[cifs-protocol] [REG:111081664438980] RE: Level 257 FindFirst rejected by some Windows servers even though NTLM
Hongwei Sun
hongweis at microsoft.com
Wed Sep 7 08:39:39 MDT 2011
Steve,
In principle, the SMB information level (SMB) sent on wire by redirector is based on the fileInformationlevel (FSCC level) provided by the application through API. One of the API is FindFirstFileEx (http://msdn.microsoft.com/en-us/library/aa364419(v=vs.85).aspx ). The fInfoLevelId is an input parameter , which is an enum as below.
typedef enum _FINDEX_INFO_LEVELS {
FindExInfoStandard,
FindExInfoBasic,
FindExInfoMaxInfoLevel
} FINDEX_INFO_LEVELS;
When sent to the redirector , FindExInfoStandard is mapped to FileBothDirectoryInformation and FindExInfoBasic is mapped to FileFullDirectoryInformation. As I can see, there is no logic in redirector to stop sending certain SMB levels permitted as per MS-CIFS/MS-SMB based on server version. It is just using the mapping between SMB level and FSCC level as specified in 2.2.8 of MS-CIFS. To understand why the client sends a certain level, we have to find what information level is passed into API , which is application dependent. And this is not a part of protocol.
Please let me know if you have more questions.
Thanks!
Hongwei
-----Original Message-----
From: Steve French [mailto:smfrench at gmail.com]
Sent: Wednesday, August 31, 2011 4:22 PM
To: Hongwei Sun
Cc: Bryan.James.Krone-EXT at jci.com; MSSolve Case Email; cifs-protocol at samba.org; Edgar Olougouna; pfif at tridgell.net
Subject: Re: [REG:111081664438980] RE: [cifs-protocol] Level 257 FindFirst rejected by some Windows servers even though NTLM
Bryan,
I think what is puzzling is that windows client cifs redirector has the ability to send more than 3 common levels of FindFirst API calls which get sent as the equivalent CIFS Transact2 FindFirst requests
levels on the wire. What we see in the traces that you provide are
one particular level being emitted by the Windows client (which works to WIndowsCE) but we see cifs trying two other similar levels (common levels, but which do not request the "short name" in the search
results e.g) which the server does not support. It is a little
surprising that the Windows client does not fallover and fail on other search requests (other than the dir command which presumably accidentally works because it picks the right level of FindFirst API call to invoke) - such as from the Windows Explorer, search commands
or other common tools or gui objects. One theory would be that the
Windows client stops sending those common levels based on some unknown criteria (which I would like to understand so I can make sure my client works), and maps them to the particular level which we see from the Windows client trace that this WindowsCE server supports.
On Wed, Aug 31, 2011 at 9:52 AM, Hongwei Sun <hongweis at microsoft.com> wrote:
> Thanks ! But I am looking for the program/API used by a Windows client that results in a SMB_FIND_FILE_BOTH_DIRECTORY_INFO sent to Windows CE during your testing using Windows client.
>
>
>
> -----Original Message-----
> From: Bryan.James.Krone-EXT at jci.com
> [mailto:Bryan.James.Krone-EXT at jci.com]
> Sent: Wednesday, August 31, 2011 5:24 AM
> To: Steve French
> Cc: MSSolve Case Email; cifs-protocol at samba.org; Edgar Olougouna;
> Hongwei Sun; pfif at tridgell.net
> Subject: Re: [REG:111081664438980] RE: [cifs-protocol] Level 257
> FindFirst rejected by some Windows servers even though NTLM
>
> I'm using an embedded uClibc/busybox linux and I run the "ls" command and nothing shows up on the screen in the terminal window.
>
>
>
> From:
> Steve French <smfrench at gmail.com>
> To:
> Hongwei Sun <hongweis at microsoft.com>
> Cc:
> Edgar Olougouna <edgaro at microsoft.com>, "pfif at tridgell.net"
> <pfif at tridgell.net>, "cifs-protocol at samba.org"
> <cifs-protocol at samba.org>, MSSolve Case Email <casemail at microsoft.com>
> Date:
> 08/30/2011 04:09 PM
> Subject:
> Re: [REG:111081664438980] RE: [cifs-protocol] Level 257 FindFirst
> rejected by some Windows servers even though NTLM
>
>
>
> Sorry about that - I don't actually have the test machines (I couldn't
> find a WindowsCE machine to test with) and the user didn't say what
> the test program was - but I think it was the "dir" command. I will
> ask him.
>
> On Tue, Aug 30, 2011 at 3:04 PM, Hongwei Sun <hongweis at microsoft.com>
> wrote:
>> Steve,
>>
>> Any update ?
>>
>> Thanks!
>>
>> Hongwei
>>
>>
>> -----Original Message-----
>> From: Hongwei Sun
>> Sent: Thursday, August 25, 2011 4:26 PM
>> To: 'Steve French'
>> Cc: Edgar Olougouna; pfif at tridgell.net; cifs-protocol at samba.org;
>> MSSolve
> Case Email
>> Subject: RE: [REG:111081664438980] RE: [cifs-protocol] Level 257
> FindFirst rejected by some Windows servers even though NTLM
>>
>> Steve,
>>
>> What program or API are you using on Windows client to test
>> FIND_FIRST2
> command ? Have you observed that the same Windows client sends the
> different information level while connecting to different server ?
> The client (redirector) maps the application-provided [MS-FSCC]
> information levels to a SMB information Level.
> SMB_FIND_FILE_BOTH_DIRECTORY_INFO is mapped to
> FileBothDirectoryInformation passed from the application. I just want to check to see how this is passed from the application.
>>
>> Thanks!
>>
>> Hongwei
>>
>>
>> -----Original Message-----
>> From: Steve French [mailto:smfrench at gmail.com]
>> Sent: Wednesday, August 24, 2011 4:23 PM
>> To: Hongwei Sun
>> Cc: Edgar Olougouna; pfif at tridgell.net; cifs-protocol at samba.org;
>> MSSolve
> Case Email
>> Subject: Re: [REG:111081664438980] RE: [cifs-protocol] Level 257
> FindFirst rejected by some Windows servers even though NTLM
>>
>> On Tue, Aug 23, 2011 at 10:43 PM, Hongwei Sun
>> <hongweis at microsoft.com>
> wrote:
>>> Steve,
>>>
>>> Windows CE is not within the scope of protocol documentation, such
>>> as
> MS-SMB and MS-CIFS. Therefore it is understandable that it doesn't
> behave as specified in the protocol documents.
>>
>> This is more about what Windows clients do not about the WindowsCE
> server.
>>
>> Clearly windows clients works (to WindowsCE server) - and it appears
>> it
> is because they choose levels carefully to avoid the WindowsCE server
> problems
>>
>> instead of
>> FIND_FILE_DIRECTORY_INFO (level 257)
>> nor
>> FIND_FILE_FULL_DIRECTORY_INFO (258)
>> nor
>> FIND_FILE_ID_FULL_DIRECTORY_INFO (262)
>>
>> Windows clients (XP, Vista, etc) know enough to send
> SMB_FIND_FILE_BOTH_DIRECTORY_INFO (260)
>>
>> which doesn't make sense since FIND_FILE_BOTH_DIRECTORY_INFO requires
> the server to return the short name (which no longer seems relevant to
> windows clients but they are requesting it - even of WindowsCE).
>>
>> Windows is NOT returning operation not supported (or the eqiuvalent)
>> to
> the application, rather it is selectively choosing to use level 260
> (rather than the 3 other more logical find levels)
>>
>> So the question is - how does Windows (clients) determine which level
>> to
> request on FindFirst - in particular when not to use 257, 258 or
>> 262 and fall back to 260?
>>
>>> As far as Windows systems, as per 2.2.2.3.1 MS-CIFS, for Windows
>>> NT and earlier, the Find information levels supported are clearly
>>> specified
>>>
>>> SMB_INFO_STANDARD 0x0001
>>> (LANMAN2.0)
>>> SMB_INFO_QUERY_EA_SIZE 0x0002
>>> (LANMAN2.0)
>>> SMB_INFO_QUERY_EAS_FROM_LIST 0x0003 (LANMAN2.0)
>>> SMB_FIND_FILE_DIRECTORY_INFO 0x0101 (NT LANMAN)
>>> SMB_FIND_FILE_FULL_DIRECTORY_INFO 0x0102 (NT LANMAN)
>>> SMB_FIND_FILE_NAMES_INFO 0x0103 (NT
>>> LANMAN)
>>> SMB_FIND_FILE_BOTH_DIRECTORY_INFO 0x0104 (NT LANMAN)
>>>
>>> For Windows 2000 and later , in addition to the levels above , the
>>> following levels are added as per MS-SMB 2.2.6.1.1
>>>
>>> SMB_FIND_FILE_ID_FULL_DIRECTORY_INFO 0x0105 (NT LANMAN)
>>> SMB_FIND_FILE_ID_BOTH_DIRECTORY_INFO 0x0106 (NT LANMAN)
>>>
>>> As per 2.2.8 MS-CIFS, The client MUST map the application-provided
> [MS-FSCC] information levels to SMB information Levels. For all
> other [MS-FSCC] information levels, the client MUST fail the request
> with STATUS_NOT_SUPPORTED. In some case, the client MUST send a fixed level.
> For example, a client that has not negotiated long names support MUST
> request only SMB_INFO_STANDARD.
>>>
>>> Please let us know if you have more questions.
>>>
>>> Thanks!
>>>
>>> Hongwei
>>>
>>>
>>>
>>>
>>> -----Original Message-----
>>> From: cifs-protocol-bounces at cifs.org
>>> [mailto:cifs-protocol-bounces at cifs.org] On Behalf Of Steve French
>>> Sent: Thursday, August 18, 2011 4:54 PM
>>> To: Edgar Olougouna
>>> Cc: pfif at tridgell.net; cifs-protocol at samba.org
>>> Subject: Re: [cifs-protocol] Level 257 FindFirst rejected by some
>>> Windows servers even though NTLM
>>>
>>> It looks like Windows CE takes (only?) level 260 but I can't easily
> prove it without access to a test system (I just have some customer
> traces) - so how does Windows clients (Windows XP/Vista/7 etc.)
> determine which FindFirst level to send to these given that the
> Microsoft server in this case is reporting NT Find and NT SMB support
> but in practice not supporting most FindFirst levels.
>>>
>>> On Tue, Aug 16, 2011 at 12:56 PM, Edgar Olougouna
> <edgaro at microsoft.com> wrote:
>>>> [Dochelp to bcc]
>>>>
>>>> Steve,
>>>>
>>>> One of our engineers will follow-up soon on this inquiry. The case
> number is 111081664438980.
>>>>
>>>> Regards,
>>>> Edgar
>>>>
>>>> -----Original Message-----
>>>> From: Steve French [mailto:smfrench at gmail.com]
>>>> Sent: Tuesday, August 16, 2011 12:35 PM
>>>> To: Interoperability Documentation Help
>>>> Cc: cifs-protocol at samba.org; pfif at tridgell.net
>>>> Subject: Level 257 FindFirst rejected by some Windows servers even
>>>> though NTLM
>>>>
>>>> A user sent me a trace of FindFirst level 257 (0x101 ) failing to
>>>> Windows CE with NT Status: STATUS_INVALID_LEVEL (0xc0000148)
>>>>
>>>> even though dialect negotiated was NT LM 012 and that dialect is
>>>> the
> only prereq listed in MS-SMB for the level (see page 64).
>>>>
>>>> How can the client determine under what condition that the server
>>>> does not support that level - - and what level to fall back (or
>>>> move
> up to higher level)? Level 257 is pretty basic.
>>>>
>>>>
>>>> --
>>>> Thanks,
>>>>
>>>> Steve
>>>>
>>>>
>>>
>>>
>>>
>>> --
>>> Thanks,
>>>
>>> Steve
>>> _______________________________________________
>>> cifs-protocol mailing list
>>> cifs-protocol at cifs.org
>>> https://lists.samba.org/mailman/listinfo/cifs-protocol
>>>
>>>
>>
>>
>>
>> --
>> Thanks,
>>
>> Steve
>>
>>
>
>
>
> --
> Thanks,
>
> Steve
>
>
>
>
>
--
Thanks,
Steve
More information about the cifs-protocol
mailing list