Winbind daemon for ntdom nss module
- Copyright (C) by Tim Potter 2000, 2001
+ Copyright (C) by Tim Potter 2000-2002
Copyright (C) Andrew Tridgell 2002
+ Copyright (C) Jelmer Vernooij 2003
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "winbindd.h"
-/* List of all connected clients */
-
-static struct winbindd_cli_state *client_list;
-static int num_clients;
BOOL opt_nocache = False;
-BOOL opt_dual_daemon = False;
+BOOL opt_dual_daemon = True;
+
+/*****************************************************************************
+ stubb functions
+****************************************************************************/
+
+void become_root( void )
+{
+ return;
+}
+
+void unbecome_root( void )
+{
+ return;
+}
/* Reload configuration */
static BOOL reload_services_file(BOOL test)
{
BOOL ret;
- pstring logfile;
if (lp_loaded()) {
pstring fname;
}
}
- snprintf(logfile, sizeof(logfile), "%s/log.winbindd", dyn_LOGFILEBASE);
- lp_set_logfile(logfile);
-
reopen_logs();
ret = lp_load(dyn_CONFIGFILE,False,False,True);
- snprintf(logfile, sizeof(logfile), "%s/log.winbindd", dyn_LOGFILEBASE);
- lp_set_logfile(logfile);
-
reopen_logs();
load_interfaces();
return(ret);
}
+
#if DUMP_CORE
/**************************************************************************** **
/* Print client state information */
- DEBUG(0, ("\t%d clients currently active\n", num_clients));
+ DEBUG(0, ("\t%d clients currently active\n", winbindd_num_clients()));
- if (DEBUGLEVEL >= 2 && num_clients) {
+ if (DEBUGLEVEL >= 2 && winbindd_num_clients()) {
DEBUG(2, ("\tclient list:\n"));
- for(tmp = client_list; tmp; tmp = tmp->next) {
+ for(tmp = winbindd_client_list(); tmp; tmp = tmp->next) {
DEBUG(2, ("\t\tpid %d, sock %d, rbl %d, wbl %d\n",
tmp->pid, tmp->sock, tmp->read_buf_len,
tmp->write_buf_len));
static void print_winbindd_status(void)
{
winbindd_status();
- winbindd_idmap_status();
winbindd_cm_status();
}
static void flush_caches(void)
{
+#if 0
/* Clear cached user and group enumation info */
- wcache_flush_cache();
+ if (!opt_dual_daemon) /* Until we have coherent cache flush. */
+ wcache_flush_cache();
+#endif
+
+ /* We need to invalidate cached user list entries on a SIGHUP
+ otherwise cached access denied errors due to restrict anonymous
+ hang around until the sequence number changes. */
+
+ wcache_invalidate_cache();
}
/* Handle the signal by unlinking socket and exiting */
{
pstring path;
- winbindd_idmap_close();
+ idmap_close();
/* Remove socket file */
snprintf(path, sizeof(path), "%s/%s",
sys_select_signal();
}
-/* Create winbindd socket */
+/* React on 'smbcontrol winbindd reload-config' in the same way as on SIGHUP*/
+static void msg_reload_services(int msg_type, pid_t src, void *buf, size_t len)
+{
+ /* Flush various caches */
+ flush_caches();
+ reload_services_file(True);
+}
-static int create_sock(void)
+/* React on 'smbcontrol winbindd shutdown' in the same way as on SIGTERM*/
+static void msg_shutdown(int msg_type, pid_t src, void *buf, size_t len)
{
- return create_pipe_sock( WINBINDD_SOCKET_DIR,
- WINBINDD_SOCKET_NAME, 0755);
+ terminate();
}
struct dispatch_table {
enum winbindd_cmd cmd;
enum winbindd_result (*fn)(struct winbindd_cli_state *state);
- char *winbindd_cmd_name;
+ const char *winbindd_cmd_name;
};
static struct dispatch_table dispatch_table[] = {
{ WINBINDD_INFO, winbindd_info, "INFO" },
{ WINBINDD_INTERFACE_VERSION, winbindd_interface_version, "INTERFACE_VERSION" },
{ WINBINDD_DOMAIN_NAME, winbindd_domain_name, "DOMAIN_NAME" },
+ { WINBINDD_NETBIOS_NAME, winbindd_netbios_name, "NETBIOS_NAME" },
+ { WINBINDD_PRIV_PIPE_DIR, winbindd_priv_pipe_dir, "WINBINDD_PRIV_PIPE_DIR" },
/* WINS functions */
{ WINBINDD_WINS_BYNAME, winbindd_wins_byname, "WINS_BYNAME" },
{ WINBINDD_WINS_BYIP, winbindd_wins_byip, "WINS_BYIP" },
-
+
+ /* UNIX account management functions */
+ { WINBINDD_CREATE_USER, winbindd_create_user, "CREATE_USER" },
+ { WINBINDD_CREATE_GROUP, winbindd_create_group, "CREATE_GROUP" },
+ { WINBINDD_ADD_USER_TO_GROUP, winbindd_add_user_to_group, "ADD_USER_TO_GROUP" },
+ { WINBINDD_REMOVE_USER_FROM_GROUP, winbindd_remove_user_from_group,"REMOVE_USER_FROM_GROUP"},
+ { WINBINDD_SET_USER_PRIMARY_GROUP, winbindd_set_user_primary_group,"SET_USER_PRIMARY_GROUP"},
+ { WINBINDD_DELETE_USER, winbindd_delete_user, "DELETE_USER" },
+ { WINBINDD_DELETE_GROUP, winbindd_delete_group, "DELETE_GROUP" },
+
/* End of list */
{ WINBINDD_NUM_CMDS, NULL, "NONE" }
/* Process a new connection by adding it to the client connection list */
-static void new_connection(int accept_sock)
+static void new_connection(int listen_sock, BOOL privileged)
{
struct sockaddr_un sunaddr;
struct winbindd_cli_state *state;
len = sizeof(sunaddr);
do {
- sock = accept(accept_sock, (struct sockaddr *)&sunaddr, &len);
+ sock = accept(listen_sock, (struct sockaddr *)&sunaddr, &len);
} while (sock == -1 && errno == EINTR);
if (sock == -1)
ZERO_STRUCTP(state);
state->sock = sock;
-
+
+ state->last_access = time(NULL);
+
+ state->privileged = privileged;
+
/* Add to connection list */
- DLIST_ADD(client_list, state);
- num_clients++;
+ winbindd_add_client(state);
}
/* Remove a client connection from client connection list */
/* Remove from list and free */
- DLIST_REMOVE(client_list, state);
+ winbindd_remove_client(state);
SAFE_FREE(state);
- num_clients--;
}
}
+/* Shutdown client connection which has been idle for the longest time */
+
+static BOOL remove_idle_client(void)
+{
+ struct winbindd_cli_state *state, *remove_state = NULL;
+ time_t last_access = 0;
+ int nidle = 0;
+
+ for (state = winbindd_client_list(); state; state = state->next) {
+ if (state->read_buf_len == 0 && state->write_buf_len == 0 &&
+ !state->getpwent_state && !state->getgrent_state) {
+ nidle++;
+ if (!last_access || state->last_access < last_access) {
+ last_access = state->last_access;
+ remove_state = state;
+ }
+ }
+ }
+
+ if (remove_state) {
+ DEBUG(5,("Found %d idle client connections, shutting down sock %d, pid %u\n",
+ nidle, remove_state->sock, (unsigned int)remove_state->pid));
+ remove_client(remove_state);
+ return True;
+ }
+
+ return False;
+}
+
/* Process a complete received packet from a client */
void winbind_process_packet(struct winbindd_cli_state *state)
/* Process request */
/* Ensure null termination of entire request */
- state->request.domain[sizeof(state->request.domain)-1]='\0';
+ state->request.null_term = '\0';
state->pid = state->request.pid;
/* Read data */
- do {
-
- n = read(state->sock, state->read_buf_len +
- (char *)&state->request,
- sizeof(state->request) - state->read_buf_len);
-
- } while (n == -1 && errno == EINTR);
+ n = sys_read(state->sock, state->read_buf_len +
+ (char *)&state->request,
+ sizeof(state->request) - state->read_buf_len);
DEBUG(10,("client_read: read %d bytes. Need %d more for a full request.\n", n, sizeof(state->request) - n - state->read_buf_len ));
/* Update client state */
state->read_buf_len += n;
+ state->last_access = time(NULL);
}
/* Write some data to a client connection */
state->write_buf_len;
}
- do {
- num_written = write(state->sock, data, state->write_buf_len);
- } while (num_written == -1 && errno == EINTR);
+ num_written = sys_write(state->sock, data, state->write_buf_len);
DEBUG(10,("client_write: wrote %d bytes.\n", num_written ));
/* Update client state */
state->write_buf_len -= num_written;
-
+ state->last_access = time(NULL);
+
/* Have we written all data? */
if (state->write_buf_len == 0) {
}
}
-/* Process incoming clients on accept_sock. We use a tricky non-blocking,
+/* Process incoming clients on listen_sock. We use a tricky non-blocking,
non-forking, non-threaded model which allows us to handle many
simultaneous connections while remaining impervious to many denial of
service attacks. */
-static void process_loop(int accept_sock)
+static void process_loop(void)
{
/* We'll be doing this a lot */
while (1) {
struct winbindd_cli_state *state;
fd_set r_fds, w_fds;
- int maxfd = accept_sock, selret;
+ int maxfd, listen_sock, listen_priv_sock, selret;
struct timeval timeout;
/* Handle messages */
message_dispatch();
+ /* rescan the trusted domains list. This must be done
+ regularly to cope with transitive trusts */
+ rescan_trusted_domains(False);
+
/* Free up temporary memory */
lp_talloc_free();
/* Initialise fd lists for select() */
+ listen_sock = open_winbindd_socket();
+ listen_priv_sock = open_winbindd_priv_socket();
+
+ if (listen_sock == -1 || listen_priv_sock == -1) {
+ perror("open_winbind_socket");
+ exit(1);
+ }
+
+ maxfd = MAX(listen_sock, listen_priv_sock);
+
FD_ZERO(&r_fds);
FD_ZERO(&w_fds);
- FD_SET(accept_sock, &r_fds);
+ FD_SET(listen_sock, &r_fds);
+ FD_SET(listen_priv_sock, &r_fds);
timeout.tv_sec = WINBINDD_ESTABLISH_LOOP;
timeout.tv_usec = 0;
/* Set up client readers and writers */
- state = client_list;
+ state = winbindd_client_list();
while (state) {
exit(1);
}
- /* Create a new connection if accept_sock readable */
+ /* Create a new connection if listen_sock readable */
if (selret > 0) {
dual_select(&w_fds);
}
- if (FD_ISSET(accept_sock, &r_fds))
- new_connection(accept_sock);
+ if (FD_ISSET(listen_sock, &r_fds)) {
+ while (winbindd_num_clients() > WINBINDD_MAX_SIMULTANEOUS_CLIENTS - 1) {
+ DEBUG(5,("winbindd: Exceeding %d client connections, removing idle connection.\n",
+ WINBINDD_MAX_SIMULTANEOUS_CLIENTS));
+ if (!remove_idle_client()) {
+ DEBUG(0,("winbindd: Exceeding %d client connections, no idle connection found\n",
+ WINBINDD_MAX_SIMULTANEOUS_CLIENTS));
+ break;
+ }
+ }
+ /* new, non-privileged connection */
+ new_connection(listen_sock, False);
+ }
+
+ if (FD_ISSET(listen_priv_sock, &r_fds)) {
+ while (winbindd_num_clients() > WINBINDD_MAX_SIMULTANEOUS_CLIENTS - 1) {
+ DEBUG(5,("winbindd: Exceeding %d client connections, removing idle connection.\n",
+ WINBINDD_MAX_SIMULTANEOUS_CLIENTS));
+ if (!remove_idle_client()) {
+ DEBUG(0,("winbindd: Exceeding %d client connections, no idle connection found\n",
+ WINBINDD_MAX_SIMULTANEOUS_CLIENTS));
+ break;
+ }
+ }
+ /* new, privileged connection */
+ new_connection(listen_priv_sock, True);
+ }
/* Process activity on client connections */
- for (state = client_list; state; state = state->next) {
+ for (state = winbindd_client_list(); state;
+ state = state->next) {
/* Data available for reading */
if (do_sighup) {
- /* Flush winbindd cache */
+ DEBUG(3, ("got SIGHUP\n"));
- flush_caches();
- reload_services_file(True);
+ msg_reload_services(MSG_SMB_CONF_UPDATED, (pid_t) 0, NULL, 0);
do_sighup = False;
}
}
}
-
-/*
- these are split out from the main winbindd for use by the background daemon
- */
-int winbind_setup_common(void)
-{
- load_interfaces();
-
- if (!secrets_init()) {
-
- DEBUG(0,("Could not initialize domain trust account secrets. Giving up\n"));
- return 1;
-
- }
-
- namecache_enable(); /* Enable netbios namecache */
-
- /* Get list of domains we look up requests for. This includes the
- domain which we are a member of as well as any trusted
- domains. */
-
- init_domain_list();
-
- ZERO_STRUCT(server_state);
-
- /* Winbind daemon initialisation */
-
- if (!winbindd_param_init())
- return 1;
-
- if (!winbindd_idmap_init())
- return 1;
-
- /* Unblock all signals we are interested in as they may have been
- blocked by the parent process. */
-
- BlockSignals(False, SIGINT);
- BlockSignals(False, SIGQUIT);
- BlockSignals(False, SIGTERM);
- BlockSignals(False, SIGUSR1);
- BlockSignals(False, SIGUSR2);
- BlockSignals(False, SIGHUP);
-
- /* Setup signal handlers */
-
- CatchSignal(SIGINT, termination_handler); /* Exit on these sigs */
- CatchSignal(SIGQUIT, termination_handler);
- CatchSignal(SIGTERM, termination_handler);
-
- CatchSignal(SIGPIPE, SIG_IGN); /* Ignore sigpipe */
-
- CatchSignal(SIGUSR2, sigusr2_handler); /* Debugging sigs */
- CatchSignal(SIGHUP, sighup_handler);
-
- return 0;
-}
-
-
/* Main function */
struct winbindd_state server_state; /* Server state information */
-
-static void usage(void)
+int main(int argc, char **argv)
{
- printf("Usage: winbindd [options]\n");
- printf("\t-i interactive mode\n");
- printf("\t-B dual daemon mode\n");
- printf("\t-n disable cacheing\n");
- printf("\t-d level set debug level\n");
- printf("\t-s configfile choose smb.conf location\n");
- printf("\t-h show this help message\n");
-}
-
- int main(int argc, char **argv)
-{
- extern BOOL AllowDebugChange;
- extern pstring global_myname;
- extern fstring global_myworkgroup;
- extern BOOL append_log;
pstring logfile;
- int accept_sock;
- BOOL interactive = False;
+ static BOOL interactive = False;
+ static BOOL Fork = True;
+ static BOOL log_stdout = False;
+ struct poptOption long_options[] = {
+ POPT_AUTOHELP
+ { "stdout", 'S', POPT_ARG_VAL, &log_stdout, True, "Log to stdout" },
+ { "foreground", 'F', POPT_ARG_VAL, &Fork, False, "Daemon in foreground mode" },
+ { "interactive", 'i', POPT_ARG_NONE, NULL, 'i', "Interactive mode" },
+ { "single-daemon", 'Y', POPT_ARG_VAL, &opt_dual_daemon, False, "Single daemon mode" },
+ { "no-caching", 'n', POPT_ARG_VAL, &opt_nocache, False, "Disable caching" },
+ POPT_COMMON_SAMBA
+ POPT_TABLEEND
+ };
+ poptContext pc;
int opt;
/* glibc (?) likes to print "User defined signal 1" and exit if a
fault_setup((void (*)(void *))fault_quit );
- /* Append to log file by default as we are a single process daemon
- program. */
-
- append_log = True;
-
- snprintf(logfile, sizeof(logfile), "%s/log.winbindd", dyn_LOGFILEBASE);
- lp_set_logfile(logfile);
-
/* Initialise for running in non-root mode */
sec_init();
+ set_remote_machine_name("winbindd", False);
+
/* Set environment variable so we don't recursively call ourselves.
This may also be useful interactively. */
- SETENV(WINBINDD_DONT_ENV, "1", 1);
+ setenv(WINBINDD_DONT_ENV, "1", 1);
/* Initialise samba/rpc client stuff */
- while ((opt = getopt(argc, argv, "id:s:nhB")) != EOF) {
- switch (opt) {
+ pc = poptGetContext("winbindd", argc, (const char **)argv, long_options,
+ POPT_CONTEXT_KEEP_FIRST);
+ while ((opt = poptGetNextOpt(pc)) != -1) {
+ switch (opt) {
/* Don't become a daemon */
case 'i':
interactive = True;
+ log_stdout = True;
+ Fork = False;
break;
+ }
+ }
- /* dual daemon system */
- case 'B':
- opt_dual_daemon = True;
- break;
-
- /* disable cacheing */
- case 'n':
- opt_nocache = True;
- break;
-
- /* Run with specified debug level */
- case 'd':
- DEBUGLEVEL = atoi(optarg);
- AllowDebugChange = False;
- break;
-
- /* Load a different smb.conf file */
- case 's':
- pstrcpy(dyn_CONFIGFILE,optarg);
- break;
-
- case 'h':
- usage();
- exit(0);
- default:
- printf("Unknown option %c\n", (char)opt);
- exit(1);
- }
+ if (log_stdout && Fork) {
+ printf("Can't log to stdout (-S) unless daemon is in foreground +(-F) or interactive (-i)\n");
+ poptPrintUsage(pc, stderr, 0);
+ exit(1);
}
snprintf(logfile, sizeof(logfile), "%s/log.winbindd", dyn_LOGFILEBASE);
lp_set_logfile(logfile);
- setup_logging("winbindd", interactive);
+ setup_logging("winbindd", log_stdout);
reopen_logs();
DEBUG(1, ("winbindd version %s started.\n", VERSION ) );
- DEBUGADD( 1, ( "Copyright The Samba Team 2000-2001\n" ) );
+ DEBUGADD( 1, ( "Copyright The Samba Team 2000-2003\n" ) );
if (!reload_services_file(False)) {
DEBUG(0, ("error opening config file\n"));
/* Setup names. */
- if (!*global_myname) {
- char *p;
+ if (!init_names())
+ exit(1);
- fstrcpy(global_myname, myhostname());
- p = strchr(global_myname, '.');
- if (p)
- *p = 0;
- }
+ load_interfaces();
- fstrcpy(global_myworkgroup, lp_workgroup());
+ if (!secrets_init()) {
- if (!interactive) {
- become_daemon();
- pidfile_create("winbindd");
+ DEBUG(0,("Could not initialize domain trust account secrets. Giving up\n"));
+ return False;
}
+ /* Enable netbios namecache */
+
+ namecache_enable();
+
+ /* Check winbindd parameters are valid */
+
+ ZERO_STRUCT(server_state);
+
+ if (!winbindd_param_init())
+ return 1;
+
+ /* Winbind daemon initialisation */
+
+ if (!winbindd_upgrade_idmap())
+ return 1;
+
+ if (!idmap_init(lp_idmap_backend()))
+ return 1;
+
+ /* Unblock all signals we are interested in as they may have been
+ blocked by the parent process. */
+
+ BlockSignals(False, SIGINT);
+ BlockSignals(False, SIGQUIT);
+ BlockSignals(False, SIGTERM);
+ BlockSignals(False, SIGUSR1);
+ BlockSignals(False, SIGUSR2);
+ BlockSignals(False, SIGHUP);
+
+ /* Setup signal handlers */
+
+ CatchSignal(SIGINT, termination_handler); /* Exit on these sigs */
+ CatchSignal(SIGQUIT, termination_handler);
+ CatchSignal(SIGTERM, termination_handler);
+
+ CatchSignal(SIGPIPE, SIG_IGN); /* Ignore sigpipe */
+
+ CatchSignal(SIGUSR2, sigusr2_handler); /* Debugging sigs */
+ CatchSignal(SIGHUP, sighup_handler);
+
+ if (!interactive)
+ become_daemon(Fork);
+
+ pidfile_create("winbindd");
#if HAVE_SETPGID
/*
do_dual_daemon();
}
- if (winbind_setup_common() != 0) {
- return 1;
- }
-
/* Initialise messaging system */
if (!message_init()) {
DEBUG(0, ("unable to initialise messaging system\n"));
exit(1);
}
-
- register_msg_pool_usage();
-
- /* Create UNIX domain socket */
- if ((accept_sock = create_sock()) == -1) {
- DEBUG(0, ("failed to create socket\n"));
- return 1;
- }
+ /* React on 'smbcontrol winbindd reload-config' in the same way
+ as to SIGHUP signal */
+ message_register(MSG_SMB_CONF_UPDATED, msg_reload_services);
+ message_register(MSG_SHUTDOWN, msg_shutdown);
+
+ poptFreeContext(pc);
+ netsamlogon_cache_init(); /* Non-critical */
+
/* Loop waiting for requests */
- process_loop(accept_sock);
+ process_loop();
+
+ trustdom_cache_shutdown();
- uni_group_cache_shutdown();
return 0;
}
git.samba.org / gd / samba-autobuild / .git / blobdiff