Open mxmlnkn opened 1 month ago
Thanks Max, for the report
Is this test executed using a Samba container?
See the last part of the "Testing" section from the Readme
https://github.com/jborean93/smbprotocol/blob/master/README.md#testing
source ./build_helpers/lib.sh
lib::setup::smb_server
There are various automated tests
for example this one
It would help to get this reproduced using the automated tests.
In this way, if this needs an improvement to the tests, once this is fixed, we know that this use case is covered for any of the future releases
Is this test executed using a Samba container?
No. I have simply installed the Ubuntu samba package via apt.
There are various automated tests
At this point, I feel veritably cursed to trigger every possible issue. The tests failed because I had an smbclient.py
file in my PATH
:
ImportError while loading conftest 'smbprotocol/tests/conftest.py'.
tests/conftest.py:9: in <module>
from smbclient import ClientConfig, delete_session, mkdir
E ImportError: cannot import name 'ClientConfig' from 'smbclient' (/home/user/.local/bin/smbclient.py)
After renaming that by stripping the .py extension, the tests run through successfully. Although there are some skipped ones because of The SMB_SHARE env var was not set, integration tests will be skipped
. After setting up the environment variables with: SMB_USER=$user SMB_PASSWORD=$password SMB_SERVER=127.0.0.1 SMB_PORT=445 SMB_SHARE=test-share py.test -v --cov smbprotocol --cov-report term-missing
, a lot of the tests are still failing:
I am probably still misconfiguring something ... The credentials work with smbclient (and anonymous login also works, so they shouldn't even be necessary).
Your linked test_dialect_3_1_1_not_require_signing
test shows up as PASSED
.
Potentially Samba is adding another check on the tree to not allow tree connects without signing. I'll have to try and set up a test environment to try this out to see what is happening here.
Edit: This actually shouldn't matter, require_signing=False
doesn't disable signing, it just allows the client to connect to a server where signing is not available.
sudo apt install samba sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.old sudo nano /etc/samba/smb.conf
[visualstudio] path = /home/kali/data browseable = yes read only = no
sudo smbpasswd -a kali
sudo systemctl start smbd sudo systemctl start nmbd
mkdir /home/kali/data chmod -R 777 /home/kali/data
Ok I was wrong, the require_signing
kwarg does control whether the client will sign the data or not. When enabling the debug logs you can see the Samba is rejecting the tree connect with
smbd_smb2_tree_connect: reject request to share [test] as '6380EEC6753A\sambauser' without encryption or signing. Disconnecting.
smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../../source3/smbd/smb2_tcon.c:151
Server exit (NT_STATUS_END_OF_FILE)
It looks like Samba requires either signing or encryption to be used when the dialect is SMB 3.11 or greater. The check for this is at https://github.com/samba-team/samba/blame/9ad287ed9c4a06c34db4e6431e5845ffd2100e2a/source3/smbd/smb2_tcon.c#L240-L253 and doesn't seem to be controllable. While the kwarg name is poorly named it's not something I can change at this point in time and Samba requires signing or encryption for non-guest sessions. Without it you'll see this failure.
I have set up a samba share:
I have successfully connected to it with:
and even with:
However, with
require_signing=False
, i.e.:I get:
which make no sense to me. I am only lowering requirements, not outright disabling signing. And why should the login still succeed but only result in an access rights error for listing the share further on?