samba - Jun 2017 - smbcacls got error NT_STATUS_NETWORK_NAME_DELETED

On Thu, Jun 08, 2017 at 06:43:34PM +0200, Ralph Böhme via samba
wrote:
> Hi Andy,
> 
> On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba wrote:
> > The smbcacls cmd worked before till recently. Due to the recent
Windows
> > patch which disables SMB v1, we have to add the following line into
the
> > [global] section in smb.conf file on Linux machine so that the
smbcacls can
> > talk to the Windows server otherwise it gets error
> > NT_STATUS_CONNECTION_RESET:
> > 
> > client max protocol = SMB3
> > 
> > with this option added, the smbcacls cmd ran into error
> > NT_STATUS_NETWORK_NAME_DELETED.
> 
> it's a bug in smbcacls. For some reason, when using protocol level >
1 it issues
> create calls on an invalid, just closed IPC tree connect, instead of the
still
> connected share.
> 
> Just ran into this today (but have seen it earlier) when passing -m smb3 on
the
> command line. Shouldn't be too hard to fix this, just didn't have
the time.
Just tried but couldn't reproduce this against an smbd server running
master. Ralph, do you have a reproducer ?

bug was filed as  Bug 12831

https://bugzilla.samba.org/show_bug.cgi?id=12831


Thank you for looking into this.

Best

Andy




On 06/08/2017 02:40 PM, Jeremy Allison wrote:
> On Thu, Jun 08, 2017 at 06:43:34PM +0200, Ralph Böhme via samba wrote:
>> Hi Andy,
>>
>> On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba wrote:
>>> The smbcacls cmd worked before till recently. Due to the recent
Windows
>>> patch which disables SMB v1, we have to add the following line into
the
>>> [global] section in smb.conf file on Linux machine so that the
smbcacls can
>>> talk to the Windows server otherwise it gets error
>>> NT_STATUS_CONNECTION_RESET:
>>>
>>> client max protocol = SMB3
>>>
>>> with this option added, the smbcacls cmd ran into error
>>> NT_STATUS_NETWORK_NAME_DELETED.
>> it's a bug in smbcacls. For some reason, when using protocol level
> 1 it issues
>> create calls on an invalid, just closed IPC tree connect, instead of
the still
>> connected share.
>>
>> Just ran into this today (but have seen it earlier) when passing -m
smb3 on the
>> command line. Shouldn't be too hard to fix this, just didn't
have the time.
> Just tried but couldn't reproduce this against an smbd server running
> master. Ralph, do you have a reproducer ?

On Thu, Jun 08, 2017 at 02:40:49PM -0700, Jeremy Allison
wrote:
> On Thu, Jun 08, 2017 at 06:43:34PM +0200, Ralph Böhme via samba wrote:
> > Hi Andy,
> > 
> > On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba wrote:
> > > The smbcacls cmd worked before till recently. Due to the recent
Windows
> > > patch which disables SMB v1, we have to add the following line
into the
> > > [global] section in smb.conf file on Linux machine so that the
smbcacls can
> > > talk to the Windows server otherwise it gets error
> > > NT_STATUS_CONNECTION_RESET:
> > > 
> > > client max protocol = SMB3
> > > 
> > > with this option added, the smbcacls cmd ran into error
> > > NT_STATUS_NETWORK_NAME_DELETED.
> > 
> > it's a bug in smbcacls. For some reason, when using protocol level
> 1 it issues
> > create calls on an invalid, just closed IPC tree connect, instead of
the still
> > connected share.
> > 
> > Just ran into this today (but have seen it earlier) when passing -m
smb3 on the
> > command line. Shouldn't be too hard to fix this, just didn't
have the time.
> 
> Just tried but couldn't reproduce this against an smbd server running
> master. Ralph, do you have a reproducer ?
$ ./bin/smbcacls -m smb3 -U slow%x //localhost/share "" -a
"ACL:SLOWSERVER\slow:ALLOWED/0x0/READ"
Failed to open \: NT_STATUS_NETWORK_NAME_DELETED
$

Cheerio!
-slow

On Fri, Jun 09, 2017 at 06:38:01AM +0200, Ralph Böhme
wrote:
> On Thu, Jun 08, 2017 at 02:40:49PM -0700, Jeremy Allison wrote:
> > On Thu, Jun 08, 2017 at 06:43:34PM +0200, Ralph Böhme via samba wrote:
> > > Hi Andy,
> > > 
> > > On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba
wrote:
> > > > The smbcacls cmd worked before till recently. Due to the
recent Windows
> > > > patch which disables SMB v1, we have to add the following
line into the
> > > > [global] section in smb.conf file on Linux machine so that
the smbcacls can
> > > > talk to the Windows server otherwise it gets error
> > > > NT_STATUS_CONNECTION_RESET:
> > > > 
> > > > client max protocol = SMB3
> > > > 
> > > > with this option added, the smbcacls cmd ran into error
> > > > NT_STATUS_NETWORK_NAME_DELETED.
> > > 
> > > it's a bug in smbcacls. For some reason, when using protocol
level > 1 it issues
> > > create calls on an invalid, just closed IPC tree connect, instead
of the still
> > > connected share.
> > > 
> > > Just ran into this today (but have seen it earlier) when passing
-m smb3 on the
> > > command line. Shouldn't be too hard to fix this, just
didn't have the time.
> > 
> > Just tried but couldn't reproduce this against an smbd server
running
> > master. Ralph, do you have a reproducer ?
> 
> $ ./bin/smbcacls -m smb3 -U slow%x //localhost/share "" -a
"ACL:SLOWSERVER\slow:ALLOWED/0x0/READ"
> Failed to open \: NT_STATUS_NETWORK_NAME_DELETED
> $
Thanks, I've reproduced and I know what the problem is - working on a fix
now !

On Fri, Jun 09, 2017 at 06:38:01AM +0200, Ralph Böhme
wrote:
> On Thu, Jun 08, 2017 at 02:40:49PM -0700, Jeremy Allison wrote:
> > On Thu, Jun 08, 2017 at 06:43:34PM +0200, Ralph Böhme via samba wrote:
> > > Hi Andy,
> > > 
> > > On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba
wrote:
> > > > The smbcacls cmd worked before till recently. Due to the
recent Windows
> > > > patch which disables SMB v1, we have to add the following
line into the
> > > > [global] section in smb.conf file on Linux machine so that
the smbcacls can
> > > > talk to the Windows server otherwise it gets error
> > > > NT_STATUS_CONNECTION_RESET:
> > > > 
> > > > client max protocol = SMB3
> > > > 
> > > > with this option added, the smbcacls cmd ran into error
> > > > NT_STATUS_NETWORK_NAME_DELETED.
> > > 
> > > it's a bug in smbcacls. For some reason, when using protocol
level > 1 it issues
> > > create calls on an invalid, just closed IPC tree connect, instead
of the still
> > > connected share.
> > > 
> > > Just ran into this today (but have seen it earlier) when passing
-m smb3 on the
> > > command line. Shouldn't be too hard to fix this, just
didn't have the time.
> > 
> > Just tried but couldn't reproduce this against an smbd server
running
> > master. Ralph, do you have a reproducer ?
> 
> $ ./bin/smbcacls -m smb3 -U slow%x //localhost/share "" -a
"ACL:SLOWSERVER\slow:ALLOWED/0x0/READ"
> Failed to open \: NT_STATUS_NETWORK_NAME_DELETED
OK, I have a patchset that fixes this, and also cleans up
the tcon handling inside the cli_XXX() calls. I now need
to make this pass make tests and survive the abuse that
we give the internals of the struct cli_state struct inside
smbtorture3.

Feel free to ping me if you want a chat on strategies
for this !

Cheers,

Jeremy.