GET_DFS_REFERRALS and IPC$

[Tom Talpey]

> -----Original Message-----
> On Tue, Dec 1, 2015 at 10:55 AM, Richard Sharpe
> <realrichardsharpe at gmail.com> wrote:
> > On Tue, Dec 1, 2015 at 10:42 AM, Jeremy Allison <jra at samba.org> wrote:
> >> On Tue, Dec 01, 2015 at 08:27:06AM -0800, Richard Sharpe wrote:
> >>> On Mon, Nov 30, 2015 at 2:59 PM, Richard Sharpe
> >>> <realrichardsharpe at gmail.com> wrote:
> >>> > Hi folks,
> >>> >
> >>> > my copy of [MS-SMB].pdf contains these words WRT DFS referrals:
> >>> >
> >>> > -----------------------------------------------
> >>> > 3.2.4.20.3 Application Requests DFS Referral Information
> >>> > ...
> >>> >
> >>> > The client MUST search for an existing Session and TreeConnect to any
> >>> > share on the server identified by ServerName for the user identified
> >>> > by UserCredentials. If no Session and TreeConnect are found, the
> >>> > client MUST establish a new Session and TreeConnect to IPC$ on the
> >>> > target server as described in section 3.2.4.2 using the supplied
> >>> > ServerName and UserCredentials.
> >>> > ...
> >>> > -------------------------------------------------
> >>> >
> >>> > However, Windows clients seem not to do that and always seem to
> use
> >>> > IPC$ for DFS referrals even when they have connections open on the
> >>> > target server.
> >>> >
> >>> > Has anyone seen any cases where Windows clients use shares other
> than IPC$?
> >>>
> >>> Following up from this, I have seen claims from Load Dynamics
> >>> (formerly, SwiftTest) that they have test cases where they send
> >>> GET_DFS_REFERRALS to Windows servers on normal shares and it works.
> >>>
> >>> I have asked for a capture.
> >>>
> >>> Samba does not like it, however, and sends back
> >>> NT_STATUS_INVALID_DEVICE_REQUEST.
> >>
> >> Interesting. If we get a Windows capture showing
> >> this we should implement the same semantics as
> >> a Windows server.
> >
> > That was my thinking.
> >
> > I should have a capture later today.
> 
> Attached is the capture.
> 
> It is pretty clear that the server is Windows Server 2012 or Windows 8
> since it supports NEGOEX.
> 
> It seems happy to accept GET_DFS_REFERRALS on any share.

It's definitely expected that the Windows server will process GET_DFS_REFERRALS on any tree connect. MS-SMB2 section 3.3.5.15.2 has no restriction.

But it's unexpected that the client behavior is different from the document - that the request is always sent to IPC$. Can you raise a dochelp request, especially identifying which client has this behavior? Thanks!

Tom.