Bug 6235 - domain enumeration breaks if master browser has space in name
Summary: domain enumeration breaks if master browser has space in name
Alias: None
Product: Samba 3.3
Classification: Unclassified
Component: libsmbclient (show other bugs)
Version: 3.3.2
Hardware: Other Linux
: P3 normal
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
Depends on:
Reported: 2009-03-30 08:01 UTC by Alexander Larsson
Modified: 2009-10-02 05:27 UTC (History)
1 user (show)

See Also:
vl: review+

patch to make name_status_find() not return a group (474 bytes, patch)
2009-04-14 13:10 UTC, Derrell Lipman
no flags Details
Additional patch. (515 bytes, patch)
2009-09-25 19:54 UTC, Jeremy Allison
vl: review+

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Larsson 2009-03-30 08:01:19 UTC
We have an issue in gnome where smbclient workgroup browsing breaks:

What ends up happening is SMBC_opendir_ctx() gets called with a uri like "smb://TESTGROUP/, and then line 618 calls resolve_name() on the workgroup name and type 0x1d, getting the ip address for the local master browser.
Then at line 628 it uses name_status_find with the ip and type 0 to find the netbios name of the master browser machine. Then later at line 648 we try to connect to the returned netbios name, with type 0x20 to enumerate the servers in the workgroup.

However, this connection times out, because the name_status_find() returns TESTGROUP as the netbios name, not the real name of the server, and there is no name TESTGROUP registered of type 0x20.

To see why this happens, consider the response of node_status_query() on the machine:
nmblookup -S TESTGROUP
Looking up status of
        ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> 
        TESTGROUP       <1d> -         B <ACTIVE> 
        TESTGROUP       <1e> - <GROUP> B <ACTIVE> 
        TESTGROUP       <00> - <GROUP> B <ACTIVE> 
        X31 LAPTOP      <00> -         B <ACTIVE> 
        X31 LAPTOP      <03> -         B <ACTIVE> 
        X31 LAPTOP      <20> -         B <ACTIVE> 

        MAC Address = 00-00-00-00-00-00

There is a type 0 name listed before the real name (X31 LAPTOP), which ends up being used since we looked up the first name of type 0. However, there is no corresponding name of type 0x20. The underlying reason for this is because the server (samba 3.3.1) seems to sort the machine name last if it has a space in it (changing the name to just "X31" fixes the issue).

However, i think the basic error is that SMBC_opendir_ctx calls name_status_find with type 0, when it later uses it as type 0x20. If it were to look for a type 0x20 in the first place the ordering issue wouldn't matter at all.
Comment 1 Derrell Lipman 2009-03-31 08:07:48 UTC
Chris, would you please review this and recommend a course of action. This code has been working (in all normal circumstances) for a very long time, so I'm loathe to change it without clear guidance.

I'll assign this to you. Please assign back to me when you've had a chance to review.


Comment 2 Derrell Lipman 2009-04-14 13:07:24 UTC
back to me
Comment 3 Derrell Lipman 2009-04-14 13:10:04 UTC
Created attachment 4064 [details]
patch to make name_status_find() not return a group

Jeremy, this seems to better reflect the intended purpose of name_status_find(), and should fix this bug. Please review to confirm that it doesn't appear to break anything.
Comment 4 Derrell Lipman 2009-04-14 13:11:29 UTC
Alexander, I wasn't able to replicate your problem even with names that contained a space. It does, however, appear that name_status_find() is returning groups when it shouldn't. Would you see if the patch I provided fixes the problem for you.

Comment 5 Alexander Larsson 2009-04-15 03:07:50 UTC
Yes, that fixes the issue for me.
Comment 6 Karolin Seeger 2009-05-03 02:07:29 UTC
Fix is not upstream, yet.
Jeremy, can you review the patch, please?
Comment 7 Karolin Seeger 2009-09-24 08:31:14 UTC
Volker, is there a chance to get this one into 3.3.8?
Comment 8 Volker Lendecke 2009-09-25 08:39:48 UTC
Looks correct to me.
Comment 9 Jeremy Allison 2009-09-25 19:54:42 UTC
Created attachment 4747 [details]
Additional patch.

I think this patch is also needed - currently libsmbclient is asking for the NetBIOS "client" name type, not the server name type. Theoretically the server might not have a client name type. Volker please review.

Comment 10 Volker Lendecke 2009-09-28 02:57:36 UTC
Comment on attachment 4747 [details]
Additional patch.

Looks good, thanks.

Comment 11 Karolin Seeger 2009-10-02 05:27:52 UTC
Pushed both patches to v3-3-test and v3-4-test.
Closing out bug report.