macOS client error

[cwbsw]

I use Arch linux with kernel 6.0.2 as server, and share a directory with read-only mode, I got these errors.

Oct 22 13:03:38 arch ksmbd[23898]: [ksmbd-worker/23898]: ERROR: LSARPC: unsupported INVOKE method 45, alloc_hint : 52
Oct 22 13:03:38 arch kernel: ksmbd: Unsupported RPC: mdssvc
Oct 22 13:03:38 arch kernel: ksmbd: Unable to open RPC pipe: -22
Oct 22 13:03:38 arch kernel: ksmbd: Unsupported RPC: MsFteWds
Oct 22 13:03:38 arch kernel: ksmbd: Unable to open RPC pipe: -22

And then macOS would hang up, sorry I don't know how to debug it.

[namjaejeon]

@mmakassikis I don't have Mac device. Do you have it and can reproduce this issue ?

[cwbsw]

@mmakassikis I don't have Mac device. Do you have it and can reproduce this issue ?

Yes, I can reproduce it on my M1 Mac mini. I only test the latest macOS version 13.0.1 and 12.1 , mount the share, do some exploration and read operation, then click unmount button in Finder, the system would be dead, I must long press power button to reboot. What other information can I provide?

[namjaejeon]

Ah.. Unfortunately I don't have a MacBook...

[sergey-senozhatsky]

@cwbsw I'd suggest to report it to Apple as you might have found a way to crash macos kernel.

[namjaejeon]

@cwbsw Can you give me tcpdump(or wireshark) on problem reproduction ?

[cwbsw]

@cwbsw Can you give me tcpdump(or wireshark) on problem reproduction ?

I reproduced this issue and capture the traffic, and also capture the traffic made by samba server with similar procedure, hope this to be helpful.
https://mega.nz/file/SEhQxTRT#CiROu_m3-YH3tNfCgqXMTRkW_2vRuBG45VSESf0zEO0

[TCB13]

Any update about this? ksmbd seems to be broken for macOS clients and it isn't only ARM. Under macOS Ventura (Intel machine) it always says the password is incorrect while a Windows client can connect to the same share with the same username/password without issues.

[namjaejeon]

namjaejeon#421

@TCB13 Other user can connect ksmbd server with the latest MacOS. Have you ever tried it with the latest ksmbd ?

[TCB13]

namjaejeon#421

@TCB13 Other user can connect ksmbd server with the latest MacOS. Have you ever tried it with the latest ksmbd ?

Well maybe you're right as my device is running ksmbd version 3.4.6. I'm sorry for bothering you.

[TCB13]

For future reference, here the SMB capture of two different macOS machines trying to connect to the same ksmbd server version 3.4.6. macOS Mojave is able to properly connect and macOS Ventura fails.

macOS-Mojave-10.14.6-SMB.zip
macOS-Ventura-SMB.zip

[namjaejeon]

@TCB13 Okay. But packets are encrypted, I can not check what error happen.
Can you turn smb3 encryption mode off like this and capture again for ventura version ?

[global]
smb3 encryption = disabled

[TCB13]

@namjaejeon here is the new capture.

macOS-Ventura-SMB-enc-off.zip

macOS stays stuck at this:

Window bounces like of the user/password was incorrect.

[namjaejeon]

@TCB13 Okay, I can not find any clue in packets. I want to compare the packets with samba. Could you please capture it against samba ?

[TCB13]

@namjaejeon ,

There you go, macOS Ventura + Samba 4.9.5-Debian with smb encrypt = off.

macOS-Ventura-SMB-enc-off-Samba4.zip

[joseruisa]

Well vacations already end... Any update on this matter?

[namjaejeon]

I can not find any clue on dump packets. I need to check it with Mac machine that has the latest OS. But I don't have Mac...

[namjaejeon]

I hope a developer who has a Mac machine look into this...

[namjaejeon]

@TCB13

I am discussing this issue with the Mac's smb3 client maintainer (Apple developer). He wants 'packet trace' information that can be dumped in the following order:
Can you do that ? You need to dump it with "smb3 encryption = disabled"

Customer Instructions for macOS SMB Clients
1. Quit all applications and close all windows which are not needed to reproduce the bug before starting the screen recording
2. For macOS Big Sur, Open System Preferences -> Dock & Menu Bar -> Clock and ensure that “Display the time with seconds” is enabled. Close System Preferences.
For macOS older than Big Sur, Open System Preferences -> Date & Time -> Clock and ensure that “Show date and time in menu bar” and “Display the time with seconds” are enabled. Close System Preferences.
3. Start a screen recording. Refer to [https://support.apple.com/en-us/HT208721](https://www.google.com/url?q=https%3A%2F%2Fsupport.apple.com%2Fen-us%2FHT208721&sa=D&sntz=1&usg=AOvVaw0uo8x7jyW_KkCR1lYYM-qP) for how to do screen recordings
4. Launch Terminal.app and type “cat /etc/nsmb.conf”. It is fine if you get the error of "no source file or directory".
5. Start a packet trace in Terminal.app with "sudo tcpdump -w ~/Desktop/SMB-Packets.pcap port 445”.
6. After you reproduce the bug, stop the packet trace in Terminal.app with “Control-C”. The packets trace is saved on your Desktop as “SMB-Packets.pcap”. Attach that to the radar.
7. Stop the screen recording and attach it to the radar.
8. Run sysdiagnose with “sudo sysdiagnose”. The sysdiagnose tool will create a zip file inside /var/tmp and reveal it to you in Finder. Attach that to the radar.

[TCB13]

Hello @namjaejeon . I've the information requested, now as the logs / sysdiagnose might contain personal information that I don't feel comfortable sharing here. Do you mind sending me an email? Thanks.

[namjaejeon]

@TCB13 Okay. I will cc you in mail. Thanks for your help!

[namjaejeon]

@TCB13 Could you please share print logs after enabling debug mode like the following ?

echo all > /sys/class/ksmbd-control/debug

[TCB13]

@TCB13 Could you please share print logs after enabling debug mode like the following ?

echo all > /sys/class/ksmbd-control/debug

Hey, what logs am I supposed to see and where? It doesn't seem to log anything else than before to both /var and the syslog.

[namjaejeon]

@TCB13 there is no ksmbd print log when command "dmesg" ?

root@linkinjeon-System-Product-Name:~# echo all > /sys/class/ksmbd-control/debug 
root@linkinjeon-System-Product-Name:~# cat /sys/class/ksmbd-control/debug
[smb] [auth] [vfs] [oplock] [ipc] [conn] [rdma] 

dmesg

[ 2937.950402] ksmbd: connect success: accepted new connection
[ 2937.950517] ksmbd: RFC1002 header 232 bytes
[ 2937.950532] ksmbd: no length check for command
[ 2937.950535] ksmbd: SMB2 data length 0 offset 0
[ 2937.950537] ksmbd: SMB2 len 100
[ 2937.950539] ksmbd: client requested dialect 0x311
[ 2937.950541] ksmbd: selected SMB 3.1.1 dialect
[ 2937.950543] ksmbd: conn->dialect 0x311
[ 2937.950545] ksmbd: Received negotiate request
[ 2937.950547] ksmbd: decoding 4 negotiate contexts
[ 2937.950549] ksmbd: deassemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context
[ 2937.950550] ksmbd: deassemble SMB2_ENCRYPTION_CAPABILITIES context
[ 2937.950551] ksmbd: Cipher ID = 0x2
...

[TCB13]

@namjaejeon I decided to create a new Debian VM and configure everything from scratch once again. And guess what, everything worked even with version 3.4.2. I was able to connect and transfer files.

root@vm-debian-12-cli:~# modinfo ksmbd | grep version
version:        3.4.2

root@vm-debian-12-cli:~# uname -a
Linux vm-debian-12-cli 6.1.0-11-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.38-4 (2023-08-08) x86_64 GNU/Linux

Thanks for the patience, I guess this is closed.

[namjaejeon]

@TCB13 Sorry? Your problem is fixed ?

[namjaejeon]

@TCB13 You can connect ksmbd using Mac client after enable/disable encryption ? (i.e. smb3 encryption = disabled or no need to set this parameter)

[TCB13]

@TCB13 Sorry? Your problem is fixed ?

It seems so, I'm not sure if this got fixed by some of the latest macOS smaller updates or was the clean VM, but it fact it is working now... and everything we did up to this point it was a waste of time.

[TCB13]

@TCB13 You can connect ksmbd using Mac client after enable/disable encryption ? (i.e. smb3 encryption = disabled or no need to set this parameter)

I'll test both cases tomorrow , just to be sure.

[namjaejeon]

@TCB13 Okay, Please check this and I will wait for this result. Thanks~!

[TCB13]

@TCB13 Okay, Please check this and I will wait for this result. Thanks~!

@namjaejeon it seems to be working with smb3 encryption = disabled or without with. Thanks.

[namjaejeon]

@TCB13 Okay. Thanks for your check!