[MS-SMB] Unexpected behavior when sending TRANS2_QUERY_FILE_INFORMATION with InformationLevel set to 0x03FA (FileAllInformation)

Question

Hi,

I encountered an unexpected behavior of Windows Server 2003 SP2 and Windows 7 SP1 functioning as servers when testing my SMB1 client implementation:

1. CAP_INFOLEVEL_PASSTHRU is set by the server.

2. I'm using TRANS2_QUERY_FILE_INFORMATION request to query file information.

3. I'm setting InformationLevel to [MS-FSCC] 2.4 FileAllInformation (The value of which is SMB_INFO_PASSTHROUGH + 18 = 0x03FA)

4. In the response I'm expecting to find [MS-FSCC] 2.4.2 - FileAllInformation but instead I'm getting [MS-CIFS] SMB_QUERY_FILE_ALL_INFO

I'm sending a packet capture to dochelp (at) microsoft.com

It seems to me that this behavior deviates from my understanding of the specifications.

Note: The following post by Sebastian Canevari [MSFT] from 2008 shed some light on the issue but the information never made it to the specifications.

Tal

Answer 1

Hi Tal,

Thanks for raising this issue with MS-SMB and sending us the network trace. I have created a service request to track this issue for you, and a member of the Open Specifications team will be getting in touch with you with respect to this issue, 

Sincerely,
Will Gregg | open specifications team

Answer 2

Hello Tal, We've got the network trace from you. I am currently researching the problem and will provide you with an update soon. Thank you for your patience.

Regards,
Sreekanth Nadendla
Microsoft Windows Open specifications

Answer 3

ISSUE RESOLVED BY LAST UPDATE PROVIDED ON 10/6/2017

We have worked with Tal Aloni offline via email to resolve this issue.

Below are the details of formal updates to [MS-SMB]

<New behavior note 130> Section 3.3.5.10.1:  If CAP_INFOLEVEL_PASSTHRU capability is set in Server.Capabilities, and client requested “FileAllInformation” pass-through Information Level, Windows-based servers respond with the structure specified in [MS-CIFS] section 2.2.8.3.10.

<Updated behavior note 18> Section 2.2.2.3.5: On Windows-based servers, pass-through Information level “FileAllInformation” is mapped to SMB_QUERY_FILE_ALL_INFO, as specified in [MS-CIFS] section 2.2.8.3.10. All other pass-through Information Levels map directly to native Windows NT operating system Information Classes, as specified in [MS-FSCC] sections 2.4 and 2.5. Windows- based servers do not support setting the following NT Information Levels via the pass-through Information Level mechanism.

Regards,
Sreekanth Nadendla
Microsoft Windows Open specifications