The Samba-Bugzilla – Bug 6235
domain enumeration breaks if master browser has space in name
Last modified: 2009-10-02 05:27:52 UTC
We have an issue in gnome where smbclient workgroup browsing breaks:
What ends up happening is SMBC_opendir_ctx() gets called with a uri like "smb://TESTGROUP/, and then line 618 calls resolve_name() on the workgroup name and type 0x1d, getting the ip address for the local master browser.
Then at line 628 it uses name_status_find with the ip and type 0 to find the netbios name of the master browser machine. Then later at line 648 we try to connect to the returned netbios name, with type 0x20 to enumerate the servers in the workgroup.
However, this connection times out, because the name_status_find() returns TESTGROUP as the netbios name, not the real name of the server, and there is no name TESTGROUP registered of type 0x20.
To see why this happens, consider the response of node_status_query() on the machine:
nmblookup -S TESTGROUP
querying TESTGROUP on 10.32.208.255
Looking up status of 10.32.208.36
..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>
TESTGROUP <1d> - B <ACTIVE>
TESTGROUP <1e> - <GROUP> B <ACTIVE>
TESTGROUP <00> - <GROUP> B <ACTIVE>
X31 LAPTOP <00> - B <ACTIVE>
X31 LAPTOP <03> - B <ACTIVE>
X31 LAPTOP <20> - B <ACTIVE>
MAC Address = 00-00-00-00-00-00
There is a type 0 name listed before the real name (X31 LAPTOP), which ends up being used since we looked up the first name of type 0. However, there is no corresponding name of type 0x20. The underlying reason for this is because the server (samba 3.3.1) seems to sort the machine name last if it has a space in it (changing the name to just "X31" fixes the issue).
However, i think the basic error is that SMBC_opendir_ctx calls name_status_find with type 0, when it later uses it as type 0x20. If it were to look for a type 0x20 in the first place the ordering issue wouldn't matter at all.
Chris, would you please review this and recommend a course of action. This code has been working (in all normal circumstances) for a very long time, so I'm loathe to change it without clear guidance.
I'll assign this to you. Please assign back to me when you've had a chance to review.
back to me
Created attachment 4064 [details]
patch to make name_status_find() not return a group
Jeremy, this seems to better reflect the intended purpose of name_status_find(), and should fix this bug. Please review to confirm that it doesn't appear to break anything.
Alexander, I wasn't able to replicate your problem even with names that contained a space. It does, however, appear that name_status_find() is returning groups when it shouldn't. Would you see if the patch I provided fixes the problem for you.
Yes, that fixes the issue for me.
Fix is not upstream, yet.
Jeremy, can you review the patch, please?
Volker, is there a chance to get this one into 3.3.8?
Looks correct to me.
Created attachment 4747 [details]
I think this patch is also needed - currently libsmbclient is asking for the NetBIOS "client" name type, not the server name type. Theoretically the server might not have a client name type. Volker please review.
Comment on attachment 4747 [details]
Looks good, thanks.
Pushed both patches to v3-3-test and v3-4-test.
Closing out bug report.