Skip to content

Fix UnboundLocalError on parentDir when connecting to Samba (Linux) shares#2174

Open
ghecko wants to merge 1 commit into
fortra:masterfrom
ghecko:master
Open

Fix UnboundLocalError on parentDir when connecting to Samba (Linux) shares#2174
ghecko wants to merge 1 commit into
fortra:masterfrom
ghecko:master

Conversation

@ghecko
Copy link
Copy Markdown

@ghecko ghecko commented Apr 17, 2026

Summary

When using any impacket-based tool (nxc, smbclient-ng, etc.) to connect to a
Samba/Linux SMB share, the connection fails with:

[error] cannot access local variable 'parentDir' where it is not associated with a value

This happens when the SMB server advertises dialect >= 3.0 with directory
leasing support, and the client accesses a file at the root of the share.

Root cause

In impacket/smb3.py, the SMB2_CREATE handler has an indentation bug in the
directory leasing logic (around line 1267-1277):

if len(fileName.split('\\')) > 2:
    parentDir = ntpath.dirname(pathName)
if parentDir in self.GlobalFileTable:   # <-- outside the guard!

parentDir is only assigned when the path has more than 2 components (i.e. not
at share root), but the code referencing it sits outside that if block. For
root-level paths (common on Samba shares) parentDir is never bound, causing
an UnboundLocalError.

Fix

Move the if parentDir in self.GlobalFileTable / else block inside the
if len(...) > 2: guard, so that parent directory lease tracking is only
attempted when a parent directory actually exists:

if len(fileName.split('\\')) > 2:
    parentDir = ntpath.dirname(pathName)
    if parentDir in self.GlobalFileTable:
        raise Exception("Don't know what to do now! :-o")
    else:
        parentEntry = copy.deepcopy(FILE)
        parentEntry['LeaseKey']   = uuid.generate()
        parentEntry['LeaseState'] = SMB2_LEASE_NONE
        self.GlobalFileTable[parentDir] = parentEntry

This matches the original intent described by the inline comment
"Is this file NOT on the root directory?".

Impact

Affects any impacket consumer connecting to Samba/Linux shares over SMB3 with
directory leasing enabled. Windows shares are less commonly affected because
paths tend to include subdirectories (e.g. C$\Windows\...).

When connecting to a Samba/Linux SMB share using SMB3 dialect >= 3.0 with
directory leasing support, the SMB2 CREATE handler in smb3.py crashes with:
  "cannot access local variable 'parentDir' where it is not associated with a value"

Root cause: an indentation bug at line 1271. The variable `parentDir` is only
assigned inside `if len(fileName.split('\\')) > 2:` (i.e. when the file is NOT
at the share root), but the block that references `parentDir` (the
GlobalFileTable lookup and parent entry creation) was incorrectly placed
outside that conditional. When accessing a root-level path — which is common
on Samba shares — the condition is false, `parentDir` is never assigned, and
Python raises UnboundLocalError.

The fix moves the `if parentDir in self.GlobalFileTable` block and its `else`
branch inside the `if len(...) > 2:` guard, which matches the original intent
described by the comment "Is this file NOT on the root directory?". Parent
directory lease tracking only makes sense when a parent directory actually
exists, so skipping it for root-level paths is the correct behavior.

This bug affects any tool built on impacket (nxc, smbclient-ng, etc.) when
targeting Samba/Linux shares with SMB3 directory leasing enabled.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant