RE: [PATCH] CIFS: handle guest access errors to Windows shares

Aurélien Aptel <aaptel@xxxxxxxx> · Wed, 30 Nov 2016 18:32:07 +0100

Hi Mark,

New setup

  PS> net user guest /activate:no
  PS> mkdir C:\guestshare
  PS> icacls C:\guestshare /grant 'Everyone:(OI)(CI)F'
  PS> new-smbshare -name guestshare -path C:\guestshare -fullaccess Everyone

I've tested v3.10, v4.4, master, master+your patch using default options
(empty or no user "NU") and user=abc (U).

NT_LOGON_FAILURE in session setup: LF
This is what you seem to have in 3.10.

NT_ACCESS_DENIED in tree connect to the share: AD
This is what you get before your infinite loop.

             |   NU       U
-------------------------------- 
3.10         |   LF       LF
4.4          |   LF       LF
master       |   AD       LF
master+patch |   AD       LF

No infinite DFS loop :(
All these issues result in mount failing very fast with permission denied.

I guess it could be from either the Windows version or the share/folder
ACL. A deeper analysis of the packets might reveal more.

In any case I did not notice any issues for on a basic DFS setup with
the patch so I don't think it introduced any regressions, which is
probably all that matters. It still bothers me a little I couldn't hit
the bug.

I've included kernel output w/ debugging output and network capture of
my tests if anyone want to have a look at it. (master+patch = ml-guestfix).

Reviewed-by: Aurelien Aptel <aaptel@xxxxxxxx>
Tested-by: Aurelien Aptel <aaptel@xxxxxxxx>

!! BOOT SCRIPT !!
-------------------

++ echo 10.160.65.202 WS2016
++ modprobe e1000
++ modprobe cifs
++ mount -t debugfs none /sys/kernel/debug
++ echo 'create      cifs.spnego    * * /usr/sbin/cifs.upcall %k'
++ echo 'create      dns_resolver   * * /usr/sbin/cifs.upcall %k'
++ echo 'module cifs +p'
++ echo 'file fs/cifs/* +p'
++ echo 1
++ echo 8
++ echo 1
++ mkdir -p /mnt
++ echo 'echo 1 > /proc/sys/kernel/sysrq && echo o > /proc/sysrq-trigger'
++ chmod a+x /bin/sd
++ mount -t cifs -vvv //WS2016/guestshare /mnt -o ip=10.160.65.202,guest,rw
ip address 10.160.65.202 override specified
mount.cifs kernel mount options: ip=10.160.65.202,unc=\\WS2016\guestshare,user=,pass=********
fs/cifs/cifsfs.c: Devname: //WS2016/guestshare flags: 0
address conversion returned 1 for 10.160.65.202
fs/cifs/connect.c: Anonymous login
fs/cifs/connect.c: file mode: 0x1ed  dir mode: 0x1ed
fs/cifs/connect.c: CIFS VFS: in cifs_mount as Xid: 0 with uid: 0
fs/cifs/connect.c: UNC: \\WS2016\guestshare
fs/cifs/connect.c: Socket created
fs/cifs/connect.c: sndbuf 16384 rcvbuf 87380 rcvtimeo 0x6d6
fs/cifs/connect.c: CIFS VFS: in cifs_get_smb_ses as Xid: 1 with uid: 0
fs/cifs/connect.c: Existing smb sess not found
fs/cifs/cifssmb.c: secFlags 0x81
fs/cifs/cifssmb.c: NTLMSSP only mechanism, enable extended security
fs/cifs/transport.c: For smb_command 114
fs/cifs/transport.c: Sending smb: smb_len=69
fs/cifs/connect.c: Demultiplex PID: 148
fs/cifs/connect.c: RFC1002 header 0xcd
fs/cifs/misc.c: checkSMB Length: 0xd1, smb_buf_length: 0xcd
fs/cifs/transport.c: cifs_sync_mid_result: cmd=114 mid=1 state=4
fs/cifs/cifssmb.c: Dialect: 2
Max buf = 16644
fs/cifs/asn1.c: OID len = 10 oid = 0x1 0x3 0x6 0x1
fs/cifs/asn1.c: OID len = 7 oid = 0x1 0x2 0x348 0xbb92
fs/cifs/asn1.c: OID len = 7 oid = 0x1 0x2 0x348 0x1bb92
fs/cifs/asn1.c: OID len = 8 oid = 0x1 0x2 0x348 0x1bb92
fs/cifs/asn1.c: OID len = 10 oid = 0x1 0x3 0x6 0x1
fs/cifs/cifssmb.c: negprot rc 0
fs/cifs/connect.c: Security Mode: 0xf Capabilities: 0x8001f3fc TimeAdjust: 28800
fs/cifs/sess.c: sess setup type 3
fs/cifs/sess.c: ntlmssp session setup phase 1
fs/cifs/transport.c: For smb_command 115
fs/cifs/transport.c: Sending smb: smb_len=186
fs/cifs/connect.c: RFC1002 header 0x163
fs/cifs/misc.c: checkSMB Length: 0x167, smb_buf_length: 0x163
fs/cifs/transport.c: cifs_sync_mid_result: cmd=115 mid=2 state=4
fs/cifs/netmisc.c: Mapping smb error code 0xc0000016 to POSIX err -5
fs/cifs/misc.c: Null buffer passed to cifs_small_buf_release
fs/cifs/sess.c: UID = 8192
fs/cifs/sess.c: bleft 135
fs/cifs/sess.c: serverOS=Windows Server 2016 Standard 14393
fs/cifs/sess.c: serverNOS=Windows Server 2016 Standard 6.3
fs/cifs/sess.c: ssetup freeing small buf ffff880004548540
fs/cifs/sess.c: ntlmssp session setup phase 3
fs/cifs/transport.c: For smb_command 115
fs/cifs/transport.c: Sending smb: smb_len=402
fs/cifs/connect.c: RFC1002 header 0x23
fs/cifs/misc.c: checkSMB Length: 0x27, smb_buf_length: 0x23
fs/cifs/transport.c: cifs_sync_mid_result: cmd=115 mid=3 state=4
Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
fs/cifs/netmisc.c: Mapping smb error code 0xc000006d to POSIX err -13
fs/cifs/misc.c: Null buffer passed to cifs_small_buf_release
fs/cifs/sess.c: ssetup freeing small buf ffff8800045488c0
CIFS VFS: Send error in SessSetup = -13
fs/cifs/connect.c: CIFS VFS: leaving cifs_get_smb_ses (xid = 1) rc = -13
fs/cifs/connect.c: CIFS VFS: leaving cifs_mount (xid = 0) rc = -13
CIFS VFS: cifs_mount failed w/return code = -13
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
++ sleep 2
++ sd
SysRq : Power Off
++ set +x

Generating "/run/initramfs/rdsosreport.txt"
You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot
after mounting them and attach it to a bug report.