Vista client + NetBIOS session setup message

[Todd Stecher]

Thanks -

It turns out this was a red-herring.  Vista now does the following  
port negotiation under some circumstances (unclear which, but its  
irrelevant now that I understand what's happening):


1) Asynchronous, simultaneous, TCP connections are issued for both the  
NetBIOS (139) and CIFS (434) ports.
2) 434 is the preferred port, so if a connection is established, the  
Vista client RST,ACKs the 139 connection.
3) This typically happens before reply_special() gets a chance to  
reply, so when an attempt is made to send back the data, you get the  
error:

>> sloisn01-1: [2008/01/14 16:33:46, 0, pid=77015, effective(0, 0),  
>> real(0,
>> 0)] lib/util_sock.c:write_data(563)
>>  write_data: write failure in writing to client 10.0.13.40. Error
>> Broken pipe
>> sloisn01-1: [2008/01/14 16:33:46, 0, pid=77015, effective(0, 0),  
>> real(0,
>> 0)] lib/util_sock.c:send_smb(1016)
>>  Error writing 4 bytes to client. -1. (Broken pipe)


It turns out this appears to be more of a problem with chkpath / DFS /  
Vista than with the initial NBSS message.  I could
be wrong, but that appears to be the most obvious problem.

Todd


On Feb 20, 2008, at 2:10 PM, Christopher R. Hertel wrote:

> Todd,
>
> I don't have Vista available to me, so I am doing a good deal of  
> guesswork
> here, but my guess is that the NetBIOS Session Setup Request message  
> would
> be used if the Vista CIFS client resolved the name via the NBT name  
> service
> rather than the DNS.
>
> With older Windows flavors (W2K is what I've tested), if you send a  
> NetBIOS
> Session Setup Request to port 445 the request is ignored and you  
> time out
> waiting for a reply.  The Session Setup Requests were handled  
> properly on
> port 139.
>
> Is this anywhere close to what you're asking about?
>
> Chris -)-----
>
> Todd Stecher wrote:
>> I'm looking at a way to trigger a NBSS message from Vista.  On our
>> 3.0.24 distro, Vista clients at our customer site send a NBSS  
>> request,
>> get back the response, and then disconnect the session.  Here's the  
>> cap
>> + associated log entry.
>>
>>
>>
>> sloisn01-1: [2008/01/14 16:33:46, 0, pid=77015, effective(0, 0),  
>> real(0,
>> 0)] lib/util_sock.c:write_data(563)
>>  write_data: write failure in writing to client 10.0.13.40. Error
>> Broken pipe
>> sloisn01-1: [2008/01/14 16:33:46, 0, pid=77015, effective(0, 0),  
>> real(0,
>> 0)] lib/util_sock.c:send_smb(1016)
>>  Error writing 4 bytes to client. -1. (Broken pipe)
>>
>> I didn't think anyone used NBSS messages anymore, and I'm having a
>> degree of difficulty getting an in-house repro on my Vista client,  
>> since
>> it always seems to skip NBSS.
>>
>> 1) Is there any way to send this message via SMBTorture?
>> 2) Does anyone know how to get Vista to emit this message?  I'm  
>> guessing
>> its join state + some mystery policy cause Vista to try NBSS, but  
>> I've
>> been unable to unravel the mystery.
>>
>> Todd Stecher | Windows Interop Dev
>> Isilon Systems    P +1-206-315-7500     F  +1-206-315-7501
>> www.isilon.com    D +1-206-315-7638    M +1-425-205-1180
>>
>>
>>
>
> -- 
> "Implementing CIFS - the Common Internet FileSystem"    ISBN:  
> 013047116X
> Samba Team -- http://www.samba.org/    -)-----     Christopher R.  
> Hertel
> jCIFS Team -- http://jcifs.samba.org/  -)-----  ubiqx development,  
> uninq
> ubiqx Team -- http://www.ubiqx.org/    -)-----          crh at ubiqx.mn.org
> OnLineBook -- http://ubiqx.org/cifs/   -)-----             crh at ubiqx.org

Todd Stecher | Windows Interop Dev
Isilon Systems    P +1-206-315-7500     F  +1-206-315-7501
www.isilon.com    D +1-206-315-7638    M +1-425-205-1180