s3:winbindd: make use of reset_cm_connection_on_error() in winbind_samlogon_retry_loop()

Note this is more than a simple invalidate_cm_connection() as it may set
domain->conn.netlogon_force_reauth = true, which is important in order
to recover from NT_STATUS_RPC_SEC_PKG_ERROR errors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15413

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit b317b10dffd99d1add3ff0b85b958edd9639abc8)

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index d870188767e703a45958eba1b09b69c30e297f75..9953ffeb94b175a9ace9acc854df71bd3c982c64 100644 (file)
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -1678,6 +1678,8 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                                 "(error: %s, attempts: %d)\n",
                                  nt_errstr(result), netr_attempts));
 
+                       reset_cm_connection_on_error(domain, NULL, result);
+
                        /* After the first retry always close the connection */
                        if (netr_attempts > 0) {
                                DEBUG(3, ("This is again a problem for this "
@@ -1800,27 +1802,21 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                   might not yet have noticed that the DC has killed
                   our connection. */
 
-               if (!rpccli_is_connected(netlogon_pipe)) {
-                       retry = true;
+               retry = reset_cm_connection_on_error(domain,
+                                                    netlogon_pipe->binding_handle,
+                                                    result);
+               if (retry) {
+                       DBG_PREFIX(attempts > 1 ? DBGLVL_NOTICE : DBGLVL_INFO, (
+                                  "This is problem %d for this "
+                                  "particular call,"
+                                  "DOMAIN[%s] DC[%s] - %s\n",
+                                  attempts,
+                                  domain->name,
+                                  domain->dcname,
+                                  nt_errstr(result)));
                        continue;
                }
 
-               /* if we get access denied, a possible cause was that we had
-                  an open connection to the DC, but someone changed our
-                  machine account password out from underneath us using 'net
-                  rpc changetrustpw' */
-
-               if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
-                       DEBUG(1,("winbind_samlogon_retry_loop: sam_logon returned "
-                                "ACCESS_DENIED.  Maybe the DC has Restrict "
-                                "NTLM set or the trust account "
-                               "password was changed and we didn't know it. "
-                                "Killing connections to domain %s\n",
-                               domainname));
-                       invalidate_cm_connection(domain);
-                       retry = true;
-               }
-
                if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
                        /*
                         * Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
@@ -1845,15 +1841,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                        break;
                }
 
-       } while ( (attempts < 2) && retry );
-
-       if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
-               DEBUG(3,("winbind_samlogon_retry_loop: sam_network_logon(ex) "
-                               "returned NT_STATUS_IO_TIMEOUT after the retry. "
-                               "Killing connections to domain %s\n",
-                       domainname));
-               invalidate_cm_connection(domain);
-       }
+       } while ( (attempts < 3) && retry );
 
        if (!NT_STATUS_IS_OK(result)) {
                return result;