Samba logs flooded by Decryption Failed

[DavidePrincipi]

Samba logs contain many "Decryption Failed" messages. Apparently everything works correctly, only log noise.

Steps to reproduce

• Configure a Samba AD provider with user first.user

• Install Mail

• Run an IMAP client, e.g.:

  curl -u first.user:Nethesis,1234 -v imap://127.0.0.1:143/INBOX
  

Expected results

Samba does not log any failure message

Actual results

6 lines of log are repeated:

# journalctl -f --grep Decrypt
Apr 16 16:29:02 rl1 samba-dc[102508]: TLS source4/lib/tls/tls_tstream.c:1449 - Decryption has failed. 
Apr 16 16:29:02 rl1 samba-dc[102508]: TLS source4/lib/tls/tls_tstream.c:1449 - Decryption has failed. 
Apr 16 16:29:02 rl1 samba-dc[102508]: TLS source4/lib/tls/tls_tstream.c:1449 - Decryption has failed. 
Apr 16 16:29:02 rl1 samba-dc[102508]: TLS source4/lib/tls/tls_tstream.c:1449 - Decryption has failed. 
Apr 16 16:29:02 rl1 samba-dc[102508]: TLS source4/lib/tls/tls_tstream.c:1449 - Decryption has failed. 
Apr 16 16:29:02 rl1 samba-dc[102508]: TLS source4/lib/tls/tls_tstream.c:1449 - Decryption has failed. 

See also

Discussion https://mattermost.nethesis.it/nethesis/pl/6ymk18w5ftnwzggd469kmyu1gw

[DavidePrincipi]

See the tcpdump attachment: decryption-failed-dovecot-auth-mixed-5.txt.pcap

It seems each log line corresponds to one RST,ACK TCP packet.

Note, in the testing environment:

• edited nginx.conf and set 127.0.0.1 as backend IP.
• edited dovecot-postlogin script to not run any LDAP query

---

The behavior is the same even if I replace Nginx with HAProxy. It seems Samba 4.19.5 is retrying the TLS handshake https://github.com/samba-team/samba/blob/7bef2f7f1c89bd635e318a2f860fdb7254ba1083/source4/lib/tls/tls_tstream.c#L1449