Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-smb.h
1 /* packet-smb.h
2  * Defines for SMB packet dissection
3  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998, 1999 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_SMB_H__
13 #define __PACKET_SMB_H__
14 
15 #include "ws_symbol_export.h"
16 
17 #include <epan/proto.h>
18 #include <epan/wmem_scopes.h>
19 
20 WS_DLL_PUBLIC bool sid_name_snooping;
21 
22 /* SMB command codes, from the SNIA CIFS spec. With MSVC and a
23  * libwireshark.dll, we need a special declaration.
24  */
25 WS_DLL_PUBLIC value_string_ext smb_cmd_vals_ext;
26 WS_DLL_PUBLIC value_string_ext trans2_cmd_vals_ext;
27 WS_DLL_PUBLIC value_string_ext nt_cmd_vals_ext;
28 
29 #define SMB_COM_CREATE_DIRECTORY 0x00
30 #define SMB_COM_DELETE_DIRECTORY 0x01
31 #define SMB_COM_OPEN 0x02
32 #define SMB_COM_CREATE 0x03
33 #define SMB_COM_CLOSE 0x04
34 #define SMB_COM_FLUSH 0x05
35 #define SMB_COM_DELETE 0x06
36 #define SMB_COM_RENAME 0x07
37 #define SMB_COM_QUERY_INFORMATION 0x08
38 #define SMB_COM_SET_INFORMATION 0x09
39 #define SMB_COM_READ 0x0A
40 #define SMB_COM_WRITE 0x0B
41 #define SMB_COM_LOCK_BYTE_RANGE 0x0C
42 #define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
43 #define SMB_COM_CREATE_TEMPORARY 0x0E
44 #define SMB_COM_CREATE_NEW 0x0F
45 #define SMB_COM_CHECK_DIRECTORY 0x10
46 #define SMB_COM_PROCESS_EXIT 0x11
47 #define SMB_COM_SEEK 0x12
48 #define SMB_COM_LOCK_AND_READ 0x13
49 #define SMB_COM_WRITE_AND_UNLOCK 0x14
50 #define SMB_COM_READ_RAW 0x1A
51 #define SMB_COM_READ_MPX 0x1B
52 #define SMB_COM_READ_MPX_SECONDARY 0x1C
53 #define SMB_COM_WRITE_RAW 0x1D
54 #define SMB_COM_WRITE_MPX 0x1E
55 #define SMB_COM_WRITE_MPX_SECONDARY 0x1F
56 #define SMB_COM_WRITE_COMPLETE 0x20
57 #define SMB_COM_QUERY_SERVER 0x21
58 #define SMB_COM_SET_INFORMATION2 0x22
59 #define SMB_COM_QUERY_INFORMATION2 0x23
60 #define SMB_COM_LOCKING_ANDX 0x24
61 #define SMB_COM_TRANSACTION 0x25
62 #define SMB_COM_TRANSACTION_SECONDARY 0x26
63 #define SMB_COM_IOCTL 0x27
64 #define SMB_COM_IOCTL_SECONDARY 0x28
65 #define SMB_COM_COPY 0x29
66 #define SMB_COM_MOVE 0x2A
67 #define SMB_COM_ECHO 0x2B
68 #define SMB_COM_WRITE_AND_CLOSE 0x2C
69 #define SMB_COM_OPEN_ANDX 0x2D
70 #define SMB_COM_READ_ANDX 0x2E
71 #define SMB_COM_WRITE_ANDX 0x2F
72 #define SMB_COM_NEW_FILE_SIZE 0x30
73 #define SMB_COM_CLOSE_AND_TREE_DISC 0x31
74 #define SMB_COM_TRANSACTION2 0x32
75 #define SMB_COM_TRANSACTION2_SECONDARY 0x33
76 #define SMB_COM_FIND_CLOSE2 0x34
77 #define SMB_COM_FIND_NOTIFY_CLOSE 0x35
78 /* Used by Xenix/Unix 0x60-0x6E */
79 #define SMB_COM_TREE_CONNECT 0x70
80 #define SMB_COM_TREE_DISCONNECT 0x71
81 #define SMB_COM_NEGOTIATE 0x72
82 #define SMB_COM_SESSION_SETUP_ANDX 0x73
83 #define SMB_COM_LOGOFF_ANDX 0x74
84 #define SMB_COM_TREE_CONNECT_ANDX 0x75
85 #define SMB_COM_QUERY_INFORMATION_DISK 0x80
86 #define SMB_COM_SEARCH 0x81
87 #define SMB_COM_FIND 0x82
88 #define SMB_COM_FIND_UNIQUE 0x83
89 #define SMB_COM_FIND_CLOSE 0x84
90 #define SMB_COM_NT_TRANSACT 0xA0
91 #define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
92 #define SMB_COM_NT_CREATE_ANDX 0xA2
93 #define SMB_COM_NT_CANCEL 0xA4
94 #define SMB_COM_NT_RENAME 0xA5
95 #define SMB_COM_OPEN_PRINT_FILE 0xC0
96 #define SMB_COM_WRITE_PRINT_FILE 0xC1
97 #define SMB_COM_CLOSE_PRINT_FILE 0xC2
98 #define SMB_COM_GET_PRINT_QUEUE 0xC3
99 #define SMB_COM_READ_BULK 0xD8
100 #define SMB_COM_WRITE_BULK 0xD9
101 #define SMB_COM_WRITE_BULK_DATA 0xDA
102 
103 /* Error codes */
104 
105 #define SMB_SUCCESS 0x00 /* All OK */
106 #define SMB_ERRDOS 0x01 /* DOS based error */
107 #define SMB_ERRSRV 0x02 /* server error, network file manager */
108 #define SMB_ERRHRD 0x03 /* Hardware style error */
109 #define SMB_ERRCMD 0x04 /* Not an SMB format command */
110 
111 /* used for SMB export object functionality */
112 typedef struct _smb_eo_t {
113  guint smbversion;
114  guint16 cmd;
115  int tid,uid;
116  guint fid;
117  guint32 pkt_num;
118  gchar *hostname;
119  gchar *filename;
120  int fid_type;
121  gint64 end_of_file;
122  gchar *content_type;
123  guint32 payload_len;
124  const guint8 *payload_data;
125  guint64 smb_file_offset;
126  guint32 smb_chunk_len;
127 } smb_eo_t;
128 
129 /* the information we need to keep around for NT transaction commands */
130 typedef struct {
131  int subcmd;
132  int fid_type;
133  guint32 ioctl_function;
135 
136 /* the information we need to keep around for transaction2 commands */
137 typedef struct {
138  int subcmd;
139  int info_level;
140  gboolean resume_keys; /* if "return resume" keys set in T2 FIND_FIRST request */
141  const char *name;
143 
144 /*
145  * The information we need to save about a request in order to show the
146  * frame number of the request in the dissection of the reply.
147  */
148 #define SMB_SIF_TID_IS_IPC 0x0001
149 #define SMB_SIF_IS_CONTINUED 0x0002
150 typedef enum {
151  SMB_EI_NONE, /* Unassigned / NULL */
152  SMB_EI_FID, /* FID */
153  SMB_EI_NTI, /* smb_nt_transact_info_t * */
154  SMB_EI_TRI, /* smb_transact_info_t * */
155  SMB_EI_T2I, /* smb_transact2_info_t * */
156  SMB_EI_TIDNAME, /* tid tracking char * */
157  SMB_EI_FILEDATA, /* fid tracking */
158  SMB_EI_FILENAME, /* filename tracking */
159  SMB_EI_UID, /* smb_uid_t */
160  SMB_EI_RWINFO, /* read/write offset/count info */
161  SMB_EI_LOCKDATA, /* locking and x data */
162  SMB_EI_RENAMEDATA, /* rename data */
163  SMB_EI_DIALECTS /* negprot dialects */
164 } smb_extra_info_t;
165 
166 typedef struct _smb_fid_into_t smb_fid_info_t;
167 
168 typedef struct {
169  guint32 frame_req, frame_res;
170  nstime_t req_time;
171  guint16 flags;
172  guint8 cmd;
173  void *extra_info;
174  smb_extra_info_t extra_info_type;
175  /* we save the fid in each transaction so that we can get fid filters
176  to match both request and response */
177  gboolean fid_seen_in_request;
178  guint16 fid;
180 
181 /*
182  * The information we need to save about a Transaction request in order
183  * to dissect the reply; this includes information for use by the
184  * Remote API and Mailslot dissectors.
185  * XXX - have an additional data structure hung off of this by the
186  * subdissectors?
187  */
188 typedef struct {
189  int subcmd;
190  int trans_subcmd;
191  int function;
192  /* Unification of fid variable type (was int) */
193  guint16 fid;
194  guint16 lanman_cmd;
195  guchar *param_descrip; /* Keep these descriptors around */
196  guchar *data_descrip;
197  guchar *aux_data_descrip;
198  int info_level;
200 
201 /*
202  * Subcommand type.
203  */
204 #define TRANSACTION_PIPE 0
205 #define TRANSACTION_MAILSLOT 1
206 
207 /* these are defines used to represent different types of TIDs.
208  don't use the value 0 for any of these */
209 #define TID_NORMAL 1
210 #define TID_IPC 2
211 
212 /* this is the structure which is associated with each conversation */
213 typedef struct conv_tables {
214  /* these two tables are used to match requests with responses */
215  GHashTable *unmatched;
216  GHashTable *matched;
217  /* This table keeps primary transact requests so secondaries can find
218  them */
219  GHashTable *primaries;
220 
221  /* This table is used to track TID->services for a conversation */
222  GHashTable *tid_service;
223  gboolean raw_ntlmssp; /* Do extended security exc use raw ntlmssp */
224 
225  /* track fid to fidstruct (filename/openframe/closeframe */
226  wmem_tree_t *fid_tree;
227  /* We'll use a GSL list instead */
228  GSList *GSL_fid_info;
229 
230  /* track tid to fidstruct (sharename/shareframe/unshareframe */
231  wmem_tree_t *tid_tree;
232 
233  /* track uid to username mappings */
234  wmem_tree_t *uid_tree;
235 } conv_tables_t;
236 
237 typedef struct smb_info {
238  guint8 cmd;
239  int tid, pid, uid, mid;
240  guint32 nt_status;
241  gboolean unicode; /* Are strings in this SMB Unicode? */
242  gboolean request; /* Is this a request? */
243  gboolean unidir;
244  int info_level;
245  int info_count;
246  smb_saved_info_t *sip; /* smb_saved_info_t, if any, for this */
247  conv_tables_t *ct;
248 } smb_info_t;
249 
250 /*
251  * Show file data for a read or write.
252  */
253 extern int dissect_file_data(tvbuff_t *tvb, proto_tree *tree, int offset,
254  guint16 bc, int dataoffset, guint16 datalen);
255 
256 
257 #define SMB_FID_TYPE_UNKNOWN 0
258 #define SMB_FID_TYPE_FILE 1
259 #define SMB_FID_TYPE_DIR 2
260 #define SMB_FID_TYPE_PIPE 3
261 
262 /* used for tracking filenames from rename request to response */
263 typedef struct _smb_rename_saved_info_t {
264  char *old_name;
265  char *new_name;
267 
268 /* used for tracking lock data between lock request/response */
269 typedef struct _smb_lock_info_t {
270  struct _smb_lock_info_t *next;
271  guint16 pid;
272  guint64 offset;
273  guint64 length;
275 
277  guint8 type;
278  guint8 oplock_level;
279  guint16 num_lock;
280  guint16 num_unlock;
281  smb_lock_info_t *locks;
282  smb_lock_info_t *unlocks;
284 
285 /* used for tracking fid/tid to filename/sharename openedframe closedframe */
286 typedef struct _smb_fid_saved_info_t {
287  char *filename;
288  guint32 create_flags;
289  guint32 access_mask;
290  guint32 file_attributes;
291  guint32 share_access;
292  guint32 create_options;
293  guint32 create_disposition;
295 
297  guint16 tid,fid;
298  /* The end_of_file will store the last registered offset or
299  the reported end_of_file from the SMB protocol */
300  gint64 end_of_file;
301  /* These two were int */
302  guint opened_in;
303  guint closed_in;
304  int type;
306 };
307 
308 /* used for tracking tid to sharename openedframe closedframe */
309 typedef struct _smb_tid_into_t {
310  int opened_in;
311  int closed_in;
312  char *filename;
313  int type;
315 
316 
317 /*
318  * Dissect an smb FID
319  */
320 extern smb_fid_info_t *dissect_smb_fid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
321  int offset, int len, guint16 fid, gboolean is_created, gboolean is_closed, gboolean is_generated, smb_info_t* si);
322 
323 /*
324  * Dissect named pipe state information.
325  */
326 extern int dissect_ipc_state(tvbuff_t *tvb, proto_tree *parent_tree,
327  int offset, gboolean setstate);
328 
329 extern bool smb_dcerpc_reassembly;
330 
331 extern const value_string create_disposition_vals[];
332 
333 extern int dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
334 
335 extern int dissect_nt_share_access(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
336 
337 extern int dissect_smb_access_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
338 
339 extern const value_string oa_open_vals[];
340 extern const value_string impersonation_level_vals[];
341 
342 extern bool sid_display_hex;
343 
344 extern int dissect_security_information_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
345 
346 extern int dissect_qfsi_FS_VOLUME_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp, int unicode);
347 extern int dissect_qfsi_FS_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
348 extern int dissect_qfsi_FS_DEVICE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
349 extern int dissect_qfsi_FS_ATTRIBUTE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
350 extern int dissect_nt_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint16 *bcp);
351 extern int dissect_nt_user_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint16 *bcp);
352 extern int dissect_nt_get_user_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint32 *bcp);
353 extern int dissect_qfsi_FS_OBJECTID_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
354 extern int dissect_qfsi_FS_FULL_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
355 extern int dissect_qfi_SMB_FILE_EA_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
356 extern int dissect_qfi_SMB_FILE_STREAM_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, guint16 *bcp, bool *trunc, int unicode);
357 extern int dissect_qfi_SMB_FILE_NAME_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc, gboolean unicode);
358 extern int dissect_qfi_SMB_FILE_STANDARD_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
359 extern int dissect_qfi_SMB_FILE_INTERNAL_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
360 extern int dissect_qsfi_SMB_FILE_POSITION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
361 extern int dissect_qsfi_SMB_FILE_MODE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
362 extern int dissect_qfi_SMB_FILE_ALIGNMENT_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
363 extern int dissect_qfi_SMB_FILE_COMPRESSION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
364 extern int dissect_qfi_SMB_FILE_NETWORK_OPEN_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
365 extern int dissect_qfi_SMB_FILE_ATTRIBUTE_TAG_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
366 extern int dissect_qsfi_SMB_FILE_ALLOCATION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
367 extern int dissect_qsfi_SMB_FILE_ENDOFFILE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
368 extern int dissect_nt_notify_completion_filter(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
369 extern int dissect_sfi_SMB_FILE_PIPE_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 *bcp, bool *trunc);
370 extern int dissect_get_dfs_request_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean unicode);
371 extern int dissect_get_dfs_referral_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean unicode);
372 
373 /* Returns an IP (v4 or v6) of the server in a SMB/SMB2 conversation */
374 extern const gchar *tree_ip_str(packet_info *pinfo, guint16 cmd);
375 
376 #endif
377 
378 /*
379  * Editor modelines - https://www.wireshark.org/tools/modelines.html
380  *
381  * Local variables:
382  * c-basic-offset: 8
383  * tab-width: 8
384  * indent-tabs-mode: t
385  * End:
386  *
387  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
388  * :indentSize=8:tabSize=8:noTabs=false:
389  */
Definition: packet_info.h:44
Definition: proto.h:904
Definition: packet-smb.h:112
Definition: packet-smb.h:296
Definition: packet-smb.h:286
Definition: packet-smb.h:269
Definition: packet-smb.h:276
Definition: packet-smb.h:263
Definition: packet-smb.h:309
Definition: value_string.h:170
Definition: value_string.h:26
Definition: wmem_tree-int.h:48
Definition: packet-smb.h:213
Definition: nstime.h:26
Definition: packet-smb.h:237
Definition: packet-smb.h:130
Definition: packet-smb.h:168
Definition: packet-smb.h:137
Definition: packet-smb.h:188
Definition: tvbuff-int.h:35