Null pointer when authenticating as guest #792

dkocher · 2023-09-04T14:20:31Z

Attempting to authenticate as guest using AuthenticationContext.guest() results in an exception

Caused by: java.lang.NullPointerException
	at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKey(SMBSessionBuilder.java:324)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKeys(SMBSessionBuilder.java:290)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:174)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119)
	at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:197)

The server is running SMB_3_1_1 (Windows Server 2022)

The text was updated successfully, but these errors were encountered:

hierynomus · 2023-09-04T14:33:04Z

@dkocher Which version? I fixed a similar bug for anonymous authentication in v0.12.2, and I thought I had checked guest then also.

dkocher · 2023-09-04T14:40:58Z

@dkocher Which version? I fixed a similar bug for anonymous authentication in v0.12.2, and I thought I had checked guest then also.

Running 0.12.2.

hierynomus · 2023-09-05T09:28:24Z

@dkocher Which authenticator are you using?

dkocher · 2023-09-05T09:53:32Z

@dkocher Which authenticator are you using?

This is using NtlmAuthenticator.

karthik-119 · 2023-09-06T09:14:12Z

Even, I'm facing the same Nullpointer exception when trying with anonymous login:

java.lang.NullPointerException
  at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKey(SMBSessionBuilder.java:324)
  at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKeys(SMBSessionBuilder.java:290)
  at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:174)
  at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152)
  at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119)
  at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:202)

It is happening after upgrade to smbj library 0.12.2 and my target server Windows 11 (protocol: SMB_3_1_1), I've tried to allow insecure guest logons as well in my Local group policy editor.

Not sure if this is relevant but found this while debugging that this can be the cause:

if (!ctx.authContext.isAnonymous() && !ctx.authContext.isGuest()) {
                context.setSessionKey(new SecretKeySpec(ctx.sessionKey, HMAC_SHA256_ALGORITHM));
 }

session key is set to context when it is neither anonymous nor guest, meaning only for user context, thus later in the derivekeys, this ended up in NullPointer.

Is there any update on the issue, whether if it's server configuration issue or bug in the actual code?

dkocher · 2023-09-20T12:12:18Z

@karthik-119 points out this may be a regression of 4633709.

This should fix the NPE that occurs when authenticating with guest or anonymous credentials and the server treating it as a regular account

hierynomus · 2023-09-26T08:38:44Z

@dkocher @karthik-119 Can you try with the fix from #800?

bubbleguuum · 2023-09-26T09:20:35Z

I tested and:

I get the crash in first post with published 0.12.2 (expected)
I do not get the crash using current git smbj as of the date of this post without Set sessionKey whenever we have it from authentication (Fixes #792) #800 applied

So that issue has already been fixed by a commit post v0.12.2 it seems.

hierynomus · 2023-09-26T09:33:44Z

@bubbleguuum Now that's even weirder, as Git doesn't show any change which could have anything to do with that on the current master branch 🤔

bubbleguuum · 2023-09-26T09:42:08Z

Yes please disregard, I did my testing wrong (was actually using v0.11.1 instead of git master!).
Will do it again properly with the PR applied.

bubbleguuum · 2023-09-26T09:54:28Z

Still crashing using master git + the 1 line PR.
Double checked that everything is correct this time, with even a logged "LALA" line just before the if (ctx.sessionKey != null) { line change:

smb: resolved FOOBAR -> 192.168.1.157
        PacketEncryptor  I  Initialized PacketEncryptor with Cipher << AES_128_CCM >>
             Connection  I  Successfully connected to: 192.168.1.157
           SMBShareInfo  I  smb: \\FOOBAR\: NegotiatedProtocol{dialect=SMB_3_0_2, maxTransactSize=8388608, maxReadSize=8388608, maxWriteSize=8388608}
      SMBSessionBuilder  I  LALA
           SMBShareInfo  W  java.lang.NullPointerException: Attempt to invoke interface method 'byte[] javax.crypto.SecretKey.getEncoded()' on a null object reference
                         W      at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKey(SMBSessionBuilder.java:326)
                         W      at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKeys(SMBSessionBuilder.java:294)
                         W      at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:176)
                         W      at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152)
                         W      at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119)
                         W      at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:202)
                      ...

karthik-119 · 2023-09-26T10:41:15Z

@dkocher @karthik-119 Can you try with the fix from #800?

@hierynomus , let me try to verify the fix.

karthik-119 · 2023-09-26T11:01:41Z

I realized that this project needs to be built with gradle which I'm not used to and have no correct configuration on my system. I'm afraid I can't verify the fix when it is still on issue branch.

Is there any possibility to build the project using maven?

hierynomus · 2023-09-26T11:05:21Z

There should be no need to set it up. You can use ./gradlew build to build the project. This will use the Gradle wrapper. There is no Maven build files included

karthik-119 · 2023-09-26T11:08:52Z

Yes, I did the same but see errors (Java version: 1.8):

hierynomus · 2023-09-28T07:26:52Z

For building you need to use Java11 (or higher)

karthik-119 · 2023-09-28T08:52:36Z

Thanks, I'm able to build project with Java 11, can you please update Readme, it still says Java 7? thanks.

I'll test the jar and update results here.

karthik-119 · 2023-09-28T09:35:49Z

Verified and can still see same NullPointerException.

java.lang.NullPointerException
	at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKey(SMBSessionBuilder.java:324)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKeys(SMBSessionBuilder.java:290)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:174)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152)
	at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119)
	at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:202)

I think the issue is within NtlmAuthenticatior logic itself (in doAuthenticate()):

 // [MS-NLMP] 3.2.2 -- Special case for anonymous authentication
        if (context.isAnonymous()) {
            NtlmAuthenticate msg = new NtlmAuthenticate(null, null, context.getUsername(), context.getDomain(),
                config.getWorkstationName(), null, negotiateFlags, config.getWindowsVersion());
            response.setNegToken(negTokenTarg(msg));
            return response;
        }

for anonymous context, response neither have any session key set nor sessions flags updated later in authentication logic of SMBSessionBuilder.

Compared to older 11.x version where for anonymous context, session key is set based on ntlm server challenge response.
On the other hand, in the deriveKeys() logic, you make checks for smb3

if (dialect.isSmb3x() &&
            !response.getSessionFlags().contains(SMB2SessionSetup.SMB2SessionFlags.SMB2_SESSION_FLAG_IS_NULL) &&
            !response.getSessionFlags().contains(SMB2SessionSetup.SMB2SessionFlags.SMB2_SESSION_FLAG_IS_GUEST)) {

where it looks like this logic is not required for anonymous or guest context but session flags for response is not updated anywhere if that is proven.

((Note: I'm no expert in smb subject or this lib code, just trying to infer based on my understanding in debug sessions, I might be wrong in my statements, please correct me))

hellivan · 2023-12-04T14:03:42Z

Any update on this?

HubertOT · 2024-01-23T14:14:55Z

Indeed any update on this issue?
As karthik-119 mentioned within method derivedKeys the sessionFlags are checked for anonymous (SMB2_SESSION_FLAG_IS_NULL) or guest (SMB2_SESSION_FLAG_IS_GUEST) login request.

Using SMBj 0.11.5 when an anonymous logon (no username nor password set) was done the sessionFlag SMB2_SESSION_FLAG_IS_GUEST was set and the logon succeeded. Doubt if this was for the correct reason, would have expected that sessionFlag "SMB2_SESSION_FLAG_IS_NULL" was set instead of "SMB2_SESSION_FLAG_IS_GUEST".
However with SMBj 0.12.x it fails as none of these sessionFlags are set, hence for signing it is tried to set the deriveKey, based on context. The context however does not contain a sessionKey as it's an anonymous login which is not able to sign or encrypt.

To work around regression in SMB anonymous authentication. See also hierynomus/smbj#792 This reverts commit d9ce4e6. Bug: #1181

* Ref: hierynomus/smbj#792 * Related: zhanghai/MaterialFiles@2d425a6 Change-Id: I82b9ae5e9f61e5c2886e782537579a9347e92b70

dsforcam · 2024-09-23T10:38:55Z

Any update on this?

bio-mjukis · 2024-11-08T10:56:07Z

There is an open PR for this issue: #800
Does anyone know a workaround for this issue (to use until the PR is merged to master)?

We can't get unauthenticated samba connection to work using smbj 0.13.0 due to this issue. Here is a stack trace:

java.lang.NullPointerException: Cannot invoke "javax.crypto.SecretKey.getEncoded()" because "derivationKey" is null at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKey(SMBSessionBuilder.java:324) at com.hierynomus.smbj.connection.SMBSessionBuilder.deriveKeys(SMBSessionBuilder.java:290) at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:174) at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152) at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119) at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:202)

…mus#792) This should fix the NPE that occurs when authenticating with guest or anonymous credentials and the server treating it as a regular account

karthik-119 mentioned this issue Sep 6, 2023

Connection#authenticate(AuthenticationContext.anonymous()) crashes on v0.12.0 #779

Closed

dkocher mentioned this issue Sep 6, 2023

SMB Anonymous Login iterate-ch/cyberduck#15069

Open

hierynomus added a commit that referenced this issue Sep 26, 2023

Set sessionKey whenever we have it from authentication (Fixes #792)

a1e1d79

This should fix the NPE that occurs when authenticating with guest or anonymous credentials and the server treating it as a regular account

zhanghai mentioned this issue Apr 7, 2024

1.7.1 SMB ECONNREFUSED for Debian Samba (Regression from 1.6.2) zhanghai/MaterialFiles#1181

Closed

zhanghai added a commit to zhanghai/MaterialFiles that referenced this issue Apr 7, 2024

Revert "[Feature] Update SMBJ."

2d425a6

To work around regression in SMB anonymous authentication. See also hierynomus/smbj#792 This reverts commit d9ce4e6. Bug: #1181

XayahSuSuSu added a commit to XayahSuSuSu/Android-DataBackup that referenced this issue Jun 28, 2024

fix: Downgrade smbj to 0.11.5

0ae5cfd

* Ref: hierynomus/smbj#792 * Related: zhanghai/MaterialFiles@2d425a6 Change-Id: I82b9ae5e9f61e5c2886e782537579a9347e92b70

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Null pointer when authenticating as guest #792

Null pointer when authenticating as guest #792

dkocher commented Sep 4, 2023

hierynomus commented Sep 4, 2023

dkocher commented Sep 4, 2023

hierynomus commented Sep 5, 2023

dkocher commented Sep 5, 2023

karthik-119 commented Sep 6, 2023 •

edited

Loading

dkocher commented Sep 20, 2023

hierynomus commented Sep 26, 2023

bubbleguuum commented Sep 26, 2023 •

edited

Loading

hierynomus commented Sep 26, 2023

bubbleguuum commented Sep 26, 2023

bubbleguuum commented Sep 26, 2023 •

edited

Loading

karthik-119 commented Sep 26, 2023

karthik-119 commented Sep 26, 2023

hierynomus commented Sep 26, 2023

karthik-119 commented Sep 26, 2023

hierynomus commented Sep 28, 2023

karthik-119 commented Sep 28, 2023

karthik-119 commented Sep 28, 2023 •

edited

Loading

hellivan commented Dec 4, 2023

HubertOT commented Jan 23, 2024

dsforcam commented Sep 23, 2024

bio-mjukis commented Nov 8, 2024

Null pointer when authenticating as guest #792

Null pointer when authenticating as guest #792

Comments

dkocher commented Sep 4, 2023

hierynomus commented Sep 4, 2023

dkocher commented Sep 4, 2023

hierynomus commented Sep 5, 2023

dkocher commented Sep 5, 2023

karthik-119 commented Sep 6, 2023 • edited Loading

dkocher commented Sep 20, 2023

hierynomus commented Sep 26, 2023

bubbleguuum commented Sep 26, 2023 • edited Loading

hierynomus commented Sep 26, 2023

bubbleguuum commented Sep 26, 2023

bubbleguuum commented Sep 26, 2023 • edited Loading

karthik-119 commented Sep 26, 2023

karthik-119 commented Sep 26, 2023

hierynomus commented Sep 26, 2023

karthik-119 commented Sep 26, 2023

hierynomus commented Sep 28, 2023

karthik-119 commented Sep 28, 2023

karthik-119 commented Sep 28, 2023 • edited Loading

hellivan commented Dec 4, 2023

HubertOT commented Jan 23, 2024

dsforcam commented Sep 23, 2024

bio-mjukis commented Nov 8, 2024

karthik-119 commented Sep 6, 2023 •

edited

Loading

bubbleguuum commented Sep 26, 2023 •

edited

Loading

bubbleguuum commented Sep 26, 2023 •

edited

Loading

karthik-119 commented Sep 28, 2023 •

edited

Loading