[cifs-protocol] [MS-NRPC] DCERPC_NCA_S_FAULT_INVALID_TAG returned instead of STATUS_INVALID_LEVEL - TrackingID#2307200040007944

[Jeff McCashland (He/him)]

Hi Metze,

We have updated [MS-NRPC] for the next release to address this issue. We have added the following Behavior Note to section 3.5.4.4.10:

<197> Section 3.5.4.4.10: Windows RPC layer may return its own error code instead of STATUS_INVALID_LEVEL. The error code that a client gets depends on where the calling application is getting the error from:
1. If the client is running on Windows and calling Windows RPC APIs, they may get the Win32 error code RPC_S_INVALID_TAG ([MS-ERREF] section 2.2).
2. If the client is running on third-party operating systems or getting the error code from the wire, they may get nca_s_fault_invalid_tag (0x1C000006). ([C706-RSCP] DCE 1.1: Remote Procedure Call - Reject Status Codes and Parameters).
3. The conversion between the on-the-wire nca_s_fault_invalid_tag and Win32 error code RPC_S_INVALID_TAG is specified in [MS-RPCE] Section 3.1.1.5.5.

I hope that helps. 

Best regards,
Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)
Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300

-----Original Message-----
From: Jeff McCashland (He/him) 
Sent: Thursday, July 20, 2023 10:38 AM
To: Stefan Metzmacher <metze at samba.org>; Ralph Böhme <slow at samba.org>
Cc: cifs-protocol at lists.samba.org; Microsoft Support <supportmail at microsoft.com>
Subject: [MS-NRPC] DCERPC_NCA_S_FAULT_INVALID_TAG returned instead of STATUS_INVALID_LEVEL - TrackingID#2307200040007944 

[Updated Subject and SR ID]

Hi Metze,

Thank you for catching this. We will look into it. 

Best regards,
Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada) Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300

-----Original Message-----
From: Stefan Metzmacher <metze at samba.org>
Sent: Thursday, July 20, 2023 12:38 AM
To: Jeff McCashland (He/him) <jeffm at microsoft.com>; Ralph Böhme <slow at samba.org>
Cc: cifs-protocol at lists.samba.org; Microsoft Support <supportmail at microsoft.com>
Subject: Re: [cifs-protocol] [EXTERNAL] Re: KB5028166 introduced undocumented changes to MS-NRPC? - TrackingID#2307130040007086

Hi Jeff,

> As I mentioned in the thread for the other issue, the updates have been published in an Errata document for later inclusion in [MS-NRPC]:
> 
> Windows Protocols Errata: [MS-NRPC]: Netlogon Remote Protocol 
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flear
> n.microsoft.com%2Fen-us%2Fopenspecs%2Fwindows_protocols%2Fms-winerrata
> %2F69ffd0ac-a0dd-49f2-96ad-6720441b0a93&data=05%7C01%7Cjeffm%40microso
> ft.com%7C96af25075d474ae90ea808db88f42f61%7C72f988bf86f141af91ab2d7cd0
> 11db47%7C1%7C0%7C638254354582832764%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC
> 4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%
> 7C&sdata=gVyQ220QSsI6nerxEVdngif4glqS1QssKJbWTGmbZFY%3D&reserved=0
> 
> Please let us know if this does not address the issue below.

I guess the documentation should clarify that DCERPC_NCA_S_FAULT_INVALID_TAG in returned on the wire instead of STATUS_INVALID_LEVEL.

metze