s3:libads: let cldap_ping_list() check for a blacklisted server name

If we black listed a server we should not use it even if
it responses to CLDAP requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Pair-Programmed-With: Ralph Boehme <slow@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 016402d5ca6c560951db3fe8c03764c6e2489c55..82d47341221721dd38f9310e5d45336dcb16dec3 100644 (file)
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -533,6 +533,30 @@ again:
 
                cldap_reply = &responses[i]->data.nt5_ex;
 
+               if (cldap_reply->pdc_dns_name != NULL) {
+                       status = check_negative_conn_cache(
+                               domain,
+                               cldap_reply->pdc_dns_name);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               /*
+                                * only use the server if it's not black listed
+                                * by name
+                                */
+                               DBG_NOTICE("realm=[%s] server=[%s][%s] "
+                                          "black listed: %s\n",
+                                          ads->server.realm,
+                                          server,
+                                          cldap_reply->pdc_dns_name,
+                                          nt_errstr(status));
+                               /* propagate blacklisting from name to ip */
+                               add_failed_connection_entry(domain,
+                                                           server,
+                                                           status);
+                               retry = true;
+                               continue;
+                       }
+               }
+
                /* Returns ok only if it matches the correct server type */
                ok = ads_fill_cldap_reply(ads,
                                          false,