[Samba] Problem after update version 4.15.0

[Ingo Asche]

Hi All,

I've just completed the git bisect:

*This is my own result list:*
commit 997fbcbc902d945eb5261ddc6667f830fbcd5931 (HEAD)
4.15.0pre1-GIT-997fbcbc902
Login failed (The one we already know)

commit 12ba3d9d8f2e480d92da16831e09af0d16709724 (HEAD)
4.15.0pre1-GIT-12ba3d9d8f2
Login works

commit 845a59919e528d083b1ab025844c41155ac93e43 (HEAD)
4.15.0pre1-GIT-845a59919e5
Login works

commit 26bb958af80199eda54e84d6ae427385d1843052 (HEAD)
4.15.0pre1-GIT-26bb958af80
Login failed

commit fd45bea7a88837cbe4f99adf3a6b3f69ce32f34c (HEAD)
4.15.0pre1-GIT-fd45bea7a88
Login works

commit 27b8709cf91ae692273956b64f9f3939eb6d36cc (HEAD)
4.15.0pre1-GIT-27b8709cf91
Login failed

commit 4e97e33c3b74d2d66420e9ef509431deae0e67a5 (HEAD)
4.15.0pre1-GIT-4e97e33c3b7
Login failed

commit 3e621dcb6966f75034bb948a2705358d43454202 (HEAD)
4.15.0pre1-GIT-3e621dcb696
Login works

commit bf71fa038e9b97f770e06e88226e885d67342d47 (HEAD)
4.15.0pre1-GIT-bf71fa038e9
Login works

commit edcb095c623a72fac049b6b1b2ab96f13c0a3c8a (HEAD)
4.15.0pre1-GIT-edcb095c623
Login failed

commit b3ee034b4d457607ef25a5b01da64e1eaf5906dd (HEAD)
4.15.0pre1-GIT-b3ee034b4d4
Login failed

*Message after last commit tested:*
b3ee034b4d457607ef25a5b01da64e1eaf5906dd is the first bad commit
commit b3ee034b4d457607ef25a5b01da64e1eaf5906dd
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Apr 10 23:10:28 2020 +0200

     s4:kdc: prefer newer enctypes for preauth responses

     This matches Windows KDCs, which was demonstrated by the
     krb5.as_req_tests tests.

     Signed-off-by: Stefan Metzmacher <metze at samba.org>
     Reviewed-by: Andrew Bartlett <abartlet at samba.org>

     Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
     Autobuild-Date(master): Thu Jul  1 18:37:14 UTC 2021 on sn-devel-184

:040000 040000 85b894b1c0893bd9b280bf09f405704ef9263061 
82f81bb5ff6a8428dd90d29c088970017850f4ab M      selftest
:040000 040000 4f166f3da6fb271df4965ac05666f67728492a6c 
f862aeebe5e0f6df34529701237b33fe86735ab8 M      source4

*And this is the bisect log:*
# good: [60cae14db1bbabe8459bb19e01f090303920bedc] VERSION: Disable 
GIT_SNAPSHOT for the 4.14.0rc1 release.
git bisect good 60cae14db1bbabe8459bb19e01f090303920bedc
# bad: [4fe965836243928ac33eb95a67d3e889fdc15861] s3: smbd: Ensure when 
we change security context we delete any $cwd cache.
git bisect bad 4fe965836243928ac33eb95a67d3e889fdc15861
# good: [153da186a1c85c5b33ddde43f6b81233f60f90d2] s3: smbd: 
smbd_check_access_rights_fsp(), for a symlink handle just check the 
handle bits.
git bisect good 153da186a1c85c5b33ddde43f6b81233f60f90d2
# bad: [997fbcbc902d945eb5261ddc6667f830fbcd5931] s3-dsgetdcname: return 
dcinfo also when delivering from the cache.
git bisect bad 997fbcbc902d945eb5261ddc6667f830fbcd5931
# good: [12ba3d9d8f2e480d92da16831e09af0d16709724] s4:registry: Migrate 
regpatch to new cmdline option parser
git bisect good 12ba3d9d8f2e480d92da16831e09af0d16709724
# good: [845a59919e528d083b1ab025844c41155ac93e43] s3:lib: add a new 
samba_path_matching* infrastructure
git bisect good 845a59919e528d083b1ab025844c41155ac93e43
# bad: [26bb958af80199eda54e84d6ae427385d1843052] dns_common_replace: 
comment in needs_add case
git bisect bad 26bb958af80199eda54e84d6ae427385d1843052
# good: [fd45bea7a88837cbe4f99adf3a6b3f69ce32f34c] 
tests/krb5/kdc_base_test.py: Add fallback methods to obtain client and 
krbtgt credentials
git bisect good fd45bea7a88837cbe4f99adf3a6b3f69ce32f34c
# bad: [27b8709cf91ae692273956b64f9f3939eb6d36cc] s3: lib: adouble.c: In 
ad_read_meta() we can now guarantee a valid fsp.
git bisect bad 27b8709cf91ae692273956b64f9f3939eb6d36cc
# bad: [4e97e33c3b74d2d66420e9ef509431deae0e67a5] s3: smbd: Code inside 
non_widelink_open() breaks an invarient inside the VFS. Demonstrate this.
git bisect bad 4e97e33c3b74d2d66420e9ef509431deae0e67a5
# good: [3e621dcb6966f75034bb948a2705358d43454202] tests/krb5: 
Deduplicate 'host' attribute initialisation
git bisect good 3e621dcb6966f75034bb948a2705358d43454202
# good: [bf71fa038e9b97f770e06e88226e885d67342d47] 
s4:torture/krb5/kdc-heimdal: Automatically determine AS-REP enctype to 
check against
git bisect good bf71fa038e9b97f770e06e88226e885d67342d47
# bad: [edcb095c623a72fac049b6b1b2ab96f13c0a3c8a] s3:libads: Remove 
extra new line in keytab list output
git bisect bad edcb095c623a72fac049b6b1b2ab96f13c0a3c8a
# bad: [b3ee034b4d457607ef25a5b01da64e1eaf5906dd] s4:kdc: prefer newer 
enctypes for preauth responses
git bisect bad b3ee034b4d457607ef25a5b01da64e1eaf5906dd
# first bad commit: [b3ee034b4d457607ef25a5b01da64e1eaf5906dd] s4:kdc: 
prefer newer enctypes for preauth responses

I will now test again the git revert as mentined in Andrew's last mail

Regards
Ingo

Łukasz Michalski via samba schrieb am 20.10.2021 um 09:59:
> On 9/28/21 23:24, Rainer Meier via samba wrote:
>> Somehow it does not affect workstations recently joined to the domain 
>> but seems to affect only workstations joined to the domain since a 
>> long time. Actually one workstation I am able to reproduce the issue 
>> is joined since 2016.
>> Re-joining the workstation might fix the issue but is not really an 
>> option I want to follow.
>>
>> Also resetting the computer account did not change anything.
>>
> I see the same here. My two machines that are members since 2019 has 
> problems, but recently added win10 works ok.
> I tried to rejoin one machine and leave/join works ok, but login is 
> still impossible after join.
>
> Regards,
> Łukasz
>
>