[cifs-protocol] [REG:110012953632586] RE: Bug in MS-WINSRA section "220.127.116.11 Name Record"
billwe at microsoft.com
Sat Jan 30 06:37:04 MST 2010
Thanks Stefan - forwarding this email to Edgar, who owns the case.
MCSE, MCTS / Senior Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
Email: billwe at microsoft.com
Tel: +1(980) 776-8200
Cell: +1(704) 661-5438
Fax: +1(704) 665-9606
From: Stefan (metze) Metzmacher [mailto:metze at samba.org]
Sent: Saturday, January 30, 2010 4:40 AM
To: Bill Wesse
Cc: pfif at tridgell.net; cifs-protocol at samba.org; Interoperability Documentation Help
Subject: Re: Bug in MS-WINSRA section "18.104.22.168 Name Record"
there's one additional bug regarding the Name length.
> Name (variable): Name terminates with a 0x00 byte. It may include a
> NetBIOS scope identifier, as specified in [RFC1001]. The maximum
> length of the Name field is 255 bytes including the 0x00 byte. If no
> NetBIOS scope is included, then the length of the name is 17 including
> the 0x00 byte.
When a windows server gets a name with length == 255 it removes the last character of the scope before storing it.
Windows returns a name with length 254 when it returns the name again.
See the attached capture (172.31.9.211 is Windows 2008 and 172.31.9.1 is a modified smbtorture).
Frame 19 smbtorture => windows 2008 name length 255 Frame 25 windows 2008 => smbtorture name length 254
> Good morning Stefan - I am including our below initial response, since I missed CC: dochelp at microsoft.com on the first one.
> -----Original Message-----
> From: Bill Wesse
> Sent: Friday, January 29, 2010 9:59 AM
> To: 'metze at samba.org'
> Cc: MSSolve Case Email; 'pfif at tridgell.net'; 'cifs-protocol at samba.org'
> Subject: [REG:110012953632586] [MS-WINSRA] 22.214.171.124 Name Record
> Padding field description incorrect
> Good morning Stefan - thanks for your comments. I have created the below case to track the issue. One of my team members will contact you shortly!
> 110012953632586 [MS-WINSRA] 126.96.36.199 Name Record Padding field
> description incorrect
> Bill Wesse
> MCSE, MCTS / Senior Escalation Engineer, US-CSS DSC PROTOCOL TEAM
> 8055 Microsoft Way
> Charlotte, NC 28273
> Email: billwe at microsoft.com
> Tel: +1(980) 776-8200
> Cell: +1(704) 661-5438
> Fax: +1(704) 665-9606
> -----Original Message-----
> From: Stefan (metze) Metzmacher [mailto:metze at samba.org]
> Sent: Friday, January 29, 2010 9:25 AM
> To: Interoperability Documentation Help
> Cc: pfif at tridgell.net; cifs-protocol at samba.org
> Subject: CAR: Bug in MS-WINSRA section "188.8.131.52 Name Record"
> I found a bug in MS-WINSRA section "184.108.40.206 Name Record".
> It says:
>> Padding (variable): If the Name field is not 4-byte aligned, this
>> Padding field will be added to pad to 4-byte alignment. If the Name
>> field itself is 4-byte aligned, then there is no Padding field. This
>> field MUST be ignored upon receipt.
> This is wrong!
> The documentation would indicate this:
> pad_len = ((offset & (4-1)) == 0 ? 0 : (4 - (offset & (4-1))))
> But Windows Servers (at least 2003 SP1 and 2008) use this:
> pad_len = 4 - (offset & (4-1));
> The difference is the case where the name field is already 4 byte aligned. In that case Windows adds 4 bytes instead of 0 bytes of aligment.
> See frame 75 in the attached capture (172.31.9.211 is a windows 2008 server and 172.31.9.1 a modified smbtorture).
> The name length is 20 and there're 4 extra bytes before the Reserved1 field.
More information about the cifs-protocol