source3/winbindd/winbindd_dual.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind child daemons
   5
   6    Copyright (C) Andrew Tridgell 2002
   7    Copyright (C) Volker Lendecke 2004,2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 /*
  24  * We fork a child per domain to be able to act non-blocking in the main
  25  * winbind daemon. A domain controller thousands of miles away being being
  26  * slow replying with a 10.000 user list should not hold up netlogon calls
  27  * that can be handled locally.
  28  */
  29
  30 #include "includes.h"
  31 #include "winbindd.h"
  32
  33 #undef DBGC_CLASS
  34 #define DBGC_CLASS DBGC_WINBIND
  35
  36 extern bool override_logfile;
  37 extern struct winbindd_methods cache_methods;
  38
  39 /* Read some data from a client connection */
  40
  41 static void child_read_request(struct winbindd_cli_state *state)
  42 {
  43         NTSTATUS status;
  44
  45         /* Read data */
  46
  47         status = read_data(state->sock, (char *)&state->request,
  48                            sizeof(state->request));
  49
  50         if (!NT_STATUS_IS_OK(status)) {
  51                 DEBUG(3, ("child_read_request: read_data failed: %s\n",
  52                           nt_errstr(status)));
  53                 state->finished = True;
  54                 return;
  55         }
  56
  57         if (state->request.extra_len == 0) {
  58                 state->request.extra_data.data = NULL;
  59                 return;
  60         }
  61
  62         DEBUG(10, ("Need to read %d extra bytes\n", (int)state->request.extra_len));
  63
  64         state->request.extra_data.data =
  65                 SMB_MALLOC_ARRAY(char, state->request.extra_len + 1);
  66
  67         if (state->request.extra_data.data == NULL) {
  68                 DEBUG(0, ("malloc failed\n"));
  69                 state->finished = True;
  70                 return;
  71         }
  72
  73         /* Ensure null termination */
  74         state->request.extra_data.data[state->request.extra_len] = '\0';
  75
  76         status= read_data(state->sock, state->request.extra_data.data,
  77                           state->request.extra_len);
  78
  79         if (!NT_STATUS_IS_OK(status)) {
  80                 DEBUG(0, ("Could not read extra data: %s\n",
  81                           nt_errstr(status)));
  82                 state->finished = True;
  83                 return;
  84         }
  85 }
  86
  87 /*
  88  * Machinery for async requests sent to children. You set up a
  89  * winbindd_request, select a child to query, and issue a async_request
  90  * call. When the request is completed, the callback function you specified is
  91  * called back with the private pointer you gave to async_request.
  92  */
  93
  94 struct winbindd_async_request {
  95         struct winbindd_async_request *next, *prev;
  96         TALLOC_CTX *mem_ctx;
  97         struct winbindd_child *child;
  98         struct winbindd_request *request;
  99         struct winbindd_response *response;
 100         void (*continuation)(void *private_data, bool success);
 101         struct timed_event *reply_timeout_event;
 102         pid_t child_pid; /* pid of the child we're waiting on. Used to detect
 103                             a restart of the child (child->pid != child_pid). */
 104         void *private_data;
 105 };
 106
 107 static void async_request_fail(struct winbindd_async_request *state);
 108 static void async_main_request_sent(void *private_data, bool success);
 109 static void async_request_sent(void *private_data, bool success);
 110 static void async_reply_recv(void *private_data, bool success);
 111 static void schedule_async_request(struct winbindd_child *child);
 112
 113 void async_request(TALLOC_CTX *mem_ctx, struct winbindd_child *child,
 114                    struct winbindd_request *request,
 115                    struct winbindd_response *response,
 116                    void (*continuation)(void *private_data, bool success),
 117                    void *private_data)
 118 {
 119         struct winbindd_async_request *state;
 120
 121         SMB_ASSERT(continuation != NULL);
 122
 123         state = TALLOC_P(mem_ctx, struct winbindd_async_request);
 124
 125         if (state == NULL) {
 126                 DEBUG(0, ("talloc failed\n"));
 127                 continuation(private_data, False);
 128                 return;
 129         }
 130
 131         state->mem_ctx = mem_ctx;
 132         state->child = child;
 133         state->reply_timeout_event = NULL;
 134         state->request = request;
 135         state->response = response;
 136         state->continuation = continuation;
 137         state->private_data = private_data;
 138
 139         DLIST_ADD_END(child->requests, state, struct winbindd_async_request *);
 140
 141         schedule_async_request(child);
 142
 143         return;
 144 }
 145
 146 static void async_main_request_sent(void *private_data, bool success)
 147 {
 148         struct winbindd_async_request *state =
 149                 talloc_get_type_abort(private_data, struct winbindd_async_request);
 150
 151         if (!success) {
 152                 DEBUG(5, ("Could not send async request\n"));
 153                 async_request_fail(state);
 154                 return;
 155         }
 156
 157         if (state->request->extra_len == 0) {
 158                 async_request_sent(private_data, True);
 159                 return;
 160         }
 161
 162         setup_async_write(&state->child->event, state->request->extra_data.data,
 163                           state->request->extra_len,
 164                           async_request_sent, state);
 165 }
 166
 167 /****************************************************************
 168  Handler triggered if the child winbindd doesn't respond within
 169  a given timeout.
 170 ****************************************************************/
 171
 172 static void async_request_timeout_handler(struct event_context *ctx,
 173                                         struct timed_event *te,
 174                                         const struct timeval *now,
 175                                         void *private_data)
 176 {
 177         struct winbindd_async_request *state =
 178                 talloc_get_type_abort(private_data, struct winbindd_async_request);
 179
 180         DEBUG(0,("async_request_timeout_handler: child pid %u is not responding. "
 181                 "Closing connection to it.\n",
 182                 state->child_pid ));
 183
 184         /* Deal with the reply - set to error. */
 185         async_reply_recv(private_data, False);
 186 }
 187
 188 /**************************************************************
 189  Common function called on both async send and recv fail.
 190  Cleans up the child and schedules the next request.
 191 **************************************************************/
 192
 193 static void async_request_fail(struct winbindd_async_request *state)
 194 {
 195         DLIST_REMOVE(state->child->requests, state);
 196
 197         TALLOC_FREE(state->reply_timeout_event);
 198
 199         SMB_ASSERT(state->child_pid != (pid_t)0);
 200
 201         /* If not already reaped, send kill signal to child. */
 202         if (state->child->pid == state->child_pid) {
 203                 kill(state->child_pid, SIGTERM);
 204
 205                 /*
 206                  * Close the socket to the child.
 207                  */
 208                 winbind_child_died(state->child_pid);
 209         }
 210
 211         state->response->length = sizeof(struct winbindd_response);
 212         state->response->result = WINBINDD_ERROR;
 213         state->continuation(state->private_data, False);
 214 }
 215
 216 static void async_request_sent(void *private_data_data, bool success)
 217 {
 218         struct winbindd_async_request *state =
 219                 talloc_get_type_abort(private_data_data, struct winbindd_async_request);
 220
 221         if (!success) {
 222                 DEBUG(5, ("Could not send async request to child pid %u\n",
 223                         (unsigned int)state->child_pid ));
 224                 async_request_fail(state);
 225                 return;
 226         }
 227
 228         /* Request successfully sent to the child, setup the wait for reply */
 229
 230         setup_async_read(&state->child->event,
 231                          &state->response->result,
 232                          sizeof(state->response->result),
 233                          async_reply_recv, state);
 234
 235         /*
 236          * Set up a timeout of 300 seconds for the response.
 237          * If we don't get it close the child socket and
 238          * report failure.
 239          */
 240
 241         state->reply_timeout_event = event_add_timed(winbind_event_context(),
 242                                                         NULL,
 243                                                         timeval_current_ofs(300,0),
 244                                                         "async_request_timeout",
 245                                                         async_request_timeout_handler,
 246                                                         state);
 247         if (!state->reply_timeout_event) {
 248                 smb_panic("async_request_sent: failed to add timeout handler.\n");
 249         }
 250 }
 251
 252 static void async_reply_recv(void *private_data, bool success)
 253 {
 254         struct winbindd_async_request *state =
 255                 talloc_get_type_abort(private_data, struct winbindd_async_request);
 256         struct winbindd_child *child = state->child;
 257
 258         TALLOC_FREE(state->reply_timeout_event);
 259
 260         state->response->length = sizeof(struct winbindd_response);
 261
 262         if (!success) {
 263                 DEBUG(5, ("Could not receive async reply from child pid %u\n",
 264                         (unsigned int)state->child_pid ));
 265
 266                 cache_cleanup_response(state->child_pid);
 267                 async_request_fail(state);
 268                 return;
 269         }
 270
 271         SMB_ASSERT(cache_retrieve_response(state->child_pid,
 272                                            state->response));
 273
 274         cache_cleanup_response(state->child_pid);
 275
 276         DLIST_REMOVE(child->requests, state);
 277
 278         schedule_async_request(child);
 279
 280         state->continuation(state->private_data, True);
 281 }
 282
 283 static bool fork_domain_child(struct winbindd_child *child);
 284
 285 static void schedule_async_request(struct winbindd_child *child)
 286 {
 287         struct winbindd_async_request *request = child->requests;
 288
 289         if (request == NULL) {
 290                 return;
 291         }
 292
 293         if (child->event.flags != 0) {
 294                 return;         /* Busy */
 295         }
 296
 297         if ((child->pid == 0) && (!fork_domain_child(child))) {
 298                 /* Cancel all outstanding requests */
 299
 300                 while (request != NULL) {
 301                         /* request might be free'd in the continuation */
 302                         struct winbindd_async_request *next = request->next;
 303                         request->continuation(request->private_data, False);
 304                         request = next;
 305                 }
 306                 return;
 307         }
 308
 309         /* Now we know who we're sending to - remember the pid. */
 310         request->child_pid = child->pid;
 311
 312         setup_async_write(&child->event, request->request,
 313                           sizeof(*request->request),
 314                           async_main_request_sent, request);
 315
 316         return;
 317 }
 318
 319 struct domain_request_state {
 320         TALLOC_CTX *mem_ctx;
 321         struct winbindd_domain *domain;
 322         struct winbindd_request *request;
 323         struct winbindd_response *response;
 324         void (*continuation)(void *private_data_data, bool success);
 325         void *private_data_data;
 326 };
 327
 328 static void domain_init_recv(void *private_data_data, bool success);
 329
 330 void async_domain_request(TALLOC_CTX *mem_ctx,
 331                           struct winbindd_domain *domain,
 332                           struct winbindd_request *request,
 333                           struct winbindd_response *response,
 334                           void (*continuation)(void *private_data_data, bool success),
 335                           void *private_data_data)
 336 {
 337         struct domain_request_state *state;
 338
 339         if (domain->initialized) {
 340                 async_request(mem_ctx, &domain->child, request, response,
 341                               continuation, private_data_data);
 342                 return;
 343         }
 344
 345         state = TALLOC_P(mem_ctx, struct domain_request_state);
 346         if (state == NULL) {
 347                 DEBUG(0, ("talloc failed\n"));
 348                 continuation(private_data_data, False);
 349                 return;
 350         }
 351
 352         state->mem_ctx = mem_ctx;
 353         state->domain = domain;
 354         state->request = request;
 355         state->response = response;
 356         state->continuation = continuation;
 357         state->private_data_data = private_data_data;
 358
 359         init_child_connection(domain, domain_init_recv, state);
 360 }
 361
 362 static void domain_init_recv(void *private_data_data, bool success)
 363 {
 364         struct domain_request_state *state =
 365                 talloc_get_type_abort(private_data_data, struct domain_request_state);
 366
 367         if (!success) {
 368                 DEBUG(5, ("Domain init returned an error\n"));
 369                 state->continuation(state->private_data_data, False);
 370                 return;
 371         }
 372
 373         async_request(state->mem_ctx, &state->domain->child,
 374                       state->request, state->response,
 375                       state->continuation, state->private_data_data);
 376 }
 377
 378 static void recvfrom_child(void *private_data_data, bool success)
 379 {
 380         struct winbindd_cli_state *state =
 381                 talloc_get_type_abort(private_data_data, struct winbindd_cli_state);
 382         enum winbindd_result result = state->response.result;
 383
 384         /* This is an optimization: The child has written directly to the
 385          * response buffer. The request itself is still in pending state,
 386          * state that in the result code. */
 387
 388         state->response.result = WINBINDD_PENDING;
 389
 390         if ((!success) || (result != WINBINDD_OK)) {
 391                 request_error(state);
 392                 return;
 393         }
 394
 395         request_ok(state);
 396 }
 397
 398 void sendto_child(struct winbindd_cli_state *state,
 399                   struct winbindd_child *child)
 400 {
 401         async_request(state->mem_ctx, child, &state->request,
 402                       &state->response, recvfrom_child, state);
 403 }
 404
 405 void sendto_domain(struct winbindd_cli_state *state,
 406                    struct winbindd_domain *domain)
 407 {
 408         async_domain_request(state->mem_ctx, domain,
 409                              &state->request, &state->response,
 410                              recvfrom_child, state);
 411 }
 412
 413 static void child_process_request(struct winbindd_child *child,
 414                                   struct winbindd_cli_state *state)
 415 {
 416         struct winbindd_domain *domain = child->domain;
 417         const struct winbindd_child_dispatch_table *table = child->table;
 418
 419         /* Free response data - we may be interrupted and receive another
 420            command before being able to send this data off. */
 421
 422         state->response.result = WINBINDD_ERROR;
 423         state->response.length = sizeof(struct winbindd_response);
 424
 425         /* as all requests in the child are sync, we can use talloc_tos() */
 426         state->mem_ctx = talloc_tos();
 427
 428         /* Process command */
 429
 430         for (; table->name; table++) {
 431                 if (state->request.cmd == table->struct_cmd) {
 432                         DEBUG(10,("child_process_request: request fn %s\n",
 433                                   table->name));
 434                         state->response.result = table->struct_fn(domain, state);
 435                         return;
 436                 }
 437         }
 438
 439         DEBUG(1 ,("child_process_request: unknown request fn number %d\n",
 440                   (int)state->request.cmd));
 441         state->response.result = WINBINDD_ERROR;
 442 }
 443
 444 void setup_child(struct winbindd_child *child,
 445                  const struct winbindd_child_dispatch_table *table,
 446                  const char *logprefix,
 447                  const char *logname)
 448 {
 449         if (logprefix && logname) {
 450                 if (asprintf(&child->logfilename, "%s/%s-%s",
 451                              get_dyn_LOGFILEBASE(), logprefix, logname) < 0) {
 452                         smb_panic("Internal error: asprintf failed");
 453                 }
 454         } else {
 455                 smb_panic("Internal error: logprefix == NULL && "
 456                           "logname == NULL");
 457         }
 458
 459         child->domain = NULL;
 460         child->table = table;
 461 }
 462
 463 struct winbindd_child *children = NULL;
 464
 465 void winbind_child_died(pid_t pid)
 466 {
 467         struct winbindd_child *child;
 468
 469         for (child = children; child != NULL; child = child->next) {
 470                 if (child->pid == pid) {
 471                         break;
 472                 }
 473         }
 474
 475         if (child == NULL) {
 476                 DEBUG(5, ("Already reaped child %u died\n", (unsigned int)pid));
 477                 return;
 478         }
 479
 480         /* This will be re-added in fork_domain_child() */
 481
 482         DLIST_REMOVE(children, child);
 483
 484         remove_fd_event(&child->event);
 485         close(child->event.fd);
 486         child->event.fd = 0;
 487         child->event.flags = 0;
 488         child->pid = 0;
 489
 490         schedule_async_request(child);
 491 }
 492
 493 /* Ensure any negative cache entries with the netbios or realm names are removed. */
 494
 495 void winbindd_flush_negative_conn_cache(struct winbindd_domain *domain)
 496 {
 497         flush_negative_conn_cache_for_domain(domain->name);
 498         if (*domain->alt_name) {
 499                 flush_negative_conn_cache_for_domain(domain->alt_name);
 500         }
 501 }
 502
 503 /*
 504  * Parent winbindd process sets its own debug level first and then
 505  * sends a message to all the winbindd children to adjust their debug
 506  * level to that of parents.
 507  */
 508
 509 void winbind_msg_debug(struct messaging_context *msg_ctx,
 510                          void *private_data,
 511                          uint32_t msg_type,
 512                          struct server_id server_id,
 513                          DATA_BLOB *data)
 514 {
 515         struct winbindd_child *child;
 516
 517         DEBUG(10,("winbind_msg_debug: got debug message.\n"));
 518
 519         debug_message(msg_ctx, private_data, MSG_DEBUG, server_id, data);
 520
 521         for (child = children; child != NULL; child = child->next) {
 522
 523                 DEBUG(10,("winbind_msg_debug: sending message to pid %u.\n",
 524                         (unsigned int)child->pid));
 525
 526                 messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
 527                            MSG_DEBUG,
 528                            data->data,
 529                            strlen((char *) data->data) + 1);
 530         }
 531 }
 532
 533 /* Set our domains as offline and forward the offline message to our children. */
 534
 535 void winbind_msg_offline(struct messaging_context *msg_ctx,
 536                          void *private_data,
 537                          uint32_t msg_type,
 538                          struct server_id server_id,
 539                          DATA_BLOB *data)
 540 {
 541         struct winbindd_child *child;
 542         struct winbindd_domain *domain;
 543
 544         DEBUG(10,("winbind_msg_offline: got offline message.\n"));
 545
 546         if (!lp_winbind_offline_logon()) {
 547                 DEBUG(10,("winbind_msg_offline: rejecting offline message.\n"));
 548                 return;
 549         }
 550
 551         /* Set our global state as offline. */
 552         if (!set_global_winbindd_state_offline()) {
 553                 DEBUG(10,("winbind_msg_offline: offline request failed.\n"));
 554                 return;
 555         }
 556
 557         /* Set all our domains as offline. */
 558         for (domain = domain_list(); domain; domain = domain->next) {
 559                 if (domain->internal) {
 560                         continue;
 561                 }
 562                 DEBUG(5,("winbind_msg_offline: marking %s offline.\n", domain->name));
 563                 set_domain_offline(domain);
 564         }
 565
 566         for (child = children; child != NULL; child = child->next) {
 567                 /* Don't send message to internal childs.  We've already
 568                    done so above. */
 569                 if (!child->domain || winbindd_internal_child(child)) {
 570                         continue;
 571                 }
 572
 573                 /* Or internal domains (this should not be possible....) */
 574                 if (child->domain->internal) {
 575                         continue;
 576                 }
 577
 578                 /* Each winbindd child should only process requests for one domain - make sure
 579                    we only set it online / offline for that domain. */
 580
 581                 DEBUG(10,("winbind_msg_offline: sending message to pid %u for domain %s.\n",
 582                         (unsigned int)child->pid, domain->name ));
 583
 584                 messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
 585                                    MSG_WINBIND_OFFLINE,
 586                                    (uint8 *)child->domain->name,
 587                                    strlen(child->domain->name)+1);
 588         }
 589 }
 590
 591 /* Set our domains as online and forward the online message to our children. */
 592
 593 void winbind_msg_online(struct messaging_context *msg_ctx,
 594                         void *private_data,
 595                         uint32_t msg_type,
 596                         struct server_id server_id,
 597                         DATA_BLOB *data)
 598 {
 599         struct winbindd_child *child;
 600         struct winbindd_domain *domain;
 601
 602         DEBUG(10,("winbind_msg_online: got online message.\n"));
 603
 604         if (!lp_winbind_offline_logon()) {
 605                 DEBUG(10,("winbind_msg_online: rejecting online message.\n"));
 606                 return;
 607         }
 608
 609         /* Set our global state as online. */
 610         set_global_winbindd_state_online();
 611
 612         smb_nscd_flush_user_cache();
 613         smb_nscd_flush_group_cache();
 614
 615         /* Set all our domains as online. */
 616         for (domain = domain_list(); domain; domain = domain->next) {
 617                 if (domain->internal) {
 618                         continue;
 619                 }
 620                 DEBUG(5,("winbind_msg_online: requesting %s to go online.\n", domain->name));
 621
 622                 winbindd_flush_negative_conn_cache(domain);
 623                 set_domain_online_request(domain);
 624
 625                 /* Send an online message to the idmap child when our
 626                    primary domain comes back online */
 627
 628                 if ( domain->primary ) {
 629                         struct winbindd_child *idmap = idmap_child();
 630
 631                         if ( idmap->pid != 0 ) {
 632                                 messaging_send_buf(msg_ctx,
 633                                                    pid_to_procid(idmap->pid),
 634                                                    MSG_WINBIND_ONLINE,
 635                                                    (uint8 *)domain->name,
 636                                                    strlen(domain->name)+1);
 637                         }
 638
 639                 }
 640         }
 641
 642         for (child = children; child != NULL; child = child->next) {
 643                 /* Don't send message to internal childs. */
 644                 if (!child->domain || winbindd_internal_child(child)) {
 645                         continue;
 646                 }
 647
 648                 /* Or internal domains (this should not be possible....) */
 649                 if (child->domain->internal) {
 650                         continue;
 651                 }
 652
 653                 /* Each winbindd child should only process requests for one domain - make sure
 654                    we only set it online / offline for that domain. */
 655
 656                 DEBUG(10,("winbind_msg_online: sending message to pid %u for domain %s.\n",
 657                         (unsigned int)child->pid, child->domain->name ));
 658
 659                 messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
 660                                    MSG_WINBIND_ONLINE,
 661                                    (uint8 *)child->domain->name,
 662                                    strlen(child->domain->name)+1);
 663         }
 664 }
 665
 666 /* Forward the online/offline messages to our children. */
 667 void winbind_msg_onlinestatus(struct messaging_context *msg_ctx,
 668                               void *private_data,
 669                               uint32_t msg_type,
 670                               struct server_id server_id,
 671                               DATA_BLOB *data)
 672 {
 673         struct winbindd_child *child;
 674
 675         DEBUG(10,("winbind_msg_onlinestatus: got onlinestatus message.\n"));
 676
 677         for (child = children; child != NULL; child = child->next) {
 678                 if (child->domain && child->domain->primary) {
 679                         DEBUG(10,("winbind_msg_onlinestatus: "
 680                                   "sending message to pid %u of primary domain.\n",
 681                                   (unsigned int)child->pid));
 682                         messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
 683                                            MSG_WINBIND_ONLINESTATUS,
 684                                            (uint8 *)data->data,
 685                                            data->length);
 686                         break;
 687                 }
 688         }
 689 }
 690
 691 void winbind_msg_dump_event_list(struct messaging_context *msg_ctx,
 692                                  void *private_data,
 693                                  uint32_t msg_type,
 694                                  struct server_id server_id,
 695                                  DATA_BLOB *data)
 696 {
 697         struct winbindd_child *child;
 698
 699         DEBUG(10,("winbind_msg_dump_event_list received\n"));
 700
 701         dump_event_list(winbind_event_context());
 702
 703         for (child = children; child != NULL; child = child->next) {
 704
 705                 DEBUG(10,("winbind_msg_dump_event_list: sending message to pid %u\n",
 706                         (unsigned int)child->pid));
 707
 708                 messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
 709                                    MSG_DUMP_EVENT_LIST,
 710                                    NULL, 0);
 711         }
 712
 713 }
 714
 715 void winbind_msg_dump_domain_list(struct messaging_context *msg_ctx,
 716                                   void *private_data,
 717                                   uint32_t msg_type,
 718                                   struct server_id server_id,
 719                                   DATA_BLOB *data)
 720 {
 721         TALLOC_CTX *mem_ctx;
 722         const char *message = NULL;
 723         struct server_id *sender = NULL;
 724         const char *domain = NULL;
 725         char *s = NULL;
 726         NTSTATUS status;
 727         struct winbindd_domain *dom = NULL;
 728
 729         DEBUG(5,("winbind_msg_dump_domain_list received.\n"));
 730
 731         if (!data || !data->data) {
 732                 return;
 733         }
 734
 735         if (data->length < sizeof(struct server_id)) {
 736                 return;
 737         }
 738
 739         mem_ctx = talloc_init("winbind_msg_dump_domain_list");
 740         if (!mem_ctx) {
 741                 return;
 742         }
 743
 744         sender = (struct server_id *)data->data;
 745         if (data->length > sizeof(struct server_id)) {
 746                 domain = (const char *)data->data+sizeof(struct server_id);
 747         }
 748
 749         if (domain) {
 750
 751                 DEBUG(5,("winbind_msg_dump_domain_list for domain: %s\n",
 752                         domain));
 753
 754                 message = NDR_PRINT_STRUCT_STRING(mem_ctx, winbindd_domain,
 755                                                   find_domain_from_name_noinit(domain));
 756                 if (!message) {
 757                         talloc_destroy(mem_ctx);
 758                         return;
 759                 }
 760
 761                 messaging_send_buf(msg_ctx, *sender,
 762                                    MSG_WINBIND_DUMP_DOMAIN_LIST,
 763                                    (uint8_t *)message, strlen(message) + 1);
 764
 765                 talloc_destroy(mem_ctx);
 766
 767                 return;
 768         }
 769
 770         DEBUG(5,("winbind_msg_dump_domain_list all domains\n"));
 771
 772         for (dom = domain_list(); dom; dom=dom->next) {
 773                 message = NDR_PRINT_STRUCT_STRING(mem_ctx, winbindd_domain, dom);
 774                 if (!message) {
 775                         talloc_destroy(mem_ctx);
 776                         return;
 777                 }
 778
 779                 s = talloc_asprintf_append(s, "%s\n", message);
 780                 if (!s) {
 781                         talloc_destroy(mem_ctx);
 782                         return;
 783                 }
 784         }
 785
 786         status = messaging_send_buf(msg_ctx, *sender,
 787                                     MSG_WINBIND_DUMP_DOMAIN_LIST,
 788                                     (uint8_t *)s, strlen(s) + 1);
 789         if (!NT_STATUS_IS_OK(status)) {
 790                 DEBUG(0,("failed to send message: %s\n",
 791                 nt_errstr(status)));
 792         }
 793
 794         talloc_destroy(mem_ctx);
 795 }
 796
 797 static void account_lockout_policy_handler(struct event_context *ctx,
 798                                            struct timed_event *te,
 799                                            const struct timeval *now,
 800                                            void *private_data)
 801 {
 802         struct winbindd_child *child =
 803                 (struct winbindd_child *)private_data;
 804         TALLOC_CTX *mem_ctx = NULL;
 805         struct winbindd_methods *methods;
 806         struct samr_DomInfo12 lockout_policy;
 807         NTSTATUS result;
 808
 809         DEBUG(10,("account_lockout_policy_handler called\n"));
 810
 811         TALLOC_FREE(child->lockout_policy_event);
 812
 813         if ( !winbindd_can_contact_domain( child->domain ) ) {
 814                 DEBUG(10,("account_lockout_policy_handler: Removing myself since I "
 815                           "do not have an incoming trust to domain %s\n",
 816                           child->domain->name));
 817
 818                 return;
 819         }
 820
 821         methods = child->domain->methods;
 822
 823         mem_ctx = talloc_init("account_lockout_policy_handler ctx");
 824         if (!mem_ctx) {
 825                 result = NT_STATUS_NO_MEMORY;
 826         } else {
 827                 result = methods->lockout_policy(child->domain, mem_ctx, &lockout_policy);
 828         }
 829         TALLOC_FREE(mem_ctx);
 830
 831         if (!NT_STATUS_IS_OK(result)) {
 832                 DEBUG(10,("account_lockout_policy_handler: lockout_policy failed error %s\n",
 833                          nt_errstr(result)));
 834         }
 835
 836         child->lockout_policy_event = event_add_timed(winbind_event_context(), NULL,
 837                                                       timeval_current_ofs(3600, 0),
 838                                                       "account_lockout_policy_handler",
 839                                                       account_lockout_policy_handler,
 840                                                       child);
 841 }
 842
 843 static time_t get_machine_password_timeout(void)
 844 {
 845         /* until we have gpo support use lp setting */
 846         return lp_machine_password_timeout();
 847 }
 848
 849 static bool calculate_next_machine_pwd_change(const char *domain,
 850                                               struct timeval *t)
 851 {
 852         time_t pass_last_set_time;
 853         time_t timeout;
 854         time_t next_change;
 855         char *pw;
 856
 857         pw = secrets_fetch_machine_password(domain,
 858                                             &pass_last_set_time,
 859                                             NULL);
 860
 861         if (pw == NULL) {
 862                 DEBUG(0,("cannot fetch own machine password ????"));
 863                 return false;
 864         }
 865
 866         SAFE_FREE(pw);
 867
 868         timeout = get_machine_password_timeout();
 869         if (timeout == 0) {
 870                 DEBUG(10,("machine password never expires\n"));
 871                 return false;
 872         }
 873
 874         if (time(NULL) < (pass_last_set_time + timeout)) {
 875                 next_change = pass_last_set_time + timeout;
 876                 DEBUG(10,("machine password still valid until: %s\n",
 877                         http_timestring(next_change)));
 878                 *t = timeval_set(next_change, 0);
 879                 return true;
 880         }
 881
 882         DEBUG(10,("machine password expired, needs immediate change\n"));
 883
 884         *t = timeval_zero();
 885
 886         return true;
 887 }
 888
 889 static void machine_password_change_handler(struct event_context *ctx,
 890                                             struct timed_event *te,
 891                                             const struct timeval *now,
 892                                             void *private_data)
 893 {
 894         struct winbindd_child *child =
 895                 (struct winbindd_child *)private_data;
 896         struct rpc_pipe_client *netlogon_pipe = NULL;
 897         TALLOC_CTX *frame;
 898         NTSTATUS result;
 899         struct timeval next_change;
 900
 901         DEBUG(10,("machine_password_change_handler called\n"));
 902
 903         TALLOC_FREE(child->machine_password_change_event);
 904
 905         if (!calculate_next_machine_pwd_change(child->domain->name,
 906                                                &next_change)) {
 907                 return;
 908         }
 909
 910         if (!winbindd_can_contact_domain(child->domain)) {
 911                 DEBUG(10,("machine_password_change_handler: Removing myself since I "
 912                           "do not have an incoming trust to domain %s\n",
 913                           child->domain->name));
 914                 return;
 915         }
 916
 917         result = cm_connect_netlogon(child->domain, &netlogon_pipe);
 918         if (!NT_STATUS_IS_OK(result)) {
 919                 DEBUG(10,("machine_password_change_handler: "
 920                         "failed to connect netlogon pipe: %s\n",
 921                          nt_errstr(result)));
 922                 return;
 923         }
 924
 925         frame = talloc_stackframe();
 926
 927         result = trust_pw_find_change_and_store_it(netlogon_pipe,
 928                                                    frame,
 929                                                    child->domain->name);
 930         TALLOC_FREE(frame);
 931
 932         if (!NT_STATUS_IS_OK(result)) {
 933                 DEBUG(10,("machine_password_change_handler: "
 934                         "failed to change machine password: %s\n",
 935                          nt_errstr(result)));
 936         } else {
 937                 DEBUG(10,("machine_password_change_handler: "
 938                         "successfully changed machine password\n"));
 939         }
 940
 941         child->machine_password_change_event = event_add_timed(winbind_event_context(), NULL,
 942                                                               next_change,
 943                                                               "machine_password_change_handler",
 944                                                               machine_password_change_handler,
 945                                                               child);
 946 }
 947
 948 /* Deal with a request to go offline. */
 949
 950 static void child_msg_offline(struct messaging_context *msg,
 951                               void *private_data,
 952                               uint32_t msg_type,
 953                               struct server_id server_id,
 954                               DATA_BLOB *data)
 955 {
 956         struct winbindd_domain *domain;
 957         const char *domainname = (const char *)data->data;
 958
 959         if (data->data == NULL || data->length == 0) {
 960                 return;
 961         }
 962
 963         DEBUG(5,("child_msg_offline received for domain %s.\n", domainname));
 964
 965         if (!lp_winbind_offline_logon()) {
 966                 DEBUG(10,("child_msg_offline: rejecting offline message.\n"));
 967                 return;
 968         }
 969
 970         /* Mark the requested domain offline. */
 971
 972         for (domain = domain_list(); domain; domain = domain->next) {
 973                 if (domain->internal) {
 974                         continue;
 975                 }
 976                 if (strequal(domain->name, domainname)) {
 977                         DEBUG(5,("child_msg_offline: marking %s offline.\n", domain->name));
 978                         set_domain_offline(domain);
 979                 }
 980         }
 981 }
 982
 983 /* Deal with a request to go online. */
 984
 985 static void child_msg_online(struct messaging_context *msg,
 986                              void *private_data,
 987                              uint32_t msg_type,
 988                              struct server_id server_id,
 989                              DATA_BLOB *data)
 990 {
 991         struct winbindd_domain *domain;
 992         const char *domainname = (const char *)data->data;
 993
 994         if (data->data == NULL || data->length == 0) {
 995                 return;
 996         }
 997
 998         DEBUG(5,("child_msg_online received for domain %s.\n", domainname));
 999
1000         if (!lp_winbind_offline_logon()) {
1001                 DEBUG(10,("child_msg_online: rejecting online message.\n"));
1002                 return;
1003         }
1004
1005         /* Set our global state as online. */
1006         set_global_winbindd_state_online();
1007
1008         /* Try and mark everything online - delete any negative cache entries
1009            to force a reconnect now. */
1010
1011         for (domain = domain_list(); domain; domain = domain->next) {
1012                 if (domain->internal) {
1013                         continue;
1014                 }
1015                 if (strequal(domain->name, domainname)) {
1016                         DEBUG(5,("child_msg_online: requesting %s to go online.\n", domain->name));
1017                         winbindd_flush_negative_conn_cache(domain);
1018                         set_domain_online_request(domain);
1019                 }
1020         }
1021 }
1022
1023 static const char *collect_onlinestatus(TALLOC_CTX *mem_ctx)
1024 {
1025         struct winbindd_domain *domain;
1026         char *buf = NULL;
1027
1028         if ((buf = talloc_asprintf(mem_ctx, "global:%s ",
1029                                    get_global_winbindd_state_offline() ?
1030                                    "Offline":"Online")) == NULL) {
1031                 return NULL;
1032         }
1033
1034         for (domain = domain_list(); domain; domain = domain->next) {
1035                 if ((buf = talloc_asprintf_append_buffer(buf, "%s:%s ",
1036                                                   domain->name,
1037                                                   domain->online ?
1038                                                   "Online":"Offline")) == NULL) {
1039                         return NULL;
1040                 }
1041         }
1042
1043         buf = talloc_asprintf_append_buffer(buf, "\n");
1044
1045         DEBUG(5,("collect_onlinestatus: %s", buf));
1046
1047         return buf;
1048 }
1049
1050 static void child_msg_onlinestatus(struct messaging_context *msg_ctx,
1051                                    void *private_data,
1052                                    uint32_t msg_type,
1053                                    struct server_id server_id,
1054                                    DATA_BLOB *data)
1055 {
1056         TALLOC_CTX *mem_ctx;
1057         const char *message;
1058         struct server_id *sender;
1059
1060         DEBUG(5,("winbind_msg_onlinestatus received.\n"));
1061
1062         if (!data->data) {
1063                 return;
1064         }
1065
1066         sender = (struct server_id *)data->data;
1067
1068         mem_ctx = talloc_init("winbind_msg_onlinestatus");
1069         if (mem_ctx == NULL) {
1070                 return;
1071         }
1072
1073         message = collect_onlinestatus(mem_ctx);
1074         if (message == NULL) {
1075                 talloc_destroy(mem_ctx);
1076                 return;
1077         }
1078
1079         messaging_send_buf(msg_ctx, *sender, MSG_WINBIND_ONLINESTATUS,
1080                            (uint8 *)message, strlen(message) + 1);
1081
1082         talloc_destroy(mem_ctx);
1083 }
1084
1085 static void child_msg_dump_event_list(struct messaging_context *msg,
1086                                       void *private_data,
1087                                       uint32_t msg_type,
1088                                       struct server_id server_id,
1089                                       DATA_BLOB *data)
1090 {
1091         DEBUG(5,("child_msg_dump_event_list received\n"));
1092
1093         dump_event_list(winbind_event_context());
1094 }
1095
1096
1097 static bool fork_domain_child(struct winbindd_child *child)
1098 {
1099         int fdpair[2];
1100         struct winbindd_cli_state state;
1101         struct winbindd_domain *domain;
1102         struct winbindd_domain *primary_domain = NULL;
1103
1104         if (child->domain) {
1105                 DEBUG(10, ("fork_domain_child called for domain '%s'\n",
1106                            child->domain->name));
1107         } else {
1108                 DEBUG(10, ("fork_domain_child called without domain.\n"));
1109         }
1110
1111         if (socketpair(AF_UNIX, SOCK_STREAM, 0, fdpair) != 0) {
1112                 DEBUG(0, ("Could not open child pipe: %s\n",
1113                           strerror(errno)));
1114                 return False;
1115         }
1116
1117         ZERO_STRUCT(state);
1118         state.pid = sys_getpid();
1119
1120         child->pid = sys_fork();
1121
1122         if (child->pid == -1) {
1123                 DEBUG(0, ("Could not fork: %s\n", strerror(errno)));
1124                 return False;
1125         }
1126
1127         if (child->pid != 0) {
1128                 /* Parent */
1129                 close(fdpair[0]);
1130                 child->next = child->prev = NULL;
1131                 DLIST_ADD(children, child);
1132                 child->event.fd = fdpair[1];
1133                 child->event.flags = 0;
1134                 child->requests = NULL;
1135                 add_fd_event(&child->event);
1136                 return True;
1137         }
1138
1139         /* Child */
1140
1141         DEBUG(10, ("Child process %d\n", (int)sys_getpid()));
1142
1143         /* Stop zombies in children */
1144         CatchChild();
1145
1146         state.sock = fdpair[0];
1147         close(fdpair[1]);
1148
1149         if (!reinit_after_fork(winbind_messaging_context(), true)) {
1150                 DEBUG(0,("reinit_after_fork() failed\n"));
1151                 _exit(0);
1152         }
1153
1154         close_conns_after_fork();
1155
1156         if (!override_logfile) {
1157                 lp_set_logfile(child->logfilename);
1158                 reopen_logs();
1159         }
1160
1161         /*
1162          * For clustering, we need to re-init our ctdbd connection after the
1163          * fork
1164          */
1165         if (!NT_STATUS_IS_OK(messaging_reinit(winbind_messaging_context())))
1166                 exit(1);
1167
1168         /* Don't handle the same messages as our parent. */
1169         messaging_deregister(winbind_messaging_context(),
1170                              MSG_SMB_CONF_UPDATED, NULL);
1171         messaging_deregister(winbind_messaging_context(),
1172                              MSG_SHUTDOWN, NULL);
1173         messaging_deregister(winbind_messaging_context(),
1174                              MSG_WINBIND_OFFLINE, NULL);
1175         messaging_deregister(winbind_messaging_context(),
1176                              MSG_WINBIND_ONLINE, NULL);
1177         messaging_deregister(winbind_messaging_context(),
1178                              MSG_WINBIND_ONLINESTATUS, NULL);
1179         messaging_deregister(winbind_messaging_context(),
1180                              MSG_DUMP_EVENT_LIST, NULL);
1181         messaging_deregister(winbind_messaging_context(),
1182                              MSG_WINBIND_DUMP_DOMAIN_LIST, NULL);
1183         messaging_deregister(winbind_messaging_context(),
1184                              MSG_DEBUG, NULL);
1185
1186         /* Handle online/offline messages. */
1187         messaging_register(winbind_messaging_context(), NULL,
1188                            MSG_WINBIND_OFFLINE, child_msg_offline);
1189         messaging_register(winbind_messaging_context(), NULL,
1190                            MSG_WINBIND_ONLINE, child_msg_online);
1191         messaging_register(winbind_messaging_context(), NULL,
1192                            MSG_WINBIND_ONLINESTATUS, child_msg_onlinestatus);
1193         messaging_register(winbind_messaging_context(), NULL,
1194                            MSG_DUMP_EVENT_LIST, child_msg_dump_event_list);
1195         messaging_register(winbind_messaging_context(), NULL,
1196                            MSG_DEBUG, debug_message);
1197
1198         if ( child->domain ) {
1199                 child->domain->startup = True;
1200                 child->domain->startup_time = time(NULL);
1201         }
1202
1203         /* Ensure we have no pending check_online events other
1204            than one for this domain or the primary domain. */
1205
1206         for (domain = domain_list(); domain; domain = domain->next) {
1207                 if (domain->primary) {
1208                         primary_domain = domain;
1209                 }
1210                 if ((domain != child->domain) && !domain->primary) {
1211                         TALLOC_FREE(domain->check_online_event);
1212                 }
1213         }
1214
1215         /* Ensure we're not handling an event inherited from
1216            our parent. */
1217
1218         cancel_named_event(winbind_event_context(),
1219                            "krb5_ticket_refresh_handler");
1220
1221         /* We might be in the idmap child...*/
1222         if (child->domain && !(child->domain->internal) &&
1223             lp_winbind_offline_logon()) {
1224
1225                 set_domain_online_request(child->domain);
1226
1227                 if (primary_domain != child->domain) {
1228                         /* We need to talk to the primary
1229                          * domain as well as the trusted
1230                          * domain inside a trusted domain
1231                          * child.
1232                          * See the code in :
1233                          * set_dc_type_and_flags_trustinfo()
1234                          * for details.
1235                          */
1236                         set_domain_online_request(primary_domain);
1237                 }
1238
1239                 child->lockout_policy_event = event_add_timed(
1240                         winbind_event_context(), NULL, timeval_zero(),
1241                         "account_lockout_policy_handler",
1242                         account_lockout_policy_handler,
1243                         child);
1244         }
1245
1246         if (child->domain && child->domain->primary &&
1247             lp_server_role() == ROLE_DOMAIN_MEMBER) {
1248
1249                 struct timeval next_change;
1250
1251                 if (calculate_next_machine_pwd_change(child->domain->name,
1252                                                        &next_change)) {
1253                         child->machine_password_change_event = event_add_timed(
1254                                 winbind_event_context(), NULL, next_change,
1255                                 "machine_password_change_handler",
1256                                 machine_password_change_handler,
1257                                 child);
1258                 }
1259         }
1260
1261         while (1) {
1262
1263                 int ret;
1264                 fd_set read_fds;
1265                 struct timeval t;
1266                 struct timeval *tp;
1267                 struct timeval now;
1268                 TALLOC_CTX *frame = talloc_stackframe();
1269
1270                 /* check for signals */
1271                 winbind_check_sigterm(false);
1272                 winbind_check_sighup(override_logfile ? NULL :
1273                                 child->logfilename);
1274
1275                 run_events(winbind_event_context(), 0, NULL, NULL);
1276
1277                 GetTimeOfDay(&now);
1278
1279                 if (child->domain && child->domain->startup &&
1280                                 (now.tv_sec > child->domain->startup_time + 30)) {
1281                         /* No longer in "startup" mode. */
1282                         DEBUG(10,("fork_domain_child: domain %s no longer in 'startup' mode.\n",
1283                                 child->domain->name ));
1284                         child->domain->startup = False;
1285                 }
1286
1287                 tp = get_timed_events_timeout(winbind_event_context(), &t);
1288                 if (tp) {
1289                         DEBUG(11,("select will use timeout of %u.%u seconds\n",
1290                                 (unsigned int)tp->tv_sec, (unsigned int)tp->tv_usec ));
1291                 }
1292
1293                 /* Handle messages */
1294
1295                 message_dispatch(winbind_messaging_context());
1296
1297                 FD_ZERO(&read_fds);
1298                 FD_SET(state.sock, &read_fds);
1299
1300                 ret = sys_select(state.sock + 1, &read_fds, NULL, NULL, tp);
1301
1302                 if (ret == 0) {
1303                         DEBUG(11,("nothing is ready yet, continue\n"));
1304                         TALLOC_FREE(frame);
1305                         continue;
1306                 }
1307
1308                 if (ret == -1 && errno == EINTR) {
1309                         /* We got a signal - continue. */
1310                         TALLOC_FREE(frame);
1311                         continue;
1312                 }
1313
1314                 if (ret == -1 && errno != EINTR) {
1315                         DEBUG(0,("select error occured\n"));
1316                         TALLOC_FREE(frame);
1317                         perror("select");
1318                         return False;
1319                 }
1320
1321                 /* fetch a request from the main daemon */
1322                 child_read_request(&state);
1323
1324                 if (state.finished) {
1325                         /* we lost contact with our parent */
1326                         exit(0);
1327                 }
1328
1329                 DEBUG(4,("child daemon request %d\n", (int)state.request.cmd));
1330
1331                 ZERO_STRUCT(state.response);
1332                 state.request.null_term = '\0';
1333                 child_process_request(child, &state);
1334
1335                 SAFE_FREE(state.request.extra_data.data);
1336
1337                 cache_store_response(sys_getpid(), &state.response);
1338
1339                 SAFE_FREE(state.response.extra_data.data);
1340
1341                 /* We just send the result code back, the result
1342                  * structure needs to be fetched via the
1343                  * winbindd_cache. Hmm. That needs fixing... */
1344
1345                 if (write_data(state.sock,
1346                                (const char *)&state.response.result,
1347                                sizeof(state.response.result)) !=
1348                     sizeof(state.response.result)) {
1349                         DEBUG(0, ("Could not write result\n"));
1350                         exit(1);
1351                 }
1352                 TALLOC_FREE(frame);
1353         }
1354 }