[Samba] RPC and NDR errors in log file

[James Atwell]

On 10/30/2018 10:17 AM, James Atwell wrote:
> On 10/29/2018 1:57 PM, Rowland Penny via samba wrote:
>> On Mon, 29 Oct 2018 13:20:18 -0400
>> James Atwell via samba <samba at lists.samba.org> wrote:
>>
>>> Hello List,
>>>                  I'm receiving several of these messages in my samba
>>> log file. I'm not entirely sure what the errors are referencing
>>> either. I'm under the assumption DNS related.
>>>
>>> ndr_pull_error(11): Pull bytes 1 (../librpc/ndr/ndr_basic.c:81)
>>> ../librpc/rpc/dcerpc_util.c:264: ERROR: pad length mismatch.
>>> Calculated 44 got 0
>>>
>>> I have 3 sites with 2 DC's per site.  These messages are only coming
>>> from one site and both DC's are logging the errors.
>>>
>>> Since I suspect DNS related, I will provide my setup configs.
>>>
>> The message is coming from dcerpc_util.c, so it probably has nothing to
>> do with dns
>>
>>> cat /usr/local/samba/etc/smb.conf
>>>
>>> # Global parameters
>>>
>>> [global]
>>>          dns forwarder = 75.75.75.75 208.67.222.222
>> You are using Bind, so, as the 'dns forwarder' line will be ignored, you
>> might as well remove it.
>>
>> I think we need to know more about your set up, OS versions etc.
>>
>> Also I would take it as a big favour if you found a better email client
>> that didn't add all the blank lines ;-)
>>
>> Rowland
>>
> I removed the dns forwarder line as it was left over when using the 
> internal DNS at one point. Thanks.
>
> I have 6 DC's all using Ubuntu 16.04.5 LTS. I believe I previously 
> indicated they were 14.04 releases. A total of 3 sites with 2 DC's at 
> each.  Using rysnc sysvol replication as well. All DC's are using 
> bind9 for DNS. All DC's are compiled from tar and using 4.9.1.
>
> I was previously using Samba 4.8.6 prior to upgrading to  4.9.1. I was 
> not alerted to these errors until after the upgrade.
>
> As a side note I have been on the list under a previous email if all 
> this sounds familiar. I switched back to using Thunderbird so curious 
> if it resolves the blank space issue as well.
>
>
Rowland,

     The issue actually appears across all sites. Not just the one I 
initially suspected. I was able to capture another log event but this 
time more data was with with it.

dnsserver: Invalid zone operation IsSigneddnsserver: Invalid zone 
operation IsSigneddnsserver: Invalid zone operation IsSigneddnsserver: 
Invalid zone operation IsSigneddnsserver: Invalid zone operation 
IsSigned../librpc/rpc/dcerpc_util.c:264: ERROR: pad length mismatch. 
Calculated 44got 0