DJoin cannot find domain controllers

[AdamBertok]

Dear Tranquil IT team,

Apologies in advance for the English-language post.

I would like to ask whether anyone else has run into the following issue. I believe this may be a potential bug currently present in the WAPT console.

The symptom is as follows:
When preparing a machine with djoin under the OS Deploy tab, we get the error message "Cannot find any domain controllers for <domain>."

djoin.png (12.65 Kio) Consulté 2076 fois

I suspect this may be related to the most recent Samba update.
BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP when packet is larger than 4k
https://bugzilla.samba.org/show_bug.cgi?id=15988

According to the bug, Samba's internal DNS service redirects any UDP packet larger than 512 bytes to the TCP protocol.

Evidence:
Every time, I try to refresh and get domain controllers we the following traffic happen in the background.

wireshark.png (3.03 Kio) Consulté 2076 fois

WAPT console try to request _ldap._tcp.<domain>.
Samba internal dns response with the same payload indicating the TC flag, which should trigger TCP request from client side, but that request never happen.
In our case, the DNS response to this packet is larger than 512 bytes.

wireshark-tc.png (7.11 Kio) Consulté 2076 fois

The nslookup _ldap._tcp.<domain> from windows or command line just working fine.

Environment:
Samba:
- Debian 13 Trixie
- Samba Version: Sernet 4.24.6-4

WAPT:
- Debian 13 Trixie
- WAPT version: 2.6.1.17765

This issue is currently affecting several of our WAPT servers. Has anyone else run into this problem as well?

Thank you in advance!

[dcardon]

Hi Adam,

yes it definitely looks like a bug in the DNS handling. Actually one of my colleage Andréas dealt with the Samba team with the internal DNS bug where udp to tcp switch for large packet was not properly handled. At that time Andréas contributed a patch to switch to tcp for packet larger than 1232.

Recently someone had issue with router refusing udp packets larger than 512, so it was lowered even more in the last version of Samba

There seems indeed that there is a bug in the udp to tcp switch in the code of the DNS processing in the mORMot2 library. There is someone here looking into it and I'll get back to you soon.

Thanks for reporting the issue.

Denis