saltcorn-samba 0.4.12 → 0.4.13

package/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to `saltcorn-samba` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.4.13] – 2026-07-06
+
+### Fixed – **QUERY_DIRECTORY leere Patterns → 0xC0000033 (die eigentliche Ursache)**
+
+Mit v0.4.12 wurde ein Wire-Bug in smb3-client (FileNameOffset) gefixt,
+aber Samba lehnte weiterhin ab. Mit dem neuen `tools/diag-wire.js` konnte
+die tatsächliche Ursache byteweise verifiziert werden:
+
+**Bug:** smb3-client's `readdirAll` sendet ab der 2. Enumeration-Seite
+`searchPattern=""` (leerer String). Windows toleriert das, aber Samba's
+`source3/smbd/smb2_query_directory.c` enthält den strikten Check:
+
+```c
+if (state->in_file_name[0] == '\0') {
+    tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
+    return tevent_req_post(req, ev);
+}
+```
+
+Das ergibt exakt den STATUS_OBJECT_NAME_INVALID (0xC0000033), den wir
+seit v0.4.0 sehen.
+
+**Fix in `readdir-compat.js`:** Der eigene Enumeration-Loop sendet auf
+**jeder** Seite `searchPattern="*"`, nicht nur beim ersten Request.
+`RESTART_SCANS` wird nur beim ersten Request gesetzt; ab dann sendet
+Samba nach dem letzten Batch korrekt STATUS_NO_MORE_FILES, was den Loop
+sauber terminiert. Verifiziert via `diag-wire.js`:
+
+- Probe 1 (pat=`*`, RESTART): STATUS_SUCCESS, 8 Einträge
+- Probe 2 (pat=`*`, ohne RESTART): STATUS_NO_MORE_FILES → Loop-Ende
+- Probe 6 (pat=`""`, offset=0): **0xC0000033** ← der Bug
+
+### Added
+
+- `tools/diag-wire.js` – Wire-Level-Diagnose mit Hex-Dump der SMB2-Bytes,
+  testet 6 verschiedene QUERY_DIRECTORY-Varianten (Info-Class, Buffer-
+  Größe, mit/ohne Pattern). Nützlich für zukünftige Kompatibilitäts-
+  probleme mit anderen SMB-Servern.
+
+### Upstream-Report aktualisiert
+
+`smb3-client-bug-report.md` beschreibt jetzt beide Bugs (FileNameOffset
+**und** leeres Pattern gegen Samba). Beide Fixes sind identisch simpel:
+auf jeder Page `*` senden.
+
 ## [0.4.12] – 2026-07-06
 
 ### Fixed – **`0xC0000033` beim readdir gegen Samba 4.23 endgültig behoben (Root Cause identifiziert)**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saltcorn-samba",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "Saltcorn plugin: browse, upload, rename and delete files on a Samba/CIFS share via SMB 3.1.1 (AES-CMAC signing, optional encryption). File-manager view, directory tree, inline PDF viewer, external-app open (smb://).",
   "main": "index.js",
   "scripts": {
@@ -44,6 +44,7 @@
     "filemanager-view.js",
     "pdf-view.js",
     "public/",
+    "tools/",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"

package/readdir-compat.js

@@ -1,17 +1,24 @@
 "use strict";
 
 /**
- * readdir-compat.js  —  saltcorn-samba 0.4.12
+ * readdir-compat.js  —  saltcorn-samba 0.4.13
  *
- * Behebt einen QUERY_DIRECTORY-Wire-Format-Bug in smb3-client@0.2.0 der
- * gegen Samba 4.23 zu STATUS_OBJECT_NAME_INVALID (0xC0000033) führt.
+ * Behebt zwei QUERY_DIRECTORY-Wire-Bugs in smb3-client@0.2.0 die
+ * gegen Samba 4.23 zu STATUS_OBJECT_NAME_INVALID (0xC0000033) führen.
  *
- * Root cause (dokumentiert in tools/diag-basepath.js-Report):
+ * BUG 1 (FileNameOffset bei leerem Pattern):
  *   smb3-client's `encodeQueryDirectoryRequest` setzt `FileNameOffset`
- *   immer auf 96 — auch wenn `FileNameLength === 0` gesendet wird
- *   (auf 2. und folgenden Enumeration-Pages).
+ *   immer auf 96 — auch wenn `FileNameLength === 0` gesendet wird.
  *   MS-SMB2 §2.2.33 verlangt für diesen Fall FileNameOffset = 0.
- *   Windows toleriert die Fehlbelegung, Samba 4.23 nicht.
+ *
+ * BUG 2 (Leeres Pattern auf Folge-Pages):  ← Der Hauptbug!
+ *   smb3-client sendet ab der 2. Enumeration-Page `searchPattern=""`.
+ *   Windows toleriert das, Samba 4.23 lehnt es strikt ab. Belegt via
+ *   diag-wire.js: `smb2_query_directory.c` prüft `in_file_name[0] ==
+ *   '\0'` und antwortet dann mit STATUS_OBJECT_NAME_INVALID.
+ *   Fix: Auf jeder Page `*` senden. RESTART_SCANS nur beim ersten Mal.
+ *   Samba beendet die Enumeration dann korrekt mit
+ *   STATUS_NO_MORE_FILES auf einem Folge-Request ohne RESTART_SCANS.
  *
  * Strategie:
  *   Statt smb3-client's `client.readdir()` / `readdirAll` verwenden wir
@@ -21,9 +28,6 @@
  *
  * Nur die interne wire-Struktur wird via file:// URL importiert, weil
  * smb3-client's `exports`-Gate keine Subpath-Imports zulässt.
- *
- * Idempotent, thread-safe (Node ist single-threaded, aber wir wollen
- * keinen Race auf paralleler Erst-Nutzung).
  */
 
 const fs = require("fs");
@@ -154,8 +158,13 @@ function encodeQueryDirectoryRequestFixed(I, req) {
 
 /**
  * QUERY_DIRECTORY-Loop mit gepatchtem Encoder.
- * Nachbildung von smb3-client's readdirAll(), aber mit korrektem
- * FileNameOffset auf Folge-Pages.
+ *
+ * Unterschiede zu smb3-client's readdirAll():
+ *   1. Auf Folge-Pages wird `searchPattern="*"` gesendet (nicht "").
+ *      Samba lehnt leere Patterns strikt ab (STATUS_OBJECT_NAME_INVALID).
+ *   2. RESTART_SCANS nur beim ersten Request.
+ *   3. Encoder setzt FileNameOffset=0 bei leerem Pattern (Fallback für
+ *      andere kaputte Server, wird hier faktisch nie benutzt).
  */
 async function readdirAllFixed(I, open) {
   const items = [];
@@ -167,7 +176,7 @@ async function readdirAllFixed(I, open) {
       flags: first ? I.QueryDirectoryFlag.RESTART_SCANS : 0,
       fileIndex: 0,
       fileId: open.fileId,
-      searchPattern: first ? "*" : "",
+      searchPattern: "*", // IMMER "*", nie "" — Samba lehnt leer ab
       outputBufferLength: 65536,
     });
     first = false;

package/tools/diag-basepath.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+/**
+ * Standalone diagnostic script for saltcorn-samba.
+ * Runs a series of individual SMB3 operations against a share so we can see
+ * exactly which primitive fails and why. Prints raw NT status codes.
+ *
+ * Usage (from the plugin directory, so smb3-client resolves):
+ *
+ *   node tools/diag-basepath.js \
+ *     --host 192.168.110.10 --share buero --user 01_vassen \
+ *     --domain buero.ib-vassen.de --password '…' \
+ *     --path static
+ *
+ * The script never writes; it only opens handles.
+ */
+
+"use strict";
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const required = ["host", "share", "user", "path"];
+  for (const k of required) {
+    if (!args[k]) {
+      console.error("missing required --" + k);
+      process.exit(2);
+    }
+  }
+  const password = args.password || process.env.SMB_PASSWORD || "";
+  if (!password) {
+    console.error("missing --password (or SMB_PASSWORD env var)");
+    process.exit(2);
+  }
+
+  const { Client } = await import("smb3-client");
+
+  const client = new Client({
+    host: args.host,
+    port: Number(args.port) || 445,
+    domain: args.domain || "",
+    username: args.user,
+    password,
+    connectTimeout: 10_000,
+    requestTimeout: 30_000,
+    signing: args.signing || "if-offered",
+    encryption: args.encryption || "if-offered",
+  });
+
+  console.log("[1/7] Connecting …");
+  await client.connect();
+  console.log("      \u2713 TCP + Negotiate + Session-Setup + Auth OK");
+
+  const share = args.share;
+  const path = args.path;
+  const shareAndPath = share + "/" + path;
+  console.log("[2/7] TREE_CONNECT to \\\\" + args.host + "\\" + share + " \u2026");
+  try {
+    // Trigger TREE_CONNECT by touching the raw internal — but smb3-client
+    // does that implicitly on the first per-share call. So instead we call
+    // a cheap op below and let the connect surface the error there.
+    console.log("      (deferred until first op)");
+  } catch (e) {
+    console.error("      \u2717 TREE_CONNECT failed:", e && e.message);
+  }
+
+  // --- Probes ------------------------------------------------------------
+  const probes = [
+    { label: "readdir(share)      \u2014 SHARE ROOT",           op: () => client.readdir(share) },
+    { label: "readdir(share/'')   \u2014 empty subpath",         op: () => client.readdir(share + "/") },
+    { label: "stat(share/path)    \u2014 target as-is",           op: () => client.stat(shareAndPath) },
+    { label: "readdir(share/path) \u2014 target as-is",           op: () => client.readdir(shareAndPath) },
+    { label: "readdir(share/PATH) \u2014 target uppercased",      op: () => client.readdir(share + "/" + path.toUpperCase()) },
+    { label: "readdir(share/path.lc) \u2014 target lowercased",   op: () => client.readdir(share + "/" + path.toLowerCase()) },
+  ];
+
+  let step = 3;
+  for (const p of probes) {
+    console.log("[" + step + "/7] " + p.label);
+    try {
+      const r = await p.op();
+      const preview = Array.isArray(r)
+        ? " (" + r.length + " entries" +
+          (r.length ? ", first: " +
+            JSON.stringify(r.slice(0, 3).map((e) => (typeof e === "string" ? e : e.name))) : "") + ")"
+        : " (" + JSON.stringify(r).slice(0, 120) + ")";
+      console.log("      \u2713 OK" + preview);
+    } catch (e) {
+      console.log("      \u2717 " + (e && e.message ? e.message.split("\n")[0] : String(e)));
+      if (e && e.status) console.log("        NT status: 0x" + e.status.toString(16));
+      if (e && e.code)   console.log("        error code: " + e.code);
+    }
+    step++;
+  }
+
+  await client.disconnect();
+  console.log("Done.");
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const nxt = argv[i + 1];
+      if (!nxt || nxt.startsWith("--")) { out[key] = true; }
+      else { out[key] = nxt; i++; }
+    }
+  }
+  return out;
+}
+
+main().catch((e) => {
+  console.error("FATAL:", e && e.stack || e);
+  process.exit(1);
+});

package/tools/diag-wire.js

@@ -0,0 +1,352 @@
+#!/usr/bin/env node
+/**
+ * diag-wire.js — Wire-level QUERY_DIRECTORY diagnostic.
+ *
+ * Opens a connection, tree-connects, opens the target directory, then sends
+ * a hand-built QUERY_DIRECTORY packet with FULL HEX DUMP of both request
+ * and response. This bypasses smb3-client's encoders so we can compare bytes.
+ *
+ * Usage (from the plugin directory):
+ *   node tools/diag-wire.js \
+ *     --host 192.168.110.10 --share buero --user 01_vassen \
+ *     --domain buero.ib-vassen.de --password '...' \
+ *     --path static
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const url = require("url");
+
+async function loadInternals() {
+  const candidates = [
+    path.join(__dirname, "..", "node_modules", "smb3-client"),
+    path.join(__dirname, "..", "..", "node_modules", "smb3-client"),
+  ];
+  let smb3Root = null;
+  for (const c of candidates) {
+    try {
+      fs.accessSync(path.join(c, "dist", "index.js"));
+      smb3Root = c;
+      break;
+    } catch (_) {}
+  }
+  if (!smb3Root) {
+    throw new Error("smb3-client not found in node_modules");
+  }
+  const distDir = path.join(smb3Root, "dist");
+  const load = (rel) => import(url.pathToFileURL(path.join(distDir, rel)).href);
+
+  const [
+    idx,
+    bufMod,
+    qdMod,
+    cmdMod,
+    qiMod,
+    createStructMod,
+    pathsMod,
+    errMod,
+    openMod,
+  ] = await Promise.all([
+    load("index.js"),
+    load("wire/buffer.js"),
+    load("wire/structs/queryDirectory.js"),
+    load("wire/commands.js"),
+    load("wire/structs/queryInfo.js"),
+    load("wire/structs/create.js"),
+    load("paths.js"),
+    load("errors.js"),
+    load("open/open.js"),
+  ]);
+
+  return {
+    Client: idx.Client,
+    Writer: bufMod.Writer,
+    encodeQueryDirectoryRequest: qdMod.encodeQueryDirectoryRequest,
+    decodeQueryDirectoryResponse: qdMod.decodeQueryDirectoryResponse,
+    parseFileIdBothDirectoryInformation: qdMod.parseFileIdBothDirectoryInformation,
+    QueryDirectoryFlag: qdMod.QueryDirectoryFlag,
+    SmbCommand: cmdMod.SmbCommand,
+    NTStatus: cmdMod.NTStatus,
+    isSuccess: cmdMod.isSuccess,
+    statusName: cmdMod.statusName,
+    FileInformationClass: qiMod.FileInformationClass,
+    FileAccess: createStructMod.FileAccess,
+    ShareAccess: createStructMod.ShareAccess,
+    CreateDisposition: createStructMod.CreateDisposition,
+    CreateOptions: createStructMod.CreateOptions,
+    splitSharePath: pathsMod.splitSharePath,
+    toSmbPath: pathsMod.toSmbPath,
+    SmbError: errMod.SmbError,
+    Open: openMod.Open,
+  };
+}
+
+function hex(buf, label) {
+  console.log(`\n--- ${label} (${buf.length} bytes) ---`);
+  for (let off = 0; off < buf.length; off += 16) {
+    const slice = buf.slice(off, Math.min(off + 16, buf.length));
+    const hexPart = Array.from(slice)
+      .map((b) => b.toString(16).padStart(2, "0"))
+      .join(" ")
+      .padEnd(48);
+    const asciiPart = Array.from(slice)
+      .map((b) => (b >= 32 && b < 127 ? String.fromCharCode(b) : "."))
+      .join("");
+    console.log(
+      `${off.toString(16).padStart(4, "0")}  ${hexPart}  ${asciiPart}`
+    );
+  }
+}
+
+// Build QUERY_DIRECTORY body byte-by-byte with named fields
+function buildQdBody(I, opts) {
+  const {
+    fileInformationClass,
+    flags,
+    fileIndex,
+    fileId,
+    searchPattern,
+    outputBufferLength,
+    forceFileNameOffsetZero, // testing variant
+  } = opts;
+
+  const pat = Buffer.from(searchPattern, "utf16le");
+  const w = new I.Writer();
+  w.u16(33); // StructureSize
+  w.u8(fileInformationClass);
+  w.u8(flags);
+  w.u32(fileIndex);
+  w.bytes(fileId); // 16
+  const fileNameOffset = forceFileNameOffsetZero
+    ? 0
+    : pat.length === 0
+      ? 0
+      : 64 + 32;
+  w.u16(fileNameOffset);
+  w.u16(pat.length);
+  w.u32(outputBufferLength);
+  if (pat.length === 0) {
+    w.u8(0); // pad byte
+  } else {
+    w.bytes(pat);
+  }
+  return w.buffer();
+}
+
+async function sendRaw(open, I, opts, label) {
+  const body = buildQdBody(I, opts);
+  hex(body, `${label} REQUEST BODY`);
+  console.log(
+    `Fields: StructSize=33, FileInformationClass=${opts.fileInformationClass}, ` +
+      `Flags=${opts.flags}, FileNameLength=${
+        Buffer.from(opts.searchPattern, "utf16le").length
+      }, ` +
+      `OutputBufferLength=${opts.outputBufferLength}`
+  );
+  const fnOff = body.readUInt16LE(32 - 8);
+  console.log(`FileNameOffset (from body): ${fnOff}`);
+
+  const signing = open.tree.session.makeSigning();
+  try {
+    const resp = await open.tree.conn.send(I.SmbCommand.QUERY_DIRECTORY, body, {
+      sessionId: open.tree.session.sessionId,
+      treeId: open.tree.treeId,
+      ...(signing !== undefined ? { signing } : {}),
+      encrypt: open.tree.encryptRequired,
+      creditCharge: 1,
+    });
+    console.log(
+      `RESPONSE status: 0x${resp.header.status.toString(16)} (${I.statusName(
+        resp.header.status
+      )})`
+    );
+    hex(resp.body.slice(0, Math.min(resp.body.length, 128)), `${label} RESPONSE BODY (first 128)`);
+    if (I.isSuccess(resp.header.status)) {
+      const buf = I.decodeQueryDirectoryResponse(resp.body, 64);
+      const items = I.parseFileIdBothDirectoryInformation(buf);
+      console.log(
+        `Decoded ${items.length} entries: ${items.slice(0, 5).map((e) => e.fileName).join(", ")}`
+      );
+    }
+    return resp;
+  } catch (e) {
+    console.log(`SEND ERROR: ${e.message}`);
+    if (e.status) console.log(`  NT status: 0x${e.status.toString(16)}`);
+    return null;
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const required = ["host", "share", "user", "path"];
+  for (const k of required) {
+    if (!args[k]) {
+      console.error(`missing required --${k}`);
+      process.exit(2);
+    }
+  }
+  const password = args.password || process.env.SMB_PASSWORD || "";
+  if (!password) {
+    console.error("missing --password");
+    process.exit(2);
+  }
+
+  const I = await loadInternals();
+
+  const client = new I.Client({
+    host: args.host,
+    port: Number(args.port) || 445,
+    domain: args.domain || "",
+    username: args.user,
+    password,
+    connectTimeout: 10000,
+    requestTimeout: 30000,
+    signing: args.signing || "if-offered",
+    encryption: args.encryption || "if-offered",
+  });
+
+  console.log("Connecting…");
+  await client.connect();
+  console.log("Connected");
+
+  const fullPath = `${args.share}/${args.path}`;
+  const { share, rest } = I.splitSharePath(fullPath);
+  const tree = await client.treeFor(share);
+  console.log(`Tree connected: treeId=${tree.treeId}`);
+
+  // Open the target directory
+  const open = await I.Open.create(tree, {
+    filename: I.toSmbPath(rest),
+    desiredAccess:
+      I.FileAccess.FILE_READ_DATA | I.FileAccess.FILE_READ_ATTRIBUTES,
+    shareAccess: I.ShareAccess.READ | I.ShareAccess.WRITE | I.ShareAccess.DELETE,
+    createDisposition: I.CreateDisposition.OPEN,
+    createOptions: I.CreateOptions.DIRECTORY_FILE,
+    fileAttributes: 0,
+  });
+  console.log(`Opened dir, fileId hex: ${open.fileId.toString("hex")}`);
+
+  // ---------------- 6 probes ----------------
+  console.log("\n============ PROBE 1: pat='*', flags=RESTART, class=FileIdBothDir ============");
+  await sendRaw(
+    open,
+    I,
+    {
+      fileInformationClass: I.FileInformationClass.FileIdBothDirectoryInformation,
+      flags: I.QueryDirectoryFlag.RESTART_SCANS,
+      fileIndex: 0,
+      fileId: open.fileId,
+      searchPattern: "*",
+      outputBufferLength: 65536,
+    },
+    "P1"
+  );
+
+  console.log("\n============ PROBE 2: pat='*', flags=0, class=FileIdBothDir ============");
+  await sendRaw(
+    open,
+    I,
+    {
+      fileInformationClass: I.FileInformationClass.FileIdBothDirectoryInformation,
+      flags: 0,
+      fileIndex: 0,
+      fileId: open.fileId,
+      searchPattern: "*",
+      outputBufferLength: 65536,
+    },
+    "P2"
+  );
+
+  console.log("\n============ PROBE 3: pat='*', flags=RESTART, class=FileBothDir (0x03) ============");
+  await sendRaw(
+    open,
+    I,
+    {
+      fileInformationClass: I.FileInformationClass.FileBothDirectoryInformation ?? 3,
+      flags: I.QueryDirectoryFlag.RESTART_SCANS,
+      fileIndex: 0,
+      fileId: open.fileId,
+      searchPattern: "*",
+      outputBufferLength: 65536,
+    },
+    "P3"
+  );
+
+  console.log("\n============ PROBE 4: pat='*', flags=RESTART, class=FileDirInfo (0x01) ============");
+  await sendRaw(
+    open,
+    I,
+    {
+      fileInformationClass: I.FileInformationClass.FileDirectoryInformation ?? 1,
+      flags: I.QueryDirectoryFlag.RESTART_SCANS,
+      fileIndex: 0,
+      fileId: open.fileId,
+      searchPattern: "*",
+      outputBufferLength: 65536,
+    },
+    "P4"
+  );
+
+  console.log("\n============ PROBE 5: pat='*', outBuf=8192, flags=RESTART ============");
+  await sendRaw(
+    open,
+    I,
+    {
+      fileInformationClass: I.FileInformationClass.FileIdBothDirectoryInformation,
+      flags: I.QueryDirectoryFlag.RESTART_SCANS,
+      fileIndex: 0,
+      fileId: open.fileId,
+      searchPattern: "*",
+      outputBufferLength: 8192,
+    },
+    "P5"
+  );
+
+  console.log("\n============ PROBE 6: pat='', flags=RESTART (empty pattern, offset=0) ============");
+  await sendRaw(
+    open,
+    I,
+    {
+      fileInformationClass: I.FileInformationClass.FileIdBothDirectoryInformation,
+      flags: I.QueryDirectoryFlag.RESTART_SCANS,
+      fileIndex: 0,
+      fileId: open.fileId,
+      searchPattern: "",
+      outputBufferLength: 65536,
+    },
+    "P6"
+  );
+
+  console.log("\nAvailable FileInformationClass values:");
+  console.log(JSON.stringify(I.FileInformationClass, null, 2));
+
+  try {
+    await open.close();
+  } catch (_) {}
+  console.log("\nDone.");
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const nxt = argv[i + 1];
+      if (!nxt || nxt.startsWith("--")) {
+        out[key] = true;
+      } else {
+        out[key] = nxt;
+        i++;
+      }
+    }
+  }
+  return out;
+}
+
+main().catch((e) => {
+  console.error("FATAL:", (e && e.stack) || e);
+  process.exit(1);
+});