[Samba] Did anybody test smbclient4 against smbd4 using SMB2

[Jun Yi]

Dear everybody,

I want to give a shout "Did anybody test smbclient4 against smbd4 using
SMB2". I failed to do so. I always got the error
NT_STATUS_REVISION_MISMATCH. I don't believe that my configuration is
wrong. I am checking the source code, but I really want somebody to tell me
if they have done it and succeeded.

Thanks

Jun
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Andrew Bartlett]

On Tue, 2012-09-25 at 01:14 -0700, Jun Yi wrote:
> Dear everybody,
>
> I want to give a shout "Did anybody test smbclient4 against smbd4 using
> SMB2". I failed to do so. I always got the error
> NT_STATUS_REVISION_MISMATCH. I don't believe that my configuration is
> wrong. I am checking the source code, but I really want somebody to tell me
> if they have done it and succeeded.

I'm a little confused by the way you are describing the components you
are using, as we don't produce a smbd4.

Either way, perhaps it would help if we went back to basics. In master,
it seems that the smbclient binaries can use SMB2, but smbclient4
cannot.

Can you show your configuration? How are you selecting smb2 on the
client and server?

What exact version are you running?

What exact command fails? What is the full error?

If my explanation above isn't enough, an you provide a .pcap network
capture and level 10 log?

Andrew Bartlett


--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org

[Jun Yi]

Hi Andrew,

I forgot to attach the log at the client side, please find it in the
attachment.
I also add some debug by myself, please see the following debug output in
the client log:
----------------------------------------------
SMB2 dialect revision received from server is 767
The common SMB2 dialect revision for both client and server is 0
SMB2 dialect revision received from server is 528
The common SMB2 dialect revision for both client and server is 7
NEG SUCCEEDs
----------------------------------------------

Does the debug output above proved that the negotiation phase is not the
problem? I observed that the client silently closed the TCP connection
after two rounds of protocol negotiation.
Will the problem be the authentication method negotiation? Please point it
out to me.

Thanks and wait for your reply!

Jun


On Tue, Sep 25, 2012 at 10:43 AM, Jun Yi <yi.ju...@gmail.com> wrote:

> Thanks Andrew,
>
> Let's first clarify the version I used. I use the master branch, e.g.,
> version 4.1.0, for both client and server sides.
>
> I run smbclient4 at the client side:
> junyij@junyij] ./smbclient4
> -V
>
> Version 4.1.0pre1-DEVELOPERBUILD
> junyij@junyij] ./smbclient4 -m SMB2 -W smb-workgroup -U junyij
> //localhost/share1
>
> Connection to \\localhost\share1 failed - NT_STATUS_REVISION_MISMATCH
>
> I run sbmd at the server side with configuration file /etc/samba/smb.conf
> junyij@junyij] sudo ./smbd
> -V
>
> Version 4.1.0pre1-DEVELOPERBUILD
> sudo ./smbd -s /etc/samba/smb.conf -d 10 -l smbd-4
> junyij@junyij] cat
> /etc/samba/smb.conf
>
> [global]
> workgroup = smb-workgroup
> max protocol = SMB2
> min protocol = SMB2
> [share1]
> path = /tmp
>
> The generated log file ./smbd-4/log.smbd and the captured txt file (using
> filter tcp.port == 445 for wireshark) are attached in this email.
> Please forgive me that I used a very old wireshark which can save it as
> pcap file.
>
> Thanks and earnestly wait for your reply.
>
> Jun

[Andrew Bartlett]

I examined the source code used by smbclient4, and as far as I can tell
this tool simply cannot do smb2. Therefore, as you have seen, this will
fail.

You could try 'smbclient' (which uses a different codebase), which
appears to have some support, but I'm not sure exactly how much is
connected there.

[Jun Yi]

Thanks Andrew.

I found the code path for smbclient4 is up to date at most of 2007. So it
may be outdated. I also found the code path for smbclient is outdated too.
smbclient is older than smbclient4 and it can only supports smb1. I type
"smbclient -m SMB2 //server/share" and get message "SMB2 protocol
unrecognized".

I have the following two questions:
1: how to build smbtorture in the master branch. Does smbtorture support
SMB2? Did anybody use smbtorture to test against smbd daily? Where can I
find the document for smbtorture---smbd tests.
2: Did anybody use smbtorture to test against windows servers (for example
windows 7 or windows server 2008 R2). Could you please tell me how to do
that and where I can find the document?
3: I read a little of smbtorture source code (I will read more). I know
where to add a new test case into the framework. To add a runnable test
case, what part of the source codes should I read. Should I read the entire
source code?

Thanks and wait for your reply

Jun

[Andrew Bartlett]

On Tue, 2012-09-25 at 16:05 -0700, Jun Yi wrote:
> Thanks Andrew.
>
> I found the code path for smbclient4 is up to date at most of 2007. So it
> may be outdated. I also found the code path for smbclient is outdated too.
> smbclient is older than smbclient4 and it can only supports smb1. I type
> "smbclient -m SMB2 //server/share" and get message "SMB2 protocol
> unrecognized".

That's interesting, but not unexpected. The focus of the team has been
in smbtorture tests and enabling windows clients, and it seems nobody
has turned their attention to using this in our client code. The
message you get is from the simple switch statement in
source3/lib/util.c:interpret_protocol(). However, I would be quite
surprised if changing that suddenly made the rest of the code work.

> I have the following two questions:
> 1: how to build smbtorture in the master branch. Does smbtorture support
> SMB2? Did anybody use smbtorture to test against smbd daily? Where can I
> find the document for smbtorture---smbd tests.

Yes, these tests are run multiple times per day in our automated
selftest system. This is started with 'make test'.

> 2: Did anybody use smbtorture to test against windows servers (for example
> windows 7 or windows server 2008 R2). Could you please tell me how to do
> that and where I can find the document?

Generally you can run any test with something like
'smbtorture //host/share test.name -Uuser%pass'

> 3: I read a little of smbtorture source code (I will read more). I know
> where to add a new test case into the framework. To add a runnable test
> case, what part of the source codes should I read. Should I read the entire
> source code?

Volker gave you some clues earlier, I suggest following those up.

Registering new tests is a little tricky, the easiest way essentially is
to follow the example of a similar test you wish to adapt.

[Jun Yi]

Thanks Andrew,

Let's first clarify the version I used. I use the master branch, e.g.,
version 4.1.0, for both client and server sides.

I run smbclient4 at the client side:
junyij@junyij] ./smbclient4
-V

Version 4.1.0pre1-DEVELOPERBUILD
junyij@junyij] ./smbclient4 -m SMB2 -W smb-workgroup -U junyij
//localhost/share1

Connection to \\localhost\share1 failed - NT_STATUS_REVISION_MISMATCH

I run sbmd at the server side with configuration file /etc/samba/smb.conf
junyij@junyij] sudo ./smbd
-V

Version 4.1.0pre1-DEVELOPERBUILD
sudo ./smbd -s /etc/samba/smb.conf -d 10 -l smbd-4
junyij@junyij] cat
/etc/samba/smb.conf

[global]
workgroup = smb-workgroup
max protocol = SMB2
min protocol = SMB2
[share1]
path = /tmp

The generated log file ./smbd-4/log.smbd and the captured txt file (using
filter tcp.port == 445 for wireshark) are attached in this email.
Please forgive me that I used a very old wireshark which can save it as
pcap file.

Thanks and earnestly wait for your reply.

Jun

On Tue, Sep 25, 2012 at 2:10 AM, Andrew Bartlett <abar...@samba.org> wrote:

[Stefan (metze) Metzmacher]

Am 25.09.2012 19:43, schrieb Jun Yi:
> Thanks Andrew,
>
> Let's first clarify the version I used. I use the master branch, e.g.,
> version 4.1.0, for both client and server sides.
>
> I run smbclient4 at the client side:
> junyij@junyij] ./smbclient4
> -V
>
> Version 4.1.0pre1-DEVELOPERBUILD
> junyij@junyij] ./smbclient4 -m SMB2 -W smb-workgroup -U junyij
> //localhost/share1
>
> Connection to \\localhost\share1 failed - NT_STATUS_REVISION_MISMATCH

smbclient4 is not really supported at all, it might be removed in future.
It also doesn't support smb2!

smbclient doesn't support smb2/3 neither, but we may add that for
Samba-4.1.0,
but it won't be in Samba-4.0.0.

smbtorture and smbtorture3 both have some smb2/3 tests.

While developing new tests we typically verify them against
the latest Windows version (the reference implementation).

And they run in 'make test' before any commit hits our
main git repository (for the master and v4-0-test branches).

You can run smbtorture like

bin/smbtorture -Uadministrator%A1b2C3d4 //172.31.9.198/torture
smb2.durable-open

This lists all test-suites:
bin/smbtorture --list-suites
This all subtests
bin/smbtorture --list

'./smbtorture3 --help' will show all all smbtorture3 tests.
It can be used like this:
bin/smbtorture3 //172.31.9.198/torture -Uadministrator%A1b2C3d4 SMB2-NEGPROT

metze