1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
|
/*
* traffic-analyzer VFS module. Measure the smb traffic users create
* on the net.
*
* Copyright (C) Holger Hetterich, 2008
* Copyright (C) Jeremy Allison, 2008
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
/**
* Protocol version 2.0 description
*
* The following table shows the exact assembly of the 2.0 protocol.
*
* -->Header<--
* The protocol header is always send first, and contains various
* information about the data block to come.
* The header is always of fixed length, and will be send unencrypted.
*
* Byte Number/Bytes Description
* 00-02 Contains always the string "V2."
* 03 This byte contains a possible subrelease number of the
* protocol. This enables the receiver to make a version
* check to ensure the compatibility and allows us to
* release 2.x versions of the protocol with bugfixes or
* enhancements.
* 04 This byte is reserved for possible future extensions.
* 05 Usually, this byte contains the character '0'. If the
* VFS module is configured for encryption of the data,
* this byte is set to 'E'.
* 06-09 These bytes contain the character '0' by default, and
* are reserved for possible future extensions. They have
* no function in 2.0.
* 10-27 17 bytes containing a string representation of the
* number of bytes to come in the following data block.
* It is right aligned and filled from the left with '0'.
*
* -->Data Block<--
* The data block is send immediately after the header was send. It's length
* is exactly what was given in bytes 11-28 from in the header.
*
* The data block may be send encrypted.
*
* To make the data block easy for the receiver to read, it is divided into
* several sub-blocks, each with it's own header of four byte length. In each
* of the sub-headers, a string representation of the length of this block is
* to be found.
*
* Thus the formal structure is very simple:
*
* [HEADER]data[HEADER]data[HEADER]data[END]
*
* whereas [END] is exactly at the position given in bytes 11-28 of the
* header.
*
* Some data the VFS module is capturing is of use for any VFS operation.
* Therefore, there is a "common set" of data, that will be send with any
* data block. The following provides a list of this data.
* - the VFS function identifier (see VFS function ifentifier table below).
* - a timestamp to the millisecond.
* - the username (as text) who runs the VFS operation.
* - the SID of the user who run the VFS operation.
* - the domain under which the VFS operation has happened.
*
*/
/* Protocol subrelease number */
#define SMBTA_SUBRELEASE 0
/*
* Every data block sends a number of blocks sending common data
* we send the number of "common data blocks" to come very first
* so that if the receiver is using an older version of the protocol
* it knows which blocks it can ignore.
*/
#define SMBTA_COMMON_DATA_COUNT "00017"
/*
* VFS Functions identifier table. In protocol version 2, every vfs
* function is given a unique id.
*/
enum vfs_id {
/*
* care for the order here, required for compatibility
* with protocol version 1.
*/
vfs_id_read,
vfs_id_pread,
vfs_id_write,
vfs_id_pwrite,
/* end of protocol version 1 identifiers. */
vfs_id_mkdir,
vfs_id_rmdir,
vfs_id_rename,
vfs_id_chdir,
vfs_id_open,
vfs_id_close
};
/*
* Specific data sets for the VFS functions.
* A compatible receiver has to have the exact same dataset.
*/
struct open_data {
const char *filename;
mode_t mode;
int result;
};
struct close_data {
const char *filename;
int result;
};
struct mkdir_data {
const char *path;
mode_t mode;
int result;
};
struct rmdir_data {
const char *path;
int result;
};
struct rename_data {
const char *src;
const char *dst;
int result;
};
struct chdir_data {
const char *path;
int result;
};
/* rw_data used for read/write/pread/pwrite */
struct rw_data {
char *filename;
size_t len;
};
|
