suricata
app-layer-smb.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kirby Kuehl <kkuehl@gmail.com>
22  */
23 #ifndef __APP_LAYER_SMB_H__
24 #define __APP_LAYER_SMB_H__
25 
26 #include "suricata-common.h"
27 #include "app-layer-protos.h"
28 #include "app-layer-parser.h"
29 #include "flow.h"
30 #include "stream.h"
31 #include "app-layer-nbss.h"
33 #include "app-layer-dcerpc.h"
34 
35 #ifndef HAVE_RUST
36 
37 typedef struct SMBHdr_ {
38  uint8_t protocol[4];
39  uint8_t command;
40  uint32_t status;
41  uint8_t flags;
42  uint16_t flags2;
43  uint16_t pidhigh;
45  uint16_t unused;
46  uint16_t tid;
47  uint16_t pid;
48  uint16_t uid;
49  uint16_t mid;
50 } SMBHdr;
51 
52 #define SMB_HDR_LEN 32
53 #define MINIMUM_SMB_LEN 35
54 #define NBSS_SMB_HDRS_LEN 36
55 
56 typedef struct SMBWordCount_ {
57  uint8_t wordcount;
58  uint8_t wordcountleft;
59  uint8_t *words;
60 } SMBWordCount;
61 
62 typedef struct SMBByteCount_ {
63  uint8_t bytecountbytes;
64  uint16_t bytecount;
65  uint16_t bytecountleft;
66  uint8_t *bytes;
67 } SMBByteCount;
68 
69 typedef struct SMBAndX_ {
70  uint8_t isandx;
71  uint8_t paddingparsed;
72  uint8_t andxcommand;
73  uint8_t maxchainedandx;
74  uint16_t andxoffset;
76  uint16_t datalength;
77  uint16_t datalengthhigh;
78  uint64_t dataoffset;
79 } SMBAndX;
80 
81 typedef struct SMBState_ {
83  uint16_t transaction_id;
84  uint16_t bytesprocessed;
90  uint8_t dcerpc_present;
92 } SMBState;
93 
94 #define SMB_FLAGS_SERVER_TO_REDIR 0x80
95 #define SMB_NO_SECONDARY_ANDX_COMMAND 0xff
96 
97 /* http://msdn.microsoft.com/en-us/library/dd327674.aspx */
98 #define SMB_COM_CREATE_DIRECTORY 0x00
99 #define SMB_COM_DELETE_DIRECTORY 0x01
100 #define SMB_COM_OPEN 0x02
101 #define SMB_COM_CREATE 0x03
102 #define SMB_COM_CLOSE 0x04
103 #define SMB_COM_FLUSH 0x05
104 #define SMB_COM_DELETE 0x06
105 #define SMB_COM_RENAME 0x07
106 #define SMB_COM_QUERY_INFORMATION 0x08
107 #define SMB_COM_SET_INFORMATION 0x09
108 #define SMB_COM_READ 0x0A
109 #define SMB_COM_WRITE 0x0B
110 #define SMB_COM_LOCK_BYTE_RANGE 0x0C
111 #define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
112 #define SMB_COM_CREATE_TEMPORARY 0x0E
113 #define SMB_COM_CREATE_NEW 0x0F
114 #define SMB_COM_CHECK_DIRECTORY 0x10
115 #define SMB_COM_PROCESS_EXIT 0x11
116 #define SMB_COM_SEEK 0x12
117 #define SMB_COM_LOCK_AND_READ 0x13
118 #define SMB_COM_WRITE_AND_UNLOCK 0x14
119 #define SMB_COM_READ_RAW 0x1A
120 #define SMB_COM_READ_MPX 0x1B
121 #define SMB_COM_READ_MPX_SECONDARY 0x1C
122 #define SMB_COM_WRITE_RAW 0x1D
123 #define SMB_COM_WRITE_MPX 0x1E
124 #define SMB_COM_WRITE_COMPLETE 0x20
125 #define SMB_COM_SET_INFORMATION2 0x22
126 #define SMB_COM_QUERY_INFORMATION2 0x23
127 #define SMB_COM_LOCKING_ANDX 0x24
128 #define SMB_COM_TRANSACTION 0x25
129 #define SMB_COM_TRANSACTION_SECONDARY 0x26
130 #define SMB_COM_IOCTL 0x27
131 #define SMB_COM_IOCTL_SECONDARY 0x28
132 #define SMB_COM_COPY 0x29
133 #define SMB_COM_MOVE 0x2A
134 #define SMB_COM_ECHO 0x2B
135 #define SMB_COM_WRITE_AND_CLOSE 0x2C
136 #define SMB_COM_OPEN_ANDX 0x2D
137 #define SMB_COM_READ_ANDX 0x2E
138 #define SMB_COM_WRITE_ANDX 0x2F
139 #define SMB_COM_CLOSE_AND_TREE_DISC 0x31
140 #define SMB_COM_TRANSACTION2 0x32
141 #define SMB_COM_TRANSACTION2_SECONDARY 0x33
142 #define SMB_COM_FIND_CLOSE2 0x34
143 #define SMB_COM_FIND_NOTIFY_CLOSE 0x35
144 #define SMB_COM_TREE_CONNECT 0x70
145 #define SMB_COM_TREE_DISCONNECT 0x71
146 #define SMB_COM_NEGOTIATE 0x72
147 #define SMB_COM_SESSION_SETUP_ANDX 0x73
148 #define SMB_COM_LOGOFF_ANDX 0x74
149 #define SMB_COM_TREE_CONNECT_ANDX 0x75
150 #define SMB_COM_QUERY_INFORMATION_DISK 0x80
151 #define SMB_COM_SEARCH 0x81
152 #define SMB_COM_FIND 0x82
153 #define SMB_COM_FIND_UNIQUE 0x83
154 #define SMB_COM_NT_TRANSACT 0xA0
155 #define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
156 #define SMB_COM_NT_CREATE_ANDX 0xA2
157 #define SMB_COM_NT_CANCEL 0xA4
158 #define SMB_COM_NT_RENAME 0xA5
159 #define SMB_COM_OPEN_PRINT_FILE 0xC0
160 #define SMB_COM_WRITE_PRINT_FILE 0xC1
161 #define SMB_COM_CLOSE_PRINT_FILE 0xC2
162 #define SMB_COM_GET_PRINT_QUEUE 0xC3
163 
164 int isAndX(SMBState *smb_state);
165 #endif /* HAVE_RUST */
166 
167 void RegisterSMBParsers(void);
168 void SMBParserRegisterTests(void);
169 
170 #endif /* __APP_LAYER_SMB_H__ */
171 
uint32_t status
Definition: app-layer-smb.h:40
uint8_t wordcount
Definition: app-layer-smb.h:57
uint16_t andxbytesprocessed
Definition: app-layer-smb.h:75
void RegisterSMBParsers(void)
SMBWordCount wordcount
Definition: app-layer-smb.h:86
uint8_t command
Definition: app-layer-smb.h:39
uint16_t bytesprocessed
Definition: app-layer-smb.h:84
uint16_t andxoffset
Definition: app-layer-smb.h:74
struct SMBWordCount_ SMBWordCount
uint8_t wordcountleft
Definition: app-layer-smb.h:58
uint8_t maxchainedandx
Definition: app-layer-smb.h:73
uint8_t * words
Definition: app-layer-smb.h:59
int isAndX(SMBState *smb_state)
determines if the SMB command is an ANDX command
uint8_t data_needed_for_dir
Definition: app-layer-smb.h:91
NBSSHdr nbss
Definition: app-layer-smb.h:82
uint8_t isandx
Definition: app-layer-smb.h:70
uint8_t protocol[4]
Definition: app-layer-smb.h:38
uint16_t pidhigh
Definition: app-layer-smb.h:43
uint8_t paddingparsed
Definition: app-layer-smb.h:71
uint16_t mid
Definition: app-layer-smb.h:49
uint64_t securitysignature
Definition: app-layer-smb.h:44
uint16_t tid
Definition: app-layer-smb.h:46
uint8_t * bytes
Definition: app-layer-smb.h:66
uint16_t datalength
Definition: app-layer-smb.h:76
SMBHdr smb
Definition: app-layer-smb.h:85
uint8_t flags
Definition: app-layer-smb.h:41
struct SMBState_ SMBState
void SMBParserRegisterTests(void)
uint16_t datalengthhigh
Definition: app-layer-smb.h:77
uint16_t uid
Definition: app-layer-smb.h:48
struct SMBHdr_ SMBHdr
uint8_t andxcommand
Definition: app-layer-smb.h:72
uint8_t dcerpc_present
Definition: app-layer-smb.h:90
uint16_t flags2
Definition: app-layer-smb.h:42
SMBAndX andx
Definition: app-layer-smb.h:88
uint16_t bytecountleft
Definition: app-layer-smb.h:65
struct SMBByteCount_ SMBByteCount
uint16_t pid
Definition: app-layer-smb.h:47
uint64_t dataoffset
Definition: app-layer-smb.h:78
SMBByteCount bytecount
Definition: app-layer-smb.h:87
uint16_t unused
Definition: app-layer-smb.h:45
struct SMBAndX_ SMBAndX
uint8_t bytecountbytes
Definition: app-layer-smb.h:63
DCERPCState ds
Definition: app-layer-smb.h:89
uint16_t bytecount
Definition: app-layer-smb.h:64
uint16_t transaction_id
Definition: app-layer-smb.h:83