none
[MS-SMB] Unexpected behavior when sending TRANS2_QUERY_FILE_INFORMATION with InformationLevel set to 0x03FA (FileAllInformation) RRS feed

  • Question

  • Hi,

    I encountered an unexpected behavior of Windows Server 2003 SP2 and Windows 7 SP1 functioning as servers when testing my SMB1 client implementation:

    1. CAP_INFOLEVEL_PASSTHRU is set by the server.

    2. I'm using TRANS2_QUERY_FILE_INFORMATION request to query file information.

    3. I'm setting InformationLevel to [MS-FSCC] 2.4 FileAllInformation (The value of which is SMB_INFO_PASSTHROUGH + 18 = 0x03FA)

    4. In the response I'm expecting to find [MS-FSCC] 2.4.2 - FileAllInformation but instead I'm getting [MS-CIFS] SMB_QUERY_FILE_ALL_INFO

    I'm sending a packet capture to dochelp (at) microsoft.com

    It seems to me that this behavior deviates from my understanding of the specifications.

    Note: The following post by Sebastian Canevari [MSFT] from 2008 shed some light on the issue but the information never made it to the specifications.

    Tal


    • Edited by Tal Aloni Sunday, October 1, 2017 11:00 AM
    Sunday, October 1, 2017 9:39 AM

Answers

  • ISSUE RESOLVED BY LAST UPDATE PROVIDED ON 10/6/2017

    We have worked with Tal Aloni offline via email to resolve this issue.

    Below are the details of formal updates to [MS-SMB]

    <New behavior note 130> Section 3.3.5.10.1:  If CAP_INFOLEVEL_PASSTHRU capability is set in Server.Capabilities, and client requested “FileAllInformation” pass-through Information Level, Windows-based servers respond with the structure specified in [MS-CIFS] section 2.2.8.3.10.

    <Updated behavior note 18> Section 2.2.2.3.5: On Windows-based servers, pass-through Information level “FileAllInformation” is mapped to SMB_QUERY_FILE_ALL_INFO, as specified in [MS-CIFS] section 2.2.8.3.10. All other pass-through Information Levels map directly to native Windows NT operating system Information Classes, as specified in [MS-FSCC] sections 2.4 and 2.5. Windows- based servers do not support setting the following NT Information Levels via the pass-through Information Level mechanism.

    Regards,
    Sreekanth Nadendla
    Microsoft Windows Open specifications

    Thursday, December 7, 2017 7:03 PM
    Moderator

All replies

  • Hi Tal,

    Thanks for raising this issue with MS-SMB and sending us the network trace. I have created a service request to track this issue for you, and a member of the Open Specifications team will be getting in touch with you with respect to this issue, 

    Sincerely,
    Will Gregg | open specifications team

    Sunday, October 1, 2017 3:29 PM
    Moderator
  • Hello Tal, We've got the network trace from you. I am currently researching the problem and will provide you with an update soon. Thank you for your patience.

    Regards,
    Sreekanth Nadendla
    Microsoft Windows Open specifications
    Tuesday, October 3, 2017 2:20 PM
    Moderator
  • ISSUE RESOLVED BY LAST UPDATE PROVIDED ON 10/6/2017

    We have worked with Tal Aloni offline via email to resolve this issue.

    Below are the details of formal updates to [MS-SMB]

    <New behavior note 130> Section 3.3.5.10.1:  If CAP_INFOLEVEL_PASSTHRU capability is set in Server.Capabilities, and client requested “FileAllInformation” pass-through Information Level, Windows-based servers respond with the structure specified in [MS-CIFS] section 2.2.8.3.10.

    <Updated behavior note 18> Section 2.2.2.3.5: On Windows-based servers, pass-through Information level “FileAllInformation” is mapped to SMB_QUERY_FILE_ALL_INFO, as specified in [MS-CIFS] section 2.2.8.3.10. All other pass-through Information Levels map directly to native Windows NT operating system Information Classes, as specified in [MS-FSCC] sections 2.4 and 2.5. Windows- based servers do not support setting the following NT Information Levels via the pass-through Information Level mechanism.

    Regards,
    Sreekanth Nadendla
    Microsoft Windows Open specifications

    Thursday, December 7, 2017 7:03 PM
    Moderator