Bug 11018 - smbd can't find the GUID for a printer in the registry and fails to publish printers
Summary: smbd can't find the GUID for a printer in the registry and fails to publish p...
Status: RESOLVED FIXED
Alias: None
Product: Samba 3.6
Classification: Unclassified
Component: Printing (show other bugs)
Version: 3.6.24
Hardware: All All
: P5 normal
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-18 11:40 UTC by Andreas Schneider
Modified: 2016-01-08 14:29 UTC (History)
7 users (show)

See Also:


Attachments
patch for 4.2 (18.52 KB, patch)
2015-02-18 12:41 UTC, Andreas Schneider
ddiss: review-
Details
patch for 4.1 (18.51 KB, patch)
2015-02-18 12:43 UTC, Andreas Schneider
ddiss: review-
Details
patch for 4.0 (18.51 KB, patch)
2015-02-18 12:44 UTC, Andreas Schneider
ddiss: review-
Details
patch for 3.6 (18.48 KB, patch)
2015-02-18 13:12 UTC, Andreas Schneider
no flags Details
patch for 4.2 (18.23 KB, patch)
2015-03-10 13:40 UTC, Andreas Schneider
ddiss: review+
Details
patch for 4.1 (18.22 KB, patch)
2015-03-10 13:48 UTC, Andreas Schneider
ddiss: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Schneider 2014-12-18 11:40:23 UTC
smbd can't find the GUID for a printer in the registry and fails to publish printers. We should probably implement a function nt_printer_guid_retrieve() which gets the GUID from ldap if nt_printer_guid_get() fails to find the GUID in the registry.

This issue occured with:
https://bugzilla.samba.org/show_bug.cgi?id=9900

The issue also exists on Samba 4.x.
Comment 1 Colin.Simpson 2015-01-14 19:02:37 UTC
I have this bug too since going from RHEL 6.5 (Samba 3.6.9-169.el6) to 6.6  (Samba 3.6.23-12.el6). I have a support call open with Red Hat about this but have been unable to provide a step by step method for them to reproduce it, so they can backport a fix.

First question is is this the same bug you see, when you right click the printer is and click connect the Windows machine returns "Windows cannot connect to the printer" "Operation failed with error 0x00000002". And the log has an entry "Failed to get GUID for printer". Downgrading (without changing anything on the driver fixes this).
Comment 2 Nec 2015-01-15 09:48:50 UTC
Colin,

Everything is described here : https://bugzilla.samba.org/show_bug.cgi?id=9900
And yes, I witness the exact same things as you.

About the BZ 9900, it is very sad this bug has been closed as it is NOT fixed at all.
Comment 3 Colin.Simpson 2015-01-15 09:56:26 UTC
I was tempted to add an objectGUID registry entry into the Samba registry to see if this would workaround the issue. Though not sure what this value should be. 

Red Hat claim to be investigating, though I'm struggling to reproduce the issue consistently on a test system when adding new drivers, just consistently failing on my production print servers. Not sure what the exact cause of this difference is.
Comment 4 David Disseldorp 2015-01-15 10:14:16 UTC
This may be related to bso#9900.

"This bug has huge implications for printer publishing, as the DC queries the print server for publishing status (via level=7 GetPrinter) every eight hours and purges the AD PrintQueue object if the response does not match what the server expects (DSPRINT_PUBLISH with matching GUID)."
Comment 5 Andreas Schneider 2015-01-15 10:22:00 UTC
Red Hat created a test package but there is still no feedback if the created patchset fixes the bug. Talk to Red Hat support ...
Comment 6 Andreas Schneider 2015-02-18 12:41:02 UTC
Created attachment 10738 [details]
patch for 4.2
Comment 7 Andreas Schneider 2015-02-18 12:43:21 UTC
Created attachment 10739 [details]
patch for 4.1
Comment 8 Andreas Schneider 2015-02-18 12:44:26 UTC
Created attachment 10740 [details]
patch for 4.0
Comment 9 Andreas Schneider 2015-02-18 13:12:34 UTC
Created attachment 10741 [details]
patch for 3.6
Comment 10 David Disseldorp 2015-02-18 13:40:16 UTC
Comment on attachment 10738 [details]
patch for 4.2

GUID_buf_string() is only present in the master branch. All 4.X backports should be fixed.
Comment 11 Andreas Schneider 2015-03-10 13:40:30 UTC
Created attachment 10841 [details]
patch for 4.2
Comment 12 Andreas Schneider 2015-03-10 13:48:20 UTC
Created attachment 10842 [details]
patch for 4.1
Comment 13 David Disseldorp 2015-03-10 14:22:28 UTC
Comment on attachment 10841 [details]
patch for 4.2

LGTM, thanks Andreas.
Comment 14 Andreas Schneider 2015-03-12 07:06:07 UTC
Karolin, please add the patches to the relevant branches. Thanks!
Comment 15 Karolin Seeger 2015-03-15 21:05:42 UTC
Pushed to autobuild-v4-[1|2]-test.
Comment 16 Karolin Seeger 2015-03-27 20:02:06 UTC
(In reply to Karolin Seeger from comment #15)
Pushed to both branches.
Closing out bug report.

Thanks!
Comment 17 Nec 2015-10-29 09:42:02 UTC
For the record :
I confirm that in 3.6.23-20.0.1, this bug is still present, and the only workaround (kindly suggested by Colin Simpson - THANK YOU SO MUCH) is to :
- stop the services
- export the registry
- change the 14th bit of the Attribute key from 1 to 0, responsible for the checkbox "Publish in Active directory"
- save, import, restart

I can't wait to see the 3.6.24 been published in the CentOS repos, as I may have understood this was fixed in this version.
Comment 18 Michael Adam 2016-01-06 09:35:30 UTC
(In reply to Nec from comment #17)
> For the record :
> I confirm that in 3.6.23-20.0.1, this bug is still present, and the only
> workaround (kindly suggested by Colin Simpson - THANK YOU SO MUCH) is to :
> - stop the services
> - export the registry
> - change the 14th bit of the Attribute key from 1 to 0,
>   responsible for the checkbox "Publish in Active directory"

So if I get this whole thing right, the problem seems to be
that somehow that flag 'Publish in AD' go set in Samba's
registry but the printer was in fact not published. And it
was also not the intention to publish it. Is that correct?

It seems we need to understand how this situation could get created.

But this sounds different from the description of this bug,
so maybe it is a new bug (possibly with the same resulting
error message). Then we should track it as a new bug...

> - save, import, restart

> I can't wait to see the 3.6.24 been published in the CentOS repos,
> as I may have understood this was fixed in this version.

No, sorry. Samba 3.6 is out of maintenance.
It 3.6.24 was a security release.
see: https://wiki.samba.org/index.php/Samba_Release_Planning

You may get such fixes backported via downstream vendors/distributors.
which is why you may see the patches for 3.6 on Bugs here.
Comment 19 Colin.Simpson 2016-01-06 15:33:54 UTC
(In reply to Michael Adam from comment #18)
> So if I get this whole thing right, the problem seems to be
> that somehow that flag 'Publish in AD' go set in Samba's
> registry but the printer was in fact not published. And it
> was also not the intention to publish it. Is that correct?

That's it. 
Not sure why this causes a GUID issue with connecting to it.

>
> It seems we need to understand how this situation could get created.

I don't know in my case how it got created. But I maybe wanted to try publishing the printer at some point, it set the Samba registry to say it had but failed to actually do this.

Certainly unticking now will not succeed unless AD unpublishing is successful. So this make the registry hacking necessary to undo this. 

> 
> But this sounds different from the description of this bug,
> so maybe it is a new bug (possibly with the same resulting
> error message). Then we should track it as a new bug...
Comment 20 Nec 2016-01-06 15:38:00 UTC
(In reply to Colin Simpson from comment #19)
Absolutely confirming every point raised by Colin.
Comment 21 Andreas Schneider 2016-01-07 10:23:36 UTC
If I get it right, this is a new bug, that 'net ads printer remove' should have an option '--force' to remove the publish bit from the Samba registry, even if we fail to contact the AD server or the printer is not published in AD?
Comment 22 Michael Adam 2016-01-07 11:00:45 UTC
(In reply to Andreas Schneider from comment #21)
> If I get it right, this is a new bug, that 'net ads printer remove' should
> have an option '--force' to remove the publish bit from the Samba registry,
> even if we fail to contact the AD server or the printer is not published in
> AD?

I think we need to understand the following things:

- Is the creation of this inconsistent changes somehow
  triggered by the fixes of this bug?
  Or more precisely, is there something that we could do in the
  code to prevent this being created?

- If there is such a situation, is there a chance that
  samba can react better than failing with message that
  the guid was not found? (Maybe not..)

- Finally, yes we should provide a tool to force
  the removal of the publish bit as you described.

My 2 cents...
Comment 23 Andreas Schneider 2016-01-07 16:56:24 UTC
Yes, I agree. We do not have enough information to fully understand the problem or the description for a reproducer.
Comment 24 Colin.Simpson 2016-01-07 17:30:10 UTC
It's should be pretty easy to reproduce this "bug". If it is a bug, it's more a change of behaviour i.e. if "List in Directory" was ticked but it isn't published really in AD (removed by some other means etc), it will no longer allow you to "Connect" to it. It used to. 

But you also cannot untick "List in Director" in the GUI as Samba can't find the printer in AD (funally enough as it isn't published). But maybe it should still allow this to be unticked, even if not in AD?  Not sure...

To reproduce:

1/ Ensure you have a printer that isn't published in AD, and "List in Directory" is unticked. And ensure you can install drivers for it. 

2/ Stop Samba

3/ net registry export HKLM /root/samba.reg

3/ Then edit /root/samba.reg and look for the keys like:

HKLM\SOFTWARE\Microsoft\Windows NT\Current
Version\Print\Printers\Printername

Where Printername is the name of your printer.

For example I have a key.

[HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Printers\dell3130cn1]

my printer is called "dell3130cn1".

4/ Under here there is an entry "Attributes".  From my case:

"Attributes"=dword:00001848"

The "List in Directory" setting appears to be controlled by bit 14
 (counting from least significant)

In practice we have the same value (presumably all other settings
represented by this key are common to all our printers) so it was easy
i.e. I have
List in Directory NOT set - 01100001001000 - 6216(decimal) - 1848 (hex)

List in Directory set - 11100001001000 - 14408 (decimal) - 3848 (hex)

Put in a new value with this bit 14 flipped to 1 (and the rest of the
values as before) and convert back into hex. Then this is your new
value for this attributes key. For my case change to: 

"Attributes"=dword:00003848"

6/ Import this edited  registry back into Samba.

net registry import /root/samba.reg

7/ Start Samba and see if from a Windows machine this "List in
Directory" is now set.

8/ Trying to install the drivers should now fail (if you cleared out Windows of the driver installs).

9/ Also observe that the "List in Directory" tick box cannot be unticked.

Hope this helps.....and not just confuses.
Comment 25 Andreas Schneider 2016-01-08 09:19:06 UTC
Colin, could you please open a new bug with the information you provided?

Thanks.
Comment 26 Colin.Simpson 2016-01-08 14:29:18 UTC
New bug report opened Bug#11665 'When connecting to printers with "List in Directory" set but aren't in the directory fails'.

Not sure exactly which versions of Samba are effected by this.