Bug 207675
| Summary: | mount.cifs always fails with NT_STATUS_INVALID_WORKSTATION using ntlmssp when userWorkstation attribute is set | ||
|---|---|---|---|
| Product: | File System | Reporter: | Huemi (t.himmelbauer) |
| Component: | CIFS | Assignee: | fs_cifs (fs_cifs) |
| Status: | NEW --- | ||
| Severity: | normal | CC: | bjoern |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 5.4.x and others | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | Patch to send the workstation name even with ntlmssp | ||
Created attachment 289049 [details] Patch to send the workstation name even with ntlmssp Tested on Ubuntu 20.04, but mainline kernel seems to have the identical source code. Having the userWorkstations attribute set to the client host name in Active Directory, mounting a directory from an allowed client via mount.cifs from a Samba file server fails with NT_STATUS_INVALID_WORKSTATION while using smbclient succeeds. Looking at a debug 10 trace it is obvious that when smbclient makes the connection the server has a correct workstation name (probably from smb.conf) while mount.cifs sends an empty workstation name causing the connection to fail as "" is not an allowed workstation in the userWorkstations attribute list. You might find an old bug recommending the option "port=139", but this did not work. Looking at fs/cifs/sess.c from vanilla version 5.4.40 you can see in the build_ntlmssp_auth_blob function at line 489-492 that the created workstationName is always empty. As there is already netbiosname option in mount.cifs and the workstation_RFC1001_name is always populated even without appending it, the easiest way would be to use it for this case too. Attached you can find an ugly patch which allowed me on a testing system to successfully mount a directory via mount.cifs from the Samba server while it would always fail with NT_STATUS_INVALID_WORKSTATION otherwise. I'm pretty sure that it doesn't meet your quality criteria, so someone else with more insight on cifs and the kernel might want to rewrite it.