Replace smb/smb-rpc with smb2 crate

- Swap `smb` 0.11.1 + `smb-rpc` =0.11.1 for `smb2` git dependency (same target gate)
- Rewrite `smb_connection.rs`: `SmbClient::connect()` + `list_shares()` replaces the 3-step smb-rs flow
- Rewrite `smb_util.rs`: `ErrorKind` matching replaces NtStatus/string heuristics, `convert_shares` replaces NDR debug-format parsing hacks
- Update `smb_client.rs` orchestration for new error types and connection API
- Update `lib.rs`: log filter `smb` → `smb2`, remove `sspi` filter
- Update `docker_smb_test.rs` example for smb2 API
- Tested against Docker SMB containers (guest + auth) and real network devices

Author: vdavid

Cargo.lock

@@ -115,9 +115,8 @@ nusb = "0.2.3"
 bytes = "1"
 # mDNS discovery for network host browsing (pure Rust, cross-platform)
 mdns-sd = { version = "0.18", features = ["logging"] }
-# SMB protocol client for share enumeration (pure Rust)
-smb = "0.11.1"
-smb-rpc = "=0.11.1"
+# SMB2/3 protocol client for share enumeration (pure Rust, pipelined I/O)
+smb2 = { git = "https://github.com/vdavid/smb2", branch = "main" }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 # Drive indexing: NFD normalization for APFS case-insensitive collation

apps/desktop/src-tauri/Cargo.toml

@@ -3,12 +3,12 @@
 //! Run with:
 //!   cargo run --example docker_smb_test
 //!
-//! NOTE: This example only works on macOS (requires the `smb` crate).
+//! NOTE: This example only works on macOS/Linux (requires the `smb2` crate).
 
-#[cfg(target_os = "macos")]
+#[cfg(any(target_os = "macos", target_os = "linux"))]
 mod inner {
-    use smb::{Client, ClientConfig};
-    use std::net::SocketAddr;
+    use smb2::{ClientConfig, SmbClient};
+    use std::time::Duration;
 
     const TEST_PORT: u16 = 9445; // smb-guest Docker container
     const TEST_IP: &str = "127.0.0.1";
@@ -17,65 +17,54 @@ mod inner {
     pub async fn main() {
         println!("Testing Docker SMB container at {}:{}", TEST_IP, TEST_PORT);
 
-        // Create client with unsigned guest access allowed (required for test Docker servers)
-        let mut config = ClientConfig::default();
-        config.connection.allow_unsigned_guest_access = true;
-        let client = Client::new(config);
+        let config = ClientConfig {
+            addr: format!("{}:{}", TEST_IP, TEST_PORT),
+            timeout: Duration::from_secs(5),
+            username: "Guest".to_string(),
+            password: String::new(),
+            domain: String::new(),
+            auto_reconnect: false,
+            compression: false,
+        };
 
-        // Step 1: Connect to address with custom port
-        // KEY FIX: Use IP address as server name to ensure consistent connection lookup
-        let socket_addr: SocketAddr = format!("{}:{}", TEST_IP, TEST_PORT).parse().unwrap();
-        println!("Step 1: connect_to_address('{}', {:?})", TEST_IP, socket_addr);
-
-        match client.connect_to_address(TEST_IP, socket_addr).await {
-            Ok(_conn) => println!("  ✅ connect_to_address succeeded"),
-            Err(e) => {
-                println!("  ❌ connect_to_address failed: {:?}", e);
-                return;
+        // Step 1: Connect
+        println!("Step 1: Connecting as Guest...");
+        let mut client = match SmbClient::connect(config).await {
+            Ok(client) => {
+                println!("  Connected");
+                client
             }
-        }
-
-        // Step 2: Try ipc_connect with the IP address as server name
-        println!("Step 2: ipc_connect('{}', 'Guest', '')", TEST_IP);
-
-        match client.ipc_connect(TEST_IP, "Guest", String::new()).await {
-            Ok(_) => println!("  ✅ ipc_connect succeeded"),
             Err(e) => {
-                println!("  ❌ ipc_connect failed: {:?}", e);
-
-                // Try an alternative approach - let's see if the connection is really established
-                println!("\nDiagnostic: Checking if connection exists for '{}'...", TEST_IP);
-                match client.get_connection(TEST_IP).await {
-                    Ok(_conn) => println!("  Connection exists"),
-                    Err(e) => println!("  No connection found: {:?}", e),
-                }
+                println!("  Connect failed: {:?}", e);
                 return;
             }
-        }
-
-        // Step 3: List shares
-        println!("Step 3: list_shares('{}')", TEST_IP);
+        };
 
-        match client.list_shares(TEST_IP).await {
+        // Step 2: List shares
+        println!("Step 2: Listing shares...");
+        match client.list_shares().await {
             Ok(shares) => {
-                println!("  ✅ Found {} shares:", shares.len());
+                println!("  Found {} shares:", shares.len());
                 for share in shares {
-                    println!("    - {:?}", share.netname);
+                    println!(
+                        "    - {} (type={}, comment={:?})",
+                        share.name, share.share_type, share.comment
+                    );
                 }
             }
             Err(e) => {
-                println!("  ❌ list_shares failed: {:?}", e);
+                println!("  list_shares failed: {:?}", e);
             }
         }
     }
 }
 
-#[cfg(target_os = "macos")]
+#[cfg(any(target_os = "macos", target_os = "linux"))]
 fn main() {
     inner::main();
 }
 
-#[cfg(not(target_os = "macos"))]
+#[cfg(not(any(target_os = "macos", target_os = "linux")))]
 fn main() {
-    println!("This example only works on macOS (requires the `smb` crate).");
+    println!("This example only works on macOS/Linux (requires the `smb2` crate).");
 }

apps/desktop/src-tauri/examples/docker_smb_test.rs

@@ -661,32 +661,33 @@ fn handle_upsert_entry_v2(
             // would leave counts wrong because the old type's count isn't decremented.
             let old_entry = IndexStore::get_entry_by_id(conn, existing_id).ok().flatten();
             if let Some(ref old) = old_entry
-                && old.is_directory != is_directory {
-                    log::debug!(
-                        "Writer: UpsertEntryV2 type change for id={existing_id} \
+                && old.is_directory != is_directory
+            {
+                log::debug!(
+                    "Writer: UpsertEntryV2 type change for id={existing_id} \
                          (was_dir={}, now_dir={is_directory}), converting to delete+insert",
-                        old.is_directory
-                    );
-                    if old.is_directory {
-                        handle_delete_subtree_by_id(conn, existing_id);
-                    } else {
-                        handle_delete_entry_by_id(conn, existing_id);
-                    }
-                    upsert_insert_new(
-                        conn,
-                        parent_id,
-                        &name,
-                        is_directory,
-                        is_symlink,
-                        logical_size,
-                        physical_size,
-                        modified_at,
-                        inode,
-                        should_dedup,
-                        next_id,
-                    );
-                    return;
+                    old.is_directory
+                );
+                if old.is_directory {
+                    handle_delete_subtree_by_id(conn, existing_id);
+                } else {
+                    handle_delete_entry_by_id(conn, existing_id);
                 }
+                upsert_insert_new(
+                    conn,
+                    parent_id,
+                    &name,
+                    is_directory,
+                    is_symlink,
+                    logical_size,
+                    physical_size,
+                    modified_at,
+                    inode,
+                    should_dedup,
+                    next_id,
+                );
+                return;
+            }
 
             upsert_update_existing(
                 conn,

apps/desktop/src-tauri/src/indexing/writer.rs

@@ -22,12 +22,9 @@ use notify as _;
 // drag is used by tauri-plugin-drag for drag-and-drop support
 use drag as _;
 //noinspection ALL
-// smb crates are used in network/smb_client module (macOS + Linux)
+// smb2 crate is used in network/smb_client module (macOS + Linux)
 #[cfg(any(target_os = "macos", target_os = "linux"))]
-use smb as _;
-//noinspection ALL
-#[cfg(any(target_os = "macos", target_os = "linux"))]
-use smb_rpc as _;
+use smb2 as _;
 
 //noinspection ALL
 // trash crate is used in write_operations/trash.rs (Linux only)
@@ -257,8 +254,7 @@ pub fn run() {
                 .level_for("nusb", log::LevelFilter::Warn)
                 .level_for("zbus", log::LevelFilter::Warn)
                 .level_for("tracing::span", log::LevelFilter::Warn)
-                .level_for("smb", log::LevelFilter::Warn)
-                .level_for("sspi", log::LevelFilter::Warn)
+                .level_for("smb2", log::LevelFilter::Warn)
                 .level_for("tao", log::LevelFilter::Warn);
 
             // Parse RUST_LOG env var for per-module level overrides

apps/desktop/src-tauri/src/lib.rs

@@ -7,14 +7,14 @@ Discover, browse, and mount SMB network shares. Works on macOS and Linux.
 - **Discovery**: `mdns_discovery.rs` — Pure Rust mDNS using `mdns-sd` crate. Cross-platform.
 - **E2E testing**: `virtual_smb_hosts.rs` — Injects synthetic `NetworkHost` entries for Docker SMB containers. Gated behind `smb-e2e` Cargo feature. Never enabled in production.
 - **Share listing**: Split across multiple files:
-  - `smb_client.rs` — Top-level share-listing entry point; orchestrates guest -> keychain -> prompt auth flow; tries smb-rs first, falls back to smbutil (macOS only)
-  - `smb_connection.rs` — TCP connection establishment and IPC-level share listing calls
+  - `smb_client.rs` — Top-level share-listing entry point; orchestrates guest -> keychain -> prompt auth flow; tries smb2 first, falls back to smbutil (macOS only)
+  - `smb_connection.rs` — TCP connection establishment and share listing via `smb2::SmbClient`
   - `smb_cache.rs` — 30-second in-memory cache for share lists, keyed by server address
   - `smb_smbutil.rs` — `smbutil view -G` fallback for older Samba/NAS servers (macOS); on Linux delegates to `smb_smbclient`
   - `smb_smbclient.rs` — `smbclient -L` fallback for Linux (requires `samba-client` package)
   - `linux_distro.rs` — Thin wrapper calling `crate::linux_distro::LinuxDistro` for smbclient install hints; `cfg(target_os = "linux")` gated
   - `smb_types.rs` — Shared types (`ShareInfo`, `AuthMode`, `ShareListError`, etc.)
-  - `smb_util.rs` — Helpers: hostname derivation, IP resolution, account-name normalization
+  - `smb_util.rs` — Helpers: error classification (`classify_error`, `is_auth_error`) and `convert_shares` (maps `smb2::ShareInfo` to Cmdr's `ShareInfo`)
 - **Mounting** (platform-specific via `#[path]` in `mod.rs`):
   - `mount.rs` — macOS `NetFSMountURLSync` for native `/Volumes/` mounts
   - `mount_linux.rs` — Linux `gio mount` for GVFS-based user-space mounts
@@ -28,7 +28,7 @@ Discover, browse, and mount SMB network shares. Works on macOS and Linux.
 | Component | macOS | Linux |
 |-----------|-------|-------|
 | mDNS discovery | `mdns-sd` (pure Rust) | `mdns-sd` (same) |
-| SMB share listing | `smb` + `smb-rpc` crates | `smb` + `smb-rpc` (same) |
+| SMB share listing | `smb2` crate (pure Rust) | `smb2` (same) |
 | smbutil fallback | `smbutil view -G` | `smbclient -L` (from `samba-client` package) |
 | Credential storage | `security-framework` (macOS Keychain) | `keyring` (Secret Service) → `cocoon` encrypted file fallback |
 | Mounting | `NetFSMountURLSync` → `/Volumes/` | `gio mount` → `/run/user/<uid>/gvfs/` |
@@ -47,16 +47,19 @@ Full UX control (login form appears in-pane), smart defaults (pre-fill username
 guest/credentials toggle. Uses `security-framework` crate for Keychain access. Passwords never stored in our settings
 file — only in Keychain. Linux uses `keyring` crate (Secret Service) with encrypted file fallback.
 
-### `smb-rs` for SMB share enumeration (not `pavao`/libsmbclient or `smbutil`)
+### `smb2` for SMB share enumeration (not `pavao`/libsmbclient, `smb-rs`, or `smbutil`)
 
 MIT license (compatible with BSL, allows dual-licensing for enterprise), pure Rust (no C dependencies), async-native
-(built on tokio), and cross-platform (macOS, Linux, Windows). `pavao` (libsmbclient wrapper) was rejected for its GPLv3
-license. `smbutil` CLI was rejected for fragile text parsing and process spawning. Fallback to `smbutil`/`smbclient` is
-available for older Samba servers where smb-rs's RPC fails.
+(built on tokio), cross-platform, and typed errors (`smb2::Error` variants vs string pattern matching). David's own
+crate — single dependency replaces the old `smb` + `smb-rpc` pair. `smb2::list_shares()` returns pre-filtered disk
+shares with clean `String` fields (no NDR parsing needed). Fallback to `smbutil`/`smbclient` is available for older
+Samba servers where smb2's RPC fails.
 
 ### Always use IP when available
 
-smb-rs doesn't resolve `.local` hostnames reliably (std lib DNS doesn't handle mDNS). Always pass resolved IP from mDNS discovery. If IP unavailable, use derived hostname (`service_name_to_hostname`).
+smb2 uses the addr host component in UNC paths (`\\server\IPC$`). When hostname has a `.local` suffix, strip it
+before passing as addr (some servers reject `.local` in UNC paths). Always pass resolved IP from mDNS discovery when
+available. If IP unavailable, use derived hostname with `.local` stripped.
 
 ### Guest-first auth flow
 
@@ -67,14 +70,14 @@ smb-rs doesn't resolve `.local` hostnames reliably (std lib DNS doesn't handle m
 
 ### smbutil / smbclient fallback
 
-`smb` crate fails on older Samba servers (for example, Raspberry Pi) with RPC incompatibility. Classify error as `ProtocolError`, then try a platform-specific CLI fallback:
+`smb2` crate may fail on older Samba servers with RPC incompatibility. Classify error as `ProtocolError`, then try a platform-specific CLI fallback:
 - **macOS:** `smbutil view -G` (built-in).
 - **Linux:** `smbclient -L` (from `samba-client` package). If `smbclient` is not installed, returns a `MissingDependency` error with a distro-specific install command (detected via `/etc/os-release`). The `smb_smbutil.rs` Linux stubs delegate to `smb_smbclient.rs`.
 - **Other platforms:** stubs return `ProtocolError`.
 
 ### No persistent connection pool
 
-smb-rs connections are lightweight and created on-demand. Caching is at the share list level (30s TTL), not TCP connection level.
+smb2 connections are lightweight (one `SmbClient` per connection) and created on-demand. Caching is at the share list level (30s TTL), not TCP connection level.
 
 ### In-memory credential cache
 
@@ -99,3 +102,4 @@ On Linux, `keychain_linux.rs` tries Secret Service (GNOME Keyring / KDE Wallet)
 - **`ShareListError` uses internally tagged serde format** (`#[serde(tag = "type")]`) with struct variants. This keeps a flat JSON shape (`{ "type": "protocol_error", "message": "..." }`). The `MissingDependency` variant adds an optional `installCommand` field. When adding new variants, use struct syntax (not tuple).
 - **macOS smbutil and NetFSMountURLSync fail with loopback IP + non-standard port**: `//127.0.0.1:9445` gives "Broken pipe", but `//localhost:9445` works. `build_smbutil_url` and `NetworkMountView.svelte` both fall back to hostname when IP is `127.0.0.1` or `::1`. This matters for E2E testing against Docker containers on localhost.
 - **Mount URL must include port when non-standard**: `NetworkMountView.svelte` appends `:PORT` to the server string when `port !== 445`. Without this, `NetFSMountURLSync` defaults to port 445 and can't reach Docker containers on custom ports.
+- **Strip `.local` from addr for smb2**: `smb2::Connection::connect()` extracts `server_name` from the addr string and uses it in UNC paths. Passing `"foo.local:445"` creates `\\foo.local\IPC$` which some servers reject. The `build_addr` helper in `smb_connection.rs` handles this.