async_req: check for errors when monitoring socket for readability
[kai/samba-autobuild/.git] / source3 / winbindd / winbindd.c
index 677f7661828c3ffbc1c247566b2eb6b08c68a5ee..07faadf7be1f822074504e53882e59a15c64149d 100644 (file)
@@ -1,4 +1,4 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
    Winbind daemon for ntdom nss module
 #include "../librpc/gen_ndr/srv_lsa.h"
 #include "../librpc/gen_ndr/srv_samr.h"
 #include "secrets.h"
+#include "rpc_client/cli_netlogon.h"
 #include "idmap.h"
 #include "lib/addrchange.h"
 #include "serverid.h"
 #include "auth.h"
 #include "messages.h"
+#include "../lib/util/pidfile.h"
+#include "util_cluster.h"
+#include "source4/lib/messaging/irpc.h"
+#include "source4/lib/messaging/messaging.h"
+#include "lib/param/param.h"
+#include "lib/async_req/async_sock.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
 static bool client_is_idle(struct winbindd_cli_state *state);
 static void remove_client(struct winbindd_cli_state *state);
+static void winbindd_setup_max_fds(void);
 
 static bool opt_nocache = False;
 static bool interactive = False;
 
 extern bool override_logfile;
 
+struct tevent_context *winbind_event_context(void)
+{
+       static struct tevent_context *ev = NULL;
+
+       if (ev != NULL) {
+               return ev;
+       }
+
+       /*
+        * Note we MUST use the NULL context here, not the autofree context,
+        * to avoid side effects in forked children exiting.
+        */
+       ev = samba_tevent_context_init(NULL);
+       if (ev == NULL) {
+               smb_panic("Could not init winbindd's messaging context.\n");
+       }
+       return ev;
+}
+
 struct messaging_context *winbind_messaging_context(void)
 {
-       struct messaging_context *msg_ctx = server_messaging_context();
-       if (likely(msg_ctx != NULL)) {
-               return msg_ctx;
+       static struct messaging_context *msg = NULL;
+
+       if (msg != NULL) {
+               return msg;
+       }
+
+       /*
+        * Note we MUST use the NULL context here, not the autofree context,
+        * to avoid side effects in forked children exiting.
+        */
+       msg = messaging_init(NULL, winbind_event_context());
+       if (msg == NULL) {
+               smb_panic("Could not init winbindd's messaging context.\n");
        }
-       smb_panic("Could not init winbindd's messaging context.\n");
-       return NULL;
+       return msg;
+}
+
+struct imessaging_context *winbind_imessaging_context(void)
+{
+       static struct imessaging_context *msg = NULL;
+       struct loadparm_context *lp_ctx;
+
+       if (msg != NULL) {
+               return msg;
+       }
+
+       lp_ctx = loadparm_init_s3(NULL, loadparm_s3_helpers());
+       if (lp_ctx == NULL) {
+               smb_panic("Could not load smb.conf to init winbindd's imessaging context.\n");
+       }
+
+       /*
+        * Note we MUST use the NULL context here, not the autofree context,
+        * to avoid side effects in forked children exiting.
+        */
+       msg = imessaging_init(NULL, lp_ctx, procid_self(), winbind_event_context(), false);
+       talloc_unlink(NULL, lp_ctx);
+
+       if (msg == NULL) {
+               smb_panic("Could not init winbindd's messaging context.\n");
+       }
+       return msg;
 }
 
 /* Reload configuration */
@@ -65,11 +128,12 @@ static bool reload_services_file(const char *lfile)
        bool ret;
 
        if (lp_loaded()) {
-               const char *fname = lp_configfile();
+               char *fname = lp_next_configfile(talloc_tos());
 
                if (file_exist(fname) && !strcsequal(fname,get_dyn_CONFIGFILE())) {
                        set_dyn_CONFIGFILE(fname);
                }
+               TALLOC_FREE(fname);
        }
 
        /* if this is a child, restore the logfile to the special
@@ -79,10 +143,11 @@ static bool reload_services_file(const char *lfile)
        }
 
        reopen_logs();
-       ret = lp_load(get_dyn_CONFIGFILE(),False,False,True,True);
+       ret = lp_load_global(get_dyn_CONFIGFILE());
 
        reopen_logs();
        load_interfaces();
+       winbindd_setup_max_fds();
 
        return(ret);
 }
@@ -159,7 +224,7 @@ static void terminate(bool is_parent)
                char *path = NULL;
 
                if (asprintf(&path, "%s/%s",
-                       get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME) > 0) {
+                       lp_winbindd_socket_directory(), WINBINDD_SOCKET_NAME) > 0) {
                        unlink(path);
                        SAFE_FREE(path);
                }
@@ -182,8 +247,10 @@ static void terminate(bool is_parent)
 #endif
 
        if (is_parent) {
-               serverid_deregister(procid_self());
-               pidfile_unlink();
+               struct messaging_context *msg = winbind_messaging_context();
+               struct server_id self = messaging_server_id(msg);
+               serverid_deregister(self);
+               pidfile_unlink(lp_pid_directory(), "winbindd");
        }
 
        exit(0);
@@ -203,6 +270,26 @@ static void winbindd_sig_term_handler(struct tevent_context *ev,
        terminate(*is_parent);
 }
 
+/*
+  handle stdin becoming readable when we are in --foreground mode
+ */
+static void winbindd_stdin_handler(struct tevent_context *ev,
+                              struct tevent_fd *fde,
+                              uint16_t flags,
+                              void *private_data)
+{
+       char c;
+       if (read(0, &c, 1) != 1) {
+               bool *is_parent = talloc_get_type_abort(private_data, bool);
+
+               /* we have reached EOF on stdin, which means the
+                  parent has exited. Shutdown the server */
+               DEBUG(0,("EOF on stdin (is_parent=%d)\n",
+                        (int)*is_parent));
+               terminate(*is_parent);
+       }
+}
+
 bool winbindd_setup_sig_term_handler(bool parent)
 {
        struct tevent_signal *se;
@@ -251,6 +338,41 @@ bool winbindd_setup_sig_term_handler(bool parent)
        return true;
 }
 
+bool winbindd_setup_stdin_handler(bool parent, bool foreground)
+{
+       bool *is_parent;
+
+       if (foreground) {
+               struct stat st;
+
+               is_parent = talloc(winbind_event_context(), bool);
+               if (!is_parent) {
+                       return false;
+               }
+
+               *is_parent = parent;
+
+               /* if we are running in the foreground then look for
+                  EOF on stdin, and exit if it happens. This allows
+                  us to die if the parent process dies
+                  Only do this on a pipe or socket, no other device.
+               */
+               if (fstat(0, &st) != 0) {
+                       return false;
+               }
+               if (S_ISFIFO(st.st_mode) || S_ISSOCK(st.st_mode)) {
+                       tevent_add_fd(winbind_event_context(),
+                                       is_parent,
+                                       0,
+                                       TEVENT_FD_READ,
+                                       winbindd_stdin_handler,
+                                       is_parent);
+               }
+       }
+
+       return true;
+}
+
 static void winbindd_sig_hup_handler(struct tevent_context *ev,
                                     struct tevent_signal *se,
                                     int signum,
@@ -377,7 +499,7 @@ static void winbind_msg_validate_cache(struct messaging_context *msg_ctx,
                                       struct server_id server_id,
                                       DATA_BLOB *data)
 {
-       uint8 ret;
+       uint8_t ret;
        pid_t child_pid;
        NTSTATUS status;
 
@@ -389,7 +511,7 @@ static void winbind_msg_validate_cache(struct messaging_context *msg_ctx,
         * so we don't block the main winbindd and the validation
         * code can safely use fork/waitpid...
         */
-       child_pid = sys_fork();
+       child_pid = fork();
 
        if (child_pid == -1) {
                DEBUG(1, ("winbind_msg_validate_cache: Could not fork: %s\n",
@@ -416,7 +538,7 @@ static void winbind_msg_validate_cache(struct messaging_context *msg_ctx,
        /* install default SIGCHLD handler: validation code uses fork/waitpid */
        CatchSignal(SIGCHLD, SIG_DFL);
 
-       ret = (uint8)winbindd_validate_cache_nobackup();
+       ret = (uint8_t)winbindd_validate_cache_nobackup();
        DEBUG(10, ("winbindd_msg_validata_cache: got return value %d\n", ret));
        messaging_send_buf(msg_ctx, server_id, MSG_WINBIND_VALIDATE_CACHE, &ret,
                           (size_t)1);
@@ -450,11 +572,6 @@ static struct winbindd_dispatch_table {
        { WINBINDD_CCACHE_NTLMAUTH, winbindd_ccache_ntlm_auth, "NTLMAUTH" },
        { WINBINDD_CCACHE_SAVE, winbindd_ccache_save, "CCACHE_SAVE" },
 
-       /* WINS functions */
-
-       { WINBINDD_WINS_BYNAME, winbindd_wins_byname, "WINS_BYNAME" },
-       { WINBINDD_WINS_BYIP, winbindd_wins_byip, "WINS_BYIP" },
-
        /* End of list */
 
        { WINBINDD_NUM_CMDS, NULL, "NONE" }
@@ -545,6 +662,10 @@ static struct winbindd_async_dispatch_table async_nonpriv_table[] = {
        { WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, "PAM_CHNG_PSWD_AUTH_CRAP",
          winbindd_pam_chng_pswd_auth_crap_send,
          winbindd_pam_chng_pswd_auth_crap_recv },
+       { WINBINDD_WINS_BYIP, "WINS_BYIP",
+         winbindd_wins_byip_send, winbindd_wins_byip_recv },
+       { WINBINDD_WINS_BYNAME, "WINS_BYNAME",
+         winbindd_wins_byname_send, winbindd_wins_byname_recv },
 
        { 0, NULL, NULL, NULL }
 };
@@ -578,6 +699,7 @@ static void process_request(struct winbindd_cli_state *state)
 
        state->cmd_name = "unknown request";
        state->recv_fn = NULL;
+       state->last_access = time(NULL);
 
        /* Process command */
 
@@ -688,11 +810,15 @@ static void request_finished(struct winbindd_cli_state *state);
 
 static void winbind_client_request_read(struct tevent_req *req);
 static void winbind_client_response_written(struct tevent_req *req);
+static void winbind_client_activity(struct tevent_req *req);
 
 static void request_finished(struct winbindd_cli_state *state)
 {
        struct tevent_req *req;
 
+       /* free client socket monitoring request */
+       TALLOC_FREE(state->io_req);
+
        TALLOC_FREE(state->request);
 
        req = wb_resp_write_send(state, winbind_event_context(),
@@ -705,6 +831,7 @@ static void request_finished(struct winbindd_cli_state *state)
                return;
        }
        tevent_req_set_callback(req, winbind_client_response_written, state);
+       state->io_req = req;
 }
 
 static void winbind_client_response_written(struct tevent_req *req)
@@ -714,6 +841,8 @@ static void winbind_client_response_written(struct tevent_req *req)
        ssize_t ret;
        int err;
 
+       state->io_req = NULL;
+
        ret = wb_resp_write_recv(req, &err);
        TALLOC_FREE(req);
        if (ret == -1) {
@@ -740,6 +869,7 @@ static void winbind_client_response_written(struct tevent_req *req)
                return;
        }
        tevent_req_set_callback(req, winbind_client_request_read, state);
+       state->io_req = req;
 }
 
 void request_error(struct winbindd_cli_state *state)
@@ -774,7 +904,7 @@ static void new_connection(int listen_sock, bool privileged)
 
        if (sock == -1) {
                if (errno != EINTR) {
-                       DEBUG(0, ("Faild to accept socket - %s\n",
+                       DEBUG(0, ("Failed to accept socket - %s\n",
                                  strerror(errno)));
                }
                return;
@@ -784,7 +914,7 @@ static void new_connection(int listen_sock, bool privileged)
 
        /* Create new connection structure */
 
-       if ((state = TALLOC_ZERO_P(NULL, struct winbindd_cli_state)) == NULL) {
+       if ((state = talloc_zero(NULL, struct winbindd_cli_state)) == NULL) {
                close(sock);
                return;
        }
@@ -810,6 +940,7 @@ static void new_connection(int listen_sock, bool privileged)
                return;
        }
        tevent_req_set_callback(req, winbind_client_request_read, state);
+       state->io_req = req;
 
        /* Add to connection list */
 
@@ -823,6 +954,8 @@ static void winbind_client_request_read(struct tevent_req *req)
        ssize_t ret;
        int err;
 
+       state->io_req = NULL;
+
        ret = wb_req_read_recv(req, state, &state->request, &err);
        TALLOC_FREE(req);
        if (ret == -1) {
@@ -838,9 +971,33 @@ static void winbind_client_request_read(struct tevent_req *req)
                remove_client(state);
                return;
        }
+
+       req = wait_for_read_send(state, winbind_event_context(), state->sock,
+                                false);
+       if (req == NULL) {
+               DEBUG(0, ("winbind_client_request_read[%d:%s]:"
+                         " wait_for_read_send failed - removing client\n",
+                         (int)state->pid, state->cmd_name));
+               remove_client(state);
+               return;
+       }
+       tevent_req_set_callback(req, winbind_client_activity, state);
+       state->io_req = req;
+
        process_request(state);
 }
 
+static void winbind_client_activity(struct tevent_req *req)
+{
+       struct winbindd_cli_state *state =
+           tevent_req_callback_data(req, struct winbindd_cli_state);
+       int err;
+
+       wait_for_read_recv(req, &err);
+
+       remove_client(state);
+}
+
 /* Remove a client connection from client connection list */
 
 static void remove_client(struct winbindd_cli_state *state)
@@ -854,6 +1011,25 @@ static void remove_client(struct winbindd_cli_state *state)
                return;
        }
 
+       /*
+        * We need to remove a pending wb_req_read_*
+        * or wb_resp_write_* request before closing the
+        * socket.
+        *
+        * This is important as they might have used tevent_add_fd() and we
+        * use the epoll * backend on linux. So we must remove the tevent_fd
+        * before closing the fd.
+        *
+        * Otherwise we might hit a race with close_conns_after_fork() (via
+        * winbindd_reinit_after_fork()) where a file description
+        * is still open in a child, which means it's still active in
+        * the parents epoll queue, but the related tevent_fd is already
+        * already gone in the parent.
+        *
+        * See bug #11141.
+        */
+       TALLOC_FREE(state->io_req);
+
        if (state->sock != -1) {
                /* tell client, we are closing ... */
                nwritten = write(state->sock, &c, sizeof(c));
@@ -879,7 +1055,8 @@ static void remove_client(struct winbindd_cli_state *state)
 /* Is a client idle? */
 
 static bool client_is_idle(struct winbindd_cli_state *state) {
-  return (state->response == NULL &&
+  return (state->request == NULL &&
+         state->response == NULL &&
          !state->pwent_state && !state->grent_state);
 }
 
@@ -911,6 +1088,41 @@ static bool remove_idle_client(void)
        return False;
 }
 
+/*
+ * Terminate all clients whose requests have taken longer than
+ * "winbind request timeout" seconds to process, or have been
+ * idle for more than "winbind request timeout" seconds.
+ */
+
+static void remove_timed_out_clients(void)
+{
+       struct winbindd_cli_state *state, *next = NULL;
+       time_t curr_time = time(NULL);
+       int timeout_val = lp_winbind_request_timeout();
+
+       for (state = winbindd_client_list(); state; state = next) {
+               time_t expiry_time;
+
+               next = state->next;
+               expiry_time = state->last_access + timeout_val;
+
+               if (curr_time > expiry_time) {
+                       if (client_is_idle(state)) {
+                               DEBUG(5,("Idle client timed out, "
+                                       "shutting down sock %d, pid %u\n",
+                                       state->sock,
+                                       (unsigned int)state->pid));
+                       } else {
+                               DEBUG(5,("Client request timed out, "
+                                       "shutting down sock %d, pid %u\n",
+                                       state->sock,
+                                       (unsigned int)state->pid));
+                       }
+                       remove_client(state);
+               }
+       }
+}
+
 struct winbindd_listen_state {
        bool privileged;
        int fd;
@@ -936,6 +1148,7 @@ static void winbindd_listen_fde_handler(struct tevent_context *ev,
                        break;
                }
        }
+       remove_timed_out_clients();
        new_connection(s->fd, s->privileged);
 }
 
@@ -943,14 +1156,38 @@ static void winbindd_listen_fde_handler(struct tevent_context *ev,
  * Winbindd socket accessor functions
  */
 
-const char *get_winbind_pipe_dir(void)
+char *get_winbind_priv_pipe_dir(void)
 {
-       return lp_parm_const_string(-1, "winbindd", "socket dir", get_dyn_WINBINDD_SOCKET_DIR());
+       return state_path(WINBINDD_PRIV_SOCKET_SUBDIR);
 }
 
-char *get_winbind_priv_pipe_dir(void)
+static void winbindd_setup_max_fds(void)
 {
-       return lock_path(WINBINDD_PRIV_SOCKET_SUBDIR);
+       int num_fds = MAX_OPEN_FUDGEFACTOR;
+       int actual_fds;
+
+       num_fds += lp_winbind_max_clients();
+       /* Add some more to account for 2 sockets open
+          when the client transitions from unprivileged
+          to privileged socket
+       */
+       num_fds += lp_winbind_max_clients() / 10;
+
+       /* Add one socket per child process
+          (yeah there are child processes other than the
+          domain children but only domain children can vary
+          with configuration
+       */
+       num_fds += lp_winbind_max_domain_connections() *
+                  (lp_allow_trusted_domains() ? WINBIND_MAX_DOMAINS_HINT : 1);
+
+       actual_fds = set_maxfiles(num_fds);
+
+       if (actual_fds < num_fds) {
+               DEBUG(1, ("winbindd_setup_max_fds: Information only: "
+                         "requested %d open files, %d are available.\n",
+                         num_fds, actual_fds));
+       }
 }
 
 static bool winbindd_setup_listeners(void)
@@ -958,6 +1195,8 @@ static bool winbindd_setup_listeners(void)
        struct winbindd_listen_state *pub_state = NULL;
        struct winbindd_listen_state *priv_state = NULL;
        struct tevent_fd *fde;
+       int rc;
+       char *socket_path;
 
        pub_state = talloc(winbind_event_context(),
                           struct winbindd_listen_state);
@@ -967,10 +1206,14 @@ static bool winbindd_setup_listeners(void)
 
        pub_state->privileged = false;
        pub_state->fd = create_pipe_sock(
-               get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME, 0755);
+               lp_winbindd_socket_directory(), WINBINDD_SOCKET_NAME, 0755);
        if (pub_state->fd == -1) {
                goto failed;
        }
+       rc = listen(pub_state->fd, 5);
+       if (rc < 0) {
+               goto failed;
+       }
 
        fde = tevent_add_fd(winbind_event_context(), pub_state, pub_state->fd,
                            TEVENT_FD_READ, winbindd_listen_fde_handler,
@@ -987,12 +1230,22 @@ static bool winbindd_setup_listeners(void)
                goto failed;
        }
 
+       socket_path = get_winbind_priv_pipe_dir();
+       if (socket_path == NULL) {
+               goto failed;
+       }
+
        priv_state->privileged = true;
        priv_state->fd = create_pipe_sock(
-               get_winbind_priv_pipe_dir(), WINBINDD_SOCKET_NAME, 0750);
+               socket_path, WINBINDD_SOCKET_NAME, 0750);
+       TALLOC_FREE(socket_path);
        if (priv_state->fd == -1) {
                goto failed;
        }
+       rc = listen(priv_state->fd, 5);
+       if (rc < 0) {
+               goto failed;
+       }
 
        fde = tevent_add_fd(winbind_event_context(), priv_state,
                            priv_state->fd, TEVENT_FD_READ,
@@ -1020,12 +1273,16 @@ bool winbindd_use_cache(void)
        return !opt_nocache;
 }
 
-void winbindd_register_handlers(void)
+static void winbindd_register_handlers(struct messaging_context *msg_ctx,
+                                      bool foreground)
 {
+       NTSTATUS status;
        /* Setup signal handlers */
 
        if (!winbindd_setup_sig_term_handler(true))
                exit(1);
+       if (!winbindd_setup_stdin_handler(true, foreground))
+               exit(1);
        if (!winbindd_setup_sig_hup_handler(NULL))
                exit(1);
        if (!winbindd_setup_sig_chld_handler())
@@ -1045,44 +1302,52 @@ void winbindd_register_handlers(void)
 
        /* get broadcast messages */
 
-       if (!serverid_register(procid_self(),
-                              FLAG_MSG_GENERAL|FLAG_MSG_DBWRAP)) {
+       if (!serverid_register(messaging_server_id(msg_ctx),
+                              FLAG_MSG_GENERAL |
+                              FLAG_MSG_WINBIND |
+                              FLAG_MSG_DBWRAP)) {
                DEBUG(1, ("Could not register myself in serverid.tdb\n"));
                exit(1);
        }
 
        /* React on 'smbcontrol winbindd reload-config' in the same way
           as to SIGHUP signal */
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_SMB_CONF_UPDATED, msg_reload_services);
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_SHUTDOWN, msg_shutdown);
 
        /* Handle online/offline messages. */
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_WINBIND_OFFLINE, winbind_msg_offline);
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_WINBIND_ONLINE, winbind_msg_online);
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_WINBIND_ONLINESTATUS, winbind_msg_onlinestatus);
 
+       /* Handle domain online/offline messages for domains */
+       messaging_register(winbind_messaging_context(), NULL,
+                          MSG_WINBIND_DOMAIN_OFFLINE, winbind_msg_domain_offline);
        messaging_register(winbind_messaging_context(), NULL,
+                          MSG_WINBIND_DOMAIN_ONLINE, winbind_msg_domain_online);
+
+       messaging_register(msg_ctx, NULL,
                           MSG_DUMP_EVENT_LIST, winbind_msg_dump_event_list);
 
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_WINBIND_VALIDATE_CACHE,
                           winbind_msg_validate_cache);
 
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_WINBIND_DUMP_DOMAIN_LIST,
                           winbind_msg_dump_domain_list);
 
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_WINBIND_IP_DROPPED,
                           winbind_msg_ip_dropped_parent);
 
        /* Register handler for MSG_DEBUG. */
-       messaging_register(winbind_messaging_context(), NULL,
+       messaging_register(msg_ctx, NULL,
                           MSG_DEBUG,
                           winbind_msg_debug);
 
@@ -1111,6 +1376,12 @@ void winbindd_register_handlers(void)
                }
        }
 
+       status = wb_irpc_register();
+
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0, ("Could not register IRPC handlers\n"));
+               exit(1);
+       }
 }
 
 struct winbindd_addrchanged_state {
@@ -1199,7 +1470,7 @@ static void winbindd_addr_changed(struct tevent_req *req)
 
 /* Main function */
 
-int main(int argc, char **argv, char **envp)
+int main(int argc, const char **argv)
 {
        static bool is_daemon = False;
        static bool Fork = True;
@@ -1226,6 +1497,7 @@ int main(int argc, char **argv, char **envp)
        int opt;
        TALLOC_CTX *frame;
        NTSTATUS status;
+       bool ok;
 
        /*
         * Do this before any other talloc operation
@@ -1233,6 +1505,14 @@ int main(int argc, char **argv, char **envp)
        talloc_enable_null_tracking();
        frame = talloc_stackframe();
 
+       /*
+        * We want total control over the permissions on created files,
+        * so set our umask to 0.
+        */
+       umask(0);
+
+       setup_logging("winbindd", DEBUG_DEFAULT_STDOUT);
+
        /* glibc (?) likes to print "User defined signal 1" and exit if a
           SIGUSR[12] is received before a handler is installed */
 
@@ -1240,9 +1520,9 @@ int main(int argc, char **argv, char **envp)
        CatchSignal(SIGUSR2, SIG_IGN);
 
        fault_setup();
-       dump_core_setup("winbindd", lp_logfile());
+       dump_core_setup("winbindd", lp_logfile(talloc_tos()));
 
-       load_case_tables();
+       smb_init_locale();
 
        /* Initialise for running in non-root mode */
 
@@ -1260,7 +1540,7 @@ int main(int argc, char **argv, char **envp)
 
        /* Initialise samba/rpc client stuff */
 
-       pc = poptGetContext("winbindd", argc, (const char **)argv, long_options, 0);
+       pc = poptGetContext("winbindd", argc, argv, long_options, 0);
 
        while ((opt = poptGetNextOpt(pc)) != -1) {
                switch (opt) {
@@ -1293,6 +1573,14 @@ int main(int argc, char **argv, char **envp)
                }
        }
 
+       /* We call dump_core_setup one more time because the command line can
+        * set the log file or the log-basename and this will influence where
+        * cores are stored. Without this call get_dyn_LOGFILEBASE will be
+        * the default value derived from build's prefix. For EOM this value
+        * is often not related to the path where winbindd is actually run
+        * in production.
+        */
+       dump_core_setup("winbindd", lp_logfile(talloc_tos()));
        if (is_daemon && interactive) {
                d_fprintf(stderr,"\nERROR: "
                          "Option -i|--interactive is not allowed together with -D|--daemon\n\n");
@@ -1317,6 +1605,7 @@ int main(int argc, char **argv, char **envp)
                        SAFE_FREE(lfile);
                }
        }
+
        if (log_stdout) {
                setup_logging("winbindd", DEBUG_STDOUT);
        } else {
@@ -1331,6 +1620,22 @@ int main(int argc, char **argv, char **envp)
                DEBUG(0, ("error opening config file '%s'\n", get_dyn_CONFIGFILE()));
                exit(1);
        }
+       /* After parsing the configuration file we setup the core path one more time
+        * as the log file might have been set in the configuration and cores's
+        * path is by default basename(lp_logfile()).
+        */
+       dump_core_setup("winbindd", lp_logfile(talloc_tos()));
+
+       if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC
+           && !lp_parm_bool(-1, "server role check", "inhibit", false)) {
+               DEBUG(0, ("server role = 'active directory domain controller' not compatible with running the winbindd binary. \n"));
+               DEBUGADD(0, ("You should start 'samba' instead, and it will control starting the internal AD DC winbindd implementation, which is not the same as this one\n"));
+               exit(1);
+       }
+
+       if (!cluster_probe_ok()) {
+               exit(1);
+       }
 
        /* Initialise messaging system */
 
@@ -1343,8 +1648,18 @@ int main(int argc, char **argv, char **envp)
                exit(1);
        }
 
-       if (!directory_exist(lp_lockdir())) {
-               mkdir(lp_lockdir(), 0755);
+       ok = directory_create_or_exist(lp_lock_directory(), 0755);
+       if (!ok) {
+               DEBUG(0, ("Failed to create directory %s for lock files - %s\n",
+                         lp_lock_directory(), strerror(errno)));
+               exit(1);
+       }
+
+       ok = directory_create_or_exist(lp_pid_directory(), 0755);
+       if (!ok) {
+               DEBUG(0, ("Failed to create directory %s for pid files - %s\n",
+                         lp_pid_directory(), strerror(errno)));
+               exit(1);
        }
 
        /* Setup names. */
@@ -1360,6 +1675,13 @@ int main(int argc, char **argv, char **envp)
                return False;
        }
 
+       status = rpccli_pre_open_netlogon_creds();
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0, ("rpccli_pre_open_netlogon_creds() - %s\n",
+                         nt_errstr(status)));
+               exit(1);
+       }
+
        /* Unblock all signals we are interested in as they may have been
           blocked by the parent process. */
 
@@ -1374,7 +1696,7 @@ int main(int argc, char **argv, char **envp)
        if (!interactive)
                become_daemon(Fork, no_process_group, log_stdout);
 
-       pidfile_create("winbindd");
+       pidfile_create(lp_pid_directory(), "winbindd");
 
 #if HAVE_SETPGID
        /*
@@ -1394,21 +1716,32 @@ int main(int argc, char **argv, char **envp)
 
        status = reinit_after_fork(winbind_messaging_context(),
                                   winbind_event_context(),
-                                  procid_self(), false);
+                                  false);
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0,("reinit_after_fork() failed\n"));
-               exit(1);
+               exit_daemon("Winbindd reinit_after_fork() failed", map_errno_from_nt_status(status));
        }
 
-       winbindd_register_handlers();
-
-       status = init_system_info();
+       /*
+        * Do not initialize the parent-child-pipe before becoming
+        * a daemon: this is used to detect a died parent in the child
+        * process.
+        */
+       status = init_before_fork();
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(1, ("ERROR: failed to setup system user info: %s.\n",
-                         nt_errstr(status)));
+               exit_daemon(nt_errstr(status), map_errno_from_nt_status(status));
+       }
+
+       winbindd_register_handlers(winbind_messaging_context(), !Fork);
+
+       if (!messaging_parent_dgm_cleanup_init(winbind_messaging_context())) {
                exit(1);
        }
 
+       status = init_system_session_info();
+       if (!NT_STATUS_IS_OK(status)) {
+               exit_daemon("Winbindd failed to setup system user info", map_errno_from_nt_status(status));
+       }
+
        rpc_lsarpc_init(NULL);
        rpc_samr_init(NULL);
 
@@ -1418,11 +1751,17 @@ int main(int argc, char **argv, char **envp)
        /* setup listen sockets */
 
        if (!winbindd_setup_listeners()) {
-               DEBUG(0,("winbindd_setup_listeners() failed\n"));
-               exit(1);
+               exit_daemon("Winbindd failed to setup listeners", EPIPE);
        }
 
+       irpc_add_name(winbind_imessaging_context(), "winbind_server");
+
        TALLOC_FREE(frame);
+
+       if (!interactive) {
+               daemon_ready("winbindd");
+       }
+
        /* Loop waiting for requests */
        while (1) {
                frame = talloc_stackframe();