[cifs-protocol] RE: erroneous references to little-endian

Richard Guthrie rguthrie at microsoft.com
Tue Jun 16 20:21:50 GMT 2009


Thank you for the feedback.  In Section, the NETLOGON_NT_VERSION options bit table is indeed presented in little-endian byte ordering with the lowest order byte being represented by bits 0-7, the next higher byte represented by bits 8-15 and so on. Therefore the claim that the bit table is presented in little-endian format is correct. We have verified this for other bit fields in [MS-ADTS] as well. The explicit specification of whether the bytes are ordered in little-endian or big endian format is intended to clarify the relative position of the bytes in a multi-byte bit flag.

The NETLOGON_NT_VERSION options is not represented as an integer string over LDAP. It may appear in the LDAP search filter of an LDAP ping (Section 7.3.3) as a binary encoded value or it appears in an LDAP response to an LDAP ping (Section where it is packed as part of one of the following (in little-endian format): NETLOGON_PRIMARY_RESPONSE (described in Section, NETLOGON_SAM_LOGON_RESPONSE_NT40 (Section, NETLOGON_SAM_LOGON_RESPONSE (Section, or NETLOGON_SAM_LOGON_RESPONSE_EX (Section  Please let us know if you have any further questions/feedback.

Richard Guthrie
Support Escalation Engineer 
Open Protocols Support Team
Tel: +1 (469) 775-7794
E-mail: rguthrie at microsoft.com   

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at samba.org] 
Sent: Thursday, May 28, 2009 8:39 PM
To: Richard Guthrie
Cc: Interoperability Documentation Help; pfif at tridgell.net; cifs-protocol at samba.org
Subject: RE: erroneous references to little-endian

On Thu, 2009-05-28 at 06:03 -0700, Richard Guthrie wrote:
> Andrew,
> We have completed our investigation and have updated the documentation 
> to remove references that specify a parameter as little endian where 
> the values endianess is negotiated by the underlying RPC protocol as 
> we discussed previously.  Here is the list of fields in which the endianess text was removed:


However, have you made investigations to see if this has occurred in any other protocols?  

For example, MS-ADTS continues the fine tradition of claiming to present a bit table in little endian, but it is actually big-endian (and is an integer string on LDAP, and little-endian in the NBT netlogon dgram

Andrew Bartlett

Andrew Bartlett
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.

More information about the cifs-protocol mailing list