X-Git-Url: http://git.samba.org/?p=samba.git;a=blobdiff_plain;f=source3%2Fwinbindd%2Fwinbindd_cm.c;h=396a30377fc7a1a37e6d36659516f869dbb67ae1;hp=b3f89506914bfabc3eef8262fe0ac6bfb2b731ff;hb=646668bc51d42273a3665bd80bd044287e73bf2a;hpb=ba2cb35ca5b335a8f33e012255b43b9cf9a04ecf

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index b3f89506914..396a30377fc 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -8,17 +8,17 @@
    Copyright (C) Gerald (Jerry) Carter     2003-2005.
    Copyright (C) Volker Lendecke           2004-2005
    Copyright (C) Jeremy Allison		   2006
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -27,14 +27,14 @@
    We need to manage connections to domain controllers without having to
    mess up the main winbindd code with other issues.  The aim of the
    connection manager is to:
-  
+
        - make connections to domain controllers and cache them
        - re-establish connections when networks or servers go down
        - centralise the policy on connection timeouts, domain controller
 	 selection etc
        - manage re-entrancy for when winbindd becomes able to handle
 	 multiple outstanding rpc requests
-  
+
    Why not have connection management as part of the rpc layer like tng?
    Good question.  This code may morph into libsmb/rpc_cache.c or something
    like that but at the moment it's simply staying as part of winbind.	I
@@ -60,6 +60,7 @@
 
 #include "includes.h"
 #include "winbindd.h"
+#include "../libcli/auth/libcli_auth.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
@@ -171,20 +172,34 @@ static bool fork_child_dc_connect(struct winbindd_domain *domain)
 	struct dc_name_ip *dcs = NULL;
 	int num_dcs = 0;
 	TALLOC_CTX *mem_ctx = NULL;
-	pid_t child_pid;
 	pid_t parent_pid = sys_getpid();
+	char *lfile = NULL;
 
 	/* Stop zombies */
 	CatchChild();
 
-	child_pid = sys_fork();
+	if (domain->dc_probe_pid != (pid_t)-1) {
+		/*
+		 * We might already have a DC probe
+		 * child working, check.
+		 */
+		if (process_exists_by_pid(domain->dc_probe_pid)) {
+			DEBUG(10,("fork_child_dc_connect: pid %u already "
+				"checking for DC's.\n",
+				(unsigned int)domain->dc_probe_pid));
+			return true;
+		}
+		domain->dc_probe_pid = (pid_t)-1;
+	}
+
+	domain->dc_probe_pid = sys_fork();
 
-	if (child_pid == -1) {
+	if (domain->dc_probe_pid == (pid_t)-1) {
 		DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 		return False;
 	}
 
-	if (child_pid != 0) {
+	if (domain->dc_probe_pid != (pid_t)0) {
 		/* Parent */
 		messaging_register(winbind_messaging_context(), NULL,
 				   MSG_WINBIND_TRY_TO_GO_ONLINE,
@@ -199,26 +214,32 @@ static bool fork_child_dc_connect(struct winbindd_domain *domain)
 
 	/* Leave messages blocked - we will never process one. */
 
-	if (!reinit_after_fork(winbind_messaging_context(), true)) {
-		DEBUG(0,("reinit_after_fork() failed\n"));
-		_exit(0);
-	}
-
-	close_conns_after_fork();
-
 	if (!override_logfile) {
-		char *logfile;
-		if (asprintf(&logfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) > 0) {
-			lp_set_logfile(logfile);
-			SAFE_FREE(logfile);
-			reopen_logs();
+		if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
+			DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
+			_exit(1);
 		}
 	}
 
+	if (!winbindd_reinit_after_fork(lfile)) {
+		messaging_send_buf(winbind_messaging_context(),
+				   pid_to_procid(parent_pid),
+				   MSG_WINBIND_FAILED_TO_GO_ONLINE,
+				   (uint8 *)domain->name,
+				   strlen(domain->name)+1);
+		_exit(1);
+	}
+	SAFE_FREE(lfile);
+
 	mem_ctx = talloc_init("fork_child_dc_connect");
 	if (!mem_ctx) {
 		DEBUG(0,("talloc_init failed.\n"));
-		_exit(0);
+		messaging_send_buf(winbind_messaging_context(),
+				   pid_to_procid(parent_pid),
+				   MSG_WINBIND_FAILED_TO_GO_ONLINE,
+				   (uint8 *)domain->name,
+				   strlen(domain->name)+1);
+		_exit(1);
 	}
 
 	if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
@@ -248,7 +269,7 @@ static bool fork_child_dc_connect(struct winbindd_domain *domain)
 
 static void check_domain_online_handler(struct event_context *ctx,
 					struct timed_event *te,
-					const struct timeval *now,
+					struct timeval now,
 					void *private_data)
 {
         struct winbindd_domain *domain =
@@ -262,7 +283,7 @@ static void check_domain_online_handler(struct event_context *ctx,
 
 	/* Are we still in "startup" mode ? */
 
-	if (domain->startup && (now->tv_sec > domain->startup_time + 30)) {
+	if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
 		/* No longer in "startup" mode. */
 		DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 			domain->name ));
@@ -291,12 +312,12 @@ static void check_domain_online_handler(struct event_context *ctx,
 
 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 {
-	int wbc = lp_winbind_cache_time();
+	int wbr = lp_winbind_reconnect_delay();
 
 	if (domain->startup) {
 		domain->check_online_timeout = 10;
-	} else if (domain->check_online_timeout < wbc) {
-		domain->check_online_timeout = wbc;
+	} else if (domain->check_online_timeout < wbr) {
+		domain->check_online_timeout = wbr;
 	}
 }
 
@@ -336,14 +357,13 @@ void set_domain_offline(struct winbindd_domain *domain)
 	}
 
 	/* If we're in statup mode, check again in 10 seconds, not in
-	   lp_winbind_cache_time() seconds (which is 5 mins by default). */
+	   lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 
 	calc_new_online_timeout_check(domain);
 
 	domain->check_online_event = event_add_timed(winbind_event_context(),
 						NULL,
 						timeval_current_ofs(domain->check_online_timeout,0),
-						"check_domain_online_handler",
 						check_domain_online_handler,
 						domain);
 
@@ -360,7 +380,7 @@ void set_domain_offline(struct winbindd_domain *domain)
 
 	if ( domain->primary ) {
 		struct winbindd_child *idmap = idmap_child();
-		
+
 		if ( idmap->pid != 0 ) {
 			messaging_send_buf(winbind_messaging_context(),
 					   pid_to_procid(idmap->pid), 
@@ -379,8 +399,6 @@ void set_domain_offline(struct winbindd_domain *domain)
 
 static void set_domain_online(struct winbindd_domain *domain)
 {
-	struct timeval now;
-
 	DEBUG(10,("set_domain_online: called for domain %s\n",
 		domain->name ));
 
@@ -399,9 +417,7 @@ static void set_domain_online(struct winbindd_domain *domain)
 	winbindd_set_locator_kdc_envs(domain);
 
 	/* If we are waiting to get a krb5 ticket, trigger immediately. */
-	GetTimeOfDay(&now);
-	set_event_dispatch_time(winbind_event_context(),
-				"krb5_ticket_gain_handler", now);
+	ccache_regain_all_now();
 
 	/* Ok, we're out of any startup mode now... */
 	domain->startup = False;
@@ -439,7 +455,7 @@ static void set_domain_online(struct winbindd_domain *domain)
 
 	if ( domain->primary ) {
 		struct winbindd_child *idmap = idmap_child();
-		
+
 		if ( idmap->pid != 0 ) {
 			messaging_send_buf(winbind_messaging_context(),
 					   pid_to_procid(idmap->pid), 
@@ -474,6 +490,15 @@ void set_domain_online_request(struct winbindd_domain *domain)
 	   because network manager seems to lie.
 	   Wait at least 5 seconds. Heuristics suck... */
 
+
+	GetTimeOfDay(&tev);
+
+	/* Go into "startup" mode again. */
+	domain->startup_time = tev.tv_sec;
+	domain->startup = True;
+
+	tev.tv_sec += 5;
+
 	if (!domain->check_online_event) {
 		/* If we've come from being globally offline we
 		   don't have a check online event handler set.
@@ -482,29 +507,20 @@ void set_domain_online_request(struct winbindd_domain *domain)
 
 		DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 			domain->name ));
-
-		domain->check_online_event = event_add_timed(winbind_event_context(),
-								NULL,
-								timeval_current_ofs(5, 0),
-								"check_domain_online_handler",
-								check_domain_online_handler,
-								domain);
-
-		/* The above *has* to succeed for winbindd to work. */
-		if (!domain->check_online_event) {
-			smb_panic("set_domain_online_request: failed to add online handler");
-		}
 	}
 
-	GetTimeOfDay(&tev);
-
-	/* Go into "startup" mode again. */
-	domain->startup_time = tev.tv_sec;
-	domain->startup = True;
+	TALLOC_FREE(domain->check_online_event);
 
-	tev.tv_sec += 5;
+	domain->check_online_event = event_add_timed(winbind_event_context(),
+						     NULL,
+						     tev,
+						     check_domain_online_handler,
+						     domain);
 
-	set_event_dispatch_time(winbind_event_context(), "check_domain_online_handler", tev);
+	/* The above *has* to succeed for winbindd to work. */
+	if (!domain->check_online_event) {
+		smb_panic("set_domain_online_request: failed to add online handler");
+	}
 }
 
 /****************************************************************
@@ -530,7 +546,7 @@ void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
    an authenticated connection if DCs have the RestrictAnonymous registry
    entry set > 0, or the "Additional restrictions for anonymous
    connections" set in the win2k Local Security Policy. 
-   
+
    Caller to free() result in domain, username, password
 */
 
@@ -539,12 +555,12 @@ static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 	*username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 	*domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 	*password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
-	
+
 	if (*username && **username) {
 
 		if (!*domain || !**domain)
 			*domain = smb_xstrdup(lp_workgroup());
-		
+
 		if (!*password || !**password)
 			*password = smb_xstrdup("");
 
@@ -612,7 +628,7 @@ static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 						  DS_RETURN_DNS_NAME,
 						  &domain_info,
 						  &werr);
-		if (W_ERROR_IS_OK(werr)) {
+		if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 			tmp = talloc_strdup(
 				mem_ctx, domain_info->dc_unc);
 			if (tmp == NULL) {
@@ -649,7 +665,7 @@ static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 
 	if (!W_ERROR_IS_OK(werr)) {
 		DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
-			   dos_errstr(werr)));
+			   win_errstr(werr)));
 		talloc_destroy(mem_ctx);
 		return false;
 	}
@@ -680,7 +696,7 @@ static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 {
 	const char *account_name;
 	const char *name = NULL;
-	
+
 	/* If we are a DC and this is not our own domain */
 
 	if (IS_DC) {
@@ -690,10 +706,10 @@ static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 
 		if (!our_domain)
 			return NT_STATUS_INVALID_SERVER_STATE;		
-		
+
 		name = our_domain->name;		
 	}	
-	
+
 	if (!get_trust_pw_clear(name, machine_password,
 				&account_name, NULL))
 	{
@@ -715,7 +731,7 @@ static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 		if (!our_domain) {
 			return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;			
 		}
-		
+
 		if (asprintf(machine_krb5_principal, "%s$@%s",
 			     account_name, our_domain->alt_name) == -1)
 		{
@@ -753,7 +769,8 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 	struct sockaddr peeraddr;
 	socklen_t peeraddr_len;
 
-	struct sockaddr_in *peeraddr_in = (struct sockaddr_in *)&peeraddr;
+	struct sockaddr_in *peeraddr_in =
+		(struct sockaddr_in *)(void *)&peeraddr;
 
 	DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
 		controller, domain->name ));
@@ -806,11 +823,10 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 		}
 	}
 
-	cli_setup_signing_state(*cli, Undefined);
+	result = cli_negprot(*cli);
 
-	if (!cli_negprot(*cli)) {
-		DEBUG(1, ("cli_negprot failed\n"));
-		result = NT_STATUS_UNSUCCESSFUL;
+	if (!NT_STATUS_IS_OK(result)) {
+		DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
 		goto done;
 	}
 
@@ -852,7 +868,10 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 			result = ads_ntstatus(ads_status);
 			if (NT_STATUS_IS_OK(result)) {
 				/* Ensure creds are stored for NTLMSSP authenticated pipe access. */
-				cli_init_creds(*cli, machine_account, domain->name, machine_password);
+				result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
+				if (!NT_STATUS_IS_OK(result)) {
+					goto done;
+				}
 				goto session_setup_done;
 			}
 		}
@@ -877,7 +896,10 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 		result = ads_ntstatus(ads_status);
 		if (NT_STATUS_IS_OK(result)) {
 			/* Ensure creds are stored for NTLMSSP authenticated pipe access. */
-			cli_init_creds(*cli, machine_account, domain->name, machine_password);
+			result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
+			if (!NT_STATUS_IS_OK(result)) {
+				goto done;
+			}
 			goto session_setup_done;
 		}
 	}
@@ -903,7 +925,10 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 					    ipc_password, strlen(ipc_password)+1,
 					    ipc_domain))) {
 			/* Successful logon with given username. */
-			cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
+			result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
+			if (!NT_STATUS_IS_OK(result)) {
+				goto done;
+			}
 			goto session_setup_done;
 		} else {
 			DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
@@ -914,11 +939,17 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
  anon_fallback:
 
 	/* Fall back to anonymous connection, this might fail later */
+	DEBUG(10,("cm_prepare_connection: falling back to anonymous "
+		"connection for DC %s\n",
+		controller ));
 
 	if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
 					      NULL, 0, ""))) {
 		DEBUG(5, ("Connected anonymously\n"));
-		cli_init_creds(*cli, "", "", "");
+		result = cli_init_creds(*cli, "", "", "");
+		if (!NT_STATUS_IS_OK(result)) {
+			goto done;
+		}
 		goto session_setup_done;
 	}
 
@@ -942,15 +973,10 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 
 	winbindd_set_locator_kdc_envs(domain);
 
-	if (!cli_send_tconX(*cli, "IPC$", "IPC", "", 0)) {
-
-		result = cli_nt_error(*cli);
+	result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
 
+	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
-
-		if (NT_STATUS_IS_OK(result))
-			result = NT_STATUS_UNSUCCESSFUL;
-
 		goto done;
 	}
 
@@ -958,8 +984,11 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 	*retry = False;
 
 	/* set the domain if empty; needed for schannel connections */
-	if ( !*(*cli)->domain ) {
-		fstrcpy( (*cli)->domain, domain->name );
+	if ( !(*cli)->domain[0] ) {
+		result = cli_set_domain((*cli), domain->name);
+		if (!NT_STATUS_IS_OK(result)) {
+			return result;
+		}
 	}
 
 	result = NT_STATUS_OK;
@@ -984,15 +1013,39 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 	return result;
 }
 
+/*******************************************************************
+ Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
+ array.
+
+ Keeps the list unique by not adding duplicate entries.
+
+ @param[in] mem_ctx talloc memory context to allocate from
+ @param[in] domain_name domain of the DC
+ @param[in] dcname name of the DC to add to the list
+ @param[in] pss Internet address and port pair to add to the list
+ @param[in,out] dcs array of dc_name_ip structures to add to
+ @param[in,out] num_dcs number of dcs returned in the dcs array
+ @return true if the list was added to, false otherwise
+*******************************************************************/
+
 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
 			      const char *dcname, struct sockaddr_storage *pss,
 			      struct dc_name_ip **dcs, int *num)
 {
+	int i = 0;
+
 	if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
 		DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
 		return False;
 	}
 
+	/* Make sure there's no duplicates in the list */
+	for (i=0; i<*num; i++)
+		if (sockaddr_equal(
+			    (struct sockaddr *)(void *)&(*dcs)[i].ss,
+			    (struct sockaddr *)(void *)pss))
+			return False;
+
 	*dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
 
 	if (*dcs == NULL)
@@ -1016,7 +1069,7 @@ static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
 	}
 
 	(*addrs)[*num] = *pss;
-	set_sockaddr_port(&(*addrs)[*num], port);
+	set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
 
 	*num += 1;
 	return True;
@@ -1032,7 +1085,7 @@ static bool dcip_to_name(TALLOC_CTX *mem_ctx,
 		fstring name )
 {
 	struct ip_service ip_list;
-	uint32_t nt_version = NETLOGON_VERSION_1;
+	uint32_t nt_version = NETLOGON_NT_VERSION_1;
 
 	ip_list.ss = *pss;
 	ip_list.port = 0;
@@ -1125,8 +1178,15 @@ static bool dcip_to_name(TALLOC_CTX *mem_ctx,
 }
 
 /*******************************************************************
- Retreive a list of IP address for domain controllers.  Fill in 
- the dcs[]  with results.
+ Retrieve a list of IP addresses for domain controllers.
+
+ The array is sorted in the preferred connection order.
+
+ @param[in] mem_ctx talloc memory context to allocate from
+ @param[in] domain domain to retrieve DCs for
+ @param[out] dcs array of dcs that will be returned
+ @param[out] num_dcs number of dcs returned in the dcs array
+ @return always true
 *******************************************************************/
 
 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
@@ -1142,9 +1202,11 @@ static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
 
 	is_our_domain = strequal(domain->name, lp_workgroup());
 
+	/* If not our domain, get the preferred DC, by asking our primary DC */
 	if ( !is_our_domain
 		&& get_dc_name_via_netlogon(domain, dcname, &ss)
-		&& add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs, num_dcs) )
+		&& add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
+		       num_dcs) )
 	{
 		char addr[INET6_ADDRSTRLEN];
 		print_sockaddr(addr, sizeof(addr), &ss);
@@ -1171,8 +1233,13 @@ static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
 		if (sitename) {
 
 			/* Do the site-specific AD dns lookup first. */
-			get_sorted_dc_list(domain->alt_name, sitename, &ip_list, &iplist_size, True);
+			get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
+			       &iplist_size, True);
 
+			/* Add ips to the DC array.  We don't look up the name
+			   of the DC in this function, but we fill in the char*
+			   of the ip now to make the failed connection cache
+			   work */
 			for ( i=0; i<iplist_size; i++ ) {
 				char addr[INET6_ADDRSTRLEN];
 				print_sockaddr(addr, sizeof(addr),
@@ -1190,8 +1257,9 @@ static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
 			iplist_size = 0;
 		}
 
-		/* Now we add DCs from the main AD dns lookup. */
-		get_sorted_dc_list(domain->alt_name, NULL, &ip_list, &iplist_size, True);
+		/* Now we add DCs from the main AD DNS lookup. */
+		get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
+			&iplist_size, True);
 
 		for ( i=0; i<iplist_size; i++ ) {
 			char addr[INET6_ADDRSTRLEN];
@@ -1204,33 +1272,46 @@ static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
 					dcs,
 					num_dcs);
 		}
-        }
-
-	/* try standard netbios queries if no ADS */
 
-	if (iplist_size==0) {
-		get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size, False);
-	}
+		SAFE_FREE(ip_list);
+		iplist_size = 0;
+        }
 
-	/* FIXME!! this is where we should re-insert the GETDC requests --jerry */
+	/* Try standard netbios queries if no ADS */
+	if (*num_dcs == 0) {
+		get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
+		       False);
 
-	/* now add to the dc array.  We'll wait until the last minute 
-	   to look up the name of the DC.  But we fill in the char* for 
-	   the ip now in to make the failed connection cache work */
+		for ( i=0; i<iplist_size; i++ ) {
+			char addr[INET6_ADDRSTRLEN];
+			print_sockaddr(addr, sizeof(addr),
+					&ip_list[i].ss);
+			add_one_dc_unique(mem_ctx,
+					domain->name,
+					addr,
+					&ip_list[i].ss,
+					dcs,
+					num_dcs);
+		}
 
-	for ( i=0; i<iplist_size; i++ ) {
-		char addr[INET6_ADDRSTRLEN];
-		print_sockaddr(addr, sizeof(addr),
-				&ip_list[i].ss);
-		add_one_dc_unique(mem_ctx, domain->name, addr,
-			&ip_list[i].ss, dcs, num_dcs);
+		SAFE_FREE(ip_list);
+		iplist_size = 0;
 	}
 
-	SAFE_FREE( ip_list );
-
 	return True;
 }
 
+/*******************************************************************
+ Find and make a connection to a DC in the given domain.
+
+ @param[in] mem_ctx talloc memory context to allocate from
+ @param[in] domain domain to find a dc in
+ @param[out] dcname NetBIOS or FQDN of DC that's connected to
+ @param[out] pss DC Internet address and port
+ @param[out] fd fd of the open socket connected to the newly found dc
+ @return true when a DC connection is made, false otherwise
+*******************************************************************/
+
 static bool find_new_dc(TALLOC_CTX *mem_ctx,
 			struct winbindd_domain *domain,
 			fstring dcname, struct sockaddr_storage *pss, int *fd)
@@ -1316,10 +1397,11 @@ static bool find_new_dc(TALLOC_CTX *mem_ctx,
 
 	TALLOC_FREE(dcnames);
 	num_dcnames = 0;
-	
+
 	TALLOC_FREE(addrs);
 	num_addrs = 0;
 
+	close(*fd);
 	*fd = -1;
 
 	goto again;
@@ -1341,7 +1423,7 @@ static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
 
 	/* we have to check the server affinity cache here since 
 	   later we selecte a DC based on response time and not preference */
-	   
+
 	/* Check the negative connection cache
 	   before talking to it. It going down may have
 	   triggered the reconnection. */
@@ -1591,26 +1673,26 @@ static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
 	TALLOC_CTX *mem_ctx = NULL;
 
 	DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
-	
+
 	/* Our primary domain doesn't need to worry about trust flags.
 	   Force it to go through the network setup */
 	if ( domain->primary ) {		
 		return False;		
 	}
-	
+
 	our_domain = find_our_domain();
-	
+
 	if ( !connection_ok(our_domain) ) {
 		DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));		
 		return False;
 	}
 
 	/* This won't work unless our domain is AD */
-	 
+
 	if ( !our_domain->active_directory ) {
 		return False;
 	}
-	
+
 	/* Use DsEnumerateDomainTrusts to get us the trust direction
 	   and type */
 
@@ -1671,13 +1753,13 @@ static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
 
 			if ( !winbindd_can_contact_domain( domain) )
 				domain->internal = True;
-			
+
 			break;
 		}		
 	}
-	
+
 	talloc_destroy( mem_ctx );
-	
+
 	return domain->initialized;	
 }
 
@@ -1694,8 +1776,8 @@ static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
 	NTSTATUS 		result;
 	WERROR werr;
 	TALLOC_CTX              *mem_ctx = NULL;
-	struct rpc_pipe_client  *cli;
-	POLICY_HND pol;
+	struct rpc_pipe_client  *cli = NULL;
+	struct policy_handle pol;
 	union dssetup_DsRoleInfo info;
 	union lsa_PolicyInformation *lsa_info = NULL;
 
@@ -1773,8 +1855,8 @@ no_dssetup:
 	}
 
 	result = rpccli_lsa_open_policy2(cli, mem_ctx, True, 
-					 SEC_RIGHTS_MAXIMUM_ALLOWED, &pol);
-		
+					 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
+
 	if (NT_STATUS_IS_OK(result)) {
 		/* This particular query is exactly what Win2k clients use 
 		   to determine that the DC is active directory */
@@ -1815,7 +1897,7 @@ no_dssetup:
 		domain->active_directory = False;
 
 		result = rpccli_lsa_open_policy(cli, mem_ctx, True, 
-						SEC_RIGHTS_MAXIMUM_ALLOWED,
+						SEC_FLAG_MAXIMUM_ALLOWED,
 						&pol);
 
 		if (!NT_STATUS_IS_OK(result)) {
@@ -1885,8 +1967,8 @@ static void set_dc_type_and_flags( struct winbindd_domain *domain )
 /**********************************************************************
 ***********************************************************************/
 
-static bool cm_get_schannel_dcinfo(struct winbindd_domain *domain,
-				   struct dcinfo **ppdc)
+static bool cm_get_schannel_creds(struct winbindd_domain *domain,
+				   struct netlogon_creds_CredentialState **ppdc)
 {
 	NTSTATUS result;
 	struct rpc_pipe_client *netlogon_pipe;
@@ -1900,20 +1982,23 @@ static bool cm_get_schannel_dcinfo(struct winbindd_domain *domain,
 		return False;
 	}
 
-	/* Return a pointer to the struct dcinfo from the
+	/* Return a pointer to the struct netlogon_creds_CredentialState from the
 	   netlogon pipe. */
 
+	if (!domain->conn.netlogon_pipe->dc) {
+		return false;
+	}
+
 	*ppdc = domain->conn.netlogon_pipe->dc;
 	return True;
 }
 
 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
-			struct rpc_pipe_client **cli, POLICY_HND *sam_handle)
+			struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
 {
 	struct winbindd_cm_conn *conn;
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-	fstring conn_pwd;
-	struct dcinfo *p_dcinfo;
+	struct netlogon_creds_CredentialState *p_creds;
 	char *machine_password = NULL;
 	char *machine_account = NULL;
 	char *domain_name = NULL;
@@ -1929,6 +2014,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 		goto done;
 	}
 
+
 	/*
 	 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
 	 * sign and sealed pipe using the machine account password by
@@ -1936,10 +2022,9 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 	 * anonymous.
 	 */
 
-	pwd_get_cleartext(&conn->cli->pwd, conn_pwd);
 	if ((conn->cli->user_name[0] == '\0') ||
 	    (conn->cli->domain[0] == '\0') || 
-	    (conn_pwd[0] == '\0'))
+	    (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
 	{
 		result = get_trust_creds(domain, &machine_password,
 					 &machine_account, NULL);
@@ -1950,7 +2035,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 		}
 		domain_name = domain->name;
 	} else {
-		machine_password = SMB_STRDUP(conn_pwd);		
+		machine_password = SMB_STRDUP(conn->cli->password);
 		machine_account = SMB_STRDUP(conn->cli->user_name);
 		domain_name = conn->cli->domain;
 	}
@@ -1986,7 +2071,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
 	result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
 				      conn->samr_pipe->desthost,
-				      SEC_RIGHTS_MAXIMUM_ALLOWED,
+				      SEC_FLAG_MAXIMUM_ALLOWED,
 				      &conn->sam_connect_handle);
 	if (NT_STATUS_IS_OK(result)) {
 		goto open_domain;
@@ -2000,7 +2085,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
 	/* Fall back to schannel if it's a W2K pre-SP1 box. */
 
-	if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
+	if (!cm_get_schannel_creds(domain, &p_creds)) {
 		/* If this call fails - conn->cli can now be NULL ! */
 		DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
 			   "for domain %s, trying anon\n", domain->name));
@@ -2008,7 +2093,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 	}
 	result = cli_rpc_pipe_open_schannel_with_key
 		(conn->cli, &ndr_table_samr.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
-		 domain->name, p_dcinfo, &conn->samr_pipe);
+		 domain->name, &p_creds, &conn->samr_pipe);
 
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
@@ -2021,7 +2106,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
 	result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
 				      conn->samr_pipe->desthost,
-				      SEC_RIGHTS_MAXIMUM_ALLOWED,
+				      SEC_FLAG_MAXIMUM_ALLOWED,
 				      &conn->sam_connect_handle);
 	if (NT_STATUS_IS_OK(result)) {
 		goto open_domain;
@@ -2043,7 +2128,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
 	result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
 				      conn->samr_pipe->desthost,
-				      SEC_RIGHTS_MAXIMUM_ALLOWED,
+				      SEC_FLAG_MAXIMUM_ALLOWED,
 				      &conn->sam_connect_handle);
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
@@ -2056,7 +2141,7 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 	result = rpccli_samr_OpenDomain(conn->samr_pipe,
 					mem_ctx,
 					&conn->sam_connect_handle,
-					SEC_RIGHTS_MAXIMUM_ALLOWED,
+					SEC_FLAG_MAXIMUM_ALLOWED,
 					&domain->sid,
 					&conn->sam_domain_handle);
 
@@ -2075,12 +2160,11 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 }
 
 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
-			struct rpc_pipe_client **cli, POLICY_HND *lsa_policy)
+			struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
 {
 	struct winbindd_cm_conn *conn;
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-	fstring conn_pwd;
-	struct dcinfo *p_dcinfo;
+	struct netlogon_creds_CredentialState *p_creds;
 
 	result = init_dc_connection(domain);
 	if (!NT_STATUS_IS_OK(result))
@@ -2092,10 +2176,9 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 		goto done;
 	}
 
-	pwd_get_cleartext(&conn->cli->pwd, conn_pwd);
 	if ((conn->cli->user_name[0] == '\0') ||
 	    (conn->cli->domain[0] == '\0') || 
-	    (conn_pwd[0] == '\0')) {
+	    (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
 		DEBUG(10, ("cm_connect_lsa: No no user available for "
 			   "domain %s, trying schannel\n", conn->cli->domain));
 		goto schannel;
@@ -2106,7 +2189,7 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 	result = cli_rpc_pipe_open_spnego_ntlmssp
 		(conn->cli, &ndr_table_lsarpc.syntax_id,
 		 PIPE_AUTH_LEVEL_PRIVACY,
-		 conn->cli->domain, conn->cli->user_name, conn_pwd,
+		 conn->cli->domain, conn->cli->user_name, conn->cli->password,
 		 &conn->lsa_pipe);
 
 	if (!NT_STATUS_IS_OK(result)) {
@@ -2123,7 +2206,7 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 		  domain->name, conn->cli->domain, conn->cli->user_name ));
 
 	result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
-					SEC_RIGHTS_MAXIMUM_ALLOWED,
+					SEC_FLAG_MAXIMUM_ALLOWED,
 					&conn->lsa_policy);
 	if (NT_STATUS_IS_OK(result)) {
 		goto done;
@@ -2138,7 +2221,7 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
 	/* Fall back to schannel if it's a W2K pre-SP1 box. */
 
-	if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
+	if (!cm_get_schannel_creds(domain, &p_creds)) {
 		/* If this call fails - conn->cli can now be NULL ! */
 		DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
 			   "for domain %s, trying anon\n", domain->name));
@@ -2147,7 +2230,7 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 	result = cli_rpc_pipe_open_schannel_with_key
 		(conn->cli, &ndr_table_lsarpc.syntax_id,
 		 PIPE_AUTH_LEVEL_PRIVACY,
-		 domain->name, p_dcinfo, &conn->lsa_pipe);
+		 domain->name, &p_creds, &conn->lsa_pipe);
 
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
@@ -2159,7 +2242,7 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 		  "schannel.\n", domain->name ));
 
 	result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
-					SEC_RIGHTS_MAXIMUM_ALLOWED,
+					SEC_FLAG_MAXIMUM_ALLOWED,
 					&conn->lsa_policy);
 	if (NT_STATUS_IS_OK(result)) {
 		goto done;
@@ -2181,7 +2264,7 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 	}
 
 	result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
-					SEC_RIGHTS_MAXIMUM_ALLOWED,
+					SEC_FLAG_MAXIMUM_ALLOWED,
 					&conn->lsa_policy);
  done:
 	if (!NT_STATUS_IS_OK(result)) {
@@ -2293,7 +2376,7 @@ NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
 
 	result = cli_rpc_pipe_open_schannel_with_key(
 		conn->cli, &ndr_table_netlogon.syntax_id,
-		PIPE_AUTH_LEVEL_PRIVACY, domain->name, netlogon_pipe->dc,
+		PIPE_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
 		&conn->netlogon_pipe);
 
 	/* We can now close the initial netlogon pipe. */
@@ -2302,7 +2385,7 @@ NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
 			  "was %s\n", nt_errstr(result)));
-			  
+
 		/* make sure we return something besides OK */
 		return !NT_STATUS_IS_OK(result) ? result : NT_STATUS_PIPE_NOT_AVAILABLE;
 	}