s4:winbind: add a netlogon_queue (tevent_queue)

This will protect the netlogon_creds later.

metze

2 files changed, 12 insertions, 0 deletions

diff --git a/source4/winbind/wb_init_domain.c b/source4/winbind/wb_init_domain.c
index 45a4b98f31..5e2aa47005 100644
--- a/source4/winbind/wb_init_domain.c
+++ b/source4/winbind/wb_init_domain.c
@@ -160,6 +160,13 @@ struct composite_context *wb_init_domain_send(TALLOC_CTX *mem_ctx,
 
 	state->domain->netlogon_pipe = NULL;
 
+	state->domain->netlogon_queue = tevent_queue_create(state->domain,
+							    "netlogon_queue");
+	if (state->domain->netlogon_queue == NULL) goto failed;
+
+	/* We start the queue when the connection is usable */
+	tevent_queue_stop(state->domain->netlogon_queue);
+
 	if ((!cli_credentials_is_anonymous(state->domain->libnet_ctx->cred)) &&
 	    ((lpcfg_server_role(service->task->lp_ctx) == ROLE_DOMAIN_MEMBER) ||
 	     (lpcfg_server_role(service->task->lp_ctx) == ROLE_ACTIVE_DIRECTORY_DC)) &&
@@ -211,6 +218,9 @@ static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
 	}
 	talloc_reparent(state, state->domain->netlogon_pipe, state->domain->netlogon_binding);
 
+	/* the netlogon connection is ready */
+	tevent_queue_start(state->domain->netlogon_queue);
+
 	state->domain->lsa_binding = init_domain_binding(state, &ndr_table_lsarpc);
 
 	/* For debugging, it can be a real pain if all the traffic is encrypted */
diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h
index 12dd1888ed..9b03004b28 100644
--- a/source4/winbind/wb_server.h
+++ b/source4/winbind/wb_server.h
@@ -68,6 +68,8 @@ struct wbsrv_domain {
 
 	struct dcerpc_pipe *netlogon_pipe;
 	struct dcerpc_binding *netlogon_binding;
+	/* netlogon_creds usage needs to be queued */
+	struct tevent_queue *netlogon_queue;
 };
 
 /*