[PATCHES] Retry ping-dc when session expires

[Jeremy Allison]

On Mon, Dec 22, 2014 at 03:10:06PM -0800, Jeremy Allison wrote:
> On Fri, Dec 19, 2014 at 03:16:32PM -0700, Christof Schmitt wrote:
> > The call to wbinfo --ping-dc can return an error when the underlying SMB
> > connection expires. Since the goal of --ping-dc is to test whether the
> > DC is available, temporary session status changes should not be returned
> > to the caller.
> 
> > From c2d1e53f0f14f7c738d765d1add8ec3418f024f9 Mon Sep 17 00:00:00 2001
> > From: Christof Schmitt <cs at samba.org>
> > Date: Fri, 19 Dec 2014 12:24:53 -0700
> > Subject: [PATCH 1/2] winbind: Retry after SESSION_EXPIRED error in ping-dc
> > 
> > Trying to establish a netlogon connection when the service ticket
> > expires might fail with NT_STATUS_NETWORK_SESSION_EXPIRED. The
> > underlying client code already marks the session as invalid, so retry
> > the netlogon connect in this case.
> > 
> > Signed-off-by: Christof Schmit <cs at samba.org>
> > ---
> >  source3/winbindd/winbindd_dual_srv.c |    8 ++++++++
> >  1 files changed, 8 insertions(+), 0 deletions(-)
> > 
> > diff --git a/source3/winbindd/winbindd_dual_srv.c b/source3/winbindd/winbindd_dual_srv.c
> > index 108b201..769d8d5 100644
> > --- a/source3/winbindd/winbindd_dual_srv.c
> > +++ b/source3/winbindd/winbindd_dual_srv.c
> > @@ -675,6 +675,14 @@ NTSTATUS _wbint_PingDc(struct pipes_struct *p, struct wbint_PingDc *r)
> >  	}
> >  
> >  	status = cm_connect_netlogon(domain, &netlogon_pipe);
> > +
> > +	if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
> > +		/*
> > +		 * Retry to open new connection with new kerberos ticket.
> > +		 */
> 
> invalidate_cm_connection(domain)
> 
> is an idempotent call here. For safety's sake I'd prefer
> this patch to call invalidate_cm_connection(domain) before
> re-calling cm_connect_netlogon(). There are code paths out
> of cm_connect_netlogon() that don't shut down the connection.
> 
> Especially as you're calling invalidate_cm_connection(domain)
> below in the same situation.

Ping ! Christof, can you add the invalidate_cm_connection()
call and re-submit this one ? I pushed the second patch
already.

Cheers,

	Jeremy