[Samba] smbclient 4.0.7 fails transfer with STATUS_INVALID_PARAMETER and SMB2 but not with NT1

[Jeremy Allison]

On Fri, Apr 10, 2015 at 06:15:34PM +0000, Tompkins, Michael wrote:
> We get STATUS_INVALID_PARAMETER failures when smbclient uses SMB2 but passes with NT1. We do get some success, but mostly failures.  It appears to happen after it transfers the PDF file.
> 
> These are the packets leading up to SMB2 failing after the transfer:
> 
> No.     Time                          Source                Destination           Protocol Length Info
>     266 2015-04-09 08:30:43.688568000 10.5.12.227           10.6.161.184          TCP      1514   [TCP segment of a reassembled PDU]
> 
> No.     Time                          Source                Destination           Protocol Length Info
>     267 2015-04-09 08:30:43.688696000 10.5.12.227           10.6.161.184          TCP      1514   [TCP segment of a reassembled PDU]
> 
> No.     Time                          Source                Destination           Protocol Length Info
>     268 2015-04-09 08:30:43.688699000 10.5.12.227           10.6.161.184          SMB2     627    Write Request Len:72845 Off:0 File: scsmuser\Scan\DOC002.pdf
> 
> No.     Time                          Source                Destination           Protocol Length Info
>     269 2015-04-09 08:30:43.688701000 10.6.161.184          10.5.12.227           TCP      66     445→35119 [ACK] Seq=1611 Ack=74211 Win=26704 Len=0 TSval=1545474022 TSecr=464076
> 
> No.     Time                          Source                Destination           Protocol Length Info
>     270 2015-04-09 08:30:43.729116000 10.6.161.184          10.5.12.227           TCP      66     445→35119 [ACK] Seq=1611 Ack=74772 Win=26704 Len=0 TSval=1545474063 TSecr=464077
> 
> No.     Time                          Source                Destination           Protocol Length Info
>     271 2015-04-09 08:30:43.758999000 10.6.161.184          10.5.12.227           SMB2     143    Write Response, Error: STATUS_INVALID_PARAMETER
> 
> This is happening at a remote site, and we are not able to recreate it here. Does anyone have any input as to why this may be happening. I do have a wireshark trace if you’d like.

Mike, we're going to need a wireshark capture
of this I'm afraid. If the remote site can get
one, then log a bug and upload it so we can take
a look.

Cheers,

Jeremy.