thr3ads.net - samba - [Samba] Error "Failed extended allocation RID pool operation..." [Sep 2016]

If this information is useful, please help other people find it:
Share via:

Adam Tauno Williams

2016-Sep-19 13:31 UTC

[Samba] Error "Failed extended allocation RID pool operation..."

Package: sernet-samba-4.2.14-23.el6.x86_64

These DCs were very recently upgraded from a prior version.

[2016/09/19 09:32:55.168161,  0]
../source4/libcli/smb2/signing.c:116(smb2_check_signature)
  Bad SMB2 signature for message of size 202
[2016/09/19 09:32:55.168511,  0] ../lib/util/util.c:559(dump_data)
  [0000] 77 B3 94 9B 70 78 8B 21   1E 56 D0 78 E1 80 BB 5C   w...px.!
.V.x...\
[2016/09/19 09:32:55.168716,  0] ../lib/util/util.c:559(dump_data)
  [0000] 17 AB 09 20 81 BD 6B FD   5B 12 89 98 6A 79 3B FE   ... ..k.
[...jy;.
[2016/09/19 09:32:55.189708,  0]
../source4/libcli/smb2/signing.c:116(smb2_check_signature)
  Bad SMB2 signature for message of size 208
[2016/09/19 09:32:55.189999,  0] ../lib/util/util.c:559(dump_data)
  [0000] 26 35 A6 E2 D7 47 17 4D   1A 0A 07 E2 8E B8 5B DC   &5...G.M
......[.
[2016/09/19 09:32:55.190219,  0] ../lib/util/util.c:559(dump_data)
  [0000] 21 19 4D 88 60 9A D5 4E   46 08 73 B0 A7 A0 22 B6   !.M.`..N
F.s...".
[2016/09/19 09:32:55.208830,  0]
../source4/libcli/smb2/signing.c:116(smb2_check_signature)
  Bad SMB2 signature for message of size 217
[2016/09/19 09:32:55.209092,  0] ../lib/util/util.c:559(dump_data)
  [0000] 9F FD 03 E1 61 4B 32 A8   9F 9D 50 DE 25 47 C0 AF   ....aK2.
..P.%G..
[2016/09/19 09:32:55.209305,  0] ../lib/util/util.c:559(dump_data)
  [0000] C8 6B 73 58 EC 59 4E 06   46 26 7E DA D5 DE 4E 8F   .ksX.YN.
F&~...N.
[2016/09/19 09:33:02.991790,  0]
../source4/rpc_server/drsuapi/getncchanges.c:807(getncchanges_rid_alloc
)
  ../source4/rpc_server/drsuapi/getncchanges.c:807: Failed extended
allocation RID pool operation - Failed to modify RID Set object CN=RID
Set,CN=LARKIN28,OU=Domain Controllers,DC=micore,DC=us -
objectclass_attrs: at least one mandatory attribute ('rIDNextRID') on
entry 'CN=RID Set,CN=LARKIN28,OU=Domain Controllers,DC=micore,DC=us'
wasn't specified!
[2016/09/19 09:33:03.814390,  0]
../source4/smb_server/smb2/sesssetup.c:242(smb2srv_cleanup_session_dest
ructor)

-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
Systems Administrator, Python Developer, LPI / NCLA

Adam Tauno Williams

2016-Sep-19 13:56 UTC

head link

[Samba] Error "Failed extended allocation RID pool operation..."

On Mon, 2016-09-19 at 09:31 -0400, Adam Tauno Williams via samba
wrote:> Package: sernet-samba-4.2.14-23.el6.x86_64
> These DCs were very recently upgraded from a prior version.
> [2016/09/19 09:32:55.168161,  0]
> ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
>   Bad SMB2 signature for message of size 202
>   ../source4/rpc_server/drsuapi/getncchanges.c:807: Failed extended
> allocation RID pool operation - Failed to modify RID Set object
> CN=RID
> Set,CN=LARKIN28,OU=Domain Controllers,DC=micore,DC=us -
> objectclass_attrs: at least one mandatory attribute ('rIDNextRID')
on
> entry 'CN=RID Set,CN=DC3,OU=Domain Controllers,DC=example,DC=us'
> wasn't specified!
> [2016/09/19 09:33:03.814390,  0]
> ../source4/smb_server/smb2/sesssetup.c:242(smb2srv_cleanup_session_de
> structor)
Verified that the rIDNextRID attribute only has an ID on one of the
DC's.  My understanding is that this is correct;  should Samba not be
attempting to replicate this attribute?

Checked
  CN=RID Set,CN=DC3,OU=Domain Controllers,DC=example,DC=us
  CN=RID Set,CN=DC2,OU=Domain Controllers,DC=example,DC=us
  CN=RID Set,CN=DC1,OU=Domain Controllers,DC=example,DC=us

<https://msdn.microsoft.com/en-us/library/cc220818.aspx>
 cn: RID-Next-RID
 ldapDisplayName: rIDNextRID
 attributeId: 1.2.840.113556.1.4.374
 attributeSyntax: 2.5.5.9
 omSyntax: 2
 isSingleValued: TRUE
 schemaIdGuid: 6617188c-8f3c-11d0-afda-00c04fd930c9
 systemOnly: TRUE
 searchFlags: 0
 systemFlags: FLAG_SCHEMA_BASE_OBJECT | FLAG_ATTR_NOT_REPLICATED
 schemaFlagsEx: FLAG_ATTR_IS_CRITICAL
  

-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
Systems Administrator, Python Developer, LPI / NCLA

Rowland Penny

2016-Sep-19 14:15 UTC

head link

[Samba] Error "Failed extended allocation RID pool operation..."

On Mon, 19 Sep 2016 09:56:16 -0400
Adam Tauno Williams via samba <samba at lists.samba.org> wrote:
> On Mon, 2016-09-19 at 09:31 -0400, Adam Tauno Williams via samba
> wrote:
> > Package: sernet-samba-4.2.14-23.el6.x86_64
> > These DCs were very recently upgraded from a prior version.
> > [2016/09/19 09:32:55.168161,  0]
> > ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
> >   Bad SMB2 signature for message of size 202
> >   ../source4/rpc_server/drsuapi/getncchanges.c:807: Failed extended
> > allocation RID pool operation - Failed to modify RID Set object
> > CN=RID
> > Set,CN=LARKIN28,OU=Domain Controllers,DC=micore,DC=us -
> > objectclass_attrs: at least one mandatory attribute
('rIDNextRID')
> > on entry 'CN=RID Set,CN=DC3,OU=Domain
Controllers,DC=example,DC=us'
> > wasn't specified!
> > [2016/09/19 09:33:03.814390,  0]
> > ../source4/smb_server/smb2/sesssetup.c:242(smb2srv_cleanup_session_de
> > structor)
> 
> Verified that the rIDNextRID attribute only has an ID on one of the
> DC's.  My understanding is that this is correct;  should Samba not be
> attempting to replicate this attribute?
> 
> Checked
>   CN=RID Set,CN=DC3,OU=Domain Controllers,DC=example,DC=us
>   CN=RID Set,CN=DC2,OU=Domain Controllers,DC=example,DC=us
>   CN=RID Set,CN=DC1,OU=Domain Controllers,DC=example,DC=us
> 
> <https://msdn.microsoft.com/en-us/library/cc220818.aspx>
>  cn: RID-Next-RID
>  ldapDisplayName: rIDNextRID
>  attributeId: 1.2.840.113556.1.4.374
>  attributeSyntax: 2.5.5.9
>  omSyntax: 2
>  isSingleValued: TRUE
>  schemaIdGuid: 6617188c-8f3c-11d0-afda-00c04fd930c9
>  systemOnly: TRUE
>  searchFlags: 0
>  systemFlags: FLAG_SCHEMA_BASE_OBJECT | FLAG_ATTR_NOT_REPLICATED
>  schemaFlagsEx: FLAG_ATTR_IS_CRITICAL
>   
> 
No it shouldn't be replicated, the big hint is
'FLAG_ATTR_NOT_REPLICATED', it should only be on the DC that holds the
RID master FSMO role, so I supposed the question is, what does
'samba-tool fsmo show' display for the RidAllocationMasterRole ?

Rowland

Andrew Bartlett

2016-Sep-20 04:46 UTC

head link

[Samba] Error "Failed extended allocation RID pool operation..."

On Mon, 2016-09-19 at 09:31 -0400, Adam Tauno Williams via samba
wrote:> Package: sernet-samba-4.2.14-23.el6.x86_64
> 
> These DCs were very recently upgraded from a prior version.
> 
> [2016/09/19 09:32:55.168161,  0]
> ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
>   Bad SMB2 signature for message of size 202
> [2016/09/19 09:32:55.168511,  0] ../lib/util/util.c:559(dump_data)
>   [0000] 77 B3 94 9B 70 78 8B 21   1E 56 D0 78 E1 80 BB 5C   w...px.!
> .V.x...\
> [2016/09/19 09:32:55.168716,  0] ../lib/util/util.c:559(dump_data)
>   [0000] 17 AB 09 20 81 BD 6B FD   5B 12 89 98 6A 79 3B FE   ... ..k.
> [...jy;.
> [2016/09/19 09:32:55.189708,  0]
> ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
>   Bad SMB2 signature for message of size 208
> [2016/09/19 09:32:55.189999,  0] ../lib/util/util.c:559(dump_data)
>   [0000] 26 35 A6 E2 D7 47 17 4D   1A 0A 07 E2 8E B8 5B DC   &5...G.M
> ......[.
> [2016/09/19 09:32:55.190219,  0] ../lib/util/util.c:559(dump_data)
>   [0000] 21 19 4D 88 60 9A D5 4E   46 08 73 B0 A7 A0 22 B6   !.M.`..N
> F.s...".
> [2016/09/19 09:32:55.208830,  0]
> ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
>   Bad SMB2 signature for message of size 217
> [2016/09/19 09:32:55.209092,  0] ../lib/util/util.c:559(dump_data)
>   [0000] 9F FD 03 E1 61 4B 32 A8   9F 9D 50 DE 25 47 C0 AF   ....aK2.
> ..P.%G..
> [2016/09/19 09:32:55.209305,  0] ../lib/util/util.c:559(dump_data)
>   [0000] C8 6B 73 58 EC 59 4E 06   46 26 7E DA D5 DE 4E 8F   .ksX.YN.
> F&~...N.
> [2016/09/19 09:33:02.991790,  0]
> ../source4/rpc_server/drsuapi/getncchanges.c:807(getncchanges_rid_all
> oc
> )
>   ../source4/rpc_server/drsuapi/getncchanges.c:807: Failed extended
> allocation RID pool operation - Failed to modify RID Set object
> CN=RID
> Set,CN=LARKIN28,OU=Domain Controllers,DC=micore,DC=us -
> objectclass_attrs: at least one mandatory attribute ('rIDNextRID')
on
> entry 'CN=RID Set,CN=LARKIN28,OU=Domain
Controllers,DC=micore,DC=us'
> wasn't specified!
> [2016/09/19 09:33:03.814390,  0]
> ../source4/smb_server/smb2/sesssetup.c:242(smb2srv_cleanup_session_de
> st
> ructor)
To provide some background on this to avoid speculation:

rIDNextRid is a non-replicated attribute.  However it is also a
mandatory attribute.  This creates issues, because our code tries to
enforce the schema, even on 'system' operations, but this confusion as
to if the attribute should always be present causes us pain.

We just fixed a similar issue here: https://bugzilla.samba.org/show_bug
.cgi?id=12178

The issue is that the FSMO master doesn't ever see the ridNextRid
value, so if you add most of your users on the non-FSMO server, then
this will happen when the pool needs refreshing. 

It is too late here for me to safely suggest hacks, but I can think of
workarounds to satisfy the check until we can just remove it properly.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Andrew Bartlett

2016-Sep-23 03:17 UTC

head link

[Samba] Error "Failed extended allocation RID pool operation..."

On Mon, 2016-09-19 at 23:46 -0500, Andrew Bartlett via samba
wrote:> On Mon, 2016-09-19 at 09:31 -0400, Adam Tauno Williams via samba
> wrote:
> > 
> > Package: sernet-samba-4.2.14-23.el6.x86_64
> > 
> > These DCs were very recently upgraded from a prior version.
> > 
> > [2016/09/19 09:32:55.168161,  0]
> > ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
> >   Bad SMB2 signature for message of size 202
> > [2016/09/19 09:32:55.168511,  0] ../lib/util/util.c:559(dump_data)
> >   [0000] 77 B3 94 9B 70 78 8B 21   1E 56 D0 78 E1 80 BB
> > 5C   w...px.!
> > .V.x...\
> > [2016/09/19 09:32:55.168716,  0] ../lib/util/util.c:559(dump_data)
> >   [0000] 17 AB 09 20 81 BD 6B FD   5B 12 89 98 6A 79 3B FE   ...
> > ..k.
> > [...jy;.
> > [2016/09/19 09:32:55.189708,  0]
> > ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
> >   Bad SMB2 signature for message of size 208
> > [2016/09/19 09:32:55.189999,  0] ../lib/util/util.c:559(dump_data)
> >   [0000] 26 35 A6 E2 D7 47 17 4D   1A 0A 07 E2 8E B8 5B
> > DC   &5...G.M
> > ......[.
> > [2016/09/19 09:32:55.190219,  0] ../lib/util/util.c:559(dump_data)
> >   [0000] 21 19 4D 88 60 9A D5 4E   46 08 73 B0 A7 A0 22
> > B6   !.M.`..N
> > F.s...".
> > [2016/09/19 09:32:55.208830,  0]
> > ../source4/libcli/smb2/signing.c:116(smb2_check_signature)
> >   Bad SMB2 signature for message of size 217
> > [2016/09/19 09:32:55.209092,  0] ../lib/util/util.c:559(dump_data)
> >   [0000] 9F FD 03 E1 61 4B 32 A8   9F 9D 50 DE 25 47 C0
> > AF   ....aK2.
> > ..P.%G..
> > [2016/09/19 09:32:55.209305,  0] ../lib/util/util.c:559(dump_data)
> >   [0000] C8 6B 73 58 EC 59 4E 06   46 26 7E DA D5 DE 4E
> > 8F   .ksX.YN.
> > F&~...N.
> > [2016/09/19 09:33:02.991790,  0]
> > ../source4/rpc_server/drsuapi/getncchanges.c:807(getncchanges_rid_a
> > ll
> > oc
> > )
> >   ../source4/rpc_server/drsuapi/getncchanges.c:807: Failed extended
> > allocation RID pool operation - Failed to modify RID Set object
> > CN=RID
> > Set,CN=LARKIN28,OU=Domain Controllers,DC=micore,DC=us -
> > objectclass_attrs: at least one mandatory attribute
('rIDNextRID')
> > on
> > entry 'CN=RID Set,CN=LARKIN28,OU=Domain
> > Controllers,DC=micore,DC=us'
> > wasn't specified!
> > [2016/09/19 09:33:03.814390,  0]
> > ../source4/smb_server/smb2/sesssetup.c:242(smb2srv_cleanup_session_
> > de
> > st
> > ructor)
> 
> To provide some background on this to avoid speculation:
> 
> rIDNextRid is a non-replicated attribute.  However it is also a
> mandatory attribute.  This creates issues, because our code tries to
> enforce the schema, even on 'system' operations, but this confusion
> as
> to if the attribute should always be present causes us pain.
> 
> We just fixed a similar issue here: https://bugzilla.samba.org/show_b
> ug
> .cgi?id=12178
> 
> The issue is that the FSMO master doesn't ever see the ridNextRid
> value, so if you add most of your users on the non-FSMO server, then
> this will happen when the pool needs refreshing. 
> 
> It is too late here for me to safely suggest hacks, but I can think
> of
> workarounds to satisfy the check until we can just remove it
> properly.
My untested thoughts are to set ridNextRid to 0 on the DC holding the
RID master role, so that this check passes.

The correct fix is either to not enforce MUST restrictions on non-
replicated attributes, or not enforce it for unrelated modifications.

I'm still a little confused how this ever worked in the first place,
but we will look into it.  

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Apparently Analagous Threads

Search for more reasonably related threads

samba - Sep 2016 - Error "Failed extended allocation RID pool operation..."

[Samba] Error "Failed extended allocation RID pool operation..."

[Samba] Error "Failed extended allocation RID pool operation..."

[Samba] Error "Failed extended allocation RID pool operation..."

[Samba] Error "Failed extended allocation RID pool operation..."

[Samba] Error "Failed extended allocation RID pool operation..."

Apparently Analagous Threads