Bug 11758 - Wrong DsGetNCChanges response after DsReplicaSync during replication process with extended schema
Wrong DsGetNCChanges response after DsReplicaSync during replication process ...
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DCE-RPCs and pipes
4.3.5
All All
: P5 critical
: ---
Assigned To: Andrew Bartlett
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-25 19:40 UTC by Evgeny Sinelnikov
Modified: 2016-04-04 21:04 UTC (History)
1 user (show)

See Also:


Attachments
Wireshark screenshot with Samba DsGetNCChanges wrong response. (225.06 KB, image/png)
2016-02-25 19:40 UTC, Evgeny Sinelnikov
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Evgeny Sinelnikov 2016-02-25 19:40:59 UTC
Created attachment 11870 [details]
Wireshark screenshot with Samba DsGetNCChanges wrong response.

During replication process initiated on Windows DC from Samba DC occurs "Error 8418: The replication operation failed because of a schema mismatch between the servers involved".

This error returns as DsReplicaSync() DCERPC response with error code 0x20e2 = 8418 - WERR_DS_DRA_SCHEMA_MISMATCH.

Problem reproduced on Samba after replication from Windows based Domain controller extended with Exchange 2003/2010 schema.

Command to reproduce (dc01 - WinDC, dc02 - SambaDC) problem:
# samba-tool drs replicate dc01 dc02 dc=company3,dc=dd
ERROR(<class 'samba.drs_utils.drsException'>): DsReplicaSync failed - drsException: DsReplicaSync failed (8418, 'WERR_DS_DRA_SCHEMA_MISMATCH')
  File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/drs.py", line 349, in run
    drs_utils.sendDsReplicaSync(self.drsuapi, self.drsuapi_handle, source_dsa_guid, NC, req_options)
  File "/usr/local/samba/lib64/python2.7/site-packages/samba/drs_utils.py", line 83, in sendDsReplicaSync
    raise drsException("DsReplicaSync failed %s" % estr)


Full wireshark and gdb using log proccess looks like:
- DsReplicaSync request - to Windows DC (from remote host)
- DsGetNCChanges request - from Windows DC to Samba DC
- DsGetNCChanges response - wrong DCERPC response from Samba DC!
- DsReplicaSync response - return WERR_DS_DRA_SCHEMA_MISMATCH.

There are various case of wrong DCERPC response:
- packet looks like old packet from previuos session with smaller call_id, than in current request;
- nca_s_fault_context_mismatch response packet;
- unknown encrypted packet.


Discussion of this investigation in mailing list:
https://lists.samba.org/archive/samba-technical/2016-February/112361.html

Other errors, which looks similar:
https://bugzilla.samba.org/show_bug.cgi?id=10470
https://bugzilla.samba.org/show_bug.cgi?id=11172
https://bugzilla.samba.org/show_bug.cgi?id=11388
https://bugzilla.samba.org/show_bug.cgi?id=11415

Additional logs could be found here:
* test14: https://goo.gl/BSStsW (Problem with Samba DsGetNCChanges response on Windows request after DsReplicaSync)
* test13: https://goo.gl/2cr8xj (Original work between Windows DC's on same configuration)
Comment 1 Evgeny Sinelnikov 2016-04-01 12:38:08 UTC
Recently I continued testing this problem:
https://goo.gl/7CW3Gh

And finally I found solution for it:
https://lists.samba.org/archive/samba-technical/2016-April/113304.html

This is not due DCERPC interconnection, like I think. It is another, not critical cause for this problem. Real actually cause occurs due wrong attid in DsGetNCChanges response from Samba, like it here:
https://bugzilla.samba.org/show_bug.cgi?id=11443