jcifs-0.7.11 from tgz

jcifs-0.7.11 from tgz

Thu Jul 10 22:07:09 EDT 2003

Support  for  LMv2  authentication has been added. See the Overview page in
the  API  documentation  regarding  the jcifs.smb.lmCompatibility property.
Some  additonal  "cleanup"  has  also  been performed. One side-effect that
might be noticed is that the default domain/username/password can no longer
be  set  at runtime. Once the client is initialized the default credentials
are  fixed.  Setting  default  credentials are runtime was always an unsafe
operation. Create an NtlmPasswordAuthentication object instead.

Thu Jul  3 20:59:25 EDT 2003

There  have  been  two small bug fixes in the SMB layer; the count field in
the  SMB_COM_WRITE_ANDX  response  was  being ignored. Apparently the count
specified  in the request is always honored or we would have seen plenty of
file corruption by now. Second, the list() and listFiles() did not properly
handle  Transaction  buffering  with  certain  values  for the listSize and
listCount  properties  (if  multipart transaction responses are send). Also
removed  a  few  obnoxious warnings getting logged during file transfers if
Log.WARNINGS is set.

Regarding  NTLM  HTTP Authentication; there have been additions and updates
to  the  documentation  on the NTLM flags, a fix to NtlmSsp to only provide
the  target when requested by the client via the NTLM "request target" flag
(this   is   the   correct  behavior),  and  a  bugfix  to  NtlmSsp  to  do
Base64.encodeBytes(bytes,  false)  instead  of Base64.encodeBytes(bytes) (a
linewrap  in  the  header  can  cause  an  error).  Eric has also excellent
documentation detailing his analysis of the NTLM protocol:

  http://davenport.sourceforge.net/ntlm.html

Thu Jun 12 00:18:05 EDT 2003

It  was  discovered  that if a server responds to the NBT session setup but
not  to  the  SMB_COM_NEGOTIATE  request the client will hang indefinately.
This  is not a likely thing to occur because servers usually respond or not
at  all.  Regardless  it  has  been  fixed.  The  client will timeout after
jcifs.netbios.soTimeout in this situation.

Some tweeking of the NTLM http code has been performed.

Wed May 28 19:09:17 EDT 2003

jcifs-0.7.8 released

A bug in the new ntlm http client code was identified and fixed.

Tue May 27 21:40:58 EDT 2003

jcifs-0.7.7 released

A  deadlock  was  identified  in SmbTransport very similar to the one found
last  year.  A  significant  change  has  been made that greatly simplifies
synchronization in the transport layer. It eliminates this issue as well as
the  extra synchronization introduced to fix the previous problem. It is an
elemental change however so proceed with caution.

Two  new  packages  have  been  introduced.  The  jcifs.ntlmssp package now
contains  all NTLMSSP base code. This code is used by the NtlmHttpFilter as
well  has  the  new  NtlmHttpURLConnection class for transparently enabling
your  HTTP and HTTPS client to negotiate NTLM authentication. The other new
package  is  jcifs.https  which  just  contains  the HTTPS protocol handler
necesary for proper protocol handler registration. Please read the document
entitled  "Using  jCIFS  NTLM  Authentication  for  HTTP  Connections"  for
important details.

To permit SmbFileOutputStream to be used with unusual named pipe modes (see
5/1/03  message)  that  will  be  both  read  and written the open flags in
SmbFileOutputStream have been changed from O_WRONLY to O_RDWR.

The    attrExpiration    period    of    SmbFile    is    now    reset   in
SmbFileOutputStream.write()  to  prevent  jCIFS  from  reporting  incorrect
attributes  values  after  writing  the file. Previously it was possible to
write  to  the file and immediated check the timestamp or file size and get
an old value. This should no longer happen.

The  SmbFileInputStream.skip()  method  has  been implemented in a way that
will  not  result  in  any  IO to the server. Thus it is possible to resume
large downloads from the point of failure for instance.

Wed Apr 16 22:46:07 EDT 2003

jcifs-0.7.6 released

The  isDirectory method has been changed to return false if the target does
not  exist.  Previously  this  would return true which is inconsistent with
java.io.File.

Wed Apr  2 23:56:26 EST 2003

jcifs-0.7.5 released

More  refinement  to  the  NTLM  HTTP authentication code has been applied.
There  is  also  a fix for listing hosts from Windows ME/98/95 local master
browsers.

Wed Mar 26 19:17:24 EST 2003

jcifs-0.7.4 released

Some NtlmHttpFilter issues were reported by several users of Win98 clients.
Eric  has  provided  a  new  NtlmSsp.java  that  works correctly with these
clients.

Wed Feb 12 01:23:02 EST 2003

From    the    beginning   jCIFS   identified   SmbSessions   uniquely   by
domain\username. This meant that once a session was established it could be
shared  by  another  requestor even if they supplied an incorrect password.
This  was  done  for  reasons  that  strangely  enough  had  to do with SMB
chaining.  However  with  the  introduction  of  the http package it is now
common  to  use  jCIFS  to  authenticate  web  clients from a central jCIFS
instance.  This  introduces  a security flaw because there would be a brief
window  of  opportunity after a user logs in during which an impostor could
log  in  as that user with a simple change to their MSIE security settings.
This  problem has been fixed. Another related issue has also been fixed. If
the   NtlmHttpFilter  or  NetworkExplorer  servlet  is  supplied  with  bad
credentials  the  behavior  was to throw an SmbAuthException up through the
container.   Instead   these   classes   will  respond  with  the  standard
Authentication:   NTLM  response  triggering  the  password  dialog  to  be
displayed until correct credentials are displayed.