serialise all domain auth requests

this is needed because W2K will send a TCP reset to any open
connections that have not done a negprot when a second connection is
made. This meant that under heavy netlogon load a Samba domain member
would fail authentications.

Jeremy, you may wish to port this to 2.2.x
(This used to be commit eb196070e62b45b113e5712f27198c50c5c95657)

1 files changed, 10 insertions, 1 deletions

diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c
index 9e5f32c9a3..947cd41a26 100644
--- a/source3/auth/auth_domain.c
+++ b/source3/auth/auth_domain.c
@@ -81,10 +81,19 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli,
 	   logonserver.  We can avoid a 30-second timeout if the DC is down
 	   if the SAMLOGON request fails as it is only over UDP. */
 
+	/* we use a mutex to prevent two connections at once - when a NT PDC gets
+	   two connections where one hasn't completed a negprot yet it will send a 
+	   TCP reset to the first connection (tridge) */
+	if (!message_named_mutex(server)) {
+		DEBUG(1,("domain mutex failed for %s\n", server));
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+	
 	/* Attempt connection */
-
 	result = cli_full_connection(cli, global_myname, server,
 				     &dest_ip, 0, "IPC$", "IPC", "", "", "", 0);
+
+	message_named_mutex_release(server);
 	
 	if (!NT_STATUS_IS_OK(result)) {
 		return result;