Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-smb2.h
1 /* packet-smb2.h
2  * Defines for SMB2 packet dissection
3  *
4  * Wireshark - Network traffic analyzer
5  * By Gerald Combs <gerald@wireshark.org>
6  * Copyright 1998, 1999 Gerald Combs
7  *
8  * SPDX-License-Identifier: GPL-2.0-or-later
9  */
10 
11 #ifndef __PACKET_SMB2_H__
12 #define __PACKET_SMB2_H__
13 
14 #include "packet-dcerpc.h"
15 #include "packet-smb.h"
16 #include "packet-ntlmssp.h"
17 
18 /* SMB2 command codes. With MSVC and a
19  * libwireshark.dll, we need a special declaration.
20  */
21 WS_DLL_PUBLIC value_string_ext smb2_cmd_vals_ext;
22 
23 /* Structure to keep track of information specific to a single
24  * SMB2 transaction. Here we store things we need to remember between
25  * a specific request and a specific response.
26  *
27  * There is no guarantee we will have this structure available for all
28  * SMB2 packets so a dissector must check this pointer for NULL
29  * before dereferencing it.
30  *
31  * private data is set to NULL when the structure is created. It is used
32  * for communications between the Request and the Response packets.
33  */
34 
35 /* extra info needed by export object smb */
36 typedef struct _smb2_eo_file_info_t {
37  guint32 attr_mask;
38  gint64 end_of_file;
40 
41 typedef struct _smb2_fid_info_t {
42  guint64 fid_persistent;
43  guint64 fid_volatile;
44  guint64 sesid; /* *host* byte order - not necessarily little-endian! */
45  guint32 tid;
46  /* only used for key lookup in equal func, must be zero when inserting */
47  guint32 frame_key;
48  /* first and last frame nums this FID is valid */
49  guint32 frame_beg;
50  guint32 frame_end;
51  /* file name used to open this FID */
52  char *name;
54 
55 typedef enum {
56  SMB2_EI_NONE, /* Unassigned / NULL */
57  SMB2_EI_TREENAME, /* tid tracking char * */
58  SMB2_EI_FILENAME, /* fid tracking char * */
59  SMB2_EI_FINDPATTERN /* find tracking char * */
60 } smb2_extra_info_t;
61 typedef struct _smb2_saved_info_t {
62  guint8 smb2_class;
63  guint8 infolevel;
64  guint64 msg_id;
65  guint32 frame_req, frame_res;
66  nstime_t req_time;
67  guint8 *preauth_hash_req, *preauth_hash_res;
68  smb2_fid_info_t *file;
69  e_ctx_hnd policy_hnd; /* for eo_smb tracking */
70  smb_eo_t *eo_info_t; /* for storing eo_smb infos */
71  guint64 file_offset; /* needed file_offset for eo_smb */
72  guint32 bytes_moved; /* needed for eo_smb */
73  void *extra_info;
74  smb2_extra_info_t extra_info_type;
76 
77 typedef struct _smb2_tid_info_t {
78  guint32 tid;
79  guint32 connect_frame;
80  guint8 share_type;
81  char *name;
83 
84 #define SMB2_PREAUTH_HASH_SIZE 64
85 #define AES_KEY_SIZE 16
86 
87 typedef struct _smb2_sesid_info_t {
88  guint64 sesid; /* *host* byte order - not necessarily little-endian! */
89  guint32 auth_frame;
90  char *acct_name;
91  char *domain_name;
92  char *host_name;
93  guint16 server_port;
94  guint32 session_key_frame;
95  guint session_key_len;
96  guint8 session_key[NTLMSSP_KEY_LEN*2];
97  guint8 signing_key[NTLMSSP_KEY_LEN];
98  guint8 client_decryption_key16[AES_KEY_SIZE];
99  guint8 server_decryption_key16[AES_KEY_SIZE];
100  guint8 client_decryption_key32[AES_KEY_SIZE*2];
101  guint8 server_decryption_key32[AES_KEY_SIZE*2];
102 
103  wmem_map_t *tids;
104  wmem_map_t *fids;
105  /* table to store some infos for smb export object */
106  wmem_map_t *files;
107 
108  guint8 preauth_hash[SMB2_PREAUTH_HASH_SIZE];
110 
111 /* Structure to keep track of conversations and the hash tables.
112  * There is one such structure for each conversation.
113  */
114 typedef struct _smb2_conv_info_t {
115  /* these two tables are used to match requests with responses */
116  GHashTable *unmatched;
117  GHashTable *matched;
118  guint16 dialect;
119  guint16 sign_alg;
120  guint16 enc_alg;
121 
122  /* preauth hash before session setup */
123  guint8 *preauth_hash_current;
124  guint8 preauth_hash_con[SMB2_PREAUTH_HASH_SIZE];
125  guint8 preauth_hash_ses[SMB2_PREAUTH_HASH_SIZE];
127 
128 
129 /* This structure contains information from the SMB2 header
130  * as well as pointers to the conversation and the transaction specific
131  * structures.
132  */
133 #define SMB2_FLAGS_RESPONSE 0x00000001
134 #define SMB2_FLAGS_ASYNC_CMD 0x00000002
135 #define SMB2_FLAGS_CHAINED 0x00000004
136 #define SMB2_FLAGS_SIGNATURE 0x00000008
137 #define SMB2_FLAGS_PRIORITY_MASK 0x00000070
138 #define SMB2_FLAGS_DFS_OP 0x10000000
139 #define SMB2_FLAGS_REPLAY_OPERATION 0x20000000
140 
141 #define SMB2_FLAGS_PRIORITY1 0x00000010
142 #define SMB2_FLAGS_PRIORITY2 0x00000020
143 #define SMB2_FLAGS_PRIORITY3 0x00000030
144 #define SMB2_FLAGS_PRIORITY4 0x00000040
145 #define SMB2_FLAGS_PRIORITY5 0x00000050
146 #define SMB2_FLAGS_PRIORITY6 0x00000060
147 #define SMB2_FLAGS_PRIORITY7 0x00000070
148 
149 /* SMB2 FLAG MASKS */
150 #define SMB2_FLAGS_ATTR_ENCRYPTED 0x00004000
151 #define SMB2_FLAGS_ATTR_INDEXED 0x00002000
152 #define SMB2_FLAGS_ATTR_OFFLINE 0x00001000
153 #define SMB2_FLAGS_ATTR_COMPRESSED 0x00000800
154 #define SMB2_FLAGS_ATTR_REPARSEPOINT 0x00000400
155 #define SMB2_FLAGS_ATTR_SPARSE 0x00000200
156 #define SMB2_FLAGS_ATTR_TEMPORARY 0x00000100
157 #define SMB2_FLAGS_ATTR_NORMAL 0x00000080
158 #define SMB2_FLAGS_ATTR_DEVICE 0x00000040
159 #define SMB2_FLAGS_ATTR_ARCHIVE 0x00000020
160 #define SMB2_FLAGS_ATTR_DIRECTORY 0x00000010
161 #define SMB2_FLAGS_ATTR_VOLUMEID 0x00000008
162 #define SMB2_FLAGS_ATTR_SYSTEM 0x00000004
163 #define SMB2_FLAGS_ATTR_HIDDEN 0x00000002
164 #define SMB2_FLAGS_ATTR_READONLY 0x00000001
165 
166 /* SMB2 FILE TYPES ASIGNED TO EXPORT OBJECTS */
167 #define SMB2_FID_TYPE_UNKNOWN 0
168 #define SMB2_FID_TYPE_FILE 1
169 #define SMB2_FID_TYPE_DIR 2
170 #define SMB2_FID_TYPE_PIPE 3
171 #define SMB2_FID_TYPE_OTHER 4
172 
173 /* SMB2 COMMAND CODES */
174 #define SMB2_COM_NEGOTIATE_PROTOCOL 0x00
175 #define SMB2_COM_SESSION_SETUP 0x01
176 #define SMB2_COM_SESSION_LOGOFF 0x02
177 #define SMB2_COM_TREE_CONNECT 0x03
178 #define SMB2_COM_TREE_DISCONNECT 0x04
179 #define SMB2_COM_CREATE 0x05
180 #define SMB2_COM_CLOSE 0x06
181 #define SMB2_COM_FLUSH 0x07
182 #define SMB2_COM_READ 0x08
183 #define SMB2_COM_WRITE 0x09
184 #define SMB2_COM_LOCK 0x0A
185 #define SMB2_COM_IOCTL 0x0B
186 #define SMB2_COM_CANCEL 0x0C
187 #define SMB2_COM_KEEPALIVE 0x0D
188 #define SMB2_COM_FIND 0x0E
189 #define SMB2_COM_NOTIFY 0x0F
190 #define SMB2_COM_GETINFO 0x10
191 #define SMB2_COM_SETINFO 0x11
192 #define SMB2_COM_BREAK 0x12
193 
194 typedef struct _smb2_info_t {
195  guint16 opcode;
196  guint32 ioctl_function;
197  guint32 status;
198  guint32 tid;
199  guint64 sesid; /* *host* byte order - not necessarily little-endian! */
200  guint64 msg_id;
201  guint32 flags;
202  smb2_eo_file_info_t *eo_file_info; /* eo_smb extra info */
203  smb2_conv_info_t *conv;
204  smb2_saved_info_t *saved;
205  smb2_tid_info_t *tree;
206  smb2_sesid_info_t *session;
207  smb2_fid_info_t *file;
208  proto_tree *top_tree;
209 } smb2_info_t;
210 
211 /* for transform content information */
212 
213 typedef struct _smb2_transform_info_t {
214  guint8 nonce[16];
215  guint32 size;
216  guint16 flags;
217  guint64 sesid; /* *host* byte order - not necessarily little-endian! */
218  smb2_conv_info_t *conv;
219  smb2_sesid_info_t *session;
221 
223  guint orig_size;
224  guint alg;
225  guint comp_offset;
226  smb2_conv_info_t *conv;
227  smb2_sesid_info_t *session;
229 
230 
231 int dissect_smb2_FILE_OBJECTID_BUFFER(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset);
232 int dissect_smb2_ioctl_function(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, guint32 *ioctl_function);
233 void dissect_smb2_ioctl_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *top_tree, guint32 ioctl_function, gboolean data_in, void *private_data);
234 
235 #endif
236 
237 /*
238  * Editor modelines - https://www.wireshark.org/tools/modelines.html
239  *
240  * Local variables:
241  * c-basic-offset: 8
242  * tab-width: 8
243  * indent-tabs-mode: t
244  * End:
245  *
246  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
247  * :indentSize=8:tabSize=8:noTabs=false:
248  */
Definition: packet-dcerpc.h:54
Definition: packet_info.h:44
Definition: proto.h:904
Definition: packet-smb2.h:222
Definition: packet-smb2.h:114
Definition: packet-smb2.h:36
Definition: packet-smb2.h:41
Definition: packet-smb2.h:194
Definition: packet-smb2.h:61
Definition: packet-smb2.h:87
Definition: packet-smb2.h:77
Definition: packet-smb2.h:213
Definition: packet-smb.h:112
Definition: value_string.h:170
Definition: wmem_map.c:44
Definition: nstime.h:26
Definition: tvbuff-int.h:35