headers
Christopher R. Hertel | 1 Aug 2004 04:06

NTCreateAndX Response with wrong WordCount.

Is it common to see an NTCreateAndX Response with an incorrect WordCount?

I'm seeing a WordCount of 42 (that's 84 bytes).  The SNIA doc says it 
should be 26 (unless EAs or SDs are included...but I'm not seeing those).

The data beyond the normal 52 byte mark *looks* like garbage--some of it
left over from the request message.

So, just wondering...

Chris -)-----

--

-- 
"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team -- http://www.samba.org/     -)-----   Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/   -)-----   ubiqx development, uninq.
ubiqx Team -- http://www.ubiqx.org/     -)-----   crh <at> ubiqx.mn.org
OnLineBook -- http://ubiqx.org/cifs/    -)-----   crh <at> ubiqx.org
Permalink | Reply | 13 comments |
headers
Michael B Allen | 1 Aug 2004 05:45

Re: NTCreateAndX Response with wrong WordCount.

On Sat, 31 Jul 2004 21:06:10 -0500
"Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:

> Is it common to see an NTCreateAndX Response with an incorrect WordCount?
> 
> I'm seeing a WordCount of 42 (that's 84 bytes).  The SNIA doc says it 
> should be 26 (unless EAs or SDs are included...but I'm not seeing those).
> 
> The data beyond the normal 52 byte mark *looks* like garbage--some of it
> left over from the request message.
> 
> So, just wondering...

Yeah, that is odd. I never really took notice before. Maybe because I
depend so much on Ethereal which doesn't decode it. I see W2K and XP
have a WordCount of 42 whereas NT is 34. Indeed that extra 16 bytes is
the beginning of the filename in Unicode from the 6th index to the end. I
suppose that could be from the request. The offset's are even very close
(only off by 2 bytes). That means they reuse the same buffer.

Mike

--

-- 
Greedo shoots first? Not in my Star Wars.
Permalink | Reply | 12 comments |
headers
Christopher R. Hertel | 1 Aug 2004 07:05

Re: NTCreateAndX Response with wrong WordCount.

On Sat, Jul 31, 2004 at 11:45:46PM -0400, Michael B Allen wrote:
> On Sat, 31 Jul 2004 21:06:10 -0500
> "Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:
> 
> > Is it common to see an NTCreateAndX Response with an incorrect WordCount?
> > 
> > I'm seeing a WordCount of 42 (that's 84 bytes).  The SNIA doc says it 
> > should be 26 (unless EAs or SDs are included...but I'm not seeing those).
> > 
> > The data beyond the normal 52 byte mark *looks* like garbage--some of it
> > left over from the request message.
> > 
> > So, just wondering...
> 
> Yeah, that is odd. I never really took notice before. Maybe because I
> depend so much on Ethereal which doesn't decode it.

Ethereal seems to be using the format given in the SNIA doc, and in the 
capture I'm looking at, the decode looks correct.

> I see W2K and XP have a WordCount of 42 whereas NT is 34.

Okay, that's weird.

26 + 8 = 34
34 + 8 = 42

...and 26 is the "correct" number of bytes (per the SNIA doc).

Is this with EA's or Security Descriptors?  The supposed-correct value of
(Continue reading)

Permalink | Reply | 11 comments |
headers
Michael B Allen | 1 Aug 2004 08:10

Re: NTCreateAndX Response with wrong WordCount.

On Sun, 1 Aug 2004 00:05:10 -0500
"Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:
> > I see W2K and XP have a WordCount of 42 whereas NT is 34.
> 
> Okay, that's weird.
> 
> 26 + 8 = 34
> 34 + 8 = 42
> 
> ...and 26 is the "correct" number of bytes (per the SNIA doc).

The docs (SNIA and Leach v2) are incorrect. If you simply add up the sizes
of fields in the packet description it's 34 bytes. That 26 is just wrong.

As you pointed out above I think it's interesting that (34 - 26) * 2 is
16 which is how big that garbage trailer is in W2K and XP NT_CREATE_ANDX
responses. It's as if the MS developers were reviewing the code for the
next generation CIFS implementation and said "Ahh, according to the docs
this packet is 16 bytes too small, let's make it bigger!"

Mike

--

-- 
Greedo shoots first? Not in my Star Wars.
Permalink | Reply | 10 comments |
headers
Christopher R. Hertel | 1 Aug 2004 09:58

Re: NTCreateAndX Response with wrong WordCount.

On Sun, Aug 01, 2004 at 02:10:00AM -0400, Michael B Allen wrote:
> On Sun, 1 Aug 2004 00:05:10 -0500
> "Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:
> > > I see W2K and XP have a WordCount of 42 whereas NT is 34.
> > 
> > Okay, that's weird.
> > 
> > 26 + 8 = 34
> > 34 + 8 = 42
> > 
> > ...and 26 is the "correct" number of bytes (per the SNIA doc).
> 
> The docs (SNIA and Leach v2) are incorrect. If you simply add up the sizes
> of fields in the packet description it's 34 bytes. That 26 is just wrong.

Good point.

Yeah, I just grabbed a capture against NT4 and it does have 34 bytes, and 
it adds up properly, and the ByteCount is zero, and there's no garbage 
after it.

So you're right, and NT is right, and the SNIA doc is wrong, and W2K is 
way wrong.

> As you pointed out above I think it's interesting that (34 - 26) * 2 is
> 16 which is how big that garbage trailer is in W2K and XP NT_CREATE_ANDX
> responses.

Actually, there's 32 bytes worth of garbage in the captures I've got.  
That is, following the ByteCount field (which is correctly zero) I always
(Continue reading)

Permalink | Reply | 3 comments |
headers
Michael B Allen | 1 Aug 2004 10:25

Re: NTCreateAndX Response with wrong WordCount.

On Sun, 1 Aug 2004 02:58:08 -0500
"Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:
> > The docs (SNIA and Leach v2) are incorrect. If you simply add up the
> > sizes of fields in the packet description it's 34 [words]. That 26 is
> > just wrong.
> 
> Good point.
> 
> Yeah, I just grabbed a capture against NT4 and it does have 34 bytes, and 

Actually it's 34 words / 68 bytes.

> > As you pointed out above I think it's interesting that (34 - 26) * 2 is
> > 16 which is how big that garbage trailer is in W2K and XP NT_CREATE_ANDX
> > responses.
> 
> Actually, there's 32 bytes worth of garbage in the captures I've got.  
> That is, following the ByteCount field (which is correctly zero) I always 
> see 32 bytes of semi-random stuff that shouldn't be there.

16 bytes.

> So... It's wrong by 16 words.

Still multiplying by 2. It's really 8 words / 16 bytes.

> > It's as if the MS developers were reviewing the code for the
> > next generation CIFS implementation and said "Ahh, according to the docs
> > this packet is 16 bytes too small, let's make it bigger!"
>
(Continue reading)

Permalink | Reply | 1 comment |
headers
Christopher R. Hertel | 1 Aug 2004 11:15

Re: NTCreateAndX Response with wrong WordCount.

On Sun, Aug 01, 2004 at 04:25:06AM -0400, Michael B Allen wrote:
> On Sun, 1 Aug 2004 02:58:08 -0500
> "Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:
> > > The docs (SNIA and Leach v2) are incorrect. If you simply add up the
> > > sizes of fields in the packet description it's 34 [words]. That 26 is
> > > just wrong.
> > 
> > Good point.
> > 
> > Yeah, I just grabbed a capture against NT4 and it does have 34 bytes, and 
> 
> Actually it's 34 words / 68 bytes.

Yes.  That's a typo on my part.  s/bytes/words

> > > As you pointed out above I think it's interesting that (34 - 26) * 2 is
> > > 16 which is how big that garbage trailer is in W2K and XP NT_CREATE_ANDX
> > > responses.
> > 
> > Actually, there's 32 bytes worth of garbage in the captures I've got.  
> > That is, following the ByteCount field (which is correctly zero) I always 
> > see 32 bytes of semi-random stuff that shouldn't be there.
> 
> 16 bytes.
> 
> > So... It's wrong by 16 words.
> 
> Still multiplying by 2. It's really 8 words / 16 bytes.

No, I'm counting it up.  In my captures I am seeing 32 bytes of extra
(Continue reading)

Permalink | Reply | 0 comments |
headers
Neil Bortnak | 1 Aug 2004 15:59
Picon
Favicon

Re: [PATCH] smbcacls revision fix

Thanks Jeremy,

Worst comes to worst I'll recode it to use a command line argument.

Neil

Jeremy Allison wrote:
> On Thu, Jul 29, 2004 at 01:30:06PM +0900, Neil Bortnak wrote:
> 
>>Hi everyone,
>>
>>I started using smbcacls and it worked great for everything except the 
>>set (-S) feature.
>>
>>After some time spent with the code and a packet sniffer I found that 
>>all of the other functions read in the existing dacl, modify it and 
>>write it back. The set function creates a new one.
>>
>>The revision number on the dacl that gets read from the server is 2, 
>>while the version number in set's created dacl is 3. I changed the 
>>created dacl to 2 and it works perfectly now.
>>
>>It may or may not be relevant, but I am using and testing this against a 
>>NetApp Filer, and not a standard NT/2000 system. I also popped in a few 
>>extra snippets of code.
> 
> 
> Ok, I'll test this against a NT/2000 system as well. That's (unfortunately)
> the standard by which all other implementations are judged.
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Jeremy Allison | 1 Aug 2004 18:57
Picon
Favicon

Re: NTCreateAndX Response with wrong WordCount.

On Sun, Aug 01, 2004 at 02:10:00AM -0400, Michael B Allen wrote:
> On Sun, 1 Aug 2004 00:05:10 -0500
> "Christopher R. Hertel" <crh <at> ubiqx.mn.org> wrote:
> > > I see W2K and XP have a WordCount of 42 whereas NT is 34.
> > 
> > Okay, that's weird.
> > 
> > 26 + 8 = 34
> > 34 + 8 = 42
> > 
> > ...and 26 is the "correct" number of bytes (per the SNIA doc).
> 
> The docs (SNIA and Leach v2) are incorrect. If you simply add up the sizes
> of fields in the packet description it's 34 bytes. That 26 is just wrong.
> 
> As you pointed out above I think it's interesting that (34 - 26) * 2 is
> 16 which is how big that garbage trailer is in W2K and XP NT_CREATE_ANDX
> responses. It's as if the MS developers were reviewing the code for the
> next generation CIFS implementation and said "Ahh, according to the docs
> this packet is 16 bytes too small, let's make it bigger!"

No, actually the extra 16 bytes are the permissions given when
a client side cached file is stored on the client (among other
things). There's a couple of old messages in my inbox from Steve
French and Shirish at Veritas describing them, but I never got
around to fixing up the implementation.

Jeremy.
(Continue reading)

Permalink | Reply | 5 comments |
headers
Jeremy Allison | 1 Aug 2004 18:58
Picon
Favicon

Re: NTCreateAndX Response with wrong WordCount.

On Sun, Aug 01, 2004 at 02:58:08AM -0500, Christopher R. Hertel wrote:
> 
> So you're right, and NT is right, and the SNIA doc is wrong, and W2K is 
> way wrong.

The SNIA doc is wrong, but W2K/W2K3 just implement CSC, which the SNIA
dos doesn't describe.

Jeremy.
Permalink | Reply | 0 comments |

Gmane