Wireshark 4.7.0
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
packet-smb.h
1/* packet-smb.h
2 * Defines for SMB packet dissection
3 * Copyright 1999, Richard Sharpe <[email protected]>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <[email protected]>
7 * Copyright 1998, 1999 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12#ifndef __PACKET_SMB_H__
13#define __PACKET_SMB_H__
14
15#include "ws_symbol_export.h"
16
17#include <epan/proto.h>
18#include <epan/wmem_scopes.h>
19
20WS_DLL_PUBLIC bool sid_name_snooping;
21
22/* SMB command codes, from the SNIA CIFS spec. With MSVC and a
23 * libwireshark.dll, we need a special declaration.
24 */
25WS_DLL_PUBLIC value_string_ext smb_cmd_vals_ext;
26WS_DLL_PUBLIC value_string_ext trans2_cmd_vals_ext;
27WS_DLL_PUBLIC value_string_ext nt_cmd_vals_ext;
28
29#define SMB_COM_CREATE_DIRECTORY 0x00
30#define SMB_COM_DELETE_DIRECTORY 0x01
31#define SMB_COM_OPEN 0x02
32#define SMB_COM_CREATE 0x03
33#define SMB_COM_CLOSE 0x04
34#define SMB_COM_FLUSH 0x05
35#define SMB_COM_DELETE 0x06
36#define SMB_COM_RENAME 0x07
37#define SMB_COM_QUERY_INFORMATION 0x08
38#define SMB_COM_SET_INFORMATION 0x09
39#define SMB_COM_READ 0x0A
40#define SMB_COM_WRITE 0x0B
41#define SMB_COM_LOCK_BYTE_RANGE 0x0C
42#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
43#define SMB_COM_CREATE_TEMPORARY 0x0E
44#define SMB_COM_CREATE_NEW 0x0F
45#define SMB_COM_CHECK_DIRECTORY 0x10
46#define SMB_COM_PROCESS_EXIT 0x11
47#define SMB_COM_SEEK 0x12
48#define SMB_COM_LOCK_AND_READ 0x13
49#define SMB_COM_WRITE_AND_UNLOCK 0x14
50#define SMB_COM_READ_RAW 0x1A
51#define SMB_COM_READ_MPX 0x1B
52#define SMB_COM_READ_MPX_SECONDARY 0x1C
53#define SMB_COM_WRITE_RAW 0x1D
54#define SMB_COM_WRITE_MPX 0x1E
55#define SMB_COM_WRITE_MPX_SECONDARY 0x1F
56#define SMB_COM_WRITE_COMPLETE 0x20
57#define SMB_COM_QUERY_SERVER 0x21
58#define SMB_COM_SET_INFORMATION2 0x22
59#define SMB_COM_QUERY_INFORMATION2 0x23
60#define SMB_COM_LOCKING_ANDX 0x24
61#define SMB_COM_TRANSACTION 0x25
62#define SMB_COM_TRANSACTION_SECONDARY 0x26
63#define SMB_COM_IOCTL 0x27
64#define SMB_COM_IOCTL_SECONDARY 0x28
65#define SMB_COM_COPY 0x29
66#define SMB_COM_MOVE 0x2A
67#define SMB_COM_ECHO 0x2B
68#define SMB_COM_WRITE_AND_CLOSE 0x2C
69#define SMB_COM_OPEN_ANDX 0x2D
70#define SMB_COM_READ_ANDX 0x2E
71#define SMB_COM_WRITE_ANDX 0x2F
72#define SMB_COM_NEW_FILE_SIZE 0x30
73#define SMB_COM_CLOSE_AND_TREE_DISC 0x31
74#define SMB_COM_TRANSACTION2 0x32
75#define SMB_COM_TRANSACTION2_SECONDARY 0x33
76#define SMB_COM_FIND_CLOSE2 0x34
77#define SMB_COM_FIND_NOTIFY_CLOSE 0x35
78/* Used by Xenix/Unix 0x60-0x6E */
79#define SMB_COM_TREE_CONNECT 0x70
80#define SMB_COM_TREE_DISCONNECT 0x71
81#define SMB_COM_NEGOTIATE 0x72
82#define SMB_COM_SESSION_SETUP_ANDX 0x73
83#define SMB_COM_LOGOFF_ANDX 0x74
84#define SMB_COM_TREE_CONNECT_ANDX 0x75
85#define SMB_COM_QUERY_INFORMATION_DISK 0x80
86#define SMB_COM_SEARCH 0x81
87#define SMB_COM_FIND 0x82
88#define SMB_COM_FIND_UNIQUE 0x83
89#define SMB_COM_FIND_CLOSE 0x84
90#define SMB_COM_NT_TRANSACT 0xA0
91#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
92#define SMB_COM_NT_CREATE_ANDX 0xA2
93#define SMB_COM_NT_CANCEL 0xA4
94#define SMB_COM_NT_RENAME 0xA5
95#define SMB_COM_OPEN_PRINT_FILE 0xC0
96#define SMB_COM_WRITE_PRINT_FILE 0xC1
97#define SMB_COM_CLOSE_PRINT_FILE 0xC2
98#define SMB_COM_GET_PRINT_QUEUE 0xC3
99#define SMB_COM_READ_BULK 0xD8
100#define SMB_COM_WRITE_BULK 0xD9
101#define SMB_COM_WRITE_BULK_DATA 0xDA
102
103/* Error codes */
104
105#define SMB_SUCCESS 0x00 /* All OK */
106#define SMB_ERRDOS 0x01 /* DOS based error */
107#define SMB_ERRSRV 0x02 /* server error, network file manager */
108#define SMB_ERRHRD 0x03 /* Hardware style error */
109#define SMB_ERRCMD 0x04 /* Not an SMB format command */
110
111/* used for SMB export object functionality */
112typedef struct _smb_eo_t {
113 unsigned smbversion;
114 uint16_t cmd;
115 int tid,uid;
116 unsigned fid;
117 uint32_t pkt_num;
118 char *hostname;
119 char *filename;
120 int fid_type;
121 int64_t end_of_file;
122 char *content_type;
123 uint32_t payload_len;
124 const uint8_t *payload_data;
125 uint64_t smb_file_offset;
126 uint32_t smb_chunk_len;
127} smb_eo_t;
128
129/* the information we need to keep around for NT transaction commands */
130typedef struct {
131 int subcmd;
132 int fid_type;
133 uint32_t ioctl_function;
134} smb_nt_transact_info_t;
135
136/* the information we need to keep around for transaction2 commands
137* t2i and st2i */
138typedef struct {
139 int subcmd;
140 int info_level;
141 bool resume_keys; /* if "return resume" keys set in T2 FIND_FIRST request */
142 const char *name;
143} smb_transact2_info_t;
144
145typedef struct {
146 unsigned frame_num;
147 unsigned command_count;
148 gboolean multi_cmds;
149 unsigned cmd_index;
150} multi_cmds_t;
151
152/*
153 * The information we need to save about a request in order to show the
154 * frame number of the request in the dissection of the reply.
155 */
156#define SMB_SIF_TID_IS_IPC 0x0001
157#define SMB_SIF_IS_CONTINUED 0x0002
158typedef enum {
159 SMB_EI_NONE, /* Unassigned / NULL */
160 SMB_EI_FID, /* FID */
161 SMB_EI_NTI, /* smb_nt_transact_info_t * */
162 SMB_EI_TRI, /* smb_transact_info_t * */
163 SMB_EI_T2I, /* smb_transact2_info_t * */
164 SMB_EI_TIDNAME, /* tid tracking char * */
165 SMB_EI_FILEDATA, /* fid tracking */
166 SMB_EI_FILENAME, /* filename tracking */
167 SMB_EI_UID, /* smb_uid_t */
168 SMB_EI_RWINFO, /* read/write offset/count info */
169 SMB_EI_LOCKDATA, /* locking and x data */
170 SMB_EI_RENAMEDATA, /* rename data */
171 SMB_EI_DIALECTS /* negprot dialects */
172} smb_extra_info_t;
173
174typedef struct _smb_fid_into_t smb_fid_info_t;
175
176/* sip */
177typedef struct {
178 uint32_t frame_req, frame_res;
179 nstime_t req_time;
180 uint16_t flags;
181 uint8_t cmd;
182 void *extra_info;
183 smb_extra_info_t extra_info_type;
184 bool is_create_req;
185 /* we save the fid in each transaction so that we can get fid filters
186 to match both request and response */
187 bool fid_seen_in_request;
188 uint16_t fid;
189} smb_saved_info_t;
190
191/*
192 * The information we need to save about a Transaction request in order
193 * to dissect the reply; this includes information for use by the
194 * Remote API and Mailslot dissectors.
195 * XXX - have an additional data structure hung off of this by the
196 * subdissectors?
197 * tri */
198typedef struct {
199 int subcmd;
200 int trans_subcmd;
201 int function;
202 /* Unification of fid variable type (was int) */
203 uint16_t fid;
204 uint16_t lanman_cmd;
205 const char *param_descrip; /* Keep these descriptors around */
206 const char *data_descrip;
207 const char *aux_data_descrip;
208 int info_level;
209} smb_transact_info_t;
210
211/*
212 * Subcommand type.
213 */
214#define TRANSACTION_PIPE 0
215#define TRANSACTION_MAILSLOT 1
216
217/* these are defines used to represent different types of TIDs.
218 don't use the value 0 for any of these */
219#define TID_NORMAL 1
220#define TID_IPC 2
221
222/* this is the structure which is associated with each conversation */
223typedef struct conv_tables {
224 /* these two tables are used to match requests with responses */
225 GHashTable *unmatched;
226 GHashTable *matched;
227 /* This table keeps primary transact requests so secondaries can find
228 them */
229 GHashTable *primaries;
230
231 /* This table is used to track TID->services for a conversation */
232 GHashTable *tid_service;
233 bool raw_ntlmssp; /* Do extended security exc use raw ntlmssp */
234
235 /* track fid to fidstruct (filename/openframe/closeframe */
236 wmem_tree_t *fid_tree;
237 /* We'll use a GSL list instead */
238 GSList *GSL_fid_info;
239
240 /* track tid to fidstruct (sharename/shareframe/unshareframe */
241 wmem_tree_t *tid_tree;
242
243 /* track uid to username mappings */
244 wmem_tree_t *uid_tree;
245
246 /* This table is used to track which request frame a [NT]Trans[2] response fragment maps to */
247 GHashTable *trans_frag_resp;
248} conv_tables_t;
249
250/* si */
251typedef struct smb_info {
252 uint8_t cmd;
253 int tid, pid, uid, mid;
254 uint32_t nt_status;
255 bool unicode; /* Are strings in this SMB Unicode? */
256 bool request; /* Is this a request? */
257 bool unidir;
258 int info_level;
259 int info_count;
260 smb_saved_info_t *sip; /* smb_saved_info_t, if any, for this */
261 conv_tables_t *ct;
262 proto_tree *smbtree;
263} smb_info_t;
264
265/*
266 * Show file data for a read or write.
267 */
268extern int dissect_file_data(tvbuff_t *tvb, proto_tree *tree, int offset,
269 uint16_t bc, int dataoffset, uint16_t datalen);
270
271
272#define SMB_FID_TYPE_UNKNOWN 0
273#define SMB_FID_TYPE_FILE 1
274#define SMB_FID_TYPE_DIR 2
275#define SMB_FID_TYPE_PIPE 3
276
277/* used for tracking filenames from rename request to response */
278typedef struct _smb_rename_saved_info_t {
279 char *old_name;
280 char *new_name;
281} smb_rename_saved_info_t;
282
283/* used for tracking lock data between lock request/response */
284typedef struct _smb_lock_info_t {
285 struct _smb_lock_info_t *next;
286 uint16_t pid;
287 uint64_t offset;
288 uint64_t length;
289} smb_lock_info_t;
290
291typedef struct _smb_locking_saved_info_t {
292 uint8_t type;
293 uint8_t oplock_level;
294 uint16_t num_lock;
295 uint16_t num_unlock;
296 smb_lock_info_t *locks;
297 smb_lock_info_t *unlocks;
298} smb_locking_saved_info_t;
299
300/* fsi used for tracking fid/tid to filename/sharename openedframe closedframe */
301typedef struct _smb_fid_saved_info_t {
302 char *filename;
303 uint32_t create_flags;
304 uint32_t access_mask;
305 uint32_t file_attributes;
306 uint32_t share_access;
307 uint32_t create_options;
308 uint32_t create_disposition;
309} smb_fid_saved_info_t;
310
311struct _smb_fid_into_t {
312 uint16_t tid,fid;
313 /* The end_of_file will store the last registered offset or
314 the reported end_of_file from the SMB protocol */
315 int64_t end_of_file;
316 /* These two were int */
317 unsigned opened_in;
318 unsigned closed_in;
319 int type;
320 smb_fid_saved_info_t *fsi;
321};
322
323/* used for tracking tid to sharename openedframe closedframe */
324typedef struct _smb_tid_into_t {
325 int opened_in;
326 int closed_in;
327 char *filename;
328 int type;
329} smb_tid_info_t;
330
331
332/*
333 * Dissect an smb FID
334 */
335extern smb_fid_info_t *dissect_smb_fid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
336 int offset, int len, uint16_t fid, bool is_created, bool is_closed, bool is_generated, bool is_displayed, smb_info_t* si);
337
338/*
339 * Dissect named pipe state information.
340 */
341extern int dissect_ipc_state(tvbuff_t *tvb, proto_tree *parent_tree,
342 int offset, bool setstate);
343
344extern bool smb_dcerpc_reassembly;
345
346extern const value_string create_disposition_vals[];
347
348extern int dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
349
350extern int dissect_nt_share_access(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
351
352extern int dissect_smb_access_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
353
354extern const value_string oa_open_vals[];
355extern const value_string impersonation_level_vals[];
356
357extern bool sid_display_hex;
358
359extern int dissect_security_information_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
360
361extern int dissect_qfsi_FS_VOLUME_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, uint16_t *bcp, int unicode);
362extern int dissect_qfsi_FS_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, uint16_t *bcp);
363extern int dissect_qfsi_FS_DEVICE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, uint16_t *bcp);
364extern int dissect_qfsi_FS_ATTRIBUTE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, uint16_t *bcp);
365extern int dissect_nt_quota(tvbuff_t *tvb, proto_tree *tree, int offset, uint16_t *bcp);
366extern int dissect_nt_user_quota(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, int offset, uint16_t *bcp);
367extern int dissect_nt_get_user_quota(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, int offset, uint32_t *bcp);
368extern int dissect_qfsi_FS_OBJECTID_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, uint16_t *bcp);
369extern int dissect_qfsi_FS_FULL_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, uint16_t *bcp);
370extern int dissect_qfi_SMB_FILE_EA_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
371extern int dissect_qfi_SMB_FILE_STREAM_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, uint16_t *bcp, bool *trunc, int unicode);
372extern int dissect_qfi_SMB_FILE_NAME_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc, bool unicode);
373extern int dissect_qfi_SMB_FILE_STANDARD_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
374extern int dissect_qfi_SMB_FILE_INTERNAL_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
375extern int dissect_qsfi_SMB_FILE_POSITION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
376extern int dissect_qsfi_SMB_FILE_MODE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
377extern int dissect_qfi_SMB_FILE_ALIGNMENT_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
378extern int dissect_qfi_SMB_FILE_COMPRESSION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
379extern int dissect_qfi_SMB_FILE_NETWORK_OPEN_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
380extern int dissect_qfi_SMB_FILE_ATTRIBUTE_TAG_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
381extern int dissect_qsfi_SMB_FILE_ALLOCATION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
382extern int dissect_qsfi_SMB_FILE_ENDOFFILE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
383extern int dissect_nt_notify_completion_filter(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
384extern int dissect_sfi_SMB_FILE_PIPE_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
385extern int dissect_qfi_SMB_FILE_PIPE_LOCAL_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
386extern int dissect_qfi_SMB_FILE_PIPE_REMOTE_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, uint16_t *bcp, bool *trunc);
387extern int dissect_smb_get_dfs_request_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool unicode);
388extern int dissect_smb_get_dfs_referral_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, uint16_t *bcp, bool unicode);
389extern const char *smb_get_unicode_or_ascii_string(wmem_allocator_t *scope, tvbuff_t *tvb, int *offsetp, bool useunicode,
390 int *len, bool nopad, bool exactlen, uint16_t *bcp);
391
392/* Returns an IP (v4 or v6) of the server in a SMB/SMB2 conversation */
393extern const char *tree_ip_str(packet_info *pinfo, uint16_t cmd);
394
395#endif
396
397/*
398 * Editor modelines - https://www.wireshark.org/tools/modelines.html
399 *
400 * Local variables:
401 * c-basic-offset: 8
402 * tab-width: 8
403 * indent-tabs-mode: t
404 * End:
405 *
406 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
407 * :indentSize=8:tabSize=8:noTabs=false:
408 */
_packet_info
Definition packet_info.h:43
_proto_node
Definition proto.h:907
_smb_eo_t
Definition packet-smb.h:112
_smb_fid_into_t
Definition packet-smb.h:311
_smb_fid_saved_info_t
Definition packet-smb.h:301
_smb_lock_info_t
Definition packet-smb.h:284
_smb_locking_saved_info_t
Definition packet-smb.h:291
_smb_rename_saved_info_t
Definition packet-smb.h:278
_smb_tid_into_t
Definition packet-smb.h:324
_value_string_ext
Extended metadata for a value_string array.
Definition value_string.h:325
_value_string
Mapping between a 32-bit integer value and its string representation.
Definition value_string.h:33
_wmem_allocator_t
Internal memory allocator interface used by the wmem subsystem.
Definition wmem_allocator.h:34
_wmem_tree_t
Internal representation of a wmem balanced tree.
Definition wmem_tree-int.h:81
conv_tables
Definition packet-smb.h:223
multi_cmds_t
Definition packet-smb.h:145
nstime_t
Definition nstime.h:26
smb_info
Definition packet-smb.h:251
smb_nt_transact_info_t
Definition packet-smb.h:130
smb_saved_info_t
Definition packet-smb.h:177
smb_transact2_info_t
Definition packet-smb.h:138
smb_transact_info_t
Definition packet-smb.h:198
tvbuff
Definition tvbuff-int.h:35
wmem_scopes.h
Generated by doxygen 1.9.8