Volker Lendecke afd014245a test: Prime the kpasswd server ... I was getting this failure: [102(815)/143 at 10m59s] samba4.blackbox.net_ads_dns(ad_member:local)(ad_member:local) UNEXPECTED(failure): samba4.blackbox.net_ads_dns(ad_member:local).Adding an unprivileged user(ad_member:local) REASON: Exception: Exception: Could not add user unprivuser. Error setting password Incorrect net address My preliminary analysis shows that the KRB5KRB_AP_ERR_BADADDR error message is triggered by the libkrb5 client code. I have not yet shown this to happen with pure libkrb5, but my theory is the following: k5_privsafe_check_addrs() fails under the following circumstances: The kpasswd server is contacted on IPv4 and is slow to reply. After waiting a bit, libkrb5 also tries to contact kpasswd on IPv6. kpasswd_sendto_msg_callback() for the IPv6 request changes the authentication context's local_addr to IPv6. Then the IPv4 request is replied to, and then k5_privsafe_check_addrs() bails on the address family in ac->local_addr (IPv6) vs the one received and via the IPv4 connection. libkrb5's src/lib/krb5/os/changepw.c has this comment: /* * TBD: Does this tamper w/ the auth context in such a way * to break us? Yes - provide 1 per conn-state / host... */ I think we're hit by this. This patch hacks around the situation by priming the kpasswd server without error checking. If the initial v4 request is quick enough because the kpasswd server is already started up properly, everything works flawlessly. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>		2021-12-10 14:02:30 +00:00
..
blackbox	test: Prime the kpasswd server	2021-12-10 14:02:30 +00:00
win32	lib: talloc: Use the system <talloc.h> include.	2017-08-17 00:53:48 +02:00