[PATCH] fsctl_validate_neg_info skip some checkings if PROTOCOL_SMB2_02

[Jones Syue]

Hello Jeremy,

Sure, im setting the "max protocol" in the smb.conf,
and change the value to switch different SMB protocols.
This issue so far only happened with this combination:
samba4 file server: "max protocol = SMB2_02".
client: win10 pro version 1607 (recently released).

<Steps to reproduce>
1. Setting "max protocol = SMB2_02" in the smb.conf .
2. Restart samba service on the linux box.
3. win10 v1607 client input \\<linux_box_ip> to reach it,
    and windows explore can list shared folders.
4. Click one share folder "Public" and the auth window
    prompted, then enter a valid account/password pair.
5. But failed to enter the shared folder "Public",
    an error window prompted and said:
    "The specified network name is no longer available".
6. At the same time back to the file server side,
    when smbd received the SMB2 ioctl request with
    FSCTL_VALIDATE_NEGOTIATE_INFO,
    smbd would be terminated and disconnected,
    hence never reply with SMB2 ioctl response.
7. And win10 v1607 will issue next SMB2 negotiate request,
    after several packets, win10 v1607 will received
    SMB2 tree connect response with STATUS_ACCESS_DENIED.
    Hmm i guess this is mapped to the prompted error:
    "The specified network name is no longer available".

<Environment>
1. file server: a linux box with samba-4.4.5 installed,
    and not all protocols have this issue,
    max protocol = SMB2_02: FAILED.
    SMB2_10, SMB3_00, SMB3_02: passed.
    NT1, SMB3_11: passed (no FSCTL_VALIDATE_NEGO_INFO?)

2. client:  not all win10 pro have this issue.
    win10 pro version 1607 b14393.105: FAILED
    win10 pro version 1511 b10586.218: passed
    win10 pro version 10.0 b10240: passed

<Wireshark packets>
https://drive.google.com/folderview?id=0B7hCXnjbSiXFSE9ZOFJTWkM3U3M&
usp=sharing
samba-4.4.5
SMB2_02, FAILED: 20160907_samba445_failed_smb20.pcapng
SMB2_10, passed: 20160907_samba445_passed_smb21.pcapng

Tried samba-3.6.25 with SMB2_02 is passed,
smbd will reply SMB2 ioctl response with STATUS_FILE_CLOSED.
20160907_samba3625_passed_smb20.pcapng

--
Regards,
Jones Syue | 薛懷宗
QNAP Systems, Inc.

On Fri, Sep 9, 2016 at 5:51 AM, Jeremy Allison <jra at samba.org> wrote:

> On Wed, Sep 07, 2016 at 10:38:32PM +0800, Jones Syue wrote:
> > Hello list,
> >
> > The client is windows 10 pro version 1607,
> > file server: a linux box with samba-4.4.5.
> >
> > If the negotiated protocol is NT1, SMB2_10, and SMB3_11,
> > the win10 can login to the file server.
> >
> > But if the negotiated protocol is SMB2_02,
> > the win10 failed to login to the file server,
> > error alert said: the specified network name is no longer available.
> >
> > After packets captured:
> > https://drive.google.com/folderview?id=0B7hCXnjbSiXFSE9ZOFJTWkM3U3M&
> usp=sharing
> >
> > The major difference is fsctl_validate_neg_info().
> > With SMB2_02,
> > GUID_equal(&in_guid, &conn->smb2.client.guid) is false,
> > and smbd would be terminated and disconnected.
> >
> > Hmm check client guid with SMB2_02 looks a bit strange,
> > as smbd_smb2_request_process_negprot() said:
> > if (xconn->protocol < PROTOCOL_SMB2_10) {
> >   /*
> >   * SMB2_02 doesn't support client guids
> >   */
> >     return smbd_smb2_request_done(req, outbody, &outdyn);
> > }
> >
> > Another scenario happened if max protocol = SMB2_02,
> > win10 SMB1 negotiate request included dialects:
> > SMB 2.??, SMB 2.002, NT LM 0.12, etc.,
> > samba-4.4.5 will return SMB2 response with SMB 2.002.
> > In this case, both smb2.client.security_mode
> > and smb2.client.capabilities are always 0 because win10
> > SMB1 negotiate request does not support them.
> >
> > Hence the attached patch supposed to skip
> > smb2 client guid, smb2 client security mode,
> > and smb2 client capabilities if the client sent
> > SMB1 negotiate request and samba select SMB 2.002,
> > please help review and any suggestions are appreciated,
> > thank you.
>
> Hi Jones,
>
> Can you explain a little about how you're reproducing
> this ? Are you setting "max protocol" in the smb.conf
> to see this ?
>
> Cheers,
>
> Jeremy.
>