Bug 11758 - Wrong DsGetNCChanges response after DsReplicaSync during replication process with extended schema
Summary: Wrong DsGetNCChanges response after DsReplicaSync during replication process ...
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DCE-RPCs and pipes (show other bugs)
Version: 4.3.5
Hardware: All All
: P5 critical (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
Depends on:
Reported: 2016-02-25 19:40 UTC by Evgeny Sinelnikov (mail address dead)
Modified: 2017-08-15 21:38 UTC (History)
1 user (show)

See Also:

Wireshark screenshot with Samba DsGetNCChanges wrong response. (225.06 KB, image/png)
2016-02-25 19:40 UTC, Evgeny Sinelnikov (mail address dead)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Evgeny Sinelnikov (mail address dead) 2016-02-25 19:40:59 UTC
Created attachment 11870 [details]
Wireshark screenshot with Samba DsGetNCChanges wrong response.

During replication process initiated on Windows DC from Samba DC occurs "Error 8418: The replication operation failed because of a schema mismatch between the servers involved".

This error returns as DsReplicaSync() DCERPC response with error code 0x20e2 = 8418 - WERR_DS_DRA_SCHEMA_MISMATCH.

Problem reproduced on Samba after replication from Windows based Domain controller extended with Exchange 2003/2010 schema.

Command to reproduce (dc01 - WinDC, dc02 - SambaDC) problem:
# samba-tool drs replicate dc01 dc02 dc=company3,dc=dd
ERROR(<class 'samba.drs_utils.drsException'>): DsReplicaSync failed - drsException: DsReplicaSync failed (8418, 'WERR_DS_DRA_SCHEMA_MISMATCH')
  File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/drs.py", line 349, in run
    drs_utils.sendDsReplicaSync(self.drsuapi, self.drsuapi_handle, source_dsa_guid, NC, req_options)
  File "/usr/local/samba/lib64/python2.7/site-packages/samba/drs_utils.py", line 83, in sendDsReplicaSync
    raise drsException("DsReplicaSync failed %s" % estr)

Full wireshark and gdb using log proccess looks like:
- DsReplicaSync request - to Windows DC (from remote host)
- DsGetNCChanges request - from Windows DC to Samba DC
- DsGetNCChanges response - wrong DCERPC response from Samba DC!
- DsReplicaSync response - return WERR_DS_DRA_SCHEMA_MISMATCH.

There are various case of wrong DCERPC response:
- packet looks like old packet from previuos session with smaller call_id, than in current request;
- nca_s_fault_context_mismatch response packet;
- unknown encrypted packet.

Discussion of this investigation in mailing list:

Other errors, which looks similar:

Additional logs could be found here:
* test14: https://goo.gl/BSStsW (Problem with Samba DsGetNCChanges response on Windows request after DsReplicaSync)
* test13: https://goo.gl/2cr8xj (Original work between Windows DC's on same configuration)
Comment 1 Evgeny Sinelnikov (mail address dead) 2016-04-01 12:38:08 UTC
Recently I continued testing this problem:

And finally I found solution for it:

This is not due DCERPC interconnection, like I think. It is another, not critical cause for this problem. Real actually cause occurs due wrong attid in DsGetNCChanges response from Samba, like it here:
Comment 2 Evgeny Sinelnikov 2017-08-15 11:08:44 UTC
Fixed on commit 032fc2762ea47df069e02a55ad8d586ec75ff73c.

commit 032fc2762ea47df069e02a55ad8d586ec75ff73c
Author: Evgeny Sinelnikov <sin@altlinux.ru>
Date:   Tue Mar 29 18:37:40 2016 +0300

    rpc_server/drsuapi: Set msDS_IntId as attid for linked attributes if exists
    We got WERR_DS_DRA_SCHEMA_MISMATCH for linked attributes with 8418 error for
    extended attributes when using same attid as attribute object.
    Signed-off-by: Evgeny Sinelnikov <sin@altlinux.ru>
    Reviewed-by: Garming Sam <garming@catalyst.net.nz>
    Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Comment 3 Andrew Bartlett 2017-08-15 21:38:06 UTC
Marking as fixed per comment #2