[cifs-protocol] [REG:116091614680032] [MS-SMB] - status code of NT_TRANS_QUERY_QUOTA

[Bryan Burgin]

Hi Uri,

I verified your findings and files an issue against [MS-SMB].  Requested change:

Update [MS-SMB] 3.3.5.11.2 "Receiving an NT_TRANS_QUERY_QUOTA Request" to reflect:

Send STATUS_BUFFER_TOO_SMALL if no buffer was indicated or a buffer too small to hold a single entry
Send STATUS_SUCCESS to indicate the return of valid entries and as a signal that there are more (to re-post a new buffer)
Send STATUS_NO_MORE_ENTRIES when the last entry was sent.

Bryan

-----Original Message-----
From: Bryan Burgin 
Sent: Friday, September 16, 2016 12:54 PM
To: Uri Simchoni <uri at samba.org>
Cc: cifs-protocol at lists.samba.org; MSSolve Case Email <casemail at microsoft.com>
Subject: RE: [REG:116091614680032] [MS-SMB] - status code of NT_TRANS_QUERY_QUOTA

Thx.  I was reviewing ZwQueryQuotaInformationFile(), which this call relies on, and surmised that STATUS_BUFFER_TOO_SMALL is returned only if a buffer was supplied that was too small for a single entry.  Thanks for confirming.  I'll review the rest and file a report against [MS-SMB].

Bryan

-----Original Message-----
From: Uri Simchoni [mailto:uri at samba.org] 
Sent: Friday, September 16, 2016 12:50 PM
To: Bryan Burgin <bburgin at microsoft.com>
Cc: cifs-protocol at lists.samba.org; MSSolve Case Email <casemail at microsoft.com>
Subject: Re: [REG:116091614680032] [MS-SMB] - status code of NT_TRANS_QUERY_QUOTA

On 09/16/2016 07:23 PM, Bryan Burgin wrote:
> [Josh to bcc]
> 
> Hi Uri,
> 
> I can review this for you.  Is your observation that we never return STATUS_BUFFER_TOO_SMALL?  It's either STATUS_SUCCESS or STATUS_NO_MORE_ENTRIES?  Do you have traces?
> 
> Bryan
> 
> 

I've seen STATUS_BUFFER_TOO_SMALL only if MaxDataCount is not enough for a single quota record. Otherwise it's a series of OK's that end with a STATUS_NO_MORE_ENTRIES. BTW, this is the documented [MS-SMB2] behavior.

Attached pls find a packet trace. MaxDataCount has been purposefully made small here to show a series of requests.

Thanks,
Uri.