2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2002
7 Copyright (C) Volker Lendecke 2004,2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * We fork a child per domain to be able to act non-blocking in the main
25 * winbind daemon. A domain controller thousands of miles away being being
26 * slow replying with a 10.000 user list should not hold up netlogon calls
27 * that can be handled locally.
32 #include "rpc_client/rpc_client.h"
33 #include "nsswitch/wb_reqtrans.h"
35 #include "../lib/util/select.h"
36 #include "../libcli/security/security.h"
37 #include "system/select.h"
39 #include "../lib/util/tevent_unix.h"
40 #include "lib/param/loadparm.h"
41 #include "lib/util/sys_rw.h"
42 #include "lib/util/sys_rw_data.h"
46 #define DBGC_CLASS DBGC_WINBIND
48 extern bool override_logfile
;
50 static void forall_domain_children(bool (*fn
)(struct winbindd_child
*c
,
54 struct winbindd_domain
*d
;
56 for (d
= domain_list(); d
!= NULL
; d
= d
->next
) {
59 for (i
= 0; i
< lp_winbind_max_domain_connections(); i
++) {
60 struct winbindd_child
*c
= &d
->children
[i
];
67 ok
= fn(c
, private_data
);
75 static void forall_children(bool (*fn
)(struct winbindd_child
*c
,
79 struct winbindd_child
*c
;
84 ok
= fn(c
, private_data
);
92 ok
= fn(c
, private_data
);
98 forall_domain_children(fn
, private_data
);
101 /* Read some data from a client connection */
103 static NTSTATUS
child_read_request(int sock
, struct winbindd_request
*wreq
)
107 status
= read_data_ntstatus(sock
, (char *)wreq
, sizeof(*wreq
));
108 if (!NT_STATUS_IS_OK(status
)) {
109 DEBUG(3, ("child_read_request: read_data failed: %s\n",
114 if (wreq
->extra_len
== 0) {
115 wreq
->extra_data
.data
= NULL
;
119 DEBUG(10, ("Need to read %d extra bytes\n", (int)wreq
->extra_len
));
121 wreq
->extra_data
.data
= SMB_MALLOC_ARRAY(char, wreq
->extra_len
+ 1);
122 if (wreq
->extra_data
.data
== NULL
) {
123 DEBUG(0, ("malloc failed\n"));
124 return NT_STATUS_NO_MEMORY
;
127 /* Ensure null termination */
128 wreq
->extra_data
.data
[wreq
->extra_len
] = '\0';
130 status
= read_data_ntstatus(sock
, wreq
->extra_data
.data
,
132 if (!NT_STATUS_IS_OK(status
)) {
133 DEBUG(0, ("Could not read extra data: %s\n",
139 static NTSTATUS
child_write_response(int sock
, struct winbindd_response
*wrsp
)
144 iov
[0].iov_base
= (void *)wrsp
;
145 iov
[0].iov_len
= sizeof(struct winbindd_response
);
148 if (wrsp
->length
> sizeof(struct winbindd_response
)) {
149 iov
[1].iov_base
= (void *)wrsp
->extra_data
.data
;
150 iov
[1].iov_len
= wrsp
->length
-iov
[0].iov_len
;
154 DEBUG(10, ("Writing %d bytes to parent\n", (int)wrsp
->length
));
156 if (write_data_iov(sock
, iov
, iov_count
) != wrsp
->length
) {
157 DEBUG(0, ("Could not write result\n"));
158 return NT_STATUS_INVALID_HANDLE
;
165 * Do winbind child async request. This is not simply wb_simple_trans. We have
166 * to do the queueing ourselves because while a request is queued, the child
167 * might have crashed, and we have to re-fork it in the _trigger function.
170 struct wb_child_request_state
{
171 struct tevent_context
*ev
;
172 struct tevent_req
*queue_subreq
;
173 struct tevent_req
*subreq
;
174 struct winbindd_child
*child
;
175 struct winbindd_request
*request
;
176 struct winbindd_response
*response
;
179 static bool fork_domain_child(struct winbindd_child
*child
);
181 static void wb_child_request_waited(struct tevent_req
*subreq
);
182 static void wb_child_request_done(struct tevent_req
*subreq
);
183 static void wb_child_request_orphaned(struct tevent_req
*subreq
);
185 static void wb_child_request_cleanup(struct tevent_req
*req
,
186 enum tevent_req_state req_state
);
188 struct tevent_req
*wb_child_request_send(TALLOC_CTX
*mem_ctx
,
189 struct tevent_context
*ev
,
190 struct winbindd_child
*child
,
191 struct winbindd_request
*request
)
193 struct tevent_req
*req
;
194 struct wb_child_request_state
*state
;
195 struct tevent_req
*subreq
;
197 req
= tevent_req_create(mem_ctx
, &state
,
198 struct wb_child_request_state
);
204 state
->child
= child
;
205 state
->request
= request
;
207 subreq
= tevent_queue_wait_send(state
, ev
, child
->queue
);
208 if (tevent_req_nomem(subreq
, req
)) {
209 return tevent_req_post(req
, ev
);
211 tevent_req_set_callback(subreq
, wb_child_request_waited
, req
);
212 state
->queue_subreq
= subreq
;
214 tevent_req_set_cleanup_fn(req
, wb_child_request_cleanup
);
219 static void wb_child_request_waited(struct tevent_req
*subreq
)
221 struct tevent_req
*req
= tevent_req_callback_data(
222 subreq
, struct tevent_req
);
223 struct wb_child_request_state
*state
= tevent_req_data(
224 req
, struct wb_child_request_state
);
227 ok
= tevent_queue_wait_recv(subreq
);
233 * We need to keep state->queue_subreq
234 * in order to block the queue.
238 if ((state
->child
->sock
== -1) && (!fork_domain_child(state
->child
))) {
239 tevent_req_error(req
, errno
);
243 tevent_fd_set_flags(state
->child
->monitor_fde
, 0);
245 subreq
= wb_simple_trans_send(state
, global_event_context(), NULL
,
246 state
->child
->sock
, state
->request
);
247 if (tevent_req_nomem(subreq
, req
)) {
251 state
->subreq
= subreq
;
252 tevent_req_set_callback(subreq
, wb_child_request_done
, req
);
253 tevent_req_set_endtime(req
, state
->ev
, timeval_current_ofs(300, 0));
256 static void wb_child_request_done(struct tevent_req
*subreq
)
258 struct tevent_req
*req
= tevent_req_callback_data(
259 subreq
, struct tevent_req
);
260 struct wb_child_request_state
*state
= tevent_req_data(
261 req
, struct wb_child_request_state
);
264 ret
= wb_simple_trans_recv(subreq
, state
, &state
->response
, &err
);
265 /* Freeing the subrequest is deferred until the cleanup function,
266 * which has to know whether a subrequest exists, and consequently
267 * decide whether to shut down the pipe to the child process.
270 tevent_req_error(req
, err
);
273 tevent_req_done(req
);
276 static void wb_child_request_orphaned(struct tevent_req
*subreq
)
278 struct winbindd_child
*child
=
279 (struct winbindd_child
*)tevent_req_callback_data_void(subreq
);
281 DBG_WARNING("cleanup orphaned subreq[%p]\n", subreq
);
284 if (child
->domain
!= NULL
) {
286 * If the child is attached to a domain,
287 * we need to make sure the domain queue
288 * can move forward, after the orphaned
291 tevent_queue_start(child
->domain
->queue
);
295 int wb_child_request_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
296 struct winbindd_response
**presponse
, int *err
)
298 struct wb_child_request_state
*state
= tevent_req_data(
299 req
, struct wb_child_request_state
);
301 if (tevent_req_is_unix_error(req
, err
)) {
304 *presponse
= talloc_move(mem_ctx
, &state
->response
);
308 static void wb_child_request_cleanup(struct tevent_req
*req
,
309 enum tevent_req_state req_state
)
311 struct wb_child_request_state
*state
=
312 tevent_req_data(req
, struct wb_child_request_state
);
314 if (state
->subreq
== NULL
) {
315 /* nothing to cleanup */
319 if (req_state
== TEVENT_REQ_RECEIVED
) {
320 struct tevent_req
*subreq
= NULL
;
323 * Our caller gave up, but we need to keep
324 * the low level request (wb_simple_trans)
325 * in order to maintain the parent child protocol.
327 * We also need to keep the child queue blocked
328 * until we got the response from the child.
331 subreq
= talloc_move(state
->child
->queue
, &state
->subreq
);
332 talloc_move(subreq
, &state
->queue_subreq
);
333 tevent_req_set_callback(subreq
,
334 wb_child_request_orphaned
,
337 DBG_WARNING("keep orphaned subreq[%p]\n", subreq
);
341 TALLOC_FREE(state
->subreq
);
342 TALLOC_FREE(state
->queue_subreq
);
344 tevent_fd_set_flags(state
->child
->monitor_fde
, TEVENT_FD_READ
);
346 if (state
->child
->domain
!= NULL
) {
348 * If the child is attached to a domain,
349 * we need to make sure the domain queue
350 * can move forward, after the request
353 tevent_queue_start(state
->child
->domain
->queue
);
356 if (req_state
== TEVENT_REQ_DONE
) {
357 /* transmitted request and got response */
362 * Failed to transmit and receive response, or request
363 * cancelled while being serviced.
364 * The basic parent/child communication broke, close
367 TALLOC_FREE(state
->child
->monitor_fde
);
368 close(state
->child
->sock
);
369 state
->child
->sock
= -1;
372 static void child_socket_readable(struct tevent_context
*ev
,
373 struct tevent_fd
*fde
,
377 struct winbindd_child
*child
= private_data
;
379 if ((flags
& TEVENT_FD_READ
) == 0) {
383 TALLOC_FREE(child
->monitor_fde
);
386 * We're only active when there is no outstanding child
387 * request. Arriving here means the child closed its socket,
388 * it died. Do the same here.
391 SMB_ASSERT(child
->sock
!= -1);
397 static struct winbindd_child
*choose_domain_child(struct winbindd_domain
*domain
)
399 struct winbindd_child
*shortest
= &domain
->children
[0];
400 struct winbindd_child
*current
;
403 for (i
=0; i
<lp_winbind_max_domain_connections(); i
++) {
404 size_t shortest_len
, current_len
;
406 current
= &domain
->children
[i
];
407 current_len
= tevent_queue_length(current
->queue
);
409 if (current_len
== 0) {
414 shortest_len
= tevent_queue_length(shortest
->queue
);
416 if (current_len
< shortest_len
) {
424 struct dcerpc_binding_handle
*dom_child_handle(struct winbindd_domain
*domain
)
426 return domain
->binding_handle
;
429 struct wb_domain_request_state
{
430 struct tevent_context
*ev
;
431 struct tevent_queue_entry
*queue_entry
;
432 struct winbindd_domain
*domain
;
433 struct winbindd_child
*child
;
434 struct winbindd_request
*request
;
435 struct winbindd_request
*init_req
;
436 struct winbindd_response
*response
;
437 struct tevent_req
*pending_subreq
;
440 static void wb_domain_request_cleanup(struct tevent_req
*req
,
441 enum tevent_req_state req_state
)
443 struct wb_domain_request_state
*state
= tevent_req_data(
444 req
, struct wb_domain_request_state
);
447 * If we're completely done or got a failure.
448 * we should remove ourself from the domain queue,
449 * after removing the child subreq from the child queue
450 * and give the next one in the queue the chance
451 * to check for an idle child.
453 TALLOC_FREE(state
->pending_subreq
);
454 TALLOC_FREE(state
->queue_entry
);
455 tevent_queue_start(state
->domain
->queue
);
458 static void wb_domain_request_trigger(struct tevent_req
*req
,
460 static void wb_domain_request_gotdc(struct tevent_req
*subreq
);
461 static void wb_domain_request_initialized(struct tevent_req
*subreq
);
462 static void wb_domain_request_done(struct tevent_req
*subreq
);
464 struct tevent_req
*wb_domain_request_send(TALLOC_CTX
*mem_ctx
,
465 struct tevent_context
*ev
,
466 struct winbindd_domain
*domain
,
467 struct winbindd_request
*request
)
469 struct tevent_req
*req
;
470 struct wb_domain_request_state
*state
;
472 req
= tevent_req_create(mem_ctx
, &state
,
473 struct wb_domain_request_state
);
478 state
->domain
= domain
;
480 state
->request
= request
;
482 tevent_req_set_cleanup_fn(req
, wb_domain_request_cleanup
);
484 state
->queue_entry
= tevent_queue_add_entry(
485 domain
->queue
, state
->ev
, req
,
486 wb_domain_request_trigger
, NULL
);
487 if (tevent_req_nomem(state
->queue_entry
, req
)) {
488 return tevent_req_post(req
, ev
);
494 static void wb_domain_request_trigger(struct tevent_req
*req
,
497 struct wb_domain_request_state
*state
= tevent_req_data(
498 req
, struct wb_domain_request_state
);
499 struct winbindd_domain
*domain
= state
->domain
;
500 struct tevent_req
*subreq
= NULL
;
501 size_t shortest_queue_length
;
503 state
->child
= choose_domain_child(domain
);
504 shortest_queue_length
= tevent_queue_length(state
->child
->queue
);
505 if (shortest_queue_length
> 0) {
507 * All children are busy, we need to stop
508 * the queue and untrigger our own queue
509 * entry. Once a pending request
510 * is done it calls tevent_queue_start
511 * and we get retriggered.
514 tevent_queue_stop(state
->domain
->queue
);
515 tevent_queue_entry_untrigger(state
->queue_entry
);
519 if (domain
->initialized
) {
520 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
522 if (tevent_req_nomem(subreq
, req
)) {
525 tevent_req_set_callback(subreq
, wb_domain_request_done
, req
);
526 state
->pending_subreq
= subreq
;
529 * Once the domain is initialized and
530 * once we placed our real request into the child queue,
531 * we can remove ourself from the domain queue
532 * and give the next one in the queue the chance
533 * to check for an idle child.
535 TALLOC_FREE(state
->queue_entry
);
539 state
->init_req
= talloc_zero(state
, struct winbindd_request
);
540 if (tevent_req_nomem(state
->init_req
, req
)) {
544 if (IS_DC
|| domain
->primary
|| domain
->internal
) {
545 /* The primary domain has to find the DC name itself */
546 state
->init_req
->cmd
= WINBINDD_INIT_CONNECTION
;
547 fstrcpy(state
->init_req
->domain_name
, domain
->name
);
548 state
->init_req
->data
.init_conn
.is_primary
= domain
->primary
;
549 fstrcpy(state
->init_req
->data
.init_conn
.dcname
, "");
551 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
553 if (tevent_req_nomem(subreq
, req
)) {
556 tevent_req_set_callback(subreq
, wb_domain_request_initialized
,
558 state
->pending_subreq
= subreq
;
563 * This is *not* the primary domain,
564 * let's ask our DC about a DC name.
566 * We prefer getting a dns name in dc_unc,
567 * which is indicated by DS_RETURN_DNS_NAME.
568 * For NT4 domains we still get the netbios name.
570 subreq
= wb_dsgetdcname_send(state
, state
->ev
,
572 NULL
, /* domain_guid */
573 NULL
, /* site_name */
574 DS_RETURN_DNS_NAME
); /* flags */
575 if (tevent_req_nomem(subreq
, req
)) {
578 tevent_req_set_callback(subreq
, wb_domain_request_gotdc
, req
);
579 state
->pending_subreq
= subreq
;
583 static void wb_domain_request_gotdc(struct tevent_req
*subreq
)
585 struct tevent_req
*req
= tevent_req_callback_data(
586 subreq
, struct tevent_req
);
587 struct wb_domain_request_state
*state
= tevent_req_data(
588 req
, struct wb_domain_request_state
);
589 struct netr_DsRGetDCNameInfo
*dcinfo
= NULL
;
591 const char *dcname
= NULL
;
593 state
->pending_subreq
= NULL
;
595 status
= wb_dsgetdcname_recv(subreq
, state
, &dcinfo
);
597 if (tevent_req_nterror(req
, status
)) {
600 dcname
= dcinfo
->dc_unc
;
601 while (dcname
!= NULL
&& *dcname
== '\\') {
604 state
->init_req
->cmd
= WINBINDD_INIT_CONNECTION
;
605 fstrcpy(state
->init_req
->domain_name
, state
->domain
->name
);
606 state
->init_req
->data
.init_conn
.is_primary
= False
;
607 fstrcpy(state
->init_req
->data
.init_conn
.dcname
,
612 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
614 if (tevent_req_nomem(subreq
, req
)) {
617 tevent_req_set_callback(subreq
, wb_domain_request_initialized
, req
);
618 state
->pending_subreq
= subreq
;
621 static void wb_domain_request_initialized(struct tevent_req
*subreq
)
623 struct tevent_req
*req
= tevent_req_callback_data(
624 subreq
, struct tevent_req
);
625 struct wb_domain_request_state
*state
= tevent_req_data(
626 req
, struct wb_domain_request_state
);
627 struct winbindd_response
*response
;
630 state
->pending_subreq
= NULL
;
632 ret
= wb_child_request_recv(subreq
, talloc_tos(), &response
, &err
);
635 tevent_req_error(req
, err
);
639 if (!string_to_sid(&state
->domain
->sid
,
640 response
->data
.domain_info
.sid
)) {
641 DEBUG(1,("init_child_recv: Could not convert sid %s "
642 "from string\n", response
->data
.domain_info
.sid
));
643 tevent_req_error(req
, EINVAL
);
647 talloc_free(state
->domain
->name
);
648 state
->domain
->name
= talloc_strdup(state
->domain
,
649 response
->data
.domain_info
.name
);
650 if (state
->domain
->name
== NULL
) {
651 tevent_req_error(req
, ENOMEM
);
655 if (response
->data
.domain_info
.alt_name
[0] != '\0') {
656 talloc_free(state
->domain
->alt_name
);
658 state
->domain
->alt_name
= talloc_strdup(state
->domain
,
659 response
->data
.domain_info
.alt_name
);
660 if (state
->domain
->alt_name
== NULL
) {
661 tevent_req_error(req
, ENOMEM
);
666 state
->domain
->native_mode
= response
->data
.domain_info
.native_mode
;
667 state
->domain
->active_directory
=
668 response
->data
.domain_info
.active_directory
;
669 state
->domain
->initialized
= true;
671 TALLOC_FREE(response
);
673 subreq
= wb_child_request_send(state
, state
->ev
, state
->child
,
675 if (tevent_req_nomem(subreq
, req
)) {
678 tevent_req_set_callback(subreq
, wb_domain_request_done
, req
);
679 state
->pending_subreq
= subreq
;
682 * Once the domain is initialized and
683 * once we placed our real request into the child queue,
684 * we can remove ourself from the domain queue
685 * and give the next one in the queue the chance
686 * to check for an idle child.
688 TALLOC_FREE(state
->queue_entry
);
691 static void wb_domain_request_done(struct tevent_req
*subreq
)
693 struct tevent_req
*req
= tevent_req_callback_data(
694 subreq
, struct tevent_req
);
695 struct wb_domain_request_state
*state
= tevent_req_data(
696 req
, struct wb_domain_request_state
);
699 state
->pending_subreq
= NULL
;
701 ret
= wb_child_request_recv(subreq
, talloc_tos(), &state
->response
,
705 tevent_req_error(req
, err
);
708 tevent_req_done(req
);
711 int wb_domain_request_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
712 struct winbindd_response
**presponse
, int *err
)
714 struct wb_domain_request_state
*state
= tevent_req_data(
715 req
, struct wb_domain_request_state
);
717 if (tevent_req_is_unix_error(req
, err
)) {
720 *presponse
= talloc_move(mem_ctx
, &state
->response
);
724 static void child_process_request(struct winbindd_child
*child
,
725 struct winbindd_cli_state
*state
)
727 struct winbindd_domain
*domain
= child
->domain
;
728 const struct winbindd_child_dispatch_table
*table
= child
->table
;
730 /* Free response data - we may be interrupted and receive another
731 command before being able to send this data off. */
733 state
->response
->result
= WINBINDD_ERROR
;
734 state
->response
->length
= sizeof(struct winbindd_response
);
736 /* as all requests in the child are sync, we can use talloc_tos() */
737 state
->mem_ctx
= talloc_tos();
739 /* Process command */
741 for (; table
->name
; table
++) {
742 if (state
->request
->cmd
== table
->struct_cmd
) {
743 DEBUG(10,("child_process_request: request fn %s\n",
745 state
->response
->result
= table
->struct_fn(domain
, state
);
750 DEBUG(1, ("child_process_request: unknown request fn number %d\n",
751 (int)state
->request
->cmd
));
752 state
->response
->result
= WINBINDD_ERROR
;
755 void setup_child(struct winbindd_domain
*domain
, struct winbindd_child
*child
,
756 const struct winbindd_child_dispatch_table
*table
,
757 const char *logprefix
,
760 if (logprefix
&& logname
) {
761 char *logbase
= NULL
;
763 if (*lp_logfile(talloc_tos())) {
766 if (asprintf(&logbase
, "%s", lp_logfile(talloc_tos())) < 0) {
767 smb_panic("Internal error: asprintf failed");
770 if ((end
= strrchr_m(logbase
, '/'))) {
774 if (asprintf(&logbase
, "%s", get_dyn_LOGFILEBASE()) < 0) {
775 smb_panic("Internal error: asprintf failed");
779 if (asprintf(&child
->logfilename
, "%s/%s-%s",
780 logbase
, logprefix
, logname
) < 0) {
782 smb_panic("Internal error: asprintf failed");
787 smb_panic("Internal error: logprefix == NULL && "
793 child
->domain
= domain
;
794 child
->table
= table
;
795 child
->queue
= tevent_queue_create(NULL
, "winbind_child");
796 SMB_ASSERT(child
->queue
!= NULL
);
797 if (domain
== NULL
) {
798 child
->binding_handle
= wbint_binding_handle(NULL
, NULL
, child
);
799 SMB_ASSERT(child
->binding_handle
!= NULL
);
803 struct winbind_child_died_state
{
805 struct winbindd_child
*child
;
808 static bool winbind_child_died_fn(struct winbindd_child
*child
,
811 struct winbind_child_died_state
*state
= private_data
;
813 if (child
->pid
== state
->pid
) {
814 state
->child
= child
;
820 void winbind_child_died(pid_t pid
)
822 struct winbind_child_died_state state
= { .pid
= pid
};
824 forall_children(winbind_child_died_fn
, &state
);
826 if (state
.child
== NULL
) {
827 DEBUG(5, ("Already reaped child %u died\n", (unsigned int)pid
));
831 state
.child
->pid
= 0;
834 /* Ensure any negative cache entries with the netbios or realm names are removed. */
836 void winbindd_flush_negative_conn_cache(struct winbindd_domain
*domain
)
838 flush_negative_conn_cache_for_domain(domain
->name
);
839 if (domain
->alt_name
!= NULL
) {
840 flush_negative_conn_cache_for_domain(domain
->alt_name
);
845 * Parent winbindd process sets its own debug level first and then
846 * sends a message to all the winbindd children to adjust their debug
847 * level to that of parents.
850 struct winbind_msg_relay_state
{
851 struct messaging_context
*msg_ctx
;
856 static bool winbind_msg_relay_fn(struct winbindd_child
*child
,
859 struct winbind_msg_relay_state
*state
= private_data
;
861 DBG_DEBUG("sending message to pid %u.\n",
862 (unsigned int)child
->pid
);
864 messaging_send(state
->msg_ctx
, pid_to_procid(child
->pid
),
865 state
->msg_type
, state
->data
);
869 void winbind_msg_debug(struct messaging_context
*msg_ctx
,
872 struct server_id server_id
,
875 struct winbind_msg_relay_state state
= {
876 .msg_ctx
= msg_ctx
, .msg_type
= msg_type
, .data
= data
879 DEBUG(10,("winbind_msg_debug: got debug message.\n"));
881 debug_message(msg_ctx
, private_data
, MSG_DEBUG
, server_id
, data
);
883 forall_children(winbind_msg_relay_fn
, &state
);
886 void winbind_disconnect_dc_parent(struct messaging_context
*msg_ctx
,
889 struct server_id server_id
,
892 struct winbind_msg_relay_state state
= {
893 .msg_ctx
= msg_ctx
, .msg_type
= msg_type
, .data
= data
896 DBG_DEBUG("Got disconnect_dc message\n");
898 forall_children(winbind_msg_relay_fn
, &state
);
901 /* Set our domains as offline and forward the offline message to our children. */
903 struct winbind_msg_on_offline_state
{
904 struct messaging_context
*msg_ctx
;
908 static bool winbind_msg_on_offline_fn(struct winbindd_child
*child
,
911 struct winbind_msg_on_offline_state
*state
= private_data
;
913 if (child
->domain
->internal
) {
918 * Each winbindd child should only process requests for one
919 * domain - make sure we only set it online / offline for that
922 DBG_DEBUG("sending message to pid %u for domain %s.\n",
923 (unsigned int)child
->pid
, child
->domain
->name
);
925 messaging_send_buf(state
->msg_ctx
,
926 pid_to_procid(child
->pid
),
928 (const uint8_t *)child
->domain
->name
,
929 strlen(child
->domain
->name
)+1);
934 void winbind_msg_offline(struct messaging_context
*msg_ctx
,
937 struct server_id server_id
,
940 struct winbind_msg_on_offline_state state
= {
942 .msg_type
= MSG_WINBIND_OFFLINE
,
944 struct winbindd_domain
*domain
;
946 DEBUG(10,("winbind_msg_offline: got offline message.\n"));
948 if (!lp_winbind_offline_logon()) {
949 DEBUG(10,("winbind_msg_offline: rejecting offline message.\n"));
953 /* Set our global state as offline. */
954 if (!set_global_winbindd_state_offline()) {
955 DEBUG(10,("winbind_msg_offline: offline request failed.\n"));
959 /* Set all our domains as offline. */
960 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
961 if (domain
->internal
) {
964 DEBUG(5,("winbind_msg_offline: marking %s offline.\n", domain
->name
));
965 set_domain_offline(domain
);
968 forall_domain_children(winbind_msg_on_offline_fn
, &state
);
971 /* Set our domains as online and forward the online message to our children. */
973 void winbind_msg_online(struct messaging_context
*msg_ctx
,
976 struct server_id server_id
,
979 struct winbind_msg_on_offline_state state
= {
981 .msg_type
= MSG_WINBIND_ONLINE
,
983 struct winbindd_domain
*domain
;
985 DEBUG(10,("winbind_msg_online: got online message.\n"));
987 if (!lp_winbind_offline_logon()) {
988 DEBUG(10,("winbind_msg_online: rejecting online message.\n"));
992 /* Set our global state as online. */
993 set_global_winbindd_state_online();
995 smb_nscd_flush_user_cache();
996 smb_nscd_flush_group_cache();
998 /* Set all our domains as online. */
999 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1000 if (domain
->internal
) {
1003 DEBUG(5,("winbind_msg_online: requesting %s to go online.\n", domain
->name
));
1005 winbindd_flush_negative_conn_cache(domain
);
1006 set_domain_online_request(domain
);
1008 /* Send an online message to the idmap child when our
1009 primary domain comes back online */
1011 if ( domain
->primary
) {
1012 struct winbindd_child
*idmap
= idmap_child();
1014 if ( idmap
->pid
!= 0 ) {
1015 messaging_send_buf(msg_ctx
,
1016 pid_to_procid(idmap
->pid
),
1018 (const uint8_t *)domain
->name
,
1019 strlen(domain
->name
)+1);
1024 forall_domain_children(winbind_msg_on_offline_fn
, &state
);
1027 static const char *collect_onlinestatus(TALLOC_CTX
*mem_ctx
)
1029 struct winbindd_domain
*domain
;
1032 if ((buf
= talloc_asprintf(mem_ctx
, "global:%s ",
1033 get_global_winbindd_state_offline() ?
1034 "Offline":"Online")) == NULL
) {
1038 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1039 if ((buf
= talloc_asprintf_append_buffer(buf
, "%s:%s ",
1042 "Online":"Offline")) == NULL
) {
1047 buf
= talloc_asprintf_append_buffer(buf
, "\n");
1049 DEBUG(5,("collect_onlinestatus: %s", buf
));
1054 void winbind_msg_onlinestatus(struct messaging_context
*msg_ctx
,
1057 struct server_id server_id
,
1060 TALLOC_CTX
*mem_ctx
;
1061 const char *message
;
1063 DEBUG(5,("winbind_msg_onlinestatus received.\n"));
1065 mem_ctx
= talloc_init("winbind_msg_onlinestatus");
1066 if (mem_ctx
== NULL
) {
1070 message
= collect_onlinestatus(mem_ctx
);
1071 if (message
== NULL
) {
1072 talloc_destroy(mem_ctx
);
1076 messaging_send_buf(msg_ctx
, server_id
, MSG_WINBIND_ONLINESTATUS
,
1077 (const uint8_t *)message
, strlen(message
) + 1);
1079 talloc_destroy(mem_ctx
);
1082 void winbind_msg_dump_domain_list(struct messaging_context
*msg_ctx
,
1085 struct server_id server_id
,
1088 TALLOC_CTX
*mem_ctx
;
1089 const char *message
= NULL
;
1090 const char *domain
= NULL
;
1093 struct winbindd_domain
*dom
= NULL
;
1095 DEBUG(5,("winbind_msg_dump_domain_list received.\n"));
1097 mem_ctx
= talloc_init("winbind_msg_dump_domain_list");
1102 if (data
->length
> 0) {
1103 domain
= (const char *)data
->data
;
1108 DEBUG(5,("winbind_msg_dump_domain_list for domain: %s\n",
1111 message
= NDR_PRINT_STRUCT_STRING(mem_ctx
, winbindd_domain
,
1112 find_domain_from_name_noinit(domain
));
1114 talloc_destroy(mem_ctx
);
1118 messaging_send_buf(msg_ctx
, server_id
,
1119 MSG_WINBIND_DUMP_DOMAIN_LIST
,
1120 (const uint8_t *)message
, strlen(message
) + 1);
1122 talloc_destroy(mem_ctx
);
1127 DEBUG(5,("winbind_msg_dump_domain_list all domains\n"));
1129 for (dom
= domain_list(); dom
; dom
=dom
->next
) {
1130 message
= NDR_PRINT_STRUCT_STRING(mem_ctx
, winbindd_domain
, dom
);
1132 talloc_destroy(mem_ctx
);
1136 s
= talloc_asprintf_append(s
, "%s\n", message
);
1138 talloc_destroy(mem_ctx
);
1143 status
= messaging_send_buf(msg_ctx
, server_id
,
1144 MSG_WINBIND_DUMP_DOMAIN_LIST
,
1145 (uint8_t *)s
, strlen(s
) + 1);
1146 if (!NT_STATUS_IS_OK(status
)) {
1147 DEBUG(0,("failed to send message: %s\n",
1148 nt_errstr(status
)));
1151 talloc_destroy(mem_ctx
);
1154 static void account_lockout_policy_handler(struct tevent_context
*ctx
,
1155 struct tevent_timer
*te
,
1159 struct winbindd_child
*child
=
1160 (struct winbindd_child
*)private_data
;
1161 TALLOC_CTX
*mem_ctx
= NULL
;
1162 struct samr_DomInfo12 lockout_policy
;
1165 DEBUG(10,("account_lockout_policy_handler called\n"));
1167 TALLOC_FREE(child
->lockout_policy_event
);
1169 if ( !winbindd_can_contact_domain( child
->domain
) ) {
1170 DEBUG(10,("account_lockout_policy_handler: Removing myself since I "
1171 "do not have an incoming trust to domain %s\n",
1172 child
->domain
->name
));
1177 mem_ctx
= talloc_init("account_lockout_policy_handler ctx");
1179 result
= NT_STATUS_NO_MEMORY
;
1181 result
= wb_cache_lockout_policy(child
->domain
, mem_ctx
,
1184 TALLOC_FREE(mem_ctx
);
1186 if (!NT_STATUS_IS_OK(result
)) {
1187 DEBUG(10,("account_lockout_policy_handler: lockout_policy failed error %s\n",
1188 nt_errstr(result
)));
1191 child
->lockout_policy_event
= tevent_add_timer(global_event_context(), NULL
,
1192 timeval_current_ofs(3600, 0),
1193 account_lockout_policy_handler
,
1197 static time_t get_machine_password_timeout(void)
1199 /* until we have gpo support use lp setting */
1200 return lp_machine_password_timeout();
1203 static bool calculate_next_machine_pwd_change(const char *domain
,
1206 time_t pass_last_set_time
;
1212 pw
= secrets_fetch_machine_password(domain
,
1213 &pass_last_set_time
,
1217 DEBUG(0,("cannot fetch own machine password ????"));
1223 timeout
= get_machine_password_timeout();
1225 DEBUG(10,("machine password never expires\n"));
1229 tv
.tv_sec
= pass_last_set_time
;
1230 DEBUG(10, ("password last changed %s\n",
1231 timeval_string(talloc_tos(), &tv
, false)));
1232 tv
.tv_sec
+= timeout
;
1233 DEBUGADD(10, ("password valid until %s\n",
1234 timeval_string(talloc_tos(), &tv
, false)));
1236 if (time(NULL
) < (pass_last_set_time
+ timeout
)) {
1237 next_change
= pass_last_set_time
+ timeout
;
1238 DEBUG(10,("machine password still valid until: %s\n",
1239 http_timestring(talloc_tos(), next_change
)));
1240 *t
= timeval_set(next_change
, 0);
1242 if (lp_clustering()) {
1245 * When having a cluster, we have several
1246 * winbinds racing for the password change. In
1247 * the machine_password_change_handler()
1248 * function we check if someone else was
1249 * faster when the event triggers. We add a
1250 * 255-second random delay here, so that we
1251 * don't run to change the password at the
1252 * exact same moment.
1254 generate_random_buffer(&randbuf
, sizeof(randbuf
));
1255 DEBUG(10, ("adding %d seconds randomness\n",
1257 t
->tv_sec
+= randbuf
;
1262 DEBUG(10,("machine password expired, needs immediate change\n"));
1264 *t
= timeval_zero();
1269 static void machine_password_change_handler(struct tevent_context
*ctx
,
1270 struct tevent_timer
*te
,
1274 struct messaging_context
*msg_ctx
= global_messaging_context();
1275 struct winbindd_child
*child
=
1276 (struct winbindd_child
*)private_data
;
1277 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
1278 struct netlogon_creds_cli_context
*netlogon_creds_ctx
= NULL
;
1280 struct timeval next_change
;
1282 DEBUG(10,("machine_password_change_handler called\n"));
1284 TALLOC_FREE(child
->machine_password_change_event
);
1286 if (!calculate_next_machine_pwd_change(child
->domain
->name
,
1288 DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
1292 DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
1293 timeval_string(talloc_tos(), &next_change
, false)));
1295 if (!timeval_expired(&next_change
)) {
1296 DEBUG(10, ("Someone else has already changed the pw\n"));
1300 if (!winbindd_can_contact_domain(child
->domain
)) {
1301 DEBUG(10,("machine_password_change_handler: Removing myself since I "
1302 "do not have an incoming trust to domain %s\n",
1303 child
->domain
->name
));
1307 result
= cm_connect_netlogon_secure(child
->domain
,
1309 &netlogon_creds_ctx
);
1310 if (!NT_STATUS_IS_OK(result
)) {
1311 DEBUG(10,("machine_password_change_handler: "
1312 "failed to connect netlogon pipe: %s\n",
1313 nt_errstr(result
)));
1317 result
= trust_pw_change(netlogon_creds_ctx
,
1319 netlogon_pipe
->binding_handle
,
1320 child
->domain
->name
,
1321 child
->domain
->dcname
,
1324 DEBUG(10, ("machine_password_change_handler: "
1325 "trust_pw_change returned %s\n",
1326 nt_errstr(result
)));
1328 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1329 DEBUG(3,("machine_password_change_handler: password set returned "
1330 "ACCESS_DENIED. Maybe the trust account "
1331 "password was changed and we didn't know it. "
1332 "Killing connections to domain %s\n",
1333 child
->domain
->name
));
1334 invalidate_cm_connection(child
->domain
);
1337 if (!calculate_next_machine_pwd_change(child
->domain
->name
,
1339 DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
1343 DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
1344 timeval_string(talloc_tos(), &next_change
, false)));
1346 if (!NT_STATUS_IS_OK(result
)) {
1349 * In case of failure, give the DC a minute to recover
1351 tmp
= timeval_current_ofs(60, 0);
1352 next_change
= timeval_max(&next_change
, &tmp
);
1356 child
->machine_password_change_event
= tevent_add_timer(global_event_context(), NULL
,
1358 machine_password_change_handler
,
1362 /* Deal with a request to go offline. */
1364 static void child_msg_offline(struct messaging_context
*msg
,
1367 struct server_id server_id
,
1370 struct winbindd_domain
*domain
;
1371 struct winbindd_domain
*primary_domain
= NULL
;
1372 const char *domainname
= (const char *)data
->data
;
1374 if (data
->data
== NULL
|| data
->length
== 0) {
1378 DEBUG(5,("child_msg_offline received for domain %s.\n", domainname
));
1380 if (!lp_winbind_offline_logon()) {
1381 DEBUG(10,("child_msg_offline: rejecting offline message.\n"));
1385 primary_domain
= find_our_domain();
1387 /* Mark the requested domain offline. */
1389 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1390 if (domain
->internal
) {
1393 if (strequal(domain
->name
, domainname
)) {
1394 DEBUG(5,("child_msg_offline: marking %s offline.\n", domain
->name
));
1395 set_domain_offline(domain
);
1396 /* we are in the trusted domain, set the primary domain
1398 if (domain
!= primary_domain
) {
1399 set_domain_offline(primary_domain
);
1405 /* Deal with a request to go online. */
1407 static void child_msg_online(struct messaging_context
*msg
,
1410 struct server_id server_id
,
1413 struct winbindd_domain
*domain
;
1414 struct winbindd_domain
*primary_domain
= NULL
;
1415 const char *domainname
= (const char *)data
->data
;
1417 if (data
->data
== NULL
|| data
->length
== 0) {
1421 DEBUG(5,("child_msg_online received for domain %s.\n", domainname
));
1423 if (!lp_winbind_offline_logon()) {
1424 DEBUG(10,("child_msg_online: rejecting online message.\n"));
1428 primary_domain
= find_our_domain();
1430 /* Set our global state as online. */
1431 set_global_winbindd_state_online();
1433 /* Try and mark everything online - delete any negative cache entries
1434 to force a reconnect now. */
1436 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1437 if (domain
->internal
) {
1440 if (strequal(domain
->name
, domainname
)) {
1441 DEBUG(5,("child_msg_online: requesting %s to go online.\n", domain
->name
));
1442 winbindd_flush_negative_conn_cache(domain
);
1443 set_domain_online_request(domain
);
1445 /* we can be in trusted domain, which will contact primary domain
1446 * we have to bring primary domain online in trusted domain process
1447 * see, winbindd_dual_pam_auth() --> winbindd_dual_pam_auth_samlogon()
1448 * --> contact_domain = find_our_domain()
1450 if (domain
!= primary_domain
) {
1451 winbindd_flush_negative_conn_cache(primary_domain
);
1452 set_domain_online_request(primary_domain
);
1458 struct winbindd_reinit_after_fork_state
{
1459 const struct winbindd_child
*myself
;
1462 static bool winbindd_reinit_after_fork_fn(struct winbindd_child
*child
,
1465 struct winbindd_reinit_after_fork_state
*state
= private_data
;
1467 if (child
== state
->myself
) {
1471 /* Destroy all possible events in child list. */
1472 TALLOC_FREE(child
->lockout_policy_event
);
1473 TALLOC_FREE(child
->machine_password_change_event
);
1476 * Children should never be able to send each other messages,
1477 * all messages must go through the parent.
1479 child
->pid
= (pid_t
)0;
1482 * Close service sockets to all other children
1484 if (child
->sock
!= -1) {
1492 NTSTATUS
winbindd_reinit_after_fork(const struct winbindd_child
*myself
,
1493 const char *logfilename
)
1495 struct winbindd_reinit_after_fork_state state
= { .myself
= myself
};
1496 struct winbindd_domain
*domain
;
1499 status
= reinit_after_fork(
1500 global_messaging_context(),
1501 global_event_context(),
1503 if (!NT_STATUS_IS_OK(status
)) {
1504 DEBUG(0,("reinit_after_fork() failed\n"));
1507 initialize_password_db(true, global_event_context());
1509 close_conns_after_fork();
1511 if (!override_logfile
&& logfilename
) {
1512 lp_set_logfile(logfilename
);
1516 if (!winbindd_setup_sig_term_handler(false))
1517 return NT_STATUS_NO_MEMORY
;
1518 if (!winbindd_setup_sig_hup_handler(override_logfile
? NULL
:
1520 return NT_STATUS_NO_MEMORY
;
1522 /* Stop zombies in children */
1525 /* Don't handle the same messages as our parent. */
1526 messaging_deregister(global_messaging_context(),
1527 MSG_SMB_CONF_UPDATED
, NULL
);
1528 messaging_deregister(global_messaging_context(),
1529 MSG_SHUTDOWN
, NULL
);
1530 messaging_deregister(global_messaging_context(),
1531 MSG_WINBIND_OFFLINE
, NULL
);
1532 messaging_deregister(global_messaging_context(),
1533 MSG_WINBIND_ONLINE
, NULL
);
1534 messaging_deregister(global_messaging_context(),
1535 MSG_WINBIND_ONLINESTATUS
, NULL
);
1536 messaging_deregister(global_messaging_context(),
1537 MSG_WINBIND_DUMP_DOMAIN_LIST
, NULL
);
1538 messaging_deregister(global_messaging_context(),
1541 messaging_deregister(global_messaging_context(),
1542 MSG_WINBIND_DOMAIN_OFFLINE
, NULL
);
1543 messaging_deregister(global_messaging_context(),
1544 MSG_WINBIND_DOMAIN_ONLINE
, NULL
);
1546 /* We have destroyed all events in the winbindd_event_context
1547 * in reinit_after_fork(), so clean out all possible pending
1548 * event pointers. */
1550 /* Deal with check_online_events. */
1552 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1553 TALLOC_FREE(domain
->check_online_event
);
1556 /* Ensure we're not handling a credential cache event inherited
1557 * from our parent. */
1559 ccache_remove_all_after_fork();
1561 forall_children(winbindd_reinit_after_fork_fn
, &state
);
1563 return NT_STATUS_OK
;
1567 * In a child there will be only one domain, reference that here.
1569 static struct winbindd_domain
*child_domain
;
1571 struct winbindd_domain
*wb_child_domain(void)
1573 return child_domain
;
1576 struct child_handler_state
{
1577 struct winbindd_child
*child
;
1578 struct winbindd_cli_state cli
;
1581 static void child_handler(struct tevent_context
*ev
, struct tevent_fd
*fde
,
1582 uint16_t flags
, void *private_data
)
1584 struct child_handler_state
*state
=
1585 (struct child_handler_state
*)private_data
;
1588 /* fetch a request from the main daemon */
1589 status
= child_read_request(state
->cli
.sock
, state
->cli
.request
);
1591 if (!NT_STATUS_IS_OK(status
)) {
1592 /* we lost contact with our parent */
1596 DEBUG(4,("child daemon request %d\n",
1597 (int)state
->cli
.request
->cmd
));
1599 ZERO_STRUCTP(state
->cli
.response
);
1600 state
->cli
.request
->null_term
= '\0';
1601 state
->cli
.mem_ctx
= talloc_tos();
1602 child_process_request(state
->child
, &state
->cli
);
1604 DEBUG(4, ("Finished processing child request %d\n",
1605 (int)state
->cli
.request
->cmd
));
1607 SAFE_FREE(state
->cli
.request
->extra_data
.data
);
1609 status
= child_write_response(state
->cli
.sock
, state
->cli
.response
);
1610 if (!NT_STATUS_IS_OK(status
)) {
1615 static bool fork_domain_child(struct winbindd_child
*child
)
1618 struct child_handler_state state
;
1619 struct winbindd_request request
;
1620 struct winbindd_response response
;
1621 struct winbindd_domain
*primary_domain
= NULL
;
1624 struct tevent_fd
*fde
;
1626 if (child
->domain
) {
1627 DEBUG(10, ("fork_domain_child called for domain '%s'\n",
1628 child
->domain
->name
));
1630 DEBUG(10, ("fork_domain_child called without domain.\n"));
1633 if (socketpair(AF_UNIX
, SOCK_STREAM
, 0, fdpair
) != 0) {
1634 DEBUG(0, ("Could not open child pipe: %s\n",
1640 state
.child
= child
;
1641 state
.cli
.pid
= getpid();
1642 state
.cli
.request
= &request
;
1643 state
.cli
.response
= &response
;
1645 child
->pid
= fork();
1647 if (child
->pid
== -1) {
1648 DEBUG(0, ("Could not fork: %s\n", strerror(errno
)));
1654 if (child
->pid
!= 0) {
1660 nread
= sys_read(fdpair
[1], &status
, sizeof(status
));
1661 if (nread
!= sizeof(status
)) {
1662 DEBUG(1, ("fork_domain_child: Could not read child status: "
1663 "nread=%d, error=%s\n", (int)nread
,
1668 if (!NT_STATUS_IS_OK(status
)) {
1669 DEBUG(1, ("fork_domain_child: Child status is %s\n",
1670 nt_errstr(status
)));
1675 child
->monitor_fde
= tevent_add_fd(global_event_context(),
1676 global_event_context(),
1679 child_socket_readable
,
1681 if (child
->monitor_fde
== NULL
) {
1682 DBG_WARNING("tevent_add_fd failed\n");
1687 child
->sock
= fdpair
[1];
1692 child_domain
= child
->domain
;
1694 DEBUG(10, ("Child process %d\n", (int)getpid()));
1696 state
.cli
.sock
= fdpair
[0];
1699 status
= winbindd_reinit_after_fork(child
, child
->logfilename
);
1701 nwritten
= sys_write(state
.cli
.sock
, &status
, sizeof(status
));
1702 if (nwritten
!= sizeof(status
)) {
1703 DEBUG(1, ("fork_domain_child: Could not write status: "
1704 "nwritten=%d, error=%s\n", (int)nwritten
,
1708 if (!NT_STATUS_IS_OK(status
)) {
1709 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
1710 nt_errstr(status
)));
1714 if (child_domain
!= NULL
) {
1715 setproctitle("domain child [%s]", child_domain
->name
);
1716 } else if (child
== idmap_child()) {
1717 setproctitle("idmap child");
1720 /* Handle online/offline messages. */
1721 messaging_register(global_messaging_context(), NULL
,
1722 MSG_WINBIND_OFFLINE
, child_msg_offline
);
1723 messaging_register(global_messaging_context(), NULL
,
1724 MSG_WINBIND_ONLINE
, child_msg_online
);
1725 messaging_register(global_messaging_context(), NULL
,
1726 MSG_DEBUG
, debug_message
);
1727 messaging_register(global_messaging_context(), NULL
,
1728 MSG_WINBIND_IP_DROPPED
,
1729 winbind_msg_ip_dropped
);
1730 messaging_register(global_messaging_context(), NULL
,
1731 MSG_WINBIND_DISCONNECT_DC
,
1732 winbind_msg_disconnect_dc
);
1734 primary_domain
= find_our_domain();
1736 if (primary_domain
== NULL
) {
1737 smb_panic("no primary domain found");
1740 /* It doesn't matter if we allow cache login,
1741 * try to bring domain online after fork. */
1742 if ( child
->domain
) {
1743 child
->domain
->startup
= True
;
1744 child
->domain
->startup_time
= time_mono(NULL
);
1745 /* we can be in primary domain or in trusted domain
1746 * If we are in trusted domain, set the primary domain
1747 * in start-up mode */
1748 if (!(child
->domain
->internal
)) {
1749 set_domain_online_request(child
->domain
);
1750 if (!(child
->domain
->primary
)) {
1751 primary_domain
->startup
= True
;
1752 primary_domain
->startup_time
= time_mono(NULL
);
1753 set_domain_online_request(primary_domain
);
1759 * We are in idmap child, make sure that we set the
1760 * check_online_event to bring primary domain online.
1762 if (child
== idmap_child()) {
1763 set_domain_online_request(primary_domain
);
1766 /* We might be in the idmap child...*/
1767 if (child
->domain
&& !(child
->domain
->internal
) &&
1768 lp_winbind_offline_logon()) {
1770 set_domain_online_request(child
->domain
);
1772 if (primary_domain
&& (primary_domain
!= child
->domain
)) {
1773 /* We need to talk to the primary
1774 * domain as well as the trusted
1775 * domain inside a trusted domain
1778 * set_dc_type_and_flags_trustinfo()
1781 set_domain_online_request(primary_domain
);
1784 child
->lockout_policy_event
= tevent_add_timer(
1785 global_event_context(), NULL
, timeval_zero(),
1786 account_lockout_policy_handler
,
1790 if (child
->domain
&& child
->domain
->primary
&&
1791 !USE_KERBEROS_KEYTAB
&&
1792 lp_server_role() == ROLE_DOMAIN_MEMBER
) {
1794 struct timeval next_change
;
1796 if (calculate_next_machine_pwd_change(child
->domain
->name
,
1798 child
->machine_password_change_event
= tevent_add_timer(
1799 global_event_context(), NULL
, next_change
,
1800 machine_password_change_handler
,
1805 fde
= tevent_add_fd(global_event_context(), NULL
, state
.cli
.sock
,
1806 TEVENT_FD_READ
, child_handler
, &state
);
1808 DEBUG(1, ("tevent_add_fd failed\n"));
1815 TALLOC_CTX
*frame
= talloc_stackframe();
1817 ret
= tevent_loop_once(global_event_context());
1819 DEBUG(1, ("tevent_loop_once failed: %s\n",
1824 if (child
->domain
&& child
->domain
->startup
&&
1825 (time_mono(NULL
) > child
->domain
->startup_time
+ 30)) {
1826 /* No longer in "startup" mode. */
1827 DEBUG(10,("fork_domain_child: domain %s no longer in 'startup' mode.\n",
1828 child
->domain
->name
));
1829 child
->domain
->startup
= False
;
1836 void winbind_msg_ip_dropped_parent(struct messaging_context
*msg_ctx
,
1839 struct server_id server_id
,
1842 struct winbind_msg_relay_state state
= {
1844 .msg_type
= msg_type
,
1848 winbind_msg_ip_dropped(msg_ctx
, private_data
, msg_type
,
1851 forall_children(winbind_msg_relay_fn
, &state
);