[Pkg-samba-maint] Bug#652679: Another problem with wbinfo -i USER

[Robert Wolf]

Hello,

I am not sure, if my problem is the same as reported in this bug report, but
it looks similar.

Since upgrade to debian wheezy I have found some problem with getent group 
getting groups from nss-winbind. Sometimes the wbinfo -i USER has reported some 
error but I have not noticed this one.

After server reboot getent group works correctly, writing all Windows Domain 
groups and getent group WIN-GROUP writes information about this group (GID, 
members).

If I manually restart only winbind getent group stops working and does not show 
groups from Win Domain.

I have tried to delete files in /tmp/.winbindd, /run/samba, /var/cache/samba 
but no success. If the winbind does not start during boot and I start winbind 
manually from ssh, it does not work.

I have diffed the logs to compare infos.

In logfile with "time limit exceeded" error I have found following entries:

==================================================
DATE-TIME lib/charcnv.c:537(convert_string_talloc)
  convert_string_talloc: Conversion error: Illegal multibyte sequence(<EA>\1E<F6>\1E<FD>\80i<FA><CE><FA>#p\14\00\00))
DATE-TIME lib/charcnv.c:537(convert_string_talloc)
  convert_string_talloc: Conversion error: Illegal multibyte sequence(<F6>\1E<FD>\80i<FA><CE><FA>#p\14\00\00))
DATE-TIME lib/charcnv.c:528(convert_string_talloc)
  convert_string_talloc: Conversion error: Incomplete multibyte sequence(<FD>\80i<FA><CE><FA>#p\14\00\00))
DATE-TIME lib/charcnv.c:528(convert_string_talloc)
  convert_string_talloc: Conversion error: Incomplete multibyte sequence(<FA><CE><FA>#p\14\00\00))
DATE-TIME lib/charcnv.c:537(convert_string_talloc)
  convert_string_talloc: Conversion error: Illegal multibyte sequence(<CE><FA>#p\14\00\00))
DATE-TIME lib/charcnv.c:528(convert_string_talloc)
  convert_string_talloc: Conversion error: Incomplete multibyte sequence(<FA>#p\14\00\00))
DATE-TIME libads/ldap.c:1014(ads_do_paged_search_args)
  ads_do_paged_search_args: ldap_search_with_timeout((objectSid=\01\05\00\00\00\00\00\05\15\00\00\00S<EA>\1E<F6>\1E<FD>\80i<FA><CE><FA>#p\14\00\00)) -> Time limit exceeded
DATE-TIME libads/ldap_utils.c:134(ads_do_search_retry_internal)
  ads reopen failed after error Time limit exceeded
DATE-TIME libads/ldap_utils.c:315(ads_ranged_search_internal)
  ads_search: Time limit exceeded
==================================================

The message "Illegal multibyte sequence" has pointed me to other different
message from the beginning of the log file. If the winbind starts during boot,
there is a message 

==================================================
DATE-TIME ../lib/util/charset/codepoints.c:235(map_locale)
  Substituting charset 'ANSI_X3.4-1968' for LOCALE
==================================================

If I restart from command line, there is a message:

==================================================
DATE-TIME ../lib/util/charset/codepoints.c:235(map_locale)
  Substituting charset 'ISO-8859-1' for LOCALE
==================================================

So I have tested first to unset LANG (locale POSIX) and second to set LANG to
"en_US.UTF-8" and then restart winbind. In both cases getent group shows the
groups from Win Domain.


Sorry, I am samba-guru so I have no idea where the "Illegal multibyte
sequence" data come from, but it looks like some bug during processing binary
data - although the code should use the binary data as got from some cache, it
converts the data according to charsets (???) and sends this data as LDAP
search filter in (objectSid=ILLEGAL-MULTIBYTE-SEQUNCE).

Since the environment use charset UTF-8, I can restart winbind and getent
group still works.

I use stable debian wheezy with security updates, there is version
2:3.6.6-6+deb7u2 of samba and winbind installed.

I could replicate this problem on two productive and one test system. After
setting en_US.UTF-8 as default locale this problem disappeared.

Probably this bug is already solved in newer samba3 version.

Regards,

Robert Wolf.