Changeset 232 for branches/samba-3.2.x/source/winbindd/winbindd_dual.c

Timestamp:

May 27, 2009, 9:09:42 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.8

File:

• branches/samba-3.2.x/source/winbindd/winbindd_dual.c (modified) (10 diffs)

branches/samba-3.2.x/source/winbindd/winbindd_dual.c

@@ -881 +881 @@
 {
         struct winbindd_domain *domain;
+        struct winbindd_domain *primary_domain = NULL;
         const char *domainname = (const char *)data->data;
 
@@ -893 +894 @@
                 return;
         }
+
+        primary_domain = find_our_domain();
 
         /* Mark the requested domain offline. */
@@ -903 +906 @@
                         DEBUG(5,("child_msg_offline: marking %s offline.\n", domain->name));
                         set_domain_offline(domain);
+                        /* we are in the trusted domain, set the primary domain 
+                         * offline too */
+                        if (domain != primary_domain) {
+                                set_domain_offline(primary_domain);
+                        }
                 }
         }
@@ -916 +924 @@
 {
         struct winbindd_domain *domain;
+        struct winbindd_domain *primary_domain = NULL;
         const char *domainname = (const char *)data->data;
 
@@ -928 +937 @@
                 return;
         }
+
+        primary_domain = find_our_domain();
 
         /* Set our global state as online. */
@@ -943 +954 @@
                         winbindd_flush_negative_conn_cache(domain);
                         set_domain_online_request(domain);
+
+                        /* we can be in trusted domain, which will contact primary domain
+                         * we have to bring primary domain online in trusted domain process
+                         * see, winbindd_dual_pam_auth() --> winbindd_dual_pam_auth_samlogon()
+                         * --> contact_domain = find_our_domain()
+                         * */
+                        if (domain != primary_domain) {
+                                winbindd_flush_negative_conn_cache(primary_domain);
+                                set_domain_online_request(primary_domain);
+                        }
                 }
         }
@@ -1020 +1041 @@
 }
 
-
-static bool fork_domain_child(struct winbindd_child *child)
-{
-        int fdpair[2];
-        struct winbindd_cli_state state;
+void ccache_remove_all_after_fork(void);
+
+bool winbindd_reinit_after_fork(const char *logfilename)
+{
         struct winbindd_domain *domain;
-        struct winbindd_domain *primary_domain = NULL;
-
-        if (child->domain) {
-                DEBUG(10, ("fork_domain_child called for domain '%s'\n",
-                           child->domain->name));
-        } else {
-                DEBUG(10, ("fork_domain_child called without domain.\n"));
-        }
-
-        if (socketpair(AF_UNIX, SOCK_STREAM, 0, fdpair) != 0) {
-                DEBUG(0, ("Could not open child pipe: %s\n",
-                          strerror(errno)));
-                return False;
-        }
-
-        ZERO_STRUCT(state);
-        state.pid = sys_getpid();
-
-        child->pid = sys_fork();
-
-        if (child->pid == -1) {
-                DEBUG(0, ("Could not fork: %s\n", strerror(errno)));
-                return False;
-        }
-
-        if (child->pid != 0) {
-                /* Parent */
-                close(fdpair[0]);
-                child->next = child->prev = NULL;
-                DLIST_ADD(children, child);
-                child->event.fd = fdpair[1];
-                child->event.flags = 0;
-                child->requests = NULL;
-                add_fd_event(&child->event);
-                return True;
-        }
-
-        /* Child */
-
-        /* Stop zombies in children */
-        CatchChild();
-
-        state.sock = fdpair[0];
-        close(fdpair[1]);
-
-        if (!reinit_after_fork(winbind_messaging_context(), true)) {
+        struct winbindd_child *cl;
+
+        if (!reinit_after_fork(winbind_messaging_context(),
+                               winbind_event_context(), true)) {
                 DEBUG(0,("reinit_after_fork() failed\n"));
-                _exit(0);
+                return false;
         }
 
         close_conns_after_fork();
 
-        if (!override_logfile) {
-                lp_set_logfile(child->logfilename);
+        if (!override_logfile && logfilename) {
+                lp_set_logfile(logfilename);
                 reopen_logs();
         }
-
-        /*
-         * For clustering, we need to re-init our ctdbd connection after the
-         * fork
-         */
-        if (!NT_STATUS_IS_OK(messaging_reinit(winbind_messaging_context())))
-                exit(1);
 
         /* Don't handle the same messages as our parent. */
@@ -1108 +1079 @@
                              MSG_DEBUG, NULL);
 
-        /* Handle online/offline messages. */
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_WINBIND_OFFLINE, child_msg_offline);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_WINBIND_ONLINE, child_msg_online);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_WINBIND_ONLINESTATUS, child_msg_onlinestatus);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_DUMP_EVENT_LIST, child_msg_dump_event_list);
-        messaging_register(winbind_messaging_context(), NULL,
-                           MSG_DEBUG, debug_message);
-
+        /* We have destroyed all events in the winbindd_event_context
+         * in reinit_after_fork(), so clean out all possible pending
+         * event pointers. */
+
+        /* Deal with check_online_events. */
+
+        for (domain = domain_list(); domain; domain = domain->next) {
+                TALLOC_FREE(domain->check_online_event);
+        }
+
+        /* Ensure we're not handling a credential cache event inherited
+         * from our parent. */
+
+        ccache_remove_all_after_fork();
+
+        /* Destroy all possible events in child list. */
+        for (cl = children; cl != NULL; cl = cl->next) {
+                struct winbindd_async_request *request;
+
+                for (request = cl->requests; request; request = request->next) {
+                        TALLOC_FREE(request->reply_timeout_event);
+                }
+                TALLOC_FREE(cl->lockout_policy_event);
+
+                /* Children should never be able to send
+                 * each other messages, all messages must
+                 * go through the parent.
+                 */
+                cl->pid = (pid_t)0;
+        }
+        /*
+         * This is a little tricky, children must not
+         * send an MSG_WINBIND_ONLINE message to idmap_child().
+         * If we are in a child of our primary domain or
+         * in the process created by fork_child_dc_connect(),
+         * and the primary domain cannot go online,
+         * fork_child_dc_connection() sends MSG_WINBIND_ONLINE
+         * periodically to idmap_child().
+         *
+         * The sequence is, fork_child_dc_connect() ---> getdcs() --->
+         * get_dc_name_via_netlogon() ---> cm_connect_netlogon()
+         * ---> init_dc_connection() ---> cm_open_connection --->
+         * set_domain_online(), sends MSG_WINBIND_ONLINE to
+         * idmap_child(). Disallow children sending messages
+         * to each other, all messages must go through the parent.
+         */
+        cl = idmap_child();
+        cl->pid = (pid_t)0;
+
+        return true;
+}
+
+static bool fork_domain_child(struct winbindd_child *child)
+{
+        int fdpair[2];
+        struct winbindd_cli_state state;
+        struct winbindd_domain *primary_domain = NULL;
+
+        if (child->domain) {
+                DEBUG(10, ("fork_domain_child called for domain '%s'\n",
+                           child->domain->name));
+        } else {
+                DEBUG(10, ("fork_domain_child called without domain.\n"));
+        }
+
+        if (socketpair(AF_UNIX, SOCK_STREAM, 0, fdpair) != 0) {
+                DEBUG(0, ("Could not open child pipe: %s\n",
+                          strerror(errno)));
+                return False;
+        }
+
+        ZERO_STRUCT(state);
+        state.pid = sys_getpid();
+
+        child->pid = sys_fork();
+
+        if (child->pid == -1) {
+                DEBUG(0, ("Could not fork: %s\n", strerror(errno)));
+                return False;
+        }
+
+        if (child->pid != 0) {
+                /* Parent */
+                close(fdpair[0]);
+                child->next = child->prev = NULL;
+                DLIST_ADD(children, child);
+                child->event.fd = fdpair[1];
+                child->event.flags = 0;
+                add_fd_event(&child->event);
+                return True;
+        }
+
+        /* Child */
+
+        /* Stop zombies in children */
+        CatchChild();
+
+        state.sock = fdpair[0];
+        close(fdpair[1]);
+
+        if (!winbindd_reinit_after_fork(child->logfilename)) {
+                DEBUG(0, ("winbindd_reinit_after_fork failed.\n"));
+                _exit(0);
+        }
+ 
+        /* Handle online/offline messages. */
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_OFFLINE, child_msg_offline);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_ONLINE, child_msg_online);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_ONLINESTATUS, child_msg_onlinestatus);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_DUMP_EVENT_LIST, child_msg_dump_event_list);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_DEBUG, debug_message);
+        
+        primary_domain = find_our_domain();
+
+        if (primary_domain == NULL) {
+                smb_panic("no primary domain found");
+        }
+
+        /* It doesn't matter if we allow cache login,
+         * try to bring domain online after fork. */
         if ( child->domain ) {
                 child->domain->startup = True;
                 child->domain->startup_time = time(NULL);
-        }
-
-        /* Ensure we have no pending check_online events other
-           than one for this domain or the primary domain. */
-
-        for (domain = domain_list(); domain; domain = domain->next) {
-                if (domain->primary) {
-                        primary_domain = domain;
-                }
-                if ((domain != child->domain) && !domain->primary) {
-                        TALLOC_FREE(domain->check_online_event);
-                }
-        }
-
-        /* Ensure we're not handling an event inherited from
-           our parent. */
-
-        cancel_named_event(winbind_event_context(),
-                           "krb5_ticket_refresh_handler");
+                /* we can be in primary domain or in trusted domain
+                 * If we are in trusted domain, set the primary domain
+                 * in start-up mode */
+                if (!(child->domain->internal)) {
+                        set_domain_online_request(child->domain);
+                        if (!(child->domain->primary)) {
+                                primary_domain->startup = True;
+                                primary_domain->startup_time = time(NULL);
+                                set_domain_online_request(primary_domain);
+                        }
+                }
+        }
+        
+        /*
+         * We are in idmap child, make sure that we set the
+         * check_online_event to bring primary domain online.
+         */
+        if (child == idmap_child()) {
+                set_domain_online_request(primary_domain);
+        }
 
         /* We might be in the idmap child...*/
@@ -1225 +1310 @@
                         TALLOC_FREE(frame);
                         perror("select");
-                        return False;
+                        _exit(1);
                 }
 
@@ -1233 +1318 @@
                 if (state.finished) {
                         /* we lost contact with our parent */
-                        exit(0);
+                        _exit(0);
                 }