SMB3 fails to sign when path is delimited by slash

[amosavian]

HI,

When I try to connect to my macOS smb server which is SMB 3.02, All / delimiters in path must be replaced by \ otherwise the operation will fail with Failure to add signature message.

EDIT: This issue is limited to macOS 10.13.4 High Sierra. Windows 10 and Samba on Linux has no issue with dialect 3.02 signing.

[sahlberg]

Pushed a fix for this to master. Please test.

[amosavian]

While this converting is something that must be done, I'm afraid there is an underlying cause.

I've noticed this line

libsmb2/lib/pdu.c

Line 346 in 983a749

smb2_set_error(smb2, "Failure to add "

is overriding underlying error description set by this function

libsmb2/lib/smb2-signing.c

Line 170 in 56fccd7

smb2_pdu_add_signature(struct smb2_context *smb2,

I suggest removing this override to allow me to find underlying issue, the only thing you must do after that is to set an error description before this line:

libsmb2/lib/smb2-signing.c

Line 191 in 56fccd7

return -1;

Thanks

UPDATE: Indeed Microsoft insists to do this replacing check here

[sahlberg]

Good analysis.
Can you please send me a pull request for this change so that you get
proper credit in the git log ?

[amosavian]

I did further investigation and I noticed you indeed added last error message to the new one and pass it as variadic argument. I thing there is a problem in handling valist in smb2_set_error(). Unfortunately I'm novice in C and don't know much about valists in c.

I can say asserting smb2->session_key_size == 0 is not problem as it is16.

By the way, your fixing commit is working as expected.

[sahlberg]

The error string is benign and comes from the second SessionSetup during NTLMSSP negotiation. Since this is a session setup command and we thus do not yet have a session key, we can not yet do signing. I have fixed this in master now so we will not generate a spurios error string here.

…

On Mon, May 28, 2018 at 5:42 PM, Amir Abbas Mousavian < ***@***.***> wrote: I did further investigation and I noticed you indeed added last error message to the new one and pass it as variadic argument. I thing there is a problem in handling valist in smb2_set_error(). Unfortunately I'm novice in C and don't know much about valists in c. I can say asserting smb2->session_key_size == 0 is not problem as it is16. By the way, your fixing commit is working as expected. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#46 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAeNkLlsfJeWe5wBm1Q3AqEGfcXc0aK8ks5t26pMgaJpZM4UN1z2> .

[amosavian]

Yes you are right indeed.

About that srvsvc issue I've noticed the file handle would be nil when I try opening with write flag. I implemented async opening to get result and it was -13, which is permission denied. Seems I have to use fsctl for share enumerating for macOS otherwise it. would refuse.

Probably the commit you have pushed for this issue was the right one and already resolved underlying issue. Thus I close this issue.

By the way, macOS is not relying on Samba anymore and have its own smb3 server implementation, which you can find here

[sahlberg]

ok, I will add support for fcntl next weekend.

…

On Mon, May 28, 2018 at 8:40 PM, Amir Abbas Mousavian < ***@***.***> wrote: Yes you are right indeed. About that srvsvc issue I've noticed the file handle would be nil when I try opening with write flag. I implemented async opening to get result and it was -13, which is permission denied. Seems I have to use fsctl for share enumerating for macOS otherwise it. would refuse. Probably the commit you have pushed for this issue was the right one and already resolved underlying issue. Thus I close this issue. By the way, macOS is not relying on Samba anymore and have its own smb3 server implementation, which you can find here <https://opensource.apple.com/source/smb/smb-759.40.1/> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#46 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAeNkHt4sdI7bSXuxoMo9UcpyZazKop-ks5t29Q0gaJpZM4UN1z2> .

[amosavian]

Thanks. After you implement fsctl, I will try to create a pull request with listing share ability based on my implementation.

[amosavian]

@sahlberg listing share issue is not related to ioctl, I guess it's because overwrite flag set by smb2_open_async() when I try to open srvsvc pipe.

I will try to reimplement current listing share implementation in C.