s4-rpc_server: Allow listener for RPC servers to use multiple processes

To do this we must get the ncacn_ip_tcp listener to split out (for example)
netlogon onto a distinct port, so we change the registration code to split up each
ncacn_ip_tcp registration to create a new interface for indicated services.

The new option "rpc server port" allows control of the default port and
"rpc server port:netlogon" (also valid for any other pipe from the IDL name)
allows us to both work around limitations in socket_wrapper against
double-binding and allows specification of the port by the administrator.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

1 files changed, 36 insertions, 6 deletions

diff --git a/source4/rpc_server/service_rpc.c b/source4/rpc_server/service_rpc.c
index 95f5e4244b0..63418f41ddf 100644
--- a/source4/rpc_server/service_rpc.c
+++ b/source4/rpc_server/service_rpc.c
@@ -49,16 +49,21 @@ static void dcesrv_task_init(struct task_server *task)
 	NTSTATUS status;
 	struct dcesrv_context *dce_ctx;
 	struct dcesrv_endpoint *e;
-	const struct model_ops *model_ops;
+	const struct model_ops *single_model_ops;
 
 	dcerpc_server_init(task->lp_ctx);
 
 	task_server_set_title(task, "task[dcesrv]");
 
-	/* run the rpc server as a single process to allow for shard
-	 * handles, and sharing of ldb contexts */
-	model_ops = process_model_startup("single");
-	if (!model_ops) goto failed;
+	/*
+	 * run the rpc server as a single process to allow for shard
+	 * handles, and sharing of ldb contexts.
+	 *
+	 * We make an exception for NETLOGON below, and this follows
+	 * whatever the top level is.
+	 */
+	single_model_ops = process_model_startup("single");
+	if (!single_model_ops) goto failed;
 
 	status = dcesrv_init_context(task->event_ctx,
 				     task->lp_ctx,
@@ -72,17 +77,42 @@ static void dcesrv_task_init(struct task_server *task)
 	}
 
 	for (e=dce_ctx->endpoint_list;e;e=e->next) {
+		const struct model_ops *this_model_ops = single_model_ops;
+
 		enum dcerpc_transport_t transport =
 			dcerpc_binding_get_transport(e->ep_description);
 
+		/*
+		 * Ensure that -Msingle sets e->use_single_process for
+		 * consistency
+		 */
+
+		if (task->model_ops == single_model_ops) {
+			e->use_single_process = true;
+		}
+
 		if (transport == NCACN_HTTP) {
 			/*
 			 * We don't support ncacn_http yet
 			 */
 			continue;
+
+			/*
+			 * For the next two cases, what we are trying
+			 * to do is put the NETLOGON server into the
+			 * standard process model, not single, as it
+			 * has no shared handles and takes a very high
+			 * load.  We only do this for ncacn_np and
+			 * ncacn_ip_tcp as otherwise it is too hard as
+			 * all servers share a socket for ncalrpc and
+			 * unix.
+			 */
+		} else if (e->use_single_process == false) {
+			this_model_ops = task->model_ops;
 		}
 
-		status = dcesrv_add_ep(dce_ctx, task->lp_ctx, e, task->event_ctx, model_ops);
+		status = dcesrv_add_ep(dce_ctx, task->lp_ctx, e, task->event_ctx,
+				       this_model_ops);
 		if (!NT_STATUS_IS_OK(status)) goto failed;
 	}