[cifs-protocol] Re: [Pfif] CAR: Error in SMB2 Netprot description.

[Jeremy Allison]

On Thu, Jun 04, 2009 at 11:39:38AM -0700, Jeremy Allison wrote:
> On Thu, Jun 04, 2009 at 11:33:41AM -0700, Jeremy Allison wrote:
> > Hi all,
> > 
> > I believe there is an error in [MS-SMB2] — v20090521 in the
> > description of 2.2.4 SMB2 NEGOTIATE Response.
> > 
> > At the end of this section on page 35 it says:
> > 
> > "Buffer (variable): The variable-length buffer that contains the security buffer for the response, as specified by SecurityBufferOffset and SecurityBufferLength. The buffer MUST contain a token as produced by the GSS protocol as specified in section 3.3.5.3."
> > 
> > The "MUST" statement is incorrect. The Windows client
> > behavior is that if a null buffer is returned in this
> > field, then the client will downgrade to using raw-NTLMSSP
> > blobs for sessionsetup instead of SPNEGO wrapped blobs.
> > 
> > I can provide proof of this as a packet trace on request.
> > 
> > I think this is important to fix for the SMB2 client implementations,
> > which otherwise are forced to implement SPNEGO ASN.1 parsing.
> 
> Sorry, should have realized - there are two more "MUSTS"
> which are incorrect.
> 
> Section "2.2.5 SMB2 SESSION_SETUP Request" also has a MUST
> at the end of the section:
> 
> "Buffer (variable): A variable-length buffer that contains the security buffer for the request, as specified by SecurityBufferOffset and SecurityBufferLength. The buffer MUST contain a token as produced by the GSS protocol as specified in section 3.3.5.5."
> 
> and also "2.2.6 SMB2 SESSION_SETUP Response" has a MUST
> at the end of the section:
> 
> "Buffer (variable): A variable-length buffer that contains the security buffer for the response, as specified by SecurityBufferOffset and SecurityBufferLength. The buffer MUST contain a token as produced by the GSS protocol as specified in section 3.2.5.3."
> 
> The values in these buffers can be a raw NTLMSSP data
> blob instead of a GSS blob.
> 
> No need to open a new CAR, just attach these ammendments
> to the existing one.

As requested, here is the wireshark capture trace showing this
behavior.

Jeremy.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: win7-raw-ntlmssp-sessionsetup.cap
Type: application/cap
Size: 3045 bytes
Desc: not available
Url : http://lists.samba.org/archive/cifs-protocol/attachments/20090604/034a8b48/win7-raw-ntlmssp-sessionsetup.bin