remote-fs-browser 0.2.0__py3-none-any.whl

remote_fs_browser/__init__.py

@@ -0,0 +1,11 @@
+"""Cross-platform remote filesystem browsing."""
+from importlib.metadata import PackageNotFoundError, version
+from .policy import Policy
+from .sessions import Browser, FilesystemSession
+
+try:
+    __version__ = version('remote-fs-browser')
+except PackageNotFoundError:
+    __version__ = '0.0.0'
+
+__all__ = ['Browser', 'FilesystemSession', 'Policy', '__version__']

remote_fs_browser/__main__.py

@@ -0,0 +1,8 @@
+"""`python -m remote_fs_browser` and frozen builds enter here."""
+import multiprocessing
+
+from .cli import main
+
+if __name__ == '__main__':
+    multiprocessing.freeze_support()
+    main()

remote_fs_browser/backends.py

@@ -0,0 +1,182 @@
+"""Backend-neutral read-only operations; network connections belong to one worker."""
+import os
+import stat
+from datetime import datetime, timezone
+from pathlib import Path
+from .policy import normalize
+
+
+def entry(name, path, mode, size, modified):
+    kind = 'directory' if stat.S_ISDIR(mode) else 'file' if stat.S_ISREG(mode) else 'other'
+    return {'name': name, 'path': path, 'type': kind,
+            'size': size if kind == 'file' else None,
+            'modified': datetime.fromtimestamp(modified, timezone.utc).isoformat() if modified else None}
+
+
+def child_path(path, name):
+    """Session path of a directory entry, or None when the name cannot be addressed safely."""
+    try:
+        return normalize(path + '/' + name)
+    except ValueError:
+        return None
+
+
+def listing(rows, skipped):
+    return {'entries': rows, 'skipped': skipped}
+
+
+class LocalFilesystem:
+    def __init__(self, config):
+        self.root = Path(config['root']).resolve(strict=True)
+        self.root_fd = os.open(self.root, os.O_RDONLY | os.O_DIRECTORY) if os.name != 'nt' else None
+
+    def _open(self, path, directory=False):
+        parts = normalize(path).strip('/').split('/') if normalize(path) != '/' else []
+        if os.name != 'nt':
+            fd = os.dup(self.root_fd)
+            try:
+                for i, part in enumerate(parts):
+                    flags = os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK
+                    if directory or i < len(parts) - 1:
+                        flags |= os.O_DIRECTORY
+                    next_fd = os.open(part, flags, dir_fd=fd)
+                    os.close(fd)
+                    fd = next_fd
+                return fd
+            except Exception:
+                os.close(fd)
+                raise
+        target = self.root.joinpath(*parts)
+        for parent in [target, *target.parents]:
+            if parent == self.root:
+                break
+            if parent.is_symlink() or (hasattr(parent, 'is_junction') and parent.is_junction()):
+                raise PermissionError('Links are not browsable')
+        if not target.resolve(strict=True).is_relative_to(self.root):
+            raise PermissionError('Path leaves the selected root')
+        if directory:
+            return str(target)
+        fd = os.open(target, os.O_RDONLY | os.O_BINARY)
+        try:
+            # Validate the actual opened Windows handle, not just its earlier pathname.
+            import ctypes as c
+            import msvcrt
+            from ctypes import wintypes
+            fn = c.windll.kernel32.GetFinalPathNameByHandleW
+            fn.argtypes = [wintypes.HANDLE, wintypes.LPWSTR, wintypes.DWORD, wintypes.DWORD]
+            fn.restype = wintypes.DWORD
+            buffer = c.create_unicode_buffer(32768)
+            count = fn(msvcrt.get_osfhandle(fd), buffer, len(buffer), 0)
+            if not count or count >= len(buffer):
+                raise PermissionError('Cannot validate file handle')
+            final = buffer.value.removeprefix('\\\\?\\')
+            if final.startswith('UNC\\'):
+                final = '\\\\' + final[4:]
+            if not Path(final).is_relative_to(self.root):
+                raise PermissionError('File leaves the selected root')
+            return fd
+        except Exception:
+            os.close(fd)
+            raise
+
+    def list(self, path, limit):
+        path = normalize(path)
+        handle = self._open(path, directory=True)
+        rows, skipped = [], 0
+        try:
+            with os.scandir(handle) as entries:
+                for item in entries:
+                    if item.is_symlink() or (os.name == 'nt' and getattr(item.stat(follow_symlinks=False), 'st_file_attributes', 0) & 0x400):
+                        continue
+                    child = child_path(path, item.name)
+                    if child is None:
+                        skipped += 1
+                        continue
+                    info = item.stat(follow_symlinks=False)
+                    rows.append(entry(item.name, child, info.st_mode, info.st_size, info.st_mtime))
+                    if len(rows) > limit:
+                        break
+        finally:
+            if isinstance(handle, int):
+                os.close(handle)
+        return listing(rows, skipped)
+
+    def stat(self, path):
+        if os.name == 'nt':
+            target = self._open(path, directory=True)
+            info = os.stat(target, follow_symlinks=False)
+            return entry(Path(path).name, normalize(path), info.st_mode, info.st_size, info.st_mtime)
+        handle = self._open(path, directory=False)
+        try:
+            info = os.fstat(handle)
+            return entry(Path(path).name, normalize(path), info.st_mode, info.st_size, info.st_mtime)
+        finally:
+            os.close(handle)
+
+    def open(self, path):
+        fd = self._open(path)
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            os.close(fd)
+            raise PermissionError('Only regular files may be read')
+        return os.fdopen(fd, 'rb')
+
+    def close(self):
+        if self.root_fd is not None:
+            os.close(self.root_fd)
+            self.root_fd = None
+
+
+class SMBFilesystem:
+    def __init__(self, config):
+        import smbclient
+        self.client, self.cache = smbclient, {}
+        host = config['host']
+        if ':' in host:
+            raise ValueError('SMB IPv6 literals are not supported; use an IPv4 address')
+        self.root = '\\\\' + host + '\\' + config['share']
+        username = config.get('username')
+        if config.get('domain') and username and '\\' not in username:
+            username = config['domain'] + '\\' + username
+        try:
+            smbclient.register_session(host, username=username, password=config.get('password'),
+                                       connection_timeout=8, connection_cache=self.cache, auth_protocol='ntlm')
+        except Exception:
+            self.close()
+            raise
+
+    def _path(self, path):
+        path = normalize(path)
+        current = self.root
+        for part in path.strip('/').split('/') if path != '/' else []:
+            current += '\\' + part
+            info = self.client.stat(current, follow_symlinks=False, connection_cache=self.cache)
+            if stat.S_ISLNK(info.st_mode) or getattr(info, 'st_file_attributes', 0) & 0x400:
+                raise PermissionError('Links and reparse points are not browsable')
+        return current
+
+    def list(self, path, limit):
+        rows, skipped = [], 0
+        for item in self.client.scandir(self._path(path), connection_cache=self.cache):
+            info = item.stat(follow_symlinks=False)
+            if stat.S_ISLNK(info.st_mode) or getattr(info, 'st_file_attributes', 0) & 0x400:
+                continue
+            child = child_path(path, item.name)
+            if child is None:
+                skipped += 1
+                continue
+            rows.append(entry(item.name, child, info.st_mode, info.st_size, info.st_mtime))
+            if len(rows) > limit:
+                break
+        return listing(rows, skipped)
+
+    def stat(self, path):
+        info = self.client.stat(self._path(path), follow_symlinks=False, connection_cache=self.cache)
+        return entry(path.rsplit('/', 1)[-1], normalize(path), info.st_mode, info.st_size, info.st_mtime)
+
+    def open(self, path):
+        if self.stat(path)['type'] != 'file':
+            raise PermissionError('Only regular files may be read')
+        return self.client.open_file(self._path(path), mode='rb', connection_cache=self.cache)
+
+    def close(self):
+        self.client.reset_connection_cache(connection_cache=self.cache)

remote_fs_browser/cli.py

@@ -0,0 +1,162 @@
+"""Standalone same-port browser and API launcher."""
+import argparse
+import ipaddress
+import json
+import os
+from pathlib import Path
+import secrets
+import sys
+
+
+def addresses(bind, port):
+    import psutil
+    import socket
+    hosts = [bind] if bind not in ('0.0.0.0', '::') else sorted({
+        item.address.split('%')[0]
+        for group in psutil.net_if_addrs().values() for item in group
+        if item.family in (socket.AF_INET, socket.AF_INET6)
+        and not ipaddress.ip_address(item.address.split('%')[0]).is_link_local
+    })
+    rows = []
+    for host in hosts:
+        try:
+            address = ipaddress.ip_address(host)
+            label = 'Local' if address.is_loopback else 'Tailscale/CGNAT' if address.version == 4 and address in ipaddress.ip_network('100.64.0.0/10') else 'Network'
+        except ValueError:
+            label = 'Network'
+        rows.append((label, f'http://[{host}]:{port}' if ':' in host else f'http://{host}:{port}'))
+    return rows
+
+
+def config_home():
+    if os.name == 'nt':
+        base = os.environ.get('APPDATA') or str(Path.home() / 'AppData' / 'Roaming')
+    else:
+        base = os.environ.get('XDG_CONFIG_HOME') or str(Path.home() / '.config')
+    return Path(base) / 'remotefs'
+
+
+def load_or_create(path, explicit):
+    """Read the configuration; create the default one with a fresh token on first run."""
+    from .store import write_private
+    path = Path(path)
+    if path.exists():
+        if os.name != 'nt' and path.stat().st_mode & 0o077:
+            print(f'Warning: {path} is readable by other users; restrict it with chmod 600.', file=sys.stderr)
+        return json.loads(path.read_text()), False
+    if explicit:
+        raise SystemExit(f'Configuration file not found: {path}')
+    config = {'token': secrets.token_urlsafe(48), 'policy': {}}
+    write_private(path, json.dumps(config, indent=2) + '\n')
+    return config, True
+
+
+def build_policy(args, config):
+    """Flags beat the config file, which beats auto-detected defaults; lists replace, never merge."""
+    from . import defaults
+    from .policy import Policy
+    values = dict(config.get('policy', {}))
+    kinds = {}
+    if args.root:
+        values['local_roots'] = [str(Path(root).resolve(strict=True)) for root in args.root]
+    elif 'local_roots' not in values and not args.no_defaults:
+        home = defaults.readable_dirs([defaults.home_root()])
+        values['local_roots'] = defaults.readable_dirs([*home, *defaults.mounted_volumes()])
+        kinds = {root: 'home' if root in home else 'volume' for root in values['local_roots']}
+    if args.allow_network:
+        values['network_ranges'] = list(args.allow_network)
+    elif 'network_ranges' not in values and not args.no_defaults:
+        values['network_ranges'] = defaults.local_subnets()
+    return Policy(**values), kinds
+
+
+def bundled_library():
+    """Frozen Windows builds ship libnfs.dll beside the executable."""
+    if not getattr(sys, 'frozen', False):
+        return None
+    for folder in (Path(sys.executable).parent, Path(getattr(sys, '_MEIPASS', ''))):
+        candidate = folder / 'libnfs.dll'
+        if candidate.is_file():
+            return str(candidate)
+    return None
+
+
+def main(argv=None):
+    from . import __version__
+    parser = argparse.ArgumentParser(prog='remotefs', description='Serve a read-only filesystem browser and API on one port.')
+    parser.add_argument('command', nargs='?', choices=['serve'], default='serve')
+    parser.add_argument('--version', action='version', version=f'remotefs {__version__}')
+    parser.add_argument('--config', help='Private JSON configuration; defaults to the per-user config, created on first run')
+    parser.add_argument('--bind', help='Listen address; defaults to 127.0.0.1. Any other address is reachable from the network')
+    parser.add_argument('--port', type=int, help='Listen port; defaults to 8080')
+    parser.add_argument('--root', action='append', help='Allowed local root; repeat for multiple roots (default: home and mounted volumes)')
+    parser.add_argument('--allow-network', action='append', help='Allowed SMB/NFS CIDR; repeat as needed (default: this host\'s private subnets)')
+    parser.add_argument('--no-defaults', action='store_true', help='Do not auto-detect roots or networks; expose only what config and flags name')
+    parser.add_argument('--print-token', action='store_true', help='Print the service token and exit')
+    parser.add_argument('--resolve-host', help=argparse.SUPPRESS)
+    args = parser.parse_args(argv)
+
+    if args.resolve_host:
+        import socket
+        print(json.dumps(socket.gethostbyaddr(args.resolve_host)[0]))
+        return
+
+    library = bundled_library()
+    if library:
+        os.environ.setdefault('LIBNFS_LIBRARY', library)
+    path = Path(args.config) if args.config else config_home() / 'config.json'
+    config, created = load_or_create(path, explicit=bool(args.config))
+    token = config.get('token')
+    ephemeral = not token
+    if ephemeral:
+        token = secrets.token_urlsafe(32)
+    if args.print_token:
+        print(token)
+        return
+
+    from .http import create_app
+    from .store import SavedLocations, StoreLocked
+    import uvicorn
+    policy, kinds = build_policy(args, config)
+    saved, saved_note = None, ''
+    if not ephemeral:
+        try:
+            saved = SavedLocations(path.with_name('saved.json'), token)
+        except StoreLocked:
+            saved_note = f'{path.with_name("saved.json")} was saved under a different token; remembering is off until it is removed'
+    else:
+        saved_note = 'temporary token; locations are not remembered'
+    app = create_app(policy, token=token, root_kinds=kinds, saved_locations=saved)
+    bind = args.bind or config.get('bind', '127.0.0.1')
+    port = args.port if args.port is not None else config.get('port', 8080)
+    if not 1 <= port <= 65535:
+        parser.error('Port must be between 1 and 65535')
+    try:
+        remote = not ipaddress.ip_address(bind).is_loopback
+    except ValueError:
+        remote = bind not in ('localhost',)
+
+    show_token = created or ephemeral or sys.stdout.isatty()
+    lines = [f'remotefs {__version__} — read-only', '']
+    lines += [f'{label:16} {url}/' for label, url in addresses(bind, port)]
+    lines += ['', f'{"Config":16} {path}{" (created)" if created else ""}']
+    if ephemeral:
+        lines.append(f'{"Token":16} {token}   (temporary; add a token to the config to keep it)')
+    elif show_token:
+        lines.append(f'{"Token":16} {token}')
+    else:
+        lines.append(f'{"Token":16} stored in the config; run remotefs --print-token to show it')
+    roots = [f'{root} ({kinds[root]})' if root in kinds else root for root in policy.local_roots]
+    lines.append(f'{"Roots":16} {", ".join(roots) or "none"}')
+    lines.append(f'{"Networks":16} {", ".join(policy.network_ranges) or "none (SMB/NFS disabled)"}')
+    lines.append(f'{"Access":16} read-only: {", ".join(policy.operations)}')
+    lines.append(f'{"Remembered":16} {saved_note or f"{len(saved.records)} saved location(s) in {saved.path}"}')
+    from .discovery import share_enumeration_available
+    if not share_enumeration_available():
+        lines.append(f'{"SMB shares":16} enumeration unavailable (impacket not installed); shares can still be entered by name')
+    lines.append('')
+    if remote:
+        lines.append('WARNING: reachable from the network; anyone with the token can read every root above.')
+    lines.append('HTTP is unencrypted. Use a trusted network or an encrypted tunnel.')
+    print('\n'.join(lines) + '\n', flush=True)
+    uvicorn.run(app, host=bind, port=port, access_log=False)

remote_fs_browser/defaults.py

@@ -0,0 +1,91 @@
+"""Zero-configuration defaults: what this machine can see, bounded for safe discovery."""
+import ipaddress
+import os
+import socket
+import sys
+from pathlib import Path
+
+REAL_FILESYSTEMS = {'ext2', 'ext3', 'ext4', 'xfs', 'btrfs', 'zfs', 'f2fs', 'jfs', 'vfat', 'exfat', 'ntfs', 'ntfs3',
+                    'fuseblk', 'cifs', 'smb3', 'nfs', 'nfs4', 'hfsplus', 'apfs'}
+LINUX_PREFIXES = ('/mnt/', '/media/', '/run/media/', '/srv/', '/data/', '/home/')
+RFC1918 = [ipaddress.ip_network(n) for n in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16')]
+# Container, VM, tunnel and link-layer helper interfaces: their subnets are not the LAN.
+VIRTUAL_INTERFACES = ('docker', 'br-', 'veth', 'virbr', 'vmnet', 'vboxnet', 'utun', 'tun', 'tap', 'feth', 'bridge',
+                      'llw', 'awdl', 'anpi', 'lo', 'zt', 'tailscale', 'wg', 'lxc', 'lxd', 'cni', 'flannel', 'cali', 'kube')
+
+
+def home_root():
+    return str(Path.home())
+
+
+def mounted_volumes(platform=None, partitions=None, volumes='/Volumes'):
+    """Mounted storage a person would expect under "This Computer", excluding system volumes."""
+    platform = platform or sys.platform
+    if platform == 'darwin':
+        try:
+            entries = list(os.scandir(volumes))
+        except OSError:
+            return []
+        # The boot volume appears as a symlink to / and is skipped with every other link.
+        return sorted(item.path for item in entries if item.is_dir(follow_symlinks=False) and not item.name.startswith('.'))
+    if partitions is None:
+        import psutil
+        partitions = psutil.disk_partitions(all=False)
+    rows = set()
+    for part in partitions:
+        mount = part.mountpoint
+        if platform.startswith('win'):
+            if not part.fstype or 'cdrom' in part.opts.split(','):
+                continue
+            rows.add(mount)
+            continue
+        if part.fstype not in REAL_FILESYSTEMS or part.device.startswith('/dev/loop'):
+            continue
+        if mount.startswith(('/boot', '/var/lib', '/snap')) or not (mount + '/').startswith(LINUX_PREFIXES):
+            continue
+        rows.add(mount)
+    return sorted(rows)
+
+
+def local_subnets(max_prefix=24, addresses=None):
+    """RFC1918 IPv4 networks on this host's physical interfaces, narrowed to at most a /24 each.
+
+    `addresses` rows are (interface, address, netmask); a two-item (address, netmask) row is accepted too.
+    """
+    if addresses is None:
+        import psutil
+        addresses = [(name, item.address, item.netmask) for name, group in psutil.net_if_addrs().items() for item in group
+                     if item.family == socket.AF_INET and item.netmask]
+    networks = set()
+    for row in addresses:
+        name, address, netmask = row if len(row) == 3 else ('', *row)
+        if name.lower().startswith(VIRTUAL_INTERFACES):
+            continue
+        try:
+            ip = ipaddress.ip_address(address)
+            network = ipaddress.ip_network(f'{address}/{netmask}', strict=False)
+        except ValueError:
+            continue
+        if ip.version != 4 or not any(ip in block for block in RFC1918):
+            continue
+        if network.prefixlen >= 32:
+            continue
+        if network.prefixlen < max_prefix:
+            network = ipaddress.ip_network(f'{address}/{max_prefix}', strict=False)
+        networks.add(network)
+    return [str(network) for network in sorted(networks)]
+
+
+def readable_dirs(paths):
+    """Existing, readable directories, resolved and deduplicated, in the order given."""
+    rows = []
+    for path in paths:
+        try:
+            resolved = Path(path).resolve(strict=True)
+        except OSError:
+            continue
+        if not resolved.is_dir() or not os.access(resolved, os.R_OK | os.X_OK):
+            continue
+        if str(resolved) not in rows:
+            rows.append(str(resolved))
+    return rows

remote_fs_browser/discovery.py

@@ -0,0 +1,150 @@
+"""Bounded, opt-in TCP discovery plus protocol-native share/export enumeration."""
+from concurrent.futures import ThreadPoolExecutor
+import ctypes as c
+import ipaddress
+from pathlib import PurePath
+import socket
+from .policy import Policy
+from .hostnames import dns_name, netbios_name
+
+# Candidate addresses probed per scan request: four /24 ranges, about half a minute worst case on 64 threads.
+SCAN_BUDGET = 1024
+
+
+def grouped(policy: Policy, roots, hosts, scanned):
+    """The picker's tree: This Computer, then SMB and NFS servers seen from this host."""
+    local = [{'type': 'local', 'root': row['root'], 'kind': row['kind'],
+              'label': 'Home' if row['kind'] == 'home' else PurePath(row['root']).name or row['root']} for row in roots]
+    hint = None
+    if not scanned:
+        hint = ('Press Discover to scan ' + ', '.join(policy.network_ranges) + ', or enter a server above.'
+                if policy.network_ranges else 'No networks are permitted for SMB/NFS on this service.')
+    groups = [{'id': 'local', 'label': 'This Computer', 'items': local}]
+    for protocol, label in (('smb', 'SMB'), ('nfs', 'NFS')):
+        items = [{'type': protocol, 'host': row['host'], 'label': row.get('name') or row['host'],
+                  **{key: row[key] for key in ('dns_name', 'netbios_name') if row.get(key)}}
+                 for row in hosts if protocol in row['protocols']]
+        groups.append({'id': protocol, 'label': label, 'items': items, 'hint': hint})
+    return groups
+
+
+def discover(policy: Policy, scan=False, root_kinds=None):
+    policy.require('discover')
+    kinds = root_kinds or {}
+    result = {'roots': [{'type': 'local', 'root': root, 'kind': kinds.get(root, 'configured')} for root in policy.local_roots],
+              'hosts': [], 'notes': ['Automatic discovery is best effort. A hostname/IP can always be supplied within policy.']}
+    if not scan:
+        result['groups'] = grouped(policy, result['roots'], [], False)
+        return result
+    hosts = set()
+    for network in policy.network_ranges:
+        network = ipaddress.ip_network(network)
+        if network.num_addresses > 256:
+            result['notes'].append('Skipped a range larger than 256 addresses; configure narrower discovery ranges.')
+            continue
+        hosts.update(str(host) for host in network.hosts())
+    if policy.servers:
+        hosts &= {policy.host(host) for host in policy.servers}
+    hosts = sorted(hosts, key=ipaddress.ip_address)
+    if len(hosts) > SCAN_BUDGET:
+        result['notes'].append(f'Scanned the first {SCAN_BUDGET} of {len(hosts)} candidate addresses; narrow the permitted ranges to scan the rest.')
+        hosts = hosts[:SCAN_BUDGET]
+
+    def probe(host):
+        protocols = []
+        for port, name in [(445, 'smb'), (2049, 'nfs')]:
+            try:
+                # One second covers ARP resolution on Wi-Fi clients; a quarter second missed live LAN hosts.
+                with socket.create_connection((host, port), timeout=1.0):
+                    protocols.append(name)
+            except OSError:
+                pass
+        if not protocols:
+            return None
+        names = {key: value for key, value in (
+            ('dns_name', dns_name(host)), ('netbios_name', netbios_name(host))) if value}
+        name = names.get('dns_name') or names.get('netbios_name')
+        return {'host': host, 'protocols': protocols, **names, **({'name': name} if name else {})}
+
+    with ThreadPoolExecutor(max_workers=64) as executor:
+        result['hosts'] = [row for row in executor.map(probe, hosts) if row]
+    result['groups'] = grouped(policy, result['roots'], result['hosts'], True)
+    return result
+
+
+def share_enumeration_available():
+    import importlib.util
+    return importlib.util.find_spec('impacket') is not None
+
+
+def smb_shares(host, credentials):
+    if not share_enumeration_available():
+        raise RuntimeError('SMB share enumeration needs the impacket package (pip install "remote-fs-browser[smb-enum]"); enter the share name instead')
+    from impacket.smbconnection import SMBConnection
+    from impacket.smb3structs import SMB2_DIALECT_21
+    # Explicit SMB2 dialect prevents falling back to SMB1 browser services.
+    connection = SMBConnection(host, host, sess_port=445, timeout=5, preferredDialect=SMB2_DIALECT_21)
+    try:
+        connection.login(credentials.get('username', ''), credentials.get('password', ''), credentials.get('domain', ''))
+        from impacket.dcerpc.v5 import transport, srvs
+        rpc = transport.SMBTransport(host, host, filename=r'\srvsvc', smb_connection=connection).get_dce_rpc()
+        rows, resume, truncated = [], 0, False
+        try:
+            rpc.connect()
+            rpc.bind(srvs.MSRPC_UUID_SRVS)
+            for _ in range(32):
+                try:
+                    response = srvs.hNetrShareEnum(rpc, 1, resumeHandle=resume, preferedMaximumLength=65536, serverName='\\\\' + host)
+                    more = False
+                except srvs.DCERPCSessionError as error:
+                    if error.get_error_code() != 234:  # ERROR_MORE_DATA
+                        raise
+                    response, more = error.get_packet(), True
+                for row in response['InfoStruct']['ShareInfo']['Level1']['Buffer']:
+                    if int(row['shi1_type']) & 0xFFFF == 0:
+                        rows.append({'name': str(row['shi1_netname']).rstrip('\x00'), 'description': str(row['shi1_remark']).rstrip('\x00')})
+                        if len(rows) == 1000:
+                            truncated = True
+                            break
+                if not more or truncated:
+                    break
+                next_resume = int(response['ResumeHandle'])
+                if next_resume == resume:
+                    truncated = True
+                    break
+                resume = next_resume
+            else:
+                truncated = True
+            return {'shares': rows, 'truncated': truncated}
+        finally:
+            rpc.disconnect()
+
+    finally:
+        connection.close()
+
+
+class Export(c.Structure):
+    pass
+
+
+Export._fields_ = [('directory', c.c_char_p), ('groups', c.c_void_p), ('next', c.POINTER(Export))]
+
+
+def nfs_exports(host):
+    from .nfs import library
+    lib = library()
+    lib.mount_getexports_timeout.argtypes = [c.c_char_p, c.c_int]
+    lib.mount_getexports_timeout.restype = c.POINTER(Export)
+    lib.mount_free_export_list.argtypes = [c.POINTER(Export)]
+    lib.mount_free_export_list.restype = None
+    head = lib.mount_getexports_timeout(host.encode(), 5)
+    rows, current = [], head
+    try:
+        while current and len(rows) < 1000:
+            rows.append(current.contents.directory.decode('utf-8', errors='replace'))
+            current = current.contents.next
+    finally:
+        if head:
+            lib.mount_free_export_list(head)
+    return {'exports': rows, 'truncated': bool(current),
+            'notes': ['Uses mountd export discovery. Empty results do not mean no exports: NFSv4-only servers may require a manually entered export.']}

remote_fs_browser/hostnames.py

@@ -0,0 +1,64 @@
+"""Best-effort device labels; connection addresses remain unchanged."""
+import json
+import secrets
+import socket
+import struct
+import subprocess
+import sys
+
+
+def netbios_name(host):
+    """Ask the target directly for its unique NetBIOS workstation/server name."""
+    transaction = secrets.randbits(16)
+    query = struct.pack('!6H', transaction, 0, 1, 0, 0, 0)
+    query += b'\x20CK' + b'A' * 30 + b'\x00\x00\x21\x00\x01'
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+            sock.settimeout(0.5)
+            sock.connect((host, 137))
+            sock.send(query)
+            data = sock.recv(4096)
+        ident, flags, questions, answers, _, _ = struct.unpack_from('!6H', data)
+        if ident != transaction or not flags & 0x8000 or flags & 15 or not answers:
+            return None
+        def skip_name(offset):
+            while data[offset]:
+                if data[offset] & 0xc0 == 0xc0:
+                    return offset + 2
+                offset += 1 + data[offset]
+            return offset + 1
+        offset = 12
+        for _ in range(questions):
+            offset = skip_name(offset) + 4
+        offset = skip_name(offset)
+        kind, _, _, length = struct.unpack_from('!HHIH', data, offset)
+        payload = data[offset + 10:offset + 10 + length]
+        if kind != 0x21 or len(payload) != length:
+            return None
+        for index in range(payload[0]):
+            name, suffix, attributes = struct.unpack_from('!15sBH', payload, 1 + index * 18)
+            if suffix in (0, 0x20) and not attributes & 0x8000:
+                label = name.decode('ascii').strip(' \x00')
+                if label and all(ch.isprintable() for ch in label):
+                    return label
+    except (OSError, ValueError, IndexError, struct.error, UnicodeError):
+        pass
+    return None
+
+
+def dns_name(host):
+    # libc resolver timeouts are not controlled by socket.settimeout. A short-lived
+    # subprocess gives DNS a hard deadline without leaving blocked resolver threads.
+    try:
+        command = ([sys.executable, '--resolve-host', host] if getattr(sys, 'frozen', False) else
+                   [sys.executable, '-c', 'import socket,json,sys; print(json.dumps(socket.gethostbyaddr(sys.argv[1])[0]))', host])
+        result = subprocess.run(
+            command,
+            capture_output=True, text=True, timeout=1.25, check=True,
+        )
+        label = json.loads(result.stdout).rstrip('.')
+        if label and label != host:
+            return label
+    except (OSError, subprocess.SubprocessError, ValueError):
+        pass
+    return None