Bug 1109102

This bug also exists on RHEL-7.
krb5-libs-1.11.3-49.el7

+++ This bug was initially created as a clone of Bug #1059730 +++

Description of problem:

I have been trying to connect Samba to an Active Directory forest(A), which has a trust to another forest(B).
The connection to AD forest A works, but the connection to forest B, did not work.

Forest B consist of a domain with 3 AD servers present in SRV records in DNS (external DNS provided by Infoblox).
However one of these three AD server does not exist anymore.

After debugging the connection between Samba and the cross-forest AD trust, I found the reason for the connection to fail in the Kerberos library (krb5-libs).

The AD servers are contacted through the function k5_sendto(), which uses the function resolve_server() which tries to find an IP address for each AD (Kerberos) server.
resolve_server() calls the system function getaddrinfo(), which returns EAI_NODATA (-5) for the nonexisting AD server on my Linux server.

To determine whether getaddrinfo() encounters a critical error, the function translate_ai_error() is called, which contains a case statement for each possible return code for getaddrinfo(). When a critical error is found, translate_ai_error returns a system error code, not equal to 0. Since the return code EAI_NODATA is not a critical error, it should return 0, so k5_sendto() can try to contact the next AD/Kerberos server found.

However, since the Kerberos library (or sendto_kdc.c) is compiled without _GNU_SOURCE being defined, EAI_NODATA is not defined, causing the case statement in translate_ai_error() to hit the default: option and return EINVAL, instead of 0. This in turn, causes k5_sendto() to stop trying to contact any other AD/Kerberos server and fail with an error code.

When compiling sendto_kdc.c with _GNU_SOURCE being defined, EAI_NODATA is defined and the case statement correctly returns 0, which will let the k5_sendto() continue to try the next AD/Kerberos server, which can be contacted succesfully. Samba is then able to contact both AD forests and everything works.


Version-Release number of selected component (if applicable):

CentOS 6.5:
krb5-libs-1.10.3-10.el6_4.6

How reproducible:

Create an AD forest with a number of AD domain servers, where 1 (or more) of the AD servers does not have an A record in DNS, but does have the correct SRV records present in DNS. Then connect Samba to this domain (security=ads) (a cross-forest trust to another domain is probably not necessary) and try to list users from the domain using:

$ id 'DOMAIN\user'

Steps to Reproduce:
1. Set up an AD domain with a number of AD domain servers
2. Install a RedHat Linux server, with Samba
2. Connect Samba to this domain (security=ads)
3. Configure the Linux server to get user information from winbind and authenticate through Kerberos (using authconfig-tui)
4. Remove the DNS A record for one or more of the AD domain servers
5. Try to fetch the information for this user, using: id 'DOMAIN\user'

Actual results:

id: DOMAIN\user: No such user

Expected results:

uid=10000000(DOMAIN\user) gid=10000000(DOMAIN\domain users) groups=10000000(DOMAIN\domain users)

Additional info:

I added 2 preprocessed listings of the translate_ai_error() function, 1 with _GNU_SOURCE being defined and the other file not having _GNU_SOURCE defined.

I also attached a diff file for the krb5.spec file, which results in a Kerberos library which I tested and works in my environment.