1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
|
/*
* fs/cifs/smb2pdu.h
*
* Copyright (c) International Business Machines Corp., 2009, 2010
* Etersoft, 2012
* Author(s): Steve French (sfrench@us.ibm.com)
* Pavel Shilovsky (pshilovsky@samba.org) 2012
*
* This library is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published
* by the Free Software Foundation; either version 2.1 of the License, or
* (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
* the GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#ifndef _SMB2PDU_H
#define _SMB2PDU_H
#include <net/sock.h>
/*
* Note that, due to trying to use names similar to the protocol specifications,
* there are many mixed case field names in the structures below. Although
* this does not match typical Linux kernel style, it is necessary to be
* be able to match against the protocol specfication.
*
* SMB2 commands
* Some commands have minimal (wct=0,bcc=0), or uninteresting, responses
* (ie no useful data other than the SMB error code itself) and are marked such.
* Knowing this helps avoid response buffer allocations and copy in some cases.
*/
/* List of commands in host endian */
#define SMB2_NEGOTIATE_HE 0x0000
#define SMB2_SESSION_SETUP_HE 0x0001
#define SMB2_LOGOFF_HE 0x0002 /* trivial request/resp */
#define SMB2_TREE_CONNECT_HE 0x0003
#define SMB2_TREE_DISCONNECT_HE 0x0004 /* trivial req/resp */
#define SMB2_CREATE_HE 0x0005
#define SMB2_CLOSE_HE 0x0006
#define SMB2_FLUSH_HE 0x0007 /* trivial resp */
#define SMB2_READ_HE 0x0008
#define SMB2_WRITE_HE 0x0009
#define SMB2_LOCK_HE 0x000A
#define SMB2_IOCTL_HE 0x000B
#define SMB2_CANCEL_HE 0x000C
#define SMB2_ECHO_HE 0x000D
#define SMB2_QUERY_DIRECTORY_HE 0x000E
#define SMB2_CHANGE_NOTIFY_HE 0x000F
#define SMB2_QUERY_INFO_HE 0x0010
#define SMB2_SET_INFO_HE 0x0011
#define SMB2_OPLOCK_BREAK_HE 0x0012
/* The same list in little endian */
#define SMB2_NEGOTIATE cpu_to_le16(SMB2_NEGOTIATE_HE)
#define SMB2_SESSION_SETUP cpu_to_le16(SMB2_SESSION_SETUP_HE)
#define SMB2_LOGOFF cpu_to_le16(SMB2_LOGOFF_HE)
#define SMB2_TREE_CONNECT cpu_to_le16(SMB2_TREE_CONNECT_HE)
#define SMB2_TREE_DISCONNECT cpu_to_le16(SMB2_TREE_DISCONNECT_HE)
#define SMB2_CREATE cpu_to_le16(SMB2_CREATE_HE)
#define SMB2_CLOSE cpu_to_le16(SMB2_CLOSE_HE)
#define SMB2_FLUSH cpu_to_le16(SMB2_FLUSH_HE)
#define SMB2_READ cpu_to_le16(SMB2_READ_HE)
#define SMB2_WRITE cpu_to_le16(SMB2_WRITE_HE)
#define SMB2_LOCK cpu_to_le16(SMB2_LOCK_HE)
#define SMB2_IOCTL cpu_to_le16(SMB2_IOCTL_HE)
#define SMB2_CANCEL cpu_to_le16(SMB2_CANCEL_HE)
#define SMB2_ECHO cpu_to_le16(SMB2_ECHO_HE)
#define SMB2_QUERY_DIRECTORY cpu_to_le16(SMB2_QUERY_DIRECTORY_HE)
#define SMB2_CHANGE_NOTIFY cpu_to_le16(SMB2_CHANGE_NOTIFY_HE)
#define SMB2_QUERY_INFO cpu_to_le16(SMB2_QUERY_INFO_HE)
#define SMB2_SET_INFO cpu_to_le16(SMB2_SET_INFO_HE)
#define SMB2_OPLOCK_BREAK cpu_to_le16(SMB2_OPLOCK_BREAK_HE)
#define NUMBER_OF_SMB2_COMMANDS 0x0013
/* BB FIXME - analyze following length BB */
#define MAX_SMB2_HDR_SIZE 0x78 /* 4 len + 64 hdr + (2*24 wct) + 2 bct + 2 pad */
#define SMB2_PROTO_NUMBER __constant_cpu_to_le32(0x424d53fe)
/*
* SMB2 Header Definition
*
* "MBZ" : Must be Zero
* "BB" : BugBug, Something to check/review/analyze later
* "PDU" : "Protocol Data Unit" (ie a network "frame")
*
*/
#define SMB2_HEADER_STRUCTURE_SIZE __constant_le16_to_cpu(64)
struct smb2_hdr {
__be32 smb2_buf_length; /* big endian on wire */
/* length is only two or three bytes - with
one or two byte type preceding it that MBZ */
__u8 ProtocolId[4]; /* 0xFE 'S' 'M' 'B' */
__le16 StructureSize; /* 64 */
__le16 CreditCharge; /* MBZ */
__le32 Status; /* Error from server */
__le16 Command;
__le16 CreditRequest; /* CreditResponse */
__le32 Flags;
__le32 NextCommand;
__u64 MessageId; /* opaque - so can stay little endian */
__le32 ProcessId;
__u32 TreeId; /* opaque - so do not make little endian */
__u64 SessionId; /* opaque - so do not make little endian */
__u8 Signature[16];
} __packed;
struct smb2_pdu {
struct smb2_hdr hdr;
__le16 StructureSize2; /* size of wct area (varies, request specific) */
} __packed;
/*
* SMB2 flag definitions
*/
#define SMB2_FLAGS_SERVER_TO_REDIR __constant_cpu_to_le32(0x00000001)
#define SMB2_FLAGS_ASYNC_COMMAND __constant_cpu_to_le32(0x00000002)
#define SMB2_FLAGS_RELATED_OPERATIONS __constant_cpu_to_le32(0x00000004)
#define SMB2_FLAGS_SIGNED __constant_cpu_to_le32(0x00000008)
#define SMB2_FLAGS_DFS_OPERATIONS __constant_cpu_to_le32(0x10000000)
/*
* Definitions for SMB2 Protocol Data Units (network frames)
*
* See MS-SMB2.PDF specification for protocol details.
* The Naming convention is the lower case version of the SMB2
* command code name for the struct. Note that structures must be packed.
*
*/
#define SMB2_ERROR_STRUCTURE_SIZE2 __constant_le16_to_cpu(9)
struct smb2_err_rsp {
struct smb2_hdr hdr;
__le16 StructureSize;
__le16 Reserved; /* MBZ */
__le32 ByteCount; /* even if zero, at least one byte follows */
__u8 ErrorData[1]; /* variable length */
} __packed;
struct smb2_negotiate_req {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 36 */
__le16 DialectCount;
__le16 SecurityMode;
__le16 Reserved; /* MBZ */
__le32 Capabilities;
__u8 ClientGUID[16]; /* MBZ */
__le64 ClientStartTime; /* MBZ */
__le16 Dialects[2]; /* variable length */
} __packed;
/* SecurityMode flags */
#define SMB2_NEGOTIATE_SIGNING_ENABLED 0x0001
#define SMB2_NEGOTIATE_SIGNING_REQUIRED 0x0002
/* Capabilities flags */
#define SMB2_GLOBAL_CAP_DFS 0x00000001
#define SMB2_GLOBAL_CAP_LEASING 0x00000002 /* Resp only New to SMB2.1 */
#define SMB2_GLOBAL_CAP_LARGE_MTU 0X00000004 /* Resp only New to SMB2.1 */
/* Internal types */
#define SMB2_NT_FIND 0x00100000
#define SMB2_LARGE_FILES 0x00200000
struct smb2_negotiate_rsp {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 65 */
__le16 SecurityMode;
__le16 DialectRevision;
__le16 Reserved; /* MBZ */
__u8 ServerGUID[16];
__le32 Capabilities;
__le32 MaxTransactSize;
__le32 MaxReadSize;
__le32 MaxWriteSize;
__le64 SystemTime; /* MBZ */
__le64 ServerStartTime;
__le16 SecurityBufferOffset;
__le16 SecurityBufferLength;
__le32 Reserved2; /* may be any value, ignore */
__u8 Buffer[1]; /* variable length GSS security buffer */
} __packed;
struct smb2_sess_setup_req {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 25 */
__u8 VcNumber;
__u8 SecurityMode;
__le32 Capabilities;
__le32 Channel;
__le16 SecurityBufferOffset;
__le16 SecurityBufferLength;
__le64 PreviousSessionId;
__u8 Buffer[1]; /* variable length GSS security buffer */
} __packed;
/* Currently defined SessionFlags */
#define SMB2_SESSION_FLAG_IS_GUEST 0x0001
#define SMB2_SESSION_FLAG_IS_NULL 0x0002
struct smb2_sess_setup_rsp {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 9 */
__le16 SessionFlags;
__le16 SecurityBufferOffset;
__le16 SecurityBufferLength;
__u8 Buffer[1]; /* variable length GSS security buffer */
} __packed;
struct smb2_logoff_req {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
struct smb2_logoff_rsp {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
struct smb2_tree_connect_req {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 9 */
__le16 Reserved;
__le16 PathOffset;
__le16 PathLength;
__u8 Buffer[1]; /* variable length */
} __packed;
struct smb2_tree_connect_rsp {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 16 */
__u8 ShareType; /* see below */
__u8 Reserved;
__le32 ShareFlags; /* see below */
__le32 Capabilities; /* see below */
__le32 MaximalAccess;
} __packed;
/* Possible ShareType values */
#define SMB2_SHARE_TYPE_DISK 0x01
#define SMB2_SHARE_TYPE_PIPE 0x02
#define SMB2_SHARE_TYPE_PRINT 0x03
/*
* Possible ShareFlags - exactly one and only one of the first 4 caching flags
* must be set (any of the remaining, SHI1005, flags may be set individually
* or in combination.
*/
#define SMB2_SHAREFLAG_MANUAL_CACHING 0x00000000
#define SMB2_SHAREFLAG_AUTO_CACHING 0x00000010
#define SMB2_SHAREFLAG_VDO_CACHING 0x00000020
#define SMB2_SHAREFLAG_NO_CACHING 0x00000030
#define SHI1005_FLAGS_DFS 0x00000001
#define SHI1005_FLAGS_DFS_ROOT 0x00000002
#define SHI1005_FLAGS_RESTRICT_EXCLUSIVE_OPENS 0x00000100
#define SHI1005_FLAGS_FORCE_SHARED_DELETE 0x00000200
#define SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING 0x00000400
#define SHI1005_FLAGS_ACCESS_BASED_DIRECTORY_ENUM 0x00000800
#define SHI1005_FLAGS_FORCE_LEVELII_OPLOCK 0x00001000
#define SHI1005_FLAGS_ENABLE_HASH 0x00002000
/* Possible share capabilities */
#define SMB2_SHARE_CAP_DFS cpu_to_le32(0x00000008)
struct smb2_tree_disconnect_req {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
struct smb2_tree_disconnect_rsp {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
/* File Attrubutes */
#define FILE_ATTRIBUTE_READONLY 0x00000001
#define FILE_ATTRIBUTE_HIDDEN 0x00000002
#define FILE_ATTRIBUTE_SYSTEM 0x00000004
#define FILE_ATTRIBUTE_DIRECTORY 0x00000010
#define FILE_ATTRIBUTE_ARCHIVE 0x00000020
#define FILE_ATTRIBUTE_NORMAL 0x00000080
#define FILE_ATTRIBUTE_TEMPORARY 0x00000100
#define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200
#define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400
#define FILE_ATTRIBUTE_COMPRESSED 0x00000800
#define FILE_ATTRIBUTE_OFFLINE 0x00001000
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000
#define FILE_ATTRIBUTE_ENCRYPTED 0x00004000
/* Oplock levels */
#define SMB2_OPLOCK_LEVEL_NONE 0x00
#define SMB2_OPLOCK_LEVEL_II 0x01
#define SMB2_OPLOCK_LEVEL_EXCLUSIVE 0x08
#define SMB2_OPLOCK_LEVEL_BATCH 0x09
#define SMB2_OPLOCK_LEVEL_LEASE 0xFF
/* Desired Access Flags */
#define FILE_READ_DATA_LE cpu_to_le32(0x00000001)
#define FILE_WRITE_DATA_LE cpu_to_le32(0x00000002)
#define FILE_APPEND_DATA_LE cpu_to_le32(0x00000004)
#define FILE_READ_EA_LE cpu_to_le32(0x00000008)
#define FILE_WRITE_EA_LE cpu_to_le32(0x00000010)
#define FILE_EXECUTE_LE cpu_to_le32(0x00000020)
#define FILE_READ_ATTRIBUTES_LE cpu_to_le32(0x00000080)
#define FILE_WRITE_ATTRIBUTES_LE cpu_to_le32(0x00000100)
#define FILE_DELETE_LE cpu_to_le32(0x00010000)
#define FILE_READ_CONTROL_LE cpu_to_le32(0x00020000)
#define FILE_WRITE_DAC_LE cpu_to_le32(0x00040000)
#define FILE_WRITE_OWNER_LE cpu_to_le32(0x00080000)
#define FILE_SYNCHRONIZE_LE cpu_to_le32(0x00100000)
#define FILE_ACCESS_SYSTEM_SECURITY_LE cpu_to_le32(0x01000000)
#define FILE_MAXIMAL_ACCESS_LE cpu_to_le32(0x02000000)
#define FILE_GENERIC_ALL_LE cpu_to_le32(0x10000000)
#define FILE_GENERIC_EXECUTE_LE cpu_to_le32(0x20000000)
#define FILE_GENERIC_WRITE_LE cpu_to_le32(0x40000000)
#define FILE_GENERIC_READ_LE cpu_to_le32(0x80000000)
/* ShareAccess Flags */
#define FILE_SHARE_READ_LE cpu_to_le32(0x00000001)
#define FILE_SHARE_WRITE_LE cpu_to_le32(0x00000002)
#define FILE_SHARE_DELETE_LE cpu_to_le32(0x00000004)
#define FILE_SHARE_ALL_LE cpu_to_le32(0x00000007)
/* CreateDisposition Flags */
#define FILE_SUPERSEDE_LE cpu_to_le32(0x00000000)
#define FILE_OPEN_LE cpu_to_le32(0x00000001)
#define FILE_CREATE_LE cpu_to_le32(0x00000002)
#define FILE_OPEN_IF_LE cpu_to_le32(0x00000003)
#define FILE_OVERWRITE_LE cpu_to_le32(0x00000004)
#define FILE_OVERWRITE_IF_LE cpu_to_le32(0x00000005)
/* CreateOptions Flags */
#define FILE_DIRECTORY_FILE_LE cpu_to_le32(0x00000001)
/* same as #define CREATE_NOT_FILE_LE cpu_to_le32(0x00000001) */
#define FILE_WRITE_THROUGH_LE cpu_to_le32(0x00000002)
#define FILE_SEQUENTIAL_ONLY_LE cpu_to_le32(0x00000004)
#define FILE_NO_INTERMEDIATE_BUFFERRING_LE cpu_to_le32(0x00000008)
#define FILE_SYNCHRONOUS_IO_ALERT_LE cpu_to_le32(0x00000010)
#define FILE_SYNCHRONOUS_IO_NON_ALERT_LE cpu_to_le32(0x00000020)
#define FILE_NON_DIRECTORY_FILE_LE cpu_to_le32(0x00000040)
#define FILE_COMPLETE_IF_OPLOCKED_LE cpu_to_le32(0x00000100)
#define FILE_NO_EA_KNOWLEDGE_LE cpu_to_le32(0x00000200)
#define FILE_RANDOM_ACCESS_LE cpu_to_le32(0x00000800)
#define FILE_DELETE_ON_CLOSE_LE cpu_to_le32(0x00001000)
#define FILE_OPEN_BY_FILE_ID_LE cpu_to_le32(0x00002000)
#define FILE_OPEN_FOR_BACKUP_INTENT_LE cpu_to_le32(0x00004000)
#define FILE_NO_COMPRESSION_LE cpu_to_le32(0x00008000)
#define FILE_RESERVE_OPFILTER_LE cpu_to_le32(0x00100000)
#define FILE_OPEN_REPARSE_POINT_LE cpu_to_le32(0x00200000)
#define FILE_OPEN_NO_RECALL_LE cpu_to_le32(0x00400000)
#define FILE_OPEN_FOR_FREE_SPACE_QUERY_LE cpu_to_le32(0x00800000)
#define FILE_READ_RIGHTS_LE (FILE_READ_DATA_LE | FILE_READ_EA_LE \
| FILE_READ_ATTRIBUTES_LE)
#define FILE_WRITE_RIGHTS_LE (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE \
| FILE_WRITE_EA_LE | FILE_WRITE_ATTRIBUTES_LE)
#define FILE_EXEC_RIGHTS_LE (FILE_EXECUTE_LE)
/* Impersonation Levels */
#define IL_ANONYMOUS cpu_to_le32(0x00000000)
#define IL_IDENTIFICATION cpu_to_le32(0x00000001)
#define IL_IMPERSONATION cpu_to_le32(0x00000002)
#define IL_DELEGATE cpu_to_le32(0x00000003)
/* Create Context Values */
#define SMB2_CREATE_EA_BUFFER "ExtA" /* extended attributes */
#define SMB2_CREATE_SD_BUFFER "SecD" /* security descriptor */
#define SMB2_CREATE_DURABLE_HANDLE_REQUEST "DHnQ"
#define SMB2_CREATE_DURABLE_HANDLE_RECONNECT "DHnC"
#define SMB2_CREATE_ALLOCATION_SIZE "AlSi"
#define SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST "MxAc"
#define SMB2_CREATE_TIMEWARP_REQUEST "TWrp"
#define SMB2_CREATE_QUERY_ON_DISK_ID "QFid"
#define SMB2_CREATE_REQUEST_LEASE "RqLs"
struct smb2_create_req {
struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 57 */
__u8 SecurityFlags;
__u8 RequestedOplockLevel;
__le32 ImpersonationLevel;
__le64 SmbCreateFlags;
__le64 Reserved;
__le32 DesiredAccess;
__le32 FileAttributes;
__le32 ShareAccess;
__le32 CreateDisposition;
_
|