[Samba] Strange crashes and disconnection from PDC?

[Andrew Bartlett]

Nir Soffer wrote:
> 
> >
> > Indeed - assuming that NT correctly captured the request.  Could it be
> > the whole IP packet?  With the IP header etc?
> 
> I'll try to decode that a bit an see what I come up with...
> >From what I can tell it looks like not an IP header... Too many NULLs,
> and I
> can't recognize the relevant IP address in the dribble.
> Also the first 4 bits should decoded to a 4 according to rfc791, and
> here it's
> a NULL. So whatever it is, it's probably not a full, aligned, nice IP
> packet.
> But I may be wrong, it's been a long time since I eyeball-decoded ip
> packets ;)

:-)

> > I'll see if the log file can give me some clues - but I'm at a loss
> > too...
> 
> Here for instance is an excerpt of what one instance had to say:
> 
> Jul 25 07:33:55 10.17.0.1 smbd[7458]: [2002/07/25 07:33:55, 0]
> smbd/password.c:connect_to_domain_password_server(1275)
> Jul 25 07:33:55 10.17.0.1 smbd[7458]:
> connect_to_domain_password_server: unable to connect to SMB server on
> machine HAWK. Error was : SUCCESS - 0.

This usually means that part of the connection process failed when the
PDC disconnected.  The 'null' packet in the reply buffer contains the 0
error code.

> Jul 25 07:33:55 10.17.0.1 smbd[7458]: [2002/07/25 07:33:55, 0]
> smbd/password.c:domain_client_validate(1585)
> Jul 25 07:33:56 10.17.0.1 smbd[7458]:   domain_client_validate: Domain
> password server not available.

And here it returns that to the caller.

> Jul 25 07:33:56 10.17.0.1 smbd[7458]: [2002/07/25 07:33:55, 0]
> passdb/pdb_smbpasswd.c:pdb_getsampwnam(1367)
> Jul 25 07:33:56 10.17.0.1 smbd[7458]:   unable to open passdb database.
> 
> Jul 25 07:33:56 10.17.0.1 smbd[7458]: [2002/07/25 07:33:55, 0]
> passdb/pdb_smbpasswd.c:pdb_getsampwnam(1367)
> Jul 25 07:33:56 10.17.0.1 smbd[7458]:   unable to open passdb database.
> 
> Jul 25 07:33:56 10.17.0.1 smbd[7458]: [2002/07/25 07:33:55, 0]
> passdb/pdb_smbpasswd.c:pdb_getsampwnam(1367)
> Jul 25 07:33:56 10.17.0.1 smbd[7458]:   unable to open passdb database.

This bit is normal, if you don't have local accounts.

> Here is another:
> 
> Jul 25 07:40:25 10.17.0.1 smbd[13661]: [2002/07/25 07:40:25, 0]
> smbd/password.c:domain_client_validate(1585)
> Jul 25 07:40:25 10.17.0.1 smbd[13661]:   domain_client_validate: Domain
> password server not available.
> Jul 25 07:40:25 10.17.0.1 smbd[13661]: [2002/07/25 07:40:25, 0]
> passdb/pdb_smbpasswd.c:pdb_getsampwnam(1367)
> Jul 25 07:40:25 10.17.0.1 smbd[13661]:   unable to open passdb database.
> 
> Jul 25 07:40:25 10.17.0.1 smbd[13661]: [2002/07/25 07:40:25, 0]
> passdb/pdb_smbpasswd.c:pdb_getsampwnam(1367)
> Jul 25 07:40:25 10.17.0.1 smbd[13661]:   unable to open passdb database.
> 
> Jul 25 07:40:25 10.17.0.1 smbd[13661]: [2002/07/25 07:40:25, 0]
> passdb/pdb_smbpasswd.c:pdb_getsampwnam(1367)
> Jul 25 07:40:25 10.17.0.1 smbd[13661]:   unable to open passdb database.
> 
> >From what I've seen in the PDC logs - all was apprently well at these
> hours.
> 
> The panic's soon followed:

Interesting that it's not the same smbd...

> Jul 25 07:40:26 10.17.0.1 smbd[14293]: [2002/07/25 07:40:26, 0]
> lib/fault.c:fault_report(38)
> Jul 25 07:40:26 10.17.0.1 smbd[14293]:
> ===============================================================
> Jul 25 07:40:26 10.17.0.1 smbd[14293]: [2002/07/25 07:40:26, 0]
> lib/fault.c:fault_report(39)
> Jul 25 07:40:26 10.17.0.1 smbd[14293]:   INTERNAL ERROR: Signal 11 in
> pid 14293 (2.2.4)
> Jul 25 07:40:26 10.17.0.1 smbd[14293]:   Please read the file BUGS.txt
> in the distribution
> Jul 25 07:40:26 10.17.0.1 smbd[14293]: [2002/07/25 07:40:26, 0]
> lib/fault.c:fault_report(41)
> Jul 25 07:40:26 10.17.0.1 smbd[14293]:
> ===============================================================
> Jul 25 07:40:26 10.17.0.1 smbd[14293]: [2002/07/25 07:40:26, 0]
> lib/util.c:smb_panic(1092)
> Jul 25 07:40:26 10.17.0.1 smbd[14293]:   PANIC: internal error
> 
> Note that this isn't the same PID...
> 
> I can't seem to couple a crashing instance with the other log message.
> Perhaps it's a parent process SEGVing and these are child processes,
> or vice versa. (although I see a lot more than 2 processes spewing
> the PDC related messages, and a lot more than 2 panic'ing, odd.)

We don't have that kind of parent/child thing in Samba, so it's not
that.  The 'parent' in Samba does so little it almost can't crash. 
Which just makes this even more weird.

If you can, recompile with debugging, setup a panic action and see if
you can catch a backtrace when it next happens (whenever that might
be...).

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net