attid fixes (Re: [SCM] Samba Shared Repository - branch master updated)

[Stefan Metzmacher]

Am 10.03.2016 um 04:26 schrieb Andrew Bartlett:
> On Thu, 2016-03-10 at 08:56 +1300, Andrew Bartlett wrote:
>> On Wed, 2016-03-09 at 11:06 +0100, Stefan Metzmacher wrote:
>>>
>>> Am 08.03.2016 um 22:42 schrieb Stefan Metzmacher:
>>>>
>>>>
>>>> Hi Andrew,
>>>>
>>>> I just got this failure while trying to push the security patches
>>>> to master.
>>>>
>>>> [1897(19151)/1898 at 2h51m55s]
>>>> samba4.blackbox.dbcheck(vampire_dc)
>>>> UNEXPECTED(failure):
>>>> samba4.blackbox.dbcheck(vampire_dc).dbcheck(vampire_dc:local)
>>>> REASON: Exception: Exception: Checking 7367 objects
>>>> ERROR: attributeID 0X5C000D is not known in our schema, not
>>>> fixing
>>>> replPropertyMetaData on
>>>> CN=DrsReplSchema-1457451558-3-cls-
>>>> B,CN=Schema,CN=Configuration,DC=samba,DC=example,DC=com
>>>>
>>>> Please use --fix to fix these errors
>>>> Checked 7367 objects (1 errors)
>>>>
>>>> FAILED (1 failures, 0 errors and 0 unexpected successes in 0
>>>> testsuites)
>>>>
>>>> A summary with detailed information can be found in:
>>>>   ./bin/ab/summary
>>>> TOP 10 slowest tests
>>>>
>>>> Please have a look.
>>> This is also quite often now:
>>>
>>> [28(449)/1892 at 10m1s] samba4.blackbox.dbcheck.release-4-1-0rc3
>>> UNEXPECTED(failure):
>>> samba4.blackbox.dbcheck.release-4-1-
>>> 0rc3.check_expected_after_dup_values(none)
>>> REASON: Exception: Exception: 4,5d3
>>> < # record 1
>>> < # returned 1 records
>>> 9a8,9
>>>>
>>>>
>>>> # record 1
>>>> # returned 1 records
>>> FAILED (1 failures, 0 errors and 0 unexpected successes in 0
>>> testsuites)
>>>
>>> https://git.samba.org/autobuild.flakey.sn-devel-104/2016-03-09-0827
>>> /s
>>> amba.stdout
>>> https://git.samba.org/autobuild.flakey.sn-devel-104/2016-03-09-0030
>>> /s
>>> amba.stdout
>>>
>>> Should we mark the dbcheck test as flapping again?
>> This only happens on 12.04, and is fixed by
>> ca9bbc8cc5bdf83de532d7afe094e35cdeee788c
>>
>> There are other issues that have been exposed, like the one you saw
>> for
>> attributeID 0X5C000D.  I expect to make good progress on those today,
>> otherwise we have no choice but to mark it flapping (which would be
>> sad, given it is one of the few protections against a large number of
>> issues in our AD DC).
> 
> Attached is a fix for this issue (actually showing up a pretty serious
> issue with custom schema in Samba domains).
> 
> I'm running private autobuilds to verify, and I'll push tomorrow or you
> can push it if you need to get some other patches in.  It passes the
> local tests well, and could explain a lot of issues.
> 
> I test with:
> make test TESTS="dbcheck.vam dbcheck.pro repl_schema"

This explains a lot! Do we have dbcheck code to fix this?

I'm also wondering if it really correct that the prefix map will
differ in a pure Windows domain. Shouldn't the destination dc
import the prefix map from the source dc when replicating schema changes?

But the fact that [MS-DRSR] has a LocalAttidFromRemoteAttid() function,
it might also be possible the prefixMap will be different on Windows too.
Are you able to verify this?

For I created https://bugzilla.samba.org/show_bug.cgi?id=11783 for this
and this can be pushed with the bug url and my review.

Thanks!
metze

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20160310/f935fa0d/signature.sig>