1 /* packet-smb.h
2 * Defines for SMB packet dissection
3 * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998, 1999 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12 #ifndef __PACKET_SMB_H__
13 #define __PACKET_SMB_H__
14
15 #include "ws_symbol_export.h"
16
17 #include <epan/proto.h>
18 #include <epan/wmem_scopes.h>
19
20 WS_DLL_PUBLIC gboolean sid_name_snooping;
21
22 /* SMB command codes, from the SNIA CIFS spec. With MSVC and a
23 * libwireshark.dll, we need a special declaration.
24 */
25 WS_DLL_PUBLIC value_string_ext smb_cmd_vals_ext;
26 WS_DLL_PUBLIC value_string_ext trans2_cmd_vals_ext;
27 WS_DLL_PUBLIC value_string_ext nt_cmd_vals_ext;
28
29 #define SMB_COM_CREATE_DIRECTORY 0x00
30 #define SMB_COM_DELETE_DIRECTORY 0x01
31 #define SMB_COM_OPEN 0x02
32 #define SMB_COM_CREATE 0x03
33 #define SMB_COM_CLOSE 0x04
34 #define SMB_COM_FLUSH 0x05
35 #define SMB_COM_DELETE 0x06
36 #define SMB_COM_RENAME 0x07
37 #define SMB_COM_QUERY_INFORMATION 0x08
38 #define SMB_COM_SET_INFORMATION 0x09
39 #define SMB_COM_READ 0x0A
40 #define SMB_COM_WRITE 0x0B
41 #define SMB_COM_LOCK_BYTE_RANGE 0x0C
42 #define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
g_cocoa_notification_backend_get_type_GCocoaNotificationBackend43 #define SMB_COM_CREATE_TEMPORARY 0x0E
44 #define SMB_COM_CREATE_NEW 0x0F
45 #define SMB_COM_CHECK_DIRECTORY 0x10
46 #define SMB_COM_PROCESS_EXIT 0x11
47 #define SMB_COM_SEEK 0x12
48 #define SMB_COM_LOCK_AND_READ 0x13
49 #define SMB_COM_WRITE_AND_UNLOCK 0x14
50 #define SMB_COM_READ_RAW 0x1A
51 #define SMB_COM_READ_MPX 0x1B
52 #define SMB_COM_READ_MPX_SECONDARY 0x1C
53 #define SMB_COM_WRITE_RAW 0x1D
54 #define SMB_COM_WRITE_MPX 0x1E
55 #define SMB_COM_WRITE_MPX_SECONDARY 0x1F
56 #define SMB_COM_WRITE_COMPLETE 0x20
57 #define SMB_COM_QUERY_SERVER 0x21
58 #define SMB_COM_SET_INFORMATION2 0x22
59 #define SMB_COM_QUERY_INFORMATION2 0x23
60 #define SMB_COM_LOCKING_ANDX 0x24
61 #define SMB_COM_TRANSACTION 0x25
62 #define SMB_COM_TRANSACTION_SECONDARY 0x26
63 #define SMB_COM_IOCTL 0x27
64 #define SMB_COM_IOCTL_SECONDARY 0x28
65 #define SMB_COM_COPY 0x29
66 #define SMB_COM_MOVE 0x2A
67 #define SMB_COM_ECHO 0x2B
68 #define SMB_COM_WRITE_AND_CLOSE 0x2C
69 #define SMB_COM_OPEN_ANDX 0x2D
70 #define SMB_COM_READ_ANDX 0x2E
71 #define SMB_COM_WRITE_ANDX 0x2F
72 #define SMB_COM_NEW_FILE_SIZE 0x30
73 #define SMB_COM_CLOSE_AND_TREE_DISC 0x31
74 #define SMB_COM_TRANSACTION2 0x32
75 #define SMB_COM_TRANSACTION2_SECONDARY 0x33
76 #define SMB_COM_FIND_CLOSE2 0x34
77 #define SMB_COM_FIND_NOTIFY_CLOSE 0x35
78 /* Used by Xenix/Unix 0x60-0x6E */
79 #define SMB_COM_TREE_CONNECT 0x70
80 #define SMB_COM_TREE_DISCONNECT 0x71
81 #define SMB_COM_NEGOTIATE 0x72
82 #define SMB_COM_SESSION_SETUP_ANDX 0x73
83 #define SMB_COM_LOGOFF_ANDX 0x74
84 #define SMB_COM_TREE_CONNECT_ANDX 0x75
85 #define SMB_COM_QUERY_INFORMATION_DISK 0x80
86 #define SMB_COM_SEARCH 0x81
87 #define SMB_COM_FIND 0x82
88 #define SMB_COM_FIND_UNIQUE 0x83
89 #define SMB_COM_FIND_CLOSE 0x84
90 #define SMB_COM_NT_TRANSACT 0xA0
91 #define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
92 #define SMB_COM_NT_CREATE_ANDX 0xA2
93 #define SMB_COM_NT_CANCEL 0xA4
94 #define SMB_COM_NT_RENAME 0xA5
95 #define SMB_COM_OPEN_PRINT_FILE 0xC0
96 #define SMB_COM_WRITE_PRINT_FILE 0xC1
97 #define SMB_COM_CLOSE_PRINT_FILE 0xC2
98 #define SMB_COM_GET_PRINT_QUEUE 0xC3
99 #define SMB_COM_READ_BULK 0xD8
100 #define SMB_COM_WRITE_BULK 0xD9
101 #define SMB_COM_WRITE_BULK_DATA 0xDA
102
103 /* Error codes */
104
105 #define SMB_SUCCESS 0x00 /* All OK */
106 #define SMB_ERRDOS 0x01 /* DOS based error */
107 #define SMB_ERRSRV 0x02 /* server error, network file manager */
108 #define SMB_ERRHRD 0x03 /* Hardware style error */
109 #define SMB_ERRCMD 0x04 /* Not an SMB format command */
110
111 /* used for SMB export object functionality */
112 typedef struct _smb_eo_t {
113 guint smbversion;
114 guint16 cmd;
115 int tid,uid;
116 guint fid;
117 guint32 pkt_num;
118 gchar *hostname;
119 gchar *filename;
120 int fid_type;
121 gint64 end_of_file;
122 gchar *content_type;
123 guint32 payload_len;
124 const guint8 *payload_data;
125 guint64 smb_file_offset;
126 guint32 smb_chunk_len;
127 } smb_eo_t;
128
129 /* the information we need to keep around for NT transaction commands */
130 typedef struct {
131 int subcmd;
132 int fid_type;
133 guint32 ioctl_function;
134 } smb_nt_transact_info_t;
g_cocoa_notification_backend_is_supportednull135
136 /* the information we need to keep around for transaction2 commands */
137 typedef struct {
138 int subcmd;
139 int info_level;
140 gboolean resume_keys; /* if "return resume" keys set in T2 FIND_FIRST request */
141 const char *name;
142 } smb_transact2_info_t;
143
144 /*
145 * The information we need to save about a request in order to show the
146 * frame number of the request in the dissection of the reply.
add_actions_to_notificationnull147 */
148 #define SMB_SIF_TID_IS_IPC 0x0001
149 #define SMB_SIF_IS_CONTINUED 0x0002
150 typedef enum {
151 SMB_EI_NONE, /* Unassigned / NULL */
152 SMB_EI_FID, /* FID */
153 SMB_EI_NTI, /* smb_nt_transact_info_t * */
154 SMB_EI_TRI, /* smb_transact_info_t * */
155 SMB_EI_T2I, /* smb_transact2_info_t * */
156 SMB_EI_TIDNAME, /* tid tracking char * */
157 SMB_EI_FILEDATA, /* fid tracking */
158 SMB_EI_FILENAME, /* filename tracking */
159 SMB_EI_UID, /* smb_uid_t */
160 SMB_EI_RWINFO, /* read/write offset/count info */
161 SMB_EI_LOCKDATA, /* locking and x data */
162 SMB_EI_RENAMEDATA, /* rename data */
163 SMB_EI_DIALECTS /* negprot dialects */
164 } smb_extra_info_t;
165
166 typedef struct _smb_fid_into_t smb_fid_info_t;
167
168 typedef struct {
169 guint32 frame_req, frame_res;
170 nstime_t req_time;
171 guint16 flags;
172 guint8 cmd;
173 void *extra_info;
174 smb_extra_info_t extra_info_type;
175 /* we save the fid in each transaction so that we can get fid filters
176 to match both request and response */
177 gboolean fid_seen_in_request;
178 guint16 fid;
179 } smb_saved_info_t;
180
181 /*
182 * The information we need to save about a Transaction request in order
183 * to dissect the reply; this includes information for use by the
184 * Remote API and Mailslot dissectors.
185 * XXX - have an additional data structure hung off of this by the
186 * subdissectors?
187 */
188 typedef struct {
189 int subcmd;
190 int trans_subcmd;
191 int function;
192 /* Unification of fid variable type (was int) */
193 guint16 fid;
194 guint16 lanman_cmd;
195 guchar *param_descrip; /* Keep these descriptors around */
196 guchar *data_descrip;
197 guchar *aux_data_descrip;
198 int info_level;
199 } smb_transact_info_t;
200
g_cocoa_notification_backend_send_notificationnull201 /*
202 * Subcommand type.
203 */
204 #define TRANSACTION_PIPE 0
205 #define TRANSACTION_MAILSLOT 1
206
207 /* these are defines used to represent different types of TIDs.
208 don't use the value 0 for any of these */
209 #define TID_NORMAL 1
210 #define TID_IPC 2
211
212 /* this is the structure which is associated with each conversation */
213 typedef struct conv_tables {
214 /* these two tables are used to match requests with responses */
215 GHashTable *unmatched;
216 GHashTable *matched;
217 /* This table keeps primary transact requests so secondaries can find
218 them */
219 GHashTable *primaries;
220
221 /* This table is used to track TID->services for a conversation */
222 GHashTable *tid_service;
223 gboolean raw_ntlmssp; /* Do extended security exc use raw ntlmssp */
224
225 /* track fid to fidstruct (filename/openframe/closeframe */
226 wmem_tree_t *fid_tree;
227 /* We'll use a GSL list instead */
228 GSList *GSL_fid_info;
229
230 /* track tid to fidstruct (sharename/shareframe/unshareframe */
231 wmem_tree_t *tid_tree;
232
233 /* track uid to username mappings */
234 wmem_tree_t *uid_tree;
235 } conv_tables_t;
236
237 typedef struct smb_info {
238 guint8 cmd;
239 int tid, pid, uid, mid;
240 guint32 nt_status;
241 gboolean unicode; /* Are strings in this SMB Unicode? */
242 gboolean request; /* Is this a request? */
243 gboolean unidir;
244 int info_level;
g_cocoa_notification_backend_withdraw_notificationnull245 int info_count;
246 smb_saved_info_t *sip; /* smb_saved_info_t, if any, for this */
247 conv_tables_t *ct;
248 } smb_info_t;
249
250 /*
251 * Show file data for a read or write.
252 */
253 extern int dissect_file_data(tvbuff_t *tvb, proto_tree *tree, int offset,
254 guint16 bc, guint16 datalen);
255
256
257 #define SMB_FID_TYPE_UNKNOWN 0
258 #define SMB_FID_TYPE_FILE 1
259 #define SMB_FID_TYPE_DIR 2
260 #define SMB_FID_TYPE_PIPE 3
261
262 /* used for tracking filenames from rename request to response */
263 typedef struct _smb_rename_saved_info_t {
264 char *old_name;
g_cocoa_notification_backend_initnull265 char *new_name;
266 } smb_rename_saved_info_t;
267
268 /* used for tracking lock data between lock request/response */
269 typedef struct _smb_lock_info_t {
g_cocoa_notification_backend_class_initnull270 struct _smb_lock_info_t *next;
271 guint16 pid;
272 guint64 offset;
273 guint64 length;
274 } smb_lock_info_t;
275
276 typedef struct _smb_locking_saved_info_t {
277 guint8 type;
278 guint8 oplock_level;
279 guint16 num_lock;
280 guint16 num_unlock;
281 smb_lock_info_t *locks;
282 smb_lock_info_t *unlocks;
283 } smb_locking_saved_info_t;
284
285 /* used for tracking fid/tid to filename/sharename openedframe closedframe */
286 typedef struct _smb_fid_saved_info_t {
287 char *filename;
288 guint32 create_flags;
289 guint32 access_mask;
290 guint32 file_attributes;
291 guint32 share_access;
292 guint32 create_options;
293 guint32 create_disposition;
294 } smb_fid_saved_info_t;
295
296 struct _smb_fid_into_t {
297 guint16 tid,fid;
298 /* The end_of_file will store the last registered offset or
299 the reported end_of_file from the SMB protocol */
300 gint64 end_of_file;
301 /* These two were int */
302 guint opened_in;
303 guint closed_in;
304 int type;
305 smb_fid_saved_info_t *fsi;
306 };
307
308 /* used for tracking tid to sharename openedframe closedframe */
309 typedef struct _smb_tid_into_t {
310 int opened_in;
311 int closed_in;
312 char *filename;
313 int type;
314 } smb_tid_info_t;
315
316
317 /*
318 * Dissect an smb FID
319 */
320 extern smb_fid_info_t *dissect_smb_fid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
321 int offset, int len, guint16 fid, gboolean is_created, gboolean is_closed, gboolean is_generated, smb_info_t* si);
322
323 /*
324 * Dissect named pipe state information.
325 */
326 extern int dissect_ipc_state(tvbuff_t *tvb, proto_tree *parent_tree,
327 int offset, gboolean setstate);
328
329 extern gboolean smb_dcerpc_reassembly;
330
331 extern const value_string create_disposition_vals[];
332
333 extern int dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
334
335 extern int dissect_nt_share_access(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
336
337 extern int dissect_smb_access_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
338
339 extern const value_string oa_open_vals[];
340 extern const value_string impersonation_level_vals[];
341
342 extern gboolean sid_display_hex;
343
344 extern int dissect_security_information_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
345
346 extern int dissect_qfsi_FS_VOLUME_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp, int unicode);
347 extern int dissect_qfsi_FS_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
348 extern int dissect_qfsi_FS_DEVICE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
349 extern int dissect_qfsi_FS_ATTRIBUTE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
350 extern int dissect_nt_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint16 *bcp);
351 extern int dissect_nt_user_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint16 *bcp);
352 extern int dissect_nt_get_user_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint32 *bcp);
353 extern int dissect_qfsi_FS_OBJECTID_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
354 extern int dissect_qfsi_FS_FULL_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
355 extern int dissect_qfi_SMB_FILE_EA_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
356 extern int dissect_qfi_SMB_FILE_STREAM_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, guint16 *bcp, gboolean *trunc, int unicode);
357 extern int dissect_qfi_SMB_FILE_NAME_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc, gboolean unicode);
358 extern int dissect_qfi_SMB_FILE_STANDARD_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
359 extern int dissect_qfi_SMB_FILE_INTERNAL_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
360 extern int dissect_qsfi_SMB_FILE_POSITION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
361 extern int dissect_qsfi_SMB_FILE_MODE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
362 extern int dissect_qfi_SMB_FILE_ALIGNMENT_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
363 extern int dissect_qfi_SMB_FILE_COMPRESSION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
364 extern int dissect_qfi_SMB_FILE_NETWORK_OPEN_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
365 extern int dissect_qfi_SMB_FILE_ATTRIBUTE_TAG_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
366 extern int dissect_qsfi_SMB_FILE_ALLOCATION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
367 extern int dissect_qsfi_SMB_FILE_ENDOFFILE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
368 extern int dissect_nt_notify_completion_filter(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
369 extern int dissect_sfi_SMB_FILE_PIPE_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
370 extern int dissect_get_dfs_request_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean unicode);
371 extern int dissect_get_dfs_referral_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean unicode);
372
373 /* Returns an IP (v4 or v6) of the server in a SMB/SMB2 conversation */
374 extern const gchar *tree_ip_str(packet_info *pinfo, guint16 cmd);
375
376 #endif
377
378 /*
379 * Editor modelines - https://www.wireshark.org/tools/modelines.html
380 *
381 * Local variables:
382 * c-basic-offset: 8
383 * tab-width: 8
384 * indent-tabs-mode: t
385 * End:
386 *
387 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
388 * :indentSize=8:tabSize=8:noTabs=false:
389 */
390