cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Robin Blanchard]

environment:

# cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)

# uname -r
3.10.0-514.16.1.el7.x86_64

# modinfo cifs
filename:       /lib/modules/3.10.0-514.16.1.el7.x86_64/kernel/fs/cifs/cifs.ko
version:        2.08
description:    VFS to access servers complying with the SNIA CIFS
Specification e.g. Samba and Windows
license:        GPL
author:         Steve French <sfrench-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
alias:          fs-cifs
rhelversion:    7.3
srcversion:     119ACC0FE17824C08D648CE
depends:        dns_resolver
intree:         Y
vermagic:       3.10.0-514.16.1.el7.x86_64 SMP mod_unload modversions
signer:         CentOS Linux kernel signing key
sig_key:        3F:E1:EB:8B:4F:91:D4:84:CD:55:44:84:54:A0:24:DE:56:34:E1:06
sig_hashalgo:   sha256
parm:           CIFSMaxBufSize:Network buffer size (not including
header). Default: 16384 Range: 8192 to 130048 (uint)
parm:           cifs_min_rcv:Network buffers in pool. Default: 4
Range: 1 to 64 (uint)
parm:           cifs_min_small:Small network buffers in pool. Default:
30 Range: 2 to 256 (uint)
parm:           cifs_max_pending:Simultaneous requests to server.
Default: 32767 Range: 2 to 32767. (uint)
parm:           enable_oplocks:Enable or disable oplocks. Default: y/Y/1 (bool)



issue:

01) smb vers=1.0 + DFS works as expected:

# mount -v -t cifs //my.domain/dfs/path /mnt -o
"ro,vers=1.0,domain=my.domain,username=silly_user"
# echo $?
0


02) smb vers=3.0 + DFS fails with:

# echo 7 > /proc/fs/cifs/cifsFYI ; mount -v -t cifs
//my.domain/dfs/path /mnt -o
"ro,vers=3.0,domain=my.domain,username=silly_user"; sleep 5 ; echo 0 >
/proc/fs/cifs/cifsFYI ; dmesg |tail -3

mount error(38): Function not implemented
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
[273116.707979] Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
[273116.712186] Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
[273116.713723] CIFS VFS: cifs_mount failed w/return code = -38


03) smb vers=3.0 w/o CFS works as expected

# mount -v -t cifs //real.win2k12.server/non-dfs/path /mnt -o
"ro,vers=3.0,domain=my.domain,username=silly_user
# echo $?
0



Is there another incantation of mount -t cifs to get smbv3 + DFS
working? Or is this a known issue (and if so, is there a work-around)
?

Thanks in advance!

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Steve French]

Fixes to add SMB2/SMB3 support for DFS were added fairly recently
(about two months ago) by Aurelien, so will be in new kernels.

Hopefully RedHat and other will backport these as they are quite useful.

On Thu, Apr 20, 2017 at 3:09 PM, Robin Blanchard
<robin.blanchard-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> environment:
>
> # cat /etc/redhat-release
> CentOS Linux release 7.3.1611 (Core)
>
> # uname -r
> 3.10.0-514.16.1.el7.x86_64
>
> # modinfo cifs
> filename:       /lib/modules/3.10.0-514.16.1.el7.x86_64/kernel/fs/cifs/cifs.ko
> version:        2.08
> description:    VFS to access servers complying with the SNIA CIFS
> Specification e.g. Samba and Windows
> license:        GPL
> author:         Steve French <sfrench-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
> alias:          fs-cifs
> rhelversion:    7.3
> srcversion:     119ACC0FE17824C08D648CE
> depends:        dns_resolver
> intree:         Y
> vermagic:       3.10.0-514.16.1.el7.x86_64 SMP mod_unload modversions
> signer:         CentOS Linux kernel signing key
> sig_key:        3F:E1:EB:8B:4F:91:D4:84:CD:55:44:84:54:A0:24:DE:56:34:E1:06
> sig_hashalgo:   sha256
> parm:           CIFSMaxBufSize:Network buffer size (not including
> header). Default: 16384 Range: 8192 to 130048 (uint)
> parm:           cifs_min_rcv:Network buffers in pool. Default: 4
> Range: 1 to 64 (uint)
> parm:           cifs_min_small:Small network buffers in pool. Default:
> 30 Range: 2 to 256 (uint)
> parm:           cifs_max_pending:Simultaneous requests to server.
> Default: 32767 Range: 2 to 32767. (uint)
> parm:           enable_oplocks:Enable or disable oplocks. Default: y/Y/1 (bool)
>
>
>
> issue:
>
> 01) smb vers=1.0 + DFS works as expected:
>
> # mount -v -t cifs //my.domain/dfs/path /mnt -o
> "ro,vers=1.0,domain=my.domain,username=silly_user"
> # echo $?
> 0
>
>
> 02) smb vers=3.0 + DFS fails with:
>
> # echo 7 > /proc/fs/cifs/cifsFYI ; mount -v -t cifs
> //my.domain/dfs/path /mnt -o
> "ro,vers=3.0,domain=my.domain,username=silly_user"; sleep 5 ; echo 0 >
> /proc/fs/cifs/cifsFYI ; dmesg |tail -3
>
> mount error(38): Function not implemented
> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
> [273116.707979] Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
> [273116.712186] Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
> [273116.713723] CIFS VFS: cifs_mount failed w/return code = -38
>
>
> 03) smb vers=3.0 w/o CFS works as expected
>
> # mount -v -t cifs //real.win2k12.server/non-dfs/path /mnt -o
> "ro,vers=3.0,domain=my.domain,username=silly_user
> # echo $?
> 0
>
>
>
> Is there another incantation of mount -t cifs to get smbv3 + DFS
> working? Or is this a known issue (and if so, is there a work-around)
> ?
>
> Thanks in advance!
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html



-- 
Thanks,

Steve

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Robin Blanchard]

Thanks, Steve.

Given WannaCry (and its derivatives), many shops are disabling SMBv1
entirely (not necessarily a bad idea). Any idea as to when the
aforementioned fixes might be pushed downstream? I've tested Ubuntu
17.04 with the same results (DFS fails with SMB > v1).

Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
CIFS VFS: cifs_mount failed w/return code = -38

# uname -r
4.10.0-22-generic

# modinfo cifs
filename:       /lib/modules/4.10.0-22-generic/kernel/fs/cifs/cifs.ko
softdep:        pre: ccm
softdep:        pre: aead2
softdep:        pre: sha256
softdep:        pre: cmac
softdep:        pre: aes
softdep:        pre: nls
softdep:        pre: md5
softdep:        pre: md4
softdep:        pre: hmac
softdep:        pre: ecb
softdep:        pre: des
softdep:        pre: arc4
version:        2.09
description:    VFS to access servers complying with the SNIA CIFS
Specification e.g. Samba and Windows
license:        GPL
author:         Steve French <sfrench-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
alias:          fs-cifs
srcversion:     2EEBCAE8D1598E85D808811
depends:        fscache
intree:         Y
vermagic:       4.10.0-22-generic SMP mod_unload
parm:           CIFSMaxBufSize:Network buffer size (not including
header). Default: 16384 Range: 8192 to 130048 (uint)
parm:           cifs_min_rcv:Network buffers in pool. Default: 4
Range: 1 to 64 (uint)
parm:           cifs_min_small:Small network buffers in pool. Default:
30 Range: 2 to 256 (uint)
parm:           cifs_max_pending:Simultaneous requests to server.
Default: 32767 Range: 2 to 32767. (uint)
parm:           enable_oplocks:Enable or disable oplocks. Default: y/Y/1 (bool)

On Thu, Apr 20, 2017 at 3:14 PM, Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> Fixes to add SMB2/SMB3 support for DFS were added fairly recently
> (about two months ago) by Aurelien, so will be in new kernels.
>
> Hopefully RedHat and other will backport these as they are quite useful.
>
> On Thu, Apr 20, 2017 at 3:09 PM, Robin Blanchard
> <robin.blanchard-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>> environment:
>>
>> # cat /etc/redhat-release
>> CentOS Linux release 7.3.1611 (Core)
>>
>> # uname -r
>> 3.10.0-514.16.1.el7.x86_64
>>
>> # modinfo cifs
>> filename:       /lib/modules/3.10.0-514.16.1.el7.x86_64/kernel/fs/cifs/cifs.ko
>> version:        2.08
>> description:    VFS to access servers complying with the SNIA CIFS
>> Specification e.g. Samba and Windows
>> license:        GPL
>> author:         Steve French <sfrench-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
>> alias:          fs-cifs
>> rhelversion:    7.3
>> srcversion:     119ACC0FE17824C08D648CE
>> depends:        dns_resolver
>> intree:         Y
>> vermagic:       3.10.0-514.16.1.el7.x86_64 SMP mod_unload modversions
>> signer:         CentOS Linux kernel signing key
>> sig_key:        3F:E1:EB:8B:4F:91:D4:84:CD:55:44:84:54:A0:24:DE:56:34:E1:06
>> sig_hashalgo:   sha256
>> parm:           CIFSMaxBufSize:Network buffer size (not including
>> header). Default: 16384 Range: 8192 to 130048 (uint)
>> parm:           cifs_min_rcv:Network buffers in pool. Default: 4
>> Range: 1 to 64 (uint)
>> parm:           cifs_min_small:Small network buffers in pool. Default:
>> 30 Range: 2 to 256 (uint)
>> parm:           cifs_max_pending:Simultaneous requests to server.
>> Default: 32767 Range: 2 to 32767. (uint)
>> parm:           enable_oplocks:Enable or disable oplocks. Default: y/Y/1 (bool)
>>
>>
>>
>> issue:
>>
>> 01) smb vers=1.0 + DFS works as expected:
>>
>> # mount -v -t cifs //my.domain/dfs/path /mnt -o
>> "ro,vers=1.0,domain=my.domain,username=silly_user"
>> # echo $?
>> 0
>>
>>
>> 02) smb vers=3.0 + DFS fails with:
>>
>> # echo 7 > /proc/fs/cifs/cifsFYI ; mount -v -t cifs
>> //my.domain/dfs/path /mnt -o
>> "ro,vers=3.0,domain=my.domain,username=silly_user"; sleep 5 ; echo 0 >
>> /proc/fs/cifs/cifsFYI ; dmesg |tail -3
>>
>> mount error(38): Function not implemented
>> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
>> [273116.707979] Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
>> [273116.712186] Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
>> [273116.713723] CIFS VFS: cifs_mount failed w/return code = -38
>>
>>
>> 03) smb vers=3.0 w/o CFS works as expected
>>
>> # mount -v -t cifs //real.win2k12.server/non-dfs/path /mnt -o
>> "ro,vers=3.0,domain=my.domain,username=silly_user
>> # echo $?
>> 0
>>
>>
>>
>> Is there another incantation of mount -t cifs to get smbv3 + DFS
>> working? Or is this a known issue (and if so, is there a work-around)
>> ?
>>
>> Thanks in advance!
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
>> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
>
> --
> Thanks,
>
> Steve

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Aurélien Aptel]

Hi Robin,

Robin Blanchard <robin.blanchard-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:

> Thanks, Steve.
>
> Given WannaCry (and its derivatives), many shops are disabling SMBv1
> entirely (not necessarily a bad idea). Any idea as to when the
> aforementioned fixes might be pushed downstream? I've tested Ubuntu
> 17.04 with the same results (DFS fails with SMB > v1).
>
> Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
> Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
> CIFS VFS: cifs_mount failed w/return code = -38
>
> # uname -r
> 4.10.0-22-generic

Unless canonical has backported my changes you need at least linux 4.11.

Cheers,

-- 
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Christian Garling]

Hello Aurelien,

I am running kernel 4.11.5 on an Ubuntu 16.04.2 system with cifs-utils 6.4 in a test environment, connecting to a DFS share on a Windows Server 2008 R2 with SMBv2 / 2.1.

Wireshark sniffing on the Ubuntu system shows the request for the referral, also the response with the correct hostname of the fileserver holding the share. After that nothing happens and cifs-utils throws "Invalid argument". I dont know what argument should be wrong. I also tried cifs-utils 6.7 from the git repo with no luck.

I try to get it working for two weeks now, so any help is welcome :-)

A connection to the DFS share from a windows client instead works well.

Thanks in advance.

Regards, Christian 



Von meinem iPhone gesendet

> Am 16.06.2017 um 11:06 schrieb Aurélien Aptel <aaptel-IBi9RG/b67k@public.gmane.org>:
> 
> Hi Robin,
> 
> Robin Blanchard <robin.blanchard-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:
> 
>> Thanks, Steve.
>> 
>> Given WannaCry (and its derivatives), many shops are disabling SMBv1
>> entirely (not necessarily a bad idea). Any idea as to when the
>> aforementioned fixes might be pushed downstream? I've tested Ubuntu
>> 17.04 with the same results (DFS fails with SMB > v1).
>> 
>> Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
>> Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
>> CIFS VFS: cifs_mount failed w/return code = -38
>> 
>> # uname -r
>> 4.10.0-22-generic
> 
> Unless canonical has backported my changes you need at least linux 4.11.
> 
> Cheers,
> 
> -- 
> Aurélien Aptel / SUSE Labs Samba Team
> GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
> SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
> GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Aurélien Aptel]

Christian Garling <christian.garling-JDaHaePr6SMW6PBduJaimg@public.gmane.org> writes:
> Wireshark sniffing on the Ubuntu system shows the request for the referral, also the response with the correct hostname of the fileserver holding the share. After that nothing happens and cifs-utils throws "Invalid argument". I dont know what argument should be wrong. I also tried cifs-utils 6.7 from the git repo with no luck.

I've just tested again kernel master against WS2016 with a link to a
WS2012 server and I can:

* mount to namespace and cd in the link
* mount the link
* mount a subdir under the link

and everything works properly with vers=2.0 vers=2.1 vers=3.0. With
vers=3.11 windows doesn't let me do the initial tree connect for some
reason.

mount -t cifs -vvv '//ws2016.suse.de/dfs3/link/sub' /mnt -o \
  'vers=3.0,domain=xyz,username=administrator,password=xyz'

Have you made sure your system can resolve both the main server hostname
and the target server (the hostname in the DFS query response)? Are you
using vers=xyz option when mounting?

-- 
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Aurélien Aptel]

I take it it doesn't work with your WS2016 either?

Could you open a new bug report on bugzilla.samba.org in the
cifsVFS/kernel fs section?

A network trace along with system log files with debugging enabled would
help a lot.

    echo 'module cifs +p' > /sys/kernel/debug/dynamic_debug/control
    echo 'file fs/cifs/* +p' > /sys/kernel/debug/dynamic_debug/control
    echo 1 > /proc/fs/cifs/cifsFYI
    echo 1 > /sys/module/dns_resolver/parameters/debug
     
    dmesg --clear
    tcpdump -w ws2016.pcap & pid=$!
    sleep 3
    mount.cifs ....
    sleep 3
    kill $pid
    dmesg > ws2016.log

this should generate a network capture in file ws2016.pcap and kernel
log messages in ws2016.log. Update the mount command with your
setup. Do it once against your WS2016 system, and once against your
WS2008 system.

-- 
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

Re: cifs.ko + smb 3.0 + DFS fails (though direct mount succeeds)

[Robin Blanchard]

Thanks, Aurélien.

I can confirm that DFS + smb 3.0 works as expected on Ubuntu 17.04 +
ppa:canonical-kernel-team/ppa

# uname -rsov
Linux 4.11.0-7-generic #12-Ubuntu SMP Mon Jun 19 17:35:19 UTC 2017 GNU/Linux


Hopefully these changes will be incorporated/backported into mainline
RedHat variants soon....

On Fri, Jun 16, 2017 at 4:06 AM, Aurélien Aptel <aaptel-IBi9RG/b67k@public.gmane.org> wrote:
> Hi Robin,
>
> Robin Blanchard <robin.blanchard-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:
>
>> Thanks, Steve.
>>
>> Given WannaCry (and its derivatives), many shops are disabling SMBv1
>> entirely (not necessarily a bad idea). Any idea as to when the
>> aforementioned fixes might be pushed downstream? I've tested Ubuntu
>> 17.04 with the same results (DFS fails with SMB > v1).
>>
>> Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
>> Status code returned 0xc0000257 STATUS_PATH_NOT_COVERED
>> CIFS VFS: cifs_mount failed w/return code = -38
>>
>> # uname -r
>> 4.10.0-22-generic
>
> Unless canonical has backported my changes you need at least linux 4.11.
>
> Cheers,
>
> --
> Aurélien Aptel / SUSE Labs Samba Team
> GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
> SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
> GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)