SMB3 Protocol Update Tom Talpey Microsoft Corporation 1 Outline - - PowerPoint PPT Presentation

▶
smb3 protocol update
SMART_READER_LITE
LIVE PREVIEW

SMB3 Protocol Update Tom Talpey Microsoft Corporation 1 Outline - - PowerPoint PPT Presentation

Oct 13, 2023 600 likes •980 views

SMB3 Protocol Update Tom Talpey Microsoft Corporation 1 Outline SMB3 Protocol changes SMB3 Protocol futures Possible Microsoft/Samba collaborations sambaXP 2019 Gttingen 2 SMB3 Protocol Changes sambaXP 2019 Gttingen 3

slide-1
SLIDE 1

1

SMB3 Protocol Update

Tom Talpey Microsoft Corporation

slide-2
SLIDE 2

2

Outline

  • SMB3 Protocol changes
  • SMB3 Protocol futures
  • Possible Microsoft/Samba collaborations

sambaXP 2019 Göttingen

slide-3
SLIDE 3

3

SMB3 Protocol Changes

sambaXP 2019 Göttingen

slide-4
SLIDE 4

4

MS-SMB2

  • Windows and Windows Server “19H1” release
  • A.k.a. Windows 10 version 1903
  • May 22, 2019
  • Updated doc March 13
  • Corrections/updates April 30
  • https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-

smb2/5606ad47-5ee0-437a-817e-70c366052962

  • Also covering 18H2/Server2019 today
  • Since it’s a year since we met here!
  • Largely maintenance – no protocol changes

sambaXP 2019 Göttingen

slide-5
SLIDE 5

5

SMB3 Changes

  • New SMB3 features (negotiate contexts)
  • Compression
  • Server netname
  • No dialect change
  • No dialect bump foreseen
  • Since SMB2/3 now has forward-compatible contexts in
  • Negotiate
  • Tree Connect

sambaXP 2019 Göttingen

slide-6
SLIDE 6

6

Compression

  • New negotiate context SMB2_COMPRESSION_CAPABILITIES
  • MS-SMB2 section 2.2.3.1.3 (request) and 2.2.4.1.3 (response)
  • ID 0x0003
  • New SMB2_COMPRESSION_TRANSFORM_HEADER
  • New transform specifically for compression
  • MS-SMB2 section 2.2.42
  • Also SMB2_READFLAG_REQUEST_COMPRESSED
  • New flag in SMB2_READ request
  • MS-SMB2 section 2.2.19

sambaXP 2019 Göttingen

slide-7
SLIDE 7

7

Negotiable SMB Traffic Compression

  • Client optionally negotiates compression by appending negotiation context (ID = 0x0003)
  • Supporting server selects subset of compression algorithms, if any, and responds with:
  • Supported compression algorithms defined in MS-XCA:
  • XPRESS (also known as LZ77)
  • XPRESS Huffman (LZ77+Huffman)
  • LZNT1

sambaXP 2019 Göttingen

Algorithm Count Algorithm Id 1 Algorithm Id 2 Algorithm Id 3

2 Byte 2 Byte 2 Byte

……

2 Byte

n Selected Algorithm Id 1

2 Byte

Selected Algorithm Id n

2 Byte

……

slide-8
SLIDE 8

8

Compression + Signing/Encryption Interop

  • New, compact transform header for SMB Compression (16B)
  • When compression and signing or encryption are needed, transform headers are nested
  • Compress always first: regular transform header always the outer transform header

sambaXP 2019 Göttingen

Reserved Compression Offset Algorithm Protocol ID Original Segment Size

SMB Transform Header SMB Compression Transform Header SMB2 HEADER and

  • ther payload …
slide-9
SLIDE 9

9

Compression processing

  • MS-SMB2 section 3.1.4.4
  • Choice of compression types by sender, on each operation
  • As appropriate to type of data, performance, etc
  • Compress Writes and requesting compress Reads for client
  • CompressAllRequests override for client
  • Not over RDMA (for now)

sambaXP 2019 Göttingen

slide-10
SLIDE 10

10

Decompression processing

  • MS-SMB2 section 3.2.5.1.10
  • Drops connection on fail (size mismatch)
  • Inevitably drops connection on garbage

sambaXP 2019 Göttingen

slide-11
SLIDE 11

11

Compression commentary

  • It’s optional!
  • Doesn’t compress if payload not smaller
  • Only compresses “large” “data-bearing” operations
  • Separate decision on both client and server, on each operation sent
  • Compress *before* encrypt
  • Encrypted data compresses badly
  • Note, some encryptions also compress – implementation consideration
  • Optional to compress SMB headers
  • Offset field may point into “middle” of payload
  • Windows compresses data-only at ~4KB+

sambaXP 2019 Göttingen

slide-12
SLIDE 12

12

Compression Performance

100 100 400 168 100 200 300 400 500 Patterned Data Random Data

SMB Compression performance under 100Mbps network with EXPRESS using Intel Xeon W3520

No Compression With Compression

sambaXP 2019 Göttingen

slide-13
SLIDE 13

13

Compression Performance

200 200 544 232 100 200 300 400 500 600 Patterned Data Random Data

SMB Compression performance under 200Mbps network with EXPRESS using Intel Xeon W3520

No Compression With Compression

sambaXP 2019 Göttingen

slide-14
SLIDE 14

14

Compression Use Cases

  • Reads and Write
  • Not metadata and IOCTL/FSCTL, but possible
  • Bulk data on long-haul
  • Specialized local transfers
  • File copy, migration, etc
  • Client opt-in
  • Used only in scenarios which might benefit

sambaXP 2019 Göttingen

slide-15
SLIDE 15

15

Compression future

  • Alternative compression algorithms
  • Hyper-V / VHDX optimized?
  • RLL type algorithm for all-zero blocks is perhaps appealing
  • Still a per-operation and per-payload decision
  • Interaction with encryption, transport, etc
  • Compression when encryption implements
  • Cf. not signing when using authenticated encryption
  • Compression over RDMA may have different goals
  • RDMA transport changes the benefit equation

sambaXP 2019 Göttingen

slide-16
SLIDE 16

16

Netname Negotiate Context

  • Client provides target servername by appending negotiation

context (ID = 0x0005)

  • Provides servername
  • Advisory, available prior to session and treeconnect processing
  • May be inspected by load balancers, connection managers, etc
  • Ignored by Server processing (perhaps surprisingly?)

sambaXP 2019 Göttingen

Name length Unicode null-terminated name

2 Byte Variable

slide-17
SLIDE 17

17

Netname Negotiate Context

  • SMB2_NETNAME_NEGOTIATE_CONTEXT_ID
  • MS-SMB2 Section 2.3.1.4 (request only)
  • 0x0005
  • Included with SMB2_NEGOTIATE by default
  • MS-SMB2 section 3.2.4.2.2

sambaXP 2019 Göttingen

slide-18
SLIDE 18

18

Updates to the Microsoft SMB3 client

  • FileNormalizedNameInformation
  • Normalized Name query added to protocol
  • FileIdInformation
  • Omitted in 3.x [oops!] (3.3.5.20.1)
  • Directory Caching Enhancements
  • Can now cache much larger directories ~ 500K entries.
  • Will attempt directory queries with 1 MB buffers to reduce round

trips and improve performance

  • Accelerated IO path for low latency access

sambaXP 2019 Göttingen

slide-19
SLIDE 19

19

Other MS-SMB2 Document Updates

  • MS-XCA normative reference added (for compression)
  • Numerous clarity and language tweaks
  • FSCTL input and output counts
  • Transform processing order, invalid protocol id’s
  • New section reorg in April 30 update see 3.2.5.1.1/3.3.5.2.1 and subsections
  • Oplock/Lease break client processing
  • Tree connect and redirect
  • Durable reconnect v2 (3.3.5.9.12)
  • Compound processing (18H2 document)

sambaXP 2019 Göttingen

slide-20
SLIDE 20

20

SMB3 Protocol Futures

sambaXP 2019 Göttingen

slide-21
SLIDE 21

21

What’s Coming?

(SDC 2018 review / SDC 2019 preview)

  • SMB over QUIC
  • New transforms and signing
  • AES-GMAC signing
  • Signing and RDMA
  • RDMA direct access to persistent storage

sambaXP 2019 Göttingen

slide-22
SLIDE 22

22

QUIC:UDP based secure stream transport

  • Low-latency connection setup
  • 1-RTT for initial connections
  • 0-RTT for repeat connections.
  • Secure and Encrypted (TLS 1.3+)
  • Improvements over HTTP/2 (“H2”) and TCP
  • Multiple Stream Support
  • ALPN for better multiplexing
  • Support for connection migration across
  • Better congestion control & loss recovery
  • UDP based library implementation
  • IETF draft stage.

sambaXP 2019 Göttingen

slide-23
SLIDE 23

23

QUIC - Unknowns

  • Still experimental
  • Evidence (Google) shows that it is firewall/NAT friendly – 93%
  • Initial implementations are software only
  • Will it catch up with TCP offload ?
  • RDMA over QUIC ?
  • Still in development
  • Very close to standardization

sambaXP 2019 Göttingen

slide-24
SLIDE 24

24

SMB Bindings for QUIC

  • QUIC connections can share same 4-tuple
  • Can multiplex using an ALPN identifier
  • Can share same port with HTTPS traffic
  • Use QUIC as a single channel TCP replacement
  • SMB multichannel will use separate QUIC connections.
  • Not currently envisioning using QUIC streams
  • Can QUIC be hooked up to Azure Files ?
  • No more port 445 blocking !

sambaXP 2019 Göttingen

slide-25
SLIDE 25

25

SMB3 Signing – Enabling AES-GMAC

  • Switch from AES-CCM to AES-GCM cipher
  • AES-GCM based SMB3 encryption performs significantly better than

AES-CCM based signing

  • Most modern processors have optimized instructions for AES-GCM

computations

  • SMB3.x (still) uses AES-CMAC for signing
  • Can we use AES-GMAC to similarly improve signing ?
  • Definitely yes

sambaXP 2019 Göttingen

slide-26
SLIDE 26

26

AES-GMAC expected performance

sambaXP 2019 Göttingen

slide-27
SLIDE 27

27

Negotiable SMB Signing with New Algorithm

  • Negotiable
  • Client will be able to negotiate switching to the AES128-GMAC algorithm for

signing in SMB 3.1.1. New negotiation context specifying the algorithm count and algorithm IDs:

  • Supporting server will select 1 signing algorithm, if possible, and respond with:
  • More algorithms may be added over time

sambaXP 2019 Göttingen

0x0001 Selected Algorithm ID

2 Byte

Algorithm Count Algorithm Id 1 Algorithm Id Algorithm Id 2

2 Byte 2 Byte 2 Byte

……

slide-28
SLIDE 28

28

Better Signing and Encryption in RDMA

  • Signing and Encryption over SMB

RDMA.

  • Performance gain over current

packet-based authenticated and/or encrypted traffic over SMB RDMA.

  • Supports AES128-GMAC for

signing, AES-CCM and AES-GCM for encryption.

sambaXP 2019 Göttingen

SMB2 RDR SMB2 SRV

RDMA Buffer RDMA Buffer

(Encrypted/Signed)

RDMA Buffer

(Decrypted/Verified)

E.g. An SMB RDMA write:

RDMA Pull

slide-29
SLIDE 29

29

Better Signing and Encryption in RDMA

  • How to transmit signature and nonce?
  • Transform Descriptor as channel payload! (SMB2_CHANNEL_RDMA type 0x0003)
  • Similar transform descriptor used with SMB2 Read Response

sambaXP 2019 Göttingen

Signature and Nonce Transform Descriptor Signature Length Signature Offset Nonce Length Nonce Offset Original Message Size Reserved 1 Reserved 2 Channel Offset Channel Length Channel (V1 or V1 Invalidate) SMB2 HEADER SMB2 REQ WRITE RDMA Descriptor

slide-30
SLIDE 30

30

1 2 3 1 Traditional i/o 2 DAX memcpy by SMB3 Server 3 Push Mode direct from RDMA NIC

SMB3 Push Mode to Persistent Memory/DAX

  • SMB3 RDMA and “Push

Mode” discussed at previous events

  • Enables zero-copy remote

read/write to DAX file

  • Ultra-low latency and overhead
  • Single-digit microsecond!
  • Minimal SMB3 and RDMA

protocol extensions required

SMB3 Server RDMA NIC SMB3 RDMA Push/ Commit “Buffer Cache”

RDMA R/W Load/Store

DAX Filesystem PMEM

I/O requests

Direct file mapping

sambaXP 2019 Göttingen

slide-31
SLIDE 31

31

RDMA Protocol Extensions

  • Two extensions advancing (slowly) in IBTA (IB, RoCE)
  • RDMA Flush is flush to durability
  • Atomic Write places pointer-sized data after flush
  • Transactional, e.g. for log write pointer update
  • IETF (iWARP) discussion also active
  • Push Mode only needs RDMA Flush

sambaXP 2019 Göttingen

slide-32
SLIDE 32

32

SMB Protocol Extensions

  • SMB3 protocol not extended
  • Only new FSCTLs
  • Client requests “Push Mode” handle on DAX file
  • Just an RDMA memory handle, long-lived
  • Server registers DAX-mapped file
  • Associated with a lease for protection and recall
  • Client performs RDMA instead of SMB2_WRITE/SMB2_READ
  • Client Flushes writes to PMEM
  • With RDMA extension, if available on both sides
  • With SMB2 FSCTL or other operation, if not

sambaXP 2019 Göttingen

slide-33
SLIDE 33

33

Details

  • More details on all the above to be available at SDC2019 in Santa

Clara

sambaXP 2019 Göttingen

slide-34
SLIDE 34

34

Microsoft/Samba Collaboration

sambaXP 2019 Göttingen

slide-35
SLIDE 35

35

Ideas

  • Microsoft remains interested in helping Samba co-develop:
  • Linux client
  • RDMA and RDMA Push Mode
  • SMB/QUIC interop
  • Azure test infra for Samba
  • Wireshark
  • And of course, Posix Extensions
  • Let’s continue to discuss!

sambaXP 2019 Göttingen

slide-36
SLIDE 36

36

OBTW

  • Death to SMB1 ☺

sambaXP 2019 Göttingen