r19231: I encountered a WinXP/Home system which, acting as the master browser for its

workgroup, decided periodically to stop sending recognized responses to a
NetServerEnum2 request for the workgroup.  Instead of returning the list of
servers (only itself; nothing else in the workgroup), it returns a status code
of 8 which is unsupported by samba3, samba4, and ethereal.

The code for this request assumed that if an unexpected status code was
received, the connection had a problem, i.e. that cli_errno() would show a
problem.  That turns out not to be the case.

This patch changes the behavior so tha any time a response is received and
cli_errno() == 0, we continue processing the reply and base our response on
the returned count (zero).  The pre-existing code then converts this count=0
into an ENOENT errno which can be properly handled by the application (whereas
an error return with errno=0 can't be).

This packet dump has only 2 frames.  Sorry about the text version but it's
most easily attached to this log message.  I also have it saved as .pcap if
anyone wants it.

Derrell

No.     Time            Source                Destination           Protocol Info
      1 14:31:59.802668 192.168.1.106         192.168.1.100         LANMAN   NetServerEnum2 Request, Server, SQL Server, Domain Controller, Backup Controller, Time Source, Apple Server, Novell Server, Domain Member Server, Print Queue Server, Dialin Server, Xenix Server, NT Workstation, Windows for Workgroups, Unknown server type:14, NT Server

Frame 1 (196 bytes on wire, 196 bytes captured)
    Arrival Time: Oct 10, 2006 14:31:59.802668000
    Time delta from previous packet: 0.000000000 seconds
    Time since reference or first frame: 0.000000000 seconds
    Frame Number: 1
    Packet Length: 196 bytes
    Capture Length: 196 bytes
    Protocols in frame: eth:ip:tcp:nbss:smb
Ethernet II, Src: IntelCor_4a:47:bb (00:13:20:4a:47:bb), Dst: Micro-St_74:16:e7 (00:0c:76:74:16:e7)
    Destination: Micro-St_74:16:e7 (00:0c:76:74:16:e7)
    Source: IntelCor_4a:47:bb (00:13:20:4a:47:bb)
    Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.106 (192.168.1.106), Dst: 192.168.1.100 (192.168.1.100)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 182
    Identification: 0xb838 (47160)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (0x06)
    Header checksum: 0xfdea [correct]
        Good: True
        Bad : False
    Source: 192.168.1.106 (192.168.1.106)
    Destination: 192.168.1.100 (192.168.1.100)
Transmission Control Protocol, Src Port: 44932 (44932), Dst Port: netbios-ssn (139), Seq: 851982066, Ack: 1274726157, Len: 130
    Source port: 44932 (44932)
    Destination port: netbios-ssn (139)
    Sequence number: 851982066
    Next sequence number: 851982196
    Acknowledgement number: 1274726157
    Header length: 32 bytes
    Flags: 0x0018 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 6432
    Checksum: 0xb4e0 [correct]
    Options: (12 bytes)
        NOP
        NOP
        Time stamp: tsval 1184074739, tsecr 11576161
NetBIOS Session Service
    Message Type: Session message
    Flags: 0x00
        .... ...0 = Add 0 to length
    Length: 126
SMB (Server Message Block Protocol)
    SMB Header
        Server Component: SMB
        Response in: 2
        SMB Command: Trans (0x25)
        NT Status: STATUS_SUCCESS (0x00000000)
        Flags: 0x08
            0... .... = Request/Response: Message is a request to the server
            .0.. .... = Notify: Notify client only on open
            ..0. .... = Oplocks: OpLock not requested/granted
            ...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
            .... 1... = Case Sensitivity: Path names are caseless
            .... ..0. = Receive Buffer Posted: Receive buffer has not been posted
            .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
        Flags2: 0xc801
            1... .... .... .... = Unicode Strings: Strings are Unicode
            .1.. .... .... .... = Error Code Type: Error codes are NT error codes
            ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
            ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
            .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
            .... .... .0.. .... = Long Names Used: Path names in request are not long file names
            .... .... .... .0.. = Security Signatures: Security signatures are not supported
            .... .... .... ..0. = Extended Attributes: Extended attributes are not supported
            .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
        Process ID High: 0
        Signature: 0000000000000000
        Reserved: 0000
        Tree ID: 2048
        Process ID: 12967
        User ID: 2048
        Multiplex ID: 6
    Trans Request (0x25)
        Word Count (WCT): 14
        Total Parameter Count: 36
        Total Data Count: 0
        Max Parameter Count: 8
        Max Data Count: 65535
        Max Setup Count: 0
        Reserved: 00
        Flags: 0x0000
            .... .... .... ..0. = One Way Transaction: Two way transaction
            .... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
        Timeout: Return immediately (0)
        Reserved: 0000
        Parameter Count: 36
        Parameter Offset: 90
        Data Count: 0
        Data Offset: 126
        Setup Count: 0
        Reserved: 00
        Byte Count (BCC): 63
        Transaction Name: \PIPE\LANMAN
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
    Function Code: NetServerEnum2 (104)
    Parameter Descriptor: WrLehDz
    Return Descriptor: B16BBDz
    Detail Level: 1
    Receive Buffer Length: 65535
    Server Type: 0x0000fffe
        .... .... .... .... .... .... .... ...0 = Workstation: This is NOT a Workstation
        .... .... .... .... .... .... .... ..1. = Server: This is a Server
        .... .... .... .... .... .... .... .1.. = SQL: This is an SQL server
        .... .... .... .... .... .... .... 1... = Domain Controller: This is a Domain Controller
        .... .... .... .... .... .... ...1 .... = Backup Controller: This is a Backup Controller
        .... .... .... .... .... .... ..1. .... = Time Source: This is a Time Source
        .... .... .... .... .... .... .1.. .... = Apple: This is an Apple host
        .... .... .... .... .... .... 1... .... = Novell: This is a Novell server
        .... .... .... .... .... ...1 .... .... = Member: This is a Domain Member server
        .... .... .... .... .... ..1. .... .... = Print: This is a Print Queue server
        .... .... .... .... .... .1.. .... .... = Dialin: This is a Dialin server
        .... .... .... .... .... 1... .... .... = Xenix: This is a Xenix server
        .... .... .... .... ...1 .... .... .... = NT Workstation: This is an NT Workstation
        .... .... .... .... ..1. .... .... .... = WfW: This is a WfW host
        .... .... .... .... 1... .... .... .... = NT Server: This is an NT Server
        .... .... .... ...0 .... .... .... .... = Potential Browser: This is NOT a Potential Browser
        .... .... .... ..0. .... .... .... .... = Backup Browser: This is NOT a Backup Browser
        .... .... .... .0.. .... .... .... .... = Master Browser: This is NOT a Master Browser
        .... .... .... 0... .... .... .... .... = Domain Master Browser: This is NOT a Domain Master Browser
        .... .... ...0 .... .... .... .... .... = OSF: This is NOT an OSF host
        .... .... ..0. .... .... .... .... .... = VMS: This is NOT a VMS host
        .... .... .0.. .... .... .... .... .... = Windows 95+: This is NOT a Windows 95 or above host
        .0.. .... .... .... .... .... .... .... = Local: This is NOT a local list only request
        0... .... .... .... .... .... .... .... = Domain Enum: This is NOT a Domain Enum request
    Enumeration Domain: WORKGROUP

No.     Time            Source                Destination           Protocol Info
      2 14:31:59.803918 192.168.1.100         192.168.1.106         LANMAN   NetServerEnum2 Response

Frame 2 (134 bytes on wire, 134 bytes captured)
    Arrival Time: Oct 10, 2006 14:31:59.803918000
    Time delta from previous packet: 0.001250000 seconds
    Time since reference or first frame: 0.001250000 seconds
    Frame Number: 2
    Packet Length: 134 bytes
    Capture Length: 134 bytes
    Protocols in frame: eth:ip:tcp:nbss:smb
Ethernet II, Src: Micro-St_74:16:e7 (00:0c:76:74:16:e7), Dst: IntelCor_4a:47:bb (00:13:20:4a:47:bb)
    Destination: IntelCor_4a:47:bb (00:13:20:4a:47:bb)
    Source: Micro-St_74:16:e7 (00:0c:76:74:16:e7)
    Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.100 (192.168.1.100), Dst: 192.168.1.106 (192.168.1.106)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 120
    Identification: 0xea10 (59920)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0x8c50 [correct]
        Good: True
        Bad : False
    Source: 192.168.1.100 (192.168.1.100)
    Destination: 192.168.1.106 (192.168.1.106)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 44932 (44932), Seq: 1274726157, Ack: 851982196, Len: 68
    Source port: netbios-ssn (139)
    Destination port: 44932 (44932)
    Sequence number: 1274726157
    Next sequence number: 1274726225
    Acknowledgement number: 851982196
    Header length: 32 bytes
    Flags: 0x0018 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 64606
    Checksum: 0x1e0d [correct]
    Options: (12 bytes)
        NOP
        NOP
        Time stamp: tsval 11576161, tsecr 1184074739
NetBIOS Session Service
    Message Type: Session message
    Flags: 0x00
        .... ...0 = Add 0 to length
    Length: 64
SMB (Server Message Block Protocol)
    SMB Header
        Server Component: SMB
        Response to: 1
        Time from request: 0.001250000 seconds
        SMB Command: Trans (0x25)
        NT Status: STATUS_SUCCESS (0x00000000)
        Flags: 0x88
            1... .... = Request/Response: Message is a response to the client/redirector
            .0.. .... = Notify: Notify client only on open
            ..0. .... = Oplocks: OpLock not requested/granted
            ...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
            .... 1... = Case Sensitivity: Path names are caseless
            .... ..0. = Receive Buffer Posted: Receive buffer has not been posted
            .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
        Flags2: 0xc801
            1... .... .... .... = Unicode Strings: Strings are Unicode
            .1.. .... .... .... = Error Code Type: Error codes are NT error codes
            ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
            ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
            .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
            .... .... .0.. .... = Long Names Used: Path names in request are not long file names
            .... .... .... .0.. = Security Signatures: Security signatures are not supported
            .... .... .... ..0. = Extended Attributes: Extended attributes are not supported
            .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
        Process ID High: 0
        Signature: 0000000000000000
        Reserved: 0000
        Tree ID: 2048
        Process ID: 12967
        User ID: 2048
        Multiplex ID: 6
    Trans Response (0x25)
        Word Count (WCT): 10
        Total Parameter Count: 8
        Total Data Count: 0
        Reserved: 0000
        Parameter Count: 8
        Parameter Offset: 56
        Parameter Displacement: 0
        Data Count: 0
        Data Offset: 64
        Data Displacement: 0
        Setup Count: 0
        Reserved: 00
        Byte Count (BCC): 9
        Padding: 00
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
    Function Code: NetServerEnum2 (104)
    Status: Unknown (8)
    Convert: 0
    Entry Count: 0
    Available Entries: 0

1 files changed, 2 insertions, 1 deletions

diff --git a/source/libsmb/clirap.c b/source/libsmb/clirap.c
index caa23b59d9a..61cdd79f36b 100644
--- a/source/libsmb/clirap.c
+++ b/source/libsmb/clirap.c
@@ -244,7 +244,8 @@ BOOL cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
                    )) {
 		int res = rparam? SVAL(rparam,0) : -1;
 			
-		if (res == 0 || res == ERRmoredata) {
+		if (res == 0 || res == ERRmoredata ||
+                    (res != -1 && cli_errno(cli) == 0)) {
 			int i;
 			int converter=SVAL(rparam,2);