SMB ( Server Message Block )

• Share level
  Protection is applied at the share level on a server. Each share can have a password, and a client only needs that password to access all files under that share.



• User level
  Protection is applied to individual files in each share and is based on user access rights. Each user (client) must log in to the server and be authenticated by the server. When it is authenticated, the client is given a UID (User ID) which it must present on all subsequent accesses to the server.

• Connecting to and disconnecting from file and print shares.


• Opening and closing files.


• Opening and closing print files.


• Reading and writing files.


• Creating and deleting files and directories.


• Searching directories.


• Getting and setting file attributes.


• Locking and unlocking byte ranges in files.


Subsequent variants were introduced as more functionality was needed. Some of these variants and the related version of LAN Manager are:


SMB Protocol Variant	Protocol Name	Comments
PC NETWORK PROGRAM 1.0	Core Protocol	The original version of SMB as defined in IBM's PC Network Program. Some versions were called PCLAN1.0
MICROSOFT NETWORKS 1.03	Core Plus Protocol	Included Lock&Read and Write&Unlock SMBs with different versions of raw read and raw write SMBs
MICROSOFT NETWORKS 3.0	DOS LAN Manager 1.0	The same as LANMAN1.0, but OS/2 errors must be translated to DOS errors.
LANMAN1.0	LAN Manager 1.0	The full LANMAN1.0 protocol.
DOS LM1.2X002	LAN Manager 2.0	The same as LM1.2X002, but errors must be translated to DOS errors.
LM1.2X002	LAN Manager 2.0	The full LANMAN2.0 protocol.
DOS LANMAN2.1	LAN Manager 2.1	The same as LANMAN2.1, but errors must be translated to DOS errors.
LANMAN2.1	LAN Manager 2.1	The full LANMAN2.1 protocol.
Windows for Workgroups 3.1a	LAN Manager 2.1?	Windows for Workgroups 1.0?
NT LM 0.12	NT LAN Manager 1.0?	Contains special SMBs for NT
Samba	NT LAN Manager 1.0?	Samba's version of NT LM 0.12?
CIFS 1.0	NT LAN Manager 1.0	Really NT LM 0.12 plus a bit?

• Command
  Protocol commands. The following are possible commands within SMB frames:
  

  Command	Description
  [bad command]	Invalid SMB command.
  [bind (UNIX)]	Obtain file system address for file.
  [cancel forward]	Cancel server recognition of name.
  [change/check dir]	Change to directory or check path.
  [change group]	Change group association of user.
  [change password]	Change password of user.
  [close file]	Close file handle and flush buffers.
  [close spoolfile]	Close print buffer file.
  [consumer logon]	Log on with consumer validation.
  [copy file]	Copy file to specified path.
  [copy new path]	Copy file to new path name.
  [create & bind]	Create file and get file system address.
  [create directory]	Create new directory.
  [create file]	Create new or open existing file.
  [delete dir]	Delete the specified directory.
  [delete file]	Delete the specified file.
  [echo]	Request echo from server.
  [find & close]	Search for file and close directory (UNIX).
  [find & close /2]	Search for file and close directory (OS/2).
  [find first file]	Find first matching file (OS/2).
  [find unique]	Search directory for specified file.
  [flush file]	Flush all file buffers to disk.
  [fork to PID]	Provide same access rights to new process.
  [forward name]	Cause server to accept messages for name.
  [get access right]	Get access rights for specified file.
  [get exp attribs]	Get expanded attributes for file (OS/2).
  [get unix attribs]	Get expanded attributes for file (UNIX).
  [get file attribs]	Get attributes for specified file.
  [get file queue]	Get print queue listing.
  [get group info]	Get logical group associations.
  [get machine name]	Get machine name for block messages.
  [get pathname]	Get path of specified handle.
  [get resources]	Get availability of server resources.
  [get server info]	Get total and free space for server disk.
  [get user info]	Get logical user associations.
  [IOCTL]	Initiate I/O control for DOS-OS/2 devices.
  [IOCTL next]	Initiates subsequent I/O control for DOS-OS/2 devices.
  [IOCTL (UNIX)]	I/O control for UNIX-Xenix devices.
  [link file]	Make an additional path to a file.
  [lock and read]	Lock and read byte range.
  [lock bytes]	Lock specified byte range.
  [lock/unlock & X]	Lock/unlock bytes and execute next command.
  [logoff & execute]	Log off and execute next command.
  [mail announce]	Query availability of server nodes.
  [mailslot message]	Mail slot transaction message.
  [make/bind dir]	Make dir and get file system address.
  [make temp file]	Make temporary data file.
  [make new file]	Make new file only if it does not exist.
  [make node]	Make file for use as a device.
  [move file]	Move file to specified path (OS/2).
  [move new path]	Move file to specified path (UNIX/Xenix).
  [multi-block data]	Send data for multi-block message.
  [multi-block end]	Terminate multi-block message.
  [multi-block hdr]	Send header for multi-block message.
  [named pipe call]	Open, write, read, or close named pipe.
  [named pipe wait]	Wait for named pipe to become ready.
  [named pipe peek]	Look at named pipe data.
  [named pipe query]	Query named pipe handle modes.
  [named pipe set]	Set named pipe handle modes.
  [named pipe attr]	Query named pipe attributes.
  [named pipe R/W]	Named pipe read/write transaction.
  [named pipe read]	Raw mode named pipe read.
  [named pipe write]	Raw mode named pipe write.
  [negotiate protoc]	Negotiate SMB protocol version.
  [newfile & bind]	Make new file and get file system address.
  [notify close]	Close handle used to monitor file changes.
  [open file]	Open specified file.
  [open & execute]	Open specified file and execute next command.
  [open spoolfile]	Open specified print buffer file.
  [process exit]	Terminate consumer process.
  [read & execute]	Read file and execute next command.
  [read and hide]	Read directory ignoring hidden files.
  [read block mplex]	Read block data on multiplexed connection.
  [read block raw]	Read block data on unique connection.
  [read block sec/r]	Read block secondary response.
  [read check]	Check file accessibility.
  [read from file]	Read from specified file.
  [read w/options]	Read from file with specified options.
  [rename file]	Rename the specified file to a new name.
  [reserve resourcs]	Reserve resources on the server.
  [search dir]	Search directory with specified attribute.
  [seek]	Set file pointer for handle.
  [send broadcast]	Send a one block broadcast message.
  [session setup]	Log-in with consumer-based authentication.
  [set exp attrib]	Set expanded file attributes (OS/2).
  [set unix attribs]	Set expanded file attributes (UNIX/Xenix).
  [set file attribs]	Set normal file attributes.
  [single block msg]	Send a single block message.
  [transaction next]	Subsequent name transaction.
  [tree & execute]	Make virtual connection and execute next command.
  [tree connect]	Make a virtual connection.
  [tree disconect]	Detach a virtual connection.
  [unbind]	Discard file system address binding.
  [unlock bytes]	Release a locked byte range.
  [write & close]	Write to and close specified file handle.
  [write & execute]	Write to file and execute next command.
  [write & unlock]	Write to and unlock a byte range.
  [write block raw]	Write block data on unique connection.
  [write block mplx]	Write block data on multiplexed connection.
  [write block sec]	Write block secondary request.
  [write complete]	Terminate a write block sequence.
  [write spoolfile]	Write to the specified print buffer.
  [write to file]	Write to the specified file handle.
  [X2 open file]	Open file.
  [X2 find first]	Find first file.
  [X2 find next]	Find next file.
  [X2 query FS]	Get file system information.
  [X2 set FS info]	Set file system information.
  [X2 query path]	Get information on path.
  [X2 set path]	Set path information.
  [X2 query file]	Get file information.
  [X2 set info]	Set file information.
  [X2 FS control]	File system control information.
  [X2 IOCTL]	I/O control for devices.
  [X2 notify]	Monitor file for changes.
  [X2 notify next]	Subsequent file monitoring.
  [X2 make dir]	Make directory.



• RCLS
  Error Code Class. The second field of the decoded SMB protocol contains the error class and error code for each frame as in E=1/22, where 1 is the error class and 22 is the error code. The error class identifies the source of the error as shown in the following table:
  

  Error Class	Name	Source of Error
  0		No error, or error was handled by system.
  1	ERRDOS	Server operating system.
  2	ERRSRV	Server network file manager.
  3	ERRHRD	System or device.
  4	ERRXOS	Extended operating system.
  225-227	ERRRMX	RMX operating system.
  255	ERRCMD	Invalid SMB commands.



• ERR
  Error Code. The following is a list of SMB error codes/messages:
  

  Error Message	Description
  {Access denied}	Unable to service request.
  {Access list full}	Access control list full.
  {Bad attrib mode}	Invalid attributes specified.
  {Bad disk request}	Disk command invalid.
  {Bad drive spec}	Specified drive invalid.
  {Bad environment}	Environment invalid.
  {Bad EXE file}	Bad executable file format.
  {Bad file access}	Invalid access to read only file.
  {Bad file ID}	File handle invalid.
  {Bad filespec}	Path name invalid.
  {Bad format}	Format invalid.
  {Bad function}	Function not supported.
  {Bad I/O data}	Data invalid on server I/O device.
  {Bad math argument}	Math argument invalid.
  {Bad media type}	Unknown media type.
  {Bad memory block}	Memory block address invalid.
  {Bad open mode}	Open mode invalid.
  {Bad permissions}	Specified permissions invalid.
  {Bad print FID}	Print file ID invalid.
  {Bad print request}	Printer device request invalid.
  {Bad reqst length}	Bad request structure length.
  {Bad semaphore}	Semaphore identifier invalid.
  {Bad SMB command}	SMB command invalid.
  {Bad Tree ID}	Tree ID invalid.
  {Bad User ID}	User ID invalid.
  {Bad user/passwrd}	Bad password or user name.
  {Bad wait done}	Wait done for unwaited process.
  {Continue in MPX}	Continue in block multiplexed mode.
  {Can delete dir}	Cannot delete current directory.
  {Can init net}	Network cannot be initialized.
  {Can mount dev}	Device cannot be mounted.
  {Can RAW, do MPX}	Cannot use raw blocks, use multiplexed.
  {Can ren to vol}	Attempt to rename across volumes failed.
  {Can support RAW}	Cannot support raw block access.
  {Can write dir}	Attempt to write on a directory failed.
  {Command not recvd}	Initial command not received.
  {CRC data error}	Data CRC error on device.
  {Dev out of space}	Device out of space.
  {Device is remote}	Referenced device remote.
  {Dir not found}	Directory not found.
  {Disk write error}	Disk write fault.
  {Disk read error}	Disk read fault.
  {Disk seek error}	Disk seek error.
  {Drive not ready}	Drive not ready.
  {Dup filename}	File name already exists.
  {EOF on printer}	End of file found on print queue dump.
  {Err buffered}	Error message buffered.
  {Err logged}	Error message logged.
  {Err displayed}	Error message displayed.
  {File not found}	Filespec not found.
  {File too big}	Maximum file size exceeded.
  {Gen disk failure}	General disk failure.
  {Insuf acc rights}	Insufficient access rights.
  {Invalid name}	Invalid name supplied on tree connect.
  {Invalid pipe}	Invalid pipe specified.
  {Lock conflict}	Lock/Unlock conflicts with other locks.
  {Memory blks lost}	Memory control blocks destroyed.
  {More data coming}	Cannot terminate; more data coming.
  {Need block device}	File used where a block device needed.
  {Need data file}	Must specify data file.
  {No FCBs available}	Out of file control blocks.
  {No more files}	No more matching files found.
  {No proc to pipe}	No process available to pipe.
  {No read process}	Write to a pipe with no read processes.
  {No resources}	Server out of resources.
  {No room f/message}	No room to buffer message.
  {Not a directory}	Must specify directory.
  {Not receiving}	Not receiving messages.
  {No semaphores}	Semaphore not available.
  {OK}	SMB command completed successfully.
  {Out of disk space}	Print queue out of disk space.
  {Out of handles}	Too many open files.
  {Out of memory}	Insufficient memory on server.
  {Out of paper}	Printer out of paper.
  {Pipe is busy}	Pipe process busy; wait.
  {Pipe is closing}	Terminating pipe process.
  {Print Q full}	Print file queue table full.
  {Proc table full}	Server process table full.
  {Rem I/O error}	Remote I/O error.
  {Sector not found}	Sector not found.
  {Seek on pipe}	Seek was issued to a pipe.
  {Server error}	General server error.
  {Server paused}	Server paused.
  {Share buffer out}	Share buffer out of space.
  {Share conflict}	Share conflicts with existing files.
  {Syntax error}	Syntax error in path name.
  {Sys call intruptd}	Interrupted system call.
  {Table overflow}	Internal table overflow.
  {Terminal needed}	Terminal device required.
  {Timed out}	Operation has run out of time.
  {Too many links}	Too many links.
  {Too many names}	Too many remote user names.
  {Too many UIDs}	User ID limit exceeded.
  {Unit unknown}	Unknown unit.
  {Unknown error}	Non-specific error.
  {Unknwn process}	No such process.
  {Write protected}	Write on write-protected diskette.
  {Wrong diskette}	Wrong diskette inserted in drive.



• REB/FLG
  REB reserved field is associated with the Core protocol only. The Flag field appears in protocol versions later than the Core protocol.



• Tree ID
  Uniquely identifies a file sharing connection between consumer and server where this protocol uses a server-based file protection.



• Process ID
  Identify a specific consumer process within a virtual connection.



• User ID
  Used by the server to verify the file access permissions of users where consumer-based file protection is in effect.



• Multiplex ID
  Used by the server to verify the file access permissions of groups where consumer-based file protection is in effect.



• WCT
  Number of parameter words.



• VWV
  Variable number of words of parameters.



• BCC
  Number of bytes of data which follow.



• BUF
  Variable number of data bytes.

• Smbclient from Samba


• Smbfs for Linux


• SMBlib (an SMB client library that is in development)

• Samba


• Microsoft Windows for Workgroups 3.x


• Microsoft Windows 95


• Microsoft Windows NT


• The PATHWORKS family of servers from Digital


• LAN Manager for OS/2, SCO, etc


• VisionFS from SCO


• TotalNET Advanced Server from Syntax


• Advanced Server for UNIX from AT&T


• LAN Server for OS/2 from IBM

• Workgroups
  A workgroup is a collection of computers that each maintains their own security information. With Windows for Workgroups, each server is pretty much in share level security. Windows 95 can pass user authentication off to an NT or LAN Manager server.



• Domains
  A domain is a collection of computers where security is handled centrally. Each domain has one or more domain controllers. There is usually a primary domain controller and several backup domain controllers. The domain controllers maintain account style information related to users (clients), like account names, encrypted passwords, authorized hours of use, groups the user belongs to, etc.



• Samba
  Samba is a freely available SMB server for UNIX, OpenVMS developed by Andrew Tridgell and maintained by a loosely knit group of people all over the world. Samba runs on a great many UNIX variants (Linux, Solaris, SunOS, HP-UX, ULTRIX, DEC OSF/1, Digital UNIX, Dynix (Sequent), IRIX (SGI), SCO Open Server, DG-UX, UNIXWARE, AIX, BSDI, NetBSD, NEXTSTEP, A/UX, etc).



• Microsoft Windows Servers
  Microsoft has a number of SMB server implementations for the Windows range of operating systems. These are not separate products, rather, they are integral to the appropriate version of the Windows operating system. However, they can be switched off either though the Control Panel or at the command line (net stop server at DOS prompt).



• LAN Manager and LAN Manager for UNIX (LM/X)
  Microsoft and AT&T GIS ported various LAN Manager versions to the UNIX operating system. This code formed the basis of many SMB servers available for UNIX operating systems from many vendors.



• VisionFS
  VisionFS is a written-from-scratch SMB server from SCO. It is available for Solaris 2.x, HP-UX and SCO (both SCO OpenServer and UNIXware).



• TotalNET Advanced Server
  This product is from Syntax. It is a completely independently written SMB server, that was perhaps the first SMB server for UNIX. These days, it comes with additional modules providing AppleShare and NetWare serving all in the one product.



• Advanced Server for UNIX
  After LM/X, NCR (which used to be ATT GIS) (perhaps with help from Microsoft) ported the Windows NT SMB server code to UNIX to provide the same level of functionality as Windows NT.



• PATHWORKS
  PATHWORKS is the name of a product family from Digital equipment corporation. It included both servers and clients, with the servers running on:
  
  • VAX and Alpha VMS
  
  
  • VAX and MIPS ULTRIX
  
  
  • DEC OSF/1 for AXP and Digital UNIX (DEC OSF/1 renamed)
  
  
  • OS/2



• LAN Server for OS/2
  This is an IBM product that seems to be derived in some way from Microsoft's LAN Manager code.

• Microsoft Clients


• Windows NT


• Windows 95


• Windows for Workgroups 3.11


• Digital's PATHWORKS clients


• Samba's smbclient


• Linux's smbfs


• SMBlib

Example 1: SMB NegProt Connection



The client sends a SMB NegProt to the server. This will list the protocol 

dialects/protocol extensions that it understands. The server responds with the index 

of the dialect that it wants to use, or 0xFFFF if none of the dialects were acceptable.

Dialects newer than the Core and CorePlus protocols supply information in the NegProt 

response to indicate their capabilities such as max buffer size. The six important 

protocol extensions of SMB are Core, CorePlus, LAN Manager 1.0, LM 2.0, and NT 

LM 0.12 and CIFS 1.0.



          +----------+        NegProt command     +------------+ 

          |          | =========================> |            | 

          |  Client  |                            |   Server   | 

          |          | <========================= |            | 

          +----------+        NegProt response    +------------+

Example 2: SMB Sesssetup Connection



Once a protocol has been established, the client can proceed to logon to the server. 

Client now sends a SMB Session Setup command (SesssetupX), The response indicates 

whether the username password pair is valid, and if so, can provide additional 

information. One of the very important aspects of the response is a User ID value that 

must be submitted with all the subsequent SMBs sent to the server. This is used for 

user authentication.



          +----------+      Sesssetup command     +------------+ 

          |          | =========================> |            | 

          |  Client  |                            |   Server   | 

          |          | <========================= |            | 

          +----------+     Sesssetup response     +------------+

Example 3: SMB TconX Connection



After the client has logged in, it then proceeds to connect to the file tree by 

sending a SMB Tree Connect command (TconX) to the server. Here TconX stands for 

tree connect. The client sends a Tcon or SMB TconX specifying the network name of 

the share to which they want to connect, and if all is well, the server responds with 

a TID that the client will use in all future SMBs relating to that share.



          +----------+         TconX command      +------------+ 

          |          | =========================> |            | 

          |  Client  |                            |   Server   | 

          |          | <========================= |            | 

          +----------+         TconX response     +------------+



After connecting to a tree, the client can now open a file with an open SMB, followed 

by reading it with read SMBs, writing it with write SMBs, and closing it with close 

SMBs.

■ Parent layer
■ Child layer

NetBIOS SMB

SMB

Create Dir Delete Dir Open File Create File Close File Flush File Delete File Rename File Get File Attr Set File Attr Read From File Write To File Lock Byte Range Unlock Byte Range Create Temp File Make New File Check Dir Path Process Exit Seek Lock Then Read Data Write Then Unlock Data Read Block Raw Read Block Multiplexed Read Block 2nd Rsp Write Block Raw Write Block Multiplexed Write Block 2nd Req Write Complete Rsp Set File Attr Expand Get File Attr Expand Lock Byte Ranges & X Xact Name, Bytes In/Out Transaction 2nd IOCTL IOCTL 2nd Copy Move Echo Write & Close Open & X Read & X Write & X Xact2 Function, Byte In/Out Transaction2 2nd Find Close 2 Find Notify Close Tree Conn Tree Disconn Negotiate Protocol Sess Set Up And X User Logoff & X Tree Conn & X Get Server Attr Search Directory Find First Find Unique Find Close NT Transaction NT Create and X NT Cancel Open Print Spool File Write To Print Spool File Close Print Spool File Return Print Queue Send Single Block Msg Send Broadcast Msg Forward User Name Cancel Forward Get Machine Name Send SOMB Msg Send EOMB Msg Send TOMB Msg