buglwIP - A Lightweight TCP/IP stack - Bugs: bug #53626, NetBIOS Responder generates...


You are not allowed to post comments on this tracker with your current authentication level.

bug #53626: NetBIOS Responder generates malformed packet responding to "*" name

Submitted by:  Jason White <wrc_jasonw>
Submitted on:  Thu 12 Apr 2018 06:07:00 PM UTC  
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Wed 18 Apr 2018 06:18:07 AM UTC, comment #5: 

The program's name is 'nbtstat', not 'nbstat'.

Anyway, should be fixed now.

Simon Goldschmidt <goldsimon>
Project Administrator
Tue 17 Apr 2018 08:41:52 PM UTC, comment #4: 

Dirk, I tested yours and it didn't work.

Simon, I tested yours and it worked but I found I needed to make a modification.

Apparently some software (SoftPerfect Network scanner) cares whether the last character of the hostname is 0x20 (server) or 0x00 (workstation). I currently have my product declaring itself as a workstation (0x00) rather than as a server (0x20) and it is working.

The networked printer from good_bad_nbns.pcapng declares its name twice. Once as a server and one as a workstation - probably to make sure it is properly recognized.

Thank You Dirk and Simon!
-Jason White

Jason White <wrc_jasonw>
Tue 17 Apr 2018 07:56:33 PM UTC, comment #3: 

I can't push right now, but the attached patch makes 'nbstat -A <myIP>' work for me. Note that wireshark seems to be missing 2 statistic counters of RFC 1002 ...

(file #43962)

Simon Goldschmidt <goldsimon>
Project Administrator
Mon 16 Apr 2018 08:41:01 AM UTC, comment #2: 

Jason, can you please test my fix?

Dirk Ziegelmeier <dziegel>
Project Administrator
Thu 12 Apr 2018 07:57:35 PM UTC, comment #1: 

Right. Also, the 'name_type' member in struct netbios_answer is wrong. Instead, there should be a MAC address (6 bytes) + 40 bytes statistics at the end.

Simon Goldschmidt <goldsimon>
Project Administrator
Thu 12 Apr 2018 06:07:00 PM UTC, original submission:  

Several days ago the NetBIOS responded was updated to respond to "*" names (in bug #53325). I eagerly tested this feature and found the following:
(1) Wireshark reports the response packet to "*" names is malformed.
(2) Attempting to query the device's hostname fails - a response is sent by LwIP but it gets discarded (in this case using both nmap and SoftPerfect Network scanner)

I have attached a Wireshark capture (good_bad_nbns.pcapng) containing the following:
(1) frame 1, from IP, an example of a valid response to the "*" name from a networked printer.
(2) frame 2, from IP, a malformed NetBIOS response generated by the feature implemented in bug #53325.

A preliminary comparison of the good (from the printer) and bad (from LwIP) packets shows that the LwIP packet is missing the "Statistics" section. Looking at RFC1002 4.2.18 also suggests that the response packet is supposed to contain a statistics section at the end.

Based off of these observations I am lead to believe that adding the ~40 bytes of statistics fields documented in RFC1002 to the end of the packet would resolve this issue.

-Jason White

Disclaimer: I am no expert in the NetBIOS name service.

Jason White <wrc_jasonw>


Attached Files
file #43962:  53626_fix.patch added by goldsimon (2KiB - application/octet-stream)
file #43902:  good_bad_nbns.pcapng added by wrc_jasonw (588B - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by wrc_jasonw (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-18 goldsimon StatusReady For Test => Fixed
        Open/ClosedOpen => Closed
    2018-04-17 goldsimon Attached File- => Added 53626_fix.patch, #43962
    2018-04-16 dziegel StatusNone => Ready For Test
    2018-04-12 wrc_jasonw Attached File- => Added good_bad_nbns.pcapng, #43902

    Back to the top

    Powered by Savane 3.5