Wireshark 4.5.0
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
packet-smb2.h
1/* packet-smb2.h
2 * Defines for SMB2 packet dissection
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998, 1999 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
10
11#ifndef __PACKET_SMB2_H__
12#define __PACKET_SMB2_H__
13
14#include "packet-dcerpc.h"
15#include "packet-smb.h"
16#include "packet-ntlmssp.h"
17
18/* SMB2 command codes. With MSVC and a
19 * libwireshark.dll, we need a special declaration.
20 */
21WS_DLL_PUBLIC value_string_ext smb2_cmd_vals_ext;
22
23/* Structure to keep track of information specific to a single
24 * SMB2 transaction. Here we store things we need to remember between
25 * a specific request and a specific response.
26 *
27 * There is no guarantee we will have this structure available for all
28 * SMB2 packets so a dissector must check this pointer for NULL
29 * before dereferencing it.
30 *
31 * private data is set to NULL when the structure is created. It is used
32 * for communications between the Request and the Response packets.
33 */
34
35/* extra info needed by export object smb */
36typedef struct _smb2_eo_file_info_t {
37 uint32_t attr_mask;
38 int64_t end_of_file;
40
41typedef struct _smb2_fid_info_t {
42 uint64_t fid_persistent;
43 uint64_t fid_volatile;
44 uint64_t sesid; /* *host* byte order - not necessarily little-endian! */
45 uint32_t tid;
46 /* only used for key lookup in equal func, must be zero when inserting */
47 uint32_t frame_key;
48 /* first and last frame nums this FID is valid */
49 uint32_t frame_beg;
50 uint32_t frame_end;
51 /* file name used to open this FID */
52 char *name;
54
55typedef enum {
56 SMB2_EI_NONE, /* Unassigned / NULL */
57 SMB2_EI_TREENAME, /* tid tracking char * */
58 SMB2_EI_FILENAME, /* fid tracking char * */
59 SMB2_EI_FINDPATTERN /* find tracking char * */
60} smb2_extra_info_t;
61typedef struct _smb2_saved_info_t {
62 uint8_t smb2_class;
63 uint8_t infolevel;
64 uint64_t msg_id;
65 uint32_t frame_req, frame_res;
66 nstime_t req_time;
67 uint8_t *preauth_hash_req, *preauth_hash_res;
68 smb2_fid_info_t *file;
69 e_ctx_hnd policy_hnd; /* for eo_smb tracking */
70 smb_eo_t *eo_info_t; /* for storing eo_smb infos */
71 uint64_t file_offset; /* needed file_offset for eo_smb */
72 uint32_t bytes_moved; /* needed for eo_smb */
73 void *extra_info;
74 smb2_extra_info_t extra_info_type;
75 uint32_t fid_hash;
76 uint16_t num_matched;
77 proto_item *hnd_item;
78 e_guid_t uuid_fid;
79 uint32_t frame_beg; /* The create frame. */
80 uint32_t frame_end; /* The close frame. */
81 const uint8_t *filename;
83
84typedef struct _smb2_tid_info_t {
85 uint32_t tid;
86 uint32_t connect_frame;
87 uint32_t disconnect_frame;
88 uint8_t share_type;
89 char *name;
91
92#define SMB2_PREAUTH_HASH_SIZE 64
93#define AES_KEY_SIZE 16
94
95typedef struct _smb2_sesid_info_t {
96 uint64_t sesid; /* *host* byte order - not necessarily little-endian! */
97 uint32_t auth_frame;
98 char *acct_name;
99 char *domain_name;
100 char *host_name;
101 uint16_t server_port;
102 uint32_t session_key_frame;
103 unsigned session_key_len;
104 uint8_t session_key[NTLMSSP_KEY_LEN*2];
105 uint8_t signing_key[NTLMSSP_KEY_LEN];
106 uint8_t client_decryption_key16[AES_KEY_SIZE];
107 uint8_t server_decryption_key16[AES_KEY_SIZE];
108 uint8_t client_decryption_key32[AES_KEY_SIZE*2];
109 uint8_t server_decryption_key32[AES_KEY_SIZE*2];
110
111 wmem_map_t *tids;
112 wmem_map_t *fids;
113 /* table to store some infos for smb export object */
114 wmem_map_t *files;
115
116 uint8_t preauth_hash[SMB2_PREAUTH_HASH_SIZE];
118
119/* Structure to keep track of conversations and the hash tables.
120 * There is one such structure for each conversation.
121 */
122typedef struct _smb2_conv_info_t {
123 /* these two tables are used to match requests with responses */
124 GHashTable *unmatched;
125 GHashTable *matched;
126 uint16_t dialect;
127 uint16_t sign_alg;
128 uint16_t enc_alg;
129
130 /* preauth hash before session setup */
131 uint8_t *preauth_hash_current;
132 uint8_t preauth_hash_con[SMB2_PREAUTH_HASH_SIZE];
133 uint8_t preauth_hash_ses[SMB2_PREAUTH_HASH_SIZE];
135
136
137/* This structure contains information from the SMB2 header
138 * as well as pointers to the conversation and the transaction specific
139 * structures.
140 */
141#define SMB2_FLAGS_RESPONSE 0x00000001
142#define SMB2_FLAGS_ASYNC_CMD 0x00000002
143#define SMB2_FLAGS_CHAINED 0x00000004
144#define SMB2_FLAGS_SIGNATURE 0x00000008
145#define SMB2_FLAGS_PRIORITY_MASK 0x00000070
146#define SMB2_FLAGS_DFS_OP 0x10000000
147#define SMB2_FLAGS_REPLAY_OPERATION 0x20000000
148
149#define SMB2_FLAGS_PRIORITY1 0x00000010
150#define SMB2_FLAGS_PRIORITY2 0x00000020
151#define SMB2_FLAGS_PRIORITY3 0x00000030
152#define SMB2_FLAGS_PRIORITY4 0x00000040
153#define SMB2_FLAGS_PRIORITY5 0x00000050
154#define SMB2_FLAGS_PRIORITY6 0x00000060
155#define SMB2_FLAGS_PRIORITY7 0x00000070
156
157/* SMB2 FLAG MASKS */
158#define SMB2_FLAGS_ATTR_ENCRYPTED 0x00004000
159#define SMB2_FLAGS_ATTR_INDEXED 0x00002000
160#define SMB2_FLAGS_ATTR_OFFLINE 0x00001000
161#define SMB2_FLAGS_ATTR_COMPRESSED 0x00000800
162#define SMB2_FLAGS_ATTR_REPARSEPOINT 0x00000400
163#define SMB2_FLAGS_ATTR_SPARSE 0x00000200
164#define SMB2_FLAGS_ATTR_TEMPORARY 0x00000100
165#define SMB2_FLAGS_ATTR_NORMAL 0x00000080
166#define SMB2_FLAGS_ATTR_DEVICE 0x00000040
167#define SMB2_FLAGS_ATTR_ARCHIVE 0x00000020
168#define SMB2_FLAGS_ATTR_DIRECTORY 0x00000010
169#define SMB2_FLAGS_ATTR_VOLUMEID 0x00000008
170#define SMB2_FLAGS_ATTR_SYSTEM 0x00000004
171#define SMB2_FLAGS_ATTR_HIDDEN 0x00000002
172#define SMB2_FLAGS_ATTR_READONLY 0x00000001
173
174/* SMB2 FILE TYPES ASSIGNED TO EXPORT OBJECTS */
175#define SMB2_FID_TYPE_UNKNOWN 0
176#define SMB2_FID_TYPE_FILE 1
177#define SMB2_FID_TYPE_DIR 2
178#define SMB2_FID_TYPE_PIPE 3
179#define SMB2_FID_TYPE_OTHER 4
180
181/* SMB2 COMMAND CODES */
182#define SMB2_COM_NEGOTIATE_PROTOCOL 0x00
183#define SMB2_COM_SESSION_SETUP 0x01
184#define SMB2_COM_SESSION_LOGOFF 0x02
185#define SMB2_COM_TREE_CONNECT 0x03
186#define SMB2_COM_TREE_DISCONNECT 0x04
187#define SMB2_COM_CREATE 0x05
188#define SMB2_COM_CLOSE 0x06
189#define SMB2_COM_FLUSH 0x07
190#define SMB2_COM_READ 0x08
191#define SMB2_COM_WRITE 0x09
192#define SMB2_COM_LOCK 0x0A
193#define SMB2_COM_IOCTL 0x0B
194#define SMB2_COM_CANCEL 0x0C
195#define SMB2_COM_KEEPALIVE 0x0D
196#define SMB2_COM_FIND 0x0E
197#define SMB2_COM_NOTIFY 0x0F
198#define SMB2_COM_GETINFO 0x10
199#define SMB2_COM_SETINFO 0x11
200#define SMB2_COM_BREAK 0x12
201
202typedef struct _smb2_info_t {
203 uint16_t opcode;
204 uint32_t ioctl_function;
205 uint32_t status;
206 uint32_t tid;
207 uint64_t sesid; /* *host* byte order - not necessarily little-endian! */
208 uint64_t msg_id;
209 uint32_t flags;
210 smb2_eo_file_info_t *eo_file_info; /* eo_smb extra info */
211 smb2_conv_info_t *conv;
212 smb2_saved_info_t *saved;
213 smb2_tid_info_t *tree;
214 smb2_sesid_info_t *session;
215 smb2_fid_info_t *file;
216 proto_tree *top_tree;
218
219/* for transform content information */
220
222 uint8_t nonce[16];
223 uint32_t size;
224 uint16_t flags;
225 uint64_t sesid; /* *host* byte order - not necessarily little-endian! */
226 smb2_conv_info_t *conv;
227 smb2_sesid_info_t *session;
229
231 unsigned orig_size;
232 unsigned alg;
233 unsigned comp_offset;
234 smb2_conv_info_t *conv;
235 smb2_sesid_info_t *session;
237
238
239int dissect_smb2_FILE_OBJECTID_BUFFER(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset);
240int dissect_smb2_ioctl_function(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, uint32_t *ioctl_function);
241void dissect_smb2_ioctl_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *top_tree, uint32_t ioctl_function, bool data_in, void *private_data);
242
243#endif
244
245/*
246 * Editor modelines - https://www.wireshark.org/tools/modelines.html
247 *
248 * Local variables:
249 * c-basic-offset: 8
250 * tab-width: 8
251 * indent-tabs-mode: t
252 * End:
253 *
254 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
255 * :indentSize=8:tabSize=8:noTabs=false:
256 */
Definition packet-dcerpc.h:54
Definition guid-utils.h:23
Definition packet_info.h:43
Definition proto.h:903
Definition packet-smb2.h:230
Definition packet-smb2.h:122
Definition packet-smb2.h:36
Definition packet-smb2.h:41
Definition packet-smb2.h:202
Definition packet-smb2.h:61
Definition packet-smb2.h:95
Definition packet-smb2.h:84
Definition packet-smb2.h:221
Definition packet-smb.h:112
Definition value_string.h:169
Definition wmem_map.c:44
Definition nstime.h:26
Definition tvbuff-int.h:35