libcli/security Provide a common, top level libcli/security/security.h
[sfrench/samba-autobuild/.git] / source3 / winbindd / winbindd_dual.c
index 53a5bc47a46c3f06367dcca393457c6043d83077..5058788e784057fa8395e10ae76f063e24fc5ce6 100644 (file)
 #include "includes.h"
 #include "winbindd.h"
 #include "../../nsswitch/libwbclient/wbc_async.h"
+#include "librpc/gen_ndr/messaging.h"
+#include "secrets.h"
+#include "../lib/util/select.h"
+#include "../libcli/security/security.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
@@ -39,7 +43,7 @@ extern struct winbindd_methods cache_methods;
 
 /* Read some data from a client connection */
 
-static void child_read_request(struct winbindd_cli_state *state)
+static NTSTATUS child_read_request(struct winbindd_cli_state *state)
 {
        NTSTATUS status;
 
@@ -51,13 +55,12 @@ static void child_read_request(struct winbindd_cli_state *state)
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(3, ("child_read_request: read_data failed: %s\n",
                          nt_errstr(status)));
-               state->finished = True;
-               return;
+               return status;
        }
 
        if (state->request->extra_len == 0) {
                state->request->extra_data.data = NULL;
-               return;
+               return NT_STATUS_OK;
        }
 
        DEBUG(10, ("Need to read %d extra bytes\n", (int)state->request->extra_len));
@@ -67,8 +70,7 @@ static void child_read_request(struct winbindd_cli_state *state)
 
        if (state->request->extra_data.data == NULL) {
                DEBUG(0, ("malloc failed\n"));
-               state->finished = True;
-               return;
+               return NT_STATUS_NO_MEMORY;
        }
 
        /* Ensure null termination */
@@ -80,9 +82,8 @@ static void child_read_request(struct winbindd_cli_state *state)
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0, ("Could not read extra data: %s\n",
                          nt_errstr(status)));
-               state->finished = True;
-               return;
        }
+       return status;
 }
 
 /*
@@ -182,186 +183,192 @@ int wb_child_request_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
        if (tevent_req_is_unix_error(req, err)) {
                return -1;
        }
-       if (state->response->result != WINBINDD_OK) {
-               *err = EIO; /* EIO doesn't fit, but what would be better? */
-               return -1;
-       }
        *presponse = talloc_move(mem_ctx, &state->response);
        return 0;
 }
 
-/*
- * Machinery for async requests sent to children. You set up a
- * winbindd_request, select a child to query, and issue a async_request
- * call. When the request is completed, the callback function you specified is
- * called back with the private pointer you gave to async_request.
- */
-
-struct winbindd_async_request {
-       struct winbindd_async_request *next, *prev;
-       TALLOC_CTX *mem_ctx;
-       struct winbindd_child *child;
+struct wb_domain_request_state {
+       struct tevent_context *ev;
+       struct winbindd_domain *domain;
+       struct winbindd_request *request;
+       struct winbindd_request *init_req;
        struct winbindd_response *response;
-       void (*continuation)(void *private_data, bool success);
-       struct timed_event *reply_timeout_event;
-       pid_t child_pid; /* pid of the child we're waiting on. Used to detect
-                           a restart of the child (child->pid != child_pid). */
-       void *private_data;
 };
 
-static bool fork_domain_child(struct winbindd_child *child);
-static void async_request_done(struct tevent_req *req);
+static void wb_domain_request_gotdc(struct tevent_req *subreq);
+static void wb_domain_request_initialized(struct tevent_req *subreq);
+static void wb_domain_request_done(struct tevent_req *subreq);
 
-void async_request(TALLOC_CTX *mem_ctx, struct winbindd_child *child,
-                  struct winbindd_request *request,
-                  struct winbindd_response *response,
-                  void (*continuation)(void *private_data, bool success),
-                  void *private_data)
+struct tevent_req *wb_domain_request_send(TALLOC_CTX *mem_ctx,
+                                         struct tevent_context *ev,
+                                         struct winbindd_domain *domain,
+                                         struct winbindd_request *request)
 {
-       struct winbindd_async_request *state;
-       struct tevent_req *req;
+       struct tevent_req *req, *subreq;
+       struct wb_domain_request_state *state;
+
+       req = tevent_req_create(mem_ctx, &state,
+                               struct wb_domain_request_state);
+       if (req == NULL) {
+               return NULL;
+       }
+
+       if (domain->initialized) {
+               subreq = wb_child_request_send(state, ev, &domain->child,
+                                              request);
+               if (tevent_req_nomem(subreq, req)) {
+                       return tevent_req_post(req, ev);
+               }
+               tevent_req_set_callback(subreq, wb_domain_request_done, req);
+               return req;
+       }
 
-       DEBUG(10, ("Sending request to child pid %d (domain=%s)\n",
-                  (int)child->pid,
-                  (child->domain != NULL) ? child->domain->name : "''"));
+       state->domain = domain;
+       state->ev = ev;
+       state->request = request;
 
-       state = talloc(mem_ctx, struct winbindd_async_request);
-       if (state == NULL) {
-               DEBUG(0, ("talloc failed\n"));
-               continuation(private_data, False);
-               return;
+       state->init_req = talloc_zero(state, struct winbindd_request);
+       if (tevent_req_nomem(state->init_req, req)) {
+               return tevent_req_post(req, ev);
        }
 
-       state->mem_ctx = mem_ctx;
-       state->child = child;
-       state->reply_timeout_event = NULL;
-       state->response = response;
-       state->continuation = continuation;
-       state->private_data = private_data;
+       if (IS_DC || domain->primary || domain->internal) {
+               /* The primary domain has to find the DC name itself */
+               state->init_req->cmd = WINBINDD_INIT_CONNECTION;
+               fstrcpy(state->init_req->domain_name, domain->name);
+               state->init_req->data.init_conn.is_primary =
+                       domain->primary ? true : false;
+               fstrcpy(state->init_req->data.init_conn.dcname, "");
 
-       request->pid = child->pid;
+               subreq = wb_child_request_send(state, ev, &domain->child,
+                                              state->init_req);
+               if (tevent_req_nomem(subreq, req)) {
+                       return tevent_req_post(req, ev);
+               }
+               tevent_req_set_callback(subreq, wb_domain_request_initialized,
+                                       req);
+               return req;
+       }
 
-       req = wb_child_request_send(state, winbind_event_context(),
-                                          child, request);
-       if (req == NULL) {
-               DEBUG(0, ("wb_child_request_send failed\n"));
-                continuation(private_data, false);
-               return;
-        }
-       tevent_req_set_callback(req, async_request_done, state);
+       /*
+        * Ask our DC for a DC name
+        */
+       domain = find_our_domain();
+
+       /* This is *not* the primary domain, let's ask our DC about a DC
+        * name */
+
+       state->init_req->cmd = WINBINDD_GETDCNAME;
+       fstrcpy(state->init_req->domain_name, domain->name);
+
+       subreq = wb_child_request_send(state, ev, &domain->child, request);
+       if (tevent_req_nomem(subreq, req)) {
+               return tevent_req_post(req, ev);
+       }
+       tevent_req_set_callback(subreq, wb_domain_request_gotdc, req);
+       return req;
 }
 
-static void async_request_done(struct tevent_req *req)
+static void wb_domain_request_gotdc(struct tevent_req *subreq)
 {
-       struct winbindd_async_request *state = tevent_req_callback_data(
-               req, struct winbindd_async_request);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct wb_domain_request_state *state = tevent_req_data(
+               req, struct wb_domain_request_state);
        struct winbindd_response *response;
        int ret, err;
 
-       ret = wb_child_request_recv(req, state, &response, &err);
-       TALLOC_FREE(req);
+       ret = wb_child_request_recv(subreq, talloc_tos(), &response, &err);
+       TALLOC_FREE(subreq);
        if (ret == -1) {
-               DEBUG(2, ("wb_child_request_recv failed: %s\n",
-                         strerror(err)));
-               state->continuation(state->private_data, false);
+               tevent_req_error(req, err);
                return;
        }
-       *state->response = *response;
-       state->continuation(state->private_data, true);
-}
+       state->init_req->cmd = WINBINDD_INIT_CONNECTION;
+       fstrcpy(state->init_req->domain_name, state->domain->name);
+       state->init_req->data.init_conn.is_primary = False;
+       fstrcpy(state->init_req->data.init_conn.dcname,
+               response->data.dc_name);
 
-struct domain_request_state {
-       TALLOC_CTX *mem_ctx;
-       struct winbindd_domain *domain;
-       struct winbindd_request *request;
-       struct winbindd_response *response;
-       void (*continuation)(void *private_data_data, bool success);
-       void *private_data_data;
-};
+       TALLOC_FREE(response);
 
-static void domain_init_recv(void *private_data_data, bool success);
+       subreq = wb_child_request_send(state, state->ev, &state->domain->child,
+                                      state->init_req);
+       if (tevent_req_nomem(subreq, req)) {
+               return;
+       }
+       tevent_req_set_callback(subreq, wb_domain_request_initialized, req);
+}
 
-void async_domain_request(TALLOC_CTX *mem_ctx,
-                         struct winbindd_domain *domain,
-                         struct winbindd_request *request,
-                         struct winbindd_response *response,
-                         void (*continuation)(void *private_data_data, bool success),
-                         void *private_data_data)
+static void wb_domain_request_initialized(struct tevent_req *subreq)
 {
-       struct domain_request_state *state;
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct wb_domain_request_state *state = tevent_req_data(
+               req, struct wb_domain_request_state);
+       struct winbindd_response *response;
+       int ret, err;
 
-       if (domain->initialized) {
-               async_request(mem_ctx, &domain->child, request, response,
-                             continuation, private_data_data);
+       ret = wb_child_request_recv(subreq, talloc_tos(), &response, &err);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               tevent_req_error(req, err);
                return;
        }
 
-       state = TALLOC_P(mem_ctx, struct domain_request_state);
-       if (state == NULL) {
-               DEBUG(0, ("talloc failed\n"));
-               continuation(private_data_data, False);
+       if (!string_to_sid(&state->domain->sid,
+                          response->data.domain_info.sid)) {
+               DEBUG(1,("init_child_recv: Could not convert sid %s "
+                       "from string\n", response->data.domain_info.sid));
+               tevent_req_error(req, EINVAL);
                return;
        }
+       fstrcpy(state->domain->name, response->data.domain_info.name);
+       fstrcpy(state->domain->alt_name, response->data.domain_info.alt_name);
+       state->domain->native_mode = response->data.domain_info.native_mode;
+       state->domain->active_directory =
+               response->data.domain_info.active_directory;
+       state->domain->initialized = true;
 
-       state->mem_ctx = mem_ctx;
-       state->domain = domain;
-       state->request = request;
-       state->response = response;
-       state->continuation = continuation;
-       state->private_data_data = private_data_data;
-
-       init_child_connection(domain, domain_init_recv, state);
-}
+       TALLOC_FREE(response);
 
-static void domain_init_recv(void *private_data_data, bool success)
-{
-       struct domain_request_state *state =
-               talloc_get_type_abort(private_data_data, struct domain_request_state);
-
-       if (!success) {
-               DEBUG(5, ("Domain init returned an error\n"));
-               state->continuation(state->private_data_data, False);
+       subreq = wb_child_request_send(state, state->ev, &state->domain->child,
+                                      state->request);
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-
-       async_request(state->mem_ctx, &state->domain->child,
-                     state->request, state->response,
-                     state->continuation, state->private_data_data);
+       tevent_req_set_callback(subreq, wb_domain_request_done, req);
 }
 
-static void recvfrom_child(void *private_data_data, bool success)
+static void wb_domain_request_done(struct tevent_req *subreq)
 {
-       struct winbindd_cli_state *state =
-               talloc_get_type_abort(private_data_data, struct winbindd_cli_state);
-       enum winbindd_result result = state->response.result;
-
-       /* This is an optimization: The child has written directly to the
-        * response buffer. The request itself is still in pending state,
-        * state that in the result code. */
-
-       state->response.result = WINBINDD_PENDING;
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct wb_domain_request_state *state = tevent_req_data(
+               req, struct wb_domain_request_state);
+       int ret, err;
 
-       if ((!success) || (result != WINBINDD_OK)) {
-               request_error(state);
+       ret = wb_child_request_recv(subreq, talloc_tos(), &state->response,
+                                   &err);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               tevent_req_error(req, err);
                return;
        }
-
-       request_ok(state);
+       tevent_req_done(req);
 }
 
-void sendto_child(struct winbindd_cli_state *state,
-                 struct winbindd_child *child)
+int wb_domain_request_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+                          struct winbindd_response **presponse, int *err)
 {
-       async_request(state->mem_ctx, child, state->request,
-                     &state->response, recvfrom_child, state);
-}
+       struct wb_domain_request_state *state = tevent_req_data(
+               req, struct wb_domain_request_state);
 
-void sendto_domain(struct winbindd_cli_state *state,
-                  struct winbindd_domain *domain)
-{
-       async_domain_request(state->mem_ctx, domain,
-                            state->request, &state->response,
-                            recvfrom_child, state);
+       if (tevent_req_is_unix_error(req, err)) {
+               return -1;
+       }
+       *presponse = talloc_move(mem_ctx, &state->response);
+       return 0;
 }
 
 static void child_process_request(struct winbindd_child *child,
@@ -373,8 +380,8 @@ static void child_process_request(struct winbindd_child *child,
        /* Free response data - we may be interrupted and receive another
           command before being able to send this data off. */
 
-       state->response.result = WINBINDD_ERROR;
-       state->response.length = sizeof(struct winbindd_response);
+       state->response->result = WINBINDD_ERROR;
+       state->response->length = sizeof(struct winbindd_response);
 
        /* as all requests in the child are sync, we can use talloc_tos() */
        state->mem_ctx = talloc_tos();
@@ -385,44 +392,67 @@ static void child_process_request(struct winbindd_child *child,
                if (state->request->cmd == table->struct_cmd) {
                        DEBUG(10,("child_process_request: request fn %s\n",
                                  table->name));
-                       state->response.result = table->struct_fn(domain, state);
+                       state->response->result = table->struct_fn(domain, state);
                        return;
                }
        }
 
        DEBUG(1 ,("child_process_request: unknown request fn number %d\n",
                  (int)state->request->cmd));
-       state->response.result = WINBINDD_ERROR;
+       state->response->result = WINBINDD_ERROR;
 }
 
-void setup_child(struct winbindd_child *child,
+void setup_child(struct winbindd_domain *domain, struct winbindd_child *child,
                 const struct winbindd_child_dispatch_table *table,
                 const char *logprefix,
                 const char *logname)
 {
        if (logprefix && logname) {
+               char *logbase = NULL;
+
+               if (*lp_logfile()) {
+                       char *end = NULL;
+
+                       if (asprintf(&logbase, "%s", lp_logfile()) < 0) {
+                               smb_panic("Internal error: asprintf failed");
+                       }
+
+                       if ((end = strrchr_m(logbase, '/'))) {
+                               *end = '\0';
+                       }
+               } else {
+                       if (asprintf(&logbase, "%s", get_dyn_LOGFILEBASE()) < 0) {
+                               smb_panic("Internal error: asprintf failed");
+                       }
+               }
+
                if (asprintf(&child->logfilename, "%s/%s-%s",
-                            get_dyn_LOGFILEBASE(), logprefix, logname) < 0) {
+                            logbase, logprefix, logname) < 0) {
+                       SAFE_FREE(logbase);
                        smb_panic("Internal error: asprintf failed");
                }
+
+               SAFE_FREE(logbase);
        } else {
                smb_panic("Internal error: logprefix == NULL && "
                          "logname == NULL");
        }
 
-       child->domain = NULL;
+       child->domain = domain;
        child->table = table;
        child->queue = tevent_queue_create(NULL, "winbind_child");
        SMB_ASSERT(child->queue != NULL);
+       child->binding_handle = wbint_binding_handle(NULL, domain, child);
+       SMB_ASSERT(child->binding_handle != NULL);
 }
 
-struct winbindd_child *children = NULL;
+static struct winbindd_child *winbindd_children = NULL;
 
 void winbind_child_died(pid_t pid)
 {
        struct winbindd_child *child;
 
-       for (child = children; child != NULL; child = child->next) {
+       for (child = winbindd_children; child != NULL; child = child->next) {
                if (child->pid == pid) {
                        break;
                }
@@ -435,7 +465,7 @@ void winbind_child_died(pid_t pid)
 
        /* This will be re-added in fork_domain_child() */
 
-       DLIST_REMOVE(children, child);
+       DLIST_REMOVE(winbindd_children, child);
 
        close(child->sock);
        child->sock = -1;
@@ -470,7 +500,7 @@ void winbind_msg_debug(struct messaging_context *msg_ctx,
 
        debug_message(msg_ctx, private_data, MSG_DEBUG, server_id, data);
 
-       for (child = children; child != NULL; child = child->next) {
+       for (child = winbindd_children; child != NULL; child = child->next) {
 
                DEBUG(10,("winbind_msg_debug: sending message to pid %u.\n",
                        (unsigned int)child->pid));
@@ -515,8 +545,8 @@ void winbind_msg_offline(struct messaging_context *msg_ctx,
                set_domain_offline(domain);
        }
 
-       for (child = children; child != NULL; child = child->next) {
-               /* Don't send message to internal childs.  We've already
+       for (child = winbindd_children; child != NULL; child = child->next) {
+               /* Don't send message to internal children.  We've already
                   done so above. */
                if (!child->domain || winbindd_internal_child(child)) {
                        continue;
@@ -590,7 +620,7 @@ void winbind_msg_online(struct messaging_context *msg_ctx,
                }
        }
 
-       for (child = children; child != NULL; child = child->next) {
+       for (child = winbindd_children; child != NULL; child = child->next) {
                /* Don't send message to internal childs. */
                if (!child->domain || winbindd_internal_child(child)) {
                        continue;
@@ -650,7 +680,7 @@ void winbind_msg_onlinestatus(struct messaging_context *msg_ctx,
        TALLOC_CTX *mem_ctx;
        const char *message;
        struct server_id *sender;
-       
+
        DEBUG(5,("winbind_msg_onlinestatus received.\n"));
 
        if (!data->data) {
@@ -663,7 +693,7 @@ void winbind_msg_onlinestatus(struct messaging_context *msg_ctx,
        if (mem_ctx == NULL) {
                return;
        }
-       
+
        message = collect_onlinestatus(mem_ctx);
        if (message == NULL) {
                talloc_destroy(mem_ctx);
@@ -688,7 +718,7 @@ void winbind_msg_dump_event_list(struct messaging_context *msg_ctx,
 
        dump_event_list(winbind_event_context());
 
-       for (child = children; child != NULL; child = child->next) {
+       for (child = winbindd_children; child != NULL; child = child->next) {
 
                DEBUG(10,("winbind_msg_dump_event_list: sending message to pid %u\n",
                        (unsigned int)child->pid));
@@ -839,6 +869,7 @@ static bool calculate_next_machine_pwd_change(const char *domain,
        time_t pass_last_set_time;
        time_t timeout;
        time_t next_change;
+       struct timeval tv;
        char *pw;
 
        pw = secrets_fetch_machine_password(domain,
@@ -858,11 +889,36 @@ static bool calculate_next_machine_pwd_change(const char *domain,
                return false;
        }
 
+       tv.tv_sec = pass_last_set_time;
+       DEBUG(10, ("password last changed %s\n",
+                  timeval_string(talloc_tos(), &tv, false)));
+       tv.tv_sec += timeout;
+       DEBUGADD(10, ("password valid until %s\n",
+                     timeval_string(talloc_tos(), &tv, false)));
+
        if (time(NULL) < (pass_last_set_time + timeout)) {
                next_change = pass_last_set_time + timeout;
                DEBUG(10,("machine password still valid until: %s\n",
                        http_timestring(talloc_tos(), next_change)));
                *t = timeval_set(next_change, 0);
+
+               if (lp_clustering()) {
+                       uint8_t randbuf;
+                       /*
+                        * When having a cluster, we have several
+                        * winbinds racing for the password change. In
+                        * the machine_password_change_handler()
+                        * function we check if someone else was
+                        * faster when the event triggers. We add a
+                        * 255-second random delay here, so that we
+                        * don't run to change the password at the
+                        * exact same moment.
+                        */
+                       generate_random_buffer(&randbuf, sizeof(randbuf));
+                       DEBUG(10, ("adding %d seconds randomness\n",
+                                  (int)randbuf));
+                       t->tv_sec += randbuf;
+               }
                return true;
        }
 
@@ -891,9 +947,18 @@ static void machine_password_change_handler(struct event_context *ctx,
 
        if (!calculate_next_machine_pwd_change(child->domain->name,
                                               &next_change)) {
+               DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
                return;
        }
 
+       DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
+                  timeval_string(talloc_tos(), &next_change, false)));
+
+       if (!timeval_expired(&next_change)) {
+               DEBUG(10, ("Someone else has already changed the pw\n"));
+               goto done;
+       }
+
        if (!winbindd_can_contact_domain(child->domain)) {
                DEBUG(10,("machine_password_change_handler: Removing myself since I "
                          "do not have an incoming trust to domain %s\n",
@@ -916,15 +981,38 @@ static void machine_password_change_handler(struct event_context *ctx,
                                                   child->domain->name);
        TALLOC_FREE(frame);
 
+       DEBUG(10, ("machine_password_change_handler: "
+                  "trust_pw_find_change_and_store_it returned %s\n",
+                  nt_errstr(result)));
+
+       if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
+               DEBUG(3,("machine_password_change_handler: password set returned "
+                        "ACCESS_DENIED.  Maybe the trust account "
+                        "password was changed and we didn't know it. "
+                        "Killing connections to domain %s\n",
+                        child->domain->name));
+               TALLOC_FREE(child->domain->conn.netlogon_pipe);
+       }
+
+       if (!calculate_next_machine_pwd_change(child->domain->name,
+                                              &next_change)) {
+               DEBUG(10, ("calculate_next_machine_pwd_change failed\n"));
+               return;
+       }
+
+       DEBUG(10, ("calculate_next_machine_pwd_change returned %s\n",
+                  timeval_string(talloc_tos(), &next_change, false)));
+
        if (!NT_STATUS_IS_OK(result)) {
-               DEBUG(10,("machine_password_change_handler: "
-                       "failed to change machine password: %s\n",
-                        nt_errstr(result)));
-       } else {
-               DEBUG(10,("machine_password_change_handler: "
-                       "successfully changed machine password\n"));
+               struct timeval tmp;
+               /*
+                * In case of failure, give the DC a minute to recover
+                */
+               tmp = timeval_current_ofs(60, 0);
+               next_change = timeval_max(&next_change, &tmp);
        }
 
+done:
        child->machine_password_change_event = event_add_timed(winbind_event_context(), NULL,
                                                              next_change,
                                                              machine_password_change_handler,
@@ -1042,10 +1130,14 @@ bool winbindd_reinit_after_fork(const char *logfilename)
 {
        struct winbindd_domain *domain;
        struct winbindd_child *cl;
+       NTSTATUS status;
 
-       if (!NT_STATUS_IS_OK(reinit_after_fork(winbind_messaging_context(),
-                                              winbind_event_context(),
-                                              true))) {
+       status = reinit_after_fork(
+               winbind_messaging_context(),
+               winbind_event_context(),
+               procid_self(),
+               true);
+       if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("reinit_after_fork() failed\n"));
                return false;
        }
@@ -1063,6 +1155,9 @@ bool winbindd_reinit_after_fork(const char *logfilename)
                                            logfilename))
                return false;
 
+       /* Stop zombies in children */
+       CatchChild();
+
        /* Don't handle the same messages as our parent. */
        messaging_deregister(winbind_messaging_context(),
                             MSG_SMB_CONF_UPDATED, NULL);
@@ -1097,7 +1192,7 @@ bool winbindd_reinit_after_fork(const char *logfilename)
        ccache_remove_all_after_fork();
 
        /* Destroy all possible events in child list. */
-       for (cl = children; cl != NULL; cl = cl->next) {
+       for (cl = winbindd_children; cl != NULL; cl = cl->next) {
                TALLOC_FREE(cl->lockout_policy_event);
                TALLOC_FREE(cl->machine_password_change_event);
 
@@ -1129,10 +1224,22 @@ bool winbindd_reinit_after_fork(const char *logfilename)
        return true;
 }
 
+/*
+ * In a child there will be only one domain, reference that here.
+ */
+static struct winbindd_domain *child_domain;
+
+struct winbindd_domain *wb_child_domain(void)
+{
+       return child_domain;
+}
+
 static bool fork_domain_child(struct winbindd_child *child)
 {
        int fdpair[2];
        struct winbindd_cli_state state;
+       struct winbindd_request request;
+       struct winbindd_response response;
        struct winbindd_domain *primary_domain = NULL;
 
        if (child->domain) {
@@ -1150,7 +1257,8 @@ static bool fork_domain_child(struct winbindd_child *child)
 
        ZERO_STRUCT(state);
        state.pid = sys_getpid();
-       state.request = &state._request;
+       state.request = &request;
+       state.response = &response;
 
        child->pid = sys_fork();
 
@@ -1163,18 +1271,16 @@ static bool fork_domain_child(struct winbindd_child *child)
                /* Parent */
                close(fdpair[0]);
                child->next = child->prev = NULL;
-               DLIST_ADD(children, child);
+               DLIST_ADD(winbindd_children, child);
                child->sock = fdpair[1];
                return True;
        }
 
        /* Child */
+       child_domain = child->domain;
 
        DEBUG(10, ("Child process %d\n", (int)sys_getpid()));
 
-       /* Stop zombies in children */
-       CatchChild();
-
        state.sock = fdpair[0];
        close(fdpair[1]);
 
@@ -1191,6 +1297,10 @@ static bool fork_domain_child(struct winbindd_child *child)
                           MSG_DUMP_EVENT_LIST, child_msg_dump_event_list);
        messaging_register(winbind_messaging_context(), NULL,
                           MSG_DEBUG, debug_message);
+       messaging_register(winbind_messaging_context(), NULL,
+                          MSG_WINBIND_IP_DROPPED,
+                          winbind_msg_ip_dropped);
+
 
        primary_domain = find_our_domain();
 
@@ -1202,7 +1312,7 @@ static bool fork_domain_child(struct winbindd_child *child)
         * try to bring domain online after fork. */
        if ( child->domain ) {
                child->domain->startup = True;
-               child->domain->startup_time = time(NULL);
+               child->domain->startup_time = time_mono(NULL);
                /* we can be in primary domain or in trusted domain
                 * If we are in trusted domain, set the primary domain
                 * in start-up mode */
@@ -1210,7 +1320,7 @@ static bool fork_domain_child(struct winbindd_child *child)
                        set_domain_online_request(child->domain);
                        if (!(child->domain->primary)) {
                                primary_domain->startup = True;
-                               primary_domain->startup_time = time(NULL);
+                               primary_domain->startup_time = time_mono(NULL);
                                set_domain_online_request(primary_domain);
                        }
                }
@@ -1265,7 +1375,7 @@ static bool fork_domain_child(struct winbindd_child *child)
 
        while (1) {
 
-               int ret;
+               int ret = 0;
                fd_set r_fds;
                fd_set w_fds;
                int maxfd;
@@ -1275,8 +1385,9 @@ static bool fork_domain_child(struct winbindd_child *child)
                TALLOC_CTX *frame = talloc_stackframe();
                struct iovec iov[2];
                int iov_count;
+               NTSTATUS status;
 
-               if (run_events(winbind_event_context(), 0, NULL, NULL)) {
+               if (run_events(winbind_event_context(), &ret, NULL, NULL)) {
                        TALLOC_FREE(frame);
                        continue;
                }
@@ -1284,7 +1395,7 @@ static bool fork_domain_child(struct winbindd_child *child)
                GetTimeOfDay(&now);
 
                if (child->domain && child->domain->startup &&
-                               (now.tv_sec > child->domain->startup_time + 30)) {
+                               (time_mono(NULL) > child->domain->startup_time + 30)) {
                        /* No longer in "startup" mode. */
                        DEBUG(10,("fork_domain_child: domain %s no longer in 'startup' mode.\n",
                                child->domain->name ));
@@ -1296,6 +1407,14 @@ static bool fork_domain_child(struct winbindd_child *child)
                FD_SET(state.sock, &r_fds);
                maxfd = state.sock;
 
+               /*
+                * Initialize this high as event_add_to_select_args()
+                * uses a timeval_min() on this and next_event. Fix
+                * from Roel van Meer <rolek@alt001.com>.
+                */
+               t.tv_sec = 999999;
+               t.tv_usec = 0;
+
                event_add_to_select_args(winbind_event_context(), &now,
                                         &r_fds, &w_fds, &t, &maxfd);
                tp = get_timed_events_timeout(winbind_event_context(), &t);
@@ -1306,7 +1425,7 @@ static bool fork_domain_child(struct winbindd_child *child)
 
                ret = sys_select(maxfd + 1, &r_fds, &w_fds, NULL, tp);
 
-               if (run_events(winbind_event_context(), ret, &r_fds, &w_fds)) {
+               if (run_events(winbind_event_context(), &ret, &r_fds, &w_fds)) {
                        /* We got a signal - continue. */
                        TALLOC_FREE(frame);
                        continue;
@@ -1332,17 +1451,18 @@ static bool fork_domain_child(struct winbindd_child *child)
                }
 
                /* fetch a request from the main daemon */
-               child_read_request(&state);
+               status = child_read_request(&state);
 
-               if (state.finished) {
+               if (!NT_STATUS_IS_OK(status)) {
                        /* we lost contact with our parent */
                        _exit(0);
                }
 
                DEBUG(4,("child daemon request %d\n", (int)state.request->cmd));
 
-               ZERO_STRUCT(state.response);
+               ZERO_STRUCTP(state.response);
                state.request->null_term = '\0';
+               state.mem_ctx = frame;
                child_process_request(child, &state);
 
                DEBUG(4, ("Finished processing child request %d\n",
@@ -1350,25 +1470,43 @@ static bool fork_domain_child(struct winbindd_child *child)
 
                SAFE_FREE(state.request->extra_data.data);
 
-               iov[0].iov_base = (void *)&state.response;
+               iov[0].iov_base = (void *)state.response;
                iov[0].iov_len = sizeof(struct winbindd_response);
                iov_count = 1;
 
-               if (state.response.length > sizeof(struct winbindd_response)) {
+               if (state.response->length > sizeof(struct winbindd_response)) {
                        iov[1].iov_base =
-                               (void *)state.response.extra_data.data;
-                       iov[1].iov_len = state.response.length-iov[0].iov_len;
+                               (void *)state.response->extra_data.data;
+                       iov[1].iov_len = state.response->length-iov[0].iov_len;
                        iov_count = 2;
                }
 
                DEBUG(10, ("Writing %d bytes to parent\n",
-                          (int)state.response.length));
+                          (int)state.response->length));
 
                if (write_data_iov(state.sock, iov, iov_count) !=
-                   state.response.length) {
+                   state.response->length) {
                        DEBUG(0, ("Could not write result\n"));
                        exit(1);
                }
                TALLOC_FREE(frame);
        }
 }
+
+void winbind_msg_ip_dropped_parent(struct messaging_context *msg_ctx,
+                                  void *private_data,
+                                  uint32_t msg_type,
+                                  struct server_id server_id,
+                                  DATA_BLOB *data)
+{
+       struct winbindd_child *child;
+
+       winbind_msg_ip_dropped(msg_ctx, private_data, msg_type,
+                              server_id, data);
+
+
+       for (child = winbindd_children; child != NULL; child = child->next) {
+               messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
+                                  msg_type, data->data, data->length);
+       }
+}