FS#64537 - [samba] samba-tool fails with python 3.8

Attached to Project: Arch Linux
Opened by Stefan Schallenberg (nafets227) - Saturday, 16 November 2019, 17:07 GMT
Last edited by Tobias Powalowski (tpowa) - Friday, 14 August 2020, 13:15 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Tobias Powalowski (tpowa)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 16
Private No

Details

Description:
samba-tool Fails with message
[root@vWinSrvTest ~]# samba-tool
ERROR(<class 'SystemError'>): uncaught exception - bad call flags
File "/usr/bin/samba-tool", line 44, in <module>
retval = cmd._run("samba-tool", subcommand, *args)
File "/usr/lib/python3.8/site-packages/samba/netcmd/__init__.py", line 255, in _run
cmd = self.subcommands[cmd_name]
File "/usr/lib/python3.8/site-packages/samba/netcmd/main.py", line 35, in __getitem__
self[attr] = getattr(__import__('samba.netcmd.%s' % package,
File "/usr/lib/python3.8/site-packages/samba/netcmd/domain.py", line 44, in <module>
from samba.join import join_RODC, join_DC, join_subdomain
File "/usr/lib/python3.8/site-packages/samba/join.py", line 24, in <module>
from samba import gensec, Ldb, drs_utils, arcfour_encrypt, string_to_byte_array



Additional info:
* package version(s)
ldb 1:1.5.6-2
samba 4.10.10-2
tdb 1.3.18-4
python 3.8.0-1
talloc 2.2.0-3
smbclient 4.10.10-2

* config and/or log files etc.
* link to upstream bug report, if any

Steps to reproduce:
Setup a new Arch Linux machine with current packages (as of 16.11.2019).
as root start samba-tool without any Parameters
Expected: Help Messages
What happened: Error Messages (see above).

Downgrading samba and related packages to python 3.8 solves the issue:
ldb 1:1.5.6-1
samba 4.10.10-1
tdb 1.3.18-2
python 3.7.4-2
talloc 2.2.0-1
smbclient 4.10.10-1
This task depends upon

Closed by  Tobias Powalowski (tpowa)
Friday, 14 August 2020, 13:15 GMT
Reason for closing:  Fixed
Comment by Val Kulkov (BeefEater) - Saturday, 30 November 2019, 18:13 GMT
Also, for samba_dnsupdate to start working again python-dnspython package must be downgraded to 1.16.0-1. Without the downgrade, samba_dnsupdate fails with "ModuleNotFoundError: No module named 'dns'".
Comment by Val Kulkov (BeefEater) - Wednesday, 04 December 2019, 22:15 GMT
There is a patch proposed upstream at https://bugzilla.samba.org/show_bug.cgi?id=14209 that has to be tested. @tpowa @nafets227 : please test if you can and let the upstream maintainer know. Unfortunately I cannot test the patch myself until later this month, my development/test system is not available and it will take time for me to rebuild it.
Comment by Luca Fulchir (Luker) - Thursday, 05 December 2019, 13:40 GMT
I tried the patch linked in that thread for samba-4.10.10, compiles but does not work:


# samba-tool
ERROR(<class 'SystemError'>): uncaught exception - bad call flags
File "/usr/bin/samba-tool", line 44, in <module>
retval = cmd._run("samba-tool", subcommand, *args)
File "/usr/lib/python3.8/site-packages/samba/netcmd/__init__.py", line 255, in _run
cmd = self.subcommands[cmd_name]
File "/usr/lib/python3.8/site-packages/samba/netcmd/main.py", line 35, in __getitem__
self[attr] = getattr(__import__('samba.netcmd.%s' % package,
File "/usr/lib/python3.8/site-packages/samba/netcmd/domain.py", line 44, in <module>
from samba.join import join_RODC, join_DC, join_subdomain
File "/usr/lib/python3.8/site-packages/samba/join.py", line 24, in <module>
from samba import gensec, Ldb, drs_utils, arcfour_encrypt, string_to_byte_array
Comment by Torsten Fohrer (tfohrer) - Monday, 09 December 2019, 09:41 GMT
Please try this additional patch for pygensec.c (taken from/fix for samba 4.11.2-x)
Comment by Luca Fulchir (Luker) - Thursday, 12 December 2019, 10:52 GMT
I applied both patches.
compiles, samba-tool does not complain, but I can't provision a new domain yet:

INFO 2019-12-12 10:48:39,936 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2088: Looking up IPv4 addresses
WARNING 2019-12-12 10:48:39,937 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2093: More than one IPv4 address found. Using 172.17.0.1
INFO 2019-12-12 10:48:39,938 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2105: Looking up IPv6 addresses
INFO 2019-12-12 10:48:41,561 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2278: Setting up share.ldb
INFO 2019-12-12 10:48:44,639 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2282: Setting up secrets.ldb
INFO 2019-12-12 10:48:46,279 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2288: Setting up the registry
INFO 2019-12-12 10:48:54,920 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2291: Setting up the privileges database
INFO 2019-12-12 10:48:58,876 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2294: Setting up idmap db
INFO 2019-12-12 10:49:01,510 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2301: Setting up SAM db
INFO 2019-12-12 10:49:01,846 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #882: Setting up sam.ldb partitions and settings
INFO 2019-12-12 10:49:01,847 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #894: Setting up sam.ldb rootDSE
INFO 2019-12-12 10:49:02,279 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1302: Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

INFO 2019-12-12 10:49:03,488 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1379: Adding DomainDN: DC=test,DC=xyz
INFO 2019-12-12 10:49:03,883 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1411: Adding configuration container
INFO 2019-12-12 10:49:04,244 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1426: Setting up sam.ldb schema
INFO 2019-12-12 10:49:08,374 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1444: Setting up sam.ldb configuration data
INFO 2019-12-12 10:49:08,684 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1485: Setting up display specifiers
INFO 2019-12-12 10:49:11,750 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1493: Modifying display specifiers and extended rights
INFO 2019-12-12 10:49:11,821 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1500: Adding users container
INFO 2019-12-12 10:49:11,824 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1506: Modifying users container
INFO 2019-12-12 10:49:11,826 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1509: Adding computers container
INFO 2019-12-12 10:49:11,829 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1515: Modifying computers container
INFO 2019-12-12 10:49:11,831 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1519: Setting up sam.ldb data
INFO 2019-12-12 10:49:12,135 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1549: Setting up well known security principals
INFO 2019-12-12 10:49:12,198 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1563: Setting up sam.ldb users and groups
===============================================================
INTERNAL ERROR: Signal 11 in pid 25850 (4.10.10)
If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting
===============================================================
smb_panic_default: PANIC (pid 25850): internal error
BACKTRACE: 0 stack frames:
Aborted (core dumped)

don't know if it is related or not though
Comment by Luca Fulchir (Luker) - Thursday, 12 December 2019, 17:31 GMT
[ doubple post, sry ]
Comment by Klaus (klaeuser) - Monday, 16 December 2019, 10:41 GMT
looks like this was a samba bug which is about to be fixed:

https://bugzilla.samba.org/show_bug.cgi?id=14209
Comment by Alexander E. Patrakov (patrakov) - Tuesday, 21 January 2020, 10:58 GMT
The upstream samba bug is now marked as resolved/fixed. Somebody should probably incorporate the patches from bugzilla into the Arch package.
Comment by Val Kulkov (BeefEater) - Tuesday, 21 January 2020, 14:20 GMT
Unfortunately, the proposed patches fixing Samba bug #14209 were not included into Samba 4.10.12 and Samba 4.11.5 that were released earlier today. The Samba Release Planning page at https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.10 says that the planned release date for Samba 4.10.13 is Thursday, January 23 2020. Hopefully 4.10.13 will not be another security-only release and hopefully it will include the patches fixing Samba bug #14209.
Comment by Klaus (klaeuser) - Monday, 27 January 2020, 08:29 GMT
Release notes for 4.10.13 say,  bug 14209  was fixed in that release:

...

===============================
Release Notes for Samba 4.10.13
January 23, 2020
===============================

...
Changes since 4.10.12
----------------------
o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* BUG 14209: pygpo: Use correct method flags.
Comment by telsch (telsch) - Tuesday, 11 February 2020, 13:51 GMT
Can also confirm this bug for samba 4.10.10-2 on armv7l.
Testing with samba 4.11.6 on x86_64 seems to fixed this.
Comment by Robert Ulmer (hifigraz) - Sunday, 23 February 2020, 07:29 GMT
Is there a chance to get 4.10.13 whilst 4.11 still in testing?
Comment by Klaus (klaeuser) - Sunday, 23 February 2020, 12:39 GMT
you can do that on your own - it's easy:

- install pbget from AUR
- get the base structure of the samba package using pbget
- configure PKGBUILD:
you only need to change the version to 4.10.13 (pkgver=4.10.13)
and the md5sums at the end of PKGBUILD (you get them with makepkg -g)
- makepkg -si

I'm not sure why nobody does that in the official repo...
Comment by Klaus (klaeuser) - Sunday, 23 February 2020, 14:13 GMT
you can do that on your own - it's easy:

- install pbget from AUR
- get the base structure of the samba package using pbget
- configure PKGBUILD:
you only need to change the version to 4.10.13 (pkgver=4.10.13)
and the md5sums at the end of PKGBUILD (you get them with makepkg -g)
- makepkg -si

I'm not sure why nobody does that in the official repo...
Comment by Klaus (klaeuser) - Sunday, 23 February 2020, 15:50 GMT
you can do that on your own - it's easy:

- install pbget from AUR
- get the base structure of the samba package using pbget
- configure PKGBUILD:
you only need to change the version to 4.10.13 (pkgver=4.10.13)
and the md5sums at the end of PKGBUILD (you get them with makepkg -g)
- makepkg -si

I'm not sure why nobody does that in the official repo...
Comment by Robert Ulmer (hifigraz) - Sunday, 23 February 2020, 19:35 GMT
Hi Klaus,

thank you for the answer(s).
I know, that I can build it myself, and I already did.
But I don't really understand why I have to and the package remains in a broken state for weeks.

KR
Robert
Comment by Klaus (klaeuser) - Monday, 24 February 2020, 07:09 GMT
Hi Robert,
I was wondering about that too and therefore asked a question in the Arch forum whether it might be possible to get a timeline, when the problem will be fixed.
Apart from a relatively unfriendly answer, nothing came of it - that's why I built the package myself...
Comment by Frederic Bezies (fredbezies) - Sunday, 29 March 2020, 05:59 GMT
I saw this morning samba 4.11.3-3 pushed on extra. It is still broken. Is this a mistake?
Comment by Val Kulkov (BeefEater) - Sunday, 29 March 2020, 15:13 GMT
This bug was fixed in samba 4.11.6, released on January 28, 2020. It is #14209 in the Samba Bugzilla, see https://www.samba.org/samba/history/samba-4.11.6.html

What is being published here, I mean version 4.11.3, is more than 4 months old version. 4.11.3 was released on December 10, 2019. I really would like to know why 4.11.3 is here instead of a more recent version. It makes no sense to me.
Comment by Felix Golatofski (TheGoliath) - Sunday, 29 March 2020, 19:23 GMT
I don't understand, why a package such as samba which sees a broad utilization all over different distributions won't see any updates for like 4 months. And when it get's updates, it's a version which over 4 months old. The bug, still isn't resolved and the package version is outdated for quite a while now. Is there any reason for that?
Comment by Frederic Bezies (fredbezies) - Monday, 30 March 2020, 11:43 GMT
There is also an opened thread on archlinux forum: https://bbs.archlinux.org/viewtopic.php?pid=1894667#p1894667

Archlinux really needs to update to Samba 4.12.0 in order to get back working shares.
Comment by Klaus (klaeuser) - Monday, 30 March 2020, 17:10 GMT
Archlinux maintenance has become somewhat obscure lately.
I just tried to build Samba 4.12.0 on a test system ... just to see if there are problems (that might explain why it is not in the repo).

It fails with:
ERROR: System library tdb of version 1.4.3 not found

In fact - there seems to be no version 1.4.3 of tdb:

pacman -Ss tdb
extra/tdb 1.3.18-4 [Installiert]
A Trivial Database similar to GDBM but allows simultaneous commits

... but when you look at https://www.archlinux.org/packages ...
What a surprise - there we find tdb 1.4.3-2

I quit at this point and return back to samba 4.10.13. This version has a fix for 14209 also ...
Comment by telsch (telsch) - Monday, 30 March 2020, 19:29 GMT
I compiled samba 4.11.7 on x86_64 and armv7l and don't have these problems.
Already provided my patches here.
https://bugs.archlinux.org/task/62521

Don't know some maintainers reading here. But why now 4.12.0 is in testing, wait for first bugfix release!

And please remove the experimental and insecure feature that was introduced in this commit.
https://git.archlinux.org/svntogit/packages.git/commit/trunk?h=packages/samba&id=b5ffb98d77dad1dd2454d01a836096b803ef5e17
Comment by Alexander E. Patrakov (patrakov) - Monday, 30 March 2020, 19:32 GMT
@telsch This experimental and insecure feature cannot be removed. It is required for printing to shared printers with GSSAPI authentication. See https://bugs.archlinux.org/task/62727
Comment by Alistair Cheeseman (AlistairETA) - Monday, 30 March 2020, 19:42 GMT
@patrakov what about the functionality lost if running as a DC? Primarily Group Policies.
https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC#Known_Limitations_of_MIT_Kerberos_Support_in_Samba

Samba DCs with MIT Kerberos KDC currently do not support:

PKINIT support required for using smart cards
Service for User to Self-service (S4U2self)
Service for User to Proxy (S4U2proxy)
Running as a Read only domain controller (RODC)
Authentication Audit logging
Computer GPO's are not applied, see Bug 13516
Comment by Alexander E. Patrakov (patrakov) - Monday, 30 March 2020, 19:45 GMT
I guess this calls for two variants of the samba package.
Comment by telsch (telsch) - Monday, 30 March 2020, 19:49 GMT
I can't find that someone says using GSSAPI authentication and samba in ad mode.
My setup is in ad mode and i could print. But my client doesn't join the domain. Just enter a valid user and password.
Comment by mirh (mirh) - Sunday, 03 May 2020, 22:04 GMT
So.. I assume this could be closed now?
Comment by Klaus (klaeuser) - Monday, 04 May 2020, 06:27 GMT
yes, you can close this.
The underlying problem of this topic (python 3.8) is fixed since samba 4.11.7. We now have 4.12.2 in extra (stable).

MIT KDC is topic of another task:  FS#66023  - [samba] and MIT KDC

Although it is understandable that some people need GSSAPI printing, MIT kerberos breaks many AD installations and is *not supported* by the samba team. Such things should not be put in the mainline - this is at most a topic for testing. But - as mentioned - this is discussed in  FS#66023 .

Loading...