winbindd: Do not use group_list->out.resume_index after free
[samba.git] / source4 / winbind / wb_server.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Main winbindd server routines
4
5    Copyright (C) Stefan Metzmacher      2005-2008
6    Copyright (C) Andrew Tridgell        2005
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "smbd/process_model.h"
25 #include "winbind/wb_server.h"
26 #include "lib/stream/packet.h"
27 #include "lib/tsocket/tsocket.h"
28 #include "libcli/util/tstream.h"
29 #include "param/param.h"
30 #include "param/secrets.h"
31 #include "lib/util/dlinklist.h"
32
33 void wbsrv_terminate_connection(struct wbsrv_connection *wbconn, const char *reason)
34 {
35         struct wbsrv_service *service = wbconn->listen_socket->service;
36
37         if (wbconn->pending_calls == 0) {
38                 char *full_reason = talloc_asprintf(wbconn, "wbsrv: %s", reason);
39
40                 DLIST_REMOVE(service->broken_connections, wbconn);
41                 stream_terminate_connection(wbconn->conn, full_reason ? full_reason : reason);
42                 return;
43         }
44
45         if (wbconn->terminate != NULL) {
46                 return;
47         }
48
49         DEBUG(3,("wbsrv: terminating connection due to '%s' defered due to %d pending calls\n",
50                  reason, wbconn->pending_calls));
51         wbconn->terminate = talloc_strdup(wbconn, reason);
52         if (wbconn->terminate == NULL) {
53                 wbconn->terminate = "wbsrv: defered terminating connection - no memory";
54         }
55         DLIST_ADD_END(service->broken_connections, wbconn, NULL);
56 }
57
58 static void wbsrv_cleanup_broken_connections(struct wbsrv_service *s)
59 {
60         struct wbsrv_connection *cur, *next;
61
62         next = s->broken_connections;
63         while (next != NULL) {
64                 cur = next;
65                 next = cur->next;
66
67                 wbsrv_terminate_connection(cur, cur->terminate);
68         }
69 }
70
71 static void wbsrv_call_loop(struct tevent_req *subreq)
72 {
73         struct wbsrv_connection *wbsrv_conn = tevent_req_callback_data(subreq,
74                                       struct wbsrv_connection);
75         struct wbsrv_service *service = wbsrv_conn->listen_socket->service;
76         struct wbsrv_samba3_call *call;
77         NTSTATUS status;
78
79         if (wbsrv_conn->terminate) {
80                 /*
81                  * if the current connection is broken
82                  * we need to clean it up before any other connection
83                  */
84                 wbsrv_terminate_connection(wbsrv_conn, wbsrv_conn->terminate);
85                 wbsrv_cleanup_broken_connections(service);
86                 return;
87         }
88
89         wbsrv_cleanup_broken_connections(service);
90
91         call = talloc_zero(wbsrv_conn, struct wbsrv_samba3_call);
92         if (call == NULL) {
93                 wbsrv_terminate_connection(wbsrv_conn, "wbsrv_call_loop: "
94                                 "no memory for wbsrv_samba3_call");
95                 return;
96         }
97         call->wbconn = wbsrv_conn;
98
99         status = tstream_read_pdu_blob_recv(subreq,
100                                             call,
101                                             &call->in);
102         TALLOC_FREE(subreq);
103         if (!NT_STATUS_IS_OK(status)) {
104                 const char *reason;
105
106                 reason = talloc_asprintf(wbsrv_conn, "wbsrv_call_loop: "
107                                          "tstream_read_pdu_blob_recv() - %s",
108                                          nt_errstr(status));
109                 if (!reason) {
110                         reason = nt_errstr(status);
111                 }
112
113                 wbsrv_terminate_connection(wbsrv_conn, reason);
114                 return;
115         }
116
117         DEBUG(10,("Received winbind TCP packet of length %lu from %s\n",
118                  (long) call->in.length,
119                  tsocket_address_string(wbsrv_conn->conn->remote_address, call)));
120
121         status = wbsrv_samba3_process(call);
122         if (!NT_STATUS_IS_OK(status)) {
123                 const char *reason;
124
125                 reason = talloc_asprintf(wbsrv_conn, "wbsrv_call_loop: "
126                                          "tstream_read_pdu_blob_recv() - %s",
127                                          nt_errstr(status));
128                 if (!reason) {
129                         reason = nt_errstr(status);
130                 }
131
132                 wbsrv_terminate_connection(wbsrv_conn, reason);
133                 return;
134         }
135
136         /*
137          * The winbind pdu's has the length as 4 byte (initial_read_size),
138          * wbsrv_samba3_packet_full_request provides the pdu length then.
139          */
140         subreq = tstream_read_pdu_blob_send(wbsrv_conn,
141                                             wbsrv_conn->conn->event.ctx,
142                                             wbsrv_conn->tstream,
143                                             4, /* initial_read_size */
144                                             wbsrv_samba3_packet_full_request,
145                                             wbsrv_conn);
146         if (subreq == NULL) {
147                 wbsrv_terminate_connection(wbsrv_conn, "wbsrv_call_loop: "
148                                 "no memory for tstream_read_pdu_blob_send");
149                 return;
150         }
151         tevent_req_set_callback(subreq, wbsrv_call_loop, wbsrv_conn);
152 }
153
154 static void wbsrv_accept(struct stream_connection *conn)
155 {
156         struct wbsrv_listen_socket *wbsrv_socket = talloc_get_type(conn->private_data,
157                                                                    struct wbsrv_listen_socket);
158         struct wbsrv_connection *wbsrv_conn;
159         struct tevent_req *subreq;
160         int rc;
161
162         wbsrv_cleanup_broken_connections(wbsrv_socket->service);
163
164         wbsrv_conn = talloc_zero(conn, struct wbsrv_connection);
165         if (wbsrv_conn == NULL) {
166                 stream_terminate_connection(conn, "wbsrv_accept: out of memory");
167                 return;
168         }
169
170         wbsrv_conn->send_queue = tevent_queue_create(conn, "wbsrv_accept");
171         if (wbsrv_conn->send_queue == NULL) {
172                 stream_terminate_connection(conn,
173                                 "wbsrv_accept: out of memory");
174                 return;
175         }
176
177         TALLOC_FREE(conn->event.fde);
178
179         rc = tstream_bsd_existing_socket(wbsrv_conn,
180                         socket_get_fd(conn->socket),
181                         &wbsrv_conn->tstream);
182         if (rc < 0) {
183                 stream_terminate_connection(conn,
184                                 "wbsrv_accept: out of memory");
185                 return;
186         }
187
188         wbsrv_conn->conn = conn;
189         wbsrv_conn->listen_socket = wbsrv_socket;
190         wbsrv_conn->lp_ctx = wbsrv_socket->service->task->lp_ctx;
191         conn->private_data = wbsrv_conn;
192
193         /*
194          * The winbind pdu's has the length as 4 byte (initial_read_size),
195          * wbsrv_samba3_packet_full_request provides the pdu length then.
196          */
197         subreq = tstream_read_pdu_blob_send(wbsrv_conn,
198                                             wbsrv_conn->conn->event.ctx,
199                                             wbsrv_conn->tstream,
200                                             4, /* initial_read_size */
201                                             wbsrv_samba3_packet_full_request,
202                                             wbsrv_conn);
203         if (subreq == NULL) {
204                 wbsrv_terminate_connection(wbsrv_conn, "wbsrv_accept: "
205                                 "no memory for tstream_read_pdu_blob_send");
206                 return;
207         }
208         tevent_req_set_callback(subreq, wbsrv_call_loop, wbsrv_conn);
209 }
210
211 /*
212   called on a tcp recv
213 */
214 static void wbsrv_recv(struct stream_connection *conn, uint16_t flags)
215 {
216         struct wbsrv_connection *wbsrv_conn = talloc_get_type(conn->private_data,
217                                                         struct wbsrv_connection);
218         wbsrv_terminate_connection(wbsrv_conn, "wbsrv_recv: called");
219 }
220
221 /*
222   called when we can write to a connection
223 */
224 static void wbsrv_send(struct stream_connection *conn, uint16_t flags)
225 {
226         struct wbsrv_connection *wbsrv_conn = talloc_get_type(conn->private_data,
227                                                         struct wbsrv_connection);
228         /* this should never be triggered! */
229         wbsrv_terminate_connection(wbsrv_conn, "wbsrv_send: called");
230 }
231
232 static const struct stream_server_ops wbsrv_ops = {
233         .name                   = "winbind samba3 protocol",
234         .accept_connection      = wbsrv_accept,
235         .recv_handler           = wbsrv_recv,
236         .send_handler           = wbsrv_send
237 };
238
239 /*
240   startup the winbind task
241 */
242 static void winbind_task_init(struct task_server *task)
243 {
244         uint16_t port = 1;
245         const struct model_ops *model_ops;
246         NTSTATUS status;
247         struct wbsrv_service *service;
248         struct wbsrv_listen_socket *listen_socket;
249         char *errstring;
250         struct dom_sid *primary_sid;
251         bool ok;
252
253         task_server_set_title(task, "task[winbind]");
254
255         /* within the winbind task we want to be a single process, so
256            ask for the single process model ops and pass these to the
257            stream_setup_socket() call. */
258         model_ops = process_model_startup("single");
259         if (!model_ops) {
260                 task_server_terminate(task,
261                                       "Can't find 'single' process model_ops", true);
262                 return;
263         }
264
265         /* Make sure the directory for the Samba3 socket exists, and is of the correct permissions */
266         ok = directory_create_or_exist_strict(lpcfg_winbindd_socket_directory(task->lp_ctx),
267                                               geteuid(), 0755);
268         if (!ok) {
269                 task_server_terminate(task,
270                                       "Cannot create winbindd pipe directory", true);
271                 return;
272         }
273
274         /* Make sure the directory for the Samba3 socket exists, and is of the correct permissions */
275         ok = directory_create_or_exist_strict(lpcfg_winbindd_privileged_socket_directory(task->lp_ctx),
276                         geteuid(), 0750);
277         if (!ok) {
278                 task_server_terminate(task,
279                                       "Cannot create winbindd privileged pipe directory", true);
280                 return;
281         }
282
283         service = talloc_zero(task, struct wbsrv_service);
284         if (!service) goto nomem;
285         service->task   = task;
286
287
288         /* Find the primary SID, depending if we are a standalone
289          * server (what good is winbind in this case, but anyway...),
290          * or are in a domain as a member or a DC */
291         switch (lpcfg_server_role(service->task->lp_ctx)) {
292         case ROLE_STANDALONE:
293                 primary_sid = secrets_get_domain_sid(service,
294                                                      service->task->lp_ctx,
295                                                      lpcfg_netbios_name(service->task->lp_ctx),
296                                                      &service->sec_channel_type,
297                                                      &errstring);
298                 if (!primary_sid) {
299                         char *message = talloc_asprintf(task, 
300                                                         "Cannot start Winbind (standalone configuration): %s: "
301                                                         "Have you provisioned this server (%s) or changed it's name?", 
302                                                         errstring, lpcfg_netbios_name(service->task->lp_ctx));
303                         task_server_terminate(task, message, true);
304                         return;
305                 }
306                 break;
307         case ROLE_DOMAIN_MEMBER:
308                 primary_sid = secrets_get_domain_sid(service,
309                                                      service->task->lp_ctx,
310                                                      lpcfg_workgroup(service->task->lp_ctx),
311                                                      &service->sec_channel_type,
312                                                      &errstring);
313                 if (!primary_sid) {
314                         char *message = talloc_asprintf(task, "Cannot start Winbind (domain member): %s: "
315                                                         "Have you joined the %s domain?", 
316                                                         errstring, lpcfg_workgroup(service->task->lp_ctx));
317                         task_server_terminate(task, message, true);
318                         return;
319                 }
320                 break;
321         case ROLE_ACTIVE_DIRECTORY_DC:
322                 primary_sid = secrets_get_domain_sid(service,
323                                                      service->task->lp_ctx,
324                                                      lpcfg_workgroup(service->task->lp_ctx),
325                                                      &service->sec_channel_type,
326                                                      &errstring);
327                 if (!primary_sid) {
328                         char *message = talloc_asprintf(task, "Cannot start Winbind (domain controller): %s: "
329                                                         "Have you provisioned the %s domain?", 
330                                                         errstring, lpcfg_workgroup(service->task->lp_ctx));
331                         task_server_terminate(task, message, true);
332                         return;
333                 }
334                 break;
335         case ROLE_DOMAIN_PDC:
336         case ROLE_DOMAIN_BDC:
337                 task_server_terminate(task, "Cannot start 'samba' winbindd as a 'classic samba' DC: use winbindd instead", true);
338                 return;
339         }
340         service->primary_sid = primary_sid;
341
342         service->idmap_ctx = idmap_init(service, task->event_ctx, task->lp_ctx);
343         if (service->idmap_ctx == NULL) {
344                 task_server_terminate(task, "Failed to load idmap database", true);
345                 return;
346         }
347
348         service->priv_pipe_dir = lpcfg_winbindd_privileged_socket_directory(task->lp_ctx);
349         service->pipe_dir = lpcfg_winbindd_socket_directory(task->lp_ctx);
350
351         /* setup the unprivileged samba3 socket */
352         listen_socket = talloc(service, struct wbsrv_listen_socket);
353         if (!listen_socket) goto nomem;
354         listen_socket->socket_path      = talloc_asprintf(listen_socket, "%s/%s", 
355                                                           service->pipe_dir, 
356                                                           WINBINDD_SOCKET_NAME);
357         if (!listen_socket->socket_path) goto nomem;
358         listen_socket->service          = service;
359         listen_socket->privileged       = false;
360         status = stream_setup_socket(task, task->event_ctx, task->lp_ctx, model_ops,
361                                      &wbsrv_ops, "unix",
362                                      listen_socket->socket_path, &port,
363                                      lpcfg_socket_options(task->lp_ctx),
364                                      listen_socket);
365         if (!NT_STATUS_IS_OK(status)) goto listen_failed;
366
367         /* setup the privileged samba3 socket */
368         listen_socket = talloc(service, struct wbsrv_listen_socket);
369         if (!listen_socket) goto nomem;
370         listen_socket->socket_path 
371                 = talloc_asprintf(listen_socket, "%s/%s", 
372                                   service->priv_pipe_dir,
373                                   WINBINDD_SOCKET_NAME);
374         if (!listen_socket->socket_path) goto nomem;
375         listen_socket->service          = service;
376         listen_socket->privileged       = true;
377         status = stream_setup_socket(task, task->event_ctx, task->lp_ctx, model_ops,
378                                      &wbsrv_ops, "unix",
379                                      listen_socket->socket_path, &port,
380                                      lpcfg_socket_options(task->lp_ctx),
381                                      listen_socket);
382         if (!NT_STATUS_IS_OK(status)) goto listen_failed;
383
384         status = wbsrv_init_irpc(service);
385         if (!NT_STATUS_IS_OK(status)) goto irpc_failed;
386
387         return;
388
389 listen_failed:
390         DEBUG(0,("stream_setup_socket(path=%s) failed - %s\n",
391                  listen_socket->socket_path, nt_errstr(status)));
392         task_server_terminate(task, nt_errstr(status), true);
393         return;
394 irpc_failed:
395         DEBUG(0,("wbsrv_init_irpc() failed - %s\n",
396                  nt_errstr(status)));
397         task_server_terminate(task, nt_errstr(status), true);
398         return;
399 nomem:
400         task_server_terminate(task, nt_errstr(NT_STATUS_NO_MEMORY), true);
401         return;
402 }
403
404 /*
405   register ourselves as a available server
406 */
407 NTSTATUS server_service_winbind_init(void)
408 {
409         return register_server_service("winbind", winbind_task_init);
410 }