Changeset 232 for branches/samba-3.2.x/source/winbindd

Timestamp:

May 27, 2009, 9:09:42 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.8

Location:

branches/samba-3.2.x/source/winbindd

Files:

• winbindd.c (modified) (8 diffs)
• winbindd_cache.c (modified) (2 diffs)
• winbindd_cm.c (modified) (7 diffs)
• winbindd_cred_cache.c (modified) (15 diffs)
• winbindd_dual.c (modified) (10 diffs)
• winbindd_util.c (modified) (2 diffs)

branches/samba-3.2.x/source/winbindd/winbindd.c

@@ -171 +171 @@
 }
 
-static bool do_sigterm;
+static SIG_ATOMIC_T do_sigterm = 0;
 
 static void termination_handler(int signum)
 {
-        do_sigterm = True;
+        do_sigterm = 1;
         sys_select_signal(signum);
 }
 
-static bool do_sigusr2;
+static SIG_ATOMIC_T do_sigusr2 = 0;
 
 static void sigusr2_handler(int signum)
 {
-        do_sigusr2 = True;
+        do_sigusr2 = 1;
         sys_select_signal(SIGUSR2);
 }
 
-static bool do_sighup;
+static SIG_ATOMIC_T do_sighup = 0;
 
 static void sighup_handler(int signum)
 {
-        do_sighup = True;
+        do_sighup = 1;
         sys_select_signal(SIGHUP);
 }
 
-static bool do_sigchld;
+static SIG_ATOMIC_T do_sigchld = 0;
 
 static void sigchld_handler(int signum)
 {
-        do_sigchld = True;
+        do_sigchld = 1;
         sys_select_signal(SIGCHLD);
 }
@@ -222 +222 @@
                          DATA_BLOB *data)
 {
-        do_sigterm = True;
+        do_sigterm = 1;
 }
 
@@ -747 +747 @@
 {
         char c = 0;
+        int nwritten;
 
         /* It's a dead client - hold a funeral */
@@ -755 +756 @@
 
         /* tell client, we are closing ... */
-        write(state->sock, &c, sizeof(c));
+        nwritten = write(state->sock, &c, sizeof(c));
+        if (nwritten == -1) {
+                DEBUG(2, ("final write to client failed: %s\n",
+                          strerror(errno)));
+        }
 
         /* Close socket */
@@ -823 +828 @@
                 reload_services_file(logfile);
 
-                do_sighup = False;
+                do_sighup = 0;
         }
 }
@@ -998 +1003 @@
         if (do_sigusr2) {
                 print_winbindd_status();
-                do_sigusr2 = False;
+                do_sigusr2 = 0;
         }
 
@@ -1004 +1009 @@
                 pid_t pid;
 
-                do_sigchld = False;
+                do_sigchld = 0;
 
                 while ((pid = sys_waitpid(-1, NULL, WNOHANG)) > 0) {
@@ -1218 +1223 @@
         TimeInit();
 
-        if (!reinit_after_fork(winbind_messaging_context(), false)) {
+        /* Don't use winbindd_reinit_after_fork here as
+         * we're just starting up and haven't created any
+         * winbindd-specific resources we must free yet. JRA.
+         */
+
+        if (!reinit_after_fork(winbind_messaging_context(),
+                               winbind_event_context(), false)) {
                 DEBUG(0,("reinit_after_fork() failed\n"));
                 exit(1);

branches/samba-3.2.x/source/winbindd/winbindd_cache.c

@@ -487 +487 @@
 
         /* see if we have to refetch the domain sequence number */
-        if (!force && (time_diff < cache_time)) {
+        if (!force && (time_diff < cache_time) &&
+                        (domain->sequence_number != DOM_SEQUENCE_NONE) &&
+                        NT_STATUS_IS_OK(domain->last_status)) {
                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
                 goto done;
@@ -496 +498 @@
         
         status = fetch_cache_seqnum( domain, t );
-        if ( NT_STATUS_IS_OK(status) )
-                goto done;      
+        if (NT_STATUS_IS_OK(status) &&
+                        (domain->sequence_number != DOM_SEQUENCE_NONE) &&
+                        NT_STATUS_IS_OK(domain->last_status)) {
+                goto done;
+        }
 
         /* important! make sure that we know if this is a native 

branches/samba-3.2.x/source/winbindd/winbindd_cm.c

@@ -174 +174 @@
         pid_t child_pid;
         pid_t parent_pid = sys_getpid();
+        char *lfile = NULL;
 
         /* Stop zombies */
@@ -200 +201 @@
         /* Leave messages blocked - we will never process one. */
 
-        if (!reinit_after_fork(winbind_messaging_context(), true)) {
+        if (!override_logfile) {
+                if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
+                        DEBUG(0, ("fork_child_dc_connect: out of memory!\n"));
+                        _exit(1);
+                }
+        }
+
+        if (!winbindd_reinit_after_fork(lfile)) {
                 DEBUG(0,("reinit_after_fork() failed\n"));
-                _exit(0);
-        }
-
-        close_conns_after_fork();
-
-        if (!override_logfile) {
-                char *logfile;
-                if (asprintf(&logfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) > 0) {
-                        lp_set_logfile(logfile);
-                        SAFE_FREE(logfile);
-                        reopen_logs();
-                }
-        }
+                messaging_send_buf(winbind_messaging_context(),
+                                   pid_to_procid(parent_pid),
+                                   MSG_WINBIND_FAILED_TO_GO_ONLINE,
+                                   (uint8 *)domain->name,
+                                   strlen(domain->name) + 1);
+                _exit(1);
+        }
+
+        SAFE_FREE(lfile);
 
         mem_ctx = talloc_init("fork_child_dc_connect");
         if (!mem_ctx) {
                 DEBUG(0,("talloc_init failed.\n"));
-                _exit(0);
+                _exit(1);
         }
 
@@ -378 +382 @@
 ****************************************************************/
 
+void ccache_regain_all_now(void);
+
 static void set_domain_online(struct winbindd_domain *domain)
 {
-        struct timeval now;
 
         DEBUG(10,("set_domain_online: called for domain %s\n",
@@ -400 +405 @@
 
         /* If we are waiting to get a krb5 ticket, trigger immediately. */
-        GetTimeOfDay(&now);
-        set_event_dispatch_time(winbind_event_context(),
-                                "krb5_ticket_gain_handler", now);
-
+        ccache_regain_all_now();
+        
         /* Ok, we're out of any startup mode now... */
         domain->startup = False;
@@ -475 +478 @@
            Wait at least 5 seconds. Heuristics suck... */
 
+        GetTimeOfDay(&tev);
+
+        /* Go into "startup" mode again. */
+        domain->startup_time = tev.tv_sec;
+        domain->startup = True;
+
+        tev.tv_sec += 5;
         if (!domain->check_online_event) {
                 /* If we've come from being globally offline we
@@ -480 +490 @@
                    We need to add one now we're trying to go
                    back online. */
-
                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
                         domain->name ));
-
-                domain->check_online_event = event_add_timed(winbind_event_context(),
-                                                                NULL,
-                                                                timeval_current_ofs(5, 0),
-                                                                "check_domain_online_handler",
-                                                                check_domain_online_handler,
-                                                                domain);
-
-                /* The above *has* to succeed for winbindd to work. */
-                if (!domain->check_online_event) {
-                        smb_panic("set_domain_online_request: failed to add online handler");
-                }
-        }
-
-        GetTimeOfDay(&tev);
-
-        /* Go into "startup" mode again. */
-        domain->startup_time = tev.tv_sec;
-        domain->startup = True;
-
-        tev.tv_sec += 5;
-
-        set_event_dispatch_time(winbind_event_context(), "check_domain_online_handler", tev);
+        }
+        
+        TALLOC_FREE(domain->check_online_event);
+        
+        domain->check_online_event = event_add_timed(winbind_event_context(),
+                                                        NULL,
+                                                        tev,
+                                                        "check_domain_online_handler",
+                                                        check_domain_online_handler,
+                                                        domain);
+        
+        /* The above *has* to succeed for winbindd to work. */
+        if (!domain->check_online_event) {
+                smb_panic("set_domain_online_request: failed to add online handler");
+        }
 }
 
@@ -613 +614 @@
                                                   &domain_info,
                                                   &werr);
-                if (W_ERROR_IS_OK(werr)) {
+                if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
                         tmp = talloc_strdup(
                                 mem_ctx, domain_info->dc_unc);

branches/samba-3.2.x/source/winbindd/winbindd_cred_cache.c

@@ -35 +35 @@
 
 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
+static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
+                                                struct timeval t);
 
 /* The Krb5 ticket refresh handler should be scheduled
@@ -71 +73 @@
         return i;
 }
+
+void ccache_remove_all_after_fork(void)
+{
+        struct WINBINDD_CCACHE_ENTRY *cur;
+        cur = ccache_list;
+        while (cur) {
+                DLIST_REMOVE(ccache_list, cur);
+                TALLOC_FREE(cur->event);
+                TALLOC_FREE(cur);
+                cur = ccache_list;
+        }
+}
+
+static void krb5_ticket_gain_handler(struct event_context *event_ctx,
+                                     struct timed_event *te,
+                                     const struct timeval *now,
+                                     void *private_data);
+static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
+                                        struct timed_event *te,
+                                        const struct timeval *now,
+                                        void *private_data);
+
+void ccache_regain_all_now(void)
+{
+        struct WINBINDD_CCACHE_ENTRY *cur;
+        struct timeval t = timeval_current();
+
+        for (cur = ccache_list; cur; cur = cur->next) {
+                struct timed_event *new_event;
+
+                /*
+                 * if refresh_time is 0, we know that the
+                 * the event has the krb5_ticket_gain_handler
+                 */
+                if (cur->refresh_time == 0) {
+                        new_event = event_add_timed(winbind_event_context(),
+                                                      cur, t,
+                                                      "krb5_ticket_gain_handler",
+                                                      krb5_ticket_gain_handler,
+                                                      cur);
+                } else {
+                        new_event = event_add_timed(winbind_event_context(),
+                                                     cur, t,
+                                                     "krb5_ticket_refresh_handler",
+                                                     krb5_ticket_refresh_handler,
+                                                     cur);
+                }
+                if (!new_event) {
+                        continue;
+                }
+
+                TALLOC_FREE(cur->event);
+                cur->event = new_event;
+        }
+        return;
+}
+
+/****************************************************************
+ The gain initial tikcet case is recongnized as entry->refresh_time
+ is always zero.
+****************************************************************/
+
+static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
+                                                struct timeval t)
+{
+        entry->refresh_time = 0;
+        entry->event = event_add_timed(winbind_event_context(), entry,
+                                        t,
+                                        "krb5_ticket_gain_handler",
+                                        krb5_ticket_gain_handler,
+                                        entry);
+}
+
 
 /****************************************************************
@@ -86 +161 @@
         int ret;
         time_t new_start;
+        time_t expire_time = 0;
         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 #endif
@@ -98 +174 @@
 
         /* Kinit again if we have the user password and we can't renew the old
-         * tgt anymore */
-
-        if ((entry->renew_until < time(NULL)) && cred_ptr && cred_ptr->pass) {
-
-                set_effective_uid(entry->uid);
-
-                ret = kerberos_kinit_password_ext(entry->principal_name,
-                                                  cred_ptr->pass,
-                                                  0, /* hm, can we do time correction here ? */
-                                                  &entry->refresh_time,
-                                                  &entry->renew_until,
-                                                  entry->ccname,
-                                                  False, /* no PAC required anymore */
-                                                  True,
-                                                  WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
-                                                  NULL);
-                gain_root_privilege();
-
-                if (ret) {
-                        DEBUG(3,("krb5_ticket_refresh_handler: "
-                                "could not re-kinit: %s\n",
-                                error_message(ret)));
-                        TALLOC_FREE(entry->event);
-                        return;
-                }
-
-                DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
-                        "for: %s in ccache: %s\n",
-                        entry->principal_name, entry->ccname));
-
+         * tgt anymore 
+         * NB
+         * This happens when machine are put to sleep for a very long time. */
+
+        if (entry->renew_until < time(NULL)) {
+rekinit:
+                if (cred_ptr && cred_ptr->pass) {
+
+                        set_effective_uid(entry->uid);
+
+                        ret = kerberos_kinit_password_ext(entry->principal_name,
+                                                          cred_ptr->pass,
+                                                          0, /* hm, can we do time correction here ? */
+                                                          &entry->refresh_time,
+                                                          &entry->renew_until,
+                                                          entry->ccname,
+                                                          False, /* no PAC required anymore */
+                                                          True,
+                                                          WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+                                                          NULL);
+                        gain_root_privilege();
+
+                        if (ret) {
+                                DEBUG(3,("krb5_ticket_refresh_handler: "
+                                        "could not re-kinit: %s\n",
+                                        error_message(ret)));
+                                /* destroy the ticket because we cannot rekinit
+                                 * it, ignore error here */
+                                ads_kdestroy(entry->ccname);
+
+                                /* Don't break the ticket refresh chain: retry 
+                                 * refreshing ticket sometime later when KDC is 
+                                 * unreachable -- BoYang 
+                                 * */
+
+                                if ((ret == KRB5_KDC_UNREACH)
+                                    || (ret == KRB5_REALM_CANT_RESOLVE)) {
 #if defined(DEBUG_KRB5_TKT_RENEWAL)
-                new_start = time(NULL) + 30;
-#else
-                /* The tkt should be refreshed at one-half the period
-                   from now to the expiration time */
-                new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
-#endif
-                goto done;
+                                        new_start = time(NULL) + 30;
+#else
+                                        new_start = time(NULL) +
+                                                    MAX(30, lp_winbind_cache_time());
+#endif
+                                        /* try to regain ticket here */
+                                        add_krb5_ticket_gain_handler_event(entry,
+                                                                           timeval_set(new_start, 0));
+                                        return;
+                                }
+                                TALLOC_FREE(entry->event);
+                                return;
+                        }
+
+                        DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
+                                "for: %s in ccache: %s\n",
+                                entry->principal_name, entry->ccname));
+
+#if defined(DEBUG_KRB5_TKT_RENEWAL)
+                        new_start = time(NULL) + 30;
+#else
+                        /* The tkt should be refreshed at one-half the period
+                           from now to the expiration time */
+                        expire_time = entry->refresh_time;
+                        new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
+#endif
+                        goto done;
+                } else {
+                                /* can this happen? 
+                                 * No cached credentials
+                                 * destroy ticket and refresh chain 
+                                 * */
+                                ads_kdestroy(entry->ccname);
+                                TALLOC_FREE(entry->event);
+                                return;
+                }
         }
 
@@ -147 +259 @@
         new_start = time(NULL) + 30;
 #else
+        expire_time = new_start;
         new_start = KRB5_EVENT_REFRESH_TIME(new_start);
 #endif
@@ -158 +271 @@
                 /* maybe we are beyond the renewing window */
 
+                /* evil rises here, we refresh ticket failed,
+                 * but the ticket might be expired. Therefore,
+                 * When we refresh ticket failed, destory the 
+                 * ticket */
+
+                ads_kdestroy(entry->ccname);
+
                 /* avoid breaking the renewal chain: retry in
                  * lp_winbind_cache_time() seconds when the KDC was not
-                 * available right now. */
-
-                if (ret == KRB5_KDC_UNREACH) {
+                 * available right now. 
+                 * the return code can be KRB5_REALM_CANT_RESOLVE*/
+
+                if ((ret == KRB5_KDC_UNREACH) 
+                    || (ret == KRB5_REALM_CANT_RESOLVE)) {
+#if defined(DEBUG_KRB5_TKT_RENEWAL)
+                        new_start = time(NULL) + 30;
+#else
                         new_start = time(NULL) +
                                     MAX(30, lp_winbind_cache_time());
-                        goto done;
-                }
+#endif
+                        /* ticket is destroyed here, we have to regain it
+                         * if it is possible */
+                        add_krb5_ticket_gain_handler_event(entry, 
+                                                           timeval_set(new_start, 0));
+                        return;
+                }
+
+                /* This is evil, if the ticket was already expired.
+                 * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
+                 * But there is still a chance that we can rekinit it. 
+                 *
+                 * This happens when user login in online mode, and then network
+                 * down or something cause winbind goes offline for a very long time,
+                 * and then goes online again. ticket expired, renew failed.
+                 * This happens when machine are put to sleep for a long time,
+                 * but shorter than entry->renew_util.
+                 * NB
+                 * Looks like the KDC is reachable, we want to rekinit as soon as
+                 * possible instead of waiting some time later. */
+                if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
+                    || (ret == KRB5_FCC_NOFILE)) goto rekinit;
 
                 return;
@@ -172 +317 @@
 
 done:
-
+        /* in cases that ticket will be unrenewable soon, we don't try to renew ticket 
+         * but try to regain ticket if it is possible */
+        if (entry->renew_until && expire_time
+             && (entry->renew_until <= expire_time)) {
+                /* try to regain ticket 10 seconds beforre expiration */
+                expire_time -= 10;
+                add_krb5_ticket_gain_handler_event(entry, timeval_set(expire_time, 0));
+                return;
+        }
+
+        if (!entry->refresh_time) {
+                entry->refresh_time = new_start;
+        }
         entry->event = event_add_timed(winbind_event_context(), entry,
                                        timeval_set(new_start, 0),
@@ -240 +397 @@
                         "could not kinit: %s\n",
                         error_message(ret)));
+                /* evil. If we cannot do it, destroy any the __maybe__ 
+                 * __existing__ ticket */
+                ads_kdestroy(entry->ccname);
                 goto retry_later;
         }
@@ -250 +410 @@
 
   retry_later:
-
+ 
+#if defined(DEBUG_KRB5_TKT_REGAIN)
+        t = timeval_set(time(NULL) + 30, 0);
+#else
         t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
-
-        entry->event = event_add_timed(winbind_event_context(),
-                                       entry,
-                                       t,
-                                       "krb5_ticket_gain_handler",
-                                       krb5_ticket_gain_handler,
-                                       entry);
+#endif
+
+        add_krb5_ticket_gain_handler_event(entry, t);
 
         return;
@@ -270 +429 @@
 #endif
 
+        if (!entry->refresh_time) {
+                entry->refresh_time = t.tv_sec;
+        }
         entry->event = event_add_timed(winbind_event_context(),
                                        entry,
@@ -332 +494 @@
         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
         struct timeval t;
+        NTSTATUS ntret;
+#ifdef HAVE_KRB5
+        int ret;
+#endif
 
         if ((username == NULL && princ_name == NULL) ||
@@ -343 +509 @@
                 return NT_STATUS_NO_MORE_ENTRIES;
         }
+
+        /* If it is cached login, destroy krb5 ticket
+         * to avoid surprise. */
+#ifdef HAVE_KRB5
+        if (postponed_request) {
+                /* ignore KRB5_FCC_NOFILE error here */
+                ret = ads_kdestroy(ccname);
+                if (ret == KRB5_FCC_NOFILE) {
+                        ret = 0;
+                }
+                if (ret) {
+                        DEBUG(0, ("add_ccache_to_list: failed to destroy "
+                                   "user krb5 ccache %s with %s\n", ccname,
+                                   error_message(ret)));
+                        return krb5_to_nt_status(ret);
+                } else {
+                        DEBUG(10, ("add_ccache_to_list: successfully destroyed "
+                                   "krb5 ccache %s for user %s\n", ccname,
+                                   username));
+                }
+        }
+#endif
 
         /* Reference count old entries */
@@ -356 +544 @@
                         username, entry->ref_count));
                 /* FIXME: in this case we still might want to have a krb5 cred
-                 * event handler created - gd*/
+                 * event handler created - gd
+                 * Add ticket refresh handler here */
+                
+                if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
+                        return NT_STATUS_OK;
+                }
+                
+                if (!entry->event) {
+                        if (postponed_request) {
+                                t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
+                                add_krb5_ticket_gain_handler_event(entry, t);
+                        } else {
+                                /* Renew at 1/2 the ticket expiration time */
+#if defined(DEBUG_KRB5_TKT_RENEWAL)
+                                t = timeval_set(time(NULL)+30, 0);
+#else
+                                t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
+#endif
+                                if (!entry->refresh_time) {
+                                        entry->refresh_time = t.tv_sec;
+                                }
+                                entry->event = event_add_timed(winbind_event_context(),
+                                                               entry,
+                                                               t,
+                                                               "krb5_ticket_refresh_handler",
+                                                               krb5_ticket_refresh_handler,
+                                                               entry);
+                        }
+
+                        if (!entry->event) {
+                                ntret = remove_ccache(username);
+                                if (!NT_STATUS_IS_OK(ntret)) {
+                                        DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
+                                                  "ccache %s for user %s\n", entry->ccname,
+                                                  entry->username));
+                                        DEBUG(0, ("add_ccache_to_list: error is %s\n",
+                                                  nt_errstr(ntret)));
+                                        return ntret;
+                                }
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
+                }
+                 
                 return NT_STATUS_OK;
         }
@@ -407 +639 @@
         if (postponed_request) {
                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
-                entry->event = event_add_timed(winbind_event_context(),
-                                               entry,
-                                               t,
-                                               "krb5_ticket_gain_handler",
-                                               krb5_ticket_gain_handler,
-                                               entry);
+                add_krb5_ticket_gain_handler_event(entry, t);
         } else {
                 /* Renew at 1/2 the ticket expiration time */
@@ -420 +647 @@
                 t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
 #endif
+                if (!entry->refresh_time) {
+                        entry->refresh_time = t.tv_sec;
+                }
+                
                 entry->event = event_add_timed(winbind_event_context(),
                                                entry,

branches/samba-3.2.x/source/winbindd/winbindd_dual.c

@@ -881 +881 @@
 {
         struct winbindd_domain *domain;
+        struct winbindd_domain *primary_domain = NULL;
         const char *domainname = (const char *)data->data;
 
@@ -893 +894 @@
                 return;
         }
+
+        primary_domain = find_our_domain();
 
         /* Mark the requested domain offline. */
@@ -903 +906 @@
                         DEBUG(5,("child_msg_offline: marking %s offline.\n", domain->name));
                         set_domain_offline(domain);
+                        /* we are in the trusted domain, set the primary domain 
+                         * offline too */
+                        if (domain != primary_domain) {
+                                set_domain_offline(primary_domain);
+                        }
                 }
         }
@@ -916 +924 @@
 {
         struct winbindd_domain *domain;
+        struct winbindd_domain *primary_domain = NULL;
         const char *domainname = (const char *)data->data;
 
@@ -928 +937 @@
                 return;
         }
+
+        primary_domain = find_our_domain();
 
         /* Set our global state as online. */
@@ -943 +954 @@
                         winbindd_flush_negative_conn_cache(domain);
                         set_domain_online_request(domain);
+
+                        /* we can be in trusted domain, which will contact primary domain
+                         * we have to bring primary domain online in trusted domain process
+                         * see, winbindd_dual_pam_auth() --> winbindd_dual_pam_auth_samlogon()
+                         * --> contact_domain = find_our_domain()
+                         * */
+                        if (domain != primary_domain) {
+                                winbindd_flush_negative_conn_cache(primary_domain);
+                                set_domain_online_request(primary_domain);
+                        }
                 }
         }
@@ -1020 +1041 @@
 }
 
-
-static bool fork_domain_child(struct winbindd_child *child)
-{
-        int fdpair[2];
-        struct winbindd_cli_state state;
+void ccache_remove_all_after_fork(void);
+
+bool winbindd_reinit_after_fork(const char *logfilename)
+{
         struct winbindd_domain *domain;
-        struct winbindd_domain *primary_domain = NULL;
-
-        if (child->domain) {
-                DEBUG(10, ("fork_domain_child called for domain '%s'\n",
-                           child->domain->name));
-        } else {
-                DEBUG(10, ("fork_domain_child called without domain.\n"));
-        }
-
-        if (socketpair(AF_UNIX, SOCK_STREAM, 0, fdpair) != 0) {
-                DEBUG(0, ("Could not open child pipe: %s\n",
-                          strerror(errno)));
-                return False;
-        }
-
-        ZERO_STRUCT(state);
-        state.pid = sys_getpid();
-
-        child->pid = sys_fork();
-
-        if (child->pid == -1) {
-                DEBUG(0, ("Could not fork: %s\n", strerror(errno)));
-                return False;
-        }
-
-        if (child->pid != 0) {
-                /* Parent */
-                close(fdpair[0]);
-                child->next = child->prev = NULL;
-                DLIST_ADD(children, child);
-                child->event.fd = fdpair[1];
-                child->event.flags = 0;
-                child->requests = NULL;
-                add_fd_event(&child->event);
-                return True;
-        }
-
-        /* Child */
-
-        /* Stop zombies in children */
-        CatchChild();
-
-        state.sock = fdpair[0];
-        close(fdpair[1]);
-
-        if (!reinit_after_fork(winbind_messaging_context(), true)) {
+        struct winbindd_child *cl;
+
+        if (!reinit_after_fork(winbind_messaging_context(),
+                               winbind_event_context(), true)) {
                 DEBUG(0,("reinit_after_fork() failed\n"));
-                _exit(0);
+                return false;
         }
 
         close_conns_after_fork();
 
-        if (!override_logfile) {
-                lp_set_logfile(child->logfilename);
+        if (!override_logfile && logfilename) {
+                lp_set_logfile(logfilename);
                 reopen_logs();
         }
-
-        /*
-         * For clustering, we need to re-init our ctdbd connection after the
-         * fork
-         */
-        if (!NT_STATUS_IS_OK(messaging_reinit(winbind_messaging_context())))
-                exit(1);
 
         /* Don't handle the same messages as our parent. */
@@ -1108 +1079 @@
                              MSG_DEBUG, NULL);
 
-        /* Handle online/offline messages. */
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_WINBIND_OFFLINE, child_msg_offline);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_WINBIND_ONLINE, child_msg_online);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_WINBIND_ONLINESTATUS, child_msg_onlinestatus);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_DUMP_EVENT_LIST, child_msg_dump_event_list);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_DEBUG, debug_message);
-
+        /* We have destroyed all events in the winbindd_event_context
+         * in reinit_after_fork(), so clean out all possible pending
+         * event pointers. */
+
+        /* Deal with check_online_events. */
+
+        for (domain = domain_list(); domain; domain = domain->next) {
+                TALLOC_FREE(domain->check_online_event);
+        }
+
+        /* Ensure we're not handling a credential cache event inherited
+         * from our parent. */
+
+        ccache_remove_all_after_fork();
+
+        /* Destroy all possible events in child list. */
+        for (cl = children; cl != NULL; cl = cl->next) {
+                struct winbindd_async_request *request;
+
+                for (request = cl->requests; request; request = request->next) {
+                        TALLOC_FREE(request->reply_timeout_event);
+                }
+                TALLOC_FREE(cl->lockout_policy_event);
+
+                /* Children should never be able to send
+                 * each other messages, all messages must
+                 * go through the parent.
+                 */
+                cl->pid = (pid_t)0;
+        }
+        /*
+         * This is a little tricky, children must not
+         * send an MSG_WINBIND_ONLINE message to idmap_child().
+         * If we are in a child of our primary domain or
+         * in the process created by fork_child_dc_connect(),
+         * and the primary domain cannot go online,
+         * fork_child_dc_connection() sends MSG_WINBIND_ONLINE
+         * periodically to idmap_child().
+         *
+         * The sequence is, fork_child_dc_connect() ---> getdcs() --->
+         * get_dc_name_via_netlogon() ---> cm_connect_netlogon()
+         * ---> init_dc_connection() ---> cm_open_connection --->
+         * set_domain_online(), sends MSG_WINBIND_ONLINE to
+         * idmap_child(). Disallow children sending messages
+         * to each other, all messages must go through the parent.
+         */
+        cl = idmap_child();
+        cl->pid = (pid_t)0;
+
+        return true;
+}
+
+static bool fork_domain_child(struct winbindd_child *child)
+{
+        int fdpair[2];
+        struct winbindd_cli_state state;
+        struct winbindd_domain *primary_domain = NULL;
+
+        if (child->domain) {
+                DEBUG(10, ("fork_domain_child called for domain '%s'\n",
+                           child->domain->name));
+        } else {
+                DEBUG(10, ("fork_domain_child called without domain.\n"));
+        }
+
+        if (socketpair(AF_UNIX, SOCK_STREAM, 0, fdpair) != 0) {
+                DEBUG(0, ("Could not open child pipe: %s\n",
+                          strerror(errno)));
+                return False;
+        }
+
+        ZERO_STRUCT(state);
+        state.pid = sys_getpid();
+
+        child->pid = sys_fork();
+
+        if (child->pid == -1) {
+                DEBUG(0, ("Could not fork: %s\n", strerror(errno)));
+                return False;
+        }
+
+        if (child->pid != 0) {
+                /* Parent */
+                close(fdpair[0]);
+                child->next = child->prev = NULL;
+                DLIST_ADD(children, child);
+                child->event.fd = fdpair[1];
+                child->event.flags = 0;
+                add_fd_event(&child->event);
+                return True;
+        }
+
+        /* Child */
+
+        /* Stop zombies in children */
+        CatchChild();
+
+        state.sock = fdpair[0];
+        close(fdpair[1]);
+
+        if (!winbindd_reinit_after_fork(child->logfilename)) {
+                DEBUG(0, ("winbindd_reinit_after_fork failed.\n"));
+                _exit(0);
+        }
+ 
+        /* Handle online/offline messages. */
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_OFFLINE, child_msg_offline);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_ONLINE, child_msg_online);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_ONLINESTATUS, child_msg_onlinestatus);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_DUMP_EVENT_LIST, child_msg_dump_event_list);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_DEBUG, debug_message);
+        
+        primary_domain = find_our_domain();
+
+        if (primary_domain == NULL) {
+                smb_panic("no primary domain found");
+        }
+
+        /* It doesn't matter if we allow cache login,
+         * try to bring domain online after fork. */
         if ( child->domain ) {
                 child->domain->startup = True;
                 child->domain->startup_time = time(NULL);
-        }
-
-        /* Ensure we have no pending check_online events other
-           than one for this domain or the primary domain. */
-
-        for (domain = domain_list(); domain; domain = domain->next) {
-                if (domain->primary) {
-                        primary_domain = domain;
-                }
-                if ((domain != child->domain) && !domain->primary) {
-                        TALLOC_FREE(domain->check_online_event);
-                }
-        }
-
-        /* Ensure we're not handling an event inherited from
-           our parent. */
-
-        cancel_named_event(winbind_event_context(),
-                           "krb5_ticket_refresh_handler");
+                /* we can be in primary domain or in trusted domain
+                 * If we are in trusted domain, set the primary domain
+                 * in start-up mode */
+                if (!(child->domain->internal)) {
+                        set_domain_online_request(child->domain);
+                        if (!(child->domain->primary)) {
+                                primary_domain->startup = True;
+                                primary_domain->startup_time = time(NULL);
+                                set_domain_online_request(primary_domain);
+                        }
+                }
+        }
+        
+        /*
+         * We are in idmap child, make sure that we set the
+         * check_online_event to bring primary domain online.
+         */
+        if (child == idmap_child()) {
+                set_domain_online_request(primary_domain);
+        }
 
         /* We might be in the idmap child...*/
@@ -1225 +1310 @@
                         TALLOC_FREE(frame);
                         perror("select");
-                        return False;
+                        _exit(1);
                 }
 
@@ -1233 +1318 @@
                 if (state.finished) {
                         /* we lost contact with our parent */
-                        exit(0);
+                        _exit(0);
                 }
 

branches/samba-3.2.x/source/winbindd/winbindd_util.c

@@ -507 +507 @@
 {
         time_t now = time(NULL);
-        
+
+        /* Check that we allow trusted domains at all */
+        if (!lp_allow_trusted_domains())
+                return;
+
         /* see if the time has come... */
         
@@ -763 +767 @@
         DOM_SID dom_sid;
         uint32 rid;
-        
+
+        /* Check if we even care */
+
+        if (!lp_allow_trusted_domains())
+                return;
+
         domain = find_domain_from_name_noinit( name );
         if ( domain )