[bug] SMB1 server ignores AllowAnonymous unless AllowGuest is also set #1521

Summary

In the SMB1 server, Config.AllowAnonymous has no effect unless Config.AllowGuest is also set: a null session is refused with STATUS_LOGON_FAILURE when only AllowAnonymous is enabled.

Location

• File(s): network/smb/smb_v10/server/handler_session.go
• Line(s) / function(s): (*Connection).finishAuthentication() at L156–L167 (admission check at L161)

Category

api-contract

Severity

medium

A server configured to accept null sessions but not guests refuses every anonymous logon, so anonymous-only deployments (null-session enumeration targets) cannot be built.

Reproduction / Evidence

Reproducible at runtime against an in-process server (SigningDisabled, an Authenticator configured), driving an NTLM logon with an empty user name, domain and password:

L161 reads:

if !c.Server.config.AllowGuest || (anonymous && !c.Server.config.AllowAnonymous) {

so !AllowGuest alone refuses every keyless logon, including a null session that AllowAnonymous is meant to admit.

Expected Behavior

The two flags are independent, as documented on Config (server.go L59–L71) and in the package documentation (doc.go L410–L414): AllowAnonymous alone admits a null session, and AllowGuest alone admits an unverifiable named identity as a guest.

Actual Behavior

AllowAnonymous only narrows AllowGuest: a null session needs both flags, and AllowAnonymous alone admits nothing.

Root Cause (if known)

The admission condition requires AllowGuest for every keyless logon and treats AllowAnonymous as an additional requirement for null sessions, instead of selecting the one flag that governs each kind of logon.

Notes

Related: #1491 (the same defect in the SMB2 server, fixed by PR #1492).