[jcifs] ipv6 bug in jcifs.netbios.NbtAddress

[Pascal Rigaux]

Hi,

We've been wondering why our server was doing weird accesses to Poland.
The culprit is in https://jcifs.samba.org/src/src/jcifs/netbios/NbtAddress.java, hashCode is used on a InetAddress:

localhost = new NbtAddress(localName, localInetAddress.hashCode(), ...)

In ipv4, it's ok ( https://github.com/samskivert/ikvm-openjdk/blob/master/jdk/src/share/classes/java/net/Inet4Address.java#L330-L332 )
but not in ipv6 ( https://github.com/samskivert/ikvm-openjdk/blob/master/jdk/src/share/classes/java/net/Inet6Address.java#L642 )

Context:
- SPNEGO implemented in CAS server (https://wiki.jasig.org/display/CASUM/SPNEGO)
- NTLM unused but somehow some firefox are sending NTLMSSP instead of Kerberos, which caused accesses to weird servers which drops the request, blocking our server :-(
I hope it's clear enough... I unfortunately had to look at things i really do not master...

cu,
Pascal Rigaux.


Test case:

import java.net.InetAddress;
class Test {
static int fromHex(String s, int offset) {
return Integer.parseInt(s.substring(offset, offset + 2), 16);
}
public static void main(String[] args) throws java.net.UnknownHostException {
InetAddress i = InetAddress.getLocalHost();
String s = Integer.toHexString(i.hashCode());
System.out.println(fromHex(s, 0) + "." + fromHex(s, 2) + "." + fromHex(s, 4) + "." + fromHex(s, 6));
}
}

% javac Test.java
% java Test
83.6.6.183
% java -Djava.net.preferIPv4Stack=true Test
193.55.96.57

(precision: the server has ipv6 2001:660:3305::57)

[Christopher R. Hertel]

See RFC1001/1002. The NBT protocol has IPv4 address fields hard-coded.
You can't map an IPv6 address to/from an NBT Address.

Chris -)-----

Post by Pascal Rigaux
Hi,
We've been wondering why our server was doing weird accesses to Poland.
The culprit is in
https://jcifs.samba.org/src/src/jcifs/netbios/NbtAddress.java, hashCode
localhost = new NbtAddress(localName, localInetAddress.hashCode(), ...)
In ipv4, it's ok (
https://github.com/samskivert/ikvm-openjdk/blob/master/jdk/src/share/classes/java/net/Inet4Address.java#L330-L332
)
but not in ipv6 (
https://github.com/samskivert/ikvm-openjdk/blob/master/jdk/src/share/classes/java/net/Inet6Address.java#L642
)
- SPNEGO implemented in CAS server (
https://wiki.jasig.org/display/CASUM/SPNEGO)
- NTLM unused but somehow some firefox are sending NTLMSSP instead of
Kerberos, which caused accesses to weird servers which drops the request,
blocking our server :-(
I hope it's clear enough... I unfortunately had to look at things i really do not master...
cu,
Pascal Rigaux.
import java.net.InetAddress;
class Test {
static int fromHex(String s, int offset) {
return Integer.parseInt(s.substring(offset, offset + 2), 16);
}
public static void main(String[] args) throws
java.net.UnknownHostException {
InetAddress i = InetAddress.getLocalHost();
String s = Integer.toHexString(i.hashCode());
System.out.println(fromHex(s, 0) + "." + fromHex(s, 2) + "." +
fromHex(s, 4) + "." + fromHex(s, 6));
}
}
% javac Test.java
% java Test
83.6.6.183
% java -Djava.net.preferIPv4Stack=true Test
193.55.96.57
(precision: the server has ipv6 2001:660:3305::57)
--
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

[Pascal Rigaux]

Then throw an exception if localInetAddress is ipv6 ? saying use
-Djava.net.preferIPv4Stack=true ?

Post by Christopher R. Hertel
See RFC1001/1002. The NBT protocol has IPv4 address fields hard-coded.
You can't map an IPv6 address to/from an NBT Address.
Chris -)-----

Post by Pascal Rigaux
Hi,
We've been wondering why our server was doing weird accesses to Poland.
The culprit is in
https://jcifs.samba.org/src/src/jcifs/netbios/NbtAddress.java, hashCode
localhost = new NbtAddress(localName, localInetAddress.hashCode(), ...)
In ipv4, it's ok (
https://github.com/samskivert/ikvm-openjdk/blob/master/jdk/src/share/classes/java/net/Inet4Address.java#L330-L332
)
but not in ipv6 (
https://github.com/samskivert/ikvm-openjdk/blob/master/jdk/src/share/classes/java/net/Inet6Address.java#L642
)
- SPNEGO implemented in CAS server (
https://wiki.jasig.org/display/CASUM/SPNEGO)
- NTLM unused but somehow some firefox are sending NTLMSSP instead of
Kerberos, which caused accesses to weird servers which drops the request,
blocking our server :-(
I hope it's clear enough... I unfortunately had to look at things i really
do not master...
cu,
Pascal Rigaux.
import java.net.InetAddress;
class Test {
static int fromHex(String s, int offset) {
return Integer.parseInt(s.substring(offset, offset + 2), 16);
}
public static void main(String[] args) throws
java.net.UnknownHostException {
InetAddress i = InetAddress.getLocalHost();
String s = Integer.toHexString(i.hashCode());
System.out.println(fromHex(s, 0) + "." + fromHex(s, 2) + "." +
fromHex(s, 4) + "." + fromHex(s, 6));
}
}
% javac Test.java
% java Test
83.6.6.183
% java -Djava.net.preferIPv4Stack=true Test
193.55.96.57
(precision: the server has ipv6 2001:660:3305::57)
--
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

--
"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team -- http://www.samba.org/ -)----- Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/ -)----- ubiqx development, uninq.
--
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

[Michael B Allen]

On Tue, Aug 25, 2015 at 6:07 AM, Pascal Rigaux

Post by Pascal Rigaux
Hi,
We've been wondering why our server was doing weird accesses to Poland.
The culprit is in
https://jcifs.samba.org/src/src/jcifs/netbios/NbtAddress.java, hashCode is

Hi Pascal,

The JVM parameter you cite is manipulating the underlying socket
behavior and so the error you're seeing is not really related to JCIFS
directly.

It's not crystal clear what you are trying to do but if you're trying
to get JCIFS to actually use an IPv6 address, it will absolutely not
work because JCIFS simply does not support IPv6 right now. And for a
variety of reasons it's not very high on the TODO list.

Mike