<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">What I am presuming is that the encrypted lease break notification packet is being silently dropped. [MS-SMB2] “<span lang="EN">3.3.4.7 Object Store Indicates a Lease Break” says “The message SHOULD NOT be signed.” If all Windows versions
have a consistent behavior, we could add another statement it SHOULD NOT be encrypted.
</span>Lease keys are not tied to a particular session from the client. So technically there no specific encryption key for that message.
<o:p></o:p></p>
<p class="MsoNormal">Please collect etw with (t.cmd) and network trace so I can have further look. With ETW captured with t.cmd I can use private symbols and hopefully see more details.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">RE: “When taking fresh traces, do you have a hint for me how I can instrument the client what it does or does not see?”<o:p></o:p></p>
<p class="MsoPlainText">----------------------<o:p></o:p></p>
<p class="MsoNormal">For your own troubleshooting, starting form Windows 8, there is inbox built-in provider manifests that Message Analyzer can leverage to see smb ETWs.
<o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">. Open an elevated command prompt (run as administrator)<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">netsh trace start capture=yes tracefile=c:\NetTrace.etl provider="Microsoft-Windows-SMBClient" keywords=0xffffffffffffffff level=0xff
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">netsh trace stop<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Open the etl file with Message Analyzer.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">Microsoft Message Analyzer
</span><a href="http://www.microsoft.com/en-us/download/details.aspx?id=44226" target="_blank">http://www.microsoft.com/en-us/download/details.aspx?id=44226</a><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Add a filter based on the
</span>SMB2 OPLOCK_BREAK<span style="font-size:9.5pt;font-family:Consolas;color:black"> (SMB2.Header.Command == 0x12), and Click Remove to look at all ETW events before that the Lease break notification. You may see WSK receive or SMB receive etws. Inspect
log events and see if it helps.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">RE: “Also, do you have a hint how I can make a Windows box acting as a server for encrypted SMB3 not offer leases but only oplocks, make a matching client not request leases?”<o:p></o:p></p>
<p class="MsoPlainText">----------------------<o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DisableLeasing registry key can be used to turn off/on leasing (but that is not recommended on production platforms given the performance impact). <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\</span><span style="color:#1F497D">DisableLeasing</span><span lang="EN"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Here is the article on disabling leasing:</span><span lang="EN"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="color:#1F497D"><a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fsupport.microsoft.com%2fen-us%2fkb%2f2957623&data=01%7c01%7cnmanis%40microsoft.com%7c46d3a9f52ede42f2310508d2caa9af3f%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=rElVz1y%2bm9mggDdDU5qqah8diXAR18r0t4UcUY6fxuU%3d" target="_blank">https://support.microsoft.com/en-us/kb/2957623</a></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">1. Disable the leasing on the file server. To do this, run the following command:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v DisableLeasing /t REG_DWORD /d 1 /f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">2.Restart the file server, or restart the server service. To restart the service, run the following commands:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">NET STOP SERVER<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">NET START SERVER<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">== Instructions for t.cmd ETW ==<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Save the script with "cmd" suffix. And collect the traces on the Windows as follows.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">. Open an elevated command prompt (run as administrator)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">. Start SMB ETW capture on client or server:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Windows client: t.cmd clion <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Windows server: t.cmd srvon<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">. start network captures (Netmon or Message Analyzer capture)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">. reproduce the issue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">. Stop SMB etw capture: <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Windows client: t.cmd clioff <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Windows server: t.cmd srvoff<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> (this will create an output t.cab file)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">. stop and save network captures<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Upload the traces (network traces, t.cab) to the workspace.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal">=== Using message analyzer to collect SMB ETW ===<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">Just a reference, I presume you are already familiar with MA.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">Microsoft Message Analyzer Operating Guide</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="https://technet.microsoft.com/en-us/library/jj649776.aspx" target="_blank">https://technet.microsoft.com/en-us/library/jj649776.aspx</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Message Analyzer > New Session > Live Trace, Trace Scenario > drop-down “Select a trace scenario” and pick “MB2 Client Full Details”<o:p></o:p></span></p>
<p class="MsoNormal"><img border="0" width="624" height="266" id="Picture_x0020_2" src="cid:image001.jpg@01D1004C.2F382C20"><span style="font-size:9.5pt;font-family:Consolas;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Click configure<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Level: verbose<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Keywords(Any): select every possible option<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Keywords(All): 0x0<o:p></o:p></span></p>
<p class="MsoNormal"><img border="0" width="347" height="180" id="Picture_x0020_1" src="cid:image002.png@01D1004C.2F382C20"><span style="font-size:9.5pt;font-family:Consolas;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas;color:black">Start the trace.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Edgar<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Volker Lendecke [mailto:Volker.Lendecke@SerNet.DE] <br>
Sent: Tuesday, October 6, 2015 1:19 PM<br>
To: Edgar Olougouna <edgaro@microsoft.com><br>
Cc: MSSolve Case Email <casemail@microsoft.com>; cifs-protocol@lists.samba.org<br>
Subject: Re: [REG:115100613235242] [cifs-protocol] Send oplock breaks unencrypted, as lease breaks are sent plain?</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On Tue, Oct 06, 2015 at 04:32:25PM +0000, Edgar Olougouna wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Please find the following details in this blog. If the specific test
<o:p></o:p></p>
<p class="MsoPlainText">> case is not covered in the blog, please send me a network trace and
<o:p></o:p></p>
<p class="MsoPlainText">> the Windows version.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'll provide the network traces tomorrow.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The required behaviour seems to be covered well in the blog, thanks for that.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">However, then Windows 8 (I'll provide tomorrow if 8 or 8.1) is buggy. Samba does not get an oplock break reply if we send the break indication encrypted. If we send the very same oplock break indication unencrypted, everything works
fine.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">When taking fresh traces, do you have a hint for me how I can instrument the client what it does or does not see?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Also, do you have a hint how I can make a Windows box acting as a server for encrypted SMB3 not offer leases but only oplocks, make a matching client not request leases?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Volker<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> Encryption in SMB 3.0: A protocol perspective <o:p></o:p></p>
<p class="MsoPlainText">> <a href="https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fblogs">
<span style="color:windowtext;text-decoration:none">https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fblogs</span></a>.<o:p></o:p></p>
<p class="MsoPlainText">> msdn.com%2fb%2fopenspecification%2farchive%2f2012%2f10%2f05%2fencrypti<o:p></o:p></p>
<p class="MsoPlainText">> on-in-smb-3-0-a-protocol-perspective.aspx&data=01%7c01%7cedgaro%40micr<o:p></o:p></p>
<p class="MsoPlainText">> osoft.com%7cbd77e39421bc4d55302f08d2ce7aa473%7c72f988bf86f141af91ab2d7<o:p></o:p></p>
<p class="MsoPlainText">> cd011db47%7c1&sdata=hW9ce3LRKc3oy%2bMPtwE0pOr0J0W%2bhsNDlopl6VnxIXA%3d<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Oplock and Lease Breaks<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Oplock break notifications/acknowledgments/responses must be encrypted when encryption is active. For an Oplock, the FileID is used to derive the SessionId which is set in the notification/acknowledgement/response. See more details
in MS-SMB2. <o:p></o:p></p>
<p class="MsoPlainText">> Lease break notifications - sent by the server - do not have a SessionId, and as a result, are neither signed nor encrypted. Lease keys are not tied to a particular session from the client.<o:p></o:p></p>
<p class="MsoPlainText">> However, Lease break acknowledgements sent by the client - and their responses sent by the server - must be encrypted when encryption is active. The client is responsible for selecting a session associated with one of the existing
opens associated with that Lease Key. The response is sent on the session that receives the acknowledgment.
<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Encryption clauses<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> The sender encrypts the message if any of the following conditions is satisfied:<o:p></o:p></p>
<p class="MsoPlainText">> . If the sender is sending a response to an encrypted request.<o:p></o:p></p>
<p class="MsoPlainText">> . If Session.EncryptData is TRUE and the request or response being sent is not NEGOTIATE.<o:p></o:p></p>
<p class="MsoPlainText">> . If Session.EncryptData is FALSE, the request or response being sent is not NEGOTIATE or SESSION_SETUP or TREE_CONNECT, and <TreeConnect|Share>.EncryptData is TRUE.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Note: TreeConnect.EncryptData is on the client side. Share.EncryptData is on the server side.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Review of encryption clauses<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> . All clauses exclude any operation which does use a SessionId. A SessionId is needed to find the Session object and derive the encryption and decryption keys from its session key. For example, if the client sends a non-encrypted
ECHO, Windows 8 server will respond with a non-encrypted response. <o:p></o:p></p>
<p class="MsoPlainText">> . Clause "response to an encrypted request": if the sender encrypts the request, the receiver will respond in the same way by encrypting the response. There is however a prerequisite that encryption is active, i.e. encryption
keys have been generated. For example, if the client encrypts an ECHO, Windows 8 server responds in-kind by encrypting the response.
<o:p></o:p></p>
<p class="MsoPlainText">> . Clause "Session.EncryptData is TRUE": SMB 3 session setup encryption goes as follows:<o:p></o:p></p>
<p class="MsoPlainText">> -- Initial session setup messages are un-encrypted as there is no session object (key etc).<o:p></o:p></p>
<p class="MsoPlainText">> -- Session binding requests must be signed, but not encrypted. Note: Windows-based server does not encrypt session setup responses for session binding, regardless whether the client encrypts the session binding request. On
the other side, Windows client does not encrypt session binding requests when Session.EncryptData is TRUE.<o:p></o:p></p>
<p class="MsoPlainText">> -- Spontaneous re-authentication of a valid session must be encrypted, otherwise the server returns STATUS_ACCESS_DENIED.<o:p></o:p></p>
<p class="MsoPlainText">> -- Re-authentication of an expired session is encrypted as well.<o:p></o:p></p>
<p class="MsoPlainText">> -- For re-authentication at reconnection after a broken connection, if the client lost all of its connections to the server, then the client would reconnect and create a new session (initial session setup). If the client lost
some of its connections but not all, then the client would reconnect and bind to the existing session (session setup binding).<o:p></o:p></p>
<p class="MsoPlainText">> . Clause "Session.EncryptData is FALSE and <TreeConnect|Share>.EncryptData is TRUE":
<o:p></o:p></p>
<p class="MsoPlainText">> If the client performs TREE_DISCONNECT before a LOGOFF, the logoff will not be encrypted.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Thanks,<o:p></o:p></p>
<p class="MsoPlainText">> Edgar<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Edgar Olougouna<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Tuesday, October 6, 2015 11:17 AM<o:p></o:p></p>
<p class="MsoPlainText">> To: <a href="mailto:Volker.Lendecke@SerNet.DE"><span style="color:windowtext;text-decoration:none">Volker.Lendecke@SerNet.DE</span></a><o:p></o:p></p>
<p class="MsoPlainText">> Cc: MSSolve Case Email <<a href="mailto:casemail@microsoft.com"><span style="color:windowtext;text-decoration:none">casemail@microsoft.com</span></a>>;
<o:p></o:p></p>
<p class="MsoPlainText">> <a href="mailto:cifs-protocol@lists.samba.org"><span style="color:windowtext;text-decoration:none">cifs-protocol@lists.samba.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">> Subject: RE: [REG:115100613235242] [cifs-protocol] Send oplock breaks unencrypted, as lease breaks are sent plain?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Volker can you please share the network trace? Is this Windows 8.1 or Windows 8?<o:p></o:p></p>
<p class="MsoPlainText">> Thanks,<o:p></o:p></p>
<p class="MsoPlainText">> Edgar<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Edgar Olougouna<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Tuesday, October 6, 2015 11:07 AM<o:p></o:p></p>
<p class="MsoPlainText">> To: <a href="mailto:Volker.Lendecke@SerNet.DE"><span style="color:windowtext;text-decoration:none">Volker.Lendecke@SerNet.DE</span></a><o:p></o:p></p>
<p class="MsoPlainText">> Cc: MSSolve Case Email <<a href="mailto:casemail@microsoft.com"><span style="color:windowtext;text-decoration:none">casemail@microsoft.com</span></a>>;
<o:p></o:p></p>
<p class="MsoPlainText">> <a href="mailto:cifs-protocol@lists.samba.org"><span style="color:windowtext;text-decoration:none">cifs-protocol@lists.samba.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">> Subject: [REG:115100613235242] [cifs-protocol] Send oplock breaks unencrypted, as lease breaks are sent plain?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> [Case number in subject]<o:p></o:p></p>
<p class="MsoPlainText">> [bcc dochelp, cc casemail]<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Volker,<o:p></o:p></p>
<p class="MsoPlainText">> Glad to hear from you. We've created the case number 115100613235242 for this inquiry.<o:p></o:p></p>
<p class="MsoPlainText">> I will look into this and follow-up soon.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Thanks,<o:p></o:p></p>
<p class="MsoPlainText">> Edgar<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Volker Lendecke [<a href="mailto:Volker.Lendecke@SerNet.DE"><span style="color:windowtext;text-decoration:none">mailto:Volker.Lendecke@SerNet.DE</span></a>]<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Tuesday, October 6, 2015 10:51 AM<o:p></o:p></p>
<p class="MsoPlainText">> To: Interoperability Documentation Help <<a href="mailto:dochelp@microsoft.com"><span style="color:windowtext;text-decoration:none">dochelp@microsoft.com</span></a>><o:p></o:p></p>
<p class="MsoPlainText">> Cc: <a href="mailto:cifs-protocol@lists.samba.org"><span style="color:windowtext;text-decoration:none">cifs-protocol@lists.samba.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">> Subject: Re: [cifs-protocol] Send oplock breaks unencrypted, as lease breaks are sent plain?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> On Tue, Oct 06, 2015 at 04:35:36PM +0200, Volker Lendecke wrote:<o:p></o:p></p>
<p class="MsoPlainText">> > Hi!<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > Testing leases and oplocks against Windows 8 over encrypted smb3 I
<o:p></o:p></p>
<p class="MsoPlainText">> > see that I get lease breaks in plain text, unencrypted, but oplock
<o:p></o:p></p>
<p class="MsoPlainText">> > breaks are sent encrypted by Windows 8. Samba does the same, however
<o:p></o:p></p>
<p class="MsoPlainText">> > a Windows 8 client seems very unhappy with our unencrypted oplock
<o:p></o:p></p>
<p class="MsoPlainText">> > breaks,<o:p></o:p></p>
<p class="MsoPlainText">> ^^^^^^^^^^^ obvious typo: We send oplock breaks encrypted, is what Win8 does but which seems wrong.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Volker<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> > it just seems not to respect them. If we modify Samba to send oplock
<o:p></o:p></p>
<p class="MsoPlainText">> > breaks unencrypted, Windows 8 client is happily downgrading the
<o:p></o:p></p>
<p class="MsoPlainText">> > oplock, everything is fine.<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > Where in the documentation can I find what is correct? And, where is
<o:p></o:p></p>
<p class="MsoPlainText">> > the bug? Client or server?<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > If required, I can provide network traces.<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > With best regards,<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > Volker Lendecke<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > --<o:p></o:p></p>
<p class="MsoPlainText">> > SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen<o:p></o:p></p>
<p class="MsoPlainText">> > phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB
<o:p></o:p></p>
<p class="MsoPlainText">> > 2816,<o:p></o:p></p>
<p class="MsoPlainText">> > GF: Dr. Johannes Loxen <o:p></o:p></p>
<p class="MsoPlainText">> > <a href="https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww">
<span style="color:windowtext;text-decoration:none">https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww</span></a>.<o:p></o:p></p>
<p class="MsoPlainText">> > sernet.de&data=01%7c01%7cedgaro%40microsoft.com%7cbd77e39421bc4d5530<o:p></o:p></p>
<p class="MsoPlainText">> > 2f08d2ce7aa473%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=GlaLY7C1<o:p></o:p></p>
<p class="MsoPlainText">> > TH%2b%2fmgbMVzeZn7gk9np2j4GkvXu0OWHuOm8%3d, <a href="mailto:kontakt@sernet.de">
<span style="color:windowtext;text-decoration:none">mailto:kontakt@sernet.de</span></a><o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > _______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">> > cifs-protocol mailing list<o:p></o:p></p>
<p class="MsoPlainText">> > <a href="mailto:cifs-protocol@lists.samba.org"><span style="color:windowtext;text-decoration:none">cifs-protocol@lists.samba.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">> > <a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2flis">
<span style="color:windowtext;text-decoration:none">https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2flis</span></a><o:p></o:p></p>
<p class="MsoPlainText">> > ts.samba.org%2fmailman%2flistinfo%2fcifs-protocol&data=01%7c01%7cedg<o:p></o:p></p>
<p class="MsoPlainText">> > aro%40microsoft.com%7cbd77e39421bc4d55302f08d2ce7aa473%7c72f988bf86f<o:p></o:p></p>
<p class="MsoPlainText">> > 141af91ab2d7cd011db47%7c1&sdata=BKg%2b1jDIxFaLp5t5qcqfLHNV1Hhxl1Ga63<o:p></o:p></p>
<p class="MsoPlainText">> > VHmHURdVg%3d<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> --<o:p></o:p></p>
<p class="MsoPlainText">> SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen<o:p></o:p></p>
<p class="MsoPlainText">> phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB 2816,
<o:p></o:p></p>
<p class="MsoPlainText">> GF: Dr. Johannes Loxen <o:p></o:p></p>
<p class="MsoPlainText">> <a href="https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.se">
<span style="color:windowtext;text-decoration:none">https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.se</span></a><o:p></o:p></p>
<p class="MsoPlainText">> rnet.de&data=01%7c01%7cedgaro%40microsoft.com%7cbd77e39421bc4d55302f08<o:p></o:p></p>
<p class="MsoPlainText">> d2ce7aa473%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=GlaLY7C1TH%2b%<o:p></o:p></p>
<p class="MsoPlainText">> 2fmgbMVzeZn7gk9np2j4GkvXu0OWHuOm8%3d, <a href="mailto:kontakt@sernet.de">
<span style="color:windowtext;text-decoration:none">mailto:kontakt@sernet.de</span></a><o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen<o:p></o:p></p>
<p class="MsoPlainText">phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
<a href="https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.sernet.de&data=01%7c01%7cedgaro%40microsoft.com%7cbd77e39421bc4d55302f08d2ce7aa473%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=GlaLY7C1TH%2b%2fmgbMVzeZn7gk9np2j4GkvXu0OWHuOm8%3d">
<span style="color:windowtext;text-decoration:none">https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.sernet.de&data=01%7c01%7cedgaro%40microsoft.com%7cbd77e39421bc4d55302f08d2ce7aa473%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=GlaLY7C1TH%2b%2fmgbMVzeZn7gk9np2j4GkvXu0OWHuOm8%3d</span></a>,
<a href="mailto:kontakt@sernet.de"><span style="color:windowtext;text-decoration:none">mailto:kontakt@sernet.de</span></a><o:p></o:p></p>
</div>
</body>
</html>