Wireshark  2.9.0-477-g68ec514b
The Wireshark network protocol analyzer
packet-smb2.h
1 /* packet-smb2.h
2  * Defines for SMB2 packet dissection
3  *
4  * Wireshark - Network traffic analyzer
5  * By Gerald Combs <gerald@wireshark.org>
6  * Copyright 1998, 1999 Gerald Combs
7  *
8  * SPDX-License-Identifier: GPL-2.0-or-later
9  */
10 
11 #ifndef __PACKET_SMB2_H__
12 #define __PACKET_SMB2_H__
13 
14 #include "packet-dcerpc.h"
15 #include "packet-smb.h"
16 
17 /* SMB2 command codes. With MSVC and a
18  * libwireshark.dll, we need a special declaration.
19  */
20 WS_DLL_PUBLIC value_string_ext smb2_cmd_vals_ext;
21 
22 /* Structure to keep track of information specific to a single
23  * SMB2 transaction. Here we store things we need to remember between
24  * a specific request and a specific response.
25  *
26  * There is no guarantee we will have this structure available for all
27  * SMB2 packets so a dissector must check this pointer for NULL
28  * before dereferencing it.
29  *
30  * private data is set to NULL when the structure is created. It is used
31  * for communications between the Request and the Response packets.
32  */
33 
34 /* extra info needed by export object smb */
35 typedef struct _smb2_eo_file_info_t {
36  guint32 attr_mask;
37  gint64 end_of_file;
39 
40 typedef struct _smb2_fid_info_t {
41  guint64 fid_persistent;
42  guint64 fid_volatile;
43  guint64 sesid;
44  guint32 tid;
45  char *name;
47 
48 typedef enum {
49  SMB2_EI_NONE, /* Unassigned / NULL */
50  SMB2_EI_TREENAME, /* tid tracking char * */
51  SMB2_EI_FILENAME, /* fid tracking char * */
52  SMB2_EI_FINDPATTERN /* find tracking char * */
53 } smb2_extra_info_t;
54 typedef struct _smb2_saved_info_t {
55  guint8 smb2_class;
56  guint8 infolevel;
57  guint64 msg_id;
58  guint32 frame_req, frame_res;
59  nstime_t req_time;
60  smb2_fid_info_t *file;
61  e_ctx_hnd policy_hnd; /* for eo_smb tracking */
62  smb_eo_t *eo_info_t; /* for storing eo_smb infos */
63  guint64 file_offset; /* needed file_offset for eo_smb */
64  guint32 bytes_moved; /* needed for eo_smb */
65  void *extra_info;
66  smb2_extra_info_t extra_info_type;
68 
69 typedef struct _smb2_tid_info_t {
70  guint32 tid;
71  guint32 connect_frame;
72  guint8 share_type;
73  char *name;
75 
76 typedef struct _smb2_sesid_info_t {
77  guint64 sesid;
78  guint32 auth_frame;
79  char *acct_name;
80  char *domain_name;
81  char *host_name;
82  guint16 server_port;
83  guint8 client_decryption_key[16];
84  guint8 server_decryption_key[16];
85  GHashTable *tids;
87 
88 /* Structure to keep track of conversations and the hash tables.
89  * There is one such structure for each conversation.
90  */
91 typedef struct _smb2_conv_info_t {
92  /* these two tables are used to match requests with responses */
93  GHashTable *unmatched;
94  GHashTable *matched;
95  GHashTable *sesids;
96  GHashTable *fids;
97  /* table to store some infos for smb export object */
98  GHashTable *files;
100 
101 
102 /* This structure contains information from the SMB2 header
103  * as well as pointers to the conversation and the transaction specific
104  * structures.
105  */
106 #define SMB2_FLAGS_RESPONSE 0x00000001
107 #define SMB2_FLAGS_ASYNC_CMD 0x00000002
108 #define SMB2_FLAGS_CHAINED 0x00000004
109 #define SMB2_FLAGS_SIGNATURE 0x00000008
110 #define SMB2_FLAGS_PRIORITY_MASK 0x00000070
111 #define SMB2_FLAGS_DFS_OP 0x10000000
112 #define SMB2_FLAGS_REPLAY_OPERATION 0x20000000
113 
114 #define SMB2_FLAGS_PRIORITY1 0x00000010
115 #define SMB2_FLAGS_PRIORITY2 0x00000020
116 #define SMB2_FLAGS_PRIORITY3 0x00000030
117 #define SMB2_FLAGS_PRIORITY4 0x00000040
118 #define SMB2_FLAGS_PRIORITY5 0x00000050
119 #define SMB2_FLAGS_PRIORITY6 0x00000060
120 #define SMB2_FLAGS_PRIORITY7 0x00000070
121 
122 /* SMB2 FLAG MASKS */
123 #define SMB2_FLAGS_ATTR_ENCRYPTED 0x00004000
124 #define SMB2_FLAGS_ATTR_INDEXED 0x00002000
125 #define SMB2_FLAGS_ATTR_OFFLINE 0x00001000
126 #define SMB2_FLAGS_ATTR_COMPRESSED 0x00000800
127 #define SMB2_FLAGS_ATTR_REPARSEPOINT 0x00000400
128 #define SMB2_FLAGS_ATTR_SPARSE 0x00000200
129 #define SMB2_FLAGS_ATTR_TEMPORARY 0x00000100
130 #define SMB2_FLAGS_ATTR_NORMAL 0x00000080
131 #define SMB2_FLAGS_ATTR_DEVICE 0x00000040
132 #define SMB2_FLAGS_ATTR_ARCHIVE 0x00000020
133 #define SMB2_FLAGS_ATTR_DIRECTORY 0x00000010
134 #define SMB2_FLAGS_ATTR_VOLUMEID 0x00000008
135 #define SMB2_FLAGS_ATTR_SYSTEM 0x00000004
136 #define SMB2_FLAGS_ATTR_HIDDEN 0x00000002
137 #define SMB2_FLAGS_ATTR_READONLY 0x00000001
138 
139 /* SMB2 FILE TYPES ASIGNED TO EXPORT OBJECTS */
140 #define SMB2_FID_TYPE_UNKNOWN 0
141 #define SMB2_FID_TYPE_FILE 1
142 #define SMB2_FID_TYPE_DIR 2
143 #define SMB2_FID_TYPE_PIPE 3
144 #define SMB2_FID_TYPE_OTHER 4
145 
146 /* SMB2 COMMAND CODES */
147 #define SMB2_COM_NEGOTIATE_PROTOCOL 0x00
148 #define SMB2_COM_SESSION_SETUP 0x01
149 #define SMB2_COM_SESSION_LOGOFF 0x02
150 #define SMB2_COM_TREE_CONNECT 0x03
151 #define SMB2_COM_TREE_DISCONNECT 0x04
152 #define SMB2_COM_CREATE 0x05
153 #define SMB2_COM_CLOSE 0x06
154 #define SMB2_COM_FLUSH 0x07
155 #define SMB2_COM_READ 0x08
156 #define SMB2_COM_WRITE 0x09
157 #define SMB2_COM_LOCK 0x0A
158 #define SMB2_COM_IOCTL 0x0B
159 #define SMB2_COM_CANCEL 0x0C
160 #define SMB2_COM_KEEPALIVE 0x0D
161 #define SMB2_COM_FIND 0x0E
162 #define SMB2_COM_NOTIFY 0x0F
163 #define SMB2_COM_GETINFO 0x10
164 #define SMB2_COM_SETINFO 0x11
165 #define SMB2_COM_BREAK 0x12
166 
167 typedef struct _smb2_info_t {
168  guint16 opcode;
169  guint32 ioctl_function;
170  guint32 status;
171  guint32 tid;
172  guint64 sesid;
173  guint64 msg_id;
174  guint32 flags;
175  smb2_eo_file_info_t *eo_file_info; /* eo_smb extra info */
176  smb2_conv_info_t *conv;
177  smb2_saved_info_t *saved;
178  smb2_tid_info_t *tree;
179  smb2_sesid_info_t *session;
180  smb2_fid_info_t *file;
181  proto_tree *top_tree;
182 } smb2_info_t;
183 
184 /* for transform content information */
185 
186 typedef struct _smb2_transform_info_t {
187  guint8 nonce[16];
188  guint32 size;
189  guint16 alg;
190  guint64 sesid;
191  smb2_conv_info_t *conv;
192  smb2_sesid_info_t *session;
194 
195 
196 int dissect_smb2_FILE_OBJECTID_BUFFER(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset);
197 int dissect_smb2_ioctl_function(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, guint32 *ioctl_function);
198 void dissect_smb2_ioctl_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *top_tree, guint32 ioctl_function, gboolean data_in, void *private_data);
199 
200 #endif
Definition: packet-smb2.h:40
Definition: packet_info.h:44
Definition: packet-smb2.h:35
Definition: tvbuff-int.h:35
Definition: nstime.h:27
Definition: packet-smb2.h:91
Definition: packet-smb2.h:69
Definition: packet-smb2.h:76
Definition: packet-smb2.h:54
Definition: packet-smb2.h:167
Definition: packet-smb2.h:186
Definition: packet-dcerpc.h:53
Definition: value_string.h:164
Definition: proto.h:759
Definition: packet-smb.h:112