Answered by:
[MS-SMB] Unexpected behavior when sending TRANS2_QUERY_FILE_INFORMATION with InformationLevel set to 0x03FA (FileAllInformation)

Question
-
Hi,
I encountered an unexpected behavior of Windows Server 2003 SP2 and Windows 7 SP1 functioning as servers when testing my SMB1 client implementation:
1. CAP_INFOLEVEL_PASSTHRU is set by the server.
2. I'm using TRANS2_QUERY_FILE_INFORMATION request to query file information.
3. I'm setting InformationLevel to [MS-FSCC] 2.4 FileAllInformation (The value of which is SMB_INFO_PASSTHROUGH + 18 = 0x03FA)
4. In the response I'm expecting to find [MS-FSCC] 2.4.2 - FileAllInformation but instead I'm getting [MS-CIFS] SMB_QUERY_FILE_ALL_INFO
I'm sending a packet capture to dochelp (at) microsoft.com
It seems to me that this behavior deviates from my understanding of the specifications.
Note: The following post by Sebastian Canevari [MSFT] from 2008 shed some light on the issue but the information never made it to the specifications.
Tal
- Edited by Tal Aloni Sunday, October 1, 2017 11:00 AM
Sunday, October 1, 2017 9:39 AM
Answers
-
ISSUE RESOLVED BY LAST UPDATE PROVIDED ON 10/6/2017
We have worked with Tal Aloni offline via email to resolve this issue.
Below are the details of formal updates to [MS-SMB]
<New behavior note 130> Section 3.3.5.10.1: If CAP_INFOLEVEL_PASSTHRU capability is set in Server.Capabilities, and client requested “FileAllInformation” pass-through Information Level, Windows-based servers respond with the structure specified in [MS-CIFS] section 2.2.8.3.10.
<Updated behavior note 18> Section 2.2.2.3.5: On Windows-based servers, pass-through Information level “FileAllInformation” is mapped to SMB_QUERY_FILE_ALL_INFO, as specified in [MS-CIFS] section 2.2.8.3.10. All other pass-through Information Levels map directly to native Windows NT operating system Information Classes, as specified in [MS-FSCC] sections 2.4 and 2.5. Windows- based servers do not support setting the following NT Information Levels via the pass-through Information Level mechanism.
Regards,
Sreekanth Nadendla
Microsoft Windows Open specifications- Proposed as answer by S NadendlaMicrosoft employee Thursday, December 7, 2017 7:03 PM
- Marked as answer by Tal Aloni Thursday, December 7, 2017 9:44 PM
Thursday, December 7, 2017 7:03 PM
All replies
-
Hi Tal,
Thanks for raising this issue with MS-SMB and sending us the network trace. I have created a service request to track this issue for you, and a member of the Open Specifications team will be getting in touch with you with respect to this issue,Sincerely,
Will Gregg | open specifications teamSunday, October 1, 2017 3:29 PM -
Hello Tal, We've got the network trace from you. I am currently researching the problem and will provide you with an update soon. Thank you for your patience.
Regards,
Sreekanth Nadendla
Microsoft Windows Open specificationsTuesday, October 3, 2017 2:20 PM -
ISSUE RESOLVED BY LAST UPDATE PROVIDED ON 10/6/2017
We have worked with Tal Aloni offline via email to resolve this issue.
Below are the details of formal updates to [MS-SMB]
<New behavior note 130> Section 3.3.5.10.1: If CAP_INFOLEVEL_PASSTHRU capability is set in Server.Capabilities, and client requested “FileAllInformation” pass-through Information Level, Windows-based servers respond with the structure specified in [MS-CIFS] section 2.2.8.3.10.
<Updated behavior note 18> Section 2.2.2.3.5: On Windows-based servers, pass-through Information level “FileAllInformation” is mapped to SMB_QUERY_FILE_ALL_INFO, as specified in [MS-CIFS] section 2.2.8.3.10. All other pass-through Information Levels map directly to native Windows NT operating system Information Classes, as specified in [MS-FSCC] sections 2.4 and 2.5. Windows- based servers do not support setting the following NT Information Levels via the pass-through Information Level mechanism.
Regards,
Sreekanth Nadendla
Microsoft Windows Open specifications- Proposed as answer by S NadendlaMicrosoft employee Thursday, December 7, 2017 7:03 PM
- Marked as answer by Tal Aloni Thursday, December 7, 2017 9:44 PM
Thursday, December 7, 2017 7:03 PM