EA name len must be less than 255 according to MS-FSCC ...

[Jeremy Allison]

On Tue, Dec 11, 2012 at 10:20:42AM -0800, Richard Sharpe wrote:
> On Tue, Dec 11, 2012 at 10:03 AM, Jeremy Allison <jra at samba.org> wrote:
> > On Tue, Dec 11, 2012 at 10:00:40AM -0800, Richard Sharpe wrote:
> >> Hi folks,
> >>
> >> according to [MS-FSCC].pdf section 2.4.15 we have:
> >>
> >> ---------------------
> >> EaNameLength (1 byte): An 8-bit unsigned integer that contains the
> >> length, in bytes, of the extended attribute name in the EaName field.
> >> This value MUST NOT include the terminating null character to EaName.
> >>
> >> EaName (variable): An array of 8-bit ASCII characters that contains
> >> the extended attribute name followed by a single terminating null
> >> character byte. The EaName MUST be less than 255 characters and MUST
> >> NOT contain any of the following characters:
> >> ASCII values 0x00 - 0x1F, \ / : * ? " < > | , + = [ ] ;
> >> ---------------------
> >>
> >> However, in source3/smbd/trans2.c:fill_ea_buffer we have:
> >>
> >>         for (p = pdata + 4; ea_list; ea_list = ea_list->next) {
> >>                 size_t dos_namelen;
> >>                 fstring dos_ea_name;
> >>                 push_ascii_fstring(dos_ea_name, ea_list->ea.name);
> >>                 dos_namelen = strlen(dos_ea_name);
> >>                 if (dos_namelen > 255 || dos_namelen == 0) {
> >>                         break;
> >>                 }
> >>
> >> The description in FSCC does seem a little confusing, but one possible
> >> interpretation is that the name, excluding the terminating NULL must
> >> be less than 255 ASCII chars in length. If that were the case, the
> >> test above is wrong.
> >
> > Test against Windows.
> >
> >> Does anyone have any examples of long EA names? Is there an easy way
> >> to set EAs from Windows?
> >
> > There is *no* way from the Win32 layer to create EA's against a
> > Windows server :-).
> 
> Hmmm, that seems not to be quite true:
> http://www.tech-archive.net/Archive/Development/microsoft.public.win32.programmer.kernel/2006-05/msg00485.html
> 
> There are also other references to the undocumented NTDLL call
> NTSetEaFile and this:
> 
>    http://www.zezula.net/en/fstools/filetest.html
> 
> I guess I will give it a try soon.

I did say Win32 layer :-). NtXXX calls are the Nt system
call layer below.

Anyway, I still think network probing using SMB calls is
a safer way to test - that describes exactly the behavior
on the wire we need to obey.

Jeremy.