 * once we placed our real request into the child queue,
565 * we can remove ourself from the domain queue
566 * and give the next one in the queue the chance
567 * to check for an idle child.
569 TALLOC_FREE(state
->queue_entry
);
573 state
->init_req
= talloc_zero(state
, struct winbindd_request
);
574 if (tevent_req_nomem(state
->init_req
, req
)) {
578 if (IS_DC
|| domain
->primary
|| domain
->internal
) {
579 /* The primary domain has to find the DC name itself */
580 state
->r
.in
.dcname
= talloc_strdup(state
, "");
581 if (tevent_req_nomem(state
->r
.in
.dcname
, req
)) {
585 subreq
= dcerpc_wbint_InitConnection_r_send(state
,
587 state
->child
->binding_handle
,
589 if (tevent_req_nomem(subreq
, req
)) {
592 tevent_req_set_callback(subreq
, wb_domain_request_initialized
,
594 state
->pending_subreq
= subreq
;
599 * This is *not* the primary domain,
600 * let's ask our DC about a DC name.
602 * We prefer getting a dns name in dc_unc,
603 * which is indicated by DS_RETURN_DNS_NAME.
604 * For NT4 domains we still get the netbios name.
606 subreq
= wb_dsgetdcname_send(state
, state
->ev
,
608 NULL
, /* domain_guid */
609 NULL
, /* site_name */
610 DS_RETURN_DNS_NAME
); /* flags */
611 if (tevent_req_nomem(subreq
, req
)) {
614 tevent_req_set_callback(subreq
, wb_domain_request_gotdc
, req
);
615 state
->pending_subreq
= subreq
;
619 static void wb_domain_request_gotdc(struct tevent_req
*subreq
)
621 struct tevent_req
*req
= tevent_req_callback_data(
622 subreq
, struct tevent_req
);
623 struct wb_domain_request_state
*state
= tevent_req_data(
624 req
, struct wb_domain_request_state
);
625 struct netr_DsRGetDCNameInfo
*dcinfo
= NULL
;
627 const char *dcname
= NULL
;
629 state
->pending_subreq
= NULL
;
631 status
= wb_dsgetdcname_recv(subreq
, state
, &dcinfo
);
633 if (tevent_req_nterror(req
, status
)) {
636 dcname
= dcinfo
->dc_unc
;
637 while (dcname
!= NULL
&& *dcname
== '\\') {
641 state
->r
.in
.dcname
= talloc_strdup(state
, dcname
);
642 if (tevent_req_nomem(state
->r
.in
.dcname
, req
)) {
648 subreq
= dcerpc_wbint_InitConnection_r_send(state
,
650 state
->child
->binding_handle
,
652 if (tevent_req_nomem(subreq
, req
)) {
655 tevent_req_set_callback(subreq
, wb_domain_request_initialized
, req
);
656 state
->pending_subreq
= subreq
;
659 static void wb_domain_request_initialized(struct tevent_req
*subreq
)
661 struct tevent_req
*req
= tevent_req_callback_data(
662 subreq
, struct tevent_req
);
663 struct wb_domain_request_state
*state
= tevent_req_data(
664 req
, struct wb_domain_request_state
);
667 state
->pending_subreq
= NULL
;
669 status
= dcerpc_wbint_InitConnection_r_recv(subreq
, state
);
671 if (NT_STATUS_IS_ERR(status
)) {
672 tevent_req_error(req
, map_errno_from_nt_status(status
));
676 status
= state
->r
.out
.result
;
677 if (NT_STATUS_IS_ERR(status
)) {
678 tevent_req_error(req
, map_errno_from_nt_status(status
));
682 state
->domain
->sid
= *state
->r
.out
.sid
;
684 talloc_free(state
->domain
->name
);
685 state
->domain
->name
= talloc_strdup(state
->domain
, *state
->r
.out
.name
);
686 if (state
->domain
->name
== NULL
) {
687 tevent_req_error(req
, ENOMEM
);
691 if (*state
->r
.out
.alt_name
!= NULL
&&
692 strlen(*state
->r
.out
.alt_name
) > 0) {
693 talloc_free(state
->domain
->alt_name
);
695 state
->domain
->alt_name
= talloc_strdup(state
->domain
,
696 *state
->r
.out
.alt_name
);
697 if (state
->domain
->alt_name
== NULL
) {
698 tevent_req_error(req
, ENOMEM
);
703 state
->domain
->native_mode
=
704 (*state
->r
.out
.flags
& WB_DOMINFO_DOMAIN_NATIVE
);
705 state
->domain
->active_directory
=
706 (*state
->r
.out
.flags
& WB_DOMINFO_DOMAIN_AD
);
707 state
->domain
->initialized
= true;
709 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
711 if (tevent_req_nomem(subreq
, req
)) {
714 tevent_req_set_callback(subreq
, wb_domain_request_done
, req
);
715 state
->pending_subreq
= subreq
;
718 * Once the domain is initialized and
719 * once we placed our real request into the child queue,
720 * we can remove ourself from the domain queue
721 * and give the next one in the queue the chance
722 * to check for an idle child.
724 TALLOC_FREE(state
->queue_entry
);
727 static void wb_domain_request_done(struct tevent_req
*subreq
)
729 struct tevent_req
*req
= tevent_req_callback_data(
730 subreq
, struct tevent_req
);
731 struct wb_domain_request_state
*state
= tevent_req_data(
732 req
, struct wb_domain_request_state
);
735 state
->pending_subreq
= NULL
;
737 ret
= wb_child_request_recv(subreq
, talloc_tos(), &state
->response
,
741 tevent_req_error(req
, err
);
744 tevent_req_done(req
);
747 int wb_domain_request_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
748 struct winbindd_response
**presponse
, int *err
)
750 struct wb_domain_request_state
*state
= tevent_req_data(
751 req
, struct wb_domain_request_state
);
753 if (tevent_req_is_unix_error(req
, err
)) {
756 *presponse
= talloc_move(mem_ctx
, &state
->response
);
760 static void child_process_request(struct winbindd_child
*child
,
761 struct winbindd_cli_state
*state
)
763 struct winbindd_domain
*domain
= child
->domain
;
765 /* Free response data - we may be interrupted and receive another
766 command before being able to send this data off. */
768 state
->response
->result
= WINBINDD_ERROR
;
769 state
->response
->length
= sizeof(struct winbindd_response
);
771 /* as all requests in the child are sync, we can use talloc_tos() */
772 state
->mem_ctx
= talloc_tos();
774 /* Process command */
775 state
->response
->result
= winbindd_dual_ndrcmd(domain
, state
);
778 void setup_child(struct winbindd_domain
*domain
, struct winbindd_child
*child
,
779 const char *logprefix
,
782 const struct loadparm_substitution
*lp_sub
=
783 loadparm_s3_global_substitution();
785 if (logprefix
&& logname
) {
786 char *logbase
= NULL
;
788 if (*lp_logfile(talloc_tos(), lp_sub
)) {
791 if (asprintf(&logbase
, "%s", lp_logfile(talloc_tos(), lp_sub
)) < 0) {
792 smb_panic("Internal error: asprintf failed");
795 if ((end
= strrchr_m(logbase
, '/'))) {
799 if (asprintf(&logbase
, "%s", get_dyn_LOGFILEBASE()) < 0) {
800 smb_panic("Internal error: asprintf failed");
804 if (asprintf(&child
->logfilename
, "%s/%s-%s",
805 logbase
, logprefix
, logname
) < 0) {
807 smb_panic("Internal error: asprintf failed");
812 smb_panic("Internal error: logprefix == NULL && "
818 child
->domain
= domain
;
819 child
->queue
= tevent_queue_create(NULL
, "winbind_child");
820 SMB_ASSERT(child
->queue
!= NULL
);
822 child
->binding_handle
= wbint_binding_handle(NULL
, NULL
, child
);
823 SMB_ASSERT(child
->binding_handle
!= NULL
);
826 struct winbind_child_died_state
{
828 struct winbindd_child
*child
;
831 static bool winbind_child_died_fn(struct winbindd_child
*child
,
834 struct winbind_child_died_state
*state
= private_data
;
836 if (child
->pid
== state
->pid
) {
837 state
->child
= child
;
843 void winbind_child_died(pid_t pid
)
845 struct winbind_child_died_state state
= { .pid
= pid
};
847 forall_children(winbind_child_died_fn
, &state
);
849 if (state
.child
== NULL
) {
850 DEBUG(5, ("Already reaped child %u died\n", (unsigned int)pid
));
854 state
.child
->pid
= 0;
857 /* Ensure any negative cache entries with the netbios or realm names are removed. */
859 void winbindd_flush_negative_conn_cache(struct winbindd_domain
*domain
)
861 flush_negative_conn_cache_for_domain(domain
->name
);
862 if (domain
->alt_name
!= NULL
) {
863 flush_negative_conn_cache_for_domain(domain
->alt_name
);
868 * Parent winbindd process sets its own debug level first and then
869 * sends a message to all the winbindd children to adjust their debug
870 * level to that of parents.
873 struct winbind_msg_relay_state
{
874 struct messaging_context
*msg_ctx
;
879 static bool winbind_msg_relay_fn(struct winbindd_child
*child
,
882 struct winbind_msg_relay_state
*state
= private_data
;
884 DBG_DEBUG("sending message to pid %u.\n",
885 (unsigned int)child
->pid
);
887 messaging_send(state
->msg_ctx
, pid_to_procid(child
->pid
),
888 state
->msg_type
, state
->data
);
892 void winbind_msg_debug(struct messaging_context
*msg_ctx
,
895 struct server_id server_id
,
898 struct winbind_msg_relay_state state
= {
899 .msg_ctx
= msg_ctx
, .msg_type
= msg_type
, .data
= data
902 DEBUG(10,("winbind_msg_debug: got debug message.\n"));
904 debug_message(msg_ctx
, private_data
, MSG_DEBUG
, server_id
, data
);
906 forall_children(winbind_msg_relay_fn
, &state
);
909 void winbind_disconnect_dc_parent(struct messaging_context
*msg_ctx
,
912 struct server_id server_id
,
915 struct winbind_msg_relay_state state
= {
916 .msg_ctx
= msg_ctx
, .msg_type
= msg_type
, .data
= data
919 DBG_DEBUG("Got disconnect_dc message\n");
921 forall_children(winbind_msg_relay_fn
, &state
);
924 static void winbindd_msg_reload_services_child(struct messaging_context
*msg
,
927 struct server_id server_id
,
930 DBG_DEBUG("Got reload-config message\n");
931 winbindd_reload_services_file((const char *)private_data
);
934 /* React on 'smbcontrol winbindd reload-config' in the same way as on SIGHUP*/
935 void winbindd_msg_reload_services_parent(struct messaging_context
*msg
,
938 struct server_id server_id
,
941 struct winbind_msg_relay_state state
= {
943 .msg_type
= msg_type
,
947 DBG_DEBUG("Got reload-config message\n");
949 /* Flush various caches */
950 winbindd_flush_caches();
952 winbindd_reload_services_file((const char *)private_data
);
954 forall_children(winbind_msg_relay_fn
, &state
);
957 /* Set our domains as offline and forward the offline message to our children. */
959 struct winbind_msg_on_offline_state
{
960 struct messaging_context
*msg_ctx
;
964 static bool winbind_msg_on_offline_fn(struct winbindd_child
*child
,
967 struct winbind_msg_on_offline_state
*state
= private_data
;
969 if (child
->domain
->internal
) {
974 * Each winbindd child should only process requests for one
975 * domain - make sure we only set it online / offline for that
978 DBG_DEBUG("sending message to pid %u for domain %s.\n",
979 (unsigned int)child
->pid
, child
->domain
->name
);
981 messaging_send_buf(state
->msg_ctx
,
982 pid_to_procid(child
->pid
),
984 (const uint8_t *)child
->domain
->name
,
985 strlen(child
->domain
->name
)+1);
990 void winbind_msg_offline(struct messaging_context
*msg_ctx
,
993 struct server_id server_id
,
996 struct winbind_msg_on_offline_state state
= {
998 .msg_type
= MSG_WINBIND_OFFLINE
,
1000 struct winbindd_domain
*domain
;
1002 DEBUG(10,("winbind_msg_offline: got offline message.\n"));
1004 if (!lp_winbind_offline_logon()) {
1005 DEBUG(10,("winbind_msg_offline: rejecting offline message.\n"));
1009 /* Set our global state as offline. */
1010 if (!set_global_winbindd_state_offline()) {
1011 DEBUG(10,("winbind_msg_offline: offline request failed.\n"));
1015 /* Set all our domains as offline. */
1016 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1017 if (domain
->internal
) {
1020 DEBUG(5,("winbind_msg_offline: marking %s offline.\n", domain
->name
));
1021 domain
->online
= false;
1024 forall_domain_children(winbind_msg_on_offline_fn
, &state
);
1027 /* Set our domains as online and forward the online message to our children. */
1029 void winbind_msg_online(struct messaging_context
*msg_ctx
,
1032 struct server_id server_id
,
1035 struct winbind_msg_on_offline_state state
= {
1037 .msg_type
= MSG_WINBIND_ONLINE
,
1040 DEBUG(10,("winbind_msg_online: got online message.\n"));
1042 if (!lp_winbind_offline_logon()) {
1043 DEBUG(10,("winbind_msg_online: rejecting online message.\n"));
1047 /* Set our global state as online. */
1048 set_global_winbindd_state_online();
1050 smb_nscd_flush_user_cache();
1051 smb_nscd_flush_group_cache();
1053 /* Tell all our child domains to go online online. */
1054 forall_domain_children(winbind_msg_on_offline_fn
, &state
);
1057 static const char *collect_onlinestatus(TALLOC_CTX
*mem_ctx
)
1059 struct winbindd_domain
*domain
;
1062 if ((buf
= talloc_asprintf(mem_ctx
, "global:%s ",
1063 get_global_winbindd_state_offline() ?
1064 "Offline":"Online")) == NULL
) {
1068 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1069 if ((buf
= talloc_asprintf_append_buffer(buf
, "%s:%s ",
1072 "Online":"Offline")) == NULL
) {
1077 buf
= talloc_asprintf_append_buffer(buf
, "\n");
1079 DEBUG(5,("collect_onlinestatus: %s", buf
));
1084 void winbind_msg_onlinestatus(struct messaging_context
*msg_ctx
,
1087 struct server_id server_id
,
1090 TALLOC_CTX
*mem_ctx
;
1091 const char *message
;
1093 DEBUG(5,("winbind_msg_onlinestatus received.\n"));
1095 mem_ctx
= talloc_init("winbind_msg_onlinestatus");
1096 if (mem_ctx
== NULL
) {
1100 message
= collect_onlinestatus(mem_ctx
);
1101 if (message
== NULL
) {
1102 talloc_destroy(mem_ctx
);
1106 messaging_send_buf(msg_ctx
, server_id
, MSG_WINBIND_ONLINESTATUS
,
1107 (const uint8_t *)message
, strlen(message
) + 1);
1109 talloc_destroy(mem_ctx
);
1112 void winbind_msg_dump_domain_list(struct messaging_context
*msg_ctx
,
1115 struct server_id server_id
,
1118 TALLOC_CTX
*mem_ctx
;
1119 const char *message
= NULL
;
1120 const char *domain
= NULL
;
1123 struct winbindd_domain
*dom
= NULL
;
1125 DEBUG(5,("winbind_msg_dump_domain_list received.\n"));
1127 mem_ctx
= talloc_init("winbind_msg_dump_domain_list");
1132 if (data
->length
> 0) {
1133 domain
= (const char *)data
->data
;
1138 DEBUG(5,("winbind_msg_dump_domain_list for domain: %s\n",
1141 message
= NDR_PRINT_STRUCT_STRING(mem_ctx
, winbindd_domain
,
1142 find_domain_from_name_noinit(domain
));
1144 talloc_destroy(mem_ctx
);
1148 messaging_send_buf(msg_ctx
, server_id
,
1149 MSG_WINBIND_DUMP_DOMAIN_LIST
,
1150 (const uint8_t *)message
, strlen(message
) + 1);
1152 talloc_destroy(mem_ctx
);
1157 DEBUG(5,("winbind_msg_dump_domain_list all domains\n"));
1159 for (dom
= domain_list(); dom
; dom
=dom
->next
) {
1160 message
= NDR_PRINT_STRUCT_STRING(mem_ctx
, winbindd_domain
, dom
);
1162 talloc_destroy(mem_ctx
);
1166 s
= talloc_asprintf_append(s
, "%s\n", message
);
1168 talloc_destroy(mem_ctx
);
1173 status
= messaging_send_buf(msg_ctx
, server_id
,
1174 MSG_WINBIND_DUMP_DOMAIN_LIST
,
1175 (uint8_t *)s
, strlen(s
) + 1);
1176 if (!NT_STATUS_IS_OK(status
)) {
1177 DEBUG(0,("failed to send message: %s\n",
1178 nt_errstr(status
)));
1181 talloc_destroy(mem_ctx
);
1184 static void account_lockout_policy_handler(struct tevent_context
*ctx
,
1185 struct tevent_timer
*te
,
1189 struct winbindd_child
*child
=
1190 (struct winbindd_child
*)private_data
;
1191 TALLOC_CTX
*mem_ctx
= NULL
;
1192 struct samr_DomInfo12 lockout_policy
;
1195 DEBUG(10,("account_lockout_policy_handler called\n"));
1197 TALLOC_FREE(child
->lockout_policy_event
);
1199 if ( !winbindd_can_contact_domain( child
->domain
) ) {
1200 DEBUG(10,("account_lockout_policy_handler: Removing myself since I "
1201 "do not have an incoming trust to domain %s\n",
1202 child
->domain
->name
));
1207 mem_ctx
= talloc_init("account_lockout_policy_handler ctx");
1209 result
= NT_STATUS_NO_MEMORY
;
1211 result
= wb_cache_lockout_policy(child
->domain
, mem_ctx
,
1214 TALLOC_FREE(mem_ctx
);
1216 if (!NT_STATUS_IS_OK(result
)) {
1217 DEBUG(10,("account_lockout_policy_handler: lockout_policy failed error %s\n",
1218 nt_errstr(result
)));
1221 child
->lockout_policy_event
= tevent_add_timer(global_event_context(), NULL
,
1222 timeval_current_ofs(3600, 0),
1223 account_lockout_policy_handler
,
1227 static time_t get_machine_password_timeout(void)
1229 /* until we have gpo support use lp setting */
1230 return lp_machine_password_timeout();
1233 static bool calculate_next_machine_pwd_change(const char *domain
,
1236 time_t pass_last_set_time
;
1242 pw
= secrets_fetch_machine_password(domain
,
1243 &pass_last_set_time
,
1247 DEBUG(0,("cannot fetch own machine password ????"));
1253 timeout
= get_machine_password_timeout();
1255 DEBUG(10,("machine password never expires\n"));
1259 tv
.tv_sec
= pass_last_set_time
;
1260 DEBUG(10, ("password last changed %s\n",
1261 timeval_string(talloc_tos(), &tv
, false)));
1262 tv
.tv_sec
+= timeout
;
1263 DEBUGADD(10, ("password valid until %s\n",
1264 timeval_string(talloc_tos(), &tv
, false)));
1266 if (time(NULL
) < (pass_last_set_time
+ timeout
)) {
1267 next_change
= pass_last_set_time
+ timeout
;
1268 DEBUG(10,("machine password still valid until: %s\n",
1269 http_timestring(talloc_tos(), next_change
)));
1270 *t
= timeval_set(next_change
, 0);
1272 if (lp_clustering()) {
1275 * When having a cluster, we have several
1276 * winbinds racing for the password change. In
1277 * the machine_password_change_handler()
1278 * function we check if someone else was
1279 * faster when the event triggers. We add a
1280 * 255-second random delay here, so that we
1281 * don't run to change the password at the
1282 * exact same moment.
1284 generate_random_buffer(&randbuf
, sizeof(randbuf
));
1285 DEBUG(10, ("adding %d seconds randomness\n",
1287 t
->tv_sec
+= randbuf
;
1292 DEBUG(10,("machine password expired, needs immediate change\n"));
1294 *t
= timeval_zero();
1299 static void machine_password_change_handler(struct tevent_context
*ctx
,
1300 struct tevent_timer
*te
,
1304 struct messaging_context
*msg_ctx
= global_messaging_context();
1305 struct winbindd_child
*child
=
1306 (struct winbindd_child
*)private_data
;
1307 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
1308 struct netlogon_creds_cli_context
*netlogon_creds_ctx
= NULL
;
1310 struct timeval next_change
;
1312 DEBUG(10,("machine_password_change_handler called\n"));
1314 TALLOC_FREE(child
->machine_password_change_event
);
1316 if (!calculate_next_machine_pwd_change(child
->domain
->name
,
1318 DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
1322 DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
1323 timeval_string(talloc_tos(), &next_change
, false)));
1325 if (!timeval_expired(&next_change
)) {
1326 DEBUG(10, ("Someone else has already changed the pw\n"));
1330 if (!winbindd_can_contact_domain(child
->domain
)) {
1331 DEBUG(10,("machine_password_change_handler: Removing myself since I "
1332 "do not have an incoming trust to domain %s\n",
1333 child
->domain
->name
));
1337 result
= cm_connect_netlogon_secure(child
->domain
,
1339 &netlogon_creds_ctx
);
1340 if (!NT_STATUS_IS_OK(result
)) {
1341 DEBUG(10,("machine_password_change_handler: "
1342 "failed to connect netlogon pipe: %s\n",
1343 nt_errstr(result
)));
1347 result
= trust_pw_change(netlogon_creds_ctx
,
1349 netlogon_pipe
->binding_handle
,
1350 child
->domain
->name
,
1351 child
->domain
->dcname
,
1354 DEBUG(10, ("machine_password_change_handler: "
1355 "trust_pw_change returned %s\n",
1356 nt_errstr(result
)));
1358 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1359 DEBUG(3,("machine_password_change_handler: password set returned "
1360 "ACCESS_DENIED. Maybe the trust account "
1361 "password was changed and we didn't know it. "
1362 "Killing connections to domain %s\n",
1363 child
->domain
->name
));
1364 invalidate_cm_connection(child
->domain
);
1367 if (!calculate_next_machine_pwd_change(child
->domain
->name
,
1369 DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
1373 DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
1374 timeval_string(talloc_tos(), &next_change
, false)));
1376 if (!NT_STATUS_IS_OK(result
)) {
1379 * In case of failure, give the DC a minute to recover
1381 tmp
= timeval_current_ofs(60, 0);
1382 next_change
= timeval_max(&next_change
, &tmp
);
1386 child
->machine_password_change_event
= tevent_add_timer(global_event_context(), NULL
,
1388 machine_password_change_handler
,
1392 /* Deal with a request to go offline. */
1394 static void child_msg_offline(struct messaging_context
*msg
,
1397 struct server_id server_id
,
1400 struct winbindd_domain
*domain
;
1401 struct winbindd_domain
*primary_domain
= NULL
;
1402 const char *domainname
= (const char *)data
->data
;
1404 if (data
->data
== NULL
|| data
->length
== 0) {
1408 DEBUG(5,("child_msg_offline received for domain %s.\n", domainname
));
1410 if (!lp_winbind_offline_logon()) {
1411 DEBUG(10,("child_msg_offline: rejecting offline message.\n"));
1415 primary_domain
= find_our_domain();
1417 /* Mark the requested domain offline. */
1419 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1420 if (domain
->internal
) {
1423 if (strequal(domain
->name
, domainname
)) {
1424 DEBUG(5,("child_msg_offline: marking %s offline.\n", domain
->name
));
1425 set_domain_offline(domain
);
1426 /* we are in the trusted domain, set the primary domain
1428 if (domain
!= primary_domain
) {
1429 set_domain_offline(primary_domain
);
1435 /* Deal with a request to go online. */
1437 static void child_msg_online(struct messaging_context
*msg
,
1440 struct server_id server_id
,
1443 struct winbindd_domain
*domain
;
1444 struct winbindd_domain
*primary_domain
= NULL
;
1445 const char *domainname
= (const char *)data
->data
;
1447 if (data
->data
== NULL
|| data
->length
== 0) {
1451 DEBUG(5,("child_msg_online received for domain %s.\n", domainname
));
1453 if (!lp_winbind_offline_logon()) {
1454 DEBUG(10,("child_msg_online: rejecting online message.\n"));
1458 primary_domain
= find_our_domain();
1460 /* Set our global state as online. */
1461 set_global_winbindd_state_online();
1463 /* Try and mark everything online - delete any negative cache entries
1464 to force a reconnect now. */
1466 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1467 if (domain
->internal
) {
1470 if (strequal(domain
->name
, domainname
)) {
1471 DEBUG(5,("child_msg_online: requesting %s to go online.\n", domain
->name
));
1472 winbindd_flush_negative_conn_cache(domain
);
1473 set_domain_online_request(domain
);
1475 /* we can be in trusted domain, which will contact primary domain
1476 * we have to bring primary domain online in trusted domain process
1477 * see, winbindd_dual_pam_auth() --> winbindd_dual_pam_auth_samlogon()
1478 * --> contact_domain = find_our_domain()
1480 if (domain
!= primary_domain
) {
1481 winbindd_flush_negative_conn_cache(primary_domain
);
1482 set_domain_online_request(primary_domain
);
1488 struct winbindd_reinit_after_fork_state
{
1489 const struct winbindd_child
*myself
;
1492 static bool winbindd_reinit_after_fork_fn(struct winbindd_child
*child
,
1495 struct winbindd_reinit_after_fork_state
*state
= private_data
;
1497 if (child
== state
->myself
) {
1501 /* Destroy all possible events in child list. */
1502 TALLOC_FREE(child
->lockout_policy_event
);
1503 TALLOC_FREE(child
->machine_password_change_event
);
1506 * Children should never be able to send each other messages,
1507 * all messages must go through the parent.
1509 child
->pid
= (pid_t
)0;
1512 * Close service sockets to all other children
1514 if (child
->sock
!= -1) {
1522 NTSTATUS
winbindd_reinit_after_fork(const struct winbindd_child
*myself
,
1523 const char *logfilename
)
1525 struct winbindd_reinit_after_fork_state state
= { .myself
= myself
};
1526 struct winbindd_domain
*domain
;
1529 status
= reinit_after_fork(
1530 global_messaging_context(),
1531 global_event_context(),
1533 if (!NT_STATUS_IS_OK(status
)) {
1534 DEBUG(0,("reinit_after_fork() failed\n"));
1537 initialize_password_db(true, global_event_context());
1539 close_conns_after_fork();
1541 if (logfilename
!= NULL
) {
1542 lp_set_logfile(logfilename
);
1546 if (!winbindd_setup_sig_term_handler(false)) {
1547 return NT_STATUS_NO_MEMORY
;
1550 if (!winbindd_setup_sig_hup_handler(logfilename
)) {
1551 return NT_STATUS_NO_MEMORY
;
1554 /* Stop zombies in children */
1557 /* Don't handle the same messages as our parent. */
1558 messaging_deregister(global_messaging_context(),
1559 MSG_SMB_CONF_UPDATED
, NULL
);
1560 messaging_deregister(global_messaging_context(),
1561 MSG_SHUTDOWN
, NULL
);
1562 messaging_deregister(global_messaging_context(),
1563 MSG_WINBIND_OFFLINE
, NULL
);
1564 messaging_deregister(global_messaging_context(),
1565 MSG_WINBIND_ONLINE
, NULL
);
1566 messaging_deregister(global_messaging_context(),
1567 MSG_WINBIND_ONLINESTATUS
, NULL
);
1568 messaging_deregister(global_messaging_context(),
1569 MSG_WINBIND_DUMP_DOMAIN_LIST
, NULL
);
1570 messaging_deregister(global_messaging_context(),
1573 messaging_deregister(global_messaging_context(),
1574 MSG_WINBIND_DOMAIN_OFFLINE
, NULL
);
1575 messaging_deregister(global_messaging_context(),
1576 MSG_WINBIND_DOMAIN_ONLINE
, NULL
);
1578 /* We have destroyed all events in the winbindd_event_context
1579 * in reinit_after_fork(), so clean out all possible pending
1580 * event pointers. */
1582 /* Deal with check_online_events. */
1584 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1585 TALLOC_FREE(domain
->check_online_event
);
1588 /* Ensure we're not handling a credential cache event inherited
1589 * from our parent. */
1591 ccache_remove_all_after_fork();
1593 forall_children(winbindd_reinit_after_fork_fn
, &state
);
1595 return NT_STATUS_OK
;
1599 * In a child there will be only one domain, reference that here.
1601 static struct winbindd_domain
*child_domain
;
1603 struct winbindd_domain
*wb_child_domain(void)
1605 return child_domain
;
1608 struct child_handler_state
{
1609 struct winbindd_child
*child
;
1610 struct winbindd_cli_state cli
;
1613 static void child_handler(struct tevent_context
*ev
, struct tevent_fd
*fde
,
1614 uint16_t flags
, void *private_data
)
1616 struct child_handler_state
*state
=
1617 (struct child_handler_state
*)private_data
;
1619 uint64_t parent_traceid
;
1621 /* fetch a request from the main daemon */
1622 status
= child_read_request(state
->cli
.sock
, state
->cli
.request
);
1624 if (!NT_STATUS_IS_OK(status
)) {
1625 /* we lost contact with our parent */
1629 /* read traceid from request */
1630 parent_traceid
= state
->cli
.request
->traceid
;
1631 debug_traceid_set(parent_traceid
);
1633 DEBUG(4,("child daemon request %d\n",
1634 (int)state
->cli
.request
->cmd
));
1636 ZERO_STRUCTP(state
->cli
.response
);
1637 state
->cli
.request
->null_term
= '\0';
1638 state
->cli
.mem_ctx
= talloc_tos();
1639 child_process_request(state
->child
, &state
->cli
);
1641 DEBUG(4, ("Finished processing child request %d\n",
1642 (int)state
->cli
.request
->cmd
));
1644 SAFE_FREE(state
->cli
.request
->extra_data
.data
);
1646 status
= child_write_response(state
->cli
.sock
, state
->cli
.response
);
1647 if (!NT_STATUS_IS_OK(status
)) {
1652 static bool fork_domain_child(struct winbindd_child
*child
)
1655 struct child_handler_state state
;
1656 struct winbindd_request request
;
1657 struct winbindd_response response
;
1658 struct winbindd_domain
*primary_domain
= NULL
;
1661 struct tevent_fd
*fde
;
1663 if (child
->domain
) {
1664 DEBUG(10, ("fork_domain_child called for domain '%s'\n",
1665 child
->domain
->name
));
1667 DEBUG(10, ("fork_domain_child called without domain.\n"));
1670 if (socketpair(AF_UNIX
, SOCK_STREAM
, 0, fdpair
) != 0) {
1671 DEBUG(0, ("Could not open child pipe: %s\n",
1677 state
.child
= child
;
1678 state
.cli
.pid
= getpid();
1679 state
.cli
.request
= &request
;
1680 state
.cli
.response
= &response
;
1682 child
->pid
= fork();
1684 if (child
->pid
== -1) {
1685 DEBUG(0, ("Could not fork: %s\n", strerror(errno
)));
1691 if (child
->pid
!= 0) {
1698 nread
= sys_read(fdpair
[1], &status
, sizeof(status
));
1699 if (nread
!= sizeof(status
)) {
1700 DEBUG(1, ("fork_domain_child: Could not read child status: "
1701 "nread=%d, error=%s\n", (int)nread
,
1706 if (!NT_STATUS_IS_OK(status
)) {
1707 DEBUG(1, ("fork_domain_child: Child status is %s\n",
1708 nt_errstr(status
)));
1713 child
->monitor_fde
= tevent_add_fd(global_event_context(),
1714 global_event_context(),
1717 child_socket_readable
,
1719 if (child
->monitor_fde
== NULL
) {
1720 DBG_WARNING("tevent_add_fd failed\n");
1725 rc
= set_blocking(fdpair
[1], false);
1731 child
->sock
= fdpair
[1];
1737 child_domain
= child
->domain
;
1739 DEBUG(10, ("Child process %d\n", (int)getpid()));
1741 state
.cli
.sock
= fdpair
[0];
1744 status
= winbindd_reinit_after_fork(child
, child
->logfilename
);
1746 /* setup callbacks again, one of them is removed in reinit_after_fork */
1747 if (lp_winbind_debug_traceid()) {
1748 winbind_debug_traceid_setup(global_event_context());
1751 nwritten
= sys_write(state
.cli
.sock
, &status
, sizeof(status
));
1752 if (nwritten
!= sizeof(status
)) {
1753 DEBUG(1, ("fork_domain_child: Could not write status: "
1754 "nwritten=%d, error=%s\n", (int)nwritten
,
1758 if (!NT_STATUS_IS_OK(status
)) {
1759 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
1760 nt_errstr(status
)));
1764 if (child_domain
!= NULL
) {
1765 setproctitle("domain child [%s]", child_domain
->name
);
1766 } else if (is_idmap_child(child
)) {
1767 setproctitle("idmap child");
1770 /* Handle online/offline messages. */
1771 messaging_register(global_messaging_context(), NULL
,
1772 MSG_WINBIND_OFFLINE
, child_msg_offline
);
1773 messaging_register(global_messaging_context(), NULL
,
1774 MSG_WINBIND_ONLINE
, child_msg_online
);
1775 messaging_register(global_messaging_context(), NULL
,
1776 MSG_DEBUG
, debug_message
);
1777 messaging_register(global_messaging_context(), NULL
,
1778 MSG_WINBIND_IP_DROPPED
,
1779 winbind_msg_ip_dropped
);
1780 messaging_register(global_messaging_context(), NULL
,
1781 MSG_WINBIND_DISCONNECT_DC
,
1782 winbind_msg_disconnect_dc
);
1784 global_messaging_context(),
1786 MSG_SMB_CONF_UPDATED
,
1787 winbindd_msg_reload_services_child
);
1789 primary_domain
= find_our_domain();
1791 if (primary_domain
== NULL
) {
1792 smb_panic("no primary domain found");
1795 /* It doesn't matter if we allow cache login,
1796 * try to bring domain online after fork. */
1797 if ( child
->domain
) {
1798 child
->domain
->startup
= True
;
1799 child
->domain
->startup_time
= time_mono(NULL
);
1800 /* we can be in primary domain or in trusted domain
1801 * If we are in trusted domain, set the primary domain
1802 * in start-up mode */
1803 if (!(child
->domain
->internal
)) {
1804 set_domain_online_request(child
->domain
);
1805 if (!(child
->domain
->primary
)) {
1806 primary_domain
->startup
= True
;
1807 primary_domain
->startup_time
= time_mono(NULL
);
1808 set_domain_online_request(primary_domain
);
1814 * We are in idmap child, bring primary domain online.
1816 if (is_idmap_child(child
)) {
1817 set_domain_online_request(primary_domain
);
1820 /* We might be in the idmap child...*/
1821 if (child
->domain
&& !(child
->domain
->internal
) &&
1822 lp_winbind_offline_logon()) {
1824 set_domain_online_request(child
->domain
);
1826 if (primary_domain
&& (primary_domain
!= child
->domain
)) {
1827 /* We need to talk to the primary
1828 * domain as well as the trusted
1829 * domain inside a trusted domain
1832 * set_dc_type_and_flags_trustinfo()
1835 set_domain_online_request(primary_domain
);
1838 child
->lockout_policy_event
= tevent_add_timer(
1839 global_event_context(), NULL
, timeval_zero(),
1840 account_lockout_policy_handler
,
1844 if (child
->domain
&& child
->domain
->primary
&&
1845 !USE_KERBEROS_KEYTAB
&&
1846 lp_server_role() == ROLE_DOMAIN_MEMBER
) {
1848 struct timeval next_change
;
1850 if (calculate_next_machine_pwd_change(child
->domain
->name
,
1852 child
->machine_password_change_event
= tevent_add_timer(
1853 global_event_context(), NULL
, next_change
,
1854 machine_password_change_handler
,
1859 fde
= tevent_add_fd(global_event_context(), NULL
, state
.cli
.sock
,
1860 TEVENT_FD_READ
, child_handler
, &state
);
1862 DEBUG(1, ("tevent_add_fd failed\n"));
1869 TALLOC_CTX
*frame
= talloc_stackframe();
1871 ret
= tevent_loop_once(global_event_context());
1873 DEBUG(1, ("tevent_loop_once failed: %s\n",
1878 if (child
->domain
&& child
->domain
->startup
&&
1879 (time_mono(NULL
) > child
->domain
->startup_time
+ 30)) {
1880 /* No longer in "startup" mode. */
1881 DEBUG(10,("fork_domain_child: domain %s no longer in 'startup' mode.\n",
1882 child
->domain
->name
));
1883 child
->domain
->startup
= False
;
1890 void winbind_msg_ip_dropped_parent(struct messaging_context
*msg_ctx
,
1893 struct server_id server_id
,
1896 struct winbind_msg_relay_state state
= {
1898 .msg_type
= msg_type
,
1902 winbind_msg_ip_dropped(msg_ctx
, private_data
, msg_type
,
1905 forall_children(winbind_msg_relay_fn
, &state
);
1908 void winbindd_terminate(bool is_parent
)
1911 /* When parent goes away we should
1912 * remove the socket file. Not so
1913 * when children terminate.
1917 if (asprintf(&path
, "%s/%s",
1918 lp_winbindd_socket_directory(), WINBINDD_SOCKET_NAME
) > 0) {
1926 netlogon_creds_cli_close_global_db();
1930 TALLOC_CTX
*mem_ctx
= talloc_init("end_description");
1931 char *description
= talloc_describe_all(mem_ctx
);
1933 DEBUG(3, ("tallocs left:\n%s\n", description
));
1934 talloc_destroy(mem_ctx
);
1939 pidfile_unlink(lp_pid_directory(), "winbindd");
1945 static void winbindd_sig_term_handler(struct tevent_context
*ev
,
1946 struct tevent_signal
*se
,
1952 bool *p
= talloc_get_type_abort(private_data
, bool);
1953 bool is_parent
= *p
;
1957 DEBUG(0,("Got sig[%d] terminate (is_parent=%d)\n",
1958 signum
, is_parent
));
1959 winbindd_terminate(is_parent
);
1962 bool winbindd_setup_sig_term_handler(bool parent
)
1964 struct tevent_signal
*se
;
1967 is_parent
= talloc(global_event_context(), bool);
1972 *is_parent
= parent
;
1974 se
= tevent_add_signal(global_event_context(),
1977 winbindd_sig_term_handler
,
1980 DEBUG(0,("failed to setup SIGTERM handler"));
1981 talloc_free(is_parent
);
1985 se
= tevent_add_signal(global_event_context(),
1988 winbindd_sig_term_handler
,
1991 DEBUG(0,("failed to setup SIGINT handler"));
1992 talloc_free(is_parent
);
1996 se
= tevent_add_signal(global_event_context(),
1999 winbindd_sig_term_handler
,
2002 DEBUG(0,("failed to setup SIGINT handler"));
2003 talloc_free(is_parent
);
2010 static void flush_caches_noinit(void)
2013 * We need to invalidate cached user list entries on a SIGHUP
2014 * otherwise cached access denied errors due to restrict anonymous
2015 * hang around until the sequence number changes.
2017 * Skip uninitialized domains when flush cache.
2018 * If domain is not initialized, it means it is never
2019 * used or never become online. look, wcache_invalidate_cache()
2020 * -> get_cache() -> init_dc_connection(). It causes a lot of traffic
2021 * for unused domains and large traffic for primay domain's DC if there
2022 * are many domains..
2025 if (!wcache_invalidate_cache_noinit()) {
2026 DEBUG(0, ("invalidating the cache failed; revalidate the cache\n"));
2027 if (!winbindd_cache_validate_and_initialize()) {
2033 static void winbindd_sig_hup_handler(struct tevent_context
*ev
,
2034 struct tevent_signal
*se
,
2040 const char *file
= (const char *)private_data
;
2042 DEBUG(1,("Reloading services after SIGHUP\n"));
2043 flush_caches_noinit();
2044 winbindd_reload_services_file(file
);
2047 bool winbindd_setup_sig_hup_handler(const char *lfile
)
2049 struct tevent_signal
*se
;
2053 file
= talloc_strdup(global_event_context(),
2060 se
= tevent_add_signal(global_event_context(),
2061 global_event_context(),
2063 winbindd_sig_hup_handler
,