none
SMB2 Mac client failes to access file on Windows 2012 R2 share which is a DFS root RRS feed

  • Question

  • Hello,

    I am seeing some issue in Mac client accessing file on Windows 2012 R2 share which is also a DFS root.  Server returns an error STATUS_OBJECT_ PATH_NOT_FOUND, even if file exist.

    I have taken network trace capturing the issue.

    It will be great if some one can  have a look and comment whether it is a server issue or client issue.

    Thanks

    Jimmy

     

    Monday, May 1, 2017 5:52 AM

Answers

  • Hi Jimmy,

    In response to your question: "How can a share be in DFS if the sharing server does not support DFS?"

    I've reviewed relevant sections of [MS-SMB2], [MS-DFSC], and [MS-SRVS], and compared the spec to Windows Server source code where the check you referenced in SMB2 is made:

    3.3.5.9 Receiving an SMB2 CREATE Request
    "If the request received has SMB2_FLAGS_DFS_OPERATIONS set in the Flags field of the SMB2 header, and TreeConnect.Share.IsDfs is TRUE, the server MUST verify the value of IsDfsCapable"

    In this section, TreeConnect.Share.IsDfs indicates whether the share is located in a DFS tree and configured for DFS. These are static properties of the share. On the other hand, IsDfsCapable can be more dynamic, as it requires (in Windows implementation) the DFS service to be healthy. The section is indicating that the DFS server/service availability should be verified before invoking the DFS interface to normalize the path name. 

    Please let us know if you have further questions on the protocol. 

    Thanks,


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Thursday, May 4, 2017 7:47 PM
    Moderator
  • Hi Jimmy,

    The server expects the prefix to always be present if SMB2_FLAGS_DFS_OPERATIONS is set on the Tree Connect. If the prefix is missing, the DFS server will remove the first 2 elements of the path, assuming these are the prefix.

    • If this results in a null string (as it would for "MyDir\file1"), the server returns STATUS_INVALID_PARAMETER
    • If the string is too short, the server returns STATUS_FILE_IS_A_DIRECTORY
    • If the DFS Namespace is offline (ie: it can't find a DFS server\share matching the prefix), the server returns STATUS_DFS_UNAVAILABLE.
    • If it doesn't find the prefix-removed path on the server\share of the Tree Connect, the server returns STATUS_PATH_NOT_COVERED, assuming that the path includes a DFS link.

    If the Tree Connect is for \\server1\share, and the path is server2\share\folder\file.txt, then we'll attempt to open folder\file.txt on \\server1\share, if the server2\share namespace is online.

    Note that the only use the server makes of the prefix is to make sure the DFS namespace is online. 

    I hope that helps! Please let us know if you have further questions. 

    Thanks,


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Friday, May 5, 2017 6:56 PM
    Moderator

All replies

  • Hello Jimmy:

     

    The purpose of this forum is to support only the Open Specifications documentation. You can read about the Microsoft Open Specifications program from http://www.microsoft.com/openspecifications/en/us/default.aspx . The library of Open Specification documents can be accessed from http://msdn.microsoft.com/en-us/library/dd208104(PROT.10).aspx   

     

    We feel that your query is best suited for following forum and would request you to please repost your query on this forum for further assistance :https://social.technet.microsoft.com/Forums/windowsserver/en-us/home?forum=winserverfiles

    Thanks


    Tarun Chopra | Escalation Engineer | Open Specifications Support Team

    Monday, May 1, 2017 4:42 PM
  • Hello Tarun,

    I thought [MS-SMB2] is open specification.

    3.3.5.9 Receiving an SMB2 CREATE Request

    "If the request received has SMB2_FLAGS_DFS_OPERATIONS set in the Flags field of the SMB2 header, and TreeConnect.Share.IsDfs is TRUE, the server MUST verify the value of IsDfsCapable:
     If IsDfsCapable is TRUE, the server MUST invoke the interface defined in [MS-DFSC] section 3.2.4.1 to normalize the path name by supplying the target path name.
     If IsDfsCapable is FALSE, the server MUST fail the request with STATUS_FS_DRIVER_REQUIRED."

    I think that "TreeConnect.Share.IsDfs" cannot be TRUE if "IsDfsCapable" is FALSE. How can a share be in DFS if the sharing server does not support DFS?

    Thanks



    Monday, May 1, 2017 7:13 PM
  • Hello Jimmy:

    Thanks for providing detailed information. We have created a case to track you inquiry and a support engineer will be in touch to assist further.

    Thanks


    Tarun Chopra | Escalation Engineer | Open Specifications Support Team


    Monday, May 1, 2017 11:40 PM
  • Hi Jimmy,

    I am researching your DFS question. I will let you know what I find.

    Thanks,


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Tuesday, May 2, 2017 3:44 PM
    Moderator
  • Hi Jimmy,

    In response to your question: "How can a share be in DFS if the sharing server does not support DFS?"

    I've reviewed relevant sections of [MS-SMB2], [MS-DFSC], and [MS-SRVS], and compared the spec to Windows Server source code where the check you referenced in SMB2 is made:

    3.3.5.9 Receiving an SMB2 CREATE Request
    "If the request received has SMB2_FLAGS_DFS_OPERATIONS set in the Flags field of the SMB2 header, and TreeConnect.Share.IsDfs is TRUE, the server MUST verify the value of IsDfsCapable"

    In this section, TreeConnect.Share.IsDfs indicates whether the share is located in a DFS tree and configured for DFS. These are static properties of the share. On the other hand, IsDfsCapable can be more dynamic, as it requires (in Windows implementation) the DFS service to be healthy. The section is indicating that the DFS server/service availability should be verified before invoking the DFS interface to normalize the path name. 

    Please let us know if you have further questions on the protocol. 

    Thanks,


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Thursday, May 4, 2017 7:47 PM
    Moderator
  • Hi Jeff,

    Thanks for this satisfactory explanation.

    I have one  more question on normalize the path name - [MS-DFSC] section 3.2.41

    It says "  if the path name is "\MyDomain\MyDfs\MyDir\file1", then the DFS server MUST change the path name to "MyDir\file1".  "

    What if path name is MyDir\file1 ? ie what if client has sent a path name relative to the root of the namespace ?

    Same question in other words referring a different section in  [MS-SMB2].

    [MS-SMB2] 2.2.13 SMB2 CREATE Request

    "NameOffset (2 bytes): The offset, in bytes, from the beginning of the SMB2 header to the 8-byte aligned file name. If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of the SMB2 header, the file name includes a prefix that will be processed during DFS name normalization as specified in section 3.3.5.9. Otherwise, the file name is relative to the share that is identified by the TreeId in the SMB2 header."

    What if client sent a request with SMB2_FLAGS_DFS_OPERATIONS set in the Flags field and file name DOES NOT include a prefix (ie a path name relative to share) ? How does server process such a request ?. I could not find an answer in the spec.

    Thanks

    Jimmy

    Friday, May 5, 2017 3:58 AM
  • Hi Jimmy,

    The server expects the prefix to always be present if SMB2_FLAGS_DFS_OPERATIONS is set on the Tree Connect. If the prefix is missing, the DFS server will remove the first 2 elements of the path, assuming these are the prefix.

    • If this results in a null string (as it would for "MyDir\file1"), the server returns STATUS_INVALID_PARAMETER
    • If the string is too short, the server returns STATUS_FILE_IS_A_DIRECTORY
    • If the DFS Namespace is offline (ie: it can't find a DFS server\share matching the prefix), the server returns STATUS_DFS_UNAVAILABLE.
    • If it doesn't find the prefix-removed path on the server\share of the Tree Connect, the server returns STATUS_PATH_NOT_COVERED, assuming that the path includes a DFS link.

    If the Tree Connect is for \\server1\share, and the path is server2\share\folder\file.txt, then we'll attempt to open folder\file.txt on \\server1\share, if the server2\share namespace is online.

    Note that the only use the server makes of the prefix is to make sure the DFS namespace is online. 

    I hope that helps! Please let us know if you have further questions. 

    Thanks,


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Friday, May 5, 2017 6:56 PM
    Moderator
  • Hi Jeff,

    Thanks for your response. It would have been better if it was documented.

    Thanks

    Jimmy

    Thursday, May 11, 2017 5:17 AM
  • Hi Jimmy,

    Thank you for your response. I double-checked our documentation to make sure. It seems fairly well documented that if SMB2_FLAGS_DFS_OPERATIONS is set, the filename always has a prefix:

    [MS-SMB2]
    2.2.13 SMB2 CREATE Request
    NameOffset (2 bytes): [...]"If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of the SMB2 header, the file name includes a prefix..."

    A client will not request a DFS open with a pathname like "MyDir\file1" according to this section where it mentions "as a DFS pathname for a DFS share":

    [MS-SMB2]
    3.2.4.3 Application Requests Opening a File
    To open a file on a remote share, the application provides the following:
    § The path name of the file being opened, as a DFS pathname for a DFS share, or relative to the TreeConnect for a non-DFS share.

    "\MyDomain\MyDfs\MyDir\file1" is an example of a DFS pathname:

    [MS-DFSC]
    3.2.4.1 Handling a Path Normalization Request
    Otherwise, the DFS server MUST change the path name to a path relative to the root of the namespace and return STATUS_SUCCESS. For example, if the path name is "\MyDomain\MyDfs\MyDir\file1", then the DFS server MUST change the path name to "MyDir\file1".

    I hope that helps!


    Jeff McCashland | Microsoft Protocols Open Specifications Team


    Thursday, May 18, 2017 11:20 PM
    Moderator