summaryrefslogtreecommitdiffstats
path: root/rust/src/smb
diff options
context:
space:
mode:
Diffstat (limited to 'rust/src/smb')
-rw-r--r--rust/src/smb/auth.rs260
-rw-r--r--rust/src/smb/dcerpc.rs533
-rw-r--r--rust/src/smb/dcerpc_records.rs247
-rw-r--r--rust/src/smb/debug.rs74
-rw-r--r--rust/src/smb/detect.rs194
-rw-r--r--rust/src/smb/error.rs35
-rw-r--r--rust/src/smb/events.rs80
-rw-r--r--rust/src/smb/files.rs244
-rw-r--r--rust/src/smb/funcs.rs114
-rw-r--r--rust/src/smb/log.rs458
-rw-r--r--rust/src/smb/mod.rs47
-rw-r--r--rust/src/smb/nbss_records.rs223
-rw-r--r--rust/src/smb/ntlmssp_records.rs211
-rw-r--r--rust/src/smb/session.rs69
-rw-r--r--rust/src/smb/smb.rs2435
-rw-r--r--rust/src/smb/smb1.rs1155
-rw-r--r--rust/src/smb/smb1_records.rs880
-rw-r--r--rust/src/smb/smb1_session.rs202
-rw-r--r--rust/src/smb/smb2.rs913
-rw-r--r--rust/src/smb/smb2_ioctl.rs133
-rw-r--r--rust/src/smb/smb2_records.rs903
-rw-r--r--rust/src/smb/smb2_session.rs85
-rw-r--r--rust/src/smb/smb3.rs59
-rw-r--r--rust/src/smb/smb_records.rs53
-rw-r--r--rust/src/smb/smb_status.rs3609
25 files changed, 13216 insertions, 0 deletions
diff --git a/rust/src/smb/auth.rs b/rust/src/smb/auth.rs
new file mode 100644
index 0000000..c5d20bb
--- /dev/null
+++ b/rust/src/smb/auth.rs
@@ -0,0 +1,260 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::kerberos::*;
+
+use crate::smb::ntlmssp_records::*;
+use crate::smb::smb::*;
+
+use nom7::{Err, IResult};
+use der_parser6::ber::BerObjectContent;
+use der_parser6::der::{parse_der_oid, parse_der_sequence};
+
+fn parse_secblob_get_spnego(blob: &[u8]) -> IResult<&[u8], &[u8], SecBlobError>
+{
+ let (rem, base_o) = der_parser6::parse_der(blob).map_err(Err::convert)?;
+ SCLogDebug!("parse_secblob_get_spnego: base_o {:?}", base_o);
+ let d = match base_o.content.as_slice() {
+ Err(_) => { return Err(Err::Error(SecBlobError::NotSpNego)); },
+ Ok(d) => d,
+ };
+ let (next, o) = parse_der_oid(d).map_err(Err::convert)?;
+ SCLogDebug!("parse_secblob_get_spnego: sub_o {:?}", o);
+
+ let oid = match o.content.as_oid() {
+ Ok(oid) => oid,
+ Err(_) => {
+ return Err(Err::Error(SecBlobError::NotSpNego));
+ },
+ };
+ SCLogDebug!("oid {}", oid.to_string());
+
+ match oid.to_string().as_str() {
+ "1.3.6.1.5.5.2" => {
+ SCLogDebug!("SPNEGO {}", oid);
+ },
+ _ => {
+ return Err(Err::Error(SecBlobError::NotSpNego));
+ },
+ }
+
+ SCLogDebug!("parse_secblob_get_spnego: next {:?}", next);
+ SCLogDebug!("parse_secblob_get_spnego: DONE");
+ Ok((rem, next))
+}
+
+fn parse_secblob_spnego_start(blob: &[u8]) -> IResult<&[u8], &[u8], SecBlobError>
+{
+ let (rem, o) = der_parser6::parse_der(blob).map_err(Err::convert)?;
+ let d = match o.content.as_slice() {
+ Ok(d) => {
+ SCLogDebug!("d: next data len {}",d.len());
+ d
+ },
+ _ => {
+ return Err(Err::Error(SecBlobError::NotSpNego));
+ },
+ };
+ Ok((rem, d))
+}
+
+#[derive(Debug, PartialEq)]
+pub struct SpnegoRequest {
+ pub krb: Option<Kerberos5Ticket>,
+ pub ntlmssp: Option<NtlmsspData>,
+}
+
+fn parse_secblob_spnego(blob: &[u8]) -> Option<SpnegoRequest>
+{
+ let mut have_ntlmssp = false;
+ let mut have_kerberos = false;
+ let mut kticket : Option<Kerberos5Ticket> = None;
+ let mut ntlmssp : Option<NtlmsspData> = None;
+
+ let o = match parse_der_sequence(blob) {
+ Ok((_, o)) => o,
+ _ => { return None; },
+ };
+ for s in o {
+ SCLogDebug!("s {:?}", s);
+
+ let n = match s.content.as_slice() {
+ Ok(s) => s,
+ _ => { continue; },
+ };
+ let o = match der_parser6::parse_der(n) {
+ Ok((_,x)) => x,
+ _ => { continue; },
+ };
+ SCLogDebug!("o {:?}", o);
+ match o.content {
+ BerObjectContent::Sequence(ref seq) => {
+ for se in seq {
+ SCLogDebug!("SEQ {:?}", se);
+ match se.content {
+ BerObjectContent::OID(ref oid) => {
+ SCLogDebug!("OID {:?}", oid);
+ match oid.to_string().as_str() {
+ "1.2.840.48018.1.2.2" => { SCLogDebug!("Microsoft Kerberos 5"); },
+ "1.2.840.113554.1.2.2" => { SCLogDebug!("Kerberos 5"); have_kerberos = true; },
+ "1.2.840.113554.1.2.2.1" => { SCLogDebug!("krb5-name"); },
+ "1.2.840.113554.1.2.2.2" => { SCLogDebug!("krb5-principal"); },
+ "1.2.840.113554.1.2.2.3" => { SCLogDebug!("krb5-user-to-user-mech"); },
+ "1.3.6.1.4.1.311.2.2.10" => { SCLogDebug!("NTLMSSP"); have_ntlmssp = true; },
+ "1.3.6.1.4.1.311.2.2.30" => { SCLogDebug!("NegoEx"); },
+ _ => { SCLogDebug!("unexpected OID {:?}", oid); },
+ }
+ },
+ _ => { SCLogDebug!("expected OID, got {:?}", se); },
+ }
+ }
+ },
+ BerObjectContent::OctetString(os) => {
+ if have_kerberos {
+ if let Ok((_, t)) = parse_kerberos5_request(os) {
+ kticket = Some(t)
+ }
+ }
+
+ if have_ntlmssp && kticket.is_none() {
+ SCLogDebug!("parsing expected NTLMSSP");
+ ntlmssp = parse_ntlmssp_blob(os);
+ }
+ },
+ _ => {},
+ }
+ }
+
+ let s = SpnegoRequest {
+ krb: kticket,
+ ntlmssp,
+ };
+ Some(s)
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct NtlmsspData {
+ pub host: Vec<u8>,
+ pub user: Vec<u8>,
+ pub domain: Vec<u8>,
+ pub version: Option<NTLMSSPVersion>,
+ pub warning: bool,
+}
+
+/// take in blob, search for the header and parse it
+fn parse_ntlmssp_blob(blob: &[u8]) -> Option<NtlmsspData>
+{
+ let mut ntlmssp_data : Option<NtlmsspData> = None;
+
+ SCLogDebug!("NTLMSSP {:?}", blob);
+ if let Ok((_, nd)) = parse_ntlmssp(blob) {
+ SCLogDebug!("NTLMSSP TYPE {}/{} nd {:?}",
+ nd.msg_type, &ntlmssp_type_string(nd.msg_type), nd);
+ match nd.msg_type {
+ NTLMSSP_NEGOTIATE => {
+ },
+ NTLMSSP_AUTH => {
+ if let Ok((_, ad)) = parse_ntlm_auth_record(nd.data) {
+ SCLogDebug!("auth data {:?}", ad);
+ let mut host = ad.host.to_vec();
+ host.retain(|&i|i != 0x00);
+ let mut user = ad.user.to_vec();
+ user.retain(|&i|i != 0x00);
+ let mut domain = ad.domain.to_vec();
+ domain.retain(|&i|i != 0x00);
+
+ let d = NtlmsspData {
+ host,
+ user,
+ domain,
+ warning: ad.warning,
+ version: ad.version,
+ };
+ ntlmssp_data = Some(d);
+ }
+ },
+ _ => {},
+ }
+ }
+ return ntlmssp_data;
+}
+
+// if spnego parsing fails try to fall back to ntlmssp
+pub fn parse_secblob(blob: &[u8]) -> Option<SpnegoRequest>
+{
+ match parse_secblob_get_spnego(blob) {
+ Ok((_, spnego)) => {
+ match parse_secblob_spnego_start(spnego) {
+ Ok((_, spnego_start)) => {
+ parse_secblob_spnego(spnego_start)
+ },
+ _ => {
+ match parse_ntlmssp_blob(blob) {
+ Some(n) => {
+ let s = SpnegoRequest {
+ krb: None,
+ ntlmssp: Some(n),
+ };
+ Some(s)
+ },
+ None => { None },
+ }
+ },
+ }
+ },
+ _ => {
+ match parse_ntlmssp_blob(blob) {
+ Some(n) => {
+ let s = SpnegoRequest {
+ krb: None,
+ ntlmssp: Some(n),
+ };
+ Some(s)
+ },
+ None => { None },
+ }
+ },
+ }
+}
+#[cfg(test)]
+mod tests {
+ use super::*;
+ #[test]
+ fn test_parse_secblob() {
+ // smb2.security_blob
+ let blob = hex::decode("a18202313082022da0030a0101a28202100482020c4e544c4d5353500003000000180018009c00000048014801b40000001e001e005800000008000800760000001e001e007e00000010001000fc010000158288e20a005a290000000fc6107a73184fb65fe684f6a1641464be4400450053004b0054004f0050002d0032004100450046004d003700470075007300650072004400450053004b0054004f0050002d0032004100450046004d003700470000000000000000000000000000000000000000000000000028a0c9f4e792c408913d2878feaa9a22010100000000000078a7ed218527d2010cf876f08a0b3bfa0000000002001e004400450053004b0054004f0050002d00560031004600410030005500510001001e004400450053004b0054004f0050002d00560031004600410030005500510004001e004400450053004b0054004f0050002d00560031004600410030005500510003001e004400450053004b0054004f0050002d0056003100460041003000550051000700080078a7ed218527d20106000400020000000800300030000000000000000100000000200000ad865b6d08a95d0e76a94e2ca013ab3f69c4fd945cca01b277700fd2b305ca010a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100390039002e003100330033000000000000000000000000005858824ec4a47b3b42ad3132ab84a5c3a31204100100000092302d756840453f00000000").unwrap();
+ let result = parse_secblob(&blob);
+ assert_eq!(
+ result,
+ Some(SpnegoRequest {
+ krb: None,
+ ntlmssp: Some(NtlmsspData {
+ host: b"DESKTOP-2AEFM7G".to_vec(),
+ user: b"user".to_vec(),
+ domain: b"DESKTOP-2AEFM7G".to_vec(),
+ version: Some(NTLMSSPVersion {
+ ver_major: 10,
+ ver_minor: 0,
+ ver_build: 10586,
+ ver_ntlm_rev: 15,
+ },),
+ warning: false,
+ }),
+ })
+ );
+ }
+}
diff --git a/rust/src/smb/dcerpc.rs b/rust/src/smb/dcerpc.rs
new file mode 100644
index 0000000..b4c5749
--- /dev/null
+++ b/rust/src/smb/dcerpc.rs
@@ -0,0 +1,533 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+// written by Victor Julien
+
+use uuid;
+use crate::smb::smb::*;
+use crate::smb::smb2::*;
+use crate::smb::dcerpc_records::*;
+use crate::smb::events::*;
+use crate::dcerpc::dcerpc::*;
+use crate::smb::smb_status::*;
+
+impl SMBCommonHdr {
+ /// helper for DCERPC tx tracking. Check if we need
+ /// to use the msg_id/multiplex_id in TX tracking.
+ ///
+ pub fn to_dcerpc(&self, vercmd: &SMBVerCmdStat) -> SMBCommonHdr {
+ // only use the msg id for IOCTL, not for READ/WRITE
+ // as there request/response are different transactions
+ let mut use_msg_id = self.msg_id;
+ match vercmd.get_version() {
+ 2 => {
+ let (_, cmd2) = vercmd.get_smb2_cmd();
+ let x = match cmd2 {
+ SMB2_COMMAND_READ => { 0 },
+ SMB2_COMMAND_WRITE => { 0 },
+ SMB2_COMMAND_IOCTL => { self.msg_id },
+ _ => { self.msg_id },
+ };
+ use_msg_id = x;
+ },
+ 1 => {
+ SCLogDebug!("FIXME TODO");
+ //let (_, cmd1) = vercmd.get_smb1_cmd();
+ //if cmd1 != SMB1_COMMAND_IOCTL {
+ use_msg_id = 0;
+ //}
+ },
+ _ => { },
+ }
+ SMBCommonHdr {
+ ssn_id: self.ssn_id,
+ tree_id: self.tree_id,
+ msg_id: use_msg_id,
+ rec_type: SMBHDR_TYPE_DCERPCTX,
+ }
+ }
+}
+
+#[derive(Default, Debug)]
+pub struct DCERPCIface {
+ pub uuid: Vec<u8>,
+ pub ver: u16,
+ pub ver_min: u16,
+ pub ack_result: u16,
+ pub ack_reason: u16,
+ pub acked: bool,
+ pub context_id: u16,
+}
+
+impl DCERPCIface {
+ pub fn new(uuid: Vec<u8>, ver: u16, ver_min: u16) -> Self {
+ Self {
+ uuid,
+ ver,
+ ver_min,
+ ..Default::default()
+ }
+ }
+}
+
+#[derive(Default, Debug)]
+pub struct SMBTransactionDCERPC {
+ pub opnum: u16,
+ pub context_id: u16,
+ pub req_cmd: u8,
+ pub req_set: bool,
+ pub res_cmd: u8,
+ pub res_set: bool,
+ pub call_id: u32,
+ pub frag_cnt_ts: u16,
+ pub frag_cnt_tc: u16,
+ pub stub_data_ts: Vec<u8>,
+ pub stub_data_tc: Vec<u8>,
+}
+
+impl SMBTransactionDCERPC {
+ fn new_request(req: u8, call_id: u32) -> Self {
+ return Self {
+ opnum: 0,
+ context_id: 0,
+ req_cmd: req,
+ req_set: true,
+ call_id,
+ ..Default::default()
+ }
+ }
+ fn new_response(call_id: u32) -> Self {
+ return Self {
+ call_id,
+ ..Default::default()
+ };
+ }
+ pub fn set_result(&mut self, res: u8) {
+ self.res_set = true;
+ self.res_cmd = res;
+ }
+}
+
+impl SMBState {
+ fn new_dcerpc_tx(&mut self, hdr: SMBCommonHdr, vercmd: SMBVerCmdStat, cmd: u8, call_id: u32)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ tx.hdr = hdr;
+ tx.vercmd = vercmd;
+ tx.type_data = Some(SMBTransactionTypeData::DCERPC(
+ SMBTransactionDCERPC::new_request(cmd, call_id)));
+
+ SCLogDebug!("SMB: TX DCERPC created: ID {} hdr {:?}", tx.id, tx.hdr);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ fn new_dcerpc_tx_for_response(&mut self, hdr: SMBCommonHdr, vercmd: SMBVerCmdStat, call_id: u32)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ tx.hdr = hdr;
+ tx.vercmd = vercmd;
+ tx.type_data = Some(SMBTransactionTypeData::DCERPC(
+ SMBTransactionDCERPC::new_response(call_id)));
+
+ SCLogDebug!("SMB: TX DCERPC created: ID {} hdr {:?}", tx.id, tx.hdr);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ fn get_dcerpc_tx(&mut self, hdr: &SMBCommonHdr, vercmd: &SMBVerCmdStat, call_id: u32)
+ -> Option<&mut SMBTransaction>
+ {
+ let dce_hdr = hdr.to_dcerpc(vercmd);
+
+ SCLogDebug!("looking for {:?}", dce_hdr);
+ for tx in &mut self.transactions {
+ let found = dce_hdr.compare(&tx.hdr.to_dcerpc(vercmd)) &&
+ match tx.type_data {
+ Some(SMBTransactionTypeData::DCERPC(ref x)) => {
+ x.call_id == call_id
+ },
+ _ => { false },
+ };
+ if found {
+ return Some(tx);
+ }
+ }
+ return None;
+ }
+}
+
+/// Handle DCERPC request data from a WRITE, IOCTL or TRANS record.
+/// return bool indicating whether an tx has been created/updated.
+///
+pub fn smb_write_dcerpc_record(state: &mut SMBState,
+ vercmd: SMBVerCmdStat,
+ hdr: SMBCommonHdr,
+ data: &[u8]) -> bool
+{
+ let mut bind_ifaces : Option<Vec<DCERPCIface>> = None;
+ let mut is_bind = false;
+
+ SCLogDebug!("called for {} bytes of data", data.len());
+ match parse_dcerpc_record(data) {
+ Ok((_, dcer)) => {
+ SCLogDebug!("DCERPC: version {}.{} write data {} => {:?}",
+ dcer.version_major, dcer.version_minor, dcer.data.len(), dcer);
+
+ /* if this isn't the first frag, simply update the existing
+ * tx with the additional stub data */
+ if dcer.packet_type == DCERPC_TYPE_REQUEST && !dcer.first_frag {
+ SCLogDebug!("NOT the first frag. Need to find an existing TX");
+ match parse_dcerpc_request_record(dcer.data, dcer.frag_len, dcer.little_endian) {
+ Ok((_, recr)) => {
+ let found = match state.get_dcerpc_tx(&hdr, &vercmd, dcer.call_id) {
+ Some(tx) => {
+ SCLogDebug!("previous CMD {} found at tx {} => {:?}",
+ dcer.packet_type, tx.id, tx);
+ if let Some(SMBTransactionTypeData::DCERPC(ref mut tdn)) = tx.type_data {
+ SCLogDebug!("additional frag of size {}", recr.data.len());
+ tdn.stub_data_ts.extend_from_slice(recr.data);
+ tdn.frag_cnt_ts += 1;
+ SCLogDebug!("stub_data now {}", tdn.stub_data_ts.len());
+ }
+ if dcer.last_frag {
+ SCLogDebug!("last frag set, so request side of DCERPC closed");
+ tx.request_done = true;
+ } else {
+ SCLogDebug!("NOT last frag, so request side of DCERPC remains open");
+ }
+ true
+ },
+ None => {
+ SCLogDebug!("NO previous CMD {} found", dcer.packet_type);
+ false
+ },
+ };
+ return found;
+ },
+ _ => {
+ state.set_event(SMBEvent::MalformedData);
+ return false;
+ },
+ }
+ }
+
+ let tx = state.new_dcerpc_tx(hdr, vercmd, dcer.packet_type, dcer.call_id);
+ match dcer.packet_type {
+ DCERPC_TYPE_REQUEST => {
+ match parse_dcerpc_request_record(dcer.data, dcer.frag_len, dcer.little_endian) {
+ Ok((_, recr)) => {
+ SCLogDebug!("DCERPC: REQUEST {:?}", recr);
+ if let Some(SMBTransactionTypeData::DCERPC(ref mut tdn)) = tx.type_data {
+ SCLogDebug!("first frag size {}", recr.data.len());
+ tdn.stub_data_ts.extend_from_slice(recr.data);
+ tdn.opnum = recr.opnum;
+ tdn.context_id = recr.context_id;
+ tdn.frag_cnt_ts += 1;
+ SCLogDebug!("DCERPC: REQUEST opnum {} stub data len {}",
+ tdn.opnum, tdn.stub_data_ts.len());
+ }
+ if dcer.last_frag {
+ tx.request_done = true;
+ } else {
+ SCLogDebug!("NOT last frag, so request side of DCERPC remains open");
+ }
+ },
+ _ => {
+ tx.set_event(SMBEvent::MalformedData);
+ tx.request_done = true;
+ },
+ }
+ },
+ DCERPC_TYPE_BIND => {
+ let brec = if dcer.little_endian {
+ parse_dcerpc_bind_record(dcer.data)
+ } else {
+ parse_dcerpc_bind_record_big(dcer.data)
+ };
+ match brec {
+ Ok((_, bindr)) => {
+ is_bind = true;
+ SCLogDebug!("SMB DCERPC {:?} BIND {:?}", dcer, bindr);
+
+ if !bindr.ifaces.is_empty() {
+ let mut ifaces: Vec<DCERPCIface> = Vec::new();
+ for i in bindr.ifaces {
+ let x = if dcer.little_endian {
+ vec![i.iface[3], i.iface[2], i.iface[1], i.iface[0],
+ i.iface[5], i.iface[4], i.iface[7], i.iface[6],
+ i.iface[8], i.iface[9], i.iface[10], i.iface[11],
+ i.iface[12], i.iface[13], i.iface[14], i.iface[15]]
+ } else {
+ i.iface.to_vec()
+ };
+ let uuid_str = uuid::Uuid::from_slice(&x.clone());
+ let _uuid_str = uuid_str.map(|uuid_str| uuid_str.to_hyphenated().to_string()).unwrap();
+ let d = DCERPCIface::new(x,i.ver,i.ver_min);
+ SCLogDebug!("UUID {} version {}/{} bytes {:?}",
+ _uuid_str,
+ i.ver, i.ver_min,i.iface);
+ ifaces.push(d);
+ }
+ bind_ifaces = Some(ifaces);
+ }
+ },
+ _ => {
+ tx.set_event(SMBEvent::MalformedData);
+ },
+ }
+ tx.request_done = true;
+ }
+ 21..=255 => {
+ tx.set_event(SMBEvent::MalformedData);
+ tx.request_done = true;
+ },
+ _ => {
+ // valid type w/o special processing
+ tx.request_done = true;
+ },
+ }
+ },
+ _ => {
+ state.set_event(SMBEvent::MalformedData);
+ },
+ }
+
+ if is_bind {
+ // We have to write here the interfaces
+ // rather than in the BIND block
+ // due to borrow issues with the tx mutable reference
+ // that is part of the state
+ state.dcerpc_ifaces = bind_ifaces; // TODO store per ssn
+ }
+ return true;
+}
+
+/// Update TX for bind ack. Needs to update both tx and state.
+///
+fn smb_dcerpc_response_bindack(
+ state: &mut SMBState,
+ vercmd: SMBVerCmdStat,
+ hdr: SMBCommonHdr,
+ dcer: &DceRpcRecord,
+ ntstatus: u32)
+{
+ match parse_dcerpc_bindack_record(dcer.data) {
+ Ok((_, bindackr)) => {
+ SCLogDebug!("SMB READ BINDACK {:?}", bindackr);
+
+ let found = match state.get_dcerpc_tx(&hdr, &vercmd, dcer.call_id) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::DCERPC(ref mut tdn)) = tx.type_data {
+ tdn.set_result(DCERPC_TYPE_BINDACK);
+ }
+ tx.vercmd.set_ntstatus(ntstatus);
+ tx.response_done = true;
+ true
+ },
+ None => false,
+ };
+ if found {
+ if let Some(ref mut ifaces) = state.dcerpc_ifaces {
+ for (i, r) in bindackr.results.into_iter().enumerate() {
+ if i >= ifaces.len() {
+ // TODO set event: more acks that requests
+ break;
+ }
+ ifaces[i].ack_result = r.ack_result;
+ ifaces[i].acked = true;
+ }
+ }
+ }
+ },
+ _ => {
+ state.set_event(SMBEvent::MalformedData);
+ },
+ }
+}
+
+fn smb_read_dcerpc_record_error(state: &mut SMBState,
+ hdr: SMBCommonHdr, vercmd: SMBVerCmdStat, ntstatus: u32)
+ -> bool
+{
+ let ver = vercmd.get_version();
+ let cmd = if ver == 2 {
+ let (_, c) = vercmd.get_smb2_cmd();
+ c
+ } else {
+ let (_, c) = vercmd.get_smb1_cmd();
+ c as u16
+ };
+
+ let found = match state.get_generic_tx(ver, cmd, &hdr) {
+ Some(tx) => {
+ SCLogDebug!("found");
+ tx.set_status(ntstatus, false);
+ tx.response_done = true;
+ true
+ },
+ None => {
+ SCLogDebug!("NOT found");
+ false
+ },
+ };
+ return found;
+}
+
+fn dcerpc_response_handle(tx: &mut SMBTransaction,
+ vercmd: SMBVerCmdStat,
+ dcer: &DceRpcRecord)
+{
+ let (_, ntstatus) = vercmd.get_ntstatus();
+ match dcer.packet_type {
+ DCERPC_TYPE_RESPONSE => {
+ match parse_dcerpc_response_record(dcer.data, dcer.frag_len) {
+ Ok((_, respr)) => {
+ SCLogDebug!("SMBv1 READ RESPONSE {:?}", respr);
+ if let Some(SMBTransactionTypeData::DCERPC(ref mut tdn)) = tx.type_data {
+ SCLogDebug!("CMD 11 found at tx {}", tx.id);
+ tdn.set_result(DCERPC_TYPE_RESPONSE);
+ tdn.stub_data_tc.extend_from_slice(respr.data);
+ tdn.frag_cnt_tc += 1;
+ }
+ tx.vercmd.set_ntstatus(ntstatus);
+ tx.response_done = dcer.last_frag;
+ },
+ _ => {
+ tx.set_event(SMBEvent::MalformedData);
+ },
+ }
+ },
+ DCERPC_TYPE_BINDACK => {
+ // handled elsewhere
+ },
+ 21..=255 => {
+ if let Some(SMBTransactionTypeData::DCERPC(ref mut tdn)) = tx.type_data {
+ tdn.set_result(dcer.packet_type);
+ }
+ tx.vercmd.set_ntstatus(ntstatus);
+ tx.response_done = true;
+ tx.set_event(SMBEvent::MalformedData);
+ }
+ _ => { // valid type w/o special processing
+ if let Some(SMBTransactionTypeData::DCERPC(ref mut tdn)) = tx.type_data {
+ tdn.set_result(dcer.packet_type);
+ }
+ tx.vercmd.set_ntstatus(ntstatus);
+ tx.response_done = true;
+ },
+ }
+}
+
+/// Handle DCERPC reply record. Called for READ, TRANS, IOCTL
+///
+pub fn smb_read_dcerpc_record(state: &mut SMBState,
+ vercmd: SMBVerCmdStat,
+ hdr: SMBCommonHdr,
+ guid: &[u8],
+ indata: &[u8]) -> bool
+{
+ let (_, ntstatus) = vercmd.get_ntstatus();
+
+ if ntstatus != SMB_NTSTATUS_SUCCESS && ntstatus != SMB_NTSTATUS_BUFFER_OVERFLOW {
+ return smb_read_dcerpc_record_error(state, hdr, vercmd, ntstatus);
+ }
+
+ SCLogDebug!("lets first see if we have prior data");
+ // msg_id 0 as this data crosses cmd/reply pairs
+ let ehdr = SMBHashKeyHdrGuid::new(SMBCommonHdr::new(SMBHDR_TYPE_TRANS_FRAG,
+ hdr.ssn_id, hdr.tree_id, 0_u64), guid.to_vec());
+ let mut prevdata = match state.ssnguid2vec_map.remove(&ehdr) {
+ Some(s) => s,
+ None => Vec::new(),
+ };
+ SCLogDebug!("indata {} prevdata {}", indata.len(), prevdata.len());
+ prevdata.extend_from_slice(indata);
+ let data = prevdata;
+
+ let mut malformed = false;
+
+ if data.is_empty() {
+ SCLogDebug!("weird: no DCERPC data"); // TODO
+ // TODO set event?
+ return false;
+
+ } else {
+ match parse_dcerpc_record(&data) {
+ Ok((_, dcer)) => {
+ SCLogDebug!("DCERPC: version {}.{} read data {} => {:?}",
+ dcer.version_major, dcer.version_minor, dcer.data.len(), dcer);
+
+ if ntstatus == SMB_NTSTATUS_BUFFER_OVERFLOW && data.len() < dcer.frag_len as usize {
+ SCLogDebug!("short record {} < {}: storing partial data in state",
+ data.len(), dcer.frag_len);
+ state.ssnguid2vec_map.insert(ehdr, data.to_vec());
+ return true; // TODO review
+ }
+
+ if dcer.packet_type == DCERPC_TYPE_BINDACK {
+ smb_dcerpc_response_bindack(state, vercmd, hdr, &dcer, ntstatus);
+ return true;
+ }
+
+ let found = match state.get_dcerpc_tx(&hdr, &vercmd, dcer.call_id) {
+ Some(tx) => {
+ dcerpc_response_handle(tx, vercmd.clone(), &dcer);
+ true
+ },
+ None => {
+ SCLogDebug!("no tx");
+ false
+ },
+ };
+ if !found {
+ // pick up DCERPC tx even if we missed the request
+ let tx = state.new_dcerpc_tx_for_response(hdr, vercmd.clone(), dcer.call_id);
+ dcerpc_response_handle(tx, vercmd, &dcer);
+ }
+ },
+ _ => {
+ malformed = true;
+ },
+ }
+ }
+
+ if malformed {
+ state.set_event(SMBEvent::MalformedData);
+ }
+
+ return true;
+}
+
+/// Try to find out if the input data looks like DCERPC
+pub fn smb_dcerpc_probe(data: &[u8]) -> bool
+{
+ if let Ok((_, recr)) = parse_dcerpc_record(data) {
+ SCLogDebug!("SMB: could be DCERPC {:?}", recr);
+ if recr.version_major == 5 && recr.version_minor < 3 &&
+ recr.frag_len > 0 && recr.packet_type <= 20
+ {
+ SCLogDebug!("SMB: looks like we have dcerpc");
+ return true;
+ }
+ }
+ return false;
+}
diff --git a/rust/src/smb/dcerpc_records.rs b/rust/src/smb/dcerpc_records.rs
new file mode 100644
index 0000000..0c8c17f
--- /dev/null
+++ b/rust/src/smb/dcerpc_records.rs
@@ -0,0 +1,247 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::common::nom7::bits;
+use crate::smb::error::SmbError;
+use nom7::bits::streaming::take as take_bits;
+use nom7::bytes::streaming::take;
+use nom7::combinator::{cond, rest};
+use nom7::multi::count;
+use nom7::number::Endianness;
+use nom7::number::streaming::{be_u16, le_u8, le_u16, le_u32, u16, u32};
+use nom7::sequence::tuple;
+use nom7::{Err, IResult};
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcResponseRecord<'a> {
+ pub data: &'a[u8],
+}
+
+/// parse a packet type 'response' DCERPC record. Implemented
+/// as function to be able to pass the fraglen in.
+pub fn parse_dcerpc_response_record(i:&[u8], frag_len: u16 )
+ -> IResult<&[u8], DceRpcResponseRecord, SmbError>
+{
+ if frag_len < 24 {
+ return Err(Err::Error(SmbError::RecordTooSmall));
+ }
+ let (i, _) = take(8_usize)(i)?;
+ let (i, data) = take(frag_len - 24)(i)?;
+ let record = DceRpcResponseRecord { data };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcRequestRecord<'a> {
+ pub opnum: u16,
+ pub context_id: u16,
+ pub data: &'a[u8],
+}
+
+/// parse a packet type 'request' DCERPC record. Implemented
+/// as function to be able to pass the fraglen in.
+pub fn parse_dcerpc_request_record(i:&[u8], frag_len: u16, little: bool)
+ -> IResult<&[u8], DceRpcRequestRecord, SmbError>
+{
+ if frag_len < 24 {
+ return Err(Err::Error(SmbError::RecordTooSmall));
+ }
+ let (i, _) = take(4_usize)(i)?;
+ let endian = if little { Endianness::Little } else { Endianness::Big };
+ let (i, context_id) = u16(endian)(i)?;
+ let (i, opnum) = u16(endian)(i)?;
+ let (i, data) = take(frag_len - 24)(i)?;
+ let record = DceRpcRequestRecord { opnum, context_id, data };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcBindIface<'a> {
+ pub iface: &'a[u8],
+ pub ver: u16,
+ pub ver_min: u16,
+}
+
+pub fn parse_dcerpc_bind_iface(i: &[u8]) -> IResult<&[u8], DceRpcBindIface> {
+ let (i, _ctx_id) = le_u16(i)?;
+ let (i, _num_trans_items) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, interface) = take(16_usize)(i)?;
+ let (i, ver) = le_u16(i)?;
+ let (i, ver_min) = le_u16(i)?;
+ let (i, _) = take(20_usize)(i)?;
+ let res = DceRpcBindIface {
+ iface:interface,
+ ver,
+ ver_min,
+ };
+ Ok((i, res))
+}
+
+pub fn parse_dcerpc_bind_iface_big(i: &[u8]) -> IResult<&[u8], DceRpcBindIface> {
+ let (i, _ctx_id) = le_u16(i)?;
+ let (i, _num_trans_items) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, interface) = take(16_usize)(i)?;
+ let (i, ver_min) = be_u16(i)?;
+ let (i, ver) = be_u16(i)?;
+ let (i, _) = take(20_usize)(i)?;
+ let res = DceRpcBindIface {
+ iface:interface,
+ ver,
+ ver_min,
+ };
+ Ok((i, res))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcBindRecord<'a> {
+ pub num_ctx_items: u8,
+ pub ifaces: Vec<DceRpcBindIface<'a>>,
+}
+
+pub fn parse_dcerpc_bind_record(i: &[u8]) -> IResult<&[u8], DceRpcBindRecord> {
+ let (i, _max_xmit_frag) = le_u16(i)?;
+ let (i, _max_recv_frag) = le_u16(i)?;
+ let (i, _assoc_group) = take(4_usize)(i)?;
+ let (i, num_ctx_items) = le_u8(i)?;
+ let (i, _) = take(3_usize)(i)?; // reserved
+ let (i, ifaces) = count(parse_dcerpc_bind_iface, num_ctx_items as usize)(i)?;
+ let record = DceRpcBindRecord {
+ num_ctx_items,
+ ifaces,
+ };
+ Ok((i, record))
+}
+
+pub fn parse_dcerpc_bind_record_big(i: &[u8]) -> IResult<&[u8], DceRpcBindRecord> {
+ let (i, _max_xmit_frag) = be_u16(i)?;
+ let (i, _max_recv_frag) = be_u16(i)?;
+ let (i, _assoc_group) = take(4_usize)(i)?;
+ let (i, num_ctx_items) = le_u8(i)?;
+ let (i, _) = take(3_usize)(i)?; // reserved
+ let (i, ifaces) = count(parse_dcerpc_bind_iface_big, num_ctx_items as usize)(i)?;
+ let record = DceRpcBindRecord {
+ num_ctx_items,
+ ifaces,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcBindAckResult<'a> {
+ pub ack_result: u16,
+ pub ack_reason: u16,
+ pub transfer_syntax: &'a[u8],
+ pub syntax_version: u32,
+}
+
+pub fn parse_dcerpc_bindack_result(i: &[u8]) -> IResult<&[u8], DceRpcBindAckResult> {
+ let (i, ack_result) = le_u16(i)?;
+ let (i, ack_reason) = le_u16(i)?;
+ let (i, transfer_syntax) = take(16_usize)(i)?;
+ let (i, syntax_version) = le_u32(i)?;
+ let res = DceRpcBindAckResult {
+ ack_result,
+ ack_reason,
+ transfer_syntax,
+ syntax_version,
+ };
+ Ok((i, res))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcBindAckRecord<'a> {
+ pub num_results: u8,
+ pub results: Vec<DceRpcBindAckResult<'a>>,
+}
+
+pub fn parse_dcerpc_bindack_record(i: &[u8]) -> IResult<&[u8], DceRpcBindAckRecord> {
+ let (i, _max_xmit_frag) = le_u16(i)?;
+ let (i, _max_recv_frag) = le_u16(i)?;
+ let (i, _assoc_group) = take(4_usize)(i)?;
+ let (i, sec_addr_len) = le_u16(i)?;
+ let (i, _) = take(sec_addr_len)(i)?;
+ let (i, _) = cond((sec_addr_len+2) % 4 != 0, take(4 - (sec_addr_len+2) % 4))(i)?;
+ let (i, num_results) = le_u8(i)?;
+ let (i, _) = take(3_usize)(i)?; // padding
+ let (i, results) = count(parse_dcerpc_bindack_result, num_results as usize)(i)?;
+ let record = DceRpcBindAckRecord {
+ num_results,
+ results,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct DceRpcRecord<'a> {
+ pub version_major: u8,
+ pub version_minor: u8,
+
+ pub first_frag: bool,
+ pub last_frag: bool,
+
+ pub frag_len: u16,
+
+ pub little_endian: bool,
+
+ pub packet_type: u8,
+
+ pub call_id: u32,
+ pub data: &'a[u8],
+}
+
+fn parse_dcerpc_flags1(i:&[u8]) -> IResult<&[u8],(u8,u8,u8)> {
+ bits(tuple((
+ take_bits(6u8),
+ take_bits(1u8), // last (1)
+ take_bits(1u8),
+ )))(i)
+}
+
+fn parse_dcerpc_flags2(i:&[u8]) -> IResult<&[u8],(u32,u32,u32)> {
+ bits(tuple((
+ take_bits(3u32),
+ take_bits(1u32), // endianness
+ take_bits(28u32),
+ )))(i)
+}
+
+pub fn parse_dcerpc_record(i: &[u8]) -> IResult<&[u8], DceRpcRecord> {
+ let (i, version_major) = le_u8(i)?;
+ let (i, version_minor) = le_u8(i)?;
+ let (i, packet_type) = le_u8(i)?;
+ let (i, packet_flags) = parse_dcerpc_flags1(i)?;
+ let (i, data_rep) = parse_dcerpc_flags2(i)?;
+ let endian = if data_rep.1 == 0 { Endianness::Big } else { Endianness::Little };
+ let (i, frag_len) = u16(endian)(i)?;
+ let (i, _auth) = u16(endian)(i)?;
+ let (i, call_id) = u32(endian)(i)?;
+ let (i, data) = rest(i)?;
+ let record = DceRpcRecord {
+ version_major,
+ version_minor,
+ packet_type,
+ first_frag: packet_flags.2 == 1,
+ last_frag: packet_flags.1 == 1,
+ frag_len,
+ little_endian: data_rep.1 == 1,
+ call_id,
+ data,
+ };
+ Ok((i, record))
+}
diff --git a/rust/src/smb/debug.rs b/rust/src/smb/debug.rs
new file mode 100644
index 0000000..86799dd
--- /dev/null
+++ b/rust/src/smb/debug.rs
@@ -0,0 +1,74 @@
+/* Copyright (C) 2018-2020 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::smb::smb::*;
+
+impl SMBState {
+ #[cfg(not(feature = "debug"))]
+ pub fn _debug_tx_stats(&self) { }
+
+ #[cfg(feature = "debug")]
+ pub fn _debug_tx_stats(&self) {
+ if self.transactions.len() > 1 {
+ let txf = self.transactions.front().unwrap();
+ let txl = self.transactions.back().unwrap();
+
+ SCLogDebug!("TXs {} MIN {} MAX {}", self.transactions.len(), txf.id, txl.id);
+ SCLogDebug!("- OLD tx.id {}: {:?}", txf.id, txf);
+ SCLogDebug!("- NEW tx.id {}: {:?}", txl.id, txl);
+ self._dump_txs();
+ }
+ }
+
+ #[cfg(not(feature = "debug"))]
+ pub fn _dump_txs(&self) { }
+ #[cfg(feature = "debug")]
+ pub fn _dump_txs(&self) {
+ let len = self.transactions.len();
+ for i in 0..len {
+ let tx = &self.transactions[i];
+ let ver = tx.vercmd.get_version();
+ let _smbcmd = if ver == 2 {
+ let (_, cmd) = tx.vercmd.get_smb2_cmd();
+ cmd
+ } else {
+ let (_, cmd) = tx.vercmd.get_smb1_cmd();
+ cmd as u16
+ };
+
+ match tx.type_data {
+ Some(SMBTransactionTypeData::FILE(ref d)) => {
+ SCLogDebug!("idx {} tx id {} progress {}/{} filename {} type_data {:?}",
+ i, tx.id, tx.request_done, tx.response_done,
+ String::from_utf8_lossy(&d.file_name), tx.type_data);
+ },
+ _ => {
+ SCLogDebug!("idx {} tx id {} ver:{} cmd:{} progress {}/{} type_data {:?} tx {:?}",
+ i, tx.id, ver, _smbcmd, tx.request_done, tx.response_done, tx.type_data, tx);
+ },
+ }
+ }
+ }
+
+ #[cfg(not(feature = "debug"))]
+ pub fn _debug_state_stats(&self) { }
+
+ #[cfg(feature = "debug")]
+ pub fn _debug_state_stats(&self) {
+ SCLogDebug!("ssn2vec_map {} guid2name_map {} ssn2vecoffset_map {} ssn2tree_map {} ssnguid2vec_map {} file_ts_guid {} file_tc_guid {} transactions {}", self.ssn2vec_map.len(), self.guid2name_map.len(), self.ssn2vecoffset_map.len(), self.ssn2tree_map.len(), self.ssnguid2vec_map.len(), self.file_ts_guid.len(), self.file_tc_guid.len(), self.transactions.len());
+ }
+}
diff --git a/rust/src/smb/detect.rs b/rust/src/smb/detect.rs
new file mode 100644
index 0000000..c85a6f5
--- /dev/null
+++ b/rust/src/smb/detect.rs
@@ -0,0 +1,194 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use std::ptr;
+use crate::core::*;
+use crate::smb::smb::*;
+use crate::dcerpc::detect::{DCEIfaceData, DCEOpnumData, DETECT_DCE_OPNUM_RANGE_UNINITIALIZED};
+use crate::dcerpc::dcerpc::DCERPC_TYPE_REQUEST;
+use crate::detect::uint::detect_match_uint;
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_tx_get_share(tx: &mut SMBTransaction,
+ buffer: *mut *const u8,
+ buffer_len: *mut u32)
+ -> u8
+{
+ if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
+ SCLogDebug!("is_pipe {}", x.is_pipe);
+ if !x.is_pipe {
+ *buffer = x.share_name.as_ptr();
+ *buffer_len = x.share_name.len() as u32;
+ return 1;
+ }
+ }
+
+ *buffer = ptr::null();
+ *buffer_len = 0;
+ return 0;
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_tx_get_named_pipe(tx: &mut SMBTransaction,
+ buffer: *mut *const u8,
+ buffer_len: *mut u32)
+ -> u8
+{
+ if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
+ SCLogDebug!("is_pipe {}", x.is_pipe);
+ if x.is_pipe {
+ *buffer = x.share_name.as_ptr();
+ *buffer_len = x.share_name.len() as u32;
+ return 1;
+ }
+ }
+
+ *buffer = ptr::null();
+ *buffer_len = 0;
+ return 0;
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_tx_get_stub_data(tx: &mut SMBTransaction,
+ direction: u8,
+ buffer: *mut *const u8,
+ buffer_len: *mut u32)
+ -> u8
+{
+ if let Some(SMBTransactionTypeData::DCERPC(ref x)) = tx.type_data {
+ let vref = if direction == Direction::ToServer as u8 {
+ &x.stub_data_ts
+ } else {
+ &x.stub_data_tc
+ };
+ if !vref.is_empty() {
+ *buffer = vref.as_ptr();
+ *buffer_len = vref.len() as u32;
+ return 1;
+ }
+ }
+
+ *buffer = ptr::null();
+ *buffer_len = 0;
+ return 0;
+}
+
+#[no_mangle]
+pub extern "C" fn rs_smb_tx_match_dce_opnum(tx: &mut SMBTransaction,
+ dce_data: &mut DCEOpnumData)
+ -> u8
+{
+ SCLogDebug!("rs_smb_tx_get_dce_opnum: start");
+ if let Some(SMBTransactionTypeData::DCERPC(ref x)) = tx.type_data {
+ if x.req_cmd == DCERPC_TYPE_REQUEST {
+ for range in dce_data.data.iter() {
+ if range.range2 == DETECT_DCE_OPNUM_RANGE_UNINITIALIZED {
+ if range.range1 == x.opnum as u32 {
+ return 1;
+ }
+ } else if range.range1 <= x.opnum as u32 && range.range2 >= x.opnum as u32 {
+ return 1;
+ }
+ }
+ }
+ }
+
+ return 0;
+}
+
+/* mimic logic that is/was in the C code:
+ * - match on REQUEST (so not on BIND/BINDACK (probably for mixing with
+ * dce_opnum and dce_stub_data)
+ * - only match on approved ifaces (so ack_result == 0) */
+#[no_mangle]
+pub extern "C" fn rs_smb_tx_get_dce_iface(state: &mut SMBState,
+ tx: &mut SMBTransaction,
+ dce_data: &mut DCEIfaceData)
+ -> u8
+{
+ let if_uuid = dce_data.if_uuid.as_slice();
+ let is_dcerpc_request = match tx.type_data {
+ Some(SMBTransactionTypeData::DCERPC(ref x)) => {
+ x.req_cmd == DCERPC_TYPE_REQUEST
+ },
+ _ => { false },
+ };
+ if !is_dcerpc_request {
+ return 0;
+ }
+ let ifaces = match state.dcerpc_ifaces {
+ Some(ref x) => x,
+ _ => {
+ return 0;
+ },
+ };
+
+ SCLogDebug!("looking for UUID {:?}", if_uuid);
+
+ for i in ifaces {
+ SCLogDebug!("stored UUID {:?} acked {} ack_result {}", i, i.acked, i.ack_result);
+
+ if i.acked && i.ack_result == 0 && i.uuid == if_uuid {
+ if let Some(x) = &dce_data.du16 {
+ if detect_match_uint(x, i.ver) {
+ return 1;
+ }
+ } else {
+ return 1;
+ }
+ }
+ }
+ return 0;
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_tx_get_ntlmssp_user(tx: &mut SMBTransaction,
+ buffer: *mut *const u8,
+ buffer_len: *mut u32)
+ -> u8
+{
+ if let Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) = tx.type_data {
+ if let Some(ref ntlmssp) = x.ntlmssp {
+ *buffer = ntlmssp.user.as_ptr();
+ *buffer_len = ntlmssp.user.len() as u32;
+ return 1;
+ }
+ }
+
+ *buffer = ptr::null();
+ *buffer_len = 0;
+ return 0;
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_tx_get_ntlmssp_domain(tx: &mut SMBTransaction,
+ buffer: *mut *const u8,
+ buffer_len: *mut u32)
+ -> u8
+{
+ if let Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) = tx.type_data {
+ if let Some(ref ntlmssp) = x.ntlmssp {
+ *buffer = ntlmssp.domain.as_ptr();
+ *buffer_len = ntlmssp.domain.len() as u32;
+ return 1;
+ }
+ }
+
+ *buffer = ptr::null();
+ *buffer_len = 0;
+ return 0;
+}
diff --git a/rust/src/smb/error.rs b/rust/src/smb/error.rs
new file mode 100644
index 0000000..352c275
--- /dev/null
+++ b/rust/src/smb/error.rs
@@ -0,0 +1,35 @@
+/* Copyright (C) 2019 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+// Author: Pierre Chifflier <chifflier@wzdftpd.net>
+use nom7::error::{ErrorKind, ParseError};
+
+#[derive(Debug)]
+pub enum SmbError {
+ BadEncoding,
+ RecordTooSmall,
+ NomError(ErrorKind),
+}
+
+impl<I> ParseError<I> for SmbError {
+ fn from_error_kind(_input: I, kind: ErrorKind) -> Self {
+ SmbError::NomError(kind)
+ }
+ fn append(_input: I, kind: ErrorKind, _other: Self) -> Self {
+ SmbError::NomError(kind)
+ }
+}
diff --git a/rust/src/smb/events.rs b/rust/src/smb/events.rs
new file mode 100644
index 0000000..ec79354
--- /dev/null
+++ b/rust/src/smb/events.rs
@@ -0,0 +1,80 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::smb::smb::*;
+
+#[derive(AppLayerEvent)]
+pub enum SMBEvent {
+ InternalError,
+ MalformedData,
+ RecordOverflow,
+ MalformedNtlmsspRequest,
+ MalformedNtlmsspResponse,
+ DuplicateNegotiate,
+ NegotiateMalformedDialects,
+ FileOverlap,
+ /// A request was seen in the to client direction.
+ RequestToClient,
+ /// A response was seen in the to server direction,
+ ResponseToServer,
+
+ /// Negotiated max sizes exceed our limit
+ NegotiateMaxReadSizeTooLarge,
+ NegotiateMaxWriteSizeTooLarge,
+
+ /// READ request asking for more than `max_read_size`
+ ReadRequestTooLarge,
+ /// READ response bigger than `max_read_size`
+ ReadResponseTooLarge,
+ ReadQueueSizeExceeded,
+ ReadQueueCntExceeded,
+ /// WRITE request for more than `max_write_size`
+ WriteRequestTooLarge,
+ WriteQueueSizeExceeded,
+ WriteQueueCntExceeded,
+ /// Unusual NTLMSSP fields order
+ UnusualNtlmsspOrder,
+ /// Too many live transactions in one flow
+ TooManyTransactions,
+}
+
+impl SMBTransaction {
+ /// Set event.
+ pub fn set_event(&mut self, e: SMBEvent) {
+ self.tx_data.set_event(e as u8);
+ }
+
+ /// Set events from vector of events.
+ pub fn set_events(&mut self, events: Vec<SMBEvent>) {
+ for e in events {
+ self.tx_data.set_event(e as u8);
+ }
+ }
+}
+
+impl SMBState {
+ /// Set an event. The event is set on the most recent transaction.
+ pub fn set_event(&mut self, event: SMBEvent) {
+ let len = self.transactions.len();
+ if len == 0 {
+ return;
+ }
+
+ let tx = &mut self.transactions[len - 1];
+ tx.set_event(event);
+ }
+}
diff --git a/rust/src/smb/files.rs b/rust/src/smb/files.rs
new file mode 100644
index 0000000..b290357
--- /dev/null
+++ b/rust/src/smb/files.rs
@@ -0,0 +1,244 @@
+/* Copyright (C) 2018-2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use std;
+use crate::core::*;
+use crate::filetracker::*;
+use crate::filecontainer::*;
+
+use crate::smb::smb::*;
+
+/// File tracking transaction. Single direction only.
+#[derive(Default, Debug)]
+pub struct SMBTransactionFile {
+ pub direction: Direction,
+ pub fuid: Vec<u8>,
+ pub file_name: Vec<u8>,
+ pub share_name: Vec<u8>,
+ pub file_tracker: FileTransferTracker,
+ /// after a gap, this will be set to a time in the future. If the file
+ /// receives no updates before that, it will be considered complete.
+ pub post_gap_ts: u64,
+ //pub files: Files,
+}
+
+impl SMBTransactionFile {
+ pub fn new() -> Self {
+ return Self {
+ file_tracker: FileTransferTracker::new(),
+ ..Default::default()
+ }
+ }
+
+ pub fn update_file_flags(&mut self, flow_file_flags: u16) {
+ let dir_flag = if self.direction == Direction::ToServer { STREAM_TOSERVER } else { STREAM_TOCLIENT };
+ self.file_tracker.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, dir_flag) };
+ }
+}
+
+/// little wrapper around the FileTransferTracker::new_chunk method
+pub fn filetracker_newchunk(ft: &mut FileTransferTracker, name: &[u8], data: &[u8],
+ chunk_offset: u64, chunk_size: u32, is_last: bool, xid: &u32)
+{
+ if let Some(sfcm) = unsafe { SURICATA_SMB_FILE_CONFIG } {
+ ft.new_chunk(sfcm, name, data, chunk_offset,
+ chunk_size, 0, is_last, xid);
+ }
+}
+
+pub fn filetracker_trunc(ft: &mut FileTransferTracker)
+{
+ if let Some(sfcm) = unsafe { SURICATA_SMB_FILE_CONFIG } {
+ ft.trunc(sfcm);
+ }
+}
+
+pub fn filetracker_close(ft: &mut FileTransferTracker)
+{
+ if let Some(sfcm) = unsafe { SURICATA_SMB_FILE_CONFIG } {
+ ft.close(sfcm);
+ }
+}
+
+fn filetracker_update(ft: &mut FileTransferTracker, data: &[u8], gap_size: u32) -> u32
+{
+ if let Some(sfcm) = unsafe { SURICATA_SMB_FILE_CONFIG } {
+ ft.update(sfcm, data, gap_size)
+ } else {
+ 0
+ }
+}
+
+impl SMBState {
+ pub fn new_file_tx(&mut self, fuid: &[u8], file_name: &[u8], direction: Direction)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ tx.type_data = Some(SMBTransactionTypeData::FILE(SMBTransactionFile::new()));
+ if let Some(SMBTransactionTypeData::FILE(ref mut d)) = tx.type_data {
+ d.direction = direction;
+ d.fuid = fuid.to_vec();
+ d.file_name = file_name.to_vec();
+ d.file_tracker.tx_id = tx.id - 1;
+ tx.tx_data.update_file_flags(self.state_data.file_flags);
+ d.update_file_flags(tx.tx_data.file_flags);
+ }
+ tx.tx_data.init_files_opened();
+ tx.tx_data.file_tx = if direction == Direction::ToServer { STREAM_TOSERVER } else { STREAM_TOCLIENT }; // TODO direction to flag func?
+ SCLogDebug!("SMB: new_file_tx: TX FILE created: ID {} NAME {}",
+ tx.id, String::from_utf8_lossy(file_name));
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ /// get file tx for a open file. Returns None if a file for the fuid exists,
+ /// but has already been closed.
+ pub fn get_file_tx_by_fuid_with_open_file(&mut self, fuid: &[u8], direction: Direction)
+ -> Option<&mut SMBTransaction>
+ {
+ let f = fuid.to_vec();
+ for tx in &mut self.transactions {
+ let found = match tx.type_data {
+ Some(SMBTransactionTypeData::FILE(ref mut d)) => {
+ direction == d.direction && f == d.fuid && !d.file_tracker.is_done()
+ },
+ _ => { false },
+ };
+
+ if found {
+ SCLogDebug!("SMB: Found SMB file TX with ID {}", tx.id);
+ if let Some(SMBTransactionTypeData::FILE(ref mut d)) = tx.type_data {
+ tx.tx_data.update_file_flags(self.state_data.file_flags);
+ d.update_file_flags(tx.tx_data.file_flags);
+ }
+ return Some(tx);
+ }
+ }
+ SCLogDebug!("SMB: Failed to find SMB TX with FUID {:?}", fuid);
+ return None;
+ }
+
+ /// get file tx for a fuid. File may already have been closed.
+ pub fn get_file_tx_by_fuid(&mut self, fuid: &[u8], direction: Direction)
+ -> Option<&mut SMBTransaction>
+ {
+ let f = fuid.to_vec();
+ for tx in &mut self.transactions {
+ let found = match tx.type_data {
+ Some(SMBTransactionTypeData::FILE(ref mut d)) => {
+ direction == d.direction && f == d.fuid
+ },
+ _ => { false },
+ };
+
+ if found {
+ SCLogDebug!("SMB: Found SMB file TX with ID {}", tx.id);
+ if let Some(SMBTransactionTypeData::FILE(ref mut d)) = tx.type_data {
+ tx.tx_data.update_file_flags(self.state_data.file_flags);
+ d.update_file_flags(tx.tx_data.file_flags);
+ }
+ return Some(tx);
+ }
+ }
+ SCLogDebug!("SMB: Failed to find SMB TX with FUID {:?}", fuid);
+ return None;
+ }
+
+ // update in progress chunks for file transfers
+ // return how much data we consumed
+ pub fn filetracker_update(&mut self, direction: Direction, data: &[u8], gap_size: u32) -> u32 {
+ let mut chunk_left = if direction == Direction::ToServer {
+ self.file_ts_left
+ } else {
+ self.file_tc_left
+ };
+ if chunk_left == 0 {
+ return 0
+ }
+ SCLogDebug!("chunk_left {} data {}", chunk_left, data.len());
+ let file_handle = if direction == Direction::ToServer {
+ self.file_ts_guid.to_vec()
+ } else {
+ self.file_tc_guid.to_vec()
+ };
+
+ let data_to_handle_len = if chunk_left as usize >= data.len() {
+ data.len()
+ } else {
+ chunk_left as usize
+ };
+
+ if chunk_left <= data.len() as u32 {
+ chunk_left = 0;
+ } else {
+ chunk_left -= data.len() as u32;
+ }
+
+ if direction == Direction::ToServer {
+ self.file_ts_left = chunk_left;
+ } else {
+ self.file_tc_left = chunk_left;
+ }
+
+ let ssn_gap = self.ts_ssn_gap | self.tc_ssn_gap;
+ // get the tx and update it
+ let consumed = match self.get_file_tx_by_fuid(&file_handle, direction) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ if ssn_gap {
+ let queued_data = tdf.file_tracker.get_queued_size();
+ if queued_data > 2000000 { // TODO should probably be configurable
+ SCLogDebug!("QUEUED size {} while we've seen GAPs. Truncating file.", queued_data);
+ filetracker_trunc(&mut tdf.file_tracker);
+ }
+ }
+
+ // reset timestamp if we get called after a gap
+ if tdf.post_gap_ts > 0 {
+ tdf.post_gap_ts = 0;
+ }
+
+ let file_data = &data[0..data_to_handle_len];
+ filetracker_update(&mut tdf.file_tracker, file_data, gap_size)
+ } else {
+ 0
+ }
+ },
+ None => {
+ SCLogDebug!("not found for handle {:?}", file_handle);
+ 0 },
+ };
+
+ return consumed;
+ }
+}
+
+use crate::applayer::AppLayerGetFileState;
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_gettxfiles(_state: *mut std::ffi::c_void, tx: *mut std::ffi::c_void, direction: u8) -> AppLayerGetFileState {
+ let tx = cast_pointer!(tx, SMBTransaction);
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let tx_dir : u8 = tdf.direction.into();
+ if direction & tx_dir != 0 {
+ if let Some(sfcm) = { SURICATA_SMB_FILE_CONFIG } {
+ return AppLayerGetFileState { fc: &mut tdf.file_tracker.file, cfg: sfcm.files_sbcfg }
+ }
+ }
+ }
+ AppLayerGetFileState::err()
+}
diff --git a/rust/src/smb/funcs.rs b/rust/src/smb/funcs.rs
new file mode 100644
index 0000000..afab69d
--- /dev/null
+++ b/rust/src/smb/funcs.rs
@@ -0,0 +1,114 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+// Based on the list in Wiresharks packet-smb2.c
+// Names match names from Microsoft.
+
+pub fn fsctl_func_to_string(f: u32) -> String {
+ match f {
+ 0x00060194 => "FSCTL_DFS_GET_REFERRALS",
+ 0x000601B0 => "FSCTL_DFS_GET_REFERRALS_EX",
+ 0x00090000 => "FSCTL_REQUEST_OPLOCK_LEVEL_1",
+ 0x00090004 => "FSCTL_REQUEST_OPLOCK_LEVEL_2",
+ 0x00090008 => "FSCTL_REQUEST_BATCH_OPLOCK",
+ 0x0009000C => "FSCTL_OPLOCK_BREAK_ACKNOWLEDGE",
+ 0x00090010 => "FSCTL_OPBATCH_ACK_CLOSE_PENDING",
+ 0x00090014 => "FSCTL_OPLOCK_BREAK_NOTIFY",
+ 0x00090018 => "FSCTL_LOCK_VOLUME",
+ 0x0009001C => "FSCTL_UNLOCK_VOLUME",
+ 0x00090020 => "FSCTL_DISMOUNT_VOLUME",
+ 0x00090028 => "FSCTL_IS_VOLUME_MOUNTED",
+ 0x0009002C => "FSCTL_IS_PATHNAME_VALID",
+ 0x00090030 => "FSCTL_MARK_VOLUME_DIRTY",
+ 0x0009003B => "FSCTL_QUERY_RETRIEVAL_POINTERS",
+ 0x0009003C => "FSCTL_GET_COMPRESSION",
+ 0x0009004F => "FSCTL_MARK_AS_SYSTEM_HIVE",
+ 0x00090050 => "FSCTL_OPLOCK_BREAK_ACK_NO_2",
+ 0x00090054 => "FSCTL_INVALIDATE_VOLUMES",
+ 0x00090058 => "FSCTL_QUERY_FAT_BPB",
+ 0x0009005C => "FSCTL_REQUEST_FILTER_OPLOCK",
+ 0x00090060 => "FSCTL_FILESYSTEM_GET_STATISTICS",
+ 0x00090064 => "FSCTL_GET_NTFS_VOLUME_DATA",
+ 0x00090068 => "FSCTL_GET_NTFS_FILE_RECORD",
+ 0x0009006F => "FSCTL_GET_VOLUME_BITMAP",
+ 0x00090073 => "FSCTL_GET_RETRIEVAL_POINTERS",
+ 0x00090074 => "FSCTL_MOVE_FILE",
+ 0x00090078 => "FSCTL_IS_VOLUME_DIRTY",
+ 0x0009007C => "FSCTL_GET_HFS_INFORMATION",
+ 0x00090083 => "FSCTL_ALLOW_EXTENDED_DASD_IO",
+ 0x00090087 => "FSCTL_READ_PROPERTY_DATA",
+ 0x0009008B => "FSCTL_WRITE_PROPERTY_DATA",
+ 0x0009008F => "FSCTL_FIND_FILES_BY_SID",
+ 0x00090097 => "FSCTL_DUMP_PROPERTY_DATA",
+ 0x0009009C => "FSCTL_GET_OBJECT_ID",
+ 0x000900A4 => "FSCTL_SET_REPARSE_POINT",
+ 0x000900A8 => "FSCTL_GET_REPARSE_POINT",
+ 0x000900C0 => "FSCTL_CREATE_OR_GET_OBJECT_ID",
+ 0x000900C4 => "FSCTL_SET_SPARSE",
+ 0x000900D4 => "FSCTL_SET_ENCRYPTION",
+ 0x000900DB => "FSCTL_ENCRYPTION_FSCTL_IO",
+ 0x000900DF => "FSCTL_WRITE_RAW_ENCRYPTED",
+ 0x000900E3 => "FSCTL_READ_RAW_ENCRYPTED",
+ 0x000900F0 => "FSCTL_EXTEND_VOLUME",
+ 0x00090244 => "FSCTL_CSV_TUNNEL_REQUEST",
+ 0x0009027C => "FSCTL_GET_INTEGRITY_INFORMATION",
+ 0x00090284 => "FSCTL_QUERY_FILE_REGIONS",
+ 0x000902c8 => "FSCTL_CSV_SYNC_TUNNEL_REQUEST",
+ 0x00090300 => "FSCTL_QUERY_SHARED_VIRTUAL_DISK_SUPPORT",
+ 0x00090304 => "FSCTL_SVHDX_SYNC_TUNNEL_REQUEST",
+ 0x00090308 => "FSCTL_SVHDX_SET_INITIATOR_INFORMATION",
+ 0x0009030C => "FSCTL_SET_EXTERNAL_BACKING",
+ 0x00090310 => "FSCTL_GET_EXTERNAL_BACKING",
+ 0x00090314 => "FSCTL_DELETE_EXTERNAL_BACKING",
+ 0x00090318 => "FSCTL_ENUM_EXTERNAL_BACKING",
+ 0x0009031F => "FSCTL_ENUM_OVERLAY",
+ 0x00090350 => "FSCTL_STORAGE_QOS_CONTROL",
+ 0x00090364 => "FSCTL_SVHDX_ASYNC_TUNNEL_REQUEST",
+ 0x000940B3 => "FSCTL_ENUM_USN_DATA",
+ 0x000940B7 => "FSCTL_SECURITY_ID_CHECK",
+ 0x000940BB => "FSCTL_READ_USN_JOURNAL",
+ 0x000940CF => "FSCTL_QUERY_ALLOCATED_RANGES",
+ 0x000940E7 => "FSCTL_CREATE_USN_JOURNAL",
+ 0x000940EB => "FSCTL_READ_FILE_USN_DATA",
+ 0x000940EF => "FSCTL_WRITE_USN_CLOSE_RECORD",
+ 0x00094264 => "FSCTL_OFFLOAD_READ",
+ 0x00098098 => "FSCTL_SET_OBJECT_ID",
+ 0x000980A0 => "FSCTL_DELETE_OBJECT_ID",
+ 0x000980A4 => "FSCTL_SET_REPARSE_POINT",
+ 0x000980AC => "FSCTL_DELETE_REPARSE_POINT",
+ 0x000980BC => "FSCTL_SET_OBJECT_ID_EXTENDED",
+ 0x000980C8 => "FSCTL_SET_ZERO_DATA",
+ 0x000980D0 => "FSCTL_ENABLE_UPGRADE",
+ 0x00098208 => "FSCTL_FILE_LEVEL_TRIM",
+ 0x00098268 => "FSCTL_OFFLOAD_WRITE",
+ 0x0009C040 => "FSCTL_SET_COMPRESSION",
+ 0x0009C280 => "FSCTL_SET_INTEGRITY_INFORMATION",
+ 0x00110018 => "FSCTL_PIPE_WAIT",
+ 0x0011400C => "FSCTL_PIPE_PEEK",
+ 0x0011C017 => "FSCTL_PIPE_TRANSCEIVE",
+ 0x00140078 => "FSCTL_SRV_REQUEST_RESUME_KEY",
+ 0x001401D4 => "FSCTL_LMR_REQUEST_RESILIENCY",
+ 0x001401FC => "FSCTL_QUERY_NETWORK_INTERFACE_INFO",
+ 0x00140200 => "FSCTL_VALIDATE_NEGOTIATE_INFO_224",
+ 0x00140204 => "FSCTL_VALIDATE_NEGOTIATE_INFO",
+ 0x00144064 => "FSCTL_SRV_ENUMERATE_SNAPSHOTS",
+ 0x001440F2 => "FSCTL_SRV_COPYCHUNK",
+ 0x001441bb => "FSCTL_SRV_READ_HASH",
+ 0x001480F2 => "FSCTL_SRV_COPYCHUNK_WRITE",
+ _ => { return (f).to_string(); },
+ }.to_string()
+}
diff --git a/rust/src/smb/log.rs b/rust/src/smb/log.rs
new file mode 100644
index 0000000..8496574
--- /dev/null
+++ b/rust/src/smb/log.rs
@@ -0,0 +1,458 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use std::str;
+use std::string::String;
+use uuid;
+use crate::jsonbuilder::{JsonBuilder, JsonError};
+use crate::smb::smb::*;
+use crate::smb::smb1::*;
+use crate::smb::smb2::*;
+use crate::dcerpc::dcerpc::*;
+use crate::smb::funcs::*;
+use crate::smb::smb_status::*;
+
+#[cfg(not(feature = "debug"))]
+fn debug_add_progress(_js: &mut JsonBuilder, _tx: &SMBTransaction) -> Result<(), JsonError> { Ok(()) }
+
+#[cfg(feature = "debug")]
+fn debug_add_progress(jsb: &mut JsonBuilder, tx: &SMBTransaction) -> Result<(), JsonError> {
+ jsb.set_bool("request_done", tx.request_done)?;
+ jsb.set_bool("response_done", tx.response_done)?;
+ Ok(())
+}
+
+/// take in a file GUID (16 bytes) or FID (2 bytes). Also deal
+/// with our frankenFID (2 bytes + 4 user_id)
+fn fuid_to_string(fuid: &Vec<u8>) -> String {
+ let fuid_len = fuid.len();
+ if fuid_len == 16 {
+ guid_to_string(fuid)
+ } else if fuid_len == 2 {
+ format!("{:02x}{:02x}", fuid[1], fuid[0])
+ } else if fuid_len == 6 {
+ let pure_fid = &fuid[0..2];
+ format!("{:02x}{:02x}", pure_fid[1], pure_fid[0])
+ } else {
+ "".to_string()
+ }
+}
+
+fn guid_to_string(guid: &Vec<u8>) -> String {
+ if guid.len() == 16 {
+ let output = format!("{:02x}{:02x}{:02x}{:02x}-{:02x}{:02x}-{:02x}{:02x}-{:02x}{:02x}-{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}",
+ guid[3], guid[2], guid[1], guid[0],
+ guid[5], guid[4], guid[7], guid[6],
+ guid[9], guid[8], guid[11], guid[10],
+ guid[15], guid[14], guid[13], guid[12]);
+ output
+ } else {
+ "".to_string()
+ }
+}
+
+fn smb_common_header(jsb: &mut JsonBuilder, state: &SMBState, tx: &SMBTransaction) -> Result<(), JsonError>
+{
+ jsb.set_uint("id", tx.id)?;
+
+ if state.dialect != 0 {
+ let dialect = &smb2_dialect_string(state.dialect);
+ jsb.set_string("dialect", dialect)?;
+ } else {
+ let dialect = match state.dialect_vec {
+ Some(ref d) => str::from_utf8(d).unwrap_or("invalid"),
+ None => "unknown",
+ };
+ jsb.set_string("dialect", dialect)?;
+ }
+
+ match tx.vercmd.get_version() {
+ 1 => {
+ let (ok, cmd) = tx.vercmd.get_smb1_cmd();
+ if ok {
+ jsb.set_string("command", &smb1_command_string(cmd))?;
+ }
+ },
+ 2 => {
+ let (ok, cmd) = tx.vercmd.get_smb2_cmd();
+ if ok {
+ jsb.set_string("command", &smb2_command_string(cmd))?;
+ }
+ },
+ _ => { },
+ }
+
+ match tx.vercmd.get_ntstatus() {
+ (true, ntstatus) => {
+ let status = smb_ntstatus_string(ntstatus);
+ match status {
+ Some(x) => jsb.set_string("status", x)?,
+ None => {
+ let status_str = format!("{}", ntstatus);
+ jsb.set_string("status", &status_str)?
+ },
+ };
+ let status_hex = format!("0x{:x}", ntstatus);
+ jsb.set_string("status_code", &status_hex)?;
+ },
+ (false, _) => {
+ #[allow(clippy::single_match)]
+ match tx.vercmd.get_dos_error() {
+ (true, errclass, errcode) => {
+ match errclass {
+ 1 => { // DOSERR
+ let status = smb_dos_error_string(errcode);
+ jsb.set_string("status", &status)?;
+ },
+ 2 => { // SRVERR
+ let status = smb_srv_error_string(errcode);
+ jsb.set_string("status", &status)?;
+ }
+ _ => {
+ let s = format!("UNKNOWN_{:02x}_{:04x}", errclass, errcode);
+ jsb.set_string("status", &s)?;
+ },
+ }
+ let status_hex = format!("0x{:04x}", errcode);
+ jsb.set_string("status_code", &status_hex)?;
+ },
+ (_, _, _) => {
+ },
+ }
+ },
+ }
+
+
+ jsb.set_uint("session_id", tx.hdr.ssn_id)?;
+ jsb.set_uint("tree_id", tx.hdr.tree_id as u64)?;
+
+ debug_add_progress(jsb, tx)?;
+
+ match tx.type_data {
+ Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) => {
+ if let Some(ref ntlmssp) = x.ntlmssp {
+ jsb.open_object("ntlmssp")?;
+ let domain = String::from_utf8_lossy(&ntlmssp.domain);
+ jsb.set_string("domain", &domain)?;
+
+ let user = String::from_utf8_lossy(&ntlmssp.user);
+ jsb.set_string("user", &user)?;
+
+ let host = String::from_utf8_lossy(&ntlmssp.host);
+ jsb.set_string("host", &host)?;
+
+ if let Some(ref v) = ntlmssp.version {
+ jsb.set_string("version", v.to_string().as_str())?;
+ }
+
+ jsb.close()?;
+ }
+
+ if let Some(ref ticket) = x.krb_ticket {
+ jsb.open_object("kerberos")?;
+ jsb.set_string("realm", &ticket.realm.0)?;
+ jsb.open_array("snames")?;
+ for sname in ticket.sname.name_string.iter() {
+ jsb.append_string(sname)?;
+ }
+ jsb.close()?;
+ jsb.close()?;
+ }
+
+ if let Some(ref r) = x.request_host {
+ jsb.open_object("request")?;
+ let os = String::from_utf8_lossy(&r.native_os);
+ jsb.set_string("native_os", &os)?;
+ let lm = String::from_utf8_lossy(&r.native_lm);
+ jsb.set_string("native_lm", &lm)?;
+ jsb.close()?;
+ }
+ if let Some(ref r) = x.response_host {
+ jsb.open_object("response")?;
+ let os = String::from_utf8_lossy(&r.native_os);
+ jsb.set_string("native_os", &os)?;
+ let lm = String::from_utf8_lossy(&r.native_lm);
+ jsb.set_string("native_lm", &lm)?;
+ jsb.close()?;
+ }
+ },
+ Some(SMBTransactionTypeData::CREATE(ref x)) => {
+ let mut name_raw = x.filename.to_vec();
+ name_raw.retain(|&i|i != 0x00);
+ if !name_raw.is_empty() {
+ let name = String::from_utf8_lossy(&name_raw);
+ if x.directory {
+ jsb.set_string("directory", &name)?;
+ } else {
+ jsb.set_string("filename", &name)?;
+ }
+ } else {
+ // name suggestion from Bro
+ jsb.set_string("filename", "<share_root>")?;
+ }
+ match x.disposition {
+ 0 => { jsb.set_string("disposition", "FILE_SUPERSEDE")?; },
+ 1 => { jsb.set_string("disposition", "FILE_OPEN")?; },
+ 2 => { jsb.set_string("disposition", "FILE_CREATE")?; },
+ 3 => { jsb.set_string("disposition", "FILE_OPEN_IF")?; },
+ 4 => { jsb.set_string("disposition", "FILE_OVERWRITE")?; },
+ 5 => { jsb.set_string("disposition", "FILE_OVERWRITE_IF")?; },
+ _ => { jsb.set_string("disposition", "UNKNOWN")?; },
+ }
+ if x.delete_on_close {
+ jsb.set_string("access", "delete on close")?;
+ } else {
+ jsb.set_string("access", "normal")?;
+ }
+
+ // field names inspired by Bro
+ jsb.set_uint("created", x.create_ts as u64)?;
+ jsb.set_uint("accessed", x.last_access_ts as u64)?;
+ jsb.set_uint("modified", x.last_write_ts as u64)?;
+ jsb.set_uint("changed", x.last_change_ts as u64)?;
+ jsb.set_uint("size", x.size)?;
+
+ let gs = fuid_to_string(&x.guid);
+ jsb.set_string("fuid", &gs)?;
+ },
+ Some(SMBTransactionTypeData::NEGOTIATE(ref x)) => {
+ if x.smb_ver == 1 {
+ jsb.open_array("client_dialects")?;
+ for d in &x.dialects {
+ let dialect = String::from_utf8_lossy(d);
+ jsb.append_string(&dialect)?;
+ }
+ jsb.close()?;
+ } else if x.smb_ver == 2 {
+ jsb.open_array("client_dialects")?;
+ for d in &x.dialects2 {
+ let dialect = String::from_utf8_lossy(d);
+ jsb.append_string(&dialect)?;
+ }
+ jsb.close()?;
+ }
+
+ if let Some(ref g) = x.client_guid {
+ jsb.set_string("client_guid", &guid_to_string(g))?;
+ }
+
+ jsb.set_string("server_guid", &guid_to_string(&x.server_guid))?;
+
+ if state.max_read_size > 0 {
+ jsb.set_uint("max_read_size", state.max_read_size.into())?;
+ }
+ if state.max_write_size > 0 {
+ jsb.set_uint("max_write_size", state.max_write_size.into())?;
+ }
+ },
+ Some(SMBTransactionTypeData::TREECONNECT(ref x)) => {
+ let share_name = String::from_utf8_lossy(&x.share_name);
+ if x.is_pipe {
+ jsb.set_string("named_pipe", &share_name)?;
+ } else {
+ jsb.set_string("share", &share_name)?;
+ }
+
+ // handle services
+ if tx.vercmd.get_version() == 1 {
+ jsb.open_object("service")?;
+
+ if let Some(ref s) = x.req_service {
+ let serv = String::from_utf8_lossy(s);
+ jsb.set_string("request", &serv)?;
+ }
+ if let Some(ref s) = x.res_service {
+ let serv = String::from_utf8_lossy(s);
+ jsb.set_string("response", &serv)?;
+ }
+ jsb.close()?;
+
+ // share type only for SMB2
+ } else {
+ match x.share_type {
+ 1 => { jsb.set_string("share_type", "FILE")?; },
+ 2 => { jsb.set_string("share_type", "PIPE")?; },
+ 3 => { jsb.set_string("share_type", "PRINT")?; },
+ _ => { jsb.set_string("share_type", "UNKNOWN")?; },
+ }
+ }
+ },
+ Some(SMBTransactionTypeData::FILE(ref x)) => {
+ let file_name = String::from_utf8_lossy(&x.file_name);
+ jsb.set_string("filename", &file_name)?;
+ let share_name = String::from_utf8_lossy(&x.share_name);
+ jsb.set_string("share", &share_name)?;
+ let gs = fuid_to_string(&x.fuid);
+ jsb.set_string("fuid", &gs)?;
+ },
+ Some(SMBTransactionTypeData::RENAME(ref x)) => {
+ if tx.vercmd.get_version() == 2 {
+ jsb.open_object("set_info")?;
+ jsb.set_string("class", "FILE_INFO")?;
+ jsb.set_string("info_level", "SMB2_FILE_RENAME_INFO")?;
+ jsb.close()?;
+ }
+
+ jsb.open_object("rename")?;
+ let file_name = String::from_utf8_lossy(&x.oldname);
+ jsb.set_string("from", &file_name)?;
+ let file_name = String::from_utf8_lossy(&x.newname);
+ jsb.set_string("to", &file_name)?;
+ jsb.close()?;
+ let gs = fuid_to_string(&x.fuid);
+ jsb.set_string("fuid", &gs)?;
+ },
+ Some(SMBTransactionTypeData::DCERPC(ref x)) => {
+ jsb.open_object("dcerpc")?;
+ if x.req_set {
+ jsb.set_string("request", &dcerpc_type_string(x.req_cmd))?;
+ } else {
+ jsb.set_string("request", "REQUEST_LOST")?;
+ }
+ if x.res_set {
+ jsb.set_string("response", &dcerpc_type_string(x.res_cmd))?;
+ } else {
+ jsb.set_string("response", "UNREPLIED")?;
+ }
+ if x.req_set {
+ match x.req_cmd {
+ DCERPC_TYPE_REQUEST => {
+ jsb.set_uint("opnum", x.opnum as u64)?;
+ jsb.open_object("req")?;
+ jsb.set_uint("frag_cnt", x.frag_cnt_ts as u64)?;
+ jsb.set_uint("stub_data_size", x.stub_data_ts.len() as u64)?;
+ jsb.close()?;
+ if let Some(ref ifaces) = state.dcerpc_ifaces {
+ // First filter the interfaces to those
+ // with the context_id we want to log to
+ // avoid creating an empty "interfaces"
+ // array.
+ let mut ifaces = ifaces
+ .iter()
+ .filter(|i| i.context_id == x.context_id)
+ .peekable();
+ if ifaces.peek().is_some() {
+ jsb.open_array("interfaces")?;
+ for i in ifaces {
+ jsb.start_object()?;
+ let ifstr = uuid::Uuid::from_slice(&i.uuid);
+ let ifstr = ifstr.map(|ifstr| ifstr.to_hyphenated().to_string()).unwrap();
+ jsb.set_string("uuid", &ifstr)?;
+ let vstr = format!("{}.{}", i.ver, i.ver_min);
+ jsb.set_string("version", &vstr)?;
+ jsb.close()?;
+ }
+ jsb.close()?;
+ }
+ }
+ },
+ DCERPC_TYPE_BIND => {
+ if let Some(ref ifaces) = state.dcerpc_ifaces {
+ jsb.open_array("interfaces")?;
+ for i in ifaces {
+ jsb.start_object()?;
+ let ifstr = uuid::Uuid::from_slice(&i.uuid);
+ let ifstr = ifstr.map(|ifstr| ifstr.to_hyphenated().to_string()).unwrap();
+ jsb.set_string("uuid", &ifstr)?;
+ let vstr = format!("{}.{}", i.ver, i.ver_min);
+ jsb.set_string("version", &vstr)?;
+
+ if i.acked {
+ jsb.set_uint("ack_result", i.ack_result as u64)?;
+ jsb.set_uint("ack_reason", i.ack_reason as u64)?;
+ }
+ jsb.close()?;
+ }
+ jsb.close()?;
+ }
+ },
+ _ => {},
+ }
+ }
+ if x.res_set {
+ #[allow(clippy::single_match)]
+ match x.res_cmd {
+ DCERPC_TYPE_RESPONSE => {
+ jsb.open_object("res")?;
+ jsb.set_uint("frag_cnt", x.frag_cnt_tc as u64)?;
+ jsb.set_uint("stub_data_size", x.stub_data_tc.len() as u64)?;
+ jsb.close()?;
+ },
+ // we don't handle BINDACK w/o BIND
+ _ => {},
+ }
+ }
+ jsb.set_uint("call_id", x.call_id as u64)?;
+ jsb.close()?;
+ }
+ Some(SMBTransactionTypeData::IOCTL(ref x)) => {
+ jsb.set_string("function", &fsctl_func_to_string(x.func))?;
+ },
+ Some(SMBTransactionTypeData::SETFILEPATHINFO(ref x)) => {
+ let mut name_raw = x.filename.to_vec();
+ name_raw.retain(|&i|i != 0x00);
+ if !name_raw.is_empty() {
+ let name = String::from_utf8_lossy(&name_raw);
+ jsb.set_string("filename", &name)?;
+ } else {
+ // name suggestion from Bro
+ jsb.set_string("filename", "<share_root>")?;
+ }
+ if x.delete_on_close {
+ jsb.set_string("access", "delete on close")?;
+ } else {
+ jsb.set_string("access", "normal")?;
+ }
+
+ match x.subcmd {
+ 8 => {
+ jsb.set_string("subcmd", "SET_FILE_INFO")?;
+ },
+ 6 => {
+ jsb.set_string("subcmd", "SET_PATH_INFO")?;
+ },
+ _ => { },
+ }
+
+ #[allow(clippy::single_match)]
+ match x.loi {
+ 1013 => { // Set Disposition Information
+ jsb.set_string("level_of_interest", "Set Disposition Information")?;
+ },
+ _ => { },
+ }
+
+ let gs = fuid_to_string(&x.fid);
+ jsb.set_string("fuid", &gs)?;
+ },
+ _ => { },
+ }
+ return Ok(());
+}
+
+#[no_mangle]
+pub extern "C" fn rs_smb_log_json_request(jsb: &mut JsonBuilder, state: &mut SMBState, tx: &mut SMBTransaction) -> bool
+{
+ smb_common_header(jsb, state, tx).is_ok()
+}
+
+#[no_mangle]
+pub extern "C" fn rs_smb_log_json_response(jsb: &mut JsonBuilder, state: &mut SMBState, tx: &mut SMBTransaction) -> bool
+{
+ smb_common_header(jsb, state, tx).is_ok()
+}
+
diff --git a/rust/src/smb/mod.rs b/rust/src/smb/mod.rs
new file mode 100644
index 0000000..5b74f1c
--- /dev/null
+++ b/rust/src/smb/mod.rs
@@ -0,0 +1,47 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+//! SMB application layer, detection, logger and parser module.
+
+pub mod error;
+pub mod smb_records;
+pub mod smb_status;
+pub mod smb1_records;
+pub mod smb2_records;
+pub mod nbss_records;
+pub mod dcerpc_records;
+pub mod ntlmssp_records;
+
+pub mod smb;
+pub mod smb1;
+pub mod smb1_session;
+pub mod smb2;
+pub mod smb2_session;
+pub mod smb2_ioctl;
+pub mod smb3;
+pub mod dcerpc;
+pub mod session;
+pub mod log;
+pub mod detect;
+pub mod debug;
+pub mod events;
+pub mod auth;
+pub mod files;
+pub mod funcs;
+
+//#[cfg(feature = "lua")]
+//pub mod lua;
diff --git a/rust/src/smb/nbss_records.rs b/rust/src/smb/nbss_records.rs
new file mode 100644
index 0000000..6225eb4
--- /dev/null
+++ b/rust/src/smb/nbss_records.rs
@@ -0,0 +1,223 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use nom7::bytes::streaming::take;
+use nom7::combinator::rest;
+use nom7::number::streaming::be_u32;
+use nom7::IResult;
+
+pub const NBSS_MSGTYPE_SESSION_MESSAGE: u8 = 0x00;
+pub const NBSS_MSGTYPE_SESSION_REQUEST: u8 = 0x81;
+pub const NBSS_MSGTYPE_POSITIVE_SSN_RESPONSE: u8 = 0x82;
+pub const NBSS_MSGTYPE_NEGATIVE_SSN_RESPONSE: u8 = 0x83;
+pub const NBSS_MSGTYPE_RETARG_RESPONSE: u8 = 0x84;
+pub const NBSS_MSGTYPE_KEEP_ALIVE: u8 = 0x85;
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct NbssRecord<'a> {
+ pub message_type: u8,
+ pub length: u32,
+ pub data: &'a[u8],
+}
+
+impl<'a> NbssRecord<'a> {
+ pub fn is_valid(&self) -> bool {
+ let valid = match self.message_type {
+ NBSS_MSGTYPE_SESSION_MESSAGE |
+ NBSS_MSGTYPE_SESSION_REQUEST |
+ NBSS_MSGTYPE_POSITIVE_SSN_RESPONSE |
+ NBSS_MSGTYPE_NEGATIVE_SSN_RESPONSE |
+ NBSS_MSGTYPE_RETARG_RESPONSE |
+ NBSS_MSGTYPE_KEEP_ALIVE => true,
+ _ => false,
+ };
+ valid
+ }
+ pub fn needs_more(&self) -> bool {
+ return self.is_valid() && self.length >= 4 && self.data.len() < 4;
+ }
+ pub fn is_smb(&self) -> bool {
+ let valid = self.is_valid();
+ let smb = self.data.len() >= 4 &&
+ self.data[1] == b'S' && self.data[2] == b'M' && self.data[3] == b'B' && (self.data[0] == b'\xFE' || self.data[0] == b'\xFF' || self.data[0] == b'\xFD');
+
+ valid && smb
+ }
+}
+
+pub fn parse_nbss_record(i: &[u8]) -> IResult<&[u8], NbssRecord> {
+ let (i, buf) = be_u32(i)?;
+ let message_type = (buf >> 24) as u8;
+ let length = buf & 0xff_ffff;
+ let (i, data) = take(length as usize)(i)?;
+ let record = NbssRecord {
+ message_type,
+ length,
+ data,
+ };
+ Ok((i, record))
+}
+
+pub fn parse_nbss_record_partial(i: &[u8]) -> IResult<&[u8], NbssRecord> {
+ let (i, buf) = be_u32(i)?;
+ let message_type = (buf >> 24) as u8;
+ let length = buf & 0xff_ffff;
+ let (i, data) = rest(i)?;
+ let record = NbssRecord {
+ message_type,
+ length,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[cfg(test)]
+mod tests {
+
+ use super::*;
+ use nom7::Err;
+
+ #[test]
+ fn test_parse_nbss_record() {
+ let buff:&[u8] = &[
+ /* message type */ 0x00,
+ /* length */ 0x00, 0x00, 0x55,
+ /* data */ 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00,
+ 0x98, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff,
+ 0xfe, 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03,
+ 0x0a, 0x00, 0x01, 0x00, 0x04, 0x11, 0x00, 0x00, 0x00,
+ 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfd, 0xe3,
+ 0x00, 0x80, 0x2a, 0x55, 0xc4, 0x38, 0x89, 0x03, 0xcd,
+ 0x01, 0x2c, 0x01, 0x00, 0x10, 0x00, 0xfe, 0x82, 0xf1,
+ 0x64, 0x0b, 0x66, 0xba, 0x4a, 0xbb, 0x81, 0xe1, 0xea,
+ 0x54, 0xae, 0xb8, 0x66];
+
+ let result = parse_nbss_record(buff);
+ match result {
+ Ok((remainder, p)) => {
+ assert_eq!(p.message_type, NBSS_MSGTYPE_SESSION_MESSAGE);
+ assert_eq!(p.length, 85);
+ assert_eq!(p.data.len(), 85);
+ assert_ne!(p.message_type, NBSS_MSGTYPE_KEEP_ALIVE);
+
+ // this packet had an acceptable length, we don't need more
+ assert!(!p.needs_more());
+
+ // does this really look like smb?
+ assert!(p.is_smb());
+
+ // there should be nothing left
+ assert_eq!(remainder.len(), 0);
+ }
+ Err(Err::Error(err)) => {
+ panic!("Result should not be an error: {:?}.", err.code);
+ }
+ Err(Err::Incomplete(_)) => {
+ panic!("Result should not have been incomplete.");
+ }
+ _ => {
+ panic!("Unexpected behavior!");
+ }
+ }
+
+ // Non-SMB packet scenario
+ let buff_not_smb:&[u8] = &[
+ /* message type */ 0x00,
+ /* length */ 0x00, 0x00, 0x55,
+ /* data !SMB */ 0xff, 0x52, 0x4e, 0x41, 0x72, 0x00, 0x00, 0x00, 0x00,
+ 0x98, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff,
+ 0xfe, 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03,
+ 0x0a, 0x00, 0x01, 0x00, 0x04, 0x11, 0x00, 0x00, 0x00,
+ 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfd, 0xe3,
+ 0x00, 0x80, 0x2a, 0x55, 0xc4, 0x38, 0x89, 0x03, 0xcd,
+ 0x01, 0x2c, 0x01, 0x00, 0x10, 0x00, 0xfe, 0x82, 0xf1,
+ 0x64, 0x0b, 0x66, 0xba, 0x4a, 0xbb, 0x81, 0xe1, 0xea,
+ 0x54, 0xae, 0xb8, 0x66];
+
+ let result_not_smb = parse_nbss_record(buff_not_smb);
+ match result_not_smb {
+ Ok((remainder, p_not_smb)) => {
+ assert_eq!(p_not_smb.message_type, NBSS_MSGTYPE_SESSION_MESSAGE);
+ assert_eq!(p_not_smb.length, 85);
+ assert_eq!(p_not_smb.data.len(), 85);
+ assert_ne!(p_not_smb.message_type, NBSS_MSGTYPE_KEEP_ALIVE);
+
+ // this packet had an acceptable length, we don't need more
+ assert!(!p_not_smb.needs_more());
+
+ // this packet doesn't have the SMB keyword
+ // is_smb must be false
+ assert!(!p_not_smb.is_smb());
+
+ // there should be nothing left
+ assert_eq!(remainder.len(), 0);
+ }
+ Err(Err::Error(err)) => {
+ panic!("Result should not be an error: {:?}.", err.code);
+ }
+ Err(Err::Incomplete(_)) => {
+ panic!("Result should not have been incomplete.");
+ }
+ _ => {
+ panic!("Unexpected behavior!");
+ }
+ }
+ }
+
+ #[test]
+ fn test_parse_nbss_record_partial() {
+ let buff:&[u8] = &[
+ /* message type */ 0x00,
+ /* length */ 0x00, 0x00, 0x29,
+ /* data < length*/ 0xff, 0x53, 0x4d, 0x42, 0x04, 0x00, 0x00, 0x00,
+ 0x00, 0x18, 0x43, 0xc8, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x02, 0x08, 0xbd, 0x20, 0x02, 0x08, 0x06, 0x00,
+ 0x02, 0x40, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00];
+
+ let result = parse_nbss_record_partial(buff);
+ match result {
+ Ok((remainder, p)) => {
+ assert_eq!(p.message_type, NBSS_MSGTYPE_SESSION_MESSAGE);
+ assert_eq!(p.length, 41);
+ assert_ne!(p.data.len(), 41);
+ assert_ne!(p.message_type, NBSS_MSGTYPE_KEEP_ALIVE);
+
+ // this packet had an acceptable length, we don't need more
+ assert!(!p.needs_more());
+
+ // does this really look like smb?
+ assert!(p.is_smb());
+
+ // there should be nothing left
+ assert_eq!(remainder.len(), 0);
+ }
+ Err(Err::Error(err)) => {
+ panic!("Result should not be an error: {:?}.", err.code);
+ }
+ Err(Err::Incomplete(_)) => {
+ panic!("Result should not have returned as incomplete.");
+ }
+ _ => {
+ panic!("Unexpected behavior!");
+ }
+ }
+
+ }
+}
diff --git a/rust/src/smb/ntlmssp_records.rs b/rust/src/smb/ntlmssp_records.rs
new file mode 100644
index 0000000..d934629
--- /dev/null
+++ b/rust/src/smb/ntlmssp_records.rs
@@ -0,0 +1,211 @@
+/* Copyright (C) 2017-2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::common::nom7::take_until_and_consume;
+use nom7::bytes::streaming::take;
+use nom7::combinator::{cond, rest, verify};
+use nom7::error::{make_error, ErrorKind};
+use nom7::number::streaming::{le_u16, le_u32, le_u8};
+use nom7::Err;
+use nom7::IResult;
+use std::fmt;
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct NTLMSSPVersion {
+ pub ver_major: u8,
+ pub ver_minor: u8,
+ pub ver_build: u16,
+ pub ver_ntlm_rev: u8,
+}
+
+impl fmt::Display for NTLMSSPVersion {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ write!(
+ f,
+ "{}.{} build {} rev {}",
+ self.ver_major, self.ver_minor, self.ver_build, self.ver_ntlm_rev
+ )
+ }
+}
+
+fn parse_ntlm_auth_version(i: &[u8]) -> IResult<&[u8], NTLMSSPVersion> {
+ let (i, ver_major) = le_u8(i)?;
+ let (i, ver_minor) = le_u8(i)?;
+ let (i, ver_build) = le_u16(i)?;
+ let (i, _) = take(3_usize)(i)?;
+ let (i, ver_ntlm_rev) = le_u8(i)?;
+ let version = NTLMSSPVersion {
+ ver_major,
+ ver_minor,
+ ver_build,
+ ver_ntlm_rev,
+ };
+ Ok((i, version))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct NTLMSSPAuthRecord<'a> {
+ pub domain: &'a [u8],
+ pub user: &'a [u8],
+ pub host: &'a [u8],
+ pub version: Option<NTLMSSPVersion>,
+ pub warning: bool,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct NTLMSSPNegotiateFlags {
+ pub version: bool,
+ // others fields not done because not interesting yet
+}
+
+fn parse_ntlm_auth_nego_flags(i: &[u8]) -> IResult<&[u8], NTLMSSPNegotiateFlags> {
+ let (i, raw) = le_u32(i)?;
+ return Ok((
+ i,
+ NTLMSSPNegotiateFlags {
+ version: (raw & 0x2000000) != 0,
+ },
+ ));
+}
+
+const NTLMSSP_IDTYPE_LEN: usize = 12;
+
+fn extract_ntlm_substring(i: &[u8], offset: u32, length: u16) -> IResult<&[u8], &[u8]> {
+ if offset < NTLMSSP_IDTYPE_LEN as u32 {
+ return Err(Err::Error(make_error(i, ErrorKind::LengthValue)));
+ }
+ let start = offset as usize - NTLMSSP_IDTYPE_LEN;
+ let end = offset as usize + length as usize - NTLMSSP_IDTYPE_LEN;
+ if i.len() < end {
+ return Err(Err::Error(make_error(i, ErrorKind::LengthValue)));
+ }
+ return Ok((i, &i[start..end]));
+}
+
+pub fn parse_ntlm_auth_record(i: &[u8]) -> IResult<&[u8], NTLMSSPAuthRecord> {
+ let orig_i = i;
+ let record_len = i.len() + NTLMSSP_IDTYPE_LEN; // identifier (8) and type (4) are cut before we are called
+
+ let (i, _lm_blob_len) = verify(le_u16, |&v| (v as usize) < record_len)(i)?;
+ let (i, _lm_blob_maxlen) = le_u16(i)?;
+ let (i, _lm_blob_offset) = verify(le_u32, |&v| (v as usize) < record_len)(i)?;
+
+ let (i, _ntlmresp_blob_len) = verify(le_u16, |&v| (v as usize) < record_len)(i)?;
+ let (i, _ntlmresp_blob_maxlen) = le_u16(i)?;
+ let (i, _ntlmresp_blob_offset) = verify(le_u32, |&v| (v as usize) < record_len)(i)?;
+
+ let (i, domain_blob_len) = verify(le_u16, |&v| (v as usize) < record_len)(i)?;
+ let (i, _domain_blob_maxlen) = le_u16(i)?;
+ let (i, domain_blob_offset) = verify(le_u32, |&v| (v as usize) < record_len)(i)?;
+
+ let (i, user_blob_len) = verify(le_u16, |&v| (v as usize) < record_len)(i)?;
+ let (i, _user_blob_maxlen) = le_u16(i)?;
+ let (i, user_blob_offset) = verify(le_u32, |&v| (v as usize) < record_len)(i)?;
+
+ let (i, host_blob_len) = verify(le_u16, |&v| (v as usize) < record_len)(i)?;
+ let (i, _host_blob_maxlen) = le_u16(i)?;
+ let (i, host_blob_offset) = verify(le_u32, |&v| (v as usize) < record_len)(i)?;
+
+ let (i, _ssnkey_blob_len) = verify(le_u16, |&v| (v as usize) < record_len)(i)?;
+ let (i, _ssnkey_blob_maxlen) = le_u16(i)?;
+ let (i, _ssnkey_blob_offset) = verify(le_u32, |&v| (v as usize) < record_len)(i)?;
+
+ let (i, nego_flags) = parse_ntlm_auth_nego_flags(i)?;
+ let (_, version) = cond(nego_flags.version, parse_ntlm_auth_version)(i)?;
+
+ // Caller does not care about remaining input...
+ let (_, domain_blob) = extract_ntlm_substring(orig_i, domain_blob_offset, domain_blob_len)?;
+ let (_, user_blob) = extract_ntlm_substring(orig_i, user_blob_offset, user_blob_len)?;
+ let (_, host_blob) = extract_ntlm_substring(orig_i, host_blob_offset, host_blob_len)?;
+
+ let mut warning = false;
+ if (user_blob_offset > 0 && user_blob_offset < domain_blob_offset + domain_blob_len as u32)
+ || (host_blob_offset > 0 && host_blob_offset < user_blob_offset + user_blob_len as u32)
+ {
+ // to set event in transaction
+ warning = true;
+ }
+
+ let record = NTLMSSPAuthRecord {
+ domain: domain_blob,
+ user: user_blob,
+ host: host_blob,
+ warning,
+
+ version,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct NTLMSSPRecord<'a> {
+ pub msg_type: u32,
+ pub data: &'a [u8],
+}
+
+pub fn parse_ntlmssp(i: &[u8]) -> IResult<&[u8], NTLMSSPRecord> {
+ let (i, _) = take_until_and_consume(b"NTLMSSP\x00")(i)?;
+ let (i, msg_type) = le_u32(i)?;
+ let (i, data) = rest(i)?;
+ let record = NTLMSSPRecord { msg_type, data };
+ Ok((i, record))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use nom7::Err;
+ #[test]
+ fn test_parse_auth_nego_flags() {
+ // ntlmssp.negotiateflags 1
+ let blob = [0x15, 0x82, 0x88, 0xe2];
+ let result = parse_ntlm_auth_nego_flags(&blob);
+ match result {
+ Ok((remainder, flags)) => {
+ assert!(flags.version);
+ assert_eq!(remainder.len(), 0);
+ }
+ Err(Err::Error(err)) => {
+ panic!("Result should not be an error: {:?}.", err.code);
+ }
+ Err(Err::Incomplete(_)) => {
+ panic!("Result should not have been incomplete.");
+ }
+ _ => {
+ panic!("Unexpected behavior!");
+ }
+ }
+ // ntlmssp.negotiateflags 0
+ let blob = [0x15, 0x82, 0x88, 0xe0];
+ let result = parse_ntlm_auth_nego_flags(&blob);
+ match result {
+ Ok((remainder, flags)) => {
+ assert!(!flags.version);
+ assert_eq!(remainder.len(), 0);
+ }
+ Err(Err::Error(err)) => {
+ panic!("Result should not be an error: {:?}.", err.code);
+ }
+ Err(Err::Incomplete(_)) => {
+ panic!("Result should not have been incomplete.");
+ }
+ _ => {
+ panic!("Unexpected behavior!");
+ }
+ }
+ }
+}
diff --git a/rust/src/smb/session.rs b/rust/src/smb/session.rs
new file mode 100644
index 0000000..be78669
--- /dev/null
+++ b/rust/src/smb/session.rs
@@ -0,0 +1,69 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::kerberos::*;
+use crate::smb::smb::*;
+use crate::smb::smb1_session::*;
+use crate::smb::auth::*;
+
+#[derive(Default, Debug)]
+pub struct SMBTransactionSessionSetup {
+ pub request_host: Option<SessionSetupRequest>,
+ pub response_host: Option<SessionSetupResponse>,
+ pub ntlmssp: Option<NtlmsspData>,
+ pub krb_ticket: Option<Kerberos5Ticket>,
+}
+
+impl SMBTransactionSessionSetup {
+ pub fn new() -> Self {
+ return Default::default()
+ }
+}
+
+impl SMBState {
+ pub fn new_sessionsetup_tx(&mut self, hdr: SMBCommonHdr)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+
+ tx.hdr = hdr;
+ tx.type_data = Some(SMBTransactionTypeData::SESSIONSETUP(
+ SMBTransactionSessionSetup::new()));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX SESSIONSETUP created: ID {}", tx.id);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ pub fn get_sessionsetup_tx(&mut self, hdr: SMBCommonHdr)
+ -> Option<&mut SMBTransaction>
+ {
+ for tx in &mut self.transactions {
+ let hit = tx.hdr.compare(&hdr) && match tx.type_data {
+ Some(SMBTransactionTypeData::SESSIONSETUP(_)) => { true },
+ _ => { false },
+ };
+ if hit {
+ return Some(tx);
+ }
+ }
+ return None;
+ }
+}
diff --git a/rust/src/smb/smb.rs b/rust/src/smb/smb.rs
new file mode 100644
index 0000000..d6b0a56
--- /dev/null
+++ b/rust/src/smb/smb.rs
@@ -0,0 +1,2435 @@
+/* Copyright (C) 2017-2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/* TODO
+ * - check all parsers for calls on non-SUCCESS status
+ */
+
+/* GAP processing:
+ * - if post-gap we've seen a succesful tx req/res: we consider "re-sync'd"
+ */
+
+// written by Victor Julien
+
+use std;
+use std::str;
+use std::ffi::{self, CString};
+
+use std::collections::HashMap;
+use std::collections::VecDeque;
+
+use nom7::{Err, Needed};
+use nom7::error::{make_error, ErrorKind};
+
+use crate::core::*;
+use crate::applayer;
+use crate::applayer::*;
+use crate::frames::*;
+use crate::conf::*;
+use crate::applayer::{AppLayerResult, AppLayerTxData, AppLayerEvent};
+
+use crate::smb::nbss_records::*;
+use crate::smb::smb1_records::*;
+use crate::smb::smb2_records::*;
+
+use crate::smb::smb1::*;
+use crate::smb::smb2::*;
+use crate::smb::smb3::*;
+use crate::smb::dcerpc::*;
+use crate::smb::session::*;
+use crate::smb::events::*;
+use crate::smb::files::*;
+use crate::smb::smb2_ioctl::*;
+
+#[derive(AppLayerFrameType)]
+pub enum SMBFrameType {
+ NBSSPdu,
+ NBSSHdr,
+ NBSSData,
+ SMB1Pdu,
+ SMB1Hdr,
+ SMB1Data,
+ SMB2Pdu,
+ SMB2Hdr,
+ SMB2Data,
+ SMB3Pdu,
+ SMB3Hdr,
+ SMB3Data,
+}
+
+pub const MIN_REC_SIZE: u16 = 32 + 4; // SMB hdr + nbss hdr
+pub const SMB_CONFIG_DEFAULT_STREAM_DEPTH: u32 = 0;
+
+pub static mut SMB_CFG_MAX_READ_SIZE: u32 = 16777216;
+pub static mut SMB_CFG_MAX_READ_QUEUE_SIZE: u32 = 67108864;
+pub static mut SMB_CFG_MAX_READ_QUEUE_CNT: u32 = 64;
+pub static mut SMB_CFG_MAX_WRITE_SIZE: u32 = 16777216;
+pub static mut SMB_CFG_MAX_WRITE_QUEUE_SIZE: u32 = 67108864;
+pub static mut SMB_CFG_MAX_WRITE_QUEUE_CNT: u32 = 64;
+
+static mut ALPROTO_SMB: AppProto = ALPROTO_UNKNOWN;
+
+static mut SMB_MAX_TX: usize = 1024;
+
+pub static mut SURICATA_SMB_FILE_CONFIG: Option<&'static SuricataFileContext> = None;
+
+#[no_mangle]
+pub extern "C" fn rs_smb_init(context: &'static mut SuricataFileContext)
+{
+ unsafe {
+ SURICATA_SMB_FILE_CONFIG = Some(context);
+ }
+}
+
+pub const SMB_SRV_ERROR: u16 = 1;
+pub const SMB_SRV_BADPW: u16 = 2;
+pub const SMB_SRV_BADTYPE: u16 = 3;
+pub const SMB_SRV_ACCESS: u16 = 4;
+pub const SMB_SRV_BADUID: u16 = 91;
+
+pub fn smb_srv_error_string(c: u16) -> String {
+ match c {
+ SMB_SRV_ERROR => "SRV_ERROR",
+ SMB_SRV_BADPW => "SRV_BADPW",
+ SMB_SRV_BADTYPE => "SRV_BADTYPE",
+ SMB_SRV_ACCESS => "SRV_ACCESS",
+ SMB_SRV_BADUID => "SRV_BADUID",
+ _ => { return (c).to_string(); },
+ }.to_string()
+}
+
+pub const SMB_DOS_SUCCESS: u16 = 0;
+pub const SMB_DOS_BAD_FUNC: u16 = 1;
+pub const SMB_DOS_BAD_FILE: u16 = 2;
+pub const SMB_DOS_BAD_PATH: u16 = 3;
+pub const SMB_DOS_TOO_MANY_OPEN_FILES: u16 = 4;
+pub const SMB_DOS_ACCESS_DENIED: u16 = 5;
+
+pub fn smb_dos_error_string(c: u16) -> String {
+ match c {
+ SMB_DOS_SUCCESS => "DOS_SUCCESS",
+ SMB_DOS_BAD_FUNC => "DOS_BAD_FUNC",
+ SMB_DOS_BAD_FILE => "DOS_BAD_FILE",
+ SMB_DOS_BAD_PATH => "DOS_BAD_PATH",
+ SMB_DOS_TOO_MANY_OPEN_FILES => "DOS_TOO_MANY_OPEN_FILES",
+ SMB_DOS_ACCESS_DENIED => "DOS_ACCESS_DENIED",
+ _ => { return (c).to_string(); },
+ }.to_string()
+}
+
+pub const NTLMSSP_NEGOTIATE: u32 = 1;
+#[cfg(feature = "debug")]
+pub const NTLMSSP_CHALLENGE: u32 = 2;
+pub const NTLMSSP_AUTH: u32 = 3;
+
+#[cfg(feature = "debug")]
+pub fn ntlmssp_type_string(c: u32) -> String {
+ match c {
+ NTLMSSP_NEGOTIATE => "NTLMSSP_NEGOTIATE",
+ NTLMSSP_CHALLENGE => "NTLMSSP_CHALLENGE",
+ NTLMSSP_AUTH => "NTLMSSP_AUTH",
+ _ => { return (c).to_string(); },
+ }.to_string()
+}
+
+#[derive(Default, Eq, PartialEq, Debug, Clone)]
+pub struct SMBVerCmdStat {
+ smb_ver: u8,
+ smb1_cmd: u8,
+ smb2_cmd: u16,
+
+ status_set: bool,
+ status_is_dos_error: bool,
+ status_error_class: u8,
+ status: u32,
+}
+
+impl SMBVerCmdStat {
+ pub fn new() -> Self {
+ Default::default()
+ }
+ pub fn new1(cmd: u8) -> Self {
+ return Self {
+ smb_ver: 1,
+ smb1_cmd: cmd,
+ ..Default::default()
+ }
+ }
+ pub fn new1_with_ntstatus(cmd: u8, status: u32) -> Self {
+ return Self {
+ smb_ver: 1,
+ smb1_cmd: cmd,
+ status_set: true,
+ status,
+ ..Default::default()
+ }
+ }
+ pub fn new2(cmd: u16) -> Self {
+ return Self {
+ smb_ver: 2,
+ smb2_cmd: cmd,
+ ..Default::default()
+ }
+ }
+
+ pub fn new2_with_ntstatus(cmd: u16, status: u32) -> Self {
+ return Self {
+ smb_ver: 2,
+ smb2_cmd: cmd,
+ status_set: true,
+ status,
+ ..Default::default()
+ }
+ }
+
+ pub fn set_smb1_cmd(&mut self, cmd: u8) -> bool {
+ if self.smb_ver != 0 {
+ return false;
+ }
+ self.smb_ver = 1;
+ self.smb1_cmd = cmd;
+ return true;
+ }
+
+ pub fn set_smb2_cmd(&mut self, cmd: u16) -> bool {
+ if self.smb_ver != 0 {
+ return false;
+ }
+ self.smb_ver = 2;
+ self.smb2_cmd = cmd;
+ return true;
+ }
+
+ pub fn get_version(&self) -> u8 {
+ self.smb_ver
+ }
+
+ pub fn get_smb1_cmd(&self) -> (bool, u8) {
+ if self.smb_ver != 1 {
+ return (false, 0);
+ }
+ return (true, self.smb1_cmd);
+ }
+
+ pub fn get_smb2_cmd(&self) -> (bool, u16) {
+ if self.smb_ver != 2 {
+ return (false, 0);
+ }
+ return (true, self.smb2_cmd);
+ }
+
+ pub fn get_ntstatus(&self) -> (bool, u32) {
+ (self.status_set && !self.status_is_dos_error, self.status)
+ }
+
+ pub fn get_dos_error(&self) -> (bool, u8, u16) {
+ (self.status_set && self.status_is_dos_error, self.status_error_class, self.status as u16)
+ }
+
+ fn set_status(&mut self, status: u32, is_dos_error: bool)
+ {
+ if is_dos_error {
+ self.status_is_dos_error = true;
+ self.status_error_class = (status & 0x0000_00ff) as u8;
+ self.status = (status & 0xffff_0000) >> 16;
+ } else {
+ self.status = status;
+ }
+ self.status_set = true;
+ }
+
+ pub fn set_ntstatus(&mut self, status: u32)
+ {
+ self.set_status(status, false)
+ }
+
+ pub fn set_status_dos_error(&mut self, status: u32)
+ {
+ self.set_status(status, true)
+ }
+}
+
+/// "The FILETIME structure is a 64-bit value that represents the number of
+/// 100-nanosecond intervals that have elapsed since January 1, 1601,
+/// Coordinated Universal Time (UTC)."
+#[derive(Eq, PartialEq, Debug, Clone)]
+pub struct SMBFiletime {
+ ts: u64,
+}
+
+impl SMBFiletime {
+ pub fn new(raw: u64) -> Self {
+ Self {
+ ts: raw,
+ }
+ }
+
+ /// inspired by Bro, convert FILETIME to secs since unix epoch
+ pub fn as_unix(&self) -> u32 {
+ if self.ts > 116_444_736_000_000_000_u64 {
+ let ts = self.ts / 10000000 - 11644473600;
+ ts as u32
+ } else {
+ 0
+ }
+ }
+}
+
+#[derive(Debug)]
+pub enum SMBTransactionTypeData {
+ FILE(SMBTransactionFile),
+ TREECONNECT(SMBTransactionTreeConnect),
+ NEGOTIATE(SMBTransactionNegotiate),
+ DCERPC(SMBTransactionDCERPC),
+ CREATE(SMBTransactionCreate),
+ SESSIONSETUP(SMBTransactionSessionSetup),
+ IOCTL(SMBTransactionIoctl),
+ RENAME(SMBTransactionRename),
+ SETFILEPATHINFO(SMBTransactionSetFilePathInfo),
+}
+
+// Used for Trans2 SET_PATH_INFO and SET_FILE_INFO
+#[derive(Debug)]
+pub struct SMBTransactionSetFilePathInfo {
+ pub subcmd: u16,
+ pub loi: u16,
+ pub delete_on_close: bool,
+ pub filename: Vec<u8>,
+ pub fid: Vec<u8>,
+}
+
+impl SMBTransactionSetFilePathInfo {
+ pub fn new(filename: Vec<u8>, fid: Vec<u8>, subcmd: u16, loi: u16, delete_on_close: bool)
+ -> Self
+ {
+ return Self {
+ filename, fid,
+ subcmd,
+ loi,
+ delete_on_close,
+ };
+ }
+}
+
+impl SMBState {
+ pub fn new_setfileinfo_tx(&mut self, filename: Vec<u8>, fid: Vec<u8>,
+ subcmd: u16, loi: u16, delete_on_close: bool)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+
+ tx.type_data = Some(SMBTransactionTypeData::SETFILEPATHINFO(
+ SMBTransactionSetFilePathInfo::new(
+ filename, fid, subcmd, loi, delete_on_close)));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX SETFILEPATHINFO created: ID {}", tx.id);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ pub fn new_setpathinfo_tx(&mut self, filename: Vec<u8>,
+ subcmd: u16, loi: u16, delete_on_close: bool)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+
+ let fid : Vec<u8> = Vec::new();
+ tx.type_data = Some(SMBTransactionTypeData::SETFILEPATHINFO(
+ SMBTransactionSetFilePathInfo::new(filename, fid,
+ subcmd, loi, delete_on_close)));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX SETFILEPATHINFO created: ID {}", tx.id);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+}
+
+#[derive(Debug)]
+pub struct SMBTransactionRename {
+ pub oldname: Vec<u8>,
+ pub newname: Vec<u8>,
+ pub fuid: Vec<u8>,
+}
+
+impl SMBTransactionRename {
+ pub fn new(fuid: Vec<u8>, oldname: Vec<u8>, newname: Vec<u8>) -> Self {
+ return Self {
+ fuid, oldname, newname,
+ };
+ }
+}
+
+impl SMBState {
+ pub fn new_rename_tx(&mut self, fuid: Vec<u8>, oldname: Vec<u8>, newname: Vec<u8>)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+
+ tx.type_data = Some(SMBTransactionTypeData::RENAME(
+ SMBTransactionRename::new(fuid, oldname, newname)));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX RENAME created: ID {}", tx.id);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+}
+
+#[derive(Default, Debug)]
+pub struct SMBTransactionCreate {
+ pub disposition: u32,
+ pub delete_on_close: bool,
+ pub directory: bool,
+ pub filename: Vec<u8>,
+ pub guid: Vec<u8>,
+
+ pub create_ts: u32,
+ pub last_access_ts: u32,
+ pub last_write_ts: u32,
+ pub last_change_ts: u32,
+
+ pub size: u64,
+}
+
+impl SMBTransactionCreate {
+ pub fn new(filename: Vec<u8>, disp: u32, del: bool, dir: bool) -> Self {
+ return Self {
+ disposition: disp,
+ delete_on_close: del,
+ directory: dir,
+ filename,
+ ..Default::default()
+ }
+ }
+}
+
+#[derive(Default, Debug)]
+pub struct SMBTransactionNegotiate {
+ pub smb_ver: u8,
+ pub dialects: Vec<Vec<u8>>,
+ pub dialects2: Vec<Vec<u8>>,
+
+ // SMB1 doesn't have the client GUID
+ pub client_guid: Option<Vec<u8>>,
+ pub server_guid: Vec<u8>,
+}
+
+impl SMBTransactionNegotiate {
+ pub fn new(smb_ver: u8) -> Self {
+ return Self {
+ smb_ver,
+ server_guid: Vec::with_capacity(16),
+ ..Default::default()
+ };
+ }
+}
+
+#[derive(Default, Debug)]
+pub struct SMBTransactionTreeConnect {
+ pub is_pipe: bool,
+ pub share_type: u8,
+ pub tree_id: u32,
+ pub share_name: Vec<u8>,
+
+ /// SMB1 service strings
+ pub req_service: Option<Vec<u8>>,
+ pub res_service: Option<Vec<u8>>,
+}
+
+impl SMBTransactionTreeConnect {
+ pub fn new(share_name: Vec<u8>) -> Self {
+ return Self {
+ share_name,
+ ..Default::default()
+ };
+ }
+}
+
+#[derive(Debug)]
+pub struct SMBTransaction {
+ pub id: u64, /// internal id
+
+ /// version, command and status
+ pub vercmd: SMBVerCmdStat,
+ /// session id, tree id, etc.
+ pub hdr: SMBCommonHdr,
+
+ /// for state tracking. false means this side is in progress, true
+ /// that it's complete.
+ pub request_done: bool,
+ pub response_done: bool,
+
+ /// Command specific data
+ pub type_data: Option<SMBTransactionTypeData>,
+
+ pub tx_data: AppLayerTxData,
+}
+
+impl Transaction for SMBTransaction {
+ fn id(&self) -> u64 {
+ self.id
+ }
+}
+
+impl Default for SMBTransaction {
+ fn default() -> Self {
+ Self::new()
+ }
+}
+
+impl SMBTransaction {
+ pub fn new() -> Self {
+ return Self {
+ id: 0,
+ vercmd: SMBVerCmdStat::new(),
+ hdr: SMBCommonHdr::default(),
+ request_done: false,
+ response_done: false,
+ type_data: None,
+ tx_data: AppLayerTxData::new(),
+ }
+ }
+
+ pub fn set_status(&mut self, status: u32, is_dos_error: bool)
+ {
+ if is_dos_error {
+ self.vercmd.set_status_dos_error(status);
+ } else {
+ self.vercmd.set_ntstatus(status);
+ }
+ }
+
+ pub fn free(&mut self) {
+ SCLogDebug!("SMB TX {:p} free ID {}", &self, self.id);
+ debug_validate_bug_on!(self.tx_data.files_opened > 1);
+ debug_validate_bug_on!(self.tx_data.files_logged > 1);
+ }
+}
+
+impl Drop for SMBTransaction {
+ fn drop(&mut self) {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = self.type_data {
+ if let Some(sfcm) = unsafe { SURICATA_SMB_FILE_CONFIG } {
+ tdf.file_tracker.file.free(sfcm);
+ }
+ }
+ self.free();
+ }
+}
+
+#[derive(Hash, Eq, PartialEq, Debug, Clone)]
+pub struct SMBFileGUIDOffset {
+ pub guid: Vec<u8>,
+ pub offset: u64,
+}
+
+impl SMBFileGUIDOffset {
+ pub fn new(guid: Vec<u8>, offset: u64) -> Self {
+ Self {
+ guid,
+ offset,
+ }
+ }
+}
+
+/// type values to make sure we're not mixing things
+/// up in hashmap lookups
+pub const SMBHDR_TYPE_GUID: u32 = 1;
+pub const SMBHDR_TYPE_SHARE: u32 = 2;
+pub const SMBHDR_TYPE_FILENAME: u32 = 3;
+pub const SMBHDR_TYPE_OFFSET: u32 = 4;
+pub const SMBHDR_TYPE_GENERICTX: u32 = 5;
+pub const SMBHDR_TYPE_HEADER: u32 = 6;
+//unused pub const SMBHDR_TYPE_MAX_SIZE: u32 = 7; // max resp size for SMB1_COMMAND_TRANS
+pub const SMBHDR_TYPE_TRANS_FRAG: u32 = 8;
+pub const SMBHDR_TYPE_TREE: u32 = 9;
+pub const SMBHDR_TYPE_DCERPCTX: u32 = 10;
+
+#[derive(Default, Hash, Eq, PartialEq, Debug)]
+pub struct SMBCommonHdr {
+ pub ssn_id: u64,
+ pub tree_id: u32,
+ pub rec_type: u32,
+ pub msg_id: u64,
+}
+
+impl SMBCommonHdr {
+ pub fn new(rec_type: u32, ssn_id: u64, tree_id: u32, msg_id: u64) -> Self {
+ Self {
+ rec_type,
+ ssn_id,
+ tree_id,
+ msg_id,
+ }
+ }
+ pub fn from2(r: &Smb2Record, rec_type: u32) -> SMBCommonHdr {
+ let tree_id = match rec_type {
+ SMBHDR_TYPE_TREE => { 0 },
+ _ => r.tree_id,
+ };
+ let msg_id = match rec_type {
+ SMBHDR_TYPE_TRANS_FRAG | SMBHDR_TYPE_SHARE => { 0 },
+ _ => { r.message_id },
+ };
+
+ SMBCommonHdr {
+ rec_type,
+ ssn_id : r.session_id,
+ tree_id,
+ msg_id,
+ }
+
+ }
+ pub fn from2_notree(r: &Smb2Record, rec_type: u32) -> SMBCommonHdr {
+ // async responses do not have a tree id (even if the request has it)
+ // making thus the match between the two impossible.
+ // Per spec, MessageId should be enough to identify a message request and response uniquely
+ // across all messages that are sent on the same SMB2 Protocol transport connection.
+ // cf https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/ea4560b7-90da-4803-82b5-344754b92a79
+ let msg_id = match rec_type {
+ SMBHDR_TYPE_TRANS_FRAG | SMBHDR_TYPE_SHARE => { 0 },
+ _ => { r.message_id },
+ };
+
+ SMBCommonHdr {
+ rec_type,
+ ssn_id : r.session_id,
+ tree_id : 0,
+ msg_id,
+ }
+ }
+ pub fn from1(r: &SmbRecord, rec_type: u32) -> SMBCommonHdr {
+ let tree_id = match rec_type {
+ SMBHDR_TYPE_TREE => { 0 },
+ _ => r.tree_id as u32,
+ };
+ let msg_id = match rec_type {
+ SMBHDR_TYPE_TRANS_FRAG | SMBHDR_TYPE_SHARE => { 0 },
+ _ => { r.multiplex_id as u64 },
+ };
+
+ SMBCommonHdr {
+ rec_type,
+ ssn_id : r.ssn_id as u64,
+ tree_id,
+ msg_id,
+ }
+ }
+
+ // don't include tree id
+ pub fn compare(&self, hdr: &SMBCommonHdr) -> bool {
+ self.rec_type == hdr.rec_type && self.ssn_id == hdr.ssn_id &&
+ self.msg_id == hdr.msg_id
+ }
+}
+
+#[derive(Hash, Eq, PartialEq, Debug)]
+pub struct SMBHashKeyHdrGuid {
+ hdr: SMBCommonHdr,
+ guid: Vec<u8>,
+}
+
+impl SMBHashKeyHdrGuid {
+ pub fn new(hdr: SMBCommonHdr, guid: Vec<u8>) -> Self {
+ Self {
+ hdr, guid,
+ }
+ }
+}
+
+#[derive(Hash, Eq, PartialEq, Debug)]
+pub struct SMBTree {
+ pub name: Vec<u8>,
+ pub is_pipe: bool,
+}
+
+impl SMBTree {
+ pub fn new(name: Vec<u8>, is_pipe: bool) -> Self {
+ Self {
+ name,
+ is_pipe,
+ }
+ }
+}
+
+pub fn u32_as_bytes(i: u32) -> [u8;4] {
+ let o1: u8 = ((i >> 24) & 0xff) as u8;
+ let o2: u8 = ((i >> 16) & 0xff) as u8;
+ let o3: u8 = ((i >> 8) & 0xff) as u8;
+ let o4: u8 = (i & 0xff) as u8;
+ return [o1, o2, o3, o4]
+}
+
+#[derive(Default, Debug)]
+pub struct SMBState<> {
+ pub state_data: AppLayerStateData,
+
+ /// map ssn/tree/msgid to vec (guid/name/share)
+ pub ssn2vec_map: HashMap<SMBCommonHdr, Vec<u8>>,
+ /// map guid to filename
+ pub guid2name_map: HashMap<Vec<u8>, Vec<u8>>,
+ /// map ssn key to read offset
+ pub ssn2vecoffset_map: HashMap<SMBCommonHdr, SMBFileGUIDOffset>,
+
+ pub ssn2tree_map: HashMap<SMBCommonHdr, SMBTree>,
+
+ // store partial data records that are transferred in multiple
+ // requests for DCERPC.
+ pub ssnguid2vec_map: HashMap<SMBHashKeyHdrGuid, Vec<u8>>,
+
+ skip_ts: u32,
+ skip_tc: u32,
+
+ pub file_ts_left : u32,
+ pub file_tc_left : u32,
+ pub file_ts_guid : Vec<u8>,
+ pub file_tc_guid : Vec<u8>,
+
+ pub ts_ssn_gap: bool,
+ pub tc_ssn_gap: bool,
+
+ pub ts_gap: bool, // last TS update was gap
+ pub tc_gap: bool, // last TC update was gap
+
+ pub ts_trunc: bool, // no more data for TOSERVER
+ pub tc_trunc: bool, // no more data for TOCLIENT
+
+ /// true as long as we have file txs that are in a post-gap
+ /// state. It means we'll do extra house keeping for those.
+ check_post_gap_file_txs: bool,
+ post_gap_files_checked: bool,
+
+ /// transactions list
+ pub transactions: VecDeque<SMBTransaction>,
+ tx_index_completed: usize,
+
+ /// tx counter for assigning incrementing id's to tx's
+ tx_id: u64,
+
+ /// SMB2 dialect or 0 if not set or SMB1
+ pub dialect: u16,
+ /// contains name of SMB1 dialect
+ pub dialect_vec: Option<Vec<u8>>, // used if dialect == 0
+
+ /// dcerpc interfaces, stored here to be able to match
+ /// them while inspecting DCERPC REQUEST txs
+ pub dcerpc_ifaces: Option<Vec<DCERPCIface>>,
+
+ pub max_read_size: u32,
+ pub max_write_size: u32,
+
+ /// Timestamp in seconds of last update. This is packet time,
+ /// potentially coming from pcaps.
+ ts: u64,
+}
+
+impl State<SMBTransaction> for SMBState {
+ fn get_transaction_count(&self) -> usize {
+ self.transactions.len()
+ }
+
+ fn get_transaction_by_index(&self, index: usize) -> Option<&SMBTransaction> {
+ self.transactions.get(index)
+ }
+}
+
+impl SMBState {
+ /// Allocation function for a new TLS parser instance
+ pub fn new() -> Self {
+ Self {
+ state_data:AppLayerStateData::new(),
+ ssn2vec_map:HashMap::new(),
+ guid2name_map:HashMap::new(),
+ ssn2vecoffset_map:HashMap::new(),
+ ssn2tree_map:HashMap::new(),
+ ssnguid2vec_map:HashMap::new(),
+ skip_ts:0,
+ skip_tc:0,
+ file_ts_left:0,
+ file_tc_left:0,
+ file_ts_guid:Vec::new(),
+ file_tc_guid:Vec::new(),
+ ts_ssn_gap: false,
+ tc_ssn_gap: false,
+ ts_gap: false,
+ tc_gap: false,
+ ts_trunc: false,
+ tc_trunc: false,
+ check_post_gap_file_txs: false,
+ post_gap_files_checked: false,
+ transactions: VecDeque::new(),
+ tx_index_completed: 0,
+ tx_id:0,
+ dialect:0,
+ dialect_vec: None,
+ dcerpc_ifaces: None,
+ ts: 0,
+ ..Default::default()
+ }
+ }
+
+ pub fn free(&mut self) {
+ //self._debug_state_stats();
+ self._debug_tx_stats();
+ }
+
+ pub fn new_tx(&mut self) -> SMBTransaction {
+ let mut tx = SMBTransaction::new();
+ self.tx_id += 1;
+ tx.id = self.tx_id;
+ SCLogDebug!("TX {} created", tx.id);
+ if self.transactions.len() > unsafe { SMB_MAX_TX } {
+ let mut index = self.tx_index_completed;
+ for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
+ index += 1;
+ if !tx_old.request_done || !tx_old.response_done {
+ tx_old.request_done = true;
+ tx_old.response_done = true;
+ tx_old.set_event(SMBEvent::TooManyTransactions);
+ break;
+ }
+ }
+ self.tx_index_completed = index;
+
+ }
+ return tx;
+ }
+
+ pub fn free_tx(&mut self, tx_id: u64) {
+ SCLogDebug!("Freeing TX with ID {} TX.ID {}", tx_id, tx_id+1);
+ let len = self.transactions.len();
+ let mut found = false;
+ let mut index = 0;
+ for i in 0..len {
+ let tx = &self.transactions[i];
+ if tx.id == tx_id + 1 {
+ found = true;
+ index = i;
+ SCLogDebug!("tx {} progress {}/{}", tx.id, tx.request_done, tx.response_done);
+ break;
+ }
+ }
+ if found {
+ SCLogDebug!("freeing TX with ID {} TX.ID {} at index {} left: {} max id: {}",
+ tx_id, tx_id+1, index, self.transactions.len(), self.tx_id);
+ self.tx_index_completed = 0;
+ self.transactions.remove(index);
+ }
+ }
+
+ pub fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&SMBTransaction> {
+/*
+ if self.transactions.len() > 100 {
+ SCLogNotice!("get_tx_by_id: tx_id={} in list={}", tx_id, self.transactions.len());
+ self._dump_txs();
+ panic!("txs exploded");
+ }
+*/
+ for tx in &mut self.transactions {
+ if tx.id == tx_id + 1 {
+ let ver = tx.vercmd.get_version();
+ let mut _smbcmd;
+ if ver == 2 {
+ let (_, cmd) = tx.vercmd.get_smb2_cmd();
+ _smbcmd = cmd;
+ } else {
+ let (_, cmd) = tx.vercmd.get_smb1_cmd();
+ _smbcmd = cmd as u16;
+ }
+ SCLogDebug!("Found SMB TX: id {} ver:{} cmd:{} progress {}/{} type_data {:?}",
+ tx.id, ver, _smbcmd, tx.request_done, tx.response_done, tx.type_data);
+ /* hack: apply flow file flags to file tx here to make sure its propagated */
+ if let Some(SMBTransactionTypeData::FILE(ref mut d)) = tx.type_data {
+ tx.tx_data.update_file_flags(self.state_data.file_flags);
+ d.update_file_flags(tx.tx_data.file_flags);
+ }
+ return Some(tx);
+ }
+ }
+ SCLogDebug!("Failed to find SMB TX with ID {}", tx_id);
+ return None;
+ }
+
+ fn update_ts(&mut self, ts: u64) {
+ if ts != self.ts {
+ self.ts = ts;
+ self.post_gap_files_checked = false;
+ }
+ }
+
+ /* generic TX has no type_data and is only used to
+ * track a single cmd request/reply pair. */
+
+ pub fn new_generic_tx(&mut self, smb_ver: u8, smb_cmd: u16, key: SMBCommonHdr)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ if smb_ver == 1 && smb_cmd <= 255 {
+ tx.vercmd.set_smb1_cmd(smb_cmd as u8);
+ } else if smb_ver == 2 {
+ tx.vercmd.set_smb2_cmd(smb_cmd);
+ }
+
+ tx.type_data = None;
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+ tx.hdr = key;
+
+ SCLogDebug!("SMB: TX GENERIC created: ID {} tx list {} {:?}",
+ tx.id, self.transactions.len(), &tx);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ pub fn get_last_tx(&mut self, smb_ver: u8, smb_cmd: u16)
+ -> Option<&mut SMBTransaction>
+ {
+ let tx_ref = self.transactions.back_mut();
+ if let Some(tx) = tx_ref {
+ let found = if tx.vercmd.get_version() == smb_ver {
+ if smb_ver == 1 {
+ let (_, cmd) = tx.vercmd.get_smb1_cmd();
+ cmd as u16 == smb_cmd
+ } else if smb_ver == 2 {
+ let (_, cmd) = tx.vercmd.get_smb2_cmd();
+ cmd == smb_cmd
+ } else {
+ false
+ }
+ } else {
+ false
+ };
+ if found {
+ return Some(tx);
+ }
+ }
+ return None;
+ }
+
+ pub fn get_generic_tx(&mut self, smb_ver: u8, smb_cmd: u16, key: &SMBCommonHdr)
+ -> Option<&mut SMBTransaction>
+ {
+ for tx in &mut self.transactions {
+ let found = if tx.vercmd.get_version() == smb_ver {
+ if smb_ver == 1 {
+ let (_, cmd) = tx.vercmd.get_smb1_cmd();
+ cmd as u16 == smb_cmd && tx.hdr.compare(key)
+ } else if smb_ver == 2 {
+ let (_, cmd) = tx.vercmd.get_smb2_cmd();
+ cmd == smb_cmd && tx.hdr.compare(key)
+ } else {
+ false
+ }
+ } else {
+ false
+ };
+ if found {
+ return Some(tx);
+ }
+ }
+ return None;
+ }
+
+ pub fn new_negotiate_tx(&mut self, smb_ver: u8)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ if smb_ver == 1 {
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_NEGOTIATE_PROTOCOL);
+ } else if smb_ver == 2 {
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_NEGOTIATE_PROTOCOL);
+ }
+
+ tx.type_data = Some(SMBTransactionTypeData::NEGOTIATE(
+ SMBTransactionNegotiate::new(smb_ver)));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX NEGOTIATE created: ID {} SMB ver {}", tx.id, smb_ver);
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ pub fn get_negotiate_tx(&mut self, smb_ver: u8)
+ -> Option<&mut SMBTransaction>
+ {
+ for tx in &mut self.transactions {
+ let found = match tx.type_data {
+ Some(SMBTransactionTypeData::NEGOTIATE(ref x)) => {
+ x.smb_ver == smb_ver
+ },
+ _ => { false },
+ };
+ if found {
+ return Some(tx);
+ }
+ }
+ return None;
+ }
+
+ pub fn new_treeconnect_tx(&mut self, hdr: SMBCommonHdr, name: Vec<u8>)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+
+ tx.hdr = hdr;
+ tx.type_data = Some(SMBTransactionTypeData::TREECONNECT(
+ SMBTransactionTreeConnect::new(name.to_vec())));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX TREECONNECT created: ID {} NAME {}",
+ tx.id, String::from_utf8_lossy(&name));
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ pub fn get_treeconnect_tx(&mut self, hdr: SMBCommonHdr)
+ -> Option<&mut SMBTransaction>
+ {
+ for tx in &mut self.transactions {
+ let hit = tx.hdr.compare(&hdr) && match tx.type_data {
+ Some(SMBTransactionTypeData::TREECONNECT(_)) => { true },
+ _ => { false },
+ };
+ if hit {
+ return Some(tx);
+ }
+ }
+ return None;
+ }
+
+ pub fn new_create_tx(&mut self, file_name: &[u8],
+ disposition: u32, del: bool, dir: bool,
+ hdr: SMBCommonHdr)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ tx.hdr = hdr;
+ tx.type_data = Some(SMBTransactionTypeData::CREATE(
+ SMBTransactionCreate::new(
+ file_name.to_vec(), disposition,
+ del, dir)));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+
+ pub fn get_service_for_guid(&self, guid: &[u8]) -> (&'static str, bool)
+ {
+ let (name, is_dcerpc) = match self.guid2name_map.get(&guid.to_vec()) {
+ Some(n) => {
+ let mut s = n.as_slice();
+ // skip leading \ if we have it
+ if s.len() > 1 && s[0] == 0x5c_u8 {
+ s = &s[1..];
+ }
+ match str::from_utf8(s) {
+ Ok("PSEXESVC") => ("PSEXESVC", false),
+ Ok("svcctl") => ("svcctl", true),
+ Ok("srvsvc") => ("srvsvc", true),
+ Ok("atsvc") => ("atsvc", true),
+ Ok("lsarpc") => ("lsarpc", true),
+ Ok("samr") => ("samr", true),
+ Ok("spoolss") => ("spoolss", true),
+ Ok("winreg") => ("winreg", true),
+ Ok("suricata::dcerpc") => ("unknown", true),
+ Err(_) => ("MALFORMED", false),
+ Ok(&_) => {
+ SCLogDebug!("don't know {}", String::from_utf8_lossy(n));
+ ("UNKNOWN", false)
+ },
+ }
+ },
+ _ => { ("UNKNOWN", false) },
+ };
+ SCLogDebug!("service {} is_dcerpc {}", name, is_dcerpc);
+ (name, is_dcerpc)
+ }
+
+ fn post_gap_housekeeping_for_files(&mut self)
+ {
+ let mut post_gap_txs = false;
+ for tx in &mut self.transactions {
+ if let Some(SMBTransactionTypeData::FILE(ref mut f)) = tx.type_data {
+ if f.post_gap_ts > 0 {
+ if self.ts > f.post_gap_ts {
+ tx.request_done = true;
+ tx.response_done = true;
+ filetracker_trunc(&mut f.file_tracker);
+ } else {
+ post_gap_txs = true;
+ }
+ }
+ }
+ }
+ self.check_post_gap_file_txs = post_gap_txs;
+ }
+
+ /* after a gap we will consider all transactions complete for our
+ * direction. File transfer transactions are an exception. Those
+ * can handle gaps. For the file transactions we set the current
+ * (flow) time and prune them in 60 seconds if no update for them
+ * was received. */
+ fn post_gap_housekeeping(&mut self, dir: Direction)
+ {
+ if self.ts_ssn_gap && dir == Direction::ToServer {
+ for tx in &mut self.transactions {
+ if tx.id >= self.tx_id {
+ SCLogDebug!("post_gap_housekeeping: done");
+ break;
+ }
+ if let Some(SMBTransactionTypeData::FILE(ref mut f)) = tx.type_data {
+ // leaving FILE txs open as they can deal with gaps. We
+ // remove them after 60 seconds of no activity though.
+ if f.post_gap_ts == 0 {
+ f.post_gap_ts = self.ts + 60;
+ self.check_post_gap_file_txs = true;
+ }
+ } else {
+ SCLogDebug!("post_gap_housekeeping: tx {} marked as done TS", tx.id);
+ tx.request_done = true;
+ }
+ }
+ } else if self.tc_ssn_gap && dir == Direction::ToClient {
+ for tx in &mut self.transactions {
+ if tx.id >= self.tx_id {
+ SCLogDebug!("post_gap_housekeeping: done");
+ break;
+ }
+ if let Some(SMBTransactionTypeData::FILE(ref mut f)) = tx.type_data {
+ // leaving FILE txs open as they can deal with gaps. We
+ // remove them after 60 seconds of no activity though.
+ if f.post_gap_ts == 0 {
+ f.post_gap_ts = self.ts + 60;
+ self.check_post_gap_file_txs = true;
+ }
+ } else {
+ SCLogDebug!("post_gap_housekeeping: tx {} marked as done TC", tx.id);
+ tx.request_done = true;
+ tx.response_done = true;
+ }
+ }
+
+ }
+ }
+
+ pub fn set_file_left(&mut self, direction: Direction, rec_size: u32, data_size: u32, fuid: Vec<u8>)
+ {
+ let left = rec_size.saturating_sub(data_size);
+ if direction == Direction::ToServer {
+ self.file_ts_left = left;
+ self.file_ts_guid = fuid;
+ } else {
+ self.file_tc_left = left;
+ self.file_tc_guid = fuid;
+ }
+ }
+
+ pub fn set_skip(&mut self, direction: Direction, nbss_remaining: u32)
+ {
+ if direction == Direction::ToServer {
+ self.skip_ts = nbss_remaining;
+ } else {
+ self.skip_tc = nbss_remaining;
+ }
+ }
+
+ // return how much data we consumed
+ fn handle_skip(&mut self, direction: Direction, input_size: u32) -> u32 {
+ let mut skip_left = if direction == Direction::ToServer {
+ self.skip_ts
+ } else {
+ self.skip_tc
+ };
+ if skip_left == 0 {
+ return 0
+ }
+ SCLogDebug!("skip_left {} input_size {}", skip_left, input_size);
+
+ let consumed = if skip_left >= input_size {
+ input_size
+ } else {
+ skip_left
+ };
+
+ if skip_left <= input_size {
+ skip_left = 0;
+ } else {
+ skip_left -= input_size;
+ }
+
+ if direction == Direction::ToServer {
+ self.skip_ts = skip_left;
+ } else {
+ self.skip_tc = skip_left;
+ }
+ return consumed;
+ }
+
+ fn add_nbss_ts_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
+ let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8);
+ SCLogDebug!("NBSS PDU frame {:?}", nbss_pdu);
+ let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8);
+ SCLogDebug!("NBSS HDR frame {:?}", nbss_hdr_frame);
+ let nbss_data_frame = Frame::new(flow, stream_slice, &input[4..], nbss_len, SMBFrameType::NBSSData as u8);
+ SCLogDebug!("NBSS DATA frame {:?}", nbss_data_frame);
+ (nbss_pdu, nbss_hdr_frame, nbss_data_frame)
+ }
+
+ fn add_smb1_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8);
+ SCLogDebug!("SMB PDU frame {:?}", smb_pdu);
+ smb_pdu
+ }
+ fn add_smb1_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
+ let _smb1_hdr = Frame::new(flow, stream_slice, input, 32_i64, SMBFrameType::SMB1Hdr as u8);
+ SCLogDebug!("SMBv1 HDR frame {:?}", _smb1_hdr);
+ if input.len() > 32 {
+ let _smb1_data = Frame::new(flow, stream_slice, &input[32..], nbss_len - 32, SMBFrameType::SMB1Data as u8);
+ SCLogDebug!("SMBv1 DATA frame {:?}", _smb1_data);
+ }
+ }
+
+ fn add_smb2_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8);
+ SCLogDebug!("SMBv2 PDU frame {:?}", smb_pdu);
+ smb_pdu
+ }
+ fn add_smb2_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
+ let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8);
+ SCLogDebug!("SMBv2 HDR frame {:?}", _smb2_hdr);
+ if input.len() > hdr_len as usize {
+ let _smb2_data = Frame::new(flow, stream_slice, &input[hdr_len as usize..], nbss_len - hdr_len, SMBFrameType::SMB2Data as u8);
+ SCLogDebug!("SMBv2 DATA frame {:?}", _smb2_data);
+ }
+ }
+
+ fn add_smb3_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8);
+ SCLogDebug!("SMBv3 PDU frame {:?}", smb_pdu);
+ smb_pdu
+ }
+ fn add_smb3_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
+ let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8);
+ SCLogDebug!("SMBv3 HDR frame {:?}", _smb3_hdr);
+ if input.len() > 52 {
+ let _smb3_data = Frame::new(flow, stream_slice, &input[52..], nbss_len - 52, SMBFrameType::SMB3Data as u8);
+ SCLogDebug!("SMBv3 DATA frame {:?}", _smb3_data);
+ }
+ }
+
+ /// return bytes consumed
+ pub fn parse_tcp_data_ts_partial(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8]) -> usize
+ {
+ SCLogDebug!("incomplete of size {}", input.len());
+ if input.len() < 512 {
+ // check for malformed data. Wireshark reports as
+ // 'NBSS continuation data'. If it's invalid we're
+ // lost so we give up.
+ if input.len() > 8 {
+ if let Ok((_, ref hdr)) = parse_nbss_record_partial(input) {
+ if !hdr.is_smb() {
+ SCLogDebug!("partial NBSS, not SMB and no known msg type {}", hdr.message_type);
+ self.trunc_ts();
+ return 0;
+ }
+ }
+ }
+ return 0;
+ }
+
+ if let Ok((output, ref nbss_part_hdr)) = parse_nbss_record_partial(input) {
+ SCLogDebug!("parse_nbss_record_partial ok, output len {}", output.len());
+ if nbss_part_hdr.message_type == NBSS_MSGTYPE_SESSION_MESSAGE {
+ if let Ok((_, ref smb)) = parse_smb_version(nbss_part_hdr.data) {
+ SCLogDebug!("SMB {:?}", smb);
+ if smb.version == 0xff_u8 { // SMB1
+ SCLogDebug!("SMBv1 record");
+ if let Ok((_, ref r)) = parse_smb_record(nbss_part_hdr.data) {
+ if r.command == SMB1_COMMAND_WRITE_ANDX {
+ // see if it's a write to a pipe. We only handle those
+ // if complete.
+ let tree_key = SMBCommonHdr::new(SMBHDR_TYPE_SHARE,
+ r.ssn_id as u64, r.tree_id as u32, 0);
+ let is_pipe = match self.ssn2tree_map.get(&tree_key) {
+ Some(n) => n.is_pipe,
+ None => false,
+ };
+ if is_pipe {
+ return 0;
+ }
+ // how many more bytes are expected within this NBSS record
+ // So that we can check that further parsed offsets and lengths
+ // stay within the NBSS record.
+ let nbss_remaining = nbss_part_hdr.length - nbss_part_hdr.data.len() as u32;
+ smb1_write_request_record(self, r, SMB1_HEADER_SIZE, SMB1_COMMAND_WRITE_ANDX, nbss_remaining);
+
+ self.add_nbss_ts_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
+ self.add_smb1_ts_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
+ self.add_smb1_ts_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
+
+ let consumed = input.len() - output.len();
+ return consumed;
+ }
+ }
+ } else if smb.version == 0xfe_u8 { // SMB2
+ SCLogDebug!("SMBv2 record");
+ if let Ok((_, ref smb_record)) = parse_smb2_request_record(nbss_part_hdr.data) {
+ SCLogDebug!("SMB2: partial record {}",
+ &smb2_command_string(smb_record.command));
+ if smb_record.command == SMB2_COMMAND_WRITE {
+ // how many more bytes are expected within this NBSS record
+ // So that we can check that further parsed offsets and lengths
+ // stay within the NBSS record.
+ let nbss_remaining = nbss_part_hdr.length - nbss_part_hdr.data.len() as u32;
+ smb2_write_request_record(self, smb_record, nbss_remaining);
+
+ self.add_nbss_ts_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
+ self.add_smb2_ts_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
+ self.add_smb2_ts_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64, smb_record.header_len as i64);
+
+ let consumed = input.len() - output.len();
+ SCLogDebug!("consumed {}", consumed);
+ return consumed;
+ }
+ }
+ }
+ // no SMB3 here yet, will buffer full records
+ }
+ }
+ }
+
+ return 0;
+ }
+
+ /// Parsing function, handling TCP chunks fragmentation
+ pub fn parse_tcp_data_ts(&mut self, flow: *const Flow, stream_slice: &StreamSlice) -> AppLayerResult
+ {
+ let mut cur_i = stream_slice.as_slice();
+ let consumed = self.handle_skip(Direction::ToServer, cur_i.len() as u32);
+ if consumed > 0 {
+ if consumed > cur_i.len() as u32 {
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ cur_i = &cur_i[consumed as usize..];
+ }
+ // take care of in progress file chunk transfers
+ // and skip buffer beyond it
+ let consumed = self.filetracker_update(Direction::ToServer, cur_i, 0);
+ if consumed > 0 {
+ if consumed > cur_i.len() as u32 {
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ cur_i = &cur_i[consumed as usize..];
+ }
+ if cur_i.is_empty() {
+ return AppLayerResult::ok();
+ }
+ // gap
+ if self.ts_gap {
+ SCLogDebug!("TS trying to catch up after GAP (input {})", cur_i.len());
+ while !cur_i.is_empty() { // min record size
+ match search_smb_record(cur_i) {
+ Ok((_, pg)) => {
+ SCLogDebug!("smb record found");
+ let smb2_offset = cur_i.len() - pg.len();
+ if smb2_offset < 4 {
+ cur_i = &cur_i[smb2_offset+4..];
+ continue; // see if we have another record in our data
+ }
+ let nbss_offset = smb2_offset - 4;
+ cur_i = &cur_i[nbss_offset..];
+
+ self.ts_gap = false;
+ break;
+ },
+ _ => {
+ let mut consumed = stream_slice.len();
+ if consumed < 4 {
+ consumed = 0;
+ } else {
+ consumed -= 3;
+ }
+ SCLogDebug!("smb record NOT found");
+ return AppLayerResult::incomplete(consumed, 8);
+ },
+ }
+ }
+ }
+ while !cur_i.is_empty() { // min record size
+ match parse_nbss_record(cur_i) {
+ Ok((rem, ref nbss_hdr)) => {
+ SCLogDebug!("nbss frame offset {} len {}", stream_slice.offset_from(cur_i), cur_i.len() - rem.len());
+ let (_, _, nbss_data_frame) = self.add_nbss_ts_frames(flow, stream_slice, cur_i, nbss_hdr.length as i64);
+
+ if nbss_hdr.message_type == NBSS_MSGTYPE_SESSION_MESSAGE {
+ // we have the full records size worth of data,
+ // let's parse it
+ match parse_smb_version(nbss_hdr.data) {
+ Ok((_, ref smb)) => {
+
+ SCLogDebug!("SMB {:?}", smb);
+ if smb.version == 0xff_u8 { // SMB1
+
+ SCLogDebug!("SMBv1 record");
+ match parse_smb_record(nbss_hdr.data) {
+ Ok((_, ref smb_record)) => {
+ let pdu_frame = self.add_smb1_ts_pdu_frame(flow, stream_slice, nbss_hdr.data, nbss_hdr.length as i64);
+ self.add_smb1_ts_hdr_data_frames(flow, stream_slice, nbss_hdr.data, nbss_hdr.length as i64);
+ if smb_record.is_request() {
+ smb1_request_record(self, smb_record);
+ } else {
+ // If we received a response when expecting a request, set an event
+ // on the PDU frame instead of handling the response.
+ SCLogDebug!("SMB1 reply seen from client to server");
+ if let Some(frame) = pdu_frame {
+ frame.add_event(flow, SMBEvent::ResponseToServer as u8);
+ }
+ }
+ },
+ _ => {
+ if let Some(frame) = nbss_data_frame {
+ frame.add_event(flow, SMBEvent::MalformedData as u8);
+ }
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ } else if smb.version == 0xfe_u8 { // SMB2
+ let mut nbss_data = nbss_hdr.data;
+ while !nbss_data.is_empty() {
+ SCLogDebug!("SMBv2 record");
+ match parse_smb2_request_record(nbss_data) {
+ Ok((nbss_data_rem, ref smb_record)) => {
+ let record_len = (nbss_data.len() - nbss_data_rem.len()) as i64;
+ let pdu_frame = self.add_smb2_ts_pdu_frame(flow, stream_slice, nbss_data, record_len);
+ self.add_smb2_ts_hdr_data_frames(flow, stream_slice, nbss_data, record_len, smb_record.header_len as i64);
+ SCLogDebug!("nbss_data_rem {}", nbss_data_rem.len());
+ if smb_record.is_request() {
+ smb2_request_record(self, smb_record);
+ } else {
+ // If we received a response when expecting a request, set an event
+ // on the PDU frame instead of handling the response.
+ SCLogDebug!("SMB2 reply seen from client to server");
+ if let Some(frame) = pdu_frame {
+ frame.add_event(flow, SMBEvent::ResponseToServer as u8);
+ }
+ }
+ nbss_data = nbss_data_rem;
+ },
+ _ => {
+ if let Some(frame) = nbss_data_frame {
+ frame.add_event(flow, SMBEvent::MalformedData as u8);
+ }
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ }
+ } else if smb.version == 0xfd_u8 { // SMB3 transform
+
+ let mut nbss_data = nbss_hdr.data;
+ while !nbss_data.is_empty() {
+ SCLogDebug!("SMBv3 transform record");
+ match parse_smb3_transform_record(nbss_data) {
+ Ok((nbss_data_rem, ref _smb3_record)) => {
+ let record_len = (nbss_data.len() - nbss_data_rem.len()) as i64;
+ self.add_smb3_ts_pdu_frame(flow, stream_slice, nbss_data, record_len);
+ self.add_smb3_ts_hdr_data_frames(flow, stream_slice, nbss_data, record_len);
+ nbss_data = nbss_data_rem;
+ },
+ _ => {
+ if let Some(frame) = nbss_data_frame {
+ frame.add_event(flow, SMBEvent::MalformedData as u8);
+ }
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ }
+ }
+ },
+ _ => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ } else {
+ SCLogDebug!("NBSS message {:X}", nbss_hdr.message_type);
+ }
+ cur_i = rem;
+ },
+ Err(Err::Incomplete(needed)) => {
+ if let Needed::Size(n) = needed {
+ let n = usize::from(n) + cur_i.len();
+ // 512 is the minimum for parse_tcp_data_ts_partial
+ if n >= 512 && cur_i.len() < 512 {
+ let total_consumed = stream_slice.offset_from(cur_i);
+ return AppLayerResult::incomplete(total_consumed, 512);
+ }
+ let consumed = self.parse_tcp_data_ts_partial(flow, stream_slice, cur_i);
+ if consumed == 0 {
+ // if we consumed none we will buffer the entire record
+ let total_consumed = stream_slice.offset_from(cur_i);
+ SCLogDebug!("setting consumed {} need {} needed {:?} total input {}",
+ total_consumed, n, needed, stream_slice.len());
+ let need = n;
+ return AppLayerResult::incomplete(total_consumed, need as u32);
+ }
+ // tracking a write record, which we don't need to
+ // queue up at the stream level, but can feed to us
+ // in small chunks
+ return AppLayerResult::ok();
+ } else {
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ },
+ Err(_) => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ };
+
+ self.post_gap_housekeeping(Direction::ToServer);
+ if self.check_post_gap_file_txs && !self.post_gap_files_checked {
+ self.post_gap_housekeeping_for_files();
+ self.post_gap_files_checked = true;
+ }
+ AppLayerResult::ok()
+ }
+
+ fn add_nbss_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
+ let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8);
+ SCLogDebug!("NBSS PDU frame {:?}", nbss_pdu);
+ let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8);
+ SCLogDebug!("NBSS HDR frame {:?}", nbss_hdr_frame);
+ let nbss_data_frame = Frame::new(flow, stream_slice, &input[4..], nbss_len, SMBFrameType::NBSSData as u8);
+ SCLogDebug!("NBSS DATA frame {:?}", nbss_data_frame);
+ (nbss_pdu, nbss_hdr_frame, nbss_data_frame)
+ }
+
+ fn add_smb1_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8);
+ SCLogDebug!("SMB PDU frame {:?}", smb_pdu);
+ smb_pdu
+ }
+ fn add_smb1_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
+ let _smb1_hdr = Frame::new(flow, stream_slice, input, SMB1_HEADER_SIZE as i64, SMBFrameType::SMB1Hdr as u8);
+ SCLogDebug!("SMBv1 HDR frame {:?}", _smb1_hdr);
+ if input.len() > SMB1_HEADER_SIZE {
+ let _smb1_data = Frame::new(flow, stream_slice, &input[SMB1_HEADER_SIZE..], nbss_len - SMB1_HEADER_SIZE as i64,
+ SMBFrameType::SMB1Data as u8);
+ SCLogDebug!("SMBv1 DATA frame {:?}", _smb1_data);
+ }
+ }
+
+ fn add_smb2_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8);
+ SCLogDebug!("SMBv2 PDU frame {:?}", smb_pdu);
+ smb_pdu
+ }
+ fn add_smb2_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
+ let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8);
+ SCLogDebug!("SMBv2 HDR frame {:?}", _smb2_hdr);
+ if input.len() > hdr_len as usize {
+ let _smb2_data = Frame::new(flow, stream_slice, &input[hdr_len as usize ..], nbss_len - hdr_len, SMBFrameType::SMB2Data as u8);
+ SCLogDebug!("SMBv2 DATA frame {:?}", _smb2_data);
+ }
+ }
+
+ fn add_smb3_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
+ let _smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8);
+ SCLogDebug!("SMBv3 PDU frame {:?}", _smb_pdu);
+ }
+ fn add_smb3_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
+ let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8);
+ SCLogDebug!("SMBv3 HDR frame {:?}", _smb3_hdr);
+ if input.len() > 52 {
+ let _smb3_data = Frame::new(flow, stream_slice, &input[52..], nbss_len - 52, SMBFrameType::SMB3Data as u8);
+ SCLogDebug!("SMBv3 DATA frame {:?}", _smb3_data);
+ }
+ }
+
+ /// return bytes consumed
+ pub fn parse_tcp_data_tc_partial(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8]) -> usize
+ {
+ SCLogDebug!("incomplete of size {}", input.len());
+ if input.len() < 512 {
+ // check for malformed data. Wireshark reports as
+ // 'NBSS continuation data'. If it's invalid we're
+ // lost so we give up.
+ if input.len() > 8 {
+ if let Ok((_, ref hdr)) = parse_nbss_record_partial(input) {
+ if !hdr.is_smb() {
+ SCLogDebug!("partial NBSS, not SMB and no known msg type {}", hdr.message_type);
+ self.trunc_tc();
+ return 0;
+ }
+ }
+ }
+ return 0;
+ }
+
+ if let Ok((output, ref nbss_part_hdr)) = parse_nbss_record_partial(input) {
+ SCLogDebug!("parse_nbss_record_partial ok, output len {}", output.len());
+ if nbss_part_hdr.message_type == NBSS_MSGTYPE_SESSION_MESSAGE {
+ if let Ok((_, ref smb)) = parse_smb_version(nbss_part_hdr.data) {
+ SCLogDebug!("SMB {:?}", smb);
+ if smb.version == 255u8 { // SMB1
+ SCLogDebug!("SMBv1 record");
+ if let Ok((_, ref r)) = parse_smb_record(nbss_part_hdr.data) {
+ SCLogDebug!("SMB1: partial record {}",
+ r.command);
+ if r.command == SMB1_COMMAND_READ_ANDX {
+ let tree_key = SMBCommonHdr::new(SMBHDR_TYPE_SHARE,
+ r.ssn_id as u64, r.tree_id as u32, 0);
+ let is_pipe = match self.ssn2tree_map.get(&tree_key) {
+ Some(n) => n.is_pipe,
+ None => false,
+ };
+ if is_pipe {
+ return 0;
+ }
+
+ // create NBSS frames here so we don't get double frames
+ // when we don't consume the data now.
+ self.add_nbss_tc_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
+ self.add_smb1_tc_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
+ self.add_smb1_tc_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
+
+ // how many more bytes are expected within this NBSS record
+ // So that we can check that further parsed offsets and lengths
+ // stay within the NBSS record.
+ let nbss_remaining = nbss_part_hdr.length - nbss_part_hdr.data.len() as u32;
+ smb1_read_response_record(self, r, SMB1_HEADER_SIZE, nbss_remaining);
+ let consumed = input.len() - output.len();
+ return consumed;
+ }
+ }
+ } else if smb.version == 254u8 { // SMB2
+ SCLogDebug!("SMBv2 record");
+ if let Ok((_, ref smb_record)) = parse_smb2_response_record(nbss_part_hdr.data) {
+ SCLogDebug!("SMB2: partial record {}",
+ &smb2_command_string(smb_record.command));
+ if smb_record.command == SMB2_COMMAND_READ {
+ // create NBSS frames here so we don't get double frames
+ // when we don't consume the data now.
+ self.add_nbss_tc_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
+ self.add_smb2_tc_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
+ self.add_smb2_tc_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64, smb_record.header_len as i64);
+
+ // how many more bytes are expected within this NBSS record
+ // So that we can check that further parsed offsets and lengths
+ // stay within the NBSS record.
+ let nbss_remaining = nbss_part_hdr.length - nbss_part_hdr.data.len() as u32;
+ smb2_read_response_record(self, smb_record, nbss_remaining);
+ let consumed = input.len() - output.len();
+ return consumed;
+ }
+ }
+ }
+ // no SMB3 here yet, will buffer full records
+ }
+ }
+ }
+ return 0;
+ }
+
+ /// Parsing function, handling TCP chunks fragmentation
+ pub fn parse_tcp_data_tc(&mut self, flow: *const Flow, stream_slice: &StreamSlice) -> AppLayerResult
+ {
+ let mut cur_i = stream_slice.as_slice();
+ let consumed = self.handle_skip(Direction::ToClient, cur_i.len() as u32);
+ if consumed > 0 {
+ if consumed > cur_i.len() as u32 {
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ cur_i = &cur_i[consumed as usize..];
+ }
+ // take care of in progress file chunk transfers
+ // and skip buffer beyond it
+ let consumed = self.filetracker_update(Direction::ToClient, cur_i, 0);
+ if consumed > 0 {
+ if consumed > cur_i.len() as u32 {
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ cur_i = &cur_i[consumed as usize..];
+ }
+ if cur_i.is_empty() {
+ return AppLayerResult::ok();
+ }
+ // gap
+ if self.tc_gap {
+ SCLogDebug!("TC trying to catch up after GAP (input {})", cur_i.len());
+ while !cur_i.is_empty() { // min record size
+ match search_smb_record(cur_i) {
+ Ok((_, pg)) => {
+ SCLogDebug!("smb record found");
+ let smb2_offset = cur_i.len() - pg.len();
+ if smb2_offset < 4 {
+ cur_i = &cur_i[smb2_offset+4..];
+ continue; // see if we have another record in our data
+ }
+ let nbss_offset = smb2_offset - 4;
+ cur_i = &cur_i[nbss_offset..];
+
+ self.tc_gap = false;
+ break;
+ },
+ _ => {
+ let mut consumed = stream_slice.len();
+ if consumed < 4 {
+ consumed = 0;
+ } else {
+ consumed -= 3;
+ }
+ SCLogDebug!("smb record NOT found");
+ return AppLayerResult::incomplete(consumed, 8);
+ },
+ }
+ }
+ }
+ while !cur_i.is_empty() { // min record size
+ match parse_nbss_record(cur_i) {
+ Ok((rem, ref nbss_hdr)) => {
+ SCLogDebug!("nbss record offset {} len {}", stream_slice.offset_from(cur_i), cur_i.len() - rem.len());
+ self.add_nbss_tc_frames(flow, stream_slice, cur_i, nbss_hdr.length as i64);
+ SCLogDebug!("nbss frames added");
+
+ if nbss_hdr.message_type == NBSS_MSGTYPE_SESSION_MESSAGE {
+ // we have the full records size worth of data,
+ // let's parse it
+ match parse_smb_version(nbss_hdr.data) {
+ Ok((_, ref smb)) => {
+ SCLogDebug!("SMB {:?}", smb);
+ if smb.version == 0xff_u8 { // SMB1
+ SCLogDebug!("SMBv1 record");
+ match parse_smb_record(nbss_hdr.data) {
+ Ok((_, ref smb_record)) => {
+ let pdu_frame = self.add_smb1_tc_pdu_frame(flow, stream_slice, nbss_hdr.data, nbss_hdr.length as i64);
+ self.add_smb1_tc_hdr_data_frames(flow, stream_slice, nbss_hdr.data, nbss_hdr.length as i64);
+ if smb_record.is_response() {
+ smb1_response_record(self, smb_record);
+ } else {
+ SCLogDebug!("SMB1 request seen from server to client");
+ if let Some(frame) = pdu_frame {
+ frame.add_event(flow, SMBEvent::RequestToClient as u8);
+ }
+ }
+ },
+ _ => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ } else if smb.version == 0xfe_u8 { // SMB2
+ let mut nbss_data = nbss_hdr.data;
+ while !nbss_data.is_empty() {
+ SCLogDebug!("SMBv2 record");
+ match parse_smb2_response_record(nbss_data) {
+ Ok((nbss_data_rem, ref smb_record)) => {
+ let record_len = (nbss_data.len() - nbss_data_rem.len()) as i64;
+ let pdu_frame = self.add_smb2_tc_pdu_frame(flow, stream_slice, nbss_data, record_len);
+ self.add_smb2_tc_hdr_data_frames(flow, stream_slice, nbss_data, record_len, smb_record.header_len as i64);
+ if smb_record.is_response() {
+ smb2_response_record(self, smb_record);
+ } else {
+ SCLogDebug!("SMB2 request seen from server to client");
+ if let Some(frame) = pdu_frame {
+ frame.add_event(flow, SMBEvent::RequestToClient as u8);
+ }
+ }
+ nbss_data = nbss_data_rem;
+ },
+ _ => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ }
+ } else if smb.version == 0xfd_u8 { // SMB3 transform
+ let mut nbss_data = nbss_hdr.data;
+ while !nbss_data.is_empty() {
+ SCLogDebug!("SMBv3 transform record");
+ match parse_smb3_transform_record(nbss_data) {
+ Ok((nbss_data_rem, ref _smb3_record)) => {
+ let record_len = (nbss_data.len() - nbss_data_rem.len()) as i64;
+ self.add_smb3_tc_pdu_frame(flow, stream_slice, nbss_data, record_len);
+ self.add_smb3_tc_hdr_data_frames(flow, stream_slice, nbss_data, record_len);
+ nbss_data = nbss_data_rem;
+ },
+ _ => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ }
+ }
+ },
+ Err(Err::Incomplete(_)) => {
+ // not enough data to contain basic SMB hdr
+ // TODO event: empty NBSS_MSGTYPE_SESSION_MESSAGE
+ },
+ Err(_) => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ } else {
+ SCLogDebug!("NBSS message {:X}", nbss_hdr.message_type);
+ }
+ cur_i = rem;
+ },
+ Err(Err::Incomplete(needed)) => {
+ SCLogDebug!("INCOMPLETE have {} needed {:?}", cur_i.len(), needed);
+ if let Needed::Size(n) = needed {
+ let n = usize::from(n) + cur_i.len();
+ // 512 is the minimum for parse_tcp_data_tc_partial
+ if n >= 512 && cur_i.len() < 512 {
+ let total_consumed = stream_slice.offset_from(cur_i);
+ return AppLayerResult::incomplete(total_consumed, 512);
+ }
+ let consumed = self.parse_tcp_data_tc_partial(flow, stream_slice, cur_i);
+ if consumed == 0 {
+ // if we consumed none we will buffer the entire record
+ let total_consumed = stream_slice.offset_from(cur_i);
+ SCLogDebug!("setting consumed {} need {} needed {:?} total input {}",
+ total_consumed, n, needed, stream_slice.len());
+ let need = n;
+ return AppLayerResult::incomplete(total_consumed, need as u32);
+ }
+ // tracking a read record, which we don't need to
+ // queue up at the stream level, but can feed to us
+ // in small chunks
+ return AppLayerResult::ok();
+ } else {
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ },
+ Err(_) => {
+ self.set_event(SMBEvent::MalformedData);
+ return AppLayerResult::err();
+ },
+ }
+ };
+ self.post_gap_housekeeping(Direction::ToClient);
+ if self.check_post_gap_file_txs && !self.post_gap_files_checked {
+ self.post_gap_housekeeping_for_files();
+ self.post_gap_files_checked = true;
+ }
+ self._debug_tx_stats();
+ AppLayerResult::ok()
+ }
+
+ /// handle a gap in the TOSERVER direction
+ /// returns: 0 ok, 1 unrecoverable error
+ pub fn parse_tcp_data_ts_gap(&mut self, gap_size: u32) -> AppLayerResult {
+ let consumed = self.handle_skip(Direction::ToServer, gap_size);
+ if consumed < gap_size {
+ let new_gap_size = gap_size - consumed;
+ let gap = vec![0; new_gap_size as usize];
+
+ let consumed2 = self.filetracker_update(Direction::ToServer, &gap, new_gap_size);
+ if consumed2 > new_gap_size {
+ SCLogDebug!("consumed more than GAP size: {} > {}", consumed2, new_gap_size);
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ }
+ SCLogDebug!("GAP of size {} in toserver direction", gap_size);
+ self.ts_ssn_gap = true;
+ self.ts_gap = true;
+ return AppLayerResult::ok();
+ }
+
+ /// handle a gap in the TOCLIENT direction
+ /// returns: 0 ok, 1 unrecoverable error
+ pub fn parse_tcp_data_tc_gap(&mut self, gap_size: u32) -> AppLayerResult {
+ let consumed = self.handle_skip(Direction::ToClient, gap_size);
+ if consumed < gap_size {
+ let new_gap_size = gap_size - consumed;
+ let gap = vec![0; new_gap_size as usize];
+
+ let consumed2 = self.filetracker_update(Direction::ToClient, &gap, new_gap_size);
+ if consumed2 > new_gap_size {
+ SCLogDebug!("consumed more than GAP size: {} > {}", consumed2, new_gap_size);
+ self.set_event(SMBEvent::InternalError);
+ return AppLayerResult::err();
+ }
+ }
+ SCLogDebug!("GAP of size {} in toclient direction", gap_size);
+ self.tc_ssn_gap = true;
+ self.tc_gap = true;
+ return AppLayerResult::ok();
+ }
+
+ pub fn trunc_ts(&mut self) {
+ SCLogDebug!("TRUNC TS");
+ self.ts_trunc = true;
+
+ for tx in &mut self.transactions {
+ if !tx.request_done {
+ SCLogDebug!("TRUNCATING TX {} in TOSERVER direction", tx.id);
+ tx.request_done = true;
+ }
+ }
+ }
+ pub fn trunc_tc(&mut self) {
+ SCLogDebug!("TRUNC TC");
+ self.tc_trunc = true;
+
+ for tx in &mut self.transactions {
+ if !tx.response_done {
+ SCLogDebug!("TRUNCATING TX {} in TOCLIENT direction", tx.id);
+ tx.response_done = true;
+ }
+ }
+ }
+}
+
+/// Returns *mut SMBState
+#[no_mangle]
+pub extern "C" fn rs_smb_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void {
+ let state = SMBState::new();
+ let boxed = Box::new(state);
+ SCLogDebug!("allocating state");
+ return Box::into_raw(boxed) as *mut _;
+}
+
+/// Params:
+/// - state: *mut SMBState as void pointer
+#[no_mangle]
+pub extern "C" fn rs_smb_state_free(state: *mut std::os::raw::c_void) {
+ SCLogDebug!("freeing state");
+ let mut smb_state = unsafe { Box::from_raw(state as *mut SMBState) };
+ smb_state.free();
+}
+
+/// C binding parse a SMB request. Returns 1 on success, -1 on failure.
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_parse_request_tcp(flow: *const Flow,
+ state: *mut ffi::c_void,
+ _pstate: *mut std::os::raw::c_void,
+ stream_slice: StreamSlice,
+ _data: *const std::os::raw::c_void,
+ )
+ -> AppLayerResult
+{
+ let state = cast_pointer!(state, SMBState);
+ let flow = cast_pointer!(flow, Flow);
+
+ if stream_slice.is_gap() {
+ return rs_smb_parse_request_tcp_gap(state, stream_slice.gap_size());
+ }
+
+ SCLogDebug!("parsing {} bytes of request data", stream_slice.len());
+
+ /* START with MISTREAM set: record might be starting the middle. */
+ if stream_slice.flags() & (STREAM_START|STREAM_MIDSTREAM) == (STREAM_START|STREAM_MIDSTREAM) {
+ state.ts_gap = true;
+ }
+
+ state.update_ts(flow.get_last_time().as_secs());
+ state.parse_tcp_data_ts(flow, &stream_slice)
+}
+
+#[no_mangle]
+pub extern "C" fn rs_smb_parse_request_tcp_gap(
+ state: &mut SMBState,
+ input_len: u32)
+ -> AppLayerResult
+{
+ state.parse_tcp_data_ts_gap(input_len)
+}
+
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_parse_response_tcp(flow: *const Flow,
+ state: *mut ffi::c_void,
+ _pstate: *mut std::os::raw::c_void,
+ stream_slice: StreamSlice,
+ _data: *const ffi::c_void,
+ )
+ -> AppLayerResult
+{
+ let state = cast_pointer!(state, SMBState);
+ let flow = cast_pointer!(flow, Flow);
+
+ if stream_slice.is_gap() {
+ return rs_smb_parse_response_tcp_gap(state, stream_slice.gap_size());
+ }
+
+ /* START with MISTREAM set: record might be starting the middle. */
+ if stream_slice.flags() & (STREAM_START|STREAM_MIDSTREAM) == (STREAM_START|STREAM_MIDSTREAM) {
+ state.tc_gap = true;
+ }
+
+ state.update_ts(flow.get_last_time().as_secs());
+ state.parse_tcp_data_tc(flow, &stream_slice)
+}
+
+#[no_mangle]
+pub extern "C" fn rs_smb_parse_response_tcp_gap(
+ state: &mut SMBState,
+ input_len: u32)
+ -> AppLayerResult
+{
+ state.parse_tcp_data_tc_gap(input_len)
+}
+
+fn smb_probe_tcp_midstream(direction: Direction, slice: &[u8], rdir: *mut u8, begins: bool) -> i8
+{
+ let r = if begins {
+ // if pattern was found in the beginning, just check first byte
+ if slice[0] == NBSS_MSGTYPE_SESSION_MESSAGE {
+ Ok((&slice[..4], &slice[4..]))
+ } else {
+ Err(Err::Error(make_error(slice, ErrorKind::Eof)))
+ }
+ } else {
+ search_smb_record(slice)
+ };
+ match r {
+ Ok((_, data)) => {
+ SCLogDebug!("smb found");
+ match parse_smb_version(data) {
+ Ok((_, ref smb)) => {
+ SCLogDebug!("SMB {:?}", smb);
+ if smb.version == 0xff_u8 { // SMB1
+ SCLogDebug!("SMBv1 record");
+ if let Ok((_, ref smb_record)) = parse_smb_record(data) {
+ if smb_record.flags & 0x80 != 0 {
+ SCLogDebug!("RESPONSE {:02x}", smb_record.flags);
+ if direction == Direction::ToServer {
+ unsafe { *rdir = Direction::ToClient as u8; }
+ }
+ } else {
+ SCLogDebug!("REQUEST {:02x}", smb_record.flags);
+ if direction == Direction::ToClient {
+ unsafe { *rdir = Direction::ToServer as u8; }
+ }
+ }
+ return 1;
+ }
+ } else if smb.version == 0xfe_u8 { // SMB2
+ SCLogDebug!("SMB2 record");
+ if let Ok((_, ref smb_record)) = parse_smb2_record_direction(data) {
+ if direction == Direction::ToServer {
+ SCLogDebug!("direction Direction::ToServer smb_record {:?}", smb_record);
+ if !smb_record.request {
+ unsafe { *rdir = Direction::ToClient as u8; }
+ }
+ } else {
+ SCLogDebug!("direction Direction::ToClient smb_record {:?}", smb_record);
+ if smb_record.request {
+ unsafe { *rdir = Direction::ToServer as u8; }
+ }
+ }
+ }
+ }
+ else if smb.version == 0xfd_u8 { // SMB3 transform
+ SCLogDebug!("SMB3 record");
+ }
+ return 1;
+ },
+ _ => {
+ SCLogDebug!("smb not found in {:?}", slice);
+ },
+ }
+ },
+ _ => {
+ SCLogDebug!("no dice");
+ },
+ }
+ return 0;
+}
+
+fn smb_probe_tcp(flags: u8, slice: &[u8], rdir: *mut u8, begins: bool) -> AppProto
+{
+ if flags & STREAM_MIDSTREAM == STREAM_MIDSTREAM && smb_probe_tcp_midstream(flags.into(), slice, rdir, begins) == 1 {
+ unsafe { return ALPROTO_SMB; }
+ }
+ if let Ok((_, ref hdr)) = parse_nbss_record_partial(slice) {
+ if hdr.is_smb() {
+ SCLogDebug!("smb found");
+ unsafe { return ALPROTO_SMB; }
+ } else if hdr.needs_more(){
+ return 0;
+ } else if hdr.is_valid() &&
+ hdr.message_type != NBSS_MSGTYPE_SESSION_MESSAGE {
+ //we accept a first small netbios message before real SMB
+ let hl = hdr.length as usize;
+ if hdr.data.len() >= hl + 8 {
+ // 8 is 4 bytes NBSS + 4 bytes SMB0xFX magic
+ if let Ok((_, ref hdr2)) = parse_nbss_record_partial(&hdr.data[hl..]) {
+ if hdr2.is_smb() {
+ SCLogDebug!("smb found");
+ unsafe { return ALPROTO_SMB; }
+ }
+ }
+ } else if hdr.length < 256 {
+ // we want more data, 256 is some random value
+ return 0;
+ }
+ // default is failure
+ }
+ }
+ SCLogDebug!("no smb");
+ unsafe { return ALPROTO_FAILED; }
+}
+
+// probing confirmation parser
+// return 1 if found, 0 is not found
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_probe_begins_tcp(_f: *const Flow,
+ flags: u8, input: *const u8, len: u32, rdir: *mut u8)
+ -> AppProto
+{
+ if len < MIN_REC_SIZE as u32 {
+ return ALPROTO_UNKNOWN;
+ }
+ let slice = build_slice!(input, len as usize);
+ return smb_probe_tcp(flags, slice, rdir, true);
+}
+
+// probing parser
+// return 1 if found, 0 is not found
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_probe_tcp(_f: *const Flow,
+ flags: u8, input: *const u8, len: u32, rdir: *mut u8)
+ -> AppProto
+{
+ if len < MIN_REC_SIZE as u32 {
+ return ALPROTO_UNKNOWN;
+ }
+ let slice = build_slice!(input, len as usize);
+ return smb_probe_tcp(flags, slice, rdir, false);
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_state_get_tx_count(state: *mut ffi::c_void)
+ -> u64
+{
+ let state = cast_pointer!(state, SMBState);
+ SCLogDebug!("rs_smb_state_get_tx_count: returning {}", state.tx_id);
+ return state.tx_id;
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_state_get_tx(state: *mut ffi::c_void,
+ tx_id: u64)
+ -> *mut ffi::c_void
+{
+ let state = cast_pointer!(state, SMBState);
+ match state.get_tx_by_id(tx_id) {
+ Some(tx) => {
+ return tx as *const _ as *mut _;
+ }
+ None => {
+ return std::ptr::null_mut();
+ }
+ }
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_state_tx_free(state: *mut ffi::c_void,
+ tx_id: u64)
+{
+ let state = cast_pointer!(state, SMBState);
+ SCLogDebug!("freeing tx {}", tx_id);
+ state.free_tx(tx_id);
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_tx_get_alstate_progress(tx: *mut ffi::c_void,
+ direction: u8)
+ -> i32
+{
+ let tx = cast_pointer!(tx, SMBTransaction);
+
+ if direction == Direction::ToServer as u8 && tx.request_done {
+ SCLogDebug!("tx {} TOSERVER progress 1 => {:?}", tx.id, tx);
+ return 1;
+ } else if direction == Direction::ToClient as u8 && tx.response_done {
+ SCLogDebug!("tx {} TOCLIENT progress 1 => {:?}", tx.id, tx);
+ return 1;
+ } else {
+ SCLogDebug!("tx {} direction {} progress 0 => {:?}", tx.id, direction, tx);
+ return 0;
+ }
+}
+
+
+export_state_data_get!(rs_smb_get_state_data, SMBState);
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_get_tx_data(
+ tx: *mut std::os::raw::c_void)
+ -> *mut AppLayerTxData
+{
+ let tx = cast_pointer!(tx, SMBTransaction);
+ return &mut tx.tx_data;
+}
+
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_state_truncate(
+ state: *mut std::ffi::c_void,
+ direction: u8)
+{
+ let state = cast_pointer!(state, SMBState);
+ match direction.into() {
+ Direction::ToServer => {
+ state.trunc_ts();
+ }
+ Direction::ToClient => {
+ state.trunc_tc();
+ }
+ }
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_state_get_event_info_by_id(
+ event_id: std::os::raw::c_int,
+ event_name: *mut *const std::os::raw::c_char,
+ event_type: *mut AppLayerEventType,
+) -> i8 {
+ SMBEvent::get_event_info_by_id(event_id, event_name, event_type)
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_state_get_event_info(
+ event_name: *const std::os::raw::c_char,
+ event_id: *mut std::os::raw::c_int,
+ event_type: *mut AppLayerEventType,
+) -> std::os::raw::c_int {
+ SMBEvent::get_event_info(event_name, event_id, event_type)
+}
+
+pub unsafe extern "C" fn smb3_probe_tcp(f: *const Flow, dir: u8, input: *const u8, len: u32, rdir: *mut u8) -> u16 {
+ let retval = rs_smb_probe_tcp(f, dir, input, len, rdir);
+ let f = cast_pointer!(f, Flow);
+ if retval != ALPROTO_SMB {
+ return retval;
+ }
+ let (sp, dp) = f.get_ports();
+ let flags = f.get_flags();
+ let fsp = if (flags & FLOW_DIR_REVERSED) != 0 { dp } else { sp };
+ let fdp = if (flags & FLOW_DIR_REVERSED) != 0 { sp } else { dp };
+ if fsp == 445 && fdp != 445 {
+ match dir.into() {
+ Direction::ToServer => {
+ *rdir = Direction::ToClient as u8;
+ }
+ Direction::ToClient => {
+ *rdir = Direction::ToServer as u8;
+ }
+ }
+ }
+ return ALPROTO_SMB;
+}
+
+fn register_pattern_probe() -> i8 {
+ let mut r = 0;
+ unsafe {
+ // SMB1
+ r |= AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_SMB,
+ b"|ff|SMB\0".as_ptr() as *const std::os::raw::c_char, 8, 4,
+ Direction::ToServer as u8, rs_smb_probe_begins_tcp, MIN_REC_SIZE, MIN_REC_SIZE);
+ r |= AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_SMB,
+ b"|ff|SMB\0".as_ptr() as *const std::os::raw::c_char, 8, 4,
+ Direction::ToClient as u8, rs_smb_probe_begins_tcp, MIN_REC_SIZE, MIN_REC_SIZE);
+ // SMB2/3
+ r |= AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_SMB,
+ b"|fe|SMB\0".as_ptr() as *const std::os::raw::c_char, 8, 4,
+ Direction::ToServer as u8, rs_smb_probe_begins_tcp, MIN_REC_SIZE, MIN_REC_SIZE);
+ r |= AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_SMB,
+ b"|fe|SMB\0".as_ptr() as *const std::os::raw::c_char, 8, 4,
+ Direction::ToClient as u8, rs_smb_probe_begins_tcp, MIN_REC_SIZE, MIN_REC_SIZE);
+ // SMB3 encrypted records
+ r |= AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_SMB,
+ b"|fd|SMB\0".as_ptr() as *const std::os::raw::c_char, 8, 4,
+ Direction::ToServer as u8, smb3_probe_tcp, MIN_REC_SIZE, MIN_REC_SIZE);
+ r |= AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_SMB,
+ b"|fd|SMB\0".as_ptr() as *const std::os::raw::c_char, 8, 4,
+ Direction::ToClient as u8, smb3_probe_tcp, MIN_REC_SIZE, MIN_REC_SIZE);
+ }
+
+ if r == 0 {
+ return 0;
+ } else {
+ return -1;
+ }
+}
+
+// Parser name as a C style string.
+const PARSER_NAME: &[u8] = b"smb\0";
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_smb_register_parser() {
+ let default_port = CString::new("445").unwrap();
+ let mut stream_depth = SMB_CONFIG_DEFAULT_STREAM_DEPTH;
+ let parser = RustParser {
+ name: PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
+ default_port: std::ptr::null(),
+ ipproto: IPPROTO_TCP,
+ probe_ts: None,
+ probe_tc: None,
+ min_depth: 0,
+ max_depth: 16,
+ state_new: rs_smb_state_new,
+ state_free: rs_smb_state_free,
+ tx_free: rs_smb_state_tx_free,
+ parse_ts: rs_smb_parse_request_tcp,
+ parse_tc: rs_smb_parse_response_tcp,
+ get_tx_count: rs_smb_state_get_tx_count,
+ get_tx: rs_smb_state_get_tx,
+ tx_comp_st_ts: 1,
+ tx_comp_st_tc: 1,
+ tx_get_progress: rs_smb_tx_get_alstate_progress,
+ get_eventinfo: Some(rs_smb_state_get_event_info),
+ get_eventinfo_byid : Some(rs_smb_state_get_event_info_by_id),
+ localstorage_new: None,
+ localstorage_free: None,
+ get_tx_files: Some(rs_smb_gettxfiles),
+ get_tx_iterator: Some(applayer::state_get_tx_iterator::<SMBState, SMBTransaction>),
+ get_tx_data: rs_smb_get_tx_data,
+ get_state_data: rs_smb_get_state_data,
+ apply_tx_config: None,
+ flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
+ truncate: Some(rs_smb_state_truncate),
+ get_frame_id_by_name: Some(SMBFrameType::ffi_id_from_name),
+ get_frame_name_by_id: Some(SMBFrameType::ffi_name_from_id),
+ };
+
+ let ip_proto_str = CString::new("tcp").unwrap();
+
+ if AppLayerProtoDetectConfProtoDetectionEnabled(
+ ip_proto_str.as_ptr(),
+ parser.name,
+ ) != 0
+ {
+ let alproto = AppLayerRegisterProtocolDetection(&parser, 1);
+ ALPROTO_SMB = alproto;
+ if register_pattern_probe() < 0 {
+ return;
+ }
+
+ let have_cfg = AppLayerProtoDetectPPParseConfPorts(ip_proto_str.as_ptr(),
+ IPPROTO_TCP, parser.name, ALPROTO_SMB, 0,
+ MIN_REC_SIZE, rs_smb_probe_tcp, rs_smb_probe_tcp);
+
+ if have_cfg == 0 {
+ AppLayerProtoDetectPPRegister(IPPROTO_TCP, default_port.as_ptr(), ALPROTO_SMB,
+ 0, MIN_REC_SIZE, Direction::ToServer as u8, rs_smb_probe_tcp, rs_smb_probe_tcp);
+ }
+
+ if AppLayerParserConfParserEnabled(
+ ip_proto_str.as_ptr(),
+ parser.name,
+ ) != 0
+ {
+ let _ = AppLayerRegisterParser(&parser, alproto);
+ }
+ SCLogDebug!("Rust SMB parser registered.");
+ let retval = conf_get("app-layer.protocols.smb.stream-depth");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { stream_depth = retval as u32; }
+ Err(_) => { SCLogError!("Invalid depth value"); }
+ }
+ }
+ AppLayerParserSetStreamDepth(IPPROTO_TCP, ALPROTO_SMB, stream_depth);
+ let retval = conf_get("app-layer.protocols.smb.max-read-size");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { SMB_CFG_MAX_READ_SIZE = retval as u32; }
+ Err(_) => { SCLogError!("Invalid max-read-size value"); }
+ }
+ }
+ let retval = conf_get("app-layer.protocols.smb.max-write-size");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { SMB_CFG_MAX_WRITE_SIZE = retval as u32; }
+ Err(_) => { SCLogError!("Invalid max-write-size value"); }
+ }
+ }
+ let retval = conf_get("app-layer.protocols.smb.max-write-queue-size");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { SMB_CFG_MAX_WRITE_QUEUE_SIZE = retval as u32; }
+ Err(_) => { SCLogError!("Invalid max-write-queue-size value"); }
+ }
+ }
+ let retval = conf_get("app-layer.protocols.smb.max-write-queue-cnt");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { SMB_CFG_MAX_WRITE_QUEUE_CNT = retval as u32; }
+ Err(_) => { SCLogError!("Invalid max-write-queue-cnt value"); }
+ }
+ }
+ let retval = conf_get("app-layer.protocols.smb.max-read-queue-size");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { SMB_CFG_MAX_READ_QUEUE_SIZE = retval as u32; }
+ Err(_) => { SCLogError!("Invalid max-read-queue-size value"); }
+ }
+ }
+ let retval = conf_get("app-layer.protocols.smb.max-read-queue-cnt");
+ if let Some(val) = retval {
+ match get_memval(val) {
+ Ok(retval) => { SMB_CFG_MAX_READ_QUEUE_CNT = retval as u32; }
+ Err(_) => { SCLogError!("Invalid max-read-queue-cnt value"); }
+ }
+ }
+ if let Some(val) = conf_get("app-layer.protocols.smb.max-tx") {
+ if let Ok(v) = val.parse::<usize>() {
+ SMB_MAX_TX = v;
+ } else {
+ SCLogError!("Invalid value for smb.max-tx");
+ }
+ }
+ SCLogConfig!("read: max record size: {}, max queued chunks {}, max queued size {}",
+ SMB_CFG_MAX_READ_SIZE, SMB_CFG_MAX_READ_QUEUE_CNT, SMB_CFG_MAX_READ_QUEUE_SIZE);
+ SCLogConfig!("write: max record size: {}, max queued chunks {}, max queued size {}",
+ SMB_CFG_MAX_WRITE_SIZE, SMB_CFG_MAX_WRITE_QUEUE_CNT, SMB_CFG_MAX_WRITE_QUEUE_SIZE);
+ } else {
+ SCLogDebug!("Protocol detector and parser disabled for SMB.");
+ }
+}
diff --git a/rust/src/smb/smb1.rs b/rust/src/smb/smb1.rs
new file mode 100644
index 0000000..9d7d47e
--- /dev/null
+++ b/rust/src/smb/smb1.rs
@@ -0,0 +1,1155 @@
+/* Copyright (C) 2018-2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/* TODO
+ * - check all parsers for calls on non-SUCCESS status
+ */
+
+use crate::core::*;
+
+use crate::smb::smb::*;
+use crate::smb::dcerpc::*;
+use crate::smb::events::*;
+use crate::smb::files::*;
+
+use crate::smb::smb1_records::*;
+use crate::smb::smb1_session::*;
+
+use crate::smb::smb_status::*;
+
+use nom7::Err;
+
+// https://msdn.microsoft.com/en-us/library/ee441741.aspx
+pub const SMB1_COMMAND_CREATE_DIRECTORY: u8 = 0x00;
+pub const SMB1_COMMAND_DELETE_DIRECTORY: u8 = 0x01;
+pub const SMB1_COMMAND_OPEN: u8 = 0x02;
+pub const SMB1_COMMAND_CREATE: u8 = 0x03;
+pub const SMB1_COMMAND_CLOSE: u8 = 0x04;
+pub const SMB1_COMMAND_FLUSH: u8 = 0x05;
+pub const SMB1_COMMAND_DELETE: u8 = 0x06;
+pub const SMB1_COMMAND_RENAME: u8 = 0x07;
+pub const SMB1_COMMAND_QUERY_INFORMATION: u8 = 0x08;
+pub const SMB1_COMMAND_SET_INFORMATION: u8 = 0x09;
+pub const SMB1_COMMAND_READ: u8 = 0x0a;
+pub const SMB1_COMMAND_WRITE: u8 = 0x0b;
+pub const SMB1_COMMAND_LOCK_BYTE_RANGE: u8 = 0x0c;
+pub const SMB1_COMMAND_UNLOCK_BYTE_RANGE: u8 = 0x0d;
+pub const SMB1_COMMAND_CREATE_TEMPORARY: u8 = 0x0e;
+pub const SMB1_COMMAND_CREATE_NEW: u8 = 0x0f;
+pub const SMB1_COMMAND_CHECK_DIRECTORY: u8 = 0x10;
+pub const SMB1_COMMAND_PROCESS_EXIT: u8 = 0x11;
+pub const SMB1_COMMAND_SEEK: u8 = 0x12;
+pub const SMB1_COMMAND_LOCK_AND_READ: u8 = 0x13;
+pub const SMB1_COMMAND_WRITE_AND_UNLOCK: u8 = 0x14;
+pub const SMB1_COMMAND_LOCKING_ANDX: u8 = 0x24;
+pub const SMB1_COMMAND_TRANS: u8 = 0x25;
+pub const SMB1_COMMAND_ECHO: u8 = 0x2b;
+pub const SMB1_COMMAND_WRITE_AND_CLOSE: u8 = 0x2c;
+pub const SMB1_COMMAND_OPEN_ANDX: u8 = 0x2d;
+pub const SMB1_COMMAND_READ_ANDX: u8 = 0x2e;
+pub const SMB1_COMMAND_WRITE_ANDX: u8 = 0x2f;
+pub const SMB1_COMMAND_TRANS2: u8 = 0x32;
+pub const SMB1_COMMAND_TRANS2_SECONDARY: u8 = 0x33;
+pub const SMB1_COMMAND_FIND_CLOSE2: u8 = 0x34;
+pub const SMB1_COMMAND_TREE_DISCONNECT: u8 = 0x71;
+pub const SMB1_COMMAND_NEGOTIATE_PROTOCOL: u8 = 0x72;
+pub const SMB1_COMMAND_SESSION_SETUP_ANDX: u8 = 0x73;
+pub const SMB1_COMMAND_LOGOFF_ANDX: u8 = 0x74;
+pub const SMB1_COMMAND_TREE_CONNECT_ANDX: u8 = 0x75;
+pub const SMB1_COMMAND_QUERY_INFO_DISK: u8 = 0x80;
+pub const SMB1_COMMAND_NT_TRANS: u8 = 0xa0;
+pub const SMB1_COMMAND_NT_TRANS_SECONDARY: u8 = 0xa1;
+pub const SMB1_COMMAND_NT_CREATE_ANDX: u8 = 0xa2;
+pub const SMB1_COMMAND_NT_CANCEL: u8 = 0xa4;
+pub const SMB1_COMMAND_NONE: u8 = 0xff;
+
+pub fn smb1_command_string(c: u8) -> String {
+ match c {
+ SMB1_COMMAND_CREATE_DIRECTORY => "SMB1_COMMAND_CREATE_DIRECTORY",
+ SMB1_COMMAND_DELETE_DIRECTORY => "SMB1_COMMAND_DELETE_DIRECTORY",
+ SMB1_COMMAND_OPEN => "SMB1_COMMAND_OPEN",
+ SMB1_COMMAND_CREATE => "SMB1_COMMAND_CREATE",
+ SMB1_COMMAND_CLOSE => "SMB1_COMMAND_CLOSE",
+ SMB1_COMMAND_FLUSH => "SMB1_COMMAND_FLUSH",
+ SMB1_COMMAND_DELETE => "SMB1_COMMAND_DELETE",
+ SMB1_COMMAND_RENAME => "SMB1_COMMAND_RENAME",
+ SMB1_COMMAND_QUERY_INFORMATION => "SMB1_COMMAND_QUERY_INFORMATION",
+ SMB1_COMMAND_SET_INFORMATION => "SMB1_COMMAND_SET_INFORMATION",
+ SMB1_COMMAND_READ => "SMB1_COMMAND_READ",
+ SMB1_COMMAND_WRITE => "SMB1_COMMAND_WRITE",
+ SMB1_COMMAND_LOCK_BYTE_RANGE => "SMB1_COMMAND_LOCK_BYTE_RANGE",
+ SMB1_COMMAND_UNLOCK_BYTE_RANGE => "SMB1_COMMAND_UNLOCK_BYTE_RANGE",
+ SMB1_COMMAND_CREATE_TEMPORARY => "SMB1_COMMAND_CREATE_TEMPORARY",
+ SMB1_COMMAND_CREATE_NEW => "SMB1_COMMAND_CREATE_NEW",
+ SMB1_COMMAND_CHECK_DIRECTORY => "SMB1_COMMAND_CHECK_DIRECTORY",
+ SMB1_COMMAND_PROCESS_EXIT => "SMB1_COMMAND_PROCESS_EXIT",
+ SMB1_COMMAND_SEEK => "SMB1_COMMAND_SEEK",
+ SMB1_COMMAND_LOCK_AND_READ => "SMB1_COMMAND_LOCK_AND_READ",
+ SMB1_COMMAND_WRITE_AND_UNLOCK => "SMB1_COMMAND_WRITE_AND_UNLOCK",
+ SMB1_COMMAND_LOCKING_ANDX => "SMB1_COMMAND_LOCKING_ANDX",
+ SMB1_COMMAND_ECHO => "SMB1_COMMAND_ECHO",
+ SMB1_COMMAND_WRITE_AND_CLOSE => "SMB1_COMMAND_WRITE_AND_CLOSE",
+ SMB1_COMMAND_OPEN_ANDX => "SMB1_COMMAND_OPEN_ANDX",
+ SMB1_COMMAND_READ_ANDX => "SMB1_COMMAND_READ_ANDX",
+ SMB1_COMMAND_WRITE_ANDX => "SMB1_COMMAND_WRITE_ANDX",
+ SMB1_COMMAND_TRANS => "SMB1_COMMAND_TRANS",
+ SMB1_COMMAND_TRANS2 => "SMB1_COMMAND_TRANS2",
+ SMB1_COMMAND_TRANS2_SECONDARY => "SMB1_COMMAND_TRANS2_SECONDARY",
+ SMB1_COMMAND_FIND_CLOSE2 => "SMB1_COMMAND_FIND_CLOSE2",
+ SMB1_COMMAND_TREE_DISCONNECT => "SMB1_COMMAND_TREE_DISCONNECT",
+ SMB1_COMMAND_NEGOTIATE_PROTOCOL => "SMB1_COMMAND_NEGOTIATE_PROTOCOL",
+ SMB1_COMMAND_SESSION_SETUP_ANDX => "SMB1_COMMAND_SESSION_SETUP_ANDX",
+ SMB1_COMMAND_LOGOFF_ANDX => "SMB1_COMMAND_LOGOFF_ANDX",
+ SMB1_COMMAND_TREE_CONNECT_ANDX => "SMB1_COMMAND_TREE_CONNECT_ANDX",
+ SMB1_COMMAND_QUERY_INFO_DISK => "SMB1_COMMAND_QUERY_INFO_DISK",
+ SMB1_COMMAND_NT_TRANS => "SMB1_COMMAND_NT_TRANS",
+ SMB1_COMMAND_NT_TRANS_SECONDARY => "SMB1_COMMAND_NT_TRANS_SECONDARY",
+ SMB1_COMMAND_NT_CREATE_ANDX => "SMB1_COMMAND_NT_CREATE_ANDX",
+ SMB1_COMMAND_NT_CANCEL => "SMB1_COMMAND_NT_CANCEL",
+ _ => { return (c).to_string(); },
+ }.to_string()
+}
+
+// later we'll use this to determine if we need to
+// track a ssn per type
+pub fn smb1_create_new_tx(cmd: u8) -> bool {
+ match cmd {
+ SMB1_COMMAND_READ_ANDX |
+ SMB1_COMMAND_WRITE_ANDX |
+ SMB1_COMMAND_TRANS |
+ SMB1_COMMAND_TRANS2 => { false },
+ _ => { true },
+ }
+}
+
+// see if we're going to do a lookup for a TX.
+// related to smb1_create_new_tx(), however it
+// excludes the 'maybe' commands like TRANS2
+pub fn smb1_check_tx(cmd: u8) -> bool {
+ match cmd {
+ SMB1_COMMAND_READ_ANDX |
+ SMB1_COMMAND_WRITE_ANDX |
+ SMB1_COMMAND_TRANS => { false },
+ _ => { true },
+ }
+}
+
+fn smb1_close_file(state: &mut SMBState, fid: &[u8], direction: Direction)
+{
+ if let Some(tx) = state.get_file_tx_by_fuid(fid, direction) {
+ SCLogDebug!("found tx {}", tx.id);
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ if !tx.request_done {
+ SCLogDebug!("closing file tx {} FID {:?}", tx.id, fid);
+ filetracker_close(&mut tdf.file_tracker);
+ tx.request_done = true;
+ tx.response_done = true;
+ SCLogDebug!("tx {} is done", tx.id);
+ }
+ }
+ }
+}
+
+fn smb1_command_is_andx(c: u8) -> bool {
+ match c {
+ SMB1_COMMAND_LOCKING_ANDX |
+ SMB1_COMMAND_OPEN_ANDX |
+ SMB1_COMMAND_READ_ANDX |
+ SMB1_COMMAND_SESSION_SETUP_ANDX |
+ SMB1_COMMAND_LOGOFF_ANDX |
+ SMB1_COMMAND_TREE_CONNECT_ANDX |
+ SMB1_COMMAND_NT_CREATE_ANDX |
+ SMB1_COMMAND_WRITE_ANDX => {
+ return true;
+ }
+ _ => {
+ return false;
+ }
+ }
+}
+
+fn smb1_request_record_one(state: &mut SMBState, r: &SmbRecord, command: u8, andx_offset: &mut usize) {
+ let mut events : Vec<SMBEvent> = Vec::new();
+ let mut no_response_expected = false;
+
+ let have_tx = match command {
+ SMB1_COMMAND_RENAME => {
+ match parse_smb_rename_request_record(r.data) {
+ Ok((_, rd)) => {
+ SCLogDebug!("RENAME {:?}", rd);
+
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ let mut newname = rd.newname;
+ newname.retain(|&i|i != 0x00);
+ let mut oldname = rd.oldname;
+ oldname.retain(|&i|i != 0x00);
+
+ let tx = state.new_rename_tx(Vec::new(), oldname, newname);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_RENAME);
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_TRANS2 => {
+ match parse_smb_trans2_request_record(r.data) {
+ Ok((_, rd)) => {
+ SCLogDebug!("TRANS2 DONE {:?}", rd);
+
+ if rd.subcmd == 6 {
+ SCLogDebug!("SET_PATH_INFO");
+ match parse_trans2_request_params_set_path_info(rd.setup_blob) {
+ Ok((_, pd)) => {
+ SCLogDebug!("TRANS2 SET_PATH_INFO PARAMS DONE {:?}", pd);
+
+ if pd.loi == 1013 { // set disposition info
+ match parse_trans2_request_data_set_file_info_disposition(rd.data_blob) {
+ Ok((_, disp)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA DISPOSITION DONE {:?}", disp);
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+
+ let tx = state.new_setpathinfo_tx(pd.oldname,
+ rd.subcmd, pd.loi, disp.delete);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_TRANS2);
+ true
+
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA DISPOSITION INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA DISPOSITION ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else if pd.loi == 1010 {
+ match parse_trans2_request_data_set_path_info_rename(rd.data_blob) {
+ Ok((_, ren)) => {
+ SCLogDebug!("TRANS2 SET_PATH_INFO DATA RENAME DONE {:?}", ren);
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ let mut newname = ren.newname.to_vec();
+ newname.retain(|&i|i != 0x00);
+
+ let fid : Vec<u8> = Vec::new();
+
+ let tx = state.new_rename_tx(fid, pd.oldname, newname);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_TRANS2);
+ true
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 SET_PATH_INFO DATA RENAME INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 SET_PATH_INFO DATA RENAME ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else {
+ false
+ }
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 SET_PATH_INFO PARAMS INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 SET_PATH_INFO PARAMS ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else if rd.subcmd == 8 {
+ SCLogDebug!("SET_FILE_INFO");
+ match parse_trans2_request_params_set_file_info(rd.setup_blob) {
+ Ok((_, pd)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO PARAMS DONE {:?}", pd);
+
+ if pd.loi == 1013 { // set disposition info
+ match parse_trans2_request_data_set_file_info_disposition(rd.data_blob) {
+ Ok((_, disp)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA DISPOSITION DONE {:?}", disp);
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+
+ let mut frankenfid = pd.fid.to_vec();
+ frankenfid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+
+ let filename = match state.guid2name_map.get(&frankenfid) {
+ Some(n) => n.to_vec(),
+ None => b"<unknown>".to_vec(),
+ };
+ let tx = state.new_setfileinfo_tx(filename, pd.fid.to_vec(),
+ rd.subcmd, pd.loi, disp.delete);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_TRANS2);
+ true
+
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA DISPOSITION INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA DISPOSITION ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else if pd.loi == 1010 {
+ match parse_trans2_request_data_set_file_info_rename(rd.data_blob) {
+ Ok((_, ren)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA RENAME DONE {:?}", ren);
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ let mut newname = ren.newname.to_vec();
+ newname.retain(|&i|i != 0x00);
+
+ let mut frankenfid = pd.fid.to_vec();
+ frankenfid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+
+ let oldname = match state.guid2name_map.get(&frankenfid) {
+ Some(n) => n.to_vec(),
+ None => b"<unknown>".to_vec(),
+ };
+ let tx = state.new_rename_tx(pd.fid.to_vec(), oldname, newname);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_TRANS2);
+ true
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA RENAME INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO DATA RENAME ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else {
+ false
+ }
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO PARAMS INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 SET_FILE_INFO PARAMS ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else {
+ false
+ }
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("TRANS2 INCOMPLETE {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("TRANS2 ERROR {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_READ_ANDX => {
+ match parse_smb_read_andx_request_record(&r.data[*andx_offset-SMB1_HEADER_SIZE..]) {
+ Ok((_, rr)) => {
+ SCLogDebug!("rr {:?}", rr);
+
+ // store read fid,offset in map
+ let fid_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_OFFSET);
+ let mut fid = rr.fid.to_vec();
+ fid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+ let fidoff = SMBFileGUIDOffset::new(fid, rr.offset);
+ state.ssn2vecoffset_map.insert(fid_key, fidoff);
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ false
+ },
+ SMB1_COMMAND_WRITE_ANDX |
+ SMB1_COMMAND_WRITE |
+ SMB1_COMMAND_WRITE_AND_CLOSE => {
+ smb1_write_request_record(state, r, *andx_offset, command, 0);
+ true // tx handling in func
+ },
+ SMB1_COMMAND_TRANS => {
+ smb1_trans_request_record(state, r);
+ true
+ },
+ SMB1_COMMAND_NEGOTIATE_PROTOCOL => {
+ match parse_smb1_negotiate_protocol_record(r.data) {
+ Ok((_, pr)) => {
+ SCLogDebug!("SMB_COMMAND_NEGOTIATE_PROTOCOL {:?}", pr);
+
+ let mut bad_dialects = false;
+ let mut dialects : Vec<Vec<u8>> = Vec::new();
+ for d in &pr.dialects {
+ if d.is_empty() {
+ bad_dialects = true;
+ continue;
+ } else if d.len() == 1 {
+ bad_dialects = true;
+ }
+ let x = &d[1..d.len()];
+ let dvec = x.to_vec();
+ dialects.push(dvec);
+ }
+
+ let found = match state.get_negotiate_tx(1) {
+ Some(tx) => {
+ SCLogDebug!("WEIRD, should not have NEGOTIATE tx!");
+ tx.set_event(SMBEvent::DuplicateNegotiate);
+ true
+ },
+ None => { false },
+ };
+ if !found {
+ let tx = state.new_negotiate_tx(1);
+ if let Some(SMBTransactionTypeData::NEGOTIATE(ref mut tdn)) = tx.type_data {
+ tdn.dialects = dialects;
+ }
+ tx.request_done = true;
+ if bad_dialects {
+ tx.set_event(SMBEvent::NegotiateMalformedDialects);
+ }
+ }
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_NT_CREATE_ANDX => {
+ match parse_smb_create_andx_request_record(&r.data[*andx_offset-SMB1_HEADER_SIZE..], r) {
+ Ok((_, cr)) => {
+ SCLogDebug!("Create AndX {:?}", cr);
+ let del = cr.create_options & 0x0000_1000 != 0;
+ let dir = cr.create_options & 0x0000_0001 != 0;
+ SCLogDebug!("del {} dir {} options {:08x}", del, dir, cr.create_options);
+
+ let name_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_FILENAME);
+ let name_val = cr.file_name.to_vec();
+ state.ssn2vec_map.insert(name_key, name_val);
+
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.new_create_tx(&cr.file_name.to_vec(),
+ cr.disposition, del, dir, tx_hdr);
+ tx.vercmd.set_smb1_cmd(command);
+ SCLogDebug!("TS CREATE TX {} created", tx.id);
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_SESSION_SETUP_ANDX => {
+ SCLogDebug!("SMB1_COMMAND_SESSION_SETUP_ANDX user_id {}", r.user_id);
+ smb1_session_setup_request(state, r, *andx_offset);
+ true
+ },
+ SMB1_COMMAND_TREE_CONNECT_ANDX => {
+ SCLogDebug!("SMB1_COMMAND_TREE_CONNECT_ANDX");
+ match parse_smb_connect_tree_andx_record(&r.data[*andx_offset-SMB1_HEADER_SIZE..], r) {
+ Ok((_, tr)) => {
+ let name_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_TREE);
+ let mut name_val = tr.path;
+ if name_val.len() > 1 {
+ name_val = name_val[1..].to_vec();
+ }
+
+ // store hdr as SMBHDR_TYPE_TREE, so with tree id 0
+ // when the response finds this we update it
+ let tx = state.new_treeconnect_tx(name_key, name_val);
+ if let Some(SMBTransactionTypeData::TREECONNECT(ref mut tdn)) = tx.type_data {
+ tdn.req_service = Some(tr.service.to_vec());
+ }
+ tx.request_done = true;
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_TREE_CONNECT_ANDX);
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_TREE_DISCONNECT => {
+ let tree_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_SHARE);
+ state.ssn2tree_map.remove(&tree_key);
+ false
+ },
+ SMB1_COMMAND_CLOSE => {
+ match parse_smb1_close_request_record(r.data) {
+ Ok((_, cd)) => {
+ let mut fid = cd.fid.to_vec();
+ fid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+ state.ssn2vec_map.insert(SMBCommonHdr::from1(r, SMBHDR_TYPE_GUID), fid.to_vec());
+
+ SCLogDebug!("closing FID {:?}/{:?}", cd.fid, fid);
+ smb1_close_file(state, &fid, Direction::ToServer);
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ false
+ },
+ SMB1_COMMAND_NT_CANCEL |
+ SMB1_COMMAND_TRANS2_SECONDARY |
+ SMB1_COMMAND_LOCKING_ANDX => {
+ no_response_expected = true;
+ false
+ },
+ _ => {
+ if command == SMB1_COMMAND_LOGOFF_ANDX ||
+ command == SMB1_COMMAND_TREE_DISCONNECT ||
+ command == SMB1_COMMAND_NT_TRANS ||
+ command == SMB1_COMMAND_NT_TRANS_SECONDARY ||
+ command == SMB1_COMMAND_NT_CANCEL ||
+ command == SMB1_COMMAND_RENAME ||
+ command == SMB1_COMMAND_CHECK_DIRECTORY ||
+ command == SMB1_COMMAND_ECHO ||
+ command == SMB1_COMMAND_TRANS
+ { } else {
+ SCLogDebug!("unsupported command {}/{}",
+ command, &smb1_command_string(command));
+ }
+ false
+ },
+ };
+ if !have_tx && smb1_create_new_tx(command) {
+ let tx_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.new_generic_tx(1, command as u16, tx_key);
+ SCLogDebug!("tx {} created for {}/{}", tx.id, command, &smb1_command_string(command));
+ tx.set_events(events);
+ if no_response_expected {
+ tx.response_done = true;
+ }
+ }
+}
+
+pub fn smb1_request_record(state: &mut SMBState, r: &SmbRecord) -> u32 {
+ SCLogDebug!("record: command {}: record {:?}", r.command, r);
+
+ let mut andx_offset = SMB1_HEADER_SIZE;
+ let mut command = r.command;
+ loop {
+ smb1_request_record_one(state, r, command, &mut andx_offset);
+
+ // continue for next andx command if any
+ if smb1_command_is_andx(command) {
+ if let Ok((_, andx_hdr)) = smb1_parse_andx_header(&r.data[andx_offset-SMB1_HEADER_SIZE..]) {
+ if (andx_hdr.andx_offset as usize) > andx_offset &&
+ andx_hdr.andx_command != SMB1_COMMAND_NONE &&
+ (andx_hdr.andx_offset as usize) - SMB1_HEADER_SIZE < r.data.len() {
+ andx_offset = andx_hdr.andx_offset as usize;
+ command = andx_hdr.andx_command;
+ continue;
+ }
+ }
+ }
+ break;
+ }
+
+ 0
+}
+
+fn smb1_response_record_one(state: &mut SMBState, r: &SmbRecord, command: u8, andx_offset: &mut usize) {
+ SCLogDebug!("record: command {} status {} -> {:?}", r.command, r.nt_status, r);
+
+ let key_ssn_id = r.ssn_id;
+ let key_tree_id = r.tree_id;
+ let key_multiplex_id = r.multiplex_id;
+ let mut tx_sync = false;
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ let have_tx = match command {
+ SMB1_COMMAND_READ_ANDX => {
+ smb1_read_response_record(state, r, *andx_offset, 0);
+ true // tx handling in func
+ },
+ SMB1_COMMAND_NEGOTIATE_PROTOCOL => {
+ SCLogDebug!("SMB1_COMMAND_NEGOTIATE_PROTOCOL response");
+ match parse_smb1_negotiate_protocol_response_record(r.data) {
+ Ok((_, pr)) => {
+ let (have_ntx, dialect) = match state.get_negotiate_tx(1) {
+ Some(tx) => {
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.response_done = true;
+ SCLogDebug!("tx {} is done", tx.id);
+ let d = match tx.type_data {
+ Some(SMBTransactionTypeData::NEGOTIATE(ref mut x)) => {
+ x.server_guid = pr.server_guid.to_vec();
+
+ let dialect_idx = pr.dialect_idx as usize;
+ if x.dialects.len() <= dialect_idx {
+ None
+ } else {
+ let d = x.dialects[dialect_idx].to_vec();
+ Some(d)
+ }
+ },
+ _ => { None },
+ };
+ if d.is_none() {
+ tx.set_event(SMBEvent::NegotiateMalformedDialects);
+ }
+ (true, d)
+ },
+ None => { (false, None) },
+ };
+ if let Some(d) = dialect {
+ SCLogDebug!("dialect {:?}", d);
+ state.dialect_vec = Some(d);
+ }
+ have_ntx
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_TREE_CONNECT_ANDX => {
+ if r.nt_status != SMB_NTSTATUS_SUCCESS {
+ let name_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_TREE);
+ if let Some(tx) = state.get_treeconnect_tx(name_key) {
+ if let Some(SMBTransactionTypeData::TREECONNECT(ref mut tdn)) = tx.type_data {
+ tdn.tree_id = r.tree_id as u32;
+ }
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.response_done = true;
+ SCLogDebug!("tx {} is done", tx.id);
+ }
+ return;
+ }
+
+ match parse_smb_connect_tree_andx_response_record(&r.data[*andx_offset-SMB1_HEADER_SIZE..]) {
+ Ok((_, tr)) => {
+ let name_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_TREE);
+ let is_pipe = tr.service == "IPC".as_bytes();
+ let mut share_name = Vec::new();
+ let found = match state.get_treeconnect_tx(name_key) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::TREECONNECT(ref mut tdn)) = tx.type_data {
+ tdn.is_pipe = is_pipe;
+ tdn.tree_id = r.tree_id as u32;
+ share_name = tdn.share_name.to_vec();
+ tdn.res_service = Some(tr.service.to_vec());
+ }
+ tx.hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER);
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.response_done = true;
+ SCLogDebug!("tx {} is done", tx.id);
+ true
+ },
+ None => { false },
+ };
+ if found {
+ let tree = SMBTree::new(share_name.to_vec(), is_pipe);
+ let tree_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_SHARE);
+ state.ssn2tree_map.insert(tree_key, tree);
+ }
+ found
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB1_COMMAND_TREE_DISCONNECT => {
+ // normally removed when processing request,
+ // but in case we missed that try again here
+ let tree_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_SHARE);
+ state.ssn2tree_map.remove(&tree_key);
+ false
+ },
+ SMB1_COMMAND_NT_CREATE_ANDX => {
+ SCLogDebug!("SMB1_COMMAND_NT_CREATE_ANDX response {:08x}", r.nt_status);
+ if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ match parse_smb_create_andx_response_record(&r.data[*andx_offset-SMB1_HEADER_SIZE..]) {
+ Ok((_, cr)) => {
+ SCLogDebug!("Create AndX {:?}", cr);
+
+ let guid_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_FILENAME);
+ match state.ssn2vec_map.remove(&guid_key) {
+ Some(mut p) => {
+ p.retain(|&i|i != 0x00);
+
+ let mut fid = cr.fid.to_vec();
+ fid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+ SCLogDebug!("SMB1_COMMAND_NT_CREATE_ANDX fid {:?}", fid);
+ SCLogDebug!("fid {:?} name {:?}", fid, p);
+ state.guid2name_map.insert(fid, p);
+ },
+ _ => {
+ SCLogDebug!("SMBv1 response: GUID NOT FOUND");
+ },
+ }
+
+ let tx_hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ if let Some(tx) = state.get_generic_tx(1, command as u16, &tx_hdr) {
+ SCLogDebug!("tx {} with {}/{} marked as done",
+ tx.id, command, &smb1_command_string(command));
+ tx.set_status(r.nt_status, false);
+ tx.response_done = true;
+
+ if let Some(SMBTransactionTypeData::CREATE(ref mut tdn)) = tx.type_data {
+ tdn.create_ts = cr.create_ts.as_unix();
+ tdn.last_access_ts = cr.last_access_ts.as_unix();
+ tdn.last_write_ts = cr.last_write_ts.as_unix();
+ tdn.last_change_ts = cr.last_change_ts.as_unix();
+ tdn.size = cr.file_size;
+ tdn.guid = cr.fid.to_vec();
+ }
+ }
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else {
+ false
+ }
+ },
+ SMB1_COMMAND_CLOSE => {
+ let fid = state.ssn2vec_map.remove(&SMBCommonHdr::from1(r, SMBHDR_TYPE_GUID));
+ if let Some(fid) = fid {
+ SCLogDebug!("closing FID {:?}", fid);
+ smb1_close_file(state, &fid, Direction::ToClient);
+ }
+ false
+ },
+ SMB1_COMMAND_TRANS => {
+ smb1_trans_response_record(state, r);
+ true
+ },
+ SMB1_COMMAND_SESSION_SETUP_ANDX => {
+ smb1_session_setup_response(state, r, *andx_offset);
+ true
+ },
+ SMB1_COMMAND_LOGOFF_ANDX => {
+ tx_sync = true;
+ false
+ },
+ _ => {
+ false
+ },
+ };
+
+ if !have_tx && tx_sync {
+ if let Some(tx) = state.get_last_tx(1, command as u16) {
+ SCLogDebug!("last TX {} is CMD {}", tx.id, &smb1_command_string(command));
+ tx.response_done = true;
+ SCLogDebug!("tx {} cmd {} is done", tx.id, command);
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.set_events(events);
+ }
+ } else if !have_tx && smb1_check_tx(command) {
+ let tx_key = SMBCommonHdr::new(SMBHDR_TYPE_GENERICTX,
+ key_ssn_id as u64, key_tree_id as u32, key_multiplex_id as u64);
+ let _have_tx2 = match state.get_generic_tx(1, command as u16, &tx_key) {
+ Some(tx) => {
+ tx.request_done = true;
+ tx.response_done = true;
+ SCLogDebug!("tx {} cmd {} is done", tx.id, command);
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.set_events(events);
+ true
+ },
+ None => {
+ SCLogDebug!("no TX found for key {:?}", tx_key);
+ false
+ },
+ };
+ } else {
+ SCLogDebug!("have tx for cmd {}", command);
+ }
+}
+
+pub fn smb1_response_record(state: &mut SMBState, r: &SmbRecord) -> u32 {
+ let mut andx_offset = SMB1_HEADER_SIZE;
+ let mut command = r.command;
+ loop {
+ smb1_response_record_one(state, r, command, &mut andx_offset);
+
+ // continue for next andx command if any
+ if smb1_command_is_andx(command) {
+ if let Ok((_, andx_hdr)) = smb1_parse_andx_header(&r.data[andx_offset-SMB1_HEADER_SIZE..]) {
+ if (andx_hdr.andx_offset as usize) > andx_offset &&
+ andx_hdr.andx_command != SMB1_COMMAND_NONE &&
+ (andx_hdr.andx_offset as usize) - SMB1_HEADER_SIZE < r.data.len() {
+ andx_offset = andx_hdr.andx_offset as usize;
+ command = andx_hdr.andx_command;
+ continue;
+ }
+ }
+ }
+ break;
+ }
+
+ 0
+}
+
+pub fn smb1_trans_request_record(state: &mut SMBState, r: &SmbRecord)
+{
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ match parse_smb_trans_request_record(r.data, r) {
+ Ok((_, rd)) => {
+ SCLogDebug!("TRANS request {:?}", rd);
+
+ /* if we have a fid, store it so the response can pick it up */
+ let mut pipe_dcerpc = false;
+ if rd.pipe.is_some() {
+ let pipe = rd.pipe.unwrap();
+ state.ssn2vec_map.insert(SMBCommonHdr::from1(r, SMBHDR_TYPE_GUID),
+ pipe.fid.to_vec());
+
+ let mut frankenfid = pipe.fid.to_vec();
+ frankenfid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+
+ let (_filename, is_dcerpc) = state.get_service_for_guid(&frankenfid);
+
+ SCLogDebug!("smb1_trans_request_record: name {} is_dcerpc {}",
+ _filename, is_dcerpc);
+ pipe_dcerpc = is_dcerpc;
+ }
+
+ if pipe_dcerpc {
+ SCLogDebug!("SMBv1 TRANS TO PIPE");
+ let hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER);
+ let vercmd = SMBVerCmdStat::new1(r.command);
+ smb_write_dcerpc_record(state, vercmd, hdr, rd.data.data);
+ }
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ smb1_request_record_generic(state, r, events);
+}
+
+pub fn smb1_trans_response_record(state: &mut SMBState, r: &SmbRecord)
+{
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ match parse_smb_trans_response_record(r.data) {
+ Ok((_, rd)) => {
+ SCLogDebug!("TRANS response {:?}", rd);
+
+ // see if we have a stored fid
+ let fid = match state.ssn2vec_map.remove(
+ &SMBCommonHdr::from1(r, SMBHDR_TYPE_GUID)) {
+ Some(f) => f,
+ None => Vec::new(),
+ };
+ SCLogDebug!("FID {:?}", fid);
+
+ let mut frankenfid = fid.to_vec();
+ frankenfid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+
+ let (_filename, is_dcerpc) = state.get_service_for_guid(&frankenfid);
+
+ SCLogDebug!("smb1_trans_response_record: name {} is_dcerpc {}",
+ _filename, is_dcerpc);
+
+ // if we get status 'BUFFER_OVERFLOW' this is only a part of
+ // the data. Store it in the ssn/tree for later use.
+ if r.nt_status == SMB_NTSTATUS_BUFFER_OVERFLOW {
+ let key = SMBHashKeyHdrGuid::new(SMBCommonHdr::from1(r, SMBHDR_TYPE_TRANS_FRAG), fid);
+ SCLogDebug!("SMBv1/TRANS: queueing data for len {} key {:?}", rd.data.len(), key);
+ state.ssnguid2vec_map.insert(key, rd.data.to_vec());
+ } else if is_dcerpc {
+ SCLogDebug!("SMBv1 TRANS TO PIPE");
+ let hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER);
+ let vercmd = SMBVerCmdStat::new1_with_ntstatus(r.command, r.nt_status);
+ smb_read_dcerpc_record(state, vercmd, hdr, &fid, rd.data);
+ }
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+
+ // generic tx as well. Set events if needed.
+ smb1_response_record_generic(state, r, events);
+}
+
+/// Handle WRITE, WRITE_ANDX, WRITE_AND_CLOSE request records
+pub fn smb1_write_request_record(state: &mut SMBState, r: &SmbRecord, andx_offset: usize, command: u8, nbss_remaining: u32)
+{
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ let result = if command == SMB1_COMMAND_WRITE_ANDX {
+ parse_smb1_write_andx_request_record(&r.data[andx_offset-SMB1_HEADER_SIZE..], andx_offset)
+ } else if command == SMB1_COMMAND_WRITE {
+ parse_smb1_write_request_record(r.data)
+ } else {
+ parse_smb1_write_and_close_request_record(r.data)
+ };
+ match result {
+ Ok((_, rd)) => {
+ SCLogDebug!("SMBv1: write andx => {:?}", rd);
+ if rd.len > rd.data.len() as u32 + nbss_remaining {
+ // Record claims more bytes than are in NBSS record...
+ state.set_event(SMBEvent::WriteRequestTooLarge);
+ // Skip the remaining bytes of the record.
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ return;
+ }
+ let mut file_fid = rd.fid.to_vec();
+ file_fid.extend_from_slice(&u32_as_bytes(r.ssn_id));
+ SCLogDebug!("SMBv1 WRITE: FID {:?} offset {}",
+ file_fid, rd.offset);
+
+ let file_name = match state.guid2name_map.get(&file_fid) {
+ Some(n) => n.to_vec(),
+ None => b"<unknown>".to_vec(),
+ };
+ let mut set_event_fileoverlap = false;
+ let found = match state.get_file_tx_by_fuid_with_open_file(&file_fid, Direction::ToServer) {
+ Some(tx) => {
+ let file_id : u32 = tx.id as u32;
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ if rd.offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, rd.data, rd.offset,
+ rd.len, false, &file_id);
+ SCLogDebug!("FID {:?} found at tx {} => {:?}", file_fid, tx.id, tx);
+ }
+ true
+ },
+ None => { false },
+ };
+ if !found {
+ let tree_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_SHARE);
+ let (share_name, is_pipe) = match state.ssn2tree_map.get(&tree_key) {
+ Some(n) => (n.name.to_vec(), n.is_pipe),
+ None => (Vec::new(), false),
+ };
+ if is_pipe {
+ SCLogDebug!("SMBv1 WRITE TO PIPE");
+ let hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER);
+ let vercmd = SMBVerCmdStat::new1_with_ntstatus(command, r.nt_status);
+ smb_write_dcerpc_record(state, vercmd, hdr, rd.data);
+ } else {
+ let tx = state.new_file_tx(&file_fid, &file_name, Direction::ToServer);
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let file_id : u32 = tx.id as u32;
+ if rd.offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, rd.data, rd.offset,
+ rd.len, false, &file_id);
+ tdf.share_name = share_name;
+ SCLogDebug!("tdf {:?}", tdf);
+ }
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_WRITE_ANDX);
+ SCLogDebug!("FID {:?} found at tx {} => {:?}", file_fid, tx.id, tx);
+ }
+ }
+ if set_event_fileoverlap {
+ state.set_event(SMBEvent::FileOverlap);
+ }
+
+ state.set_file_left(Direction::ToServer, rd.len, rd.data.len() as u32, file_fid.to_vec());
+
+ if command == SMB1_COMMAND_WRITE_AND_CLOSE {
+ SCLogDebug!("closing FID {:?}", file_fid);
+ smb1_close_file(state, &file_fid, Direction::ToServer);
+ }
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ smb1_request_record_generic(state, r, events);
+}
+
+pub fn smb1_read_response_record(state: &mut SMBState, r: &SmbRecord, andx_offset: usize, nbss_remaining: u32)
+{
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ match parse_smb_read_andx_response_record(&r.data[andx_offset-SMB1_HEADER_SIZE..]) {
+ Ok((_, rd)) => {
+ SCLogDebug!("SMBv1: read response => {:?}", rd);
+ if rd.len > nbss_remaining + rd.data.len() as u32 {
+ // Record claims more bytes than are in NBSS record...
+ state.set_event(SMBEvent::ReadResponseTooLarge);
+ // Skip the remaining bytes of the record.
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ return;
+ }
+ let fid_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_OFFSET);
+ let (offset, file_fid) = match state.ssn2vecoffset_map.remove(&fid_key) {
+ Some(o) => (o.offset, o.guid),
+ None => {
+ SCLogDebug!("SMBv1 READ response: reply to unknown request: left {} {:?}",
+ rd.len - rd.data.len() as u32, rd);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ return;
+ },
+ };
+ SCLogDebug!("SMBv1 READ: FID {:?} offset {}", file_fid, offset);
+
+ let tree_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_SHARE);
+ let (is_pipe, share_name) = match state.ssn2tree_map.get(&tree_key) {
+ Some(n) => (n.is_pipe, n.name.to_vec()),
+ _ => { (false, Vec::new()) },
+ };
+ if !is_pipe {
+ let file_name = match state.guid2name_map.get(&file_fid) {
+ Some(n) => n.to_vec(),
+ None => Vec::new(),
+ };
+ let mut set_event_fileoverlap = false;
+ let found = match state.get_file_tx_by_fuid_with_open_file(&file_fid, Direction::ToClient) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let file_id : u32 = tx.id as u32;
+ SCLogDebug!("FID {:?} found at tx {}", file_fid, tx.id);
+ if offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, rd.data, offset,
+ rd.len, false, &file_id);
+ }
+ true
+ },
+ None => { false },
+ };
+ if !found {
+ let tx = state.new_file_tx(&file_fid, &file_name, Direction::ToClient);
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let file_id : u32 = tx.id as u32;
+ SCLogDebug!("FID {:?} found at tx {}", file_fid, tx.id);
+ if offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, rd.data, offset,
+ rd.len, false, &file_id);
+ tdf.share_name = share_name;
+ }
+ tx.vercmd.set_smb1_cmd(SMB1_COMMAND_READ_ANDX);
+ }
+ if set_event_fileoverlap {
+ state.set_event(SMBEvent::FileOverlap);
+ }
+ } else {
+ SCLogDebug!("SMBv1 READ response from PIPE");
+ let hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER);
+ let vercmd = SMBVerCmdStat::new1(SMB1_COMMAND_READ_ANDX);
+
+ // hack: we store fid with ssn id mixed in, but here we want the
+ // real thing instead.
+ let pure_fid = if file_fid.len() > 2 { &file_fid[0..2] } else { &[] };
+ smb_read_dcerpc_record(state, vercmd, hdr, pure_fid, rd.data);
+ }
+
+ state.set_file_left(Direction::ToClient, rd.len, rd.data.len() as u32, file_fid.to_vec());
+ }
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ }
+
+ // generic tx as well. Set events if needed.
+ smb1_response_record_generic(state, r, events);
+}
+
+/// create a tx for a command / response pair if we're
+/// configured to do so, or if this is a tx especially
+/// for setting an event.
+fn smb1_request_record_generic(state: &mut SMBState, r: &SmbRecord, events: Vec<SMBEvent>) {
+ if smb1_create_new_tx(r.command) || !events.is_empty() {
+ let tx_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.new_generic_tx(1, r.command as u16, tx_key);
+ tx.set_events(events);
+ }
+}
+
+/// update or create a tx for a command / response pair based
+/// on the response. We only create a tx for the response side
+/// if we didn't already update a tx, and we have to set events
+fn smb1_response_record_generic(state: &mut SMBState, r: &SmbRecord, events: Vec<SMBEvent>) {
+ let tx_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+ if let Some(tx) = state.get_generic_tx(1, r.command as u16, &tx_key) {
+ tx.request_done = true;
+ tx.response_done = true;
+ SCLogDebug!("tx {} cmd {} is done", tx.id, r.command);
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.set_events(events);
+ return;
+ }
+ if !events.is_empty() {
+ let tx = state.new_generic_tx(1, r.command as u16, tx_key);
+ tx.request_done = true;
+ tx.response_done = true;
+ SCLogDebug!("tx {} cmd {} is done", tx.id, r.command);
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.set_events(events);
+ }
+}
diff --git a/rust/src/smb/smb1_records.rs b/rust/src/smb/smb1_records.rs
new file mode 100644
index 0000000..bf767da
--- /dev/null
+++ b/rust/src/smb/smb1_records.rs
@@ -0,0 +1,880 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::common::nom7::take_until_and_consume;
+use crate::smb::error::SmbError;
+use crate::smb::smb::*;
+use crate::smb::smb_records::*;
+use nom7::bytes::streaming::{tag, take};
+use nom7::combinator::{complete, cond, peek, rest, verify};
+use nom7::error::{make_error, ErrorKind};
+use nom7::Err;
+use nom7::multi::many1;
+use nom7::number::streaming::{le_u8, le_u16, le_u32, le_u64};
+use nom7::IResult;
+
+pub const SMB1_HEADER_SIZE: usize = 32;
+
+// SMB_FLAGS_REPLY in Microsoft docs.
+const SMB1_FLAGS_RESPONSE: u8 = 0x80;
+
+fn smb_get_unicode_string_with_offset(i: &[u8], offset: usize) -> IResult<&[u8], Vec<u8>, SmbError>
+{
+ let (i, _) = cond(offset % 2 == 1, take(1_usize))(i)?;
+ smb_get_unicode_string(i)
+}
+
+/// take a string, unicode or ascii based on record
+pub fn smb1_get_string<'a>(i: &'a[u8], r: &SmbRecord, offset: usize) -> IResult<&'a[u8], Vec<u8>, SmbError> {
+ if r.has_unicode_support() {
+ smb_get_unicode_string_with_offset(i, offset)
+ } else {
+ smb_get_ascii_string(i)
+ }
+}
+
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbParamBlockAndXHeader {
+ pub wct: u8,
+ pub andx_command: u8,
+ pub andx_offset: u16,
+}
+
+pub fn smb1_parse_andx_header(i: &[u8]) -> IResult<&[u8], SmbParamBlockAndXHeader> {
+ let (i, wct) = le_u8(i)?;
+ let (i, andx_command) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, andx_offset) = le_u16(i)?;
+ let hdr = SmbParamBlockAndXHeader {
+ wct,
+ andx_command,
+ andx_offset,
+ };
+ Ok((i, hdr))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Smb1WriteRequestRecord<'a> {
+ pub offset: u64,
+ pub len: u32,
+ pub fid: &'a[u8],
+ pub data: &'a[u8],
+}
+
+pub fn parse_smb1_write_request_record(i: &[u8]) -> IResult<&[u8], Smb1WriteRequestRecord> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let (i, _count) = le_u16(i)?;
+ let (i, offset) = le_u32(i)?;
+ let (i, _remaining) = le_u16(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let (i, _buffer_format) = le_u8(i)?;
+ let (i, data_len) = le_u16(i)?;
+ let (i, file_data) = take(data_len)(i)?;
+ let record = Smb1WriteRequestRecord {
+ offset: offset as u64,
+ len: data_len as u32,
+ fid,
+ data:file_data,
+ };
+ Ok((i, record))
+}
+
+pub fn parse_smb1_write_andx_request_record(i : &[u8], andx_offset: usize) -> IResult<&[u8], Smb1WriteRequestRecord> {
+ let origin_i = i;
+ let ax = andx_offset as u16;
+ let (i, wct) = le_u8(i)?;
+ let (i, _andx_command) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, _andx_offset) = le_u16(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let (i, offset) = le_u32(i)?;
+ let (i, _) = take(4_usize)(i)?; // reserved
+ let (i, _write_mode) = le_u16(i)?;
+ let (i, _remaining) = le_u16(i)?;
+ let (i, data_len_high) = le_u16(i)?;
+ let (i, data_len_low) = le_u16(i)?;
+ let data_len = ((data_len_high as u32) << 16)|(data_len_low as u32);
+ let (i, data_offset) = le_u16(i)?;
+ if data_offset < 0x3c || data_offset < ax{
+ return Err(Err::Error(make_error(i, ErrorKind::LengthValue)));
+ }
+ let (i, high_offset) = cond(wct == 14, le_u32)(i)?;
+ let (_i, _bcc) = le_u16(i)?;
+ let (i, _padding_data) = take(data_offset-ax)(origin_i)?;
+ let (i, file_data) = take(std::cmp::min(data_len, i.len() as u32))(i)?;
+
+ let record = Smb1WriteRequestRecord {
+ offset: ((high_offset.unwrap_or(0) as u64) << 32) | offset as u64,
+ len: data_len,
+ fid,
+ data: file_data,
+ };
+ Ok((i, record))
+}
+
+pub fn parse_smb1_write_and_close_request_record(i: &[u8]) -> IResult<&[u8], Smb1WriteRequestRecord> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let (i, count) = le_u16(i)?;
+ let (i, offset) = le_u32(i)?;
+ let (i, _last_write) = take(4_usize)(i)?;
+ let (i, bcc) = le_u16(i)?;
+ let (i, _padding) = cond(bcc > count, |b| take(bcc - count)(b))(i)?;
+ let (i, file_data) = take(count)(i)?;
+ let record = Smb1WriteRequestRecord {
+ offset: offset as u64,
+ len: count as u32,
+ fid,
+ data: file_data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Smb1NegotiateProtocolResponseRecord<'a> {
+ pub dialect_idx: u16,
+ pub server_guid: &'a[u8],
+}
+
+pub fn parse_smb1_negotiate_protocol_response_record_error(i: &[u8])
+ -> IResult<&[u8], Smb1NegotiateProtocolResponseRecord> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let record = Smb1NegotiateProtocolResponseRecord {
+ dialect_idx: 0,
+ server_guid: &[],
+ };
+ Ok((i, record))
+}
+
+pub fn parse_smb1_negotiate_protocol_response_record_ok(i: &[u8])
+ -> IResult<&[u8], Smb1NegotiateProtocolResponseRecord> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, dialect_idx) = le_u16(i)?;
+ let (i, _sec_mode) = le_u8(i)?;
+ let (i, _) = take(16_usize)(i)?;
+ let (i, _caps) = le_u32(i)?;
+ let (i, _sys_time) = le_u64(i)?;
+ let (i, _server_tz) = le_u16(i)?;
+ let (i, _challenge_len) = le_u8(i)?;
+ let (i, bcc) = le_u16(i)?;
+ let (i, server_guid) = cond(bcc >= 16, take(16_usize))(i)?;
+ let record = Smb1NegotiateProtocolResponseRecord {
+ dialect_idx,
+ server_guid: server_guid.unwrap_or(&[]),
+ };
+ Ok((i, record))
+}
+
+pub fn parse_smb1_negotiate_protocol_response_record(i: &[u8])
+ -> IResult<&[u8], Smb1NegotiateProtocolResponseRecord> {
+ let (i, wct) = peek(le_u8)(i)?;
+ match wct {
+ 0 => parse_smb1_negotiate_protocol_response_record_error(i),
+ _ => parse_smb1_negotiate_protocol_response_record_ok(i),
+ }
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Smb1NegotiateProtocolRecord<'a> {
+ pub dialects: Vec<&'a [u8]>,
+}
+
+pub fn parse_smb1_negotiate_protocol_record(i: &[u8])
+ -> IResult<&[u8], Smb1NegotiateProtocolRecord> {
+ let (i, _wtc) = le_u8(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ // dialects is a list of [1 byte buffer format][string][0 terminator]
+ let (i, dialects) = many1(complete(take_until_and_consume(b"\0")))(i)?;
+ let record = Smb1NegotiateProtocolRecord { dialects };
+ Ok((i, record))
+}
+
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Smb1ResponseRecordTreeConnectAndX<'a> {
+ pub service: &'a[u8],
+ pub nativefs: &'a[u8],
+}
+
+pub fn parse_smb_connect_tree_andx_response_record(i: &[u8])
+ -> IResult<&[u8], Smb1ResponseRecordTreeConnectAndX> {
+ let (i, wct) = le_u8(i)?;
+ let (i, _andx_command) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, _andx_offset) = le_u16(i)?;
+ let (i, _) = cond(wct >= 3, take(2_usize))(i)?; // optional support
+ let (i, _) = cond(wct == 7, take(8_usize))(i)?; // access masks
+ let (i, _bcc) = le_u16(i)?;
+ let (i, service) = take_until_and_consume(b"\x00")(i)?;
+ let (i, nativefs) = take_until_and_consume(b"\x00")(i)?;
+ let record = Smb1ResponseRecordTreeConnectAndX {
+ service,
+ nativefs
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecordTreeConnectAndX<'a> {
+ pub path: Vec<u8>,
+ pub service: &'a[u8],
+}
+
+pub fn parse_smb_connect_tree_andx_record<'a>(i: &'a[u8], r: &SmbRecord)
+ -> IResult<&'a[u8], SmbRecordTreeConnectAndX<'a>, SmbError> {
+ let (i, _skip1) = take(7_usize)(i)?;
+ let (i, pwlen) = le_u16(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let (i, _pw) = take(pwlen)(i)?;
+ let (i, path) = smb1_get_string(i, r, 11 + pwlen as usize)?;
+ let (i, service) = take_until_and_consume(b"\x00")(i)?;
+ let record = SmbRecordTreeConnectAndX {
+ path,
+ service
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecordTransRequest<'a> {
+ pub params: SmbRecordTransRequestParams,
+ pub pipe: Option<SmbPipeProtocolRecord<'a>>,
+ pub txname: Vec<u8>,
+ pub data: SmbRecordTransRequestData<'a>,
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbPipeProtocolRecord<'a> {
+ pub function: u16,
+ pub fid: &'a[u8],
+}
+
+pub fn parse_smb_trans_request_record_pipe(i: &[u8])
+ -> IResult<&[u8], SmbPipeProtocolRecord, SmbError> {
+ let (i, fun) = le_u16(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let record = SmbPipeProtocolRecord {
+ function: fun,
+ fid
+ };
+ Ok((i, record))
+}
+
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecordTransRequestParams<> {
+ pub max_data_cnt: u16,
+ param_cnt: u16,
+ param_offset: u16,
+ data_cnt: u16,
+ data_offset: u16,
+ bcc: u16,
+}
+
+pub fn parse_smb_trans_request_record_params(i: &[u8])
+ -> IResult<&[u8], (SmbRecordTransRequestParams, Option<SmbPipeProtocolRecord>), SmbError>
+{
+ let (i, wct) = le_u8(i)?;
+ let (i, _total_param_cnt) = le_u16(i)?;
+ let (i, _total_data_count) = le_u16(i)?;
+ let (i, _max_param_cnt) = le_u16(i)?;
+ let (i, max_data_cnt) = le_u16(i)?;
+ let (i, _max_setup_cnt) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, _) = take(2_usize)(i)?; // flags
+ let (i, _timeout) = le_u32(i)?;
+ let (i, _) = take(2_usize)(i)?; // reserved
+ let (i, param_cnt) = le_u16(i)?;
+ let (i, param_offset) = le_u16(i)?;
+ let (i, data_cnt) = le_u16(i)?;
+ let (i, data_offset) = le_u16(i)?;
+ let (i, setup_cnt) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, pipe) = cond(wct == 16 && setup_cnt == 2 && data_cnt > 0, parse_smb_trans_request_record_pipe)(i)?;
+ let (i, bcc) = le_u16(i)?;
+ let params = SmbRecordTransRequestParams {
+ max_data_cnt,
+ param_cnt,
+ param_offset,
+ data_cnt,
+ data_offset,
+ bcc
+ };
+ Ok((i, (params, pipe)))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecordTransRequestData<'a> {
+ pub data: &'a[u8],
+}
+
+pub fn parse_smb_trans_request_record_data(i: &[u8],
+ pad1: usize, param_cnt: u16, pad2: usize, data_len: u16)
+ -> IResult<&[u8], SmbRecordTransRequestData, SmbError>
+{
+ let (i, _) = take(pad1)(i)?;
+ let (i, _) = take(param_cnt)(i)?;
+ let (i, _) = take(pad2)(i)?;
+ let (i, data) = take(data_len)(i)?;
+ let req = SmbRecordTransRequestData { data };
+ Ok((i, req))
+}
+
+pub fn parse_smb_trans_request_record<'a>(i: &'a[u8], r: &SmbRecord)
+ -> IResult<&'a[u8], SmbRecordTransRequest<'a>, SmbError>
+{
+ let (rem, (params, pipe)) = parse_smb_trans_request_record_params(i)?;
+ let mut offset = 32 + (i.len() - rem.len()); // init with SMB header
+ SCLogDebug!("params {:?}: offset {}", params, offset);
+
+ let (rem2, n) = smb1_get_string(rem, r, offset)?;
+ offset += rem.len() - rem2.len();
+ SCLogDebug!("n {:?}: offset {}", n, offset);
+
+ // spec says pad to 4 bytes, but traffic shows this doesn't
+ // always happen.
+ let pad1 = if offset == params.param_offset as usize ||
+ offset == params.data_offset as usize {
+ 0
+ } else {
+ offset % 4
+ };
+ SCLogDebug!("pad1 {}", pad1);
+ offset += pad1;
+ offset += params.param_cnt as usize;
+
+ let recdata = if params.data_cnt > 0 {
+ // ignore padding rule if we're already at the correct
+ // offset.
+ let pad2 = if offset == params.data_offset as usize {
+ 0
+ } else {
+ offset % 4
+ };
+ SCLogDebug!("pad2 {}", pad2);
+
+ let d = match parse_smb_trans_request_record_data(rem2,
+ pad1, params.param_cnt, pad2, params.data_cnt) {
+ Ok((_, rd)) => rd,
+ Err(e) => { return Err(e); }
+ };
+ SCLogDebug!("d {:?}", d);
+ d
+ } else {
+ SmbRecordTransRequestData { data: &[], } // no data
+ };
+
+ let res = SmbRecordTransRequest {
+ params, pipe, txname: n, data: recdata,
+ };
+ Ok((rem, res))
+}
+
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecordTransResponse<'a> {
+ pub data_cnt: u16,
+ pub bcc: u16,
+ pub data: &'a[u8],
+}
+
+pub fn parse_smb_trans_response_error_record(i: &[u8]) -> IResult<&[u8], SmbRecordTransResponse> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, bcc) = le_u16(i)?;
+ let resp = SmbRecordTransResponse {
+ data_cnt: 0,
+ bcc,
+ data: &[],
+ };
+ Ok((i, resp))
+}
+
+pub fn parse_smb_trans_response_regular_record(i: &[u8]) -> IResult<&[u8], SmbRecordTransResponse> {
+ let (i, wct) = le_u8(i)?;
+ let (i, _total_param_cnt) = le_u16(i)?;
+ let (i, _total_data_count) = le_u16(i)?;
+ let (i, _) = take(2_usize)(i)?; // reserved
+ let (i, _param_cnt) = le_u16(i)?;
+ let (i, _param_offset) = le_u16(i)?;
+ let (i, _param_displacement) = le_u16(i)?;
+ let (i, data_cnt) = le_u16(i)?;
+ let (i, data_offset) = le_u16(i)?;
+ let (i, _data_displacement) = le_u16(i)?;
+ let (i, _setup_cnt) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, bcc) = le_u16(i)?;
+ let (i, _) = take(1_usize)(i)?; // padding
+ let (i, _padding_evasion) = cond(
+ data_offset > 36+2*(wct as u16),
+ |b| take(data_offset - (36+2*(wct as u16)))(b)
+ )(i)?;
+ let (i, data) = take(data_cnt)(i)?;
+ let resp = SmbRecordTransResponse {
+ data_cnt,
+ bcc,
+ data
+ };
+ Ok((i, resp))
+}
+
+pub fn parse_smb_trans_response_record(i: &[u8]) -> IResult<&[u8], SmbRecordTransResponse> {
+ let (i, wct) = peek(le_u8)(i)?;
+ match wct {
+ 0 => parse_smb_trans_response_error_record(i),
+ _ => parse_smb_trans_response_regular_record(i),
+ }
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecordSetupAndX<'a> {
+ pub sec_blob: &'a[u8],
+}
+
+pub fn parse_smb_setup_andx_record(i: &[u8]) -> IResult<&[u8], SmbRecordSetupAndX> {
+ let (i, _skip1) = take(15_usize)(i)?;
+ let (i, sec_blob_len) = le_u16(i)?;
+ let (i, _skip2) = take(8_usize)(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let (i, sec_blob) = take(sec_blob_len)(i)?;
+ let record = SmbRecordSetupAndX { sec_blob };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbResponseRecordSetupAndX<'a> {
+ pub sec_blob: &'a[u8],
+}
+
+fn response_setup_andx_record(i: &[u8]) -> IResult<&[u8], SmbResponseRecordSetupAndX> {
+ let (i, _skip1) = take(7_usize)(i)?;
+ let (i, sec_blob_len) = le_u16(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let (i, sec_blob) = take(sec_blob_len)(i)?;
+ let record = SmbResponseRecordSetupAndX { sec_blob };
+ Ok((i, record))
+}
+
+fn response_setup_andx_wct3_record(i: &[u8]) -> IResult<&[u8], SmbResponseRecordSetupAndX> {
+ let (i, _skip1) = take(7_usize)(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let record = SmbResponseRecordSetupAndX {
+ sec_blob: &[],
+ };
+ Ok((i, record))
+}
+
+fn response_setup_andx_error_record(i: &[u8]) -> IResult<&[u8], SmbResponseRecordSetupAndX> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let record = SmbResponseRecordSetupAndX {
+ sec_blob: &[],
+ };
+ Ok((i, record))
+}
+
+pub fn parse_smb_response_setup_andx_record(i: &[u8]) -> IResult<&[u8], SmbResponseRecordSetupAndX> {
+ let (i, wct) = peek(le_u8)(i)?;
+ match wct {
+ 0 => response_setup_andx_error_record(i),
+ 3 => response_setup_andx_wct3_record(i),
+ _ => response_setup_andx_record(i),
+ }
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRequestReadAndXRecord<'a> {
+ pub fid: &'a[u8],
+ pub size: u64,
+ pub offset: u64,
+}
+
+pub fn parse_smb_read_andx_request_record(i: &[u8]) -> IResult<&[u8], SmbRequestReadAndXRecord> {
+ let (i, wct) = le_u8(i)?;
+ let (i, _andx_command) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, _andx_offset) = le_u16(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let (i, offset) = le_u32(i)?;
+ let (i, max_count_low) = le_u16(i)?;
+ let (i, _) = take(2_usize)(i)?;
+ let (i, max_count_high) = le_u32(i)?;
+ let (i, _) = take(2_usize)(i)?;
+ let (i, high_offset) = cond(wct == 12,le_u32)(i)?; // only from wct ==12?
+ let record = SmbRequestReadAndXRecord {
+ fid,
+ size: (((max_count_high as u64) << 16)|max_count_low as u64),
+ offset: high_offset.map(|ho| (ho as u64) << 32 | offset as u64).unwrap_or(0),
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbResponseReadAndXRecord<'a> {
+ pub len: u32,
+ pub data: &'a[u8],
+}
+
+pub fn parse_smb_read_andx_response_record(i: &[u8]) -> IResult<&[u8], SmbResponseReadAndXRecord> {
+ let (i, wct) = le_u8(i)?;
+ let (i, _andx_command) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, _andx_offset) = le_u16(i)?;
+ let (i, _) = take(6_usize)(i)?;
+ let (i, data_len_low) = le_u16(i)?;
+ let (i, data_offset) = le_u16(i)?;
+ let (i, data_len_high) = le_u32(i)?;
+ let (i, _) = take(6_usize)(i)?; // reserved
+ let (i, bcc) = le_u16(i)?;
+ let (i, _padding) = cond(
+ bcc > data_len_low,
+ |b| take(bcc - data_len_low)(b)
+ )(i)?; // TODO figure out how this works with data_len_high
+ let (i, _padding_evasion) = cond(
+ data_offset > 36+2*(wct as u16),
+ |b| take(data_offset - (36+2*(wct as u16)))(b)
+ )(i)?;
+ let (i, file_data) = rest(i)?;
+
+ let record = SmbResponseReadAndXRecord {
+ len: ((data_len_high << 16)|data_len_low as u32),
+ data: file_data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRequestRenameRecord {
+ pub oldname: Vec<u8>,
+ pub newname: Vec<u8>,
+}
+
+pub fn parse_smb_rename_request_record(i: &[u8]) -> IResult<&[u8], SmbRequestRenameRecord, SmbError> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, _search_attr) = le_u16(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let (i, _oldtype) = le_u8(i)?;
+ let (i, oldname) = smb_get_unicode_string(i)?;
+ let (i, _newtype) = le_u8(i)?;
+ let (i, newname) = smb_get_unicode_string_with_offset(i, 1)?; // HACK if we assume oldname is a series of utf16 chars offset would be 1
+ let record = SmbRequestRenameRecord {
+ oldname,
+ newname
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRequestCreateAndXRecord<> {
+ pub disposition: u32,
+ pub create_options: u32,
+ pub file_name: Vec<u8>,
+}
+
+pub fn parse_smb_create_andx_request_record<'a>(i: &'a[u8], r: &SmbRecord)
+ -> IResult<&'a[u8], SmbRequestCreateAndXRecord<>, SmbError>
+{
+ let (i, _skip1) = take(6_usize)(i)?;
+ let (i, file_name_len) = le_u16(i)?;
+ let (i, _skip3) = take(28_usize)(i)?;
+ let (i, disposition) = le_u32(i)?;
+ let (i, create_options) = le_u32(i)?;
+ let (i, _skip2) = take(5_usize)(i)?;
+ let (i, bcc) = le_u16(i)?;
+ let (i, file_name) = cond(
+ bcc >= file_name_len,
+ |b| smb1_get_string(b, r, (bcc - file_name_len) as usize)
+ )(i)?;
+ let (i, _skip3) = rest(i)?;
+ let record = SmbRequestCreateAndXRecord {
+ disposition,
+ create_options,
+ file_name: file_name.unwrap_or_default(),
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Trans2RecordParamSetFileInfoDisposition<> {
+ pub delete: bool,
+}
+
+pub fn parse_trans2_request_data_set_file_info_disposition(i: &[u8])
+ -> IResult<&[u8], Trans2RecordParamSetFileInfoDisposition> {
+ let (i, delete) = le_u8(i)?;
+ let record = Trans2RecordParamSetFileInfoDisposition {
+ delete: delete & 1 == 1,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Trans2RecordParamSetFileInfo<'a> {
+ pub fid: &'a[u8],
+ pub loi: u16,
+}
+
+pub fn parse_trans2_request_params_set_file_info(i: &[u8]) -> IResult<&[u8], Trans2RecordParamSetFileInfo> {
+ let (i, fid) = take(2_usize)(i)?;
+ let (i, loi) = le_u16(i)?;
+ let record = Trans2RecordParamSetFileInfo { fid, loi };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Trans2RecordParamSetFileInfoRename<'a> {
+ pub replace: bool,
+ pub newname: &'a[u8],
+}
+
+pub fn parse_trans2_request_data_set_file_info_rename(i: &[u8]) -> IResult<&[u8], Trans2RecordParamSetFileInfoRename> {
+ let (i, replace) = le_u8(i)?;
+ let (i, _reserved) = take(3_usize)(i)?;
+ let (i, _root_dir) = take(4_usize)(i)?;
+ let (i, newname_len) = le_u32(i)?;
+ let (i, newname) = take(newname_len)(i)?;
+ let record = Trans2RecordParamSetFileInfoRename {
+ replace: replace==1,
+ newname,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Trans2RecordParamSetPathInfo<> {
+ pub loi: u16,
+ pub oldname: Vec<u8>,
+}
+
+pub fn parse_trans2_request_params_set_path_info(i: &[u8]) -> IResult<&[u8], Trans2RecordParamSetPathInfo, SmbError> {
+ let (i, loi) = le_u16(i)?;
+ let (i, _reserved) = take(4_usize)(i)?;
+ let (i, oldname) = smb_get_unicode_string(i)?;
+ let record = Trans2RecordParamSetPathInfo { loi, oldname };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Trans2RecordParamSetPathInfoRename<'a> {
+ pub replace: bool,
+ pub newname: &'a[u8],
+}
+
+pub fn parse_trans2_request_data_set_path_info_rename(i: &[u8]) -> IResult<&[u8], Trans2RecordParamSetPathInfoRename> {
+ let (i, replace) = le_u8(i)?;
+ let (i, _reserved) = take(3_usize)(i)?;
+ let (i, _root_dir) = take(4_usize)(i)?;
+ let (i, newname_len) = le_u32(i)?;
+ let (i, newname) = take(newname_len)(i)?;
+ let record = Trans2RecordParamSetPathInfoRename {
+ replace: replace==1,
+ newname
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRequestTrans2Record<'a> {
+ pub subcmd: u16,
+ pub setup_blob: &'a[u8],
+ pub data_blob: &'a[u8],
+}
+
+pub fn parse_smb_trans2_request_record(i: &[u8]) -> IResult<&[u8], SmbRequestTrans2Record> {
+ let (i, _wct) = le_u8(i)?;
+ let (i, _total_param_cnt) = le_u16(i)?;
+ let (i, _total_data_cnt) = le_u16(i)?;
+ let (i, _max_param_cnt) = le_u16(i)?;
+ let (i, _max_data_cnt) = le_u16(i)?;
+ let (i, _max_setup_cnt) = le_u8(i)?;
+ let (i, _reserved1) = take(1_usize)(i)?;
+ let (i, _flags) = le_u16(i)?;
+ let (i, _timeout) = le_u32(i)?;
+ let (i, _reserved2) = take(2_usize)(i)?;
+ let (i, param_cnt) = le_u16(i)?;
+ let (i, param_offset) = verify(le_u16, |&v| v <= (u16::MAX - param_cnt))(i)?;
+ let (i, data_cnt) = le_u16(i)?;
+ let (i, data_offset) = le_u16(i)?;
+ let (i, _setup_cnt) = le_u8(i)?;
+ let (i, _reserved3) = take(1_usize)(i)?;
+ let (i, subcmd) = le_u16(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ //TODO test and use param_offset
+ let (i, _padding) = take(3_usize)(i)?;
+ let (i, setup_blob) = take(param_cnt)(i)?;
+ let (i, _padding2) = cond(
+ data_offset > param_offset + param_cnt,
+ |b| take(data_offset - param_offset - param_cnt)(b)
+ )(i)?;
+ let (i, data_blob) = take(data_cnt)(i)?;
+
+ let record = SmbRequestTrans2Record {
+ subcmd,
+ setup_blob,
+ data_blob
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbResponseCreateAndXRecord<'a> {
+ pub fid: &'a[u8],
+ pub create_ts: SMBFiletime,
+ pub last_access_ts: SMBFiletime,
+ pub last_write_ts: SMBFiletime,
+ pub last_change_ts: SMBFiletime,
+ pub file_size: u64,
+}
+
+pub fn parse_smb_create_andx_response_record(i: &[u8]) -> IResult<&[u8], SmbResponseCreateAndXRecord> {
+ let (i, wct) = le_u8(i)?;
+ let (i, _andx_command) = le_u8(i)?;
+ let (i, _) = take(1_usize)(i)?; // reserved
+ let (i, _andx_offset) = le_u16(i)?;
+ let (i, _oplock_level) = le_u8(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let (i, _create_action) = le_u32(i)?;
+ let (i, create_ts) = le_u64(i)?;
+ let (i, last_access_ts) = le_u64(i)?;
+ let (i, last_write_ts) = le_u64(i)?;
+ let (i, last_change_ts) = le_u64(i)?;
+ let (i, _) = take(4_usize)(i)?;
+ let (i, file_size) = le_u64(i)?;
+ let (i, _eof) = le_u64(i)?;
+ let (i, _file_type) = le_u16(i)?;
+ let (i, _ipc_state) = le_u16(i)?;
+ let (i, _is_dir) = le_u8(i)?;
+ let (i, _) = cond(wct == 42, take(32_usize))(i)?;
+ let (i, _bcc) = le_u16(i)?;
+ let record = SmbResponseCreateAndXRecord {
+ fid,
+ create_ts: SMBFiletime::new(create_ts),
+ last_access_ts: SMBFiletime::new(last_access_ts),
+ last_write_ts: SMBFiletime::new(last_write_ts),
+ last_change_ts: SMBFiletime::new(last_change_ts),
+ file_size,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRequestCloseRecord<'a> {
+ pub fid: &'a[u8],
+}
+
+pub fn parse_smb1_close_request_record(i: &[u8]) -> IResult<&[u8], SmbRequestCloseRecord> {
+ let (i, _) = take(1_usize)(i)?;
+ let (i, fid) = take(2_usize)(i)?;
+ let record = SmbRequestCloseRecord {
+ fid,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbVersion<> {
+ pub version: u8,
+}
+
+pub fn parse_smb_version(i: &[u8]) -> IResult<&[u8], SmbVersion> {
+ let (i, version) = le_u8(i)?;
+ let (i, _) = tag(b"SMB")(i)?;
+ let version = SmbVersion { version };
+ Ok((i, version))
+}
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct SmbRecord<'a> {
+ pub command: u8,
+ pub is_dos_error: bool,
+ pub nt_status: u32,
+ pub flags: u8,
+ pub flags2: u16,
+
+ pub tree_id: u16,
+ pub user_id: u16,
+ pub multiplex_id: u16,
+
+ pub process_id: u32,
+ pub ssn_id: u32,
+
+ pub data: &'a[u8],
+}
+
+impl<'a> SmbRecord<'a> {
+ pub fn has_unicode_support(&self) -> bool {
+ self.flags2 & 0x8000_u16 != 0
+ }
+
+ /// Return true if record is a request.
+ pub fn is_request(&self) -> bool {
+ self.flags & SMB1_FLAGS_RESPONSE == 0
+ }
+
+ /// Return true if record is a reply.
+ pub fn is_response(&self) -> bool {
+ self.flags & SMB1_FLAGS_RESPONSE != 0
+ }
+}
+
+pub fn parse_smb_record(i: &[u8]) -> IResult<&[u8], SmbRecord> {
+ let (i, _) = tag(b"\xffSMB")(i)?;
+ let (i, command) = le_u8(i)?;
+ let (i, nt_status) = le_u32(i)?;
+ let (i, flags) = le_u8(i)?;
+ let (i, flags2) = le_u16(i)?;
+ let (i, process_id_high) = le_u16(i)?;
+ let (i, _signature) = take(8_usize)(i)?;
+ let (i, _reserved) = take(2_usize)(i)?;
+ let (i, tree_id) = le_u16(i)?;
+ let (i, process_id) = le_u16(i)?;
+ let (i, user_id) = le_u16(i)?;
+ let (i, multiplex_id) = le_u16(i)?;
+ let (i, data) = rest(i)?;
+
+ let record = SmbRecord {
+ command,
+ nt_status,
+ flags,
+ flags2,
+ is_dos_error: (flags2 & 0x4000_u16 == 0),// && nt_status != 0),
+ tree_id,
+ user_id,
+ multiplex_id,
+
+ process_id: (process_id_high as u32) << 16 | process_id as u32,
+ //ssn_id: (((process_id as u32)<< 16)|(user_id as u32)),
+ ssn_id: user_id as u32,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[test]
+fn test_parse_smb1_write_andx_request_record_origin() {
+ let data = hex::decode("0eff000000014000000000ff00000008001400000014003f000000000014004142434445464748494a4b4c4d4e4f5051520a0a").unwrap();
+ let result = parse_smb1_write_andx_request_record(&data, SMB1_HEADER_SIZE);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert_eq!(record.offset, 0);
+ assert_eq!(record.len, 20);
+ assert_eq!(record.fid, &[0x01, 0x40]);
+ assert_eq!(record.data.len(), 20);
+ assert_eq!(record.data, b"ABCDEFGHIJKLMNOPQR\n\n");
+}
diff --git a/rust/src/smb/smb1_session.rs b/rust/src/smb/smb1_session.rs
new file mode 100644
index 0000000..c39c7ce
--- /dev/null
+++ b/rust/src/smb/smb1_session.rs
@@ -0,0 +1,202 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::smb::smb_records::*;
+use crate::smb::smb1_records::*;
+use crate::smb::smb::*;
+use crate::smb::events::*;
+use crate::smb::auth::*;
+
+#[derive(Debug)]
+pub struct SessionSetupRequest {
+ pub native_os: Vec<u8>,
+ pub native_lm: Vec<u8>,
+ pub primary_domain: Vec<u8>,
+}
+
+#[derive(Debug)]
+pub struct SessionSetupResponse {
+ pub native_os: Vec<u8>,
+ pub native_lm: Vec<u8>,
+}
+
+pub fn smb1_session_setup_request_host_info(r: &SmbRecord, blob: &[u8]) -> SessionSetupRequest
+{
+ if blob.len() > 1 && r.has_unicode_support() {
+ let offset = r.data.len() - blob.len();
+ let blob = if offset % 2 == 1 { &blob[1..] } else { blob };
+ let (native_os, native_lm, primary_domain) = match smb_get_unicode_string(blob) {
+ Ok((rem, n1)) => {
+ match smb_get_unicode_string(rem) {
+ Ok((rem, n2)) => {
+ match smb_get_unicode_string(rem) {
+ Ok((_, n3)) => { (n1, n2, n3) },
+ _ => { (n1, n2, Vec::new()) },
+ }
+ },
+ _ => { (n1, Vec::new(), Vec::new()) },
+ }
+ },
+ _ => { (Vec::new(), Vec::new(), Vec::new()) },
+ };
+
+ SCLogDebug!("name1 {:?} name2 {:?} name3 {:?}", native_os,native_lm,primary_domain);
+ SessionSetupRequest {
+ native_os,
+ native_lm,
+ primary_domain,
+ }
+ } else {
+ let (native_os, native_lm, primary_domain) = match smb_get_ascii_string(blob) {
+ Ok((rem, n1)) => {
+ match smb_get_ascii_string(rem) {
+ Ok((rem, n2)) => {
+ match smb_get_ascii_string(rem) {
+ Ok((_, n3)) => { (n1, n2, n3) },
+ _ => { (n1, n2, Vec::new()) },
+ }
+ },
+ _ => { (n1, Vec::new(), Vec::new()) },
+ }
+ },
+ _ => { (Vec::new(), Vec::new(), Vec::new()) },
+ };
+
+ SCLogDebug!("session_setup_request_host_info: not unicode");
+ SessionSetupRequest {
+ native_os,
+ native_lm,
+ primary_domain,
+ }
+ }
+}
+
+pub fn smb1_session_setup_response_host_info(r: &SmbRecord, blob: &[u8]) -> SessionSetupResponse
+{
+ if blob.len() > 1 && r.has_unicode_support() {
+ let offset = r.data.len() - blob.len();
+ let blob = if offset % 2 == 1 { &blob[1..] } else { blob };
+ let (native_os, native_lm) = match smb_get_unicode_string(blob) {
+ Ok((rem, n1)) => {
+ match smb_get_unicode_string(rem) {
+ Ok((_, n2)) => (n1, n2),
+ _ => { (n1, Vec::new()) },
+ }
+ },
+ _ => { (Vec::new(), Vec::new()) },
+ };
+
+ SCLogDebug!("name1 {:?} name2 {:?}", native_os,native_lm);
+ SessionSetupResponse {
+ native_os,
+ native_lm,
+ }
+ } else {
+ SCLogDebug!("session_setup_response_host_info: not unicode");
+ let (native_os, native_lm) = match smb_get_ascii_string(blob) {
+ Ok((rem, n1)) => {
+ match smb_get_ascii_string(rem) {
+ Ok((_, n2)) => (n1, n2),
+ _ => { (n1, Vec::new()) },
+ }
+ },
+ _ => { (Vec::new(), Vec::new()) },
+ };
+ SessionSetupResponse {
+ native_os,
+ native_lm,
+ }
+ }
+}
+
+pub fn smb1_session_setup_request(state: &mut SMBState, r: &SmbRecord, andx_offset: usize)
+{
+ SCLogDebug!("SMB1_COMMAND_SESSION_SETUP_ANDX user_id {}", r.user_id);
+ #[allow(clippy::single_match)]
+ match parse_smb_setup_andx_record(&r.data[andx_offset-SMB1_HEADER_SIZE..]) {
+ Ok((rem, setup)) => {
+ let hdr = SMBCommonHdr::new(SMBHDR_TYPE_HEADER,
+ r.ssn_id as u64, 0, r.multiplex_id as u64);
+ let tx = state.new_sessionsetup_tx(hdr);
+ tx.vercmd.set_smb1_cmd(r.command);
+
+ if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
+ td.request_host = Some(smb1_session_setup_request_host_info(r, rem));
+ if let Some(s) = parse_secblob(setup.sec_blob) {
+ td.ntlmssp = s.ntlmssp;
+ td.krb_ticket = s.krb;
+ if let Some(ntlm) = &td.ntlmssp {
+ if ntlm.warning {
+ tx.set_event(SMBEvent::UnusualNtlmsspOrder);
+ }
+ }
+ }
+ }
+ },
+ _ => {
+ // events.push(SMBEvent::MalformedData);
+ },
+ }
+}
+
+fn smb1_session_setup_update_tx(tx: &mut SMBTransaction, r: &SmbRecord, andx_offset: usize)
+{
+ match parse_smb_response_setup_andx_record(&r.data[andx_offset-SMB1_HEADER_SIZE..]) {
+ Ok((rem, _setup)) => {
+ if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
+ td.response_host = Some(smb1_session_setup_response_host_info(r, rem));
+ }
+ },
+ _ => {
+ tx.set_event(SMBEvent::MalformedData);
+ },
+ }
+ // update tx even if we can't parse the response
+ tx.hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER); // to overwrite ssn_id 0
+ tx.set_status(r.nt_status, r.is_dos_error);
+ tx.response_done = true;
+}
+
+pub fn smb1_session_setup_response(state: &mut SMBState, r: &SmbRecord, andx_offset: usize)
+{
+ // try exact match with session id already set (e.g. NTLMSSP AUTH phase)
+ let found = r.ssn_id != 0 && match state.get_sessionsetup_tx(
+ SMBCommonHdr::new(SMBHDR_TYPE_HEADER,
+ r.ssn_id as u64, 0, r.multiplex_id as u64))
+ {
+ Some(tx) => {
+ smb1_session_setup_update_tx(tx, r, andx_offset);
+ SCLogDebug!("smb1_session_setup_response: tx {:?}", tx);
+ true
+ },
+ None => { false },
+ };
+ // otherwise try match with ssn id 0 (e.g. NTLMSSP_NEGOTIATE)
+ if !found {
+ match state.get_sessionsetup_tx(
+ SMBCommonHdr::new(SMBHDR_TYPE_HEADER, 0, 0, r.multiplex_id as u64))
+ {
+ Some(tx) => {
+ smb1_session_setup_update_tx(tx, r, andx_offset);
+ SCLogDebug!("smb1_session_setup_response: tx {:?}", tx);
+ },
+ None => {
+ SCLogDebug!("smb1_session_setup_response: tx not found for {:?}", r);
+ },
+ }
+ }
+}
diff --git a/rust/src/smb/smb2.rs b/rust/src/smb/smb2.rs
new file mode 100644
index 0000000..a2fe021
--- /dev/null
+++ b/rust/src/smb/smb2.rs
@@ -0,0 +1,913 @@
+/* Copyright (C) 2017-2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use nom7::Err;
+
+use crate::core::*;
+
+use crate::smb::smb::*;
+use crate::smb::smb2_records::*;
+use crate::smb::smb2_session::*;
+use crate::smb::smb2_ioctl::*;
+use crate::smb::dcerpc::*;
+use crate::smb::events::*;
+use crate::smb::files::*;
+use crate::smb::smb_status::*;
+
+pub const SMB2_COMMAND_NEGOTIATE_PROTOCOL: u16 = 0;
+pub const SMB2_COMMAND_SESSION_SETUP: u16 = 1;
+pub const SMB2_COMMAND_SESSION_LOGOFF: u16 = 2;
+pub const SMB2_COMMAND_TREE_CONNECT: u16 = 3;
+pub const SMB2_COMMAND_TREE_DISCONNECT: u16 = 4;
+pub const SMB2_COMMAND_CREATE: u16 = 5;
+pub const SMB2_COMMAND_CLOSE: u16 = 6;
+pub const SMB2_COMMAND_FLUSH: u16 = 7;
+pub const SMB2_COMMAND_READ: u16 = 8;
+pub const SMB2_COMMAND_WRITE: u16 = 9;
+pub const SMB2_COMMAND_LOCK: u16 = 10;
+pub const SMB2_COMMAND_IOCTL: u16 = 11;
+pub const SMB2_COMMAND_CANCEL: u16 = 12;
+pub const SMB2_COMMAND_KEEPALIVE: u16 = 13;
+pub const SMB2_COMMAND_FIND: u16 = 14;
+pub const SMB2_COMMAND_CHANGE_NOTIFY: u16 = 15;
+pub const SMB2_COMMAND_GET_INFO: u16 = 16;
+pub const SMB2_COMMAND_SET_INFO: u16 = 17;
+pub const SMB2_COMMAND_OPLOCK_BREAK: u16 = 18;
+
+pub fn smb2_command_string(c: u16) -> String {
+ match c {
+ SMB2_COMMAND_NEGOTIATE_PROTOCOL => "SMB2_COMMAND_NEGOTIATE_PROTOCOL",
+ SMB2_COMMAND_SESSION_SETUP => "SMB2_COMMAND_SESSION_SETUP",
+ SMB2_COMMAND_SESSION_LOGOFF => "SMB2_COMMAND_SESSION_LOGOFF",
+ SMB2_COMMAND_TREE_CONNECT => "SMB2_COMMAND_TREE_CONNECT",
+ SMB2_COMMAND_TREE_DISCONNECT => "SMB2_COMMAND_TREE_DISCONNECT",
+ SMB2_COMMAND_CREATE => "SMB2_COMMAND_CREATE",
+ SMB2_COMMAND_CLOSE => "SMB2_COMMAND_CLOSE",
+ SMB2_COMMAND_READ => "SMB2_COMMAND_READ",
+ SMB2_COMMAND_FLUSH => "SMB2_COMMAND_FLUSH",
+ SMB2_COMMAND_WRITE => "SMB2_COMMAND_WRITE",
+ SMB2_COMMAND_LOCK => "SMB2_COMMAND_LOCK",
+ SMB2_COMMAND_IOCTL => "SMB2_COMMAND_IOCTL",
+ SMB2_COMMAND_CANCEL => "SMB2_COMMAND_CANCEL",
+ SMB2_COMMAND_KEEPALIVE => "SMB2_COMMAND_KEEPALIVE",
+ SMB2_COMMAND_FIND => "SMB2_COMMAND_FIND",
+ SMB2_COMMAND_CHANGE_NOTIFY => "SMB2_COMMAND_CHANGE_NOTIFY",
+ SMB2_COMMAND_GET_INFO => "SMB2_COMMAND_GET_INFO",
+ SMB2_COMMAND_SET_INFO => "SMB2_COMMAND_SET_INFO",
+ SMB2_COMMAND_OPLOCK_BREAK => "SMB2_COMMAND_OPLOCK_BREAK",
+ _ => { return (c).to_string(); },
+ }.to_string()
+
+}
+
+pub fn smb2_dialect_string(d: u16) -> String {
+ match d {
+ 0x0202 => "2.02",
+ 0x0210 => "2.10",
+ 0x0222 => "2.22",
+ 0x0224 => "2.24",
+ 0x02ff => "2.??",
+ 0x0300 => "3.00",
+ 0x0302 => "3.02",
+ 0x0310 => "3.10",
+ 0x0311 => "3.11",
+ _ => { return (d).to_string(); },
+ }.to_string()
+}
+
+// later we'll use this to determine if we need to
+// track a ssn per type
+fn smb2_create_new_tx(cmd: u16) -> bool {
+ match cmd {
+ SMB2_COMMAND_READ |
+ SMB2_COMMAND_WRITE |
+ SMB2_COMMAND_GET_INFO |
+ SMB2_COMMAND_SET_INFO => { false },
+ _ => { true },
+ }
+}
+
+fn smb2_read_response_record_generic(state: &mut SMBState, r: &Smb2Record)
+{
+ if smb2_create_new_tx(r.command) {
+ let tx_hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.get_generic_tx(2, r.command, &tx_hdr);
+ if let Some(tx) = tx {
+ tx.set_status(r.nt_status, false);
+ tx.response_done = true;
+ }
+ }
+}
+
+pub fn smb2_read_response_record(state: &mut SMBState, r: &Smb2Record, nbss_remaining: u32)
+{
+ let max_queue_size = unsafe { SMB_CFG_MAX_READ_QUEUE_SIZE };
+ let max_queue_cnt = unsafe { SMB_CFG_MAX_READ_QUEUE_CNT };
+
+ smb2_read_response_record_generic(state, r);
+
+ match parse_smb2_response_read(r.data) {
+ Ok((_, rd)) => {
+ if rd.len - rd.data.len() as u32 > nbss_remaining {
+ // Record claims more bytes than are in NBSS record...
+ state.set_event(SMBEvent::ReadResponseTooLarge);
+ // Skip the remaining bytes of the record.
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ return;
+ }
+ if r.nt_status == SMB_NTSTATUS_BUFFER_OVERFLOW {
+ SCLogDebug!("SMBv2/READ: incomplete record, expecting a follow up");
+ // fall through
+
+ } else if r.nt_status != SMB_NTSTATUS_SUCCESS {
+ SCLogDebug!("SMBv2: read response error code received: skip record");
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ return;
+ }
+
+ if (state.max_read_size != 0 && rd.len > state.max_read_size) ||
+ (unsafe { SMB_CFG_MAX_READ_SIZE != 0 && SMB_CFG_MAX_READ_SIZE < rd.len })
+ {
+ state.set_event(SMBEvent::ReadResponseTooLarge);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ return;
+ }
+
+ SCLogDebug!("SMBv2: read response => {:?}", rd);
+
+ // get the request info. If we don't have it, there is nothing
+ // we can do except skip this record.
+ let guid_key = SMBCommonHdr::from2_notree(r, SMBHDR_TYPE_OFFSET);
+ let (offset, file_guid) = match state.ssn2vecoffset_map.remove(&guid_key) {
+ Some(o) => (o.offset, o.guid),
+ None => {
+ SCLogDebug!("SMBv2 READ response: reply to unknown request {:?}",rd);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ return;
+ },
+ };
+ SCLogDebug!("SMBv2 READ: GUID {:?} offset {}", file_guid, offset);
+
+ let mut set_event_fileoverlap = false;
+ // look up existing tracker and if we have it update it
+ let found = match state.get_file_tx_by_fuid_with_open_file(&file_guid, Direction::ToClient) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let file_id : u32 = tx.id as u32;
+ if offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ if max_queue_size != 0 && tdf.file_tracker.get_inflight_size() + rd.len as u64 > max_queue_size.into() {
+ state.set_event(SMBEvent::ReadQueueSizeExceeded);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ } else if max_queue_cnt != 0 && tdf.file_tracker.get_inflight_cnt() >= max_queue_cnt as usize {
+ state.set_event(SMBEvent::ReadQueueCntExceeded);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ } else {
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &tdf.file_name, rd.data, offset,
+ rd.len, false, &file_id);
+ }
+ }
+ true
+ },
+ None => { false },
+ };
+ SCLogDebug!("existing file tx? {}", found);
+ if !found {
+ let tree_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_SHARE);
+ let (share_name, mut is_pipe) = match state.ssn2tree_map.get(&tree_key) {
+ Some(n) => (n.name.to_vec(), n.is_pipe),
+ _ => { (Vec::new(), false) },
+ };
+ let mut is_dcerpc = if is_pipe || share_name.is_empty() {
+ state.get_service_for_guid(&file_guid).1
+ } else {
+ false
+ };
+ SCLogDebug!("SMBv2/READ: share_name {:?} is_pipe {} is_dcerpc {}",
+ share_name, is_pipe, is_dcerpc);
+
+ if share_name.is_empty() && !is_pipe {
+ SCLogDebug!("SMBv2/READ: no tree connect seen, we don't know if we are a pipe");
+
+ if smb_dcerpc_probe(rd.data) {
+ SCLogDebug!("SMBv2/READ: looks like dcerpc");
+ // insert fake tree to assist in follow up lookups
+ let tree = SMBTree::new(b"suricata::dcerpc".to_vec(), true);
+ state.ssn2tree_map.insert(tree_key, tree);
+ if !is_dcerpc {
+ state.guid2name_map.insert(file_guid.to_vec(), b"suricata::dcerpc".to_vec());
+ }
+ is_pipe = true;
+ is_dcerpc = true;
+ } else {
+ SCLogDebug!("SMBv2/READ: not DCERPC");
+ }
+ }
+
+ if is_pipe && is_dcerpc {
+ SCLogDebug!("SMBv2 DCERPC read");
+ let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
+ let vercmd = SMBVerCmdStat::new2_with_ntstatus(SMB2_COMMAND_READ, r.nt_status);
+ smb_read_dcerpc_record(state, vercmd, hdr, &file_guid, rd.data);
+ } else if is_pipe {
+ SCLogDebug!("non-DCERPC pipe");
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ } else {
+ let file_name = match state.guid2name_map.get(&file_guid) {
+ Some(n) => { n.to_vec() }
+ None => { b"<unknown>".to_vec() }
+ };
+
+ let tx = state.new_file_tx(&file_guid, &file_name, Direction::ToClient);
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_READ);
+ tx.hdr = SMBCommonHdr::new(SMBHDR_TYPE_HEADER,
+ r.session_id, r.tree_id, 0); // TODO move into new_file_tx
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ tdf.share_name = share_name;
+ let file_id : u32 = tx.id as u32;
+ if offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ if max_queue_size != 0 && tdf.file_tracker.get_inflight_size() + rd.len as u64 > max_queue_size.into() {
+ state.set_event(SMBEvent::ReadQueueSizeExceeded);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ } else if max_queue_cnt != 0 && tdf.file_tracker.get_inflight_cnt() >= max_queue_cnt as usize {
+ state.set_event(SMBEvent::ReadQueueCntExceeded);
+ state.set_skip(Direction::ToClient, nbss_remaining);
+ } else {
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, rd.data, offset,
+ rd.len, false, &file_id);
+ }
+ }
+ }
+ }
+
+ if set_event_fileoverlap {
+ state.set_event(SMBEvent::FileOverlap);
+ }
+ state.set_file_left(Direction::ToClient, rd.len, rd.data.len() as u32, file_guid.to_vec());
+ }
+ _ => {
+ SCLogDebug!("SMBv2: failed to parse read response");
+ state.set_event(SMBEvent::MalformedData);
+ }
+ }
+}
+
+pub fn smb2_write_request_record(state: &mut SMBState, r: &Smb2Record, nbss_remaining: u32)
+{
+ let max_queue_size = unsafe { SMB_CFG_MAX_WRITE_QUEUE_SIZE };
+ let max_queue_cnt = unsafe { SMB_CFG_MAX_WRITE_QUEUE_CNT };
+
+ SCLogDebug!("SMBv2/WRITE: request record");
+ if smb2_create_new_tx(r.command) {
+ let tx_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.new_generic_tx(2, r.command, tx_key);
+ tx.request_done = true;
+ }
+ match parse_smb2_request_write(r.data) {
+ Ok((_, wr)) => {
+ if wr.wr_len - wr.data.len() as u32 > nbss_remaining {
+ // Record claims more bytes than are in NBSS record...
+ state.set_event(SMBEvent::WriteRequestTooLarge);
+ // Skip the remaining bytes of the record.
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ return;
+ }
+ if (state.max_write_size != 0 && wr.wr_len > state.max_write_size) ||
+ (unsafe { SMB_CFG_MAX_WRITE_SIZE != 0 && SMB_CFG_MAX_WRITE_SIZE < wr.wr_len }) {
+ state.set_event(SMBEvent::WriteRequestTooLarge);
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ return;
+ }
+
+ /* update key-guid map */
+ let guid_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_GUID);
+ state.ssn2vec_map.insert(guid_key, wr.guid.to_vec());
+
+ let file_guid = wr.guid.to_vec();
+ let file_name = match state.guid2name_map.get(&file_guid) {
+ Some(n) => n.to_vec(),
+ None => Vec::new(),
+ };
+
+ let mut set_event_fileoverlap = false;
+ let found = match state.get_file_tx_by_fuid_with_open_file(&file_guid, Direction::ToServer) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let file_id : u32 = tx.id as u32;
+ if wr.wr_offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+ if max_queue_size != 0 && tdf.file_tracker.get_inflight_size() + wr.wr_len as u64 > max_queue_size.into() {
+ state.set_event(SMBEvent::WriteQueueSizeExceeded);
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ } else if max_queue_cnt != 0 && tdf.file_tracker.get_inflight_cnt() >= max_queue_cnt as usize {
+ state.set_event(SMBEvent::WriteQueueCntExceeded);
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ } else {
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, wr.data, wr.wr_offset,
+ wr.wr_len, false, &file_id);
+ }
+ }
+ true
+ },
+ None => { false },
+ };
+ if !found {
+ let tree_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_SHARE);
+ let (share_name, mut is_pipe) = match state.ssn2tree_map.get(&tree_key) {
+ Some(n) => { (n.name.to_vec(), n.is_pipe) },
+ _ => { (Vec::new(), false) },
+ };
+ let mut is_dcerpc = if is_pipe || share_name.is_empty() {
+ state.get_service_for_guid(wr.guid).1
+ } else {
+ false
+ };
+ SCLogDebug!("SMBv2/WRITE: share_name {:?} is_pipe {} is_dcerpc {}",
+ share_name, is_pipe, is_dcerpc);
+
+ // if we missed the TREE connect we can't be sure if 'is_dcerpc' is correct
+ if share_name.is_empty() && !is_pipe {
+ SCLogDebug!("SMBv2/WRITE: no tree connect seen, we don't know if we are a pipe");
+
+ if smb_dcerpc_probe(wr.data) {
+ SCLogDebug!("SMBv2/WRITE: looks like we have dcerpc");
+
+ let tree = SMBTree::new(b"suricata::dcerpc".to_vec(), true);
+ state.ssn2tree_map.insert(tree_key, tree);
+ if !is_dcerpc {
+ state.guid2name_map.insert(file_guid.to_vec(),
+ b"suricata::dcerpc".to_vec());
+ }
+ is_pipe = true;
+ is_dcerpc = true;
+ } else {
+ SCLogDebug!("SMBv2/WRITE: not DCERPC");
+ }
+ }
+ if is_pipe && is_dcerpc {
+ SCLogDebug!("SMBv2 DCERPC write");
+ let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
+ let vercmd = SMBVerCmdStat::new2(SMB2_COMMAND_WRITE);
+ smb_write_dcerpc_record(state, vercmd, hdr, wr.data);
+ } else if is_pipe {
+ SCLogDebug!("non-DCERPC pipe: skip rest of the record");
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ } else {
+ let tx = state.new_file_tx(&file_guid, &file_name, Direction::ToServer);
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_WRITE);
+ tx.hdr = SMBCommonHdr::new(SMBHDR_TYPE_HEADER,
+ r.session_id, r.tree_id, 0); // TODO move into new_file_tx
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ let file_id : u32 = tx.id as u32;
+ if wr.wr_offset < tdf.file_tracker.tracked {
+ set_event_fileoverlap = true;
+ }
+
+ if max_queue_size != 0 && tdf.file_tracker.get_inflight_size() + wr.wr_len as u64 > max_queue_size.into() {
+ state.set_event(SMBEvent::WriteQueueSizeExceeded);
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ } else if max_queue_cnt != 0 && tdf.file_tracker.get_inflight_cnt() >= max_queue_cnt as usize {
+ state.set_event(SMBEvent::WriteQueueCntExceeded);
+ state.set_skip(Direction::ToServer, nbss_remaining);
+ } else {
+ filetracker_newchunk(&mut tdf.file_tracker,
+ &file_name, wr.data, wr.wr_offset,
+ wr.wr_len, false, &file_id);
+ }
+ }
+ }
+ }
+
+ if set_event_fileoverlap {
+ state.set_event(SMBEvent::FileOverlap);
+ }
+ state.set_file_left(Direction::ToServer, wr.wr_len, wr.data.len() as u32, file_guid.to_vec());
+ },
+ _ => {
+ state.set_event(SMBEvent::MalformedData);
+ },
+ }
+}
+
+pub fn smb2_request_record(state: &mut SMBState, r: &Smb2Record)
+{
+ SCLogDebug!("SMBv2 request record, command {} tree {} session {}",
+ &smb2_command_string(r.command), r.tree_id, r.session_id);
+
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ let have_tx = match r.command {
+ SMB2_COMMAND_SET_INFO => {
+ SCLogDebug!("SMB2_COMMAND_SET_INFO: {:?}", r);
+ let have_si_tx = match parse_smb2_request_setinfo(r.data) {
+ Ok((_, rd)) => {
+ SCLogDebug!("SMB2_COMMAND_SET_INFO: {:?}", rd);
+
+ match rd.data {
+ Smb2SetInfoRequestData::RENAME(ref ren) => {
+ let tx_hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ let mut newname = ren.name.to_vec();
+ newname.retain(|&i|i != 0x00);
+ let oldname = match state.guid2name_map.get(rd.guid) {
+ Some(n) => { n.to_vec() },
+ None => { b"<unknown>".to_vec() },
+ };
+ let tx = state.new_rename_tx(rd.guid.to_vec(), oldname, newname);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_SET_INFO);
+ true
+ }
+ Smb2SetInfoRequestData::DISPOSITION(ref dis) => {
+ let tx_hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ let fname = match state.guid2name_map.get(rd.guid) {
+ Some(n) => { n.to_vec() },
+ None => {
+ // try to find latest created file in case of chained commands
+ let mut guid_key = SMBCommonHdr::from2_notree(r, SMBHDR_TYPE_FILENAME);
+ if guid_key.msg_id == 0 {
+ b"<unknown>".to_vec()
+ } else {
+ guid_key.msg_id -= 1;
+ match state.ssn2vec_map.get(&guid_key) {
+ Some(n) => { n.to_vec() },
+ None => { b"<unknown>".to_vec()},
+ }
+ }
+ },
+ };
+ let tx = state.new_setfileinfo_tx(fname, rd.guid.to_vec(), rd.class as u16, rd.infolvl as u16, dis.delete);
+ tx.hdr = tx_hdr;
+ tx.request_done = true;
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_SET_INFO);
+ true
+ }
+ _ => false,
+ }
+ },
+ Err(Err::Incomplete(_n)) => {
+ SCLogDebug!("SMB2_COMMAND_SET_INFO: {:?}", _n);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ Err(Err::Error(_e)) |
+ Err(Err::Failure(_e)) => {
+ SCLogDebug!("SMB2_COMMAND_SET_INFO: {:?}", _e);
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ };
+ have_si_tx
+ },
+ SMB2_COMMAND_IOCTL => {
+ smb2_ioctl_request_record(state, r);
+ true
+ },
+ SMB2_COMMAND_TREE_DISCONNECT => {
+ let tree_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_SHARE);
+ state.ssn2tree_map.remove(&tree_key);
+ false
+ }
+ SMB2_COMMAND_NEGOTIATE_PROTOCOL => {
+ match parse_smb2_request_negotiate_protocol(r.data) {
+ Ok((_, rd)) => {
+ let mut dialects : Vec<Vec<u8>> = Vec::new();
+ for d in rd.dialects_vec {
+ SCLogDebug!("dialect {:x} => {}", d, &smb2_dialect_string(d));
+ let dvec = smb2_dialect_string(d).as_bytes().to_vec();
+ dialects.push(dvec);
+ }
+
+ let found = match state.get_negotiate_tx(2) {
+ Some(_) => {
+ SCLogDebug!("WEIRD, should not have NEGOTIATE tx!");
+ true
+ },
+ None => { false },
+ };
+ if !found {
+ let tx = state.new_negotiate_tx(2);
+ if let Some(SMBTransactionTypeData::NEGOTIATE(ref mut tdn)) = tx.type_data {
+ tdn.dialects2 = dialects;
+ tdn.client_guid = Some(rd.client_guid.to_vec());
+ }
+ tx.request_done = true;
+ }
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB2_COMMAND_SESSION_SETUP => {
+ smb2_session_setup_request(state, r);
+ true
+ },
+ SMB2_COMMAND_TREE_CONNECT => {
+ match parse_smb2_request_tree_connect(r.data) {
+ Ok((_, tr)) => {
+ let name_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_TREE);
+ let mut name_val = tr.share_name.to_vec();
+ name_val.retain(|&i|i != 0x00);
+ if name_val.len() > 1 {
+ name_val = name_val[1..].to_vec();
+ }
+
+ let tx = state.new_treeconnect_tx(name_key, name_val);
+ tx.request_done = true;
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_TREE_CONNECT);
+ true
+ }
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB2_COMMAND_READ => {
+ match parse_smb2_request_read(r.data) {
+ Ok((_, rd)) => {
+ if (state.max_read_size != 0 && rd.rd_len > state.max_read_size) ||
+ (unsafe { SMB_CFG_MAX_READ_SIZE != 0 && SMB_CFG_MAX_READ_SIZE < rd.rd_len }) {
+ events.push(SMBEvent::ReadRequestTooLarge);
+ } else {
+ SCLogDebug!("SMBv2 READ: GUID {:?} requesting {} bytes at offset {}",
+ rd.guid, rd.rd_len, rd.rd_offset);
+
+ // store read guid,offset in map
+ let guid_key = SMBCommonHdr::from2_notree(r, SMBHDR_TYPE_OFFSET);
+ let guidoff = SMBFileGUIDOffset::new(rd.guid.to_vec(), rd.rd_offset);
+ state.ssn2vecoffset_map.insert(guid_key, guidoff);
+ }
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ false
+ },
+ SMB2_COMMAND_CREATE => {
+ match parse_smb2_request_create(r.data) {
+ Ok((_, cr)) => {
+ let del = cr.create_options & 0x0000_1000 != 0;
+ let dir = cr.create_options & 0x0000_0001 != 0;
+
+ SCLogDebug!("create_options {:08x}", cr.create_options);
+
+ let name_key = SMBCommonHdr::from2_notree(r, SMBHDR_TYPE_FILENAME);
+ state.ssn2vec_map.insert(name_key, cr.data.to_vec());
+
+ let tx_hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.new_create_tx(cr.data,
+ cr.disposition, del, dir, tx_hdr);
+ tx.vercmd.set_smb2_cmd(r.command);
+ SCLogDebug!("TS CREATE TX {} created", tx.id);
+ true
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ },
+ SMB2_COMMAND_WRITE => {
+ smb2_write_request_record(state, r, 0);
+ true // write handling creates both file tx and generic tx
+ },
+ SMB2_COMMAND_CLOSE => {
+ match parse_smb2_request_close(r.data) {
+ Ok((_, cd)) => {
+ let found_ts = match state.get_file_tx_by_fuid(cd.guid, Direction::ToServer) {
+ Some(tx) => {
+ if !tx.request_done {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ filetracker_close(&mut tdf.file_tracker);
+ }
+ }
+ tx.request_done = true;
+ tx.response_done = true;
+ tx.set_status(SMB_NTSTATUS_SUCCESS, false);
+ true
+ },
+ None => { false },
+ };
+ let found_tc = match state.get_file_tx_by_fuid(cd.guid, Direction::ToClient) {
+ Some(tx) => {
+ if !tx.request_done {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ filetracker_close(&mut tdf.file_tracker);
+ }
+ }
+ tx.request_done = true;
+ tx.response_done = true;
+ tx.set_status(SMB_NTSTATUS_SUCCESS, false);
+ true
+ },
+ None => { false },
+ };
+ if !found_ts && !found_tc {
+ SCLogDebug!("SMBv2: CLOSE(TS): no TX at GUID {:?}", cd.guid);
+ }
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ false
+ },
+ _ => {
+ false
+ },
+ };
+ /* if we don't have a tx, create it here (maybe) */
+ if !have_tx && smb2_create_new_tx(r.command) {
+ let tx_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ let tx = state.new_generic_tx(2, r.command, tx_key);
+ SCLogDebug!("TS TX {} command {} created with session_id {} tree_id {} message_id {}",
+ tx.id, r.command, r.session_id, r.tree_id, r.message_id);
+ tx.set_events(events);
+ }
+}
+
+pub fn smb2_response_record(state: &mut SMBState, r: &Smb2Record)
+{
+ SCLogDebug!("SMBv2 response record, command {} status {} tree {} session {} message {}",
+ &smb2_command_string(r.command), r.nt_status,
+ r.tree_id, r.session_id, r.message_id);
+
+ let mut events : Vec<SMBEvent> = Vec::new();
+
+ let have_tx = match r.command {
+ SMB2_COMMAND_IOCTL => {
+ smb2_ioctl_response_record(state, r);
+ true
+ },
+ SMB2_COMMAND_SESSION_SETUP => {
+ smb2_session_setup_response(state, r);
+ true
+ },
+ SMB2_COMMAND_WRITE => {
+ if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ match parse_smb2_response_write(r.data)
+ {
+ Ok((_, _wr)) => {
+ SCLogDebug!("SMBv2: Write response => {:?}", _wr);
+
+ /* search key-guid map */
+ let guid_key = SMBCommonHdr::new(SMBHDR_TYPE_GUID,
+ r.session_id, r.tree_id, r.message_id);
+ let _guid_vec = match state.ssn2vec_map.remove(&guid_key) {
+ Some(p) => p,
+ None => {
+ SCLogDebug!("SMBv2 response: GUID NOT FOUND");
+ Vec::new()
+ },
+ };
+ SCLogDebug!("SMBv2 write response for GUID {:?}", _guid_vec);
+ }
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ }
+ false // the request may have created a generic tx, so handle that here
+ },
+ SMB2_COMMAND_READ => {
+ if r.nt_status == SMB_NTSTATUS_SUCCESS ||
+ r.nt_status == SMB_NTSTATUS_BUFFER_OVERFLOW {
+ smb2_read_response_record(state, r, 0);
+ false
+
+ } else if r.nt_status == SMB_NTSTATUS_END_OF_FILE {
+ SCLogDebug!("SMBv2: read response => EOF");
+
+ let guid_key = SMBCommonHdr::from2_notree(r, SMBHDR_TYPE_OFFSET);
+ let file_guid = match state.ssn2vecoffset_map.remove(&guid_key) {
+ Some(o) => o.guid,
+ _ => {
+ SCLogDebug!("SMBv2 READ response: reply to unknown request");
+ Vec::new()
+ },
+ };
+ let found = match state.get_file_tx_by_fuid(&file_guid, Direction::ToClient) {
+ Some(tx) => {
+ if !tx.request_done {
+ if let Some(SMBTransactionTypeData::FILE(ref mut tdf)) = tx.type_data {
+ filetracker_close(&mut tdf.file_tracker);
+ }
+ }
+ tx.set_status(r.nt_status, false);
+ tx.request_done = true;
+ false
+ },
+ None => { false },
+ };
+ if !found {
+ SCLogDebug!("SMBv2 READ: no TX at GUID {:?}", file_guid);
+ }
+ false
+ } else {
+ SCLogDebug!("SMBv2 READ: status {}", r.nt_status);
+ false
+ }
+ },
+ SMB2_COMMAND_CREATE => {
+ if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ match parse_smb2_response_create(r.data) {
+ Ok((_, cr)) => {
+ SCLogDebug!("SMBv2: Create response => {:?}", cr);
+
+ let guid_key = SMBCommonHdr::from2_notree(r, SMBHDR_TYPE_FILENAME);
+ if let Some(mut p) = state.ssn2vec_map.remove(&guid_key) {
+ p.retain(|&i|i != 0x00);
+ state.guid2name_map.insert(cr.guid.to_vec(), p);
+ } else {
+ SCLogDebug!("SMBv2 response: GUID NOT FOUND");
+ }
+
+ let tx_hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ if let Some(tx) = state.get_generic_tx(2, r.command, &tx_hdr) {
+ SCLogDebug!("tx {} with {}/{} marked as done",
+ tx.id, r.command, &smb2_command_string(r.command));
+ tx.set_status(r.nt_status, false);
+ tx.response_done = true;
+
+ if let Some(SMBTransactionTypeData::CREATE(ref mut tdn)) = tx.type_data {
+ tdn.create_ts = cr.create_ts.as_unix();
+ tdn.last_access_ts = cr.last_access_ts.as_unix();
+ tdn.last_write_ts = cr.last_write_ts.as_unix();
+ tdn.last_change_ts = cr.last_change_ts.as_unix();
+ tdn.size = cr.size;
+ tdn.guid = cr.guid.to_vec();
+ }
+ }
+ }
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ },
+ }
+ true
+ } else {
+ false
+ }
+ },
+ SMB2_COMMAND_TREE_DISCONNECT => {
+ // normally removed when processing request,
+ // but in case we missed that try again here
+ let tree_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_SHARE);
+ state.ssn2tree_map.remove(&tree_key);
+ false
+ }
+ SMB2_COMMAND_TREE_CONNECT => {
+ if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ match parse_smb2_response_tree_connect(r.data) {
+ Ok((_, tr)) => {
+ let name_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_TREE);
+ let mut share_name = Vec::new();
+ let is_pipe = tr.share_type == 2;
+ let found = match state.get_treeconnect_tx(name_key) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::TREECONNECT(ref mut tdn)) = tx.type_data {
+ tdn.share_type = tr.share_type;
+ tdn.is_pipe = is_pipe;
+ tdn.tree_id = r.tree_id;
+ share_name = tdn.share_name.to_vec();
+ }
+ // update hdr now that we have a tree_id
+ tx.hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
+ tx.response_done = true;
+ tx.set_status(r.nt_status, false);
+ true
+ },
+ None => { false },
+ };
+ if found {
+ let tree = SMBTree::new(share_name.to_vec(), is_pipe);
+ let tree_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_SHARE);
+ state.ssn2tree_map.insert(tree_key, tree);
+ }
+ true
+ }
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ },
+ }
+ } else {
+ let name_key = SMBCommonHdr::from2(r, SMBHDR_TYPE_TREE);
+ let found = match state.get_treeconnect_tx(name_key) {
+ Some(tx) => {
+ tx.response_done = true;
+ tx.set_status(r.nt_status, false);
+ true
+ },
+ None => { false },
+ };
+ found
+ }
+ },
+ SMB2_COMMAND_NEGOTIATE_PROTOCOL => {
+ let res = if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ parse_smb2_response_negotiate_protocol(r.data)
+ } else {
+ parse_smb2_response_negotiate_protocol_error(r.data)
+ };
+ match res {
+ Ok((_, rd)) => {
+ SCLogDebug!("SERVER dialect => {}", &smb2_dialect_string(rd.dialect));
+
+ let smb_cfg_max_read_size = unsafe { SMB_CFG_MAX_READ_SIZE };
+ if smb_cfg_max_read_size != 0 && rd.max_read_size > smb_cfg_max_read_size {
+ state.set_event(SMBEvent::NegotiateMaxReadSizeTooLarge);
+ }
+ let smb_cfg_max_write_size = unsafe { SMB_CFG_MAX_WRITE_SIZE };
+ if smb_cfg_max_write_size != 0 && rd.max_write_size > smb_cfg_max_write_size {
+ state.set_event(SMBEvent::NegotiateMaxWriteSizeTooLarge);
+ }
+
+ state.dialect = rd.dialect;
+ state.max_read_size = rd.max_read_size;
+ state.max_write_size = rd.max_write_size;
+
+ let found2 = match state.get_negotiate_tx(2) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::NEGOTIATE(ref mut tdn)) = tx.type_data {
+ tdn.server_guid = rd.server_guid.to_vec();
+ }
+ tx.set_status(r.nt_status, false);
+ tx.response_done = true;
+ true
+ },
+ None => { false },
+ };
+ // SMB2 response to SMB1 request?
+ let found1 = !found2 && match state.get_negotiate_tx(1) {
+ Some(tx) => {
+ if let Some(SMBTransactionTypeData::NEGOTIATE(ref mut tdn)) = tx.type_data {
+ tdn.server_guid = rd.server_guid.to_vec();
+ }
+ tx.set_status(r.nt_status, false);
+ tx.response_done = true;
+ true
+ },
+ None => { false },
+ };
+ found1 || found2
+ },
+ _ => {
+ events.push(SMBEvent::MalformedData);
+ false
+ }
+ }
+ },
+ _ => {
+ SCLogDebug!("default case: no TX");
+ false
+ },
+ };
+ if !have_tx {
+ let tx_hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_GENERICTX);
+ SCLogDebug!("looking for TX {} with session_id {} tree_id {} message_id {}",
+ &smb2_command_string(r.command),
+ r.session_id, r.tree_id, r.message_id);
+ let _found = match state.get_generic_tx(2, r.command, &tx_hdr) {
+ Some(tx) => {
+ SCLogDebug!("tx {} with {}/{} marked as done",
+ tx.id, r.command, &smb2_command_string(r.command));
+ if r.nt_status != SMB_NTSTATUS_PENDING {
+ tx.response_done = true;
+ }
+ tx.set_status(r.nt_status, false);
+ tx.set_events(events);
+ true
+ },
+ _ => {
+ SCLogDebug!("no tx found for {:?}", r);
+ false
+ },
+ };
+ }
+}
diff --git a/rust/src/smb/smb2_ioctl.rs b/rust/src/smb/smb2_ioctl.rs
new file mode 100644
index 0000000..73687aa
--- /dev/null
+++ b/rust/src/smb/smb2_ioctl.rs
@@ -0,0 +1,133 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::smb::smb::*;
+use crate::smb::smb2::*;
+use crate::smb::smb2_records::*;
+use crate::smb::dcerpc::*;
+use crate::smb::events::*;
+#[cfg(feature = "debug")]
+use crate::smb::funcs::*;
+use crate::smb::smb_status::*;
+
+#[derive(Debug)]
+pub struct SMBTransactionIoctl {
+ pub func: u32,
+}
+
+impl SMBTransactionIoctl {
+ pub fn new(func: u32) -> Self {
+ return Self {
+ func,
+ };
+ }
+}
+
+impl SMBState {
+ pub fn new_ioctl_tx(&mut self, hdr: SMBCommonHdr, func: u32)
+ -> &mut SMBTransaction
+ {
+ let mut tx = self.new_tx();
+ tx.hdr = hdr;
+ tx.type_data = Some(SMBTransactionTypeData::IOCTL(
+ SMBTransactionIoctl::new(func)));
+ tx.request_done = true;
+ tx.response_done = self.tc_trunc; // no response expected if tc is truncated
+
+ SCLogDebug!("SMB: TX IOCTL created: ID {} FUNC {:08x}: {}",
+ tx.id, func, &fsctl_func_to_string(func));
+ self.transactions.push_back(tx);
+ let tx_ref = self.transactions.back_mut();
+ return tx_ref.unwrap();
+ }
+}
+
+// IOCTL responses ASYNC don't set the tree id
+pub fn smb2_ioctl_request_record(state: &mut SMBState, r: &Smb2Record)
+{
+ let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
+ match parse_smb2_request_ioctl(r.data) {
+ Ok((_, rd)) => {
+ SCLogDebug!("IOCTL request data: {:?}", rd);
+ let is_dcerpc = if rd.is_pipe {
+ state.get_service_for_guid(rd.guid).1
+ } else {
+ false
+ };
+ if is_dcerpc {
+ SCLogDebug!("IOCTL request data is_pipe. Calling smb_write_dcerpc_record");
+ let vercmd = SMBVerCmdStat::new2(SMB2_COMMAND_IOCTL);
+ smb_write_dcerpc_record(state, vercmd, hdr, rd.data);
+ } else {
+ SCLogDebug!("IOCTL {:08x} {}", rd.function, &fsctl_func_to_string(rd.function));
+ let tx = state.new_ioctl_tx(hdr, rd.function);
+ tx.vercmd.set_smb2_cmd(SMB2_COMMAND_IOCTL);
+ }
+ },
+ _ => {
+ let tx = state.new_generic_tx(2, r.command, hdr);
+ tx.set_event(SMBEvent::MalformedData);
+ },
+ };
+}
+
+// IOCTL responses ASYNC don't set the tree id
+pub fn smb2_ioctl_response_record(state: &mut SMBState, r: &Smb2Record)
+{
+ let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
+ match parse_smb2_response_ioctl(r.data) {
+ Ok((_, rd)) => {
+ SCLogDebug!("IOCTL response data: {:?}", rd);
+
+ let is_dcerpc = if rd.is_pipe {
+ state.get_service_for_guid(rd.guid).1
+ } else {
+ false
+ };
+ if is_dcerpc {
+ SCLogDebug!("IOCTL response data is_pipe. Calling smb_read_dcerpc_record");
+ let vercmd = SMBVerCmdStat::new2_with_ntstatus(SMB2_COMMAND_IOCTL, r.nt_status);
+ SCLogDebug!("TODO passing empty GUID");
+ smb_read_dcerpc_record(state, vercmd, hdr, &[],rd.data);
+ } else {
+ SCLogDebug!("SMB2_COMMAND_IOCTL/SMB_NTSTATUS_PENDING looking for {:?}", hdr);
+ if let Some(tx) = state.get_generic_tx(2, SMB2_COMMAND_IOCTL, &hdr) {
+ tx.set_status(r.nt_status, false);
+ if r.nt_status != SMB_NTSTATUS_PENDING {
+ tx.response_done = true;
+ }
+ }
+ }
+ },
+ _ => {
+ SCLogDebug!("SMB2_COMMAND_IOCTL/SMB_NTSTATUS_PENDING looking for {:?}", hdr);
+ if let Some(tx) = state.get_generic_tx(2, SMB2_COMMAND_IOCTL, &hdr) {
+ SCLogDebug!("updated status of tx {}", tx.id);
+ tx.set_status(r.nt_status, false);
+ if r.nt_status != SMB_NTSTATUS_PENDING {
+ tx.response_done = true;
+ }
+
+ // parsing failed for 'SUCCESS' record, set event
+ if r.nt_status == SMB_NTSTATUS_SUCCESS {
+ SCLogDebug!("parse fail {:?}", r);
+ tx.set_event(SMBEvent::MalformedData);
+ }
+ }
+ },
+ };
+}
diff --git a/rust/src/smb/smb2_records.rs b/rust/src/smb/smb2_records.rs
new file mode 100644
index 0000000..4a7721c
--- /dev/null
+++ b/rust/src/smb/smb2_records.rs
@@ -0,0 +1,903 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::smb::nbss_records::NBSS_MSGTYPE_SESSION_MESSAGE;
+use crate::smb::smb::*;
+use nom7::bytes::streaming::{tag, take};
+use nom7::combinator::{cond, map_parser, rest};
+use nom7::error::{make_error, ErrorKind};
+use nom7::multi::count;
+use nom7::number::streaming::{le_u16, le_u32, le_u64, le_u8};
+use nom7::{Err, IResult, Needed};
+
+const SMB2_FLAGS_SERVER_TO_REDIR: u32 = 0x0000_0001;
+const SMB2_FLAGS_ASYNC_COMMAND: u32 = 0x0000_0002;
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2SecBlobRecord<'a> {
+ pub data: &'a [u8],
+}
+
+pub fn parse_smb2_sec_blob(i: &[u8]) -> IResult<&[u8], Smb2SecBlobRecord> {
+ let (i, data) = rest(i)?;
+ Ok((i, Smb2SecBlobRecord { data }))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2RecordDir {
+ pub request: bool,
+}
+
+pub fn parse_smb2_record_direction(i: &[u8]) -> IResult<&[u8], Smb2RecordDir> {
+ let (i, _server_component) = tag(b"\xfeSMB")(i)?;
+ let (i, _skip) = take(12_usize)(i)?;
+ let (i, flags) = le_u8(i)?;
+ let record = Smb2RecordDir {
+ request: flags & 0x01 == 0,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2Record<'a> {
+ pub direction: u8, // 0 req, 1 res
+ pub header_len: u16,
+ pub nt_status: u32,
+ pub command: u16,
+ pub message_id: u64,
+ pub tree_id: u32,
+ pub async_id: u64,
+ pub session_id: u64,
+ pub data: &'a [u8],
+}
+
+impl<'a> Smb2Record<'a> {
+ pub fn is_request(&self) -> bool {
+ self.direction == 0
+ }
+
+ pub fn is_response(&self) -> bool {
+ self.direction == 1
+ }
+}
+
+#[derive(Debug)]
+struct SmbFlags {
+ direction: u8,
+ async_command: u8,
+}
+
+fn parse_smb2_flags(i: &[u8]) -> IResult<&[u8], SmbFlags> {
+ let (i, val) = le_u32(i)?;
+ let direction = u8::from(val & SMB2_FLAGS_SERVER_TO_REDIR != 0);
+ let async_command = u8::from(val & SMB2_FLAGS_ASYNC_COMMAND != 0);
+ Ok((
+ i,
+ SmbFlags {
+ direction,
+ async_command,
+ },
+ ))
+}
+
+pub fn parse_smb2_request_record(i: &[u8]) -> IResult<&[u8], Smb2Record> {
+ let (i, _server_component) = tag(b"\xfeSMB")(i)?;
+ let (i, hlen) = le_u16(i)?;
+ let (i, _credit_charge) = le_u16(i)?;
+ let (i, _channel_seq) = le_u16(i)?;
+ let (i, _reserved) = take(2_usize)(i)?;
+ let (i, command) = le_u16(i)?;
+ let (i, _credits_requested) = le_u16(i)?;
+ let (i, flags) = parse_smb2_flags(i)?;
+ let (i, chain_offset) = le_u32(i)?;
+ let (i, message_id) = le_u64(i)?;
+ let (i, _process_id) = le_u32(i)?;
+ let (i, tree_id) = le_u32(i)?;
+ let (i, session_id) = le_u64(i)?;
+ let (i, _signature) = take(16_usize)(i)?;
+ let (i, data) = if chain_offset > hlen as u32 {
+ take(chain_offset - hlen as u32)(i)?
+ } else {
+ rest(i)?
+ };
+ let record = Smb2Record {
+ direction: flags.direction,
+ header_len: hlen,
+ nt_status: 0,
+ command,
+ message_id,
+ tree_id,
+ async_id: 0,
+ session_id,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2NegotiateProtocolRequestRecord<'a> {
+ pub dialects_vec: Vec<u16>,
+ pub client_guid: &'a [u8],
+}
+
+pub fn parse_smb2_request_negotiate_protocol(
+ i: &[u8],
+) -> IResult<&[u8], Smb2NegotiateProtocolRequestRecord> {
+ let (i, _struct_size) = take(2_usize)(i)?;
+ let (i, dialects_count) = le_u16(i)?;
+ let (i, _sec_mode) = le_u16(i)?;
+ let (i, _reserved1) = le_u16(i)?;
+ let (i, _capabilities) = le_u32(i)?;
+ let (i, client_guid) = take(16_usize)(i)?;
+ let (i, _ctx_offset) = le_u32(i)?;
+ let (i, _ctx_cnt) = le_u16(i)?;
+ let (i, _reserved2) = le_u16(i)?;
+ let (i, dia_vec) = count(le_u16, dialects_count as usize)(i)?;
+ let record = Smb2NegotiateProtocolRequestRecord {
+ dialects_vec: dia_vec,
+ client_guid,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2NegotiateProtocolResponseRecord<'a> {
+ pub dialect: u16,
+ pub server_guid: &'a [u8],
+ pub max_trans_size: u32,
+ pub max_read_size: u32,
+ pub max_write_size: u32,
+}
+
+pub fn parse_smb2_response_negotiate_protocol(
+ i: &[u8],
+) -> IResult<&[u8], Smb2NegotiateProtocolResponseRecord> {
+ let (i, _struct_size) = take(2_usize)(i)?;
+ let (i, _skip1) = take(2_usize)(i)?;
+ let (i, dialect) = le_u16(i)?;
+ let (i, _ctx_cnt) = le_u16(i)?;
+ let (i, server_guid) = take(16_usize)(i)?;
+ let (i, _capabilities) = le_u32(i)?;
+ let (i, max_trans_size) = le_u32(i)?;
+ let (i, max_read_size) = le_u32(i)?;
+ let (i, max_write_size) = le_u32(i)?;
+ let record = Smb2NegotiateProtocolResponseRecord {
+ dialect,
+ server_guid,
+ max_trans_size,
+ max_read_size,
+ max_write_size,
+ };
+ Ok((i, record))
+}
+
+pub fn parse_smb2_response_negotiate_protocol_error(
+ i: &[u8],
+) -> IResult<&[u8], Smb2NegotiateProtocolResponseRecord> {
+ let (i, _struct_size) = take(2_usize)(i)?;
+ let (i, _skip1) = take(2_usize)(i)?;
+ let record = Smb2NegotiateProtocolResponseRecord {
+ dialect: 0,
+ server_guid: &[],
+ max_trans_size: 0,
+ max_read_size: 0,
+ max_write_size: 0,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2SessionSetupRequestRecord<'a> {
+ pub data: &'a [u8],
+}
+
+pub fn parse_smb2_request_session_setup(i: &[u8]) -> IResult<&[u8], Smb2SessionSetupRequestRecord> {
+ let (i, _struct_size) = take(2_usize)(i)?;
+ let (i, _flags) = le_u8(i)?;
+ let (i, _security_mode) = le_u8(i)?;
+ let (i, _capabilities) = le_u32(i)?;
+ let (i, _channel) = le_u32(i)?;
+ let (i, _sec_offset) = le_u16(i)?;
+ let (i, _sec_len) = le_u16(i)?;
+ let (i, _prev_ssn_id) = take(8_usize)(i)?;
+ let (i, data) = rest(i)?;
+ let record = Smb2SessionSetupRequestRecord { data };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2TreeConnectRequestRecord<'a> {
+ pub share_name: &'a [u8],
+}
+
+pub fn parse_smb2_request_tree_connect(i: &[u8]) -> IResult<&[u8], Smb2TreeConnectRequestRecord> {
+ let (i, _struct_size) = take(2_usize)(i)?;
+ let (i, _offset_length) = take(4_usize)(i)?;
+ let (i, data) = rest(i)?;
+ let record = Smb2TreeConnectRequestRecord { share_name: data };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2TreeConnectResponseRecord {
+ pub share_type: u8,
+}
+
+pub fn parse_smb2_response_tree_connect(i: &[u8]) -> IResult<&[u8], Smb2TreeConnectResponseRecord> {
+ let (i, _struct_size) = take(2_usize)(i)?;
+ let (i, share_type) = le_u8(i)?;
+ let (i, _share_flags) = le_u32(i)?;
+ let (i, _share_caps) = le_u32(i)?;
+ let (i, _access_mask) = le_u32(i)?;
+ let record = Smb2TreeConnectResponseRecord { share_type };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2CreateRequestRecord<'a> {
+ pub disposition: u32,
+ pub create_options: u32,
+ pub data: &'a [u8],
+}
+
+pub fn parse_smb2_request_create(i: &[u8]) -> IResult<&[u8], Smb2CreateRequestRecord> {
+ let (i, _skip1) = take(36_usize)(i)?;
+ let (i, disposition) = le_u32(i)?;
+ let (i, create_options) = le_u32(i)?;
+ let (i, _file_name_offset) = le_u16(i)?;
+ let (i, file_name_length) = le_u16(i)?;
+ let (i, _skip2) = take(8_usize)(i)?;
+ let (i, data) = take(file_name_length)(i)?;
+ let (i, _skip3) = rest(i)?;
+ let record = Smb2CreateRequestRecord {
+ disposition,
+ create_options,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2IOCtlRequestRecord<'a> {
+ pub is_pipe: bool,
+ pub function: u32,
+ pub guid: &'a [u8],
+ pub data: &'a [u8],
+}
+
+pub fn parse_smb2_request_ioctl(i: &[u8]) -> IResult<&[u8], Smb2IOCtlRequestRecord> {
+ let (i, _skip) = take(2_usize)(i)?; // structure size
+ let (i, _) = take(2_usize)(i)?; // reserved
+ let (i, func) = le_u32(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let (i, _indata_offset) = le_u32(i)?;
+ let (i, indata_len) = le_u32(i)?;
+ let (i, _) = take(4_usize)(i)?;
+ let (i, _outdata_offset) = le_u32(i)?;
+ let (i, _outdata_len) = le_u32(i)?;
+ let (i, _) = take(12_usize)(i)?;
+ let (i, data) = take(indata_len)(i)?;
+ let record = Smb2IOCtlRequestRecord {
+ is_pipe: (func == 0x0011c017),
+ function: func,
+ guid,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2IOCtlResponseRecord<'a> {
+ pub is_pipe: bool,
+ pub guid: &'a [u8],
+ pub data: &'a [u8],
+ pub indata_len: u32,
+ pub outdata_len: u32,
+ pub indata_offset: u32,
+ pub outdata_offset: u32,
+}
+
+pub fn parse_smb2_response_ioctl(i: &[u8]) -> IResult<&[u8], Smb2IOCtlResponseRecord> {
+ let (i, _skip) = take(2_usize)(i)?; // structure size
+ let (i, _) = take(2_usize)(i)?; // reserved
+ let (i, func) = le_u32(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let (i, indata_offset) = le_u32(i)?;
+ let (i, indata_len) = le_u32(i)?;
+ let (i, outdata_offset) = le_u32(i)?;
+ let (i, outdata_len) = le_u32(i)?;
+ let (i, _) = take(8_usize)(i)?;
+ let (i, _) = take(indata_len)(i)?;
+ let (i, data) = take(outdata_len)(i)?;
+ let record = Smb2IOCtlResponseRecord {
+ is_pipe: (func == 0x0011c017),
+ guid,
+ data,
+ indata_len,
+ outdata_len,
+ indata_offset,
+ outdata_offset,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2CloseRequestRecord<'a> {
+ pub guid: &'a [u8],
+}
+
+pub fn parse_smb2_request_close(i: &[u8]) -> IResult<&[u8], Smb2CloseRequestRecord> {
+ let (i, _skip) = take(8_usize)(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let record = Smb2CloseRequestRecord { guid };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq)]
+pub struct Smb2SetInfoRequestRenameRecord<'a> {
+ pub name: &'a [u8],
+}
+
+pub fn parse_smb2_request_setinfo_rename(i: &[u8]) -> IResult<&[u8], Smb2SetInfoRequestData> {
+ let (i, _replace) = le_u8(i)?;
+ let (i, _reserved) = take(7_usize)(i)?;
+ let (i, _root_handle) = take(8_usize)(i)?;
+ let (i, name_len) = le_u32(i)?;
+ let (i, name) = take(name_len)(i)?;
+ let record = Smb2SetInfoRequestData::RENAME(Smb2SetInfoRequestRenameRecord { name });
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq)]
+pub struct Smb2SetInfoRequestDispoRecord {
+ pub delete: bool,
+}
+
+pub fn parse_smb2_request_setinfo_disposition(i: &[u8]) -> IResult<&[u8], Smb2SetInfoRequestData> {
+ let (i, info) = le_u8(i)?;
+ let record = Smb2SetInfoRequestData::DISPOSITION(Smb2SetInfoRequestDispoRecord {
+ delete: info & 1 != 0,
+ });
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq)]
+pub enum Smb2SetInfoRequestData<'a> {
+ DISPOSITION(Smb2SetInfoRequestDispoRecord),
+ RENAME(Smb2SetInfoRequestRenameRecord<'a>),
+ UNHANDLED,
+}
+
+#[derive(Debug)]
+pub struct Smb2SetInfoRequestRecord<'a> {
+ pub guid: &'a [u8],
+ pub class: u8,
+ pub infolvl: u8,
+ pub data: Smb2SetInfoRequestData<'a>,
+}
+
+fn parse_smb2_request_setinfo_data(
+ i: &[u8], class: u8, infolvl: u8,
+) -> IResult<&[u8], Smb2SetInfoRequestData> {
+ if class == 1 {
+ // constants from [MS-FSCC] section 2.4
+ match infolvl {
+ 10 => {
+ return parse_smb2_request_setinfo_rename(i);
+ }
+ 0xd => {
+ return parse_smb2_request_setinfo_disposition(i);
+ }
+ _ => {}
+ }
+ }
+ return Ok((i, Smb2SetInfoRequestData::UNHANDLED));
+}
+
+pub fn parse_smb2_request_setinfo(i: &[u8]) -> IResult<&[u8], Smb2SetInfoRequestRecord> {
+ let (i, _struct_size) = le_u16(i)?;
+ let (i, class) = le_u8(i)?;
+ let (i, infolvl) = le_u8(i)?;
+ let (i, setinfo_size) = le_u32(i)?;
+ let (i, _setinfo_offset) = le_u16(i)?;
+ let (i, _reserved) = take(2_usize)(i)?;
+ let (i, _additional_info) = le_u32(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let (i, data) = map_parser(take(setinfo_size), |b| {
+ parse_smb2_request_setinfo_data(b, class, infolvl)
+ })(i)?;
+ let record = Smb2SetInfoRequestRecord {
+ guid,
+ class,
+ infolvl,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2WriteRequestRecord<'a> {
+ pub wr_len: u32,
+ pub wr_offset: u64,
+ pub guid: &'a [u8],
+ pub data: &'a [u8],
+}
+
+// can be called on incomplete records
+pub fn parse_smb2_request_write(i: &[u8]) -> IResult<&[u8], Smb2WriteRequestRecord> {
+ let (i, _skip1) = take(4_usize)(i)?;
+ let (i, wr_len) = le_u32(i)?;
+ let (i, wr_offset) = le_u64(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let (i, _channel) = le_u32(i)?;
+ let (i, _remaining_bytes) = le_u32(i)?;
+ let (i, _write_flags) = le_u32(i)?;
+ let (i, _skip2) = take(4_usize)(i)?;
+ let (i, data) = parse_smb2_data(i, wr_len)?;
+ let record = Smb2WriteRequestRecord {
+ wr_len,
+ wr_offset,
+ guid,
+ data,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2ReadRequestRecord<'a> {
+ pub rd_len: u32,
+ pub rd_offset: u64,
+ pub guid: &'a [u8],
+}
+
+pub fn parse_smb2_request_read(i: &[u8]) -> IResult<&[u8], Smb2ReadRequestRecord> {
+ let (i, _skip1) = take(4_usize)(i)?;
+ let (i, rd_len) = le_u32(i)?;
+ let (i, rd_offset) = le_u64(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let (i, _min_count) = le_u32(i)?;
+ let (i, _channel) = le_u32(i)?;
+ let (i, _remaining_bytes) = le_u32(i)?;
+ let (i, _skip2) = take(4_usize)(i)?;
+ let record = Smb2ReadRequestRecord {
+ rd_len,
+ rd_offset,
+ guid,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2ReadResponseRecord<'a> {
+ pub len: u32,
+ pub data: &'a [u8],
+}
+
+// parse read/write data. If all is available, 'take' it.
+// otherwise just return what we have. So this may return
+// partial data.
+fn parse_smb2_data(i: &[u8], len: u32) -> IResult<&[u8], &[u8]> {
+ if len as usize > i.len() {
+ rest(i)
+ } else {
+ take(len)(i)
+ }
+}
+
+// can be called on incomplete records
+pub fn parse_smb2_response_read(i: &[u8]) -> IResult<&[u8], Smb2ReadResponseRecord> {
+ let (i, _struct_size) = le_u16(i)?;
+ let (i, _data_offset) = le_u16(i)?;
+ let (i, rd_len) = le_u32(i)?;
+ let (i, _rd_rem) = le_u32(i)?;
+ let (i, _padding) = take(4_usize)(i)?;
+ let (i, data) = parse_smb2_data(i, rd_len)?;
+ let record = Smb2ReadResponseRecord { len: rd_len, data };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2CreateResponseRecord<'a> {
+ pub guid: &'a [u8],
+ pub create_ts: SMBFiletime,
+ pub last_access_ts: SMBFiletime,
+ pub last_write_ts: SMBFiletime,
+ pub last_change_ts: SMBFiletime,
+ pub size: u64,
+}
+
+pub fn parse_smb2_response_create(i: &[u8]) -> IResult<&[u8], Smb2CreateResponseRecord> {
+ let (i, _ssize) = le_u16(i)?;
+ let (i, _oplock) = le_u8(i)?;
+ let (i, _resp_flags) = le_u8(i)?;
+ let (i, _create_action) = le_u32(i)?;
+ let (i, create_ts) = le_u64(i)?;
+ let (i, last_access_ts) = le_u64(i)?;
+ let (i, last_write_ts) = le_u64(i)?;
+ let (i, last_change_ts) = le_u64(i)?;
+ let (i, _alloc_size) = le_u64(i)?;
+ let (i, eof) = le_u64(i)?;
+ let (i, _attrs) = le_u32(i)?;
+ let (i, _padding) = take(4_usize)(i)?;
+ let (i, guid) = take(16_usize)(i)?;
+ let (i, _skip2) = take(8_usize)(i)?;
+ let record = Smb2CreateResponseRecord {
+ guid,
+ create_ts: SMBFiletime::new(create_ts),
+ last_access_ts: SMBFiletime::new(last_access_ts),
+ last_write_ts: SMBFiletime::new(last_write_ts),
+ last_change_ts: SMBFiletime::new(last_change_ts),
+ size: eof,
+ };
+ Ok((i, record))
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Smb2WriteResponseRecord {
+ pub wr_cnt: u32,
+}
+
+pub fn parse_smb2_response_write(i: &[u8]) -> IResult<&[u8], Smb2WriteResponseRecord> {
+ let (i, _skip1) = take(4_usize)(i)?;
+ let (i, wr_cnt) = le_u32(i)?;
+ let (i, _skip2) = take(6_usize)(i)?;
+ let record = Smb2WriteResponseRecord { wr_cnt };
+ Ok((i, record))
+}
+
+pub fn parse_smb2_response_record(i: &[u8]) -> IResult<&[u8], Smb2Record> {
+ let (i, _) = tag(b"\xfeSMB")(i)?;
+ let (i, hlen) = le_u16(i)?;
+ let (i, _credit_charge) = le_u16(i)?;
+ let (i, nt_status) = le_u32(i)?;
+ let (i, command) = le_u16(i)?;
+ let (i, _credit_granted) = le_u16(i)?;
+ let (i, flags) = parse_smb2_flags(i)?;
+ let (i, chain_offset) = le_u32(i)?;
+ let (i, message_id) = le_u64(i)?;
+ let (i, _process_id) = cond(flags.async_command == 0, le_u32)(i)?;
+ let (i, tree_id) = cond(flags.async_command == 0, le_u32)(i)?;
+ let (i, async_id) = cond(flags.async_command == 1, le_u64)(i)?;
+ let (i, session_id) = le_u64(i)?;
+ let (i, _signature) = take(16_usize)(i)?;
+ let (i, data) = if chain_offset > hlen as u32 {
+ take(chain_offset - hlen as u32)(i)?
+ } else {
+ rest(i)?
+ };
+ let record = Smb2Record {
+ direction: flags.direction,
+ header_len: hlen,
+ nt_status,
+ message_id,
+ tree_id: tree_id.unwrap_or(0),
+ async_id: async_id.unwrap_or(0),
+ session_id,
+ command,
+ data,
+ };
+ Ok((i, record))
+}
+
+fn smb_basic_search(d: &[u8]) -> usize {
+ let needle = b"SMB";
+ // this could be replaced by aho-corasick
+ let iter = d.windows(needle.len());
+ for (r, window) in iter.enumerate() {
+ if window == needle {
+ return r;
+ }
+ }
+ return 0;
+}
+
+pub fn search_smb_record(i: &[u8]) -> IResult<&[u8], &[u8]> {
+ let mut d = i;
+ while d.len() >= 4 {
+ let index = smb_basic_search(d);
+ if index == 0 {
+ return Err(Err::Error(make_error(d, ErrorKind::Eof)));
+ }
+ if d[index - 1] == 0xfe || d[index - 1] == 0xff || d[index - 1] == 0xfd {
+ // if we have enough data, check nbss
+ if index < 5 || d[index - 5] == NBSS_MSGTYPE_SESSION_MESSAGE {
+ return Ok((&d[index + 3..], &d[index - 1..]));
+ }
+ }
+ d = &d[index + 3..];
+ }
+ Err(Err::Incomplete(Needed::new(4_usize - d.len())))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use crate::smb::smb2::smb2_dialect_string;
+ use std::convert::TryInto;
+ fn guid_to_string(guid: &[u8]) -> String {
+ if guid.len() == 16 {
+ let output = format!("{:02x}{:02x}{:02x}{:02x}-{:02x}{:02x}-{:02x}{:02x}-{:02x}{:02x}-{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}",
+ guid[3], guid[2], guid[1], guid[0],
+ guid[5], guid[4], guid[7], guid[6],
+ guid[9], guid[8], guid[11], guid[10],
+ guid[15], guid[14], guid[13], guid[12]);
+ output
+ } else {
+ "".to_string()
+ }
+ }
+ #[test]
+ fn test_parse_smb2_request_record() {
+ let data = hex::decode("fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000").unwrap();
+ let result = parse_smb2_request_record(&data).unwrap();
+ let record: Smb2Record = result.1;
+ assert_eq!(
+ record,
+ Smb2Record {
+ direction: 1,
+ header_len: 64,
+ nt_status: 0,
+ command: 0,
+ message_id: 0,
+ tree_id: 0,
+ async_id: 0,
+ session_id: 0,
+ data: &[],
+ }
+ );
+ }
+ #[test]
+ fn test_parse_smb2_request_negotiate_protocol() {
+ // https://github.com/bro/bro/blob/master/testing/btest/Traces/smb/smb3_negotiate_context.pcap
+ // smb3_negotiate_context.pcap no.12
+ let data = hex::decode("24000800010000007f00000016ab4fd9625676488cd1707d08e52b5878000000020000000202100222022402000302031003110300000000010026000000000001002000010067e5f669ff3e0ad12e89ad84ceb1d35dfee53ede3e4858a6d1a9099ac1635a9600000200060000000000020001000200").unwrap();
+ let result = parse_smb2_request_negotiate_protocol(&data).unwrap();
+ let record: Smb2NegotiateProtocolRequestRecord = result.1;
+ let dialects: Vec<String> = record
+ .dialects_vec
+ .iter()
+ .map(|d| smb2_dialect_string(*d))
+ .collect();
+ assert_eq!(
+ dialects,
+ ["2.02", "2.10", "2.22", "2.24", "3.00", "3.02", "3.10", "3.11"]
+ );
+ assert_eq!(
+ guid_to_string(record.client_guid),
+ "d94fab16-5662-4876-d18c-7d70582be508"
+ ); // TODO: guid order
+ }
+
+ #[test]
+ fn test_parse_smb2_response_tree_connect() {
+ // https://github.com/bro/bro/blob/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:smb2 no.11
+ let data = hex::decode("100001000008000000000000ff011f00").unwrap();
+ let result = parse_smb2_response_tree_connect(&data).unwrap();
+ let record: Smb2TreeConnectResponseRecord = result.1;
+ assert_eq!(record.share_type, 1); // 1: SMB2_SHARE_TYPE_DISK
+ }
+ #[test]
+ fn test_parse_smb2_request_create() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:smb2 no.26
+ let data = hex::decode("390000000200000000000000000000000000000000000000810010008000000003000000020000002100200078000000800000005800000000007200760073002800000010000400000018001000000044486e510000000000000000000000000000000000000000180000001000040000001800000000004d78416300000000000000001000040000001800000000005146696400000000").unwrap();
+ let result = parse_smb2_request_create(&data).unwrap();
+ let record: Smb2CreateRequestRecord = result.1;
+ assert_eq!(record.disposition, 2); // FILE_CREATE: 2
+ assert_eq!(record.create_options, 0x200021);
+ assert_eq!(record.data, &[]);
+ let del = record.create_options & 0x0000_1000 != 0;
+ let dir = record.create_options & 0x0000_0001 != 0;
+ assert!(!del);
+ assert!(dir);
+ }
+ #[test]
+ fn test_parse_smb2_request_close() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:smb2 no.24
+ let data = hex::decode("1800000000000000490000000000000005000000ffffffff").unwrap();
+ let result = parse_smb2_request_close(&data).unwrap();
+ let record: Smb2CloseRequestRecord = result.1;
+ assert_eq!(
+ guid_to_string(record.guid),
+ "00000049-0000-0000-0005-0000ffffffff"
+ );
+ }
+
+ #[test]
+ fn test_parse_smb2_request_setinfo() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:tcp.stream eq 0 no.36
+ let data = hex::decode(
+ "210001140800000060000000000000004d0000000000000009000000ffffffff4b06170000000000",
+ )
+ .unwrap();
+ let result = parse_smb2_request_setinfo(&data).unwrap();
+ let record: Smb2SetInfoRequestRecord = result.1;
+ assert_eq!(record.class, 1);
+ assert_eq!(record.infolvl, 20);
+ assert_eq!(record.data, Smb2SetInfoRequestData::UNHANDLED);
+ assert_eq!(
+ guid_to_string(record.guid),
+ "0000004d-0000-0000-0009-0000ffffffff"
+ );
+ }
+
+ #[test]
+ fn test_parse_smb2_request_read() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:smb2 no.20
+ let data = hex::decode("31005000000400000000000000000000490000000000000005000000ffffffff00000000000000000000000000000000").unwrap();
+ let result = parse_smb2_request_read(&data).unwrap();
+ let record: Smb2ReadRequestRecord = result.1;
+ assert_eq!(record.rd_len, 1024);
+ assert_eq!(record.rd_offset, 0);
+ assert_eq!(
+ guid_to_string(record.guid),
+ "00000049-0000-0000-0005-0000ffffffff"
+ );
+ }
+
+ #[test]
+ fn test_parse_smb2_request_write() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:tcp.stream eq 0 no.18
+ let data = hex::decode("31007000740000000000000000000000490000000000000005000000ffffffff0000000000000000000000000000000005000b03100000007400000001000000b810b810000000000200000000000100c84f324b7016d30112785a47bf6ee18803000000045d888aeb1cc9119fe808002b1048600200000001000100c84f324b7016d30112785a47bf6ee188030000002c1cb76c12984045030000000000000001000000").unwrap();
+ let result = parse_smb2_request_write(&data).unwrap();
+ let record: Smb2WriteRequestRecord = result.1;
+ assert_eq!(record.wr_len, 116);
+ assert_eq!(record.wr_offset, 0);
+ assert_eq!(
+ guid_to_string(record.guid),
+ "00000049-0000-0000-0005-0000ffffffff"
+ );
+ assert_eq!(record.data.len(), 116);
+ }
+
+ #[test]
+ fn test_parse_smb2_response_read() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb2.pcap
+ // filter:tcp.stream eq 0 no.21
+ let data = hex::decode("110050005c000000000000000000000005000c03100000005c00000001000000b810b810b97200000d005c504950455c73727673766300000200000000000000045d888aeb1cc9119fe808002b10486002000000030003000000000000000000000000000000000000000000").unwrap();
+ let result = parse_smb2_response_read(&data).unwrap();
+ let record: Smb2ReadResponseRecord = result.1;
+ assert_eq!(record.len, 92);
+ assert_eq!(record.data.len(), 92);
+ }
+ #[test]
+ fn test_parse_smb2_record_direction() {
+ let data = hex::decode("fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000").unwrap();
+ let result = parse_smb2_record_direction(&data).unwrap();
+ let record: Smb2RecordDir = result.1;
+ assert!(!record.request);
+ let data = hex::decode("fe534d4240000000000000000100080000000000000000000100000000000000fffe000000000000000000000000000000000000000000000000000000000000").unwrap();
+ let result = parse_smb2_record_direction(&data).unwrap();
+ let record: Smb2RecordDir = result.1;
+ assert!(record.request);
+ }
+
+ #[test]
+ fn test_parse_smb2_request_tree_connect() {
+ let data = hex::decode("0900000048002c005c005c003100390032002e003100360038002e003100390039002e003100330033005c004900500043002400").unwrap();
+ let result = parse_smb2_request_tree_connect(&data);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert!(record.share_name.len() > 2);
+ let share_name_len = u16::from_le_bytes(record.share_name[0..2].try_into().unwrap());
+ assert_eq!(share_name_len, 44);
+ assert_eq!(record.share_name.len(), share_name_len as usize + 2);
+ let mut share_name = record.share_name[2..].to_vec();
+ share_name.retain(|&i| i != 0x00);
+ assert_eq!(
+ String::from_utf8_lossy(&share_name),
+ "\\\\192.168.199.133\\IPC$"
+ );
+ }
+
+ #[test]
+ fn test_parse_smb2_response_record() {
+ let data = hex::decode("fe534d4240000000000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100ff020000966eafa3357f0440a5f9643e1bfa8c56070000000000800000008000000080001064882d8527d201a1f3ae878427d20180004001000000006082013c06062b0601050502a08201303082012ca01a3018060a2b06010401823702021e060a2b06010401823702020aa282010c048201084e45474f45585453010000000000000060000000700000007fb23ba7cacc4e216323ca8472061efbd2c4f6d6b3017012f0bf4f7202ec684ee801ef64e55401ab86b1c9ebde4e39ea0000000000000000600000000100000000000000000000005c33530deaf90d4db2ec4ae3786ec3084e45474f45585453030000000100000040000000980000007fb23ba7cacc4e216323ca8472061efb5c33530deaf90d4db2ec4ae3786ec30840000000580000003056a05430523027802530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b65793027802530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579").unwrap();
+ let result = parse_smb2_response_record(&data);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert_eq!(record.direction, 1);
+ assert_eq!(record.header_len, 64);
+ assert_eq!(record.nt_status, 0);
+ assert_eq!(
+ record.command,
+ crate::smb::smb2::SMB2_COMMAND_NEGOTIATE_PROTOCOL
+ );
+ assert_eq!(record.message_id, 0);
+ assert_eq!(record.tree_id, 0);
+ assert_eq!(record.async_id, 0);
+ assert_eq!(record.session_id, 0);
+ let neg_proto_result = parse_smb2_response_negotiate_protocol(record.data);
+ assert!(neg_proto_result.is_ok());
+ let neg_proto = neg_proto_result.unwrap().1;
+ assert_eq!(
+ guid_to_string(neg_proto.server_guid),
+ "a3af6e96-7f35-4004-f9a5-3e64568cfa1b"
+ );
+ assert_eq!(neg_proto.dialect, 0x2ff);
+ assert_eq!(smb2_dialect_string(neg_proto.dialect), "2.??".to_string());
+ assert_eq!(neg_proto.max_trans_size, 0x800000);
+ assert_eq!(neg_proto.max_read_size, 0x800000);
+ assert_eq!(neg_proto.max_write_size, 0x800000);
+ }
+
+ #[test]
+ fn test_todo_parse_smb2_response_negotiate_protocol_error() {
+ // TODO: find pcap
+ }
+
+ #[test]
+ fn test_parse_smb2_response_write() {
+ let data = hex::decode("11000000a00000000000000000000000").unwrap();
+ let result = parse_smb2_response_write(&data);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert_eq!(record.wr_cnt, 160);
+ }
+ #[test]
+ fn test_parse_smb2_response_create() {
+ let data = hex::decode("5900000001000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000800000000000000001000000db3b5a009a29ea00000000000000000000000000").unwrap();
+ let result = parse_smb2_response_create(&data);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert_eq!(
+ guid_to_string(record.guid),
+ "00000001-3bdb-005a-299a-00ea00000000"
+ );
+ assert_eq!(record.create_ts, SMBFiletime::new(0));
+ assert_eq!(record.last_access_ts, SMBFiletime::new(0));
+ assert_eq!(record.last_write_ts, SMBFiletime::new(0));
+ assert_eq!(record.last_change_ts, SMBFiletime::new(0));
+ assert_eq!(record.size, 0);
+ }
+ #[test]
+ fn test_parse_smb2_response_ioctl() {
+ let data = hex::decode("31000000fc011400ffffffffffffffffffffffffffffffff7000000000000000700000003001000000000000000000009800000004000000010000000000000000ca9a3b0000000002000000c0a8c7850000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000010000000000000000ca9a3b000000001700000000000000fe8000000000000065b53a9792d191990000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000").unwrap();
+ let result = parse_smb2_response_ioctl(&data);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert_eq!(record.indata_len, 0);
+ assert_eq!(
+ guid_to_string(record.guid),
+ "ffffffff-ffff-ffff-ffff-ffffffffffff"
+ );
+ assert!(!record.is_pipe);
+ assert_eq!(record.outdata_len, 304);
+ assert_eq!(record.indata_offset, 112);
+ assert_eq!(record.outdata_offset, 112);
+ }
+
+ #[test]
+ fn test_parse_smb2_request_ioctl() {
+ let data = hex::decode("39000000fc011400ffffffffffffffffffffffffffffffff7800000000000000000000007800000000000000000001000100000000000000").unwrap();
+ let result = parse_smb2_request_ioctl(&data);
+ assert!(result.is_ok());
+ let record = result.unwrap().1;
+ assert_eq!(
+ guid_to_string(record.guid),
+ "ffffffff-ffff-ffff-ffff-ffffffffffff"
+ );
+ assert!(!record.is_pipe);
+ assert_eq!(record.function, 0x1401fc);
+ assert_eq!(record.data, &[]);
+ }
+}
diff --git a/rust/src/smb/smb2_session.rs b/rust/src/smb/smb2_session.rs
new file mode 100644
index 0000000..93cc99c
--- /dev/null
+++ b/rust/src/smb/smb2_session.rs
@@ -0,0 +1,85 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::smb::smb2_records::*;
+use crate::smb::smb::*;
+use crate::smb::events::*;
+use crate::smb::auth::*;
+
+pub fn smb2_session_setup_request(state: &mut SMBState, r: &Smb2Record)
+{
+ SCLogDebug!("SMB2_COMMAND_SESSION_SETUP: r.data.len() {}", r.data.len());
+ #[allow(clippy::single_match)]
+ match parse_smb2_request_session_setup(r.data) {
+ Ok((_, setup)) => {
+ let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
+ let tx = state.new_sessionsetup_tx(hdr);
+ tx.vercmd.set_smb2_cmd(r.command);
+
+ if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
+ if let Some(s) = parse_secblob(setup.data) {
+ td.ntlmssp = s.ntlmssp;
+ td.krb_ticket = s.krb;
+ if let Some(ntlm) = &td.ntlmssp {
+ if ntlm.warning {
+ tx.set_event(SMBEvent::UnusualNtlmsspOrder);
+ }
+ }
+ }
+ }
+ },
+ _ => {
+// events.push(SMBEvent::MalformedData);
+ },
+ }
+}
+
+fn smb2_session_setup_update_tx(tx: &mut SMBTransaction, r: &Smb2Record)
+{
+ tx.hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER); // to overwrite ssn_id 0
+ tx.set_status(r.nt_status, false);
+ tx.response_done = true;
+}
+
+pub fn smb2_session_setup_response(state: &mut SMBState, r: &Smb2Record)
+{
+ // try exact match with session id already set (e.g. NTLMSSP AUTH phase)
+ let found = r.session_id != 0 && match state.get_sessionsetup_tx(
+ SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER))
+ {
+ Some(tx) => {
+ smb2_session_setup_update_tx(tx, r);
+ SCLogDebug!("smb2_session_setup_response: tx {:?}", tx);
+ true
+ },
+ None => { false },
+ };
+ // otherwise try match with ssn id 0 (e.g. NTLMSSP_NEGOTIATE)
+ if !found {
+ match state.get_sessionsetup_tx(
+ SMBCommonHdr::new(SMBHDR_TYPE_HEADER, 0, 0, r.message_id))
+ {
+ Some(tx) => {
+ smb2_session_setup_update_tx(tx, r);
+ SCLogDebug!("smb2_session_setup_response: tx {:?}", tx);
+ },
+ None => {
+ SCLogDebug!("smb2_session_setup_response: tx not found for {:?}", r);
+ },
+ }
+ }
+}
diff --git a/rust/src/smb/smb3.rs b/rust/src/smb/smb3.rs
new file mode 100644
index 0000000..07a7059
--- /dev/null
+++ b/rust/src/smb/smb3.rs
@@ -0,0 +1,59 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use nom7::bytes::streaming::{tag, take};
+use nom7::number::streaming::{le_u16, le_u32, le_u64};
+use nom7::IResult;
+
+#[derive(Debug,PartialEq, Eq)]
+pub struct Smb3TransformRecord<'a> {
+ pub session_id: u64,
+ pub enc_algo: u16,
+ pub enc_data: &'a[u8],
+}
+
+pub fn parse_smb3_transform_record(i: &[u8]) -> IResult<&[u8], Smb3TransformRecord> {
+ let (i, _) = tag(b"\xfdSMB")(i)?;
+ let (i, _signature) = take(16_usize)(i)?;
+ let (i, _nonce) = take(16_usize)(i)?;
+ let (i, msg_size) = le_u32(i)?;
+ let (i, _reserved) = le_u16(i)?;
+ let (i, enc_algo) = le_u16(i)?;
+ let (i, session_id) = le_u64(i)?;
+ let (i, enc_data) = take(msg_size)(i)?;
+ let record = Smb3TransformRecord {
+ session_id,
+ enc_algo,
+ enc_data,
+ };
+ Ok((i, record))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ #[test]
+ fn test_parse_smb3_transform_record() {
+ // https://raw.githubusercontent.com/bro/bro/master/testing/btest/Traces/smb/smb3.pcap
+ let data = hex::decode("fd534d42188d39cea4b1e3f640aff5d0b1569852c0bd665516dbb4b499507f000000000069000000000001003d00009400480000d9f8a66572b40c621bea6f5922a412a8eb2e3cc2af9ce26a277e75898cb523b9eb49ef660a6a1a09368fadd6a58e893e08eb3b7c068bdb74b6cd38e9ed1a2559cefb2ebc2172fd86c08a1a636eb851f20bf53a242f4cfaf7ab44e77291073ad492d6297c3d3a67757c").unwrap();
+ let result = parse_smb3_transform_record(&data).unwrap();
+ let record: Smb3TransformRecord = result.1;
+ assert_eq!(record.session_id, 79167320227901);
+ assert_eq!(record.enc_algo, 1);
+ assert_eq!(record.enc_data.len(), 105);
+ }
+}
diff --git a/rust/src/smb/smb_records.rs b/rust/src/smb/smb_records.rs
new file mode 100644
index 0000000..cc5b3cb
--- /dev/null
+++ b/rust/src/smb/smb_records.rs
@@ -0,0 +1,53 @@
+/* Copyright (C) 2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use crate::common::nom7::take_until_and_consume;
+use crate::smb::error::SmbError;
+use nom7::{Err, IResult};
+
+/// parse a UTF16 string that is null terminated. Normally by 2 null
+/// bytes, but at the end of the data it can also be a single null.
+/// Skip every second byte.
+pub fn smb_get_unicode_string(blob: &[u8]) -> IResult<&[u8], Vec<u8>, SmbError>
+{
+ SCLogDebug!("get_unicode_string: blob {} {:?}", blob.len(), blob);
+ let mut name : Vec<u8> = Vec::new();
+ let mut c = blob;
+ while !c.is_empty() {
+ if c.len() == 1 && c[0] == 0 {
+ let rem = &c[1..];
+ SCLogDebug!("get_unicode_string: name {:?}", name);
+ return Ok((rem, name))
+ } else if c.len() == 1 {
+ break;
+ } else if c[0] == 0 && c[1] == 0 {
+ let rem = &c[2..];
+ SCLogDebug!("get_unicode_string: name {:?}", name);
+ return Ok((rem, name))
+ }
+ name.push(c[0]);
+ c = &c[2..];
+ }
+ Err(Err::Error(SmbError::BadEncoding))
+}
+
+// parse an ASCII string that is null terminated
+pub fn smb_get_ascii_string(i: &[u8]) -> IResult<&[u8], Vec<u8>, SmbError> {
+ let (i, s) = take_until_and_consume(b"\x00")(i)?;
+ Ok((i, s.to_vec()))
+}
+
diff --git a/rust/src/smb/smb_status.rs b/rust/src/smb/smb_status.rs
new file mode 100644
index 0000000..10b06a5
--- /dev/null
+++ b/rust/src/smb/smb_status.rs
@@ -0,0 +1,3609 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+pub const SMB_NTSTATUS_SUCCESS: u32 = 0x00000000;
+pub const SMB_NTSTATUS_WAIT_1: u32 = 0x00000001;
+pub const SMB_NTSTATUS_WAIT_2: u32 = 0x00000002;
+pub const SMB_NTSTATUS_WAIT_3: u32 = 0x00000003;
+pub const SMB_NTSTATUS_WAIT_63: u32 = 0x0000003f;
+pub const SMB_NTSTATUS_ABANDONED: u32 = 0x00000080;
+pub const SMB_NTSTATUS_ABANDONED_WAIT_63: u32 = 0x000000bf;
+pub const SMB_NTSTATUS_USER_APC: u32 = 0x000000c0;
+pub const SMB_NTSTATUS_ALERTED: u32 = 0x00000101;
+pub const SMB_NTSTATUS_TIMEOUT: u32 = 0x00000102;
+pub const SMB_NTSTATUS_PENDING: u32 = 0x00000103;
+pub const SMB_NTSTATUS_REPARSE: u32 = 0x00000104;
+pub const SMB_NTSTATUS_MORE_ENTRIES: u32 = 0x00000105;
+pub const SMB_NTSTATUS_NOT_ALL_ASSIGNED: u32 = 0x00000106;
+pub const SMB_NTSTATUS_SOME_NOT_MAPPED: u32 = 0x00000107;
+pub const SMB_NTSTATUS_OPLOCK_BREAK_IN_PROGRESS: u32 = 0x00000108;
+pub const SMB_NTSTATUS_VOLUME_MOUNTED: u32 = 0x00000109;
+pub const SMB_NTSTATUS_RXACT_COMMITTED: u32 = 0x0000010a;
+pub const SMB_NTSTATUS_NOTIFY_CLEANUP: u32 = 0x0000010b;
+pub const SMB_NTSTATUS_NOTIFY_ENUM_DIR: u32 = 0x0000010c;
+pub const SMB_NTSTATUS_NO_QUOTAS_FOR_ACCOUNT: u32 = 0x0000010d;
+pub const SMB_NTSTATUS_PRIMARY_TRANSPORT_CONNECT_FAILED: u32 = 0x0000010e;
+pub const SMB_NTSTATUS_PAGE_FAULT_TRANSITION: u32 = 0x00000110;
+pub const SMB_NTSTATUS_PAGE_FAULT_DEMAND_ZERO: u32 = 0x00000111;
+pub const SMB_NTSTATUS_PAGE_FAULT_COPY_ON_WRITE: u32 = 0x00000112;
+pub const SMB_NTSTATUS_PAGE_FAULT_GUARD_PAGE: u32 = 0x00000113;
+pub const SMB_NTSTATUS_PAGE_FAULT_PAGING_FILE: u32 = 0x00000114;
+pub const SMB_NTSTATUS_CACHE_PAGE_LOCKED: u32 = 0x00000115;
+pub const SMB_NTSTATUS_CRASH_DUMP: u32 = 0x00000116;
+pub const SMB_NTSTATUS_BUFFER_ALL_ZEROS: u32 = 0x00000117;
+pub const SMB_NTSTATUS_REPARSE_OBJECT: u32 = 0x00000118;
+pub const SMB_NTSTATUS_RESOURCE_REQUIREMENTS_CHANGED: u32 = 0x00000119;
+pub const SMB_NTSTATUS_TRANSLATION_COMPLETE: u32 = 0x00000120;
+pub const SMB_NTSTATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY: u32 = 0x00000121;
+pub const SMB_NTSTATUS_NOTHING_TO_TERMINATE: u32 = 0x00000122;
+pub const SMB_NTSTATUS_PROCESS_NOT_IN_JOB: u32 = 0x00000123;
+pub const SMB_NTSTATUS_PROCESS_IN_JOB: u32 = 0x00000124;
+pub const SMB_NTSTATUS_VOLSNAP_HIBERNATE_READY: u32 = 0x00000125;
+pub const SMB_NTSTATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY: u32 = 0x00000126;
+pub const SMB_NTSTATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED: u32 = 0x00000127;
+pub const SMB_NTSTATUS_INTERRUPT_STILL_CONNECTED: u32 = 0x00000128;
+pub const SMB_NTSTATUS_PROCESS_CLONED: u32 = 0x00000129;
+pub const SMB_NTSTATUS_FILE_LOCKED_WITH_ONLY_READERS: u32 = 0x0000012a;
+pub const SMB_NTSTATUS_FILE_LOCKED_WITH_WRITERS: u32 = 0x0000012b;
+pub const SMB_NTSTATUS_RESOURCEMANAGER_READ_ONLY: u32 = 0x00000202;
+pub const SMB_NTSTATUS_WAIT_FOR_OPLOCK: u32 = 0x00000367;
+pub const SMB_NTDBG_EXCEPTION_HANDLED: u32 = 0x00010001;
+pub const SMB_NTDBG_CONTINUE: u32 = 0x00010002;
+pub const SMB_NTSTATUS_FLT_IO_COMPLETE: u32 = 0x001c0001;
+pub const SMB_NTSTATUS_FILE_NOT_AVAILABLE: u32 = 0xc0000467;
+pub const SMB_NTSTATUS_SHARE_UNAVAILABLE: u32 = 0xc0000480;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_THREAD_AFFINITY: u32 = 0xc0000721;
+pub const SMB_NTSTATUS_OBJECT_NAME_EXISTS: u32 = 0x40000000;
+pub const SMB_NTSTATUS_THREAD_WAS_SUSPENDED: u32 = 0x40000001;
+pub const SMB_NTSTATUS_WORKING_SET_LIMIT_RANGE: u32 = 0x40000002;
+pub const SMB_NTSTATUS_IMAGE_NOT_AT_BASE: u32 = 0x40000003;
+pub const SMB_NTSTATUS_RXACT_STATE_CREATED: u32 = 0x40000004;
+pub const SMB_NTSTATUS_SEGMENT_NOTIFICATION: u32 = 0x40000005;
+pub const SMB_NTSTATUS_LOCAL_USER_SESSION_KEY: u32 = 0x40000006;
+pub const SMB_NTSTATUS_BAD_CURRENT_DIRECTORY: u32 = 0x40000007;
+pub const SMB_NTSTATUS_SERIAL_MORE_WRITES: u32 = 0x40000008;
+pub const SMB_NTSTATUS_REGISTRY_RECOVERED: u32 = 0x40000009;
+pub const SMB_NTSTATUS_FT_READ_RECOVERY_FROM_BACKUP: u32 = 0x4000000a;
+pub const SMB_NTSTATUS_FT_WRITE_RECOVERY: u32 = 0x4000000b;
+pub const SMB_NTSTATUS_SERIAL_COUNTER_TIMEOUT: u32 = 0x4000000c;
+pub const SMB_NTSTATUS_NULL_LM_PASSWORD: u32 = 0x4000000d;
+pub const SMB_NTSTATUS_IMAGE_MACHINE_TYPE_MISMATCH: u32 = 0x4000000e;
+pub const SMB_NTSTATUS_RECEIVE_PARTIAL: u32 = 0x4000000f;
+pub const SMB_NTSTATUS_RECEIVE_EXPEDITED: u32 = 0x40000010;
+pub const SMB_NTSTATUS_RECEIVE_PARTIAL_EXPEDITED: u32 = 0x40000011;
+pub const SMB_NTSTATUS_EVENT_DONE: u32 = 0x40000012;
+pub const SMB_NTSTATUS_EVENT_PENDING: u32 = 0x40000013;
+pub const SMB_NTSTATUS_CHECKING_FILE_SYSTEM: u32 = 0x40000014;
+pub const SMB_NTSTATUS_FATAL_APP_EXIT: u32 = 0x40000015;
+pub const SMB_NTSTATUS_PREDEFINED_HANDLE: u32 = 0x40000016;
+pub const SMB_NTSTATUS_WAS_UNLOCKED: u32 = 0x40000017;
+pub const SMB_NTSTATUS_SERVICE_NOTIFICATION: u32 = 0x40000018;
+pub const SMB_NTSTATUS_WAS_LOCKED: u32 = 0x40000019;
+pub const SMB_NTSTATUS_LOG_HARD_ERROR: u32 = 0x4000001a;
+pub const SMB_NTSTATUS_ALREADY_WIN32: u32 = 0x4000001b;
+pub const SMB_NTSTATUS_WX86_UNSIMULATE: u32 = 0x4000001c;
+pub const SMB_NTSTATUS_WX86_CONTINUE: u32 = 0x4000001d;
+pub const SMB_NTSTATUS_WX86_SINGLE_STEP: u32 = 0x4000001e;
+pub const SMB_NTSTATUS_WX86_BREAKPOINT: u32 = 0x4000001f;
+pub const SMB_NTSTATUS_WX86_EXCEPTION_CONTINUE: u32 = 0x40000020;
+pub const SMB_NTSTATUS_WX86_EXCEPTION_LASTCHANCE: u32 = 0x40000021;
+pub const SMB_NTSTATUS_WX86_EXCEPTION_CHAIN: u32 = 0x40000022;
+pub const SMB_NTSTATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE: u32 = 0x40000023;
+pub const SMB_NTSTATUS_NO_YIELD_PERFORMED: u32 = 0x40000024;
+pub const SMB_NTSTATUS_TIMER_RESUME_IGNORED: u32 = 0x40000025;
+pub const SMB_NTSTATUS_ARBITRATION_UNHANDLED: u32 = 0x40000026;
+pub const SMB_NTSTATUS_CARDBUS_NOT_SUPPORTED: u32 = 0x40000027;
+pub const SMB_NTSTATUS_WX86_CREATEWX86TIB: u32 = 0x40000028;
+pub const SMB_NTSTATUS_MP_PROCESSOR_MISMATCH: u32 = 0x40000029;
+pub const SMB_NTSTATUS_HIBERNATED: u32 = 0x4000002a;
+pub const SMB_NTSTATUS_RESUME_HIBERNATION: u32 = 0x4000002b;
+pub const SMB_NTSTATUS_FIRMWARE_UPDATED: u32 = 0x4000002c;
+pub const SMB_NTSTATUS_DRIVERS_LEAKING_LOCKED_PAGES: u32 = 0x4000002d;
+pub const SMB_NTSTATUS_MESSAGE_RETRIEVED: u32 = 0x4000002e;
+pub const SMB_NTSTATUS_SYSTEM_POWERSTATE_TRANSITION: u32 = 0x4000002f;
+pub const SMB_NTSTATUS_ALPC_CHECK_COMPLETION_LIST: u32 = 0x40000030;
+pub const SMB_NTSTATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION: u32 = 0x40000031;
+pub const SMB_NTSTATUS_ACCESS_AUDIT_BY_POLICY: u32 = 0x40000032;
+pub const SMB_NTSTATUS_ABANDON_HIBERFILE: u32 = 0x40000033;
+pub const SMB_NTSTATUS_BIZRULES_NOT_ENABLED: u32 = 0x40000034;
+pub const SMB_NTSTATUS_WAKE_SYSTEM: u32 = 0x40000294;
+pub const SMB_NTSTATUS_DS_SHUTTING_DOWN: u32 = 0x40000370;
+pub const SMB_NTDBG_REPLY_LATER: u32 = 0x40010001;
+pub const SMB_NTDBG_UNABLE_TO_PROVIDE_HANDLE: u32 = 0x40010002;
+pub const SMB_NTDBG_TERMINATE_THREAD: u32 = 0x40010003;
+pub const SMB_NTDBG_TERMINATE_PROCESS: u32 = 0x40010004;
+pub const SMB_NTDBG_CONTROL_C: u32 = 0x40010005;
+pub const SMB_NTDBG_PRINTEXCEPTION_C: u32 = 0x40010006;
+pub const SMB_NTDBG_RIPEXCEPTION: u32 = 0x40010007;
+pub const SMB_NTDBG_CONTROL_BREAK: u32 = 0x40010008;
+pub const SMB_NTDBG_COMMAND_EXCEPTION: u32 = 0x40010009;
+pub const SMB_NTRPC_NT_UUID_LOCAL_ONLY: u32 = 0x40020056;
+pub const SMB_NTRPC_NT_SEND_INCOMPLETE: u32 = 0x400200af;
+pub const SMB_NTSTATUS_CTX_CDM_CONNECT: u32 = 0x400a0004;
+pub const SMB_NTSTATUS_CTX_CDM_DISCONNECT: u32 = 0x400a0005;
+pub const SMB_NTSTATUS_SXS_RELEASE_ACTIVATION_CONTEXT: u32 = 0x4015000d;
+pub const SMB_NTSTATUS_RECOVERY_NOT_NEEDED: u32 = 0x40190034;
+pub const SMB_NTSTATUS_RM_ALREADY_STARTED: u32 = 0x40190035;
+pub const SMB_NTSTATUS_LOG_NO_RESTART: u32 = 0x401a000c;
+pub const SMB_NTSTATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST: u32 = 0x401b00ec;
+pub const SMB_NTSTATUS_GRAPHICS_PARTIAL_DATA_POPULATED: u32 = 0x401e000a;
+pub const SMB_NTSTATUS_GRAPHICS_DRIVER_MISMATCH: u32 = 0x401e0117;
+pub const SMB_NTSTATUS_GRAPHICS_MODE_NOT_PINNED: u32 = 0x401e0307;
+pub const SMB_NTSTATUS_GRAPHICS_NO_PREFERRED_MODE: u32 = 0x401e031e;
+pub const SMB_NTSTATUS_GRAPHICS_DATASET_IS_EMPTY: u32 = 0x401e034b;
+pub const SMB_NTSTATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET: u32 = 0x401e034c;
+pub const SMB_NTSTATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED: u32 = 0x401e0351;
+pub const SMB_NTSTATUS_GRAPHICS_UNKNOWN_CHILD_STATUS: u32 = 0x401e042f;
+pub const SMB_NTSTATUS_GRAPHICS_LEADLINK_START_DEFERRED: u32 = 0x401e0437;
+pub const SMB_NTSTATUS_GRAPHICS_POLLING_TOO_FREQUENTLY: u32 = 0x401e0439;
+pub const SMB_NTSTATUS_GRAPHICS_START_DEFERRED: u32 = 0x401e043a;
+pub const SMB_NTSTATUS_NDIS_INDICATION_REQUIRED: u32 = 0x40230001;
+pub const SMB_NTSTATUS_GUARD_PAGE_VIOLATION: u32 = 0x80000001;
+pub const SMB_NTSTATUS_DATATYPE_MISALIGNMENT: u32 = 0x80000002;
+pub const SMB_NTSTATUS_BREAKPOINT: u32 = 0x80000003;
+pub const SMB_NTSTATUS_SINGLE_STEP: u32 = 0x80000004;
+pub const SMB_NTSTATUS_BUFFER_OVERFLOW: u32 = 0x80000005;
+pub const SMB_NTSTATUS_NO_MORE_FILES: u32 = 0x80000006;
+pub const SMB_NTSTATUS_WAKE_SYSTEM_DEBUGGER: u32 = 0x80000007;
+pub const SMB_NTSTATUS_HANDLES_CLOSED: u32 = 0x8000000a;
+pub const SMB_NTSTATUS_NO_INHERITANCE: u32 = 0x8000000b;
+pub const SMB_NTSTATUS_GUID_SUBSTITUTION_MADE: u32 = 0x8000000c;
+pub const SMB_NTSTATUS_PARTIAL_COPY: u32 = 0x8000000d;
+pub const SMB_NTSTATUS_DEVICE_PAPER_EMPTY: u32 = 0x8000000e;
+pub const SMB_NTSTATUS_DEVICE_POWERED_OFF: u32 = 0x8000000f;
+pub const SMB_NTSTATUS_DEVICE_OFF_LINE: u32 = 0x80000010;
+pub const SMB_NTSTATUS_DEVICE_BUSY: u32 = 0x80000011;
+pub const SMB_NTSTATUS_NO_MORE_EAS: u32 = 0x80000012;
+pub const SMB_NTSTATUS_INVALID_EA_NAME: u32 = 0x80000013;
+pub const SMB_NTSTATUS_EA_LIST_INCONSISTENT: u32 = 0x80000014;
+pub const SMB_NTSTATUS_INVALID_EA_FLAG: u32 = 0x80000015;
+pub const SMB_NTSTATUS_VERIFY_REQUIRED: u32 = 0x80000016;
+pub const SMB_NTSTATUS_EXTRANEOUS_INFORMATION: u32 = 0x80000017;
+pub const SMB_NTSTATUS_RXACT_COMMIT_NECESSARY: u32 = 0x80000018;
+pub const SMB_NTSTATUS_NO_MORE_ENTRIES: u32 = 0x8000001a;
+pub const SMB_NTSTATUS_FILEMARK_DETECTED: u32 = 0x8000001b;
+pub const SMB_NTSTATUS_MEDIA_CHANGED: u32 = 0x8000001c;
+pub const SMB_NTSTATUS_BUS_RESET: u32 = 0x8000001d;
+pub const SMB_NTSTATUS_END_OF_MEDIA: u32 = 0x8000001e;
+pub const SMB_NTSTATUS_BEGINNING_OF_MEDIA: u32 = 0x8000001f;
+pub const SMB_NTSTATUS_MEDIA_CHECK: u32 = 0x80000020;
+pub const SMB_NTSTATUS_SETMARK_DETECTED: u32 = 0x80000021;
+pub const SMB_NTSTATUS_NO_DATA_DETECTED: u32 = 0x80000022;
+pub const SMB_NTSTATUS_REDIRECTOR_HAS_OPEN_HANDLES: u32 = 0x80000023;
+pub const SMB_NTSTATUS_SERVER_HAS_OPEN_HANDLES: u32 = 0x80000024;
+pub const SMB_NTSTATUS_ALREADY_DISCONNECTED: u32 = 0x80000025;
+pub const SMB_NTSTATUS_LONGJUMP: u32 = 0x80000026;
+pub const SMB_NTSTATUS_CLEANER_CARTRIDGE_INSTALLED: u32 = 0x80000027;
+pub const SMB_NTSTATUS_PLUGPLAY_QUERY_VETOED: u32 = 0x80000028;
+pub const SMB_NTSTATUS_UNWIND_CONSOLIDATE: u32 = 0x80000029;
+pub const SMB_NTSTATUS_REGISTRY_HIVE_RECOVERED: u32 = 0x8000002a;
+pub const SMB_NTSTATUS_DLL_MIGHT_BE_INSECURE: u32 = 0x8000002b;
+pub const SMB_NTSTATUS_DLL_MIGHT_BE_INCOMPATIBLE: u32 = 0x8000002c;
+pub const SMB_NTSTATUS_STOPPED_ON_SYMLINK: u32 = 0x8000002d;
+pub const SMB_NTSTATUS_DEVICE_REQUIRES_CLEANING: u32 = 0x80000288;
+pub const SMB_NTSTATUS_DEVICE_DOOR_OPEN: u32 = 0x80000289;
+pub const SMB_NTSTATUS_DATA_LOST_REPAIR: u32 = 0x80000803;
+pub const SMB_NTDBG_EXCEPTION_NOT_HANDLED: u32 = 0x80010001;
+pub const SMB_NTSTATUS_CLUSTER_NODE_ALREADY_UP: u32 = 0x80130001;
+pub const SMB_NTSTATUS_CLUSTER_NODE_ALREADY_DOWN: u32 = 0x80130002;
+pub const SMB_NTSTATUS_CLUSTER_NETWORK_ALREADY_ONLINE: u32 = 0x80130003;
+pub const SMB_NTSTATUS_CLUSTER_NETWORK_ALREADY_OFFLINE: u32 = 0x80130004;
+pub const SMB_NTSTATUS_CLUSTER_NODE_ALREADY_MEMBER: u32 = 0x80130005;
+pub const SMB_NTSTATUS_COULD_NOT_RESIZE_LOG: u32 = 0x80190009;
+pub const SMB_NTSTATUS_NO_TXF_METADATA: u32 = 0x80190029;
+pub const SMB_NTSTATUS_CANT_RECOVER_WITH_HANDLE_OPEN: u32 = 0x80190031;
+pub const SMB_NTSTATUS_TXF_METADATA_ALREADY_PRESENT: u32 = 0x80190041;
+pub const SMB_NTSTATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET: u32 = 0x80190042;
+pub const SMB_NTSTATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED: u32 = 0x801b00eb;
+pub const SMB_NTSTATUS_FLT_BUFFER_TOO_SMALL: u32 = 0x801c0001;
+pub const SMB_NTSTATUS_FVE_PARTIAL_METADATA: u32 = 0x80210001;
+pub const SMB_NTSTATUS_FVE_TRANSIENT_STATE: u32 = 0x80210002;
+pub const SMB_NTSTATUS_UNSUCCESSFUL: u32 = 0xc0000001;
+pub const SMB_NTSTATUS_NOT_IMPLEMENTED: u32 = 0xc0000002;
+pub const SMB_NTSTATUS_INVALID_INFO_CLASS: u32 = 0xc0000003;
+pub const SMB_NTSTATUS_INFO_LENGTH_MISMATCH: u32 = 0xc0000004;
+pub const SMB_NTSTATUS_ACCESS_VIOLATION: u32 = 0xc0000005;
+pub const SMB_NTSTATUS_IN_PAGE_ERROR: u32 = 0xc0000006;
+pub const SMB_NTSTATUS_PAGEFILE_QUOTA: u32 = 0xc0000007;
+pub const SMB_NTSTATUS_INVALID_HANDLE: u32 = 0xc0000008;
+pub const SMB_NTSTATUS_BAD_INITIAL_STACK: u32 = 0xc0000009;
+pub const SMB_NTSTATUS_BAD_INITIAL_PC: u32 = 0xc000000a;
+pub const SMB_NTSTATUS_INVALID_CID: u32 = 0xc000000b;
+pub const SMB_NTSTATUS_TIMER_NOT_CANCELED: u32 = 0xc000000c;
+pub const SMB_NTSTATUS_INVALID_PARAMETER: u32 = 0xc000000d;
+pub const SMB_NTSTATUS_NO_SUCH_DEVICE: u32 = 0xc000000e;
+pub const SMB_NTSTATUS_NO_SUCH_FILE: u32 = 0xc000000f;
+pub const SMB_NTSTATUS_INVALID_DEVICE_REQUEST: u32 = 0xc0000010;
+pub const SMB_NTSTATUS_END_OF_FILE: u32 = 0xc0000011;
+pub const SMB_NTSTATUS_WRONG_VOLUME: u32 = 0xc0000012;
+pub const SMB_NTSTATUS_NO_MEDIA_IN_DEVICE: u32 = 0xc0000013;
+pub const SMB_NTSTATUS_UNRECOGNIZED_MEDIA: u32 = 0xc0000014;
+pub const SMB_NTSTATUS_NONEXISTENT_SECTOR: u32 = 0xc0000015;
+pub const SMB_NTSTATUS_MORE_PROCESSING_REQUIRED: u32 = 0xc0000016;
+pub const SMB_NTSTATUS_NO_MEMORY: u32 = 0xc0000017;
+pub const SMB_NTSTATUS_CONFLICTING_ADDRESSES: u32 = 0xc0000018;
+pub const SMB_NTSTATUS_NOT_MAPPED_VIEW: u32 = 0xc0000019;
+pub const SMB_NTSTATUS_UNABLE_TO_FREE_VM: u32 = 0xc000001a;
+pub const SMB_NTSTATUS_UNABLE_TO_DELETE_SECTION: u32 = 0xc000001b;
+pub const SMB_NTSTATUS_INVALID_SYSTEM_SERVICE: u32 = 0xc000001c;
+pub const SMB_NTSTATUS_ILLEGAL_INSTRUCTION: u32 = 0xc000001d;
+pub const SMB_NTSTATUS_INVALID_LOCK_SEQUENCE: u32 = 0xc000001e;
+pub const SMB_NTSTATUS_INVALID_VIEW_SIZE: u32 = 0xc000001f;
+pub const SMB_NTSTATUS_INVALID_FILE_FOR_SECTION: u32 = 0xc0000020;
+pub const SMB_NTSTATUS_ALREADY_COMMITTED: u32 = 0xc0000021;
+pub const SMB_NTSTATUS_ACCESS_DENIED: u32 = 0xc0000022;
+pub const SMB_NTSTATUS_BUFFER_TOO_SMALL: u32 = 0xc0000023;
+pub const SMB_NTSTATUS_OBJECT_TYPE_MISMATCH: u32 = 0xc0000024;
+pub const SMB_NTSTATUS_NONCONTINUABLE_EXCEPTION: u32 = 0xc0000025;
+pub const SMB_NTSTATUS_INVALID_DISPOSITION: u32 = 0xc0000026;
+pub const SMB_NTSTATUS_UNWIND: u32 = 0xc0000027;
+pub const SMB_NTSTATUS_BAD_STACK: u32 = 0xc0000028;
+pub const SMB_NTSTATUS_INVALID_UNWIND_TARGET: u32 = 0xc0000029;
+pub const SMB_NTSTATUS_NOT_LOCKED: u32 = 0xc000002a;
+pub const SMB_NTSTATUS_PARITY_ERROR: u32 = 0xc000002b;
+pub const SMB_NTSTATUS_UNABLE_TO_DECOMMIT_VM: u32 = 0xc000002c;
+pub const SMB_NTSTATUS_NOT_COMMITTED: u32 = 0xc000002d;
+pub const SMB_NTSTATUS_INVALID_PORT_ATTRIBUTES: u32 = 0xc000002e;
+pub const SMB_NTSTATUS_PORT_MESSAGE_TOO_LONG: u32 = 0xc000002f;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_MIX: u32 = 0xc0000030;
+pub const SMB_NTSTATUS_INVALID_QUOTA_LOWER: u32 = 0xc0000031;
+pub const SMB_NTSTATUS_DISK_CORRUPT_ERROR: u32 = 0xc0000032;
+pub const SMB_NTSTATUS_OBJECT_NAME_INVALID: u32 = 0xc0000033;
+pub const SMB_NTSTATUS_OBJECT_NAME_NOT_FOUND: u32 = 0xc0000034;
+pub const SMB_NTSTATUS_OBJECT_NAME_COLLISION: u32 = 0xc0000035;
+pub const SMB_NTSTATUS_PORT_DISCONNECTED: u32 = 0xc0000037;
+pub const SMB_NTSTATUS_DEVICE_ALREADY_ATTACHED: u32 = 0xc0000038;
+pub const SMB_NTSTATUS_OBJECT_PATH_INVALID: u32 = 0xc0000039;
+pub const SMB_NTSTATUS_OBJECT_PATH_NOT_FOUND: u32 = 0xc000003a;
+pub const SMB_NTSTATUS_OBJECT_PATH_SYNTAX_BAD: u32 = 0xc000003b;
+pub const SMB_NTSTATUS_DATA_OVERRUN: u32 = 0xc000003c;
+pub const SMB_NTSTATUS_DATA_LATE_ERROR: u32 = 0xc000003d;
+pub const SMB_NTSTATUS_DATA_ERROR: u32 = 0xc000003e;
+pub const SMB_NTSTATUS_CRC_ERROR: u32 = 0xc000003f;
+pub const SMB_NTSTATUS_SECTION_TOO_BIG: u32 = 0xc0000040;
+pub const SMB_NTSTATUS_PORT_CONNECTION_REFUSED: u32 = 0xc0000041;
+pub const SMB_NTSTATUS_INVALID_PORT_HANDLE: u32 = 0xc0000042;
+pub const SMB_NTSTATUS_SHARING_VIOLATION: u32 = 0xc0000043;
+pub const SMB_NTSTATUS_QUOTA_EXCEEDED: u32 = 0xc0000044;
+pub const SMB_NTSTATUS_INVALID_PAGE_PROTECTION: u32 = 0xc0000045;
+pub const SMB_NTSTATUS_MUTANT_NOT_OWNED: u32 = 0xc0000046;
+pub const SMB_NTSTATUS_SEMAPHORE_LIMIT_EXCEEDED: u32 = 0xc0000047;
+pub const SMB_NTSTATUS_PORT_ALREADY_SET: u32 = 0xc0000048;
+pub const SMB_NTSTATUS_SECTION_NOT_IMAGE: u32 = 0xc0000049;
+pub const SMB_NTSTATUS_SUSPEND_COUNT_EXCEEDED: u32 = 0xc000004a;
+pub const SMB_NTSTATUS_THREAD_IS_TERMINATING: u32 = 0xc000004b;
+pub const SMB_NTSTATUS_BAD_WORKING_SET_LIMIT: u32 = 0xc000004c;
+pub const SMB_NTSTATUS_INCOMPATIBLE_FILE_MAP: u32 = 0xc000004d;
+pub const SMB_NTSTATUS_SECTION_PROTECTION: u32 = 0xc000004e;
+pub const SMB_NTSTATUS_EAS_NOT_SUPPORTED: u32 = 0xc000004f;
+pub const SMB_NTSTATUS_EA_TOO_LARGE: u32 = 0xc0000050;
+pub const SMB_NTSTATUS_NONEXISTENT_EA_ENTRY: u32 = 0xc0000051;
+pub const SMB_NTSTATUS_NO_EAS_ON_FILE: u32 = 0xc0000052;
+pub const SMB_NTSTATUS_EA_CORRUPT_ERROR: u32 = 0xc0000053;
+pub const SMB_NTSTATUS_FILE_LOCK_CONFLICT: u32 = 0xc0000054;
+pub const SMB_NTSTATUS_LOCK_NOT_GRANTED: u32 = 0xc0000055;
+pub const SMB_NTSTATUS_DELETE_PENDING: u32 = 0xc0000056;
+pub const SMB_NTSTATUS_CTL_FILE_NOT_SUPPORTED: u32 = 0xc0000057;
+pub const SMB_NTSTATUS_UNKNOWN_REVISION: u32 = 0xc0000058;
+pub const SMB_NTSTATUS_REVISION_MISMATCH: u32 = 0xc0000059;
+pub const SMB_NTSTATUS_INVALID_OWNER: u32 = 0xc000005a;
+pub const SMB_NTSTATUS_INVALID_PRIMARY_GROUP: u32 = 0xc000005b;
+pub const SMB_NTSTATUS_NO_IMPERSONATION_TOKEN: u32 = 0xc000005c;
+pub const SMB_NTSTATUS_CANT_DISABLE_MANDATORY: u32 = 0xc000005d;
+pub const SMB_NTSTATUS_NO_LOGON_SERVERS: u32 = 0xc000005e;
+pub const SMB_NTSTATUS_NO_SUCH_LOGON_SESSION: u32 = 0xc000005f;
+pub const SMB_NTSTATUS_NO_SUCH_PRIVILEGE: u32 = 0xc0000060;
+pub const SMB_NTSTATUS_PRIVILEGE_NOT_HELD: u32 = 0xc0000061;
+pub const SMB_NTSTATUS_INVALID_ACCOUNT_NAME: u32 = 0xc0000062;
+pub const SMB_NTSTATUS_USER_EXISTS: u32 = 0xc0000063;
+pub const SMB_NTSTATUS_NO_SUCH_USER: u32 = 0xc0000064;
+pub const SMB_NTSTATUS_GROUP_EXISTS: u32 = 0xc0000065;
+pub const SMB_NTSTATUS_NO_SUCH_GROUP: u32 = 0xc0000066;
+pub const SMB_NTSTATUS_MEMBER_IN_GROUP: u32 = 0xc0000067;
+pub const SMB_NTSTATUS_MEMBER_NOT_IN_GROUP: u32 = 0xc0000068;
+pub const SMB_NTSTATUS_LAST_ADMIN: u32 = 0xc0000069;
+pub const SMB_NTSTATUS_WRONG_PASSWORD: u32 = 0xc000006a;
+pub const SMB_NTSTATUS_ILL_FORMED_PASSWORD: u32 = 0xc000006b;
+pub const SMB_NTSTATUS_PASSWORD_RESTRICTION: u32 = 0xc000006c;
+pub const SMB_NTSTATUS_LOGON_FAILURE: u32 = 0xc000006d;
+pub const SMB_NTSTATUS_ACCOUNT_RESTRICTION: u32 = 0xc000006e;
+pub const SMB_NTSTATUS_INVALID_LOGON_HOURS: u32 = 0xc000006f;
+pub const SMB_NTSTATUS_INVALID_WORKSTATION: u32 = 0xc0000070;
+pub const SMB_NTSTATUS_PASSWORD_EXPIRED: u32 = 0xc0000071;
+pub const SMB_NTSTATUS_ACCOUNT_DISABLED: u32 = 0xc0000072;
+pub const SMB_NTSTATUS_NONE_MAPPED: u32 = 0xc0000073;
+pub const SMB_NTSTATUS_TOO_MANY_LUIDS_REQUESTED: u32 = 0xc0000074;
+pub const SMB_NTSTATUS_LUIDS_EXHAUSTED: u32 = 0xc0000075;
+pub const SMB_NTSTATUS_INVALID_SUB_AUTHORITY: u32 = 0xc0000076;
+pub const SMB_NTSTATUS_INVALID_ACL: u32 = 0xc0000077;
+pub const SMB_NTSTATUS_INVALID_SID: u32 = 0xc0000078;
+pub const SMB_NTSTATUS_INVALID_SECURITY_DESCR: u32 = 0xc0000079;
+pub const SMB_NTSTATUS_PROCEDURE_NOT_FOUND: u32 = 0xc000007a;
+pub const SMB_NTSTATUS_INVALID_IMAGE_FORMAT: u32 = 0xc000007b;
+pub const SMB_NTSTATUS_NO_TOKEN: u32 = 0xc000007c;
+pub const SMB_NTSTATUS_BAD_INHERITANCE_ACL: u32 = 0xc000007d;
+pub const SMB_NTSTATUS_RANGE_NOT_LOCKED: u32 = 0xc000007e;
+pub const SMB_NTSTATUS_DISK_FULL: u32 = 0xc000007f;
+pub const SMB_NTSTATUS_SERVER_DISABLED: u32 = 0xc0000080;
+pub const SMB_NTSTATUS_SERVER_NOT_DISABLED: u32 = 0xc0000081;
+pub const SMB_NTSTATUS_TOO_MANY_GUIDS_REQUESTED: u32 = 0xc0000082;
+pub const SMB_NTSTATUS_GUIDS_EXHAUSTED: u32 = 0xc0000083;
+pub const SMB_NTSTATUS_INVALID_ID_AUTHORITY: u32 = 0xc0000084;
+pub const SMB_NTSTATUS_AGENTS_EXHAUSTED: u32 = 0xc0000085;
+pub const SMB_NTSTATUS_INVALID_VOLUME_LABEL: u32 = 0xc0000086;
+pub const SMB_NTSTATUS_SECTION_NOT_EXTENDED: u32 = 0xc0000087;
+pub const SMB_NTSTATUS_NOT_MAPPED_DATA: u32 = 0xc0000088;
+pub const SMB_NTSTATUS_RESOURCE_DATA_NOT_FOUND: u32 = 0xc0000089;
+pub const SMB_NTSTATUS_RESOURCE_TYPE_NOT_FOUND: u32 = 0xc000008a;
+pub const SMB_NTSTATUS_RESOURCE_NAME_NOT_FOUND: u32 = 0xc000008b;
+pub const SMB_NTSTATUS_ARRAY_BOUNDS_EXCEEDED: u32 = 0xc000008c;
+pub const SMB_NTSTATUS_FLOAT_DENORMAL_OPERAND: u32 = 0xc000008d;
+pub const SMB_NTSTATUS_FLOAT_DIVIDE_BY_ZERO: u32 = 0xc000008e;
+pub const SMB_NTSTATUS_FLOAT_INEXACT_RESULT: u32 = 0xc000008f;
+pub const SMB_NTSTATUS_FLOAT_INVALID_OPERATION: u32 = 0xc0000090;
+pub const SMB_NTSTATUS_FLOAT_OVERFLOW: u32 = 0xc0000091;
+pub const SMB_NTSTATUS_FLOAT_STACK_CHECK: u32 = 0xc0000092;
+pub const SMB_NTSTATUS_FLOAT_UNDERFLOW: u32 = 0xc0000093;
+pub const SMB_NTSTATUS_INTEGER_DIVIDE_BY_ZERO: u32 = 0xc0000094;
+pub const SMB_NTSTATUS_INTEGER_OVERFLOW: u32 = 0xc0000095;
+pub const SMB_NTSTATUS_PRIVILEGED_INSTRUCTION: u32 = 0xc0000096;
+pub const SMB_NTSTATUS_TOO_MANY_PAGING_FILES: u32 = 0xc0000097;
+pub const SMB_NTSTATUS_FILE_INVALID: u32 = 0xc0000098;
+pub const SMB_NTSTATUS_ALLOTTED_SPACE_EXCEEDED: u32 = 0xc0000099;
+pub const SMB_NTSTATUS_INSUFFICIENT_RESOURCES: u32 = 0xc000009a;
+pub const SMB_NTSTATUS_DFS_EXIT_PATH_FOUND: u32 = 0xc000009b;
+pub const SMB_NTSTATUS_DEVICE_DATA_ERROR: u32 = 0xc000009c;
+pub const SMB_NTSTATUS_DEVICE_NOT_CONNECTED: u32 = 0xc000009d;
+pub const SMB_NTSTATUS_FREE_VM_NOT_AT_BASE: u32 = 0xc000009f;
+pub const SMB_NTSTATUS_MEMORY_NOT_ALLOCATED: u32 = 0xc00000a0;
+pub const SMB_NTSTATUS_WORKING_SET_QUOTA: u32 = 0xc00000a1;
+pub const SMB_NTSTATUS_MEDIA_WRITE_PROTECTED: u32 = 0xc00000a2;
+pub const SMB_NTSTATUS_DEVICE_NOT_READY: u32 = 0xc00000a3;
+pub const SMB_NTSTATUS_INVALID_GROUP_ATTRIBUTES: u32 = 0xc00000a4;
+pub const SMB_NTSTATUS_BAD_IMPERSONATION_LEVEL: u32 = 0xc00000a5;
+pub const SMB_NTSTATUS_CANT_OPEN_ANONYMOUS: u32 = 0xc00000a6;
+pub const SMB_NTSTATUS_BAD_VALIDATION_CLASS: u32 = 0xc00000a7;
+pub const SMB_NTSTATUS_BAD_TOKEN_TYPE: u32 = 0xc00000a8;
+pub const SMB_NTSTATUS_BAD_MASTER_BOOT_RECORD: u32 = 0xc00000a9;
+pub const SMB_NTSTATUS_INSTRUCTION_MISALIGNMENT: u32 = 0xc00000aa;
+pub const SMB_NTSTATUS_INSTANCE_NOT_AVAILABLE: u32 = 0xc00000ab;
+pub const SMB_NTSTATUS_PIPE_NOT_AVAILABLE: u32 = 0xc00000ac;
+pub const SMB_NTSTATUS_INVALID_PIPE_STATE: u32 = 0xc00000ad;
+pub const SMB_NTSTATUS_PIPE_BUSY: u32 = 0xc00000ae;
+pub const SMB_NTSTATUS_ILLEGAL_FUNCTION: u32 = 0xc00000af;
+pub const SMB_NTSTATUS_PIPE_DISCONNECTED: u32 = 0xc00000b0;
+pub const SMB_NTSTATUS_PIPE_CLOSING: u32 = 0xc00000b1;
+pub const SMB_NTSTATUS_PIPE_CONNECTED: u32 = 0xc00000b2;
+pub const SMB_NTSTATUS_PIPE_LISTENING: u32 = 0xc00000b3;
+pub const SMB_NTSTATUS_INVALID_READ_MODE: u32 = 0xc00000b4;
+pub const SMB_NTSTATUS_IO_TIMEOUT: u32 = 0xc00000b5;
+pub const SMB_NTSTATUS_FILE_FORCED_CLOSED: u32 = 0xc00000b6;
+pub const SMB_NTSTATUS_PROFILING_NOT_STARTED: u32 = 0xc00000b7;
+pub const SMB_NTSTATUS_PROFILING_NOT_STOPPED: u32 = 0xc00000b8;
+pub const SMB_NTSTATUS_COULD_NOT_INTERPRET: u32 = 0xc00000b9;
+pub const SMB_NTSTATUS_FILE_IS_A_DIRECTORY: u32 = 0xc00000ba;
+pub const SMB_NTSTATUS_NOT_SUPPORTED: u32 = 0xc00000bb;
+pub const SMB_NTSTATUS_REMOTE_NOT_LISTENING: u32 = 0xc00000bc;
+pub const SMB_NTSTATUS_DUPLICATE_NAME: u32 = 0xc00000bd;
+pub const SMB_NTSTATUS_BAD_NETWORK_PATH: u32 = 0xc00000be;
+pub const SMB_NTSTATUS_NETWORK_BUSY: u32 = 0xc00000bf;
+pub const SMB_NTSTATUS_DEVICE_DOES_NOT_EXIST: u32 = 0xc00000c0;
+pub const SMB_NTSTATUS_TOO_MANY_COMMANDS: u32 = 0xc00000c1;
+pub const SMB_NTSTATUS_ADAPTER_HARDWARE_ERROR: u32 = 0xc00000c2;
+pub const SMB_NTSTATUS_INVALID_NETWORK_RESPONSE: u32 = 0xc00000c3;
+pub const SMB_NTSTATUS_UNEXPECTED_NETWORK_ERROR: u32 = 0xc00000c4;
+pub const SMB_NTSTATUS_BAD_REMOTE_ADAPTER: u32 = 0xc00000c5;
+pub const SMB_NTSTATUS_PRINT_QUEUE_FULL: u32 = 0xc00000c6;
+pub const SMB_NTSTATUS_NO_SPOOL_SPACE: u32 = 0xc00000c7;
+pub const SMB_NTSTATUS_PRINT_CANCELLED: u32 = 0xc00000c8;
+pub const SMB_NTSTATUS_NETWORK_NAME_DELETED: u32 = 0xc00000c9;
+pub const SMB_NTSTATUS_NETWORK_ACCESS_DENIED: u32 = 0xc00000ca;
+pub const SMB_NTSTATUS_BAD_DEVICE_TYPE: u32 = 0xc00000cb;
+pub const SMB_NTSTATUS_BAD_NETWORK_NAME: u32 = 0xc00000cc;
+pub const SMB_NTSTATUS_TOO_MANY_NAMES: u32 = 0xc00000cd;
+pub const SMB_NTSTATUS_TOO_MANY_SESSIONS: u32 = 0xc00000ce;
+pub const SMB_NTSTATUS_SHARING_PAUSED: u32 = 0xc00000cf;
+pub const SMB_NTSTATUS_REQUEST_NOT_ACCEPTED: u32 = 0xc00000d0;
+pub const SMB_NTSTATUS_REDIRECTOR_PAUSED: u32 = 0xc00000d1;
+pub const SMB_NTSTATUS_NET_WRITE_FAULT: u32 = 0xc00000d2;
+pub const SMB_NTSTATUS_PROFILING_AT_LIMIT: u32 = 0xc00000d3;
+pub const SMB_NTSTATUS_NOT_SAME_DEVICE: u32 = 0xc00000d4;
+pub const SMB_NTSTATUS_FILE_RENAMED: u32 = 0xc00000d5;
+pub const SMB_NTSTATUS_VIRTUAL_CIRCUIT_CLOSED: u32 = 0xc00000d6;
+pub const SMB_NTSTATUS_NO_SECURITY_ON_OBJECT: u32 = 0xc00000d7;
+pub const SMB_NTSTATUS_CANT_WAIT: u32 = 0xc00000d8;
+pub const SMB_NTSTATUS_PIPE_EMPTY: u32 = 0xc00000d9;
+pub const SMB_NTSTATUS_CANT_ACCESS_DOMAIN_INFO: u32 = 0xc00000da;
+pub const SMB_NTSTATUS_CANT_TERMINATE_SELF: u32 = 0xc00000db;
+pub const SMB_NTSTATUS_INVALID_SERVER_STATE: u32 = 0xc00000dc;
+pub const SMB_NTSTATUS_INVALID_DOMAIN_STATE: u32 = 0xc00000dd;
+pub const SMB_NTSTATUS_INVALID_DOMAIN_ROLE: u32 = 0xc00000de;
+pub const SMB_NTSTATUS_NO_SUCH_DOMAIN: u32 = 0xc00000df;
+pub const SMB_NTSTATUS_DOMAIN_EXISTS: u32 = 0xc00000e0;
+pub const SMB_NTSTATUS_DOMAIN_LIMIT_EXCEEDED: u32 = 0xc00000e1;
+pub const SMB_NTSTATUS_OPLOCK_NOT_GRANTED: u32 = 0xc00000e2;
+pub const SMB_NTSTATUS_INVALID_OPLOCK_PROTOCOL: u32 = 0xc00000e3;
+pub const SMB_NTSTATUS_INTERNAL_DB_CORRUPTION: u32 = 0xc00000e4;
+pub const SMB_NTSTATUS_INTERNAL_ERROR: u32 = 0xc00000e5;
+pub const SMB_NTSTATUS_GENERIC_NOT_MAPPED: u32 = 0xc00000e6;
+pub const SMB_NTSTATUS_BAD_DESCRIPTOR_FORMAT: u32 = 0xc00000e7;
+pub const SMB_NTSTATUS_INVALID_USER_BUFFER: u32 = 0xc00000e8;
+pub const SMB_NTSTATUS_UNEXPECTED_IO_ERROR: u32 = 0xc00000e9;
+pub const SMB_NTSTATUS_UNEXPECTED_MM_CREATE_ERR: u32 = 0xc00000ea;
+pub const SMB_NTSTATUS_UNEXPECTED_MM_MAP_ERROR: u32 = 0xc00000eb;
+pub const SMB_NTSTATUS_UNEXPECTED_MM_EXTEND_ERR: u32 = 0xc00000ec;
+pub const SMB_NTSTATUS_NOT_LOGON_PROCESS: u32 = 0xc00000ed;
+pub const SMB_NTSTATUS_LOGON_SESSION_EXISTS: u32 = 0xc00000ee;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_1: u32 = 0xc00000ef;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_2: u32 = 0xc00000f0;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_3: u32 = 0xc00000f1;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_4: u32 = 0xc00000f2;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_5: u32 = 0xc00000f3;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_6: u32 = 0xc00000f4;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_7: u32 = 0xc00000f5;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_8: u32 = 0xc00000f6;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_9: u32 = 0xc00000f7;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_10: u32 = 0xc00000f8;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_11: u32 = 0xc00000f9;
+pub const SMB_NTSTATUS_INVALID_PARAMETER_12: u32 = 0xc00000fa;
+pub const SMB_NTSTATUS_REDIRECTOR_NOT_STARTED: u32 = 0xc00000fb;
+pub const SMB_NTSTATUS_REDIRECTOR_STARTED: u32 = 0xc00000fc;
+pub const SMB_NTSTATUS_STACK_OVERFLOW: u32 = 0xc00000fd;
+pub const SMB_NTSTATUS_NO_SUCH_PACKAGE: u32 = 0xc00000fe;
+pub const SMB_NTSTATUS_BAD_FUNCTION_TABLE: u32 = 0xc00000ff;
+pub const SMB_NTSTATUS_VARIABLE_NOT_FOUND: u32 = 0xc0000100;
+pub const SMB_NTSTATUS_DIRECTORY_NOT_EMPTY: u32 = 0xc0000101;
+pub const SMB_NTSTATUS_FILE_CORRUPT_ERROR: u32 = 0xc0000102;
+pub const SMB_NTSTATUS_NOT_A_DIRECTORY: u32 = 0xc0000103;
+pub const SMB_NTSTATUS_BAD_LOGON_SESSION_STATE: u32 = 0xc0000104;
+pub const SMB_NTSTATUS_LOGON_SESSION_COLLISION: u32 = 0xc0000105;
+pub const SMB_NTSTATUS_NAME_TOO_LONG: u32 = 0xc0000106;
+pub const SMB_NTSTATUS_FILES_OPEN: u32 = 0xc0000107;
+pub const SMB_NTSTATUS_CONNECTION_IN_USE: u32 = 0xc0000108;
+pub const SMB_NTSTATUS_MESSAGE_NOT_FOUND: u32 = 0xc0000109;
+pub const SMB_NTSTATUS_PROCESS_IS_TERMINATING: u32 = 0xc000010a;
+pub const SMB_NTSTATUS_INVALID_LOGON_TYPE: u32 = 0xc000010b;
+pub const SMB_NTSTATUS_NO_GUID_TRANSLATION: u32 = 0xc000010c;
+pub const SMB_NTSTATUS_CANNOT_IMPERSONATE: u32 = 0xc000010d;
+pub const SMB_NTSTATUS_IMAGE_ALREADY_LOADED: u32 = 0xc000010e;
+pub const SMB_NTSTATUS_NO_LDT: u32 = 0xc0000117;
+pub const SMB_NTSTATUS_INVALID_LDT_SIZE: u32 = 0xc0000118;
+pub const SMB_NTSTATUS_INVALID_LDT_OFFSET: u32 = 0xc0000119;
+pub const SMB_NTSTATUS_INVALID_LDT_DESCRIPTOR: u32 = 0xc000011a;
+pub const SMB_NTSTATUS_INVALID_IMAGE_NE_FORMAT: u32 = 0xc000011b;
+pub const SMB_NTSTATUS_RXACT_INVALID_STATE: u32 = 0xc000011c;
+pub const SMB_NTSTATUS_RXACT_COMMIT_FAILURE: u32 = 0xc000011d;
+pub const SMB_NTSTATUS_MAPPED_FILE_SIZE_ZERO: u32 = 0xc000011e;
+pub const SMB_NTSTATUS_TOO_MANY_OPENED_FILES: u32 = 0xc000011f;
+pub const SMB_NTSTATUS_CANCELLED: u32 = 0xc0000120;
+pub const SMB_NTSTATUS_CANNOT_DELETE: u32 = 0xc0000121;
+pub const SMB_NTSTATUS_INVALID_COMPUTER_NAME: u32 = 0xc0000122;
+pub const SMB_NTSTATUS_FILE_DELETED: u32 = 0xc0000123;
+pub const SMB_NTSTATUS_SPECIAL_ACCOUNT: u32 = 0xc0000124;
+pub const SMB_NTSTATUS_SPECIAL_GROUP: u32 = 0xc0000125;
+pub const SMB_NTSTATUS_SPECIAL_USER: u32 = 0xc0000126;
+pub const SMB_NTSTATUS_MEMBERS_PRIMARY_GROUP: u32 = 0xc0000127;
+pub const SMB_NTSTATUS_FILE_CLOSED: u32 = 0xc0000128;
+pub const SMB_NTSTATUS_TOO_MANY_THREADS: u32 = 0xc0000129;
+pub const SMB_NTSTATUS_THREAD_NOT_IN_PROCESS: u32 = 0xc000012a;
+pub const SMB_NTSTATUS_TOKEN_ALREADY_IN_USE: u32 = 0xc000012b;
+pub const SMB_NTSTATUS_PAGEFILE_QUOTA_EXCEEDED: u32 = 0xc000012c;
+pub const SMB_NTSTATUS_COMMITMENT_LIMIT: u32 = 0xc000012d;
+pub const SMB_NTSTATUS_INVALID_IMAGE_LE_FORMAT: u32 = 0xc000012e;
+pub const SMB_NTSTATUS_INVALID_IMAGE_NOT_MZ: u32 = 0xc000012f;
+pub const SMB_NTSTATUS_INVALID_IMAGE_PROTECT: u32 = 0xc0000130;
+pub const SMB_NTSTATUS_INVALID_IMAGE_WIN_16: u32 = 0xc0000131;
+pub const SMB_NTSTATUS_LOGON_SERVER_CONFLICT: u32 = 0xc0000132;
+pub const SMB_NTSTATUS_TIME_DIFFERENCE_AT_DC: u32 = 0xc0000133;
+pub const SMB_NTSTATUS_SYNCHRONIZATION_REQUIRED: u32 = 0xc0000134;
+pub const SMB_NTSTATUS_DLL_NOT_FOUND: u32 = 0xc0000135;
+pub const SMB_NTSTATUS_OPEN_FAILED: u32 = 0xc0000136;
+pub const SMB_NTSTATUS_IO_PRIVILEGE_FAILED: u32 = 0xc0000137;
+pub const SMB_NTSTATUS_ORDINAL_NOT_FOUND: u32 = 0xc0000138;
+pub const SMB_NTSTATUS_ENTRYPOINT_NOT_FOUND: u32 = 0xc0000139;
+pub const SMB_NTSTATUS_CONTROL_C_EXIT: u32 = 0xc000013a;
+pub const SMB_NTSTATUS_LOCAL_DISCONNECT: u32 = 0xc000013b;
+pub const SMB_NTSTATUS_REMOTE_DISCONNECT: u32 = 0xc000013c;
+pub const SMB_NTSTATUS_REMOTE_RESOURCES: u32 = 0xc000013d;
+pub const SMB_NTSTATUS_LINK_FAILED: u32 = 0xc000013e;
+pub const SMB_NTSTATUS_LINK_TIMEOUT: u32 = 0xc000013f;
+pub const SMB_NTSTATUS_INVALID_CONNECTION: u32 = 0xc0000140;
+pub const SMB_NTSTATUS_INVALID_ADDRESS: u32 = 0xc0000141;
+pub const SMB_NTSTATUS_DLL_INIT_FAILED: u32 = 0xc0000142;
+pub const SMB_NTSTATUS_MISSING_SYSTEMFILE: u32 = 0xc0000143;
+pub const SMB_NTSTATUS_UNHANDLED_EXCEPTION: u32 = 0xc0000144;
+pub const SMB_NTSTATUS_APP_INIT_FAILURE: u32 = 0xc0000145;
+pub const SMB_NTSTATUS_PAGEFILE_CREATE_FAILED: u32 = 0xc0000146;
+pub const SMB_NTSTATUS_NO_PAGEFILE: u32 = 0xc0000147;
+pub const SMB_NTSTATUS_INVALID_LEVEL: u32 = 0xc0000148;
+pub const SMB_NTSTATUS_WRONG_PASSWORD_CORE: u32 = 0xc0000149;
+pub const SMB_NTSTATUS_ILLEGAL_FLOAT_CONTEXT: u32 = 0xc000014a;
+pub const SMB_NTSTATUS_PIPE_BROKEN: u32 = 0xc000014b;
+pub const SMB_NTSTATUS_REGISTRY_CORRUPT: u32 = 0xc000014c;
+pub const SMB_NTSTATUS_REGISTRY_IO_FAILED: u32 = 0xc000014d;
+pub const SMB_NTSTATUS_NO_EVENT_PAIR: u32 = 0xc000014e;
+pub const SMB_NTSTATUS_UNRECOGNIZED_VOLUME: u32 = 0xc000014f;
+pub const SMB_NTSTATUS_SERIAL_NO_DEVICE_INITED: u32 = 0xc0000150;
+pub const SMB_NTSTATUS_NO_SUCH_ALIAS: u32 = 0xc0000151;
+pub const SMB_NTSTATUS_MEMBER_NOT_IN_ALIAS: u32 = 0xc0000152;
+pub const SMB_NTSTATUS_MEMBER_IN_ALIAS: u32 = 0xc0000153;
+pub const SMB_NTSTATUS_ALIAS_EXISTS: u32 = 0xc0000154;
+pub const SMB_NTSTATUS_LOGON_NOT_GRANTED: u32 = 0xc0000155;
+pub const SMB_NTSTATUS_TOO_MANY_SECRETS: u32 = 0xc0000156;
+pub const SMB_NTSTATUS_SECRET_TOO_LONG: u32 = 0xc0000157;
+pub const SMB_NTSTATUS_INTERNAL_DB_ERROR: u32 = 0xc0000158;
+pub const SMB_NTSTATUS_FULLSCREEN_MODE: u32 = 0xc0000159;
+pub const SMB_NTSTATUS_TOO_MANY_CONTEXT_IDS: u32 = 0xc000015a;
+pub const SMB_NTSTATUS_LOGON_TYPE_NOT_GRANTED: u32 = 0xc000015b;
+pub const SMB_NTSTATUS_NOT_REGISTRY_FILE: u32 = 0xc000015c;
+pub const SMB_NTSTATUS_NT_CROSS_ENCRYPTION_REQUIRED: u32 = 0xc000015d;
+pub const SMB_NTSTATUS_DOMAIN_CTRLR_CONFIG_ERROR: u32 = 0xc000015e;
+pub const SMB_NTSTATUS_FT_MISSING_MEMBER: u32 = 0xc000015f;
+pub const SMB_NTSTATUS_ILL_FORMED_SERVICE_ENTRY: u32 = 0xc0000160;
+pub const SMB_NTSTATUS_ILLEGAL_CHARACTER: u32 = 0xc0000161;
+pub const SMB_NTSTATUS_UNMAPPABLE_CHARACTER: u32 = 0xc0000162;
+pub const SMB_NTSTATUS_UNDEFINED_CHARACTER: u32 = 0xc0000163;
+pub const SMB_NTSTATUS_FLOPPY_VOLUME: u32 = 0xc0000164;
+pub const SMB_NTSTATUS_FLOPPY_ID_MARK_NOT_FOUND: u32 = 0xc0000165;
+pub const SMB_NTSTATUS_FLOPPY_WRONG_CYLINDER: u32 = 0xc0000166;
+pub const SMB_NTSTATUS_FLOPPY_UNKNOWN_ERROR: u32 = 0xc0000167;
+pub const SMB_NTSTATUS_FLOPPY_BAD_REGISTERS: u32 = 0xc0000168;
+pub const SMB_NTSTATUS_DISK_RECALIBRATE_FAILED: u32 = 0xc0000169;
+pub const SMB_NTSTATUS_DISK_OPERATION_FAILED: u32 = 0xc000016a;
+pub const SMB_NTSTATUS_DISK_RESET_FAILED: u32 = 0xc000016b;
+pub const SMB_NTSTATUS_SHARED_IRQ_BUSY: u32 = 0xc000016c;
+pub const SMB_NTSTATUS_FT_ORPHANING: u32 = 0xc000016d;
+pub const SMB_NTSTATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT: u32 = 0xc000016e;
+pub const SMB_NTSTATUS_PARTITION_FAILURE: u32 = 0xc0000172;
+pub const SMB_NTSTATUS_INVALID_BLOCK_LENGTH: u32 = 0xc0000173;
+pub const SMB_NTSTATUS_DEVICE_NOT_PARTITIONED: u32 = 0xc0000174;
+pub const SMB_NTSTATUS_UNABLE_TO_LOCK_MEDIA: u32 = 0xc0000175;
+pub const SMB_NTSTATUS_UNABLE_TO_UNLOAD_MEDIA: u32 = 0xc0000176;
+pub const SMB_NTSTATUS_EOM_OVERFLOW: u32 = 0xc0000177;
+pub const SMB_NTSTATUS_NO_MEDIA: u32 = 0xc0000178;
+pub const SMB_NTSTATUS_NO_SUCH_MEMBER: u32 = 0xc000017a;
+pub const SMB_NTSTATUS_INVALID_MEMBER: u32 = 0xc000017b;
+pub const SMB_NTSTATUS_KEY_DELETED: u32 = 0xc000017c;
+pub const SMB_NTSTATUS_NO_LOG_SPACE: u32 = 0xc000017d;
+pub const SMB_NTSTATUS_TOO_MANY_SIDS: u32 = 0xc000017e;
+pub const SMB_NTSTATUS_LM_CROSS_ENCRYPTION_REQUIRED: u32 = 0xc000017f;
+pub const SMB_NTSTATUS_KEY_HAS_CHILDREN: u32 = 0xc0000180;
+pub const SMB_NTSTATUS_CHILD_MUST_BE_VOLATILE: u32 = 0xc0000181;
+pub const SMB_NTSTATUS_DEVICE_CONFIGURATION_ERROR: u32 = 0xc0000182;
+pub const SMB_NTSTATUS_DRIVER_INTERNAL_ERROR: u32 = 0xc0000183;
+pub const SMB_NTSTATUS_INVALID_DEVICE_STATE: u32 = 0xc0000184;
+pub const SMB_NTSTATUS_IO_DEVICE_ERROR: u32 = 0xc0000185;
+pub const SMB_NTSTATUS_DEVICE_PROTOCOL_ERROR: u32 = 0xc0000186;
+pub const SMB_NTSTATUS_BACKUP_CONTROLLER: u32 = 0xc0000187;
+pub const SMB_NTSTATUS_LOG_FILE_FULL: u32 = 0xc0000188;
+pub const SMB_NTSTATUS_TOO_LATE: u32 = 0xc0000189;
+pub const SMB_NTSTATUS_NO_TRUST_LSA_SECRET: u32 = 0xc000018a;
+pub const SMB_NTSTATUS_NO_TRUST_SAM_ACCOUNT: u32 = 0xc000018b;
+pub const SMB_NTSTATUS_TRUSTED_DOMAIN_FAILURE: u32 = 0xc000018c;
+pub const SMB_NTSTATUS_TRUSTED_RELATIONSHIP_FAILURE: u32 = 0xc000018d;
+pub const SMB_NTSTATUS_EVENTLOG_FILE_CORRUPT: u32 = 0xc000018e;
+pub const SMB_NTSTATUS_EVENTLOG_CANT_START: u32 = 0xc000018f;
+pub const SMB_NTSTATUS_TRUST_FAILURE: u32 = 0xc0000190;
+pub const SMB_NTSTATUS_MUTANT_LIMIT_EXCEEDED: u32 = 0xc0000191;
+pub const SMB_NTSTATUS_NETLOGON_NOT_STARTED: u32 = 0xc0000192;
+pub const SMB_NTSTATUS_ACCOUNT_EXPIRED: u32 = 0xc0000193;
+pub const SMB_NTSTATUS_POSSIBLE_DEADLOCK: u32 = 0xc0000194;
+pub const SMB_NTSTATUS_NETWORK_CREDENTIAL_CONFLICT: u32 = 0xc0000195;
+pub const SMB_NTSTATUS_REMOTE_SESSION_LIMIT: u32 = 0xc0000196;
+pub const SMB_NTSTATUS_EVENTLOG_FILE_CHANGED: u32 = 0xc0000197;
+pub const SMB_NTSTATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT: u32 = 0xc0000198;
+pub const SMB_NTSTATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT: u32 = 0xc0000199;
+pub const SMB_NTSTATUS_NOLOGON_SERVER_TRUST_ACCOUNT: u32 = 0xc000019a;
+pub const SMB_NTSTATUS_DOMAIN_TRUST_INCONSISTENT: u32 = 0xc000019b;
+pub const SMB_NTSTATUS_FS_DRIVER_REQUIRED: u32 = 0xc000019c;
+pub const SMB_NTSTATUS_IMAGE_ALREADY_LOADED_AS_DLL: u32 = 0xc000019d;
+pub const SMB_NTSTATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING: u32 = 0xc000019e;
+pub const SMB_NTSTATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME: u32 = 0xc000019f;
+pub const SMB_NTSTATUS_SECURITY_STREAM_IS_INCONSISTENT: u32 = 0xc00001a0;
+pub const SMB_NTSTATUS_INVALID_LOCK_RANGE: u32 = 0xc00001a1;
+pub const SMB_NTSTATUS_INVALID_ACE_CONDITION: u32 = 0xc00001a2;
+pub const SMB_NTSTATUS_IMAGE_SUBSYSTEM_NOT_PRESENT: u32 = 0xc00001a3;
+pub const SMB_NTSTATUS_NOTIFICATION_GUID_ALREADY_DEFINED: u32 = 0xc00001a4;
+pub const SMB_NTSTATUS_NETWORK_OPEN_RESTRICTION: u32 = 0xc0000201;
+pub const SMB_NTSTATUS_NO_USER_SESSION_KEY: u32 = 0xc0000202;
+pub const SMB_NTSTATUS_USER_SESSION_DELETED: u32 = 0xc0000203;
+pub const SMB_NTSTATUS_RESOURCE_LANG_NOT_FOUND: u32 = 0xc0000204;
+pub const SMB_NTSTATUS_INSUFF_SERVER_RESOURCES: u32 = 0xc0000205;
+pub const SMB_NTSTATUS_INVALID_BUFFER_SIZE: u32 = 0xc0000206;
+pub const SMB_NTSTATUS_INVALID_ADDRESS_COMPONENT: u32 = 0xc0000207;
+pub const SMB_NTSTATUS_INVALID_ADDRESS_WILDCARD: u32 = 0xc0000208;
+pub const SMB_NTSTATUS_TOO_MANY_ADDRESSES: u32 = 0xc0000209;
+pub const SMB_NTSTATUS_ADDRESS_ALREADY_EXISTS: u32 = 0xc000020a;
+pub const SMB_NTSTATUS_ADDRESS_CLOSED: u32 = 0xc000020b;
+pub const SMB_NTSTATUS_CONNECTION_DISCONNECTED: u32 = 0xc000020c;
+pub const SMB_NTSTATUS_CONNECTION_RESET: u32 = 0xc000020d;
+pub const SMB_NTSTATUS_TOO_MANY_NODES: u32 = 0xc000020e;
+pub const SMB_NTSTATUS_TRANSACTION_ABORTED: u32 = 0xc000020f;
+pub const SMB_NTSTATUS_TRANSACTION_TIMED_OUT: u32 = 0xc0000210;
+pub const SMB_NTSTATUS_TRANSACTION_NO_RELEASE: u32 = 0xc0000211;
+pub const SMB_NTSTATUS_TRANSACTION_NO_MATCH: u32 = 0xc0000212;
+pub const SMB_NTSTATUS_TRANSACTION_RESPONDED: u32 = 0xc0000213;
+pub const SMB_NTSTATUS_TRANSACTION_INVALID_ID: u32 = 0xc0000214;
+pub const SMB_NTSTATUS_TRANSACTION_INVALID_TYPE: u32 = 0xc0000215;
+pub const SMB_NTSTATUS_NOT_SERVER_SESSION: u32 = 0xc0000216;
+pub const SMB_NTSTATUS_NOT_CLIENT_SESSION: u32 = 0xc0000217;
+pub const SMB_NTSTATUS_CANNOT_LOAD_REGISTRY_FILE: u32 = 0xc0000218;
+pub const SMB_NTSTATUS_DEBUG_ATTACH_FAILED: u32 = 0xc0000219;
+pub const SMB_NTSTATUS_SYSTEM_PROCESS_TERMINATED: u32 = 0xc000021a;
+pub const SMB_NTSTATUS_DATA_NOT_ACCEPTED: u32 = 0xc000021b;
+pub const SMB_NTSTATUS_NO_BROWSER_SERVERS_FOUND: u32 = 0xc000021c;
+pub const SMB_NTSTATUS_VDM_HARD_ERROR: u32 = 0xc000021d;
+pub const SMB_NTSTATUS_DRIVER_CANCEL_TIMEOUT: u32 = 0xc000021e;
+pub const SMB_NTSTATUS_REPLY_MESSAGE_MISMATCH: u32 = 0xc000021f;
+pub const SMB_NTSTATUS_MAPPED_ALIGNMENT: u32 = 0xc0000220;
+pub const SMB_NTSTATUS_IMAGE_CHECKSUM_MISMATCH: u32 = 0xc0000221;
+pub const SMB_NTSTATUS_LOST_WRITEBEHIND_DATA: u32 = 0xc0000222;
+pub const SMB_NTSTATUS_CLIENT_SERVER_PARAMETERS_INVALID: u32 = 0xc0000223;
+pub const SMB_NTSTATUS_PASSWORD_MUST_CHANGE: u32 = 0xc0000224;
+pub const SMB_NTSTATUS_NOT_FOUND: u32 = 0xc0000225;
+pub const SMB_NTSTATUS_NOT_TINY_STREAM: u32 = 0xc0000226;
+pub const SMB_NTSTATUS_RECOVERY_FAILURE: u32 = 0xc0000227;
+pub const SMB_NTSTATUS_STACK_OVERFLOW_READ: u32 = 0xc0000228;
+pub const SMB_NTSTATUS_FAIL_CHECK: u32 = 0xc0000229;
+pub const SMB_NTSTATUS_DUPLICATE_OBJECTID: u32 = 0xc000022a;
+pub const SMB_NTSTATUS_OBJECTID_EXISTS: u32 = 0xc000022b;
+pub const SMB_NTSTATUS_CONVERT_TO_LARGE: u32 = 0xc000022c;
+pub const SMB_NTSTATUS_RETRY: u32 = 0xc000022d;
+pub const SMB_NTSTATUS_FOUND_OUT_OF_SCOPE: u32 = 0xc000022e;
+pub const SMB_NTSTATUS_ALLOCATE_BUCKET: u32 = 0xc000022f;
+pub const SMB_NTSTATUS_PROPSET_NOT_FOUND: u32 = 0xc0000230;
+pub const SMB_NTSTATUS_MARSHALL_OVERFLOW: u32 = 0xc0000231;
+pub const SMB_NTSTATUS_INVALID_VARIANT: u32 = 0xc0000232;
+pub const SMB_NTSTATUS_DOMAIN_CONTROLLER_NOT_FOUND: u32 = 0xc0000233;
+pub const SMB_NTSTATUS_ACCOUNT_LOCKED_OUT: u32 = 0xc0000234;
+pub const SMB_NTSTATUS_HANDLE_NOT_CLOSABLE: u32 = 0xc0000235;
+pub const SMB_NTSTATUS_CONNECTION_REFUSED: u32 = 0xc0000236;
+pub const SMB_NTSTATUS_GRACEFUL_DISCONNECT: u32 = 0xc0000237;
+pub const SMB_NTSTATUS_ADDRESS_ALREADY_ASSOCIATED: u32 = 0xc0000238;
+pub const SMB_NTSTATUS_ADDRESS_NOT_ASSOCIATED: u32 = 0xc0000239;
+pub const SMB_NTSTATUS_CONNECTION_INVALID: u32 = 0xc000023a;
+pub const SMB_NTSTATUS_CONNECTION_ACTIVE: u32 = 0xc000023b;
+pub const SMB_NTSTATUS_NETWORK_UNREACHABLE: u32 = 0xc000023c;
+pub const SMB_NTSTATUS_HOST_UNREACHABLE: u32 = 0xc000023d;
+pub const SMB_NTSTATUS_PROTOCOL_UNREACHABLE: u32 = 0xc000023e;
+pub const SMB_NTSTATUS_PORT_UNREACHABLE: u32 = 0xc000023f;
+pub const SMB_NTSTATUS_REQUEST_ABORTED: u32 = 0xc0000240;
+pub const SMB_NTSTATUS_CONNECTION_ABORTED: u32 = 0xc0000241;
+pub const SMB_NTSTATUS_BAD_COMPRESSION_BUFFER: u32 = 0xc0000242;
+pub const SMB_NTSTATUS_USER_MAPPED_FILE: u32 = 0xc0000243;
+pub const SMB_NTSTATUS_AUDIT_FAILED: u32 = 0xc0000244;
+pub const SMB_NTSTATUS_TIMER_RESOLUTION_NOT_SET: u32 = 0xc0000245;
+pub const SMB_NTSTATUS_CONNECTION_COUNT_LIMIT: u32 = 0xc0000246;
+pub const SMB_NTSTATUS_LOGIN_TIME_RESTRICTION: u32 = 0xc0000247;
+pub const SMB_NTSTATUS_LOGIN_WKSTA_RESTRICTION: u32 = 0xc0000248;
+pub const SMB_NTSTATUS_IMAGE_MP_UP_MISMATCH: u32 = 0xc0000249;
+pub const SMB_NTSTATUS_INSUFFICIENT_LOGON_INFO: u32 = 0xc0000250;
+pub const SMB_NTSTATUS_BAD_DLL_ENTRYPOINT: u32 = 0xc0000251;
+pub const SMB_NTSTATUS_BAD_SERVICE_ENTRYPOINT: u32 = 0xc0000252;
+pub const SMB_NTSTATUS_LPC_REPLY_LOST: u32 = 0xc0000253;
+pub const SMB_NTSTATUS_IP_ADDRESS_CONFLICT1: u32 = 0xc0000254;
+pub const SMB_NTSTATUS_IP_ADDRESS_CONFLICT2: u32 = 0xc0000255;
+pub const SMB_NTSTATUS_REGISTRY_QUOTA_LIMIT: u32 = 0xc0000256;
+pub const SMB_NTSTATUS_PATH_NOT_COVERED: u32 = 0xc0000257;
+pub const SMB_NTSTATUS_NO_CALLBACK_ACTIVE: u32 = 0xc0000258;
+pub const SMB_NTSTATUS_LICENSE_QUOTA_EXCEEDED: u32 = 0xc0000259;
+pub const SMB_NTSTATUS_PWD_TOO_SHORT: u32 = 0xc000025a;
+pub const SMB_NTSTATUS_PWD_TOO_RECENT: u32 = 0xc000025b;
+pub const SMB_NTSTATUS_PWD_HISTORY_CONFLICT: u32 = 0xc000025c;
+pub const SMB_NTSTATUS_PLUGPLAY_NO_DEVICE: u32 = 0xc000025e;
+pub const SMB_NTSTATUS_UNSUPPORTED_COMPRESSION: u32 = 0xc000025f;
+pub const SMB_NTSTATUS_INVALID_HW_PROFILE: u32 = 0xc0000260;
+pub const SMB_NTSTATUS_INVALID_PLUGPLAY_DEVICE_PATH: u32 = 0xc0000261;
+pub const SMB_NTSTATUS_DRIVER_ORDINAL_NOT_FOUND: u32 = 0xc0000262;
+pub const SMB_NTSTATUS_DRIVER_ENTRYPOINT_NOT_FOUND: u32 = 0xc0000263;
+pub const SMB_NTSTATUS_RESOURCE_NOT_OWNED: u32 = 0xc0000264;
+pub const SMB_NTSTATUS_TOO_MANY_LINKS: u32 = 0xc0000265;
+pub const SMB_NTSTATUS_QUOTA_LIST_INCONSISTENT: u32 = 0xc0000266;
+pub const SMB_NTSTATUS_FILE_IS_OFFLINE: u32 = 0xc0000267;
+pub const SMB_NTSTATUS_EVALUATION_EXPIRATION: u32 = 0xc0000268;
+pub const SMB_NTSTATUS_ILLEGAL_DLL_RELOCATION: u32 = 0xc0000269;
+pub const SMB_NTSTATUS_LICENSE_VIOLATION: u32 = 0xc000026a;
+pub const SMB_NTSTATUS_DLL_INIT_FAILED_LOGOFF: u32 = 0xc000026b;
+pub const SMB_NTSTATUS_DRIVER_UNABLE_TO_LOAD: u32 = 0xc000026c;
+pub const SMB_NTSTATUS_DFS_UNAVAILABLE: u32 = 0xc000026d;
+pub const SMB_NTSTATUS_VOLUME_DISMOUNTED: u32 = 0xc000026e;
+pub const SMB_NTSTATUS_WX86_INTERNAL_ERROR: u32 = 0xc000026f;
+pub const SMB_NTSTATUS_WX86_FLOAT_STACK_CHECK: u32 = 0xc0000270;
+pub const SMB_NTSTATUS_VALIDATE_CONTINUE: u32 = 0xc0000271;
+pub const SMB_NTSTATUS_NO_MATCH: u32 = 0xc0000272;
+pub const SMB_NTSTATUS_NO_MORE_MATCHES: u32 = 0xc0000273;
+pub const SMB_NTSTATUS_NOT_A_REPARSE_POINT: u32 = 0xc0000275;
+pub const SMB_NTSTATUS_IO_REPARSE_TAG_INVALID: u32 = 0xc0000276;
+pub const SMB_NTSTATUS_IO_REPARSE_TAG_MISMATCH: u32 = 0xc0000277;
+pub const SMB_NTSTATUS_IO_REPARSE_DATA_INVALID: u32 = 0xc0000278;
+pub const SMB_NTSTATUS_IO_REPARSE_TAG_NOT_HANDLED: u32 = 0xc0000279;
+pub const SMB_NTSTATUS_REPARSE_POINT_NOT_RESOLVED: u32 = 0xc0000280;
+pub const SMB_NTSTATUS_DIRECTORY_IS_A_REPARSE_POINT: u32 = 0xc0000281;
+pub const SMB_NTSTATUS_RANGE_LIST_CONFLICT: u32 = 0xc0000282;
+pub const SMB_NTSTATUS_SOURCE_ELEMENT_EMPTY: u32 = 0xc0000283;
+pub const SMB_NTSTATUS_DESTINATION_ELEMENT_FULL: u32 = 0xc0000284;
+pub const SMB_NTSTATUS_ILLEGAL_ELEMENT_ADDRESS: u32 = 0xc0000285;
+pub const SMB_NTSTATUS_MAGAZINE_NOT_PRESENT: u32 = 0xc0000286;
+pub const SMB_NTSTATUS_REINITIALIZATION_NEEDED: u32 = 0xc0000287;
+pub const SMB_NTSTATUS_ENCRYPTION_FAILED: u32 = 0xc000028a;
+pub const SMB_NTSTATUS_DECRYPTION_FAILED: u32 = 0xc000028b;
+pub const SMB_NTSTATUS_RANGE_NOT_FOUND: u32 = 0xc000028c;
+pub const SMB_NTSTATUS_NO_RECOVERY_POLICY: u32 = 0xc000028d;
+pub const SMB_NTSTATUS_NO_EFS: u32 = 0xc000028e;
+pub const SMB_NTSTATUS_WRONG_EFS: u32 = 0xc000028f;
+pub const SMB_NTSTATUS_NO_USER_KEYS: u32 = 0xc0000290;
+pub const SMB_NTSTATUS_FILE_NOT_ENCRYPTED: u32 = 0xc0000291;
+pub const SMB_NTSTATUS_NOT_EXPORT_FORMAT: u32 = 0xc0000292;
+pub const SMB_NTSTATUS_FILE_ENCRYPTED: u32 = 0xc0000293;
+pub const SMB_NTSTATUS_WMI_GUID_NOT_FOUND: u32 = 0xc0000295;
+pub const SMB_NTSTATUS_WMI_INSTANCE_NOT_FOUND: u32 = 0xc0000296;
+pub const SMB_NTSTATUS_WMI_ITEMID_NOT_FOUND: u32 = 0xc0000297;
+pub const SMB_NTSTATUS_WMI_TRY_AGAIN: u32 = 0xc0000298;
+pub const SMB_NTSTATUS_SHARED_POLICY: u32 = 0xc0000299;
+pub const SMB_NTSTATUS_POLICY_OBJECT_NOT_FOUND: u32 = 0xc000029a;
+pub const SMB_NTSTATUS_POLICY_ONLY_IN_DS: u32 = 0xc000029b;
+pub const SMB_NTSTATUS_VOLUME_NOT_UPGRADED: u32 = 0xc000029c;
+pub const SMB_NTSTATUS_REMOTE_STORAGE_NOT_ACTIVE: u32 = 0xc000029d;
+pub const SMB_NTSTATUS_REMOTE_STORAGE_MEDIA_ERROR: u32 = 0xc000029e;
+pub const SMB_NTSTATUS_NO_TRACKING_SERVICE: u32 = 0xc000029f;
+pub const SMB_NTSTATUS_SERVER_SID_MISMATCH: u32 = 0xc00002a0;
+pub const SMB_NTSTATUS_DS_NO_ATTRIBUTE_OR_VALUE: u32 = 0xc00002a1;
+pub const SMB_NTSTATUS_DS_INVALID_ATTRIBUTE_SYNTAX: u32 = 0xc00002a2;
+pub const SMB_NTSTATUS_DS_ATTRIBUTE_TYPE_UNDEFINED: u32 = 0xc00002a3;
+pub const SMB_NTSTATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS: u32 = 0xc00002a4;
+pub const SMB_NTSTATUS_DS_BUSY: u32 = 0xc00002a5;
+pub const SMB_NTSTATUS_DS_UNAVAILABLE: u32 = 0xc00002a6;
+pub const SMB_NTSTATUS_DS_NO_RIDS_ALLOCATED: u32 = 0xc00002a7;
+pub const SMB_NTSTATUS_DS_NO_MORE_RIDS: u32 = 0xc00002a8;
+pub const SMB_NTSTATUS_DS_INCORRECT_ROLE_OWNER: u32 = 0xc00002a9;
+pub const SMB_NTSTATUS_DS_RIDMGR_INIT_ERROR: u32 = 0xc00002aa;
+pub const SMB_NTSTATUS_DS_OBJ_CLASS_VIOLATION: u32 = 0xc00002ab;
+pub const SMB_NTSTATUS_DS_CANT_ON_NON_LEAF: u32 = 0xc00002ac;
+pub const SMB_NTSTATUS_DS_CANT_ON_RDN: u32 = 0xc00002ad;
+pub const SMB_NTSTATUS_DS_CANT_MOD_OBJ_CLASS: u32 = 0xc00002ae;
+pub const SMB_NTSTATUS_DS_CROSS_DOM_MOVE_FAILED: u32 = 0xc00002af;
+pub const SMB_NTSTATUS_DS_GC_NOT_AVAILABLE: u32 = 0xc00002b0;
+pub const SMB_NTSTATUS_DIRECTORY_SERVICE_REQUIRED: u32 = 0xc00002b1;
+pub const SMB_NTSTATUS_REPARSE_ATTRIBUTE_CONFLICT: u32 = 0xc00002b2;
+pub const SMB_NTSTATUS_CANT_ENABLE_DENY_ONLY: u32 = 0xc00002b3;
+pub const SMB_NTSTATUS_FLOAT_MULTIPLE_FAULTS: u32 = 0xc00002b4;
+pub const SMB_NTSTATUS_FLOAT_MULTIPLE_TRAPS: u32 = 0xc00002b5;
+pub const SMB_NTSTATUS_DEVICE_REMOVED: u32 = 0xc00002b6;
+pub const SMB_NTSTATUS_JOURNAL_DELETE_IN_PROGRESS: u32 = 0xc00002b7;
+pub const SMB_NTSTATUS_JOURNAL_NOT_ACTIVE: u32 = 0xc00002b8;
+pub const SMB_NTSTATUS_NOINTERFACE: u32 = 0xc00002b9;
+pub const SMB_NTSTATUS_DS_ADMIN_LIMIT_EXCEEDED: u32 = 0xc00002c1;
+pub const SMB_NTSTATUS_DRIVER_FAILED_SLEEP: u32 = 0xc00002c2;
+pub const SMB_NTSTATUS_MUTUAL_AUTHENTICATION_FAILED: u32 = 0xc00002c3;
+pub const SMB_NTSTATUS_CORRUPT_SYSTEM_FILE: u32 = 0xc00002c4;
+pub const SMB_NTSTATUS_DATATYPE_MISALIGNMENT_ERROR: u32 = 0xc00002c5;
+pub const SMB_NTSTATUS_WMI_READ_ONLY: u32 = 0xc00002c6;
+pub const SMB_NTSTATUS_WMI_SET_FAILURE: u32 = 0xc00002c7;
+pub const SMB_NTSTATUS_COMMITMENT_MINIMUM: u32 = 0xc00002c8;
+pub const SMB_NTSTATUS_REG_NAT_CONSUMPTION: u32 = 0xc00002c9;
+pub const SMB_NTSTATUS_TRANSPORT_FULL: u32 = 0xc00002ca;
+pub const SMB_NTSTATUS_DS_SAM_INIT_FAILURE: u32 = 0xc00002cb;
+pub const SMB_NTSTATUS_ONLY_IF_CONNECTED: u32 = 0xc00002cc;
+pub const SMB_NTSTATUS_DS_SENSITIVE_GROUP_VIOLATION: u32 = 0xc00002cd;
+pub const SMB_NTSTATUS_PNP_RESTART_ENUMERATION: u32 = 0xc00002ce;
+pub const SMB_NTSTATUS_JOURNAL_ENTRY_DELETED: u32 = 0xc00002cf;
+pub const SMB_NTSTATUS_DS_CANT_MOD_PRIMARYGROUPID: u32 = 0xc00002d0;
+pub const SMB_NTSTATUS_SYSTEM_IMAGE_BAD_SIGNATURE: u32 = 0xc00002d1;
+pub const SMB_NTSTATUS_PNP_REBOOT_REQUIRED: u32 = 0xc00002d2;
+pub const SMB_NTSTATUS_POWER_STATE_INVALID: u32 = 0xc00002d3;
+pub const SMB_NTSTATUS_DS_INVALID_GROUP_TYPE: u32 = 0xc00002d4;
+pub const SMB_NTSTATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN: u32 = 0xc00002d5;
+pub const SMB_NTSTATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN: u32 = 0xc00002d6;
+pub const SMB_NTSTATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER: u32 = 0xc00002d7;
+pub const SMB_NTSTATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER: u32 = 0xc00002d8;
+pub const SMB_NTSTATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER: u32 = 0xc00002d9;
+pub const SMB_NTSTATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER: u32 = 0xc00002da;
+pub const SMB_NTSTATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER: u32 = 0xc00002db;
+pub const SMB_NTSTATUS_DS_HAVE_PRIMARY_MEMBERS: u32 = 0xc00002dc;
+pub const SMB_NTSTATUS_WMI_NOT_SUPPORTED: u32 = 0xc00002dd;
+pub const SMB_NTSTATUS_INSUFFICIENT_POWER: u32 = 0xc00002de;
+pub const SMB_NTSTATUS_SAM_NEED_BOOTKEY_PASSWORD: u32 = 0xc00002df;
+pub const SMB_NTSTATUS_SAM_NEED_BOOTKEY_FLOPPY: u32 = 0xc00002e0;
+pub const SMB_NTSTATUS_DS_CANT_START: u32 = 0xc00002e1;
+pub const SMB_NTSTATUS_DS_INIT_FAILURE: u32 = 0xc00002e2;
+pub const SMB_NTSTATUS_SAM_INIT_FAILURE: u32 = 0xc00002e3;
+pub const SMB_NTSTATUS_DS_GC_REQUIRED: u32 = 0xc00002e4;
+pub const SMB_NTSTATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY: u32 = 0xc00002e5;
+pub const SMB_NTSTATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS: u32 = 0xc00002e6;
+pub const SMB_NTSTATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED: u32 = 0xc00002e7;
+pub const SMB_NTSTATUS_CURRENT_DOMAIN_NOT_ALLOWED: u32 = 0xc00002e9;
+pub const SMB_NTSTATUS_CANNOT_MAKE: u32 = 0xc00002ea;
+pub const SMB_NTSTATUS_SYSTEM_SHUTDOWN: u32 = 0xc00002eb;
+pub const SMB_NTSTATUS_DS_INIT_FAILURE_CONSOLE: u32 = 0xc00002ec;
+pub const SMB_NTSTATUS_DS_SAM_INIT_FAILURE_CONSOLE: u32 = 0xc00002ed;
+pub const SMB_NTSTATUS_UNFINISHED_CONTEXT_DELETED: u32 = 0xc00002ee;
+pub const SMB_NTSTATUS_NO_TGT_REPLY: u32 = 0xc00002ef;
+pub const SMB_NTSTATUS_OBJECTID_NOT_FOUND: u32 = 0xc00002f0;
+pub const SMB_NTSTATUS_NO_IP_ADDRESSES: u32 = 0xc00002f1;
+pub const SMB_NTSTATUS_WRONG_CREDENTIAL_HANDLE: u32 = 0xc00002f2;
+pub const SMB_NTSTATUS_CRYPTO_SYSTEM_INVALID: u32 = 0xc00002f3;
+pub const SMB_NTSTATUS_MAX_REFERRALS_EXCEEDED: u32 = 0xc00002f4;
+pub const SMB_NTSTATUS_MUST_BE_KDC: u32 = 0xc00002f5;
+pub const SMB_NTSTATUS_STRONG_CRYPTO_NOT_SUPPORTED: u32 = 0xc00002f6;
+pub const SMB_NTSTATUS_TOO_MANY_PRINCIPALS: u32 = 0xc00002f7;
+pub const SMB_NTSTATUS_NO_PA_DATA: u32 = 0xc00002f8;
+pub const SMB_NTSTATUS_PKINIT_NAME_MISMATCH: u32 = 0xc00002f9;
+pub const SMB_NTSTATUS_SMARTCARD_LOGON_REQUIRED: u32 = 0xc00002fa;
+pub const SMB_NTSTATUS_KDC_INVALID_REQUEST: u32 = 0xc00002fb;
+pub const SMB_NTSTATUS_KDC_UNABLE_TO_REFER: u32 = 0xc00002fc;
+pub const SMB_NTSTATUS_KDC_UNKNOWN_ETYPE: u32 = 0xc00002fd;
+pub const SMB_NTSTATUS_SHUTDOWN_IN_PROGRESS: u32 = 0xc00002fe;
+pub const SMB_NTSTATUS_SERVER_SHUTDOWN_IN_PROGRESS: u32 = 0xc00002ff;
+pub const SMB_NTSTATUS_NOT_SUPPORTED_ON_SBS: u32 = 0xc0000300;
+pub const SMB_NTSTATUS_WMI_GUID_DISCONNECTED: u32 = 0xc0000301;
+pub const SMB_NTSTATUS_WMI_ALREADY_DISABLED: u32 = 0xc0000302;
+pub const SMB_NTSTATUS_WMI_ALREADY_ENABLED: u32 = 0xc0000303;
+pub const SMB_NTSTATUS_MFT_TOO_FRAGMENTED: u32 = 0xc0000304;
+pub const SMB_NTSTATUS_COPY_PROTECTION_FAILURE: u32 = 0xc0000305;
+pub const SMB_NTSTATUS_CSS_AUTHENTICATION_FAILURE: u32 = 0xc0000306;
+pub const SMB_NTSTATUS_CSS_KEY_NOT_PRESENT: u32 = 0xc0000307;
+pub const SMB_NTSTATUS_CSS_KEY_NOT_ESTABLISHED: u32 = 0xc0000308;
+pub const SMB_NTSTATUS_CSS_SCRAMBLED_SECTOR: u32 = 0xc0000309;
+pub const SMB_NTSTATUS_CSS_REGION_MISMATCH: u32 = 0xc000030a;
+pub const SMB_NTSTATUS_CSS_RESETS_EXHAUSTED: u32 = 0xc000030b;
+pub const SMB_NTSTATUS_PKINIT_FAILURE: u32 = 0xc0000320;
+pub const SMB_NTSTATUS_SMARTCARD_SUBSYSTEM_FAILURE: u32 = 0xc0000321;
+pub const SMB_NTSTATUS_NO_KERB_KEY: u32 = 0xc0000322;
+pub const SMB_NTSTATUS_HOST_DOWN: u32 = 0xc0000350;
+pub const SMB_NTSTATUS_UNSUPPORTED_PREAUTH: u32 = 0xc0000351;
+pub const SMB_NTSTATUS_EFS_ALG_BLOB_TOO_BIG: u32 = 0xc0000352;
+pub const SMB_NTSTATUS_PORT_NOT_SET: u32 = 0xc0000353;
+pub const SMB_NTSTATUS_DEBUGGER_INACTIVE: u32 = 0xc0000354;
+pub const SMB_NTSTATUS_DS_VERSION_CHECK_FAILURE: u32 = 0xc0000355;
+pub const SMB_NTSTATUS_AUDITING_DISABLED: u32 = 0xc0000356;
+pub const SMB_NTSTATUS_PRENT4_MACHINE_ACCOUNT: u32 = 0xc0000357;
+pub const SMB_NTSTATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER: u32 = 0xc0000358;
+pub const SMB_NTSTATUS_INVALID_IMAGE_WIN_32: u32 = 0xc0000359;
+pub const SMB_NTSTATUS_INVALID_IMAGE_WIN_64: u32 = 0xc000035a;
+pub const SMB_NTSTATUS_BAD_BINDINGS: u32 = 0xc000035b;
+pub const SMB_NTSTATUS_NETWORK_SESSION_EXPIRED: u32 = 0xc000035c;
+pub const SMB_NTSTATUS_APPHELP_BLOCK: u32 = 0xc000035d;
+pub const SMB_NTSTATUS_ALL_SIDS_FILTERED: u32 = 0xc000035e;
+pub const SMB_NTSTATUS_NOT_SAFE_MODE_DRIVER: u32 = 0xc000035f;
+pub const SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT: u32 = 0xc0000361;
+pub const SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_PATH: u32 = 0xc0000362;
+pub const SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER: u32 = 0xc0000363;
+pub const SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_OTHER: u32 = 0xc0000364;
+pub const SMB_NTSTATUS_FAILED_DRIVER_ENTRY: u32 = 0xc0000365;
+pub const SMB_NTSTATUS_DEVICE_ENUMERATION_ERROR: u32 = 0xc0000366;
+pub const SMB_NTSTATUS_MOUNT_POINT_NOT_RESOLVED: u32 = 0xc0000368;
+pub const SMB_NTSTATUS_INVALID_DEVICE_OBJECT_PARAMETER: u32 = 0xc0000369;
+pub const SMB_NTSTATUS_MCA_OCCURED: u32 = 0xc000036a;
+pub const SMB_NTSTATUS_DRIVER_BLOCKED_CRITICAL: u32 = 0xc000036b;
+pub const SMB_NTSTATUS_DRIVER_BLOCKED: u32 = 0xc000036c;
+pub const SMB_NTSTATUS_DRIVER_DATABASE_ERROR: u32 = 0xc000036d;
+pub const SMB_NTSTATUS_SYSTEM_HIVE_TOO_LARGE: u32 = 0xc000036e;
+pub const SMB_NTSTATUS_INVALID_IMPORT_OF_NON_DLL: u32 = 0xc000036f;
+pub const SMB_NTSTATUS_NO_SECRETS: u32 = 0xc0000371;
+pub const SMB_NTSTATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY: u32 = 0xc0000372;
+pub const SMB_NTSTATUS_FAILED_STACK_SWITCH: u32 = 0xc0000373;
+pub const SMB_NTSTATUS_HEAP_CORRUPTION: u32 = 0xc0000374;
+pub const SMB_NTSTATUS_SMARTCARD_WRONG_PIN: u32 = 0xc0000380;
+pub const SMB_NTSTATUS_SMARTCARD_CARD_BLOCKED: u32 = 0xc0000381;
+pub const SMB_NTSTATUS_SMARTCARD_CARD_NOT_AUTHENTICATED: u32 = 0xc0000382;
+pub const SMB_NTSTATUS_SMARTCARD_NO_CARD: u32 = 0xc0000383;
+pub const SMB_NTSTATUS_SMARTCARD_NO_KEY_CONTAINER: u32 = 0xc0000384;
+pub const SMB_NTSTATUS_SMARTCARD_NO_CERTIFICATE: u32 = 0xc0000385;
+pub const SMB_NTSTATUS_SMARTCARD_NO_KEYSET: u32 = 0xc0000386;
+pub const SMB_NTSTATUS_SMARTCARD_IO_ERROR: u32 = 0xc0000387;
+pub const SMB_NTSTATUS_DOWNGRADE_DETECTED: u32 = 0xc0000388;
+pub const SMB_NTSTATUS_SMARTCARD_CERT_REVOKED: u32 = 0xc0000389;
+pub const SMB_NTSTATUS_ISSUING_CA_UNTRUSTED: u32 = 0xc000038a;
+pub const SMB_NTSTATUS_REVOCATION_OFFLINE_C: u32 = 0xc000038b;
+pub const SMB_NTSTATUS_PKINIT_CLIENT_FAILURE: u32 = 0xc000038c;
+pub const SMB_NTSTATUS_SMARTCARD_CERT_EXPIRED: u32 = 0xc000038d;
+pub const SMB_NTSTATUS_DRIVER_FAILED_PRIOR_UNLOAD: u32 = 0xc000038e;
+pub const SMB_NTSTATUS_SMARTCARD_SILENT_CONTEXT: u32 = 0xc000038f;
+pub const SMB_NTSTATUS_PER_USER_TRUST_QUOTA_EXCEEDED: u32 = 0xc0000401;
+pub const SMB_NTSTATUS_ALL_USER_TRUST_QUOTA_EXCEEDED: u32 = 0xc0000402;
+pub const SMB_NTSTATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED: u32 = 0xc0000403;
+pub const SMB_NTSTATUS_DS_NAME_NOT_UNIQUE: u32 = 0xc0000404;
+pub const SMB_NTSTATUS_DS_DUPLICATE_ID_FOUND: u32 = 0xc0000405;
+pub const SMB_NTSTATUS_DS_GROUP_CONVERSION_ERROR: u32 = 0xc0000406;
+pub const SMB_NTSTATUS_VOLSNAP_PREPARE_HIBERNATE: u32 = 0xc0000407;
+pub const SMB_NTSTATUS_USER2USER_REQUIRED: u32 = 0xc0000408;
+pub const SMB_NTSTATUS_STACK_BUFFER_OVERRUN: u32 = 0xc0000409;
+pub const SMB_NTSTATUS_NO_S4U_PROT_SUPPORT: u32 = 0xc000040a;
+pub const SMB_NTSTATUS_CROSSREALM_DELEGATION_FAILURE: u32 = 0xc000040b;
+pub const SMB_NTSTATUS_REVOCATION_OFFLINE_KDC: u32 = 0xc000040c;
+pub const SMB_NTSTATUS_ISSUING_CA_UNTRUSTED_KDC: u32 = 0xc000040d;
+pub const SMB_NTSTATUS_KDC_CERT_EXPIRED: u32 = 0xc000040e;
+pub const SMB_NTSTATUS_KDC_CERT_REVOKED: u32 = 0xc000040f;
+pub const SMB_NTSTATUS_PARAMETER_QUOTA_EXCEEDED: u32 = 0xc0000410;
+pub const SMB_NTSTATUS_HIBERNATION_FAILURE: u32 = 0xc0000411;
+pub const SMB_NTSTATUS_DELAY_LOAD_FAILED: u32 = 0xc0000412;
+pub const SMB_NTSTATUS_AUTHENTICATION_FIREWALL_FAILED: u32 = 0xc0000413;
+pub const SMB_NTSTATUS_VDM_DISALLOWED: u32 = 0xc0000414;
+pub const SMB_NTSTATUS_HUNG_DISPLAY_DRIVER_THREAD: u32 = 0xc0000415;
+pub const SMB_NTSTATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE: u32 = 0xc0000416;
+pub const SMB_NTSTATUS_INVALID_CRUNTIME_PARAMETER: u32 = 0xc0000417;
+pub const SMB_NTSTATUS_NTLM_BLOCKED: u32 = 0xc0000418;
+pub const SMB_NTSTATUS_DS_SRC_SID_EXISTS_IN_FOREST: u32 = 0xc0000419;
+pub const SMB_NTSTATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST: u32 = 0xc000041a;
+pub const SMB_NTSTATUS_DS_FLAT_NAME_EXISTS_IN_FOREST: u32 = 0xc000041b;
+pub const SMB_NTSTATUS_INVALID_USER_PRINCIPAL_NAME: u32 = 0xc000041c;
+pub const SMB_NTSTATUS_ASSERTION_FAILURE: u32 = 0xc0000420;
+pub const SMB_NTSTATUS_VERIFIER_STOP: u32 = 0xc0000421;
+pub const SMB_NTSTATUS_CALLBACK_POP_STACK: u32 = 0xc0000423;
+pub const SMB_NTSTATUS_INCOMPATIBLE_DRIVER_BLOCKED: u32 = 0xc0000424;
+pub const SMB_NTSTATUS_HIVE_UNLOADED: u32 = 0xc0000425;
+pub const SMB_NTSTATUS_COMPRESSION_DISABLED: u32 = 0xc0000426;
+pub const SMB_NTSTATUS_FILE_SYSTEM_LIMITATION: u32 = 0xc0000427;
+pub const SMB_NTSTATUS_INVALID_IMAGE_HASH: u32 = 0xc0000428;
+pub const SMB_NTSTATUS_NOT_CAPABLE: u32 = 0xc0000429;
+pub const SMB_NTSTATUS_REQUEST_OUT_OF_SEQUENCE: u32 = 0xc000042a;
+pub const SMB_NTSTATUS_IMPLEMENTATION_LIMIT: u32 = 0xc000042b;
+pub const SMB_NTSTATUS_ELEVATION_REQUIRED: u32 = 0xc000042c;
+pub const SMB_NTSTATUS_NO_SECURITY_CONTEXT: u32 = 0xc000042d;
+pub const SMB_NTSTATUS_PKU2U_CERT_FAILURE: u32 = 0xc000042e;
+pub const SMB_NTSTATUS_BEYOND_VDL: u32 = 0xc0000432;
+pub const SMB_NTSTATUS_ENCOUNTERED_WRITE_IN_PROGRESS: u32 = 0xc0000433;
+pub const SMB_NTSTATUS_PTE_CHANGED: u32 = 0xc0000434;
+pub const SMB_NTSTATUS_PURGE_FAILED: u32 = 0xc0000435;
+pub const SMB_NTSTATUS_CRED_REQUIRES_CONFIRMATION: u32 = 0xc0000440;
+pub const SMB_NTSTATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE: u32 = 0xc0000441;
+pub const SMB_NTSTATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER: u32 = 0xc0000442;
+pub const SMB_NTSTATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE: u32 = 0xc0000443;
+pub const SMB_NTSTATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE: u32 = 0xc0000444;
+pub const SMB_NTSTATUS_CS_ENCRYPTION_FILE_NOT_CSE: u32 = 0xc0000445;
+pub const SMB_NTSTATUS_INVALID_LABEL: u32 = 0xc0000446;
+pub const SMB_NTSTATUS_DRIVER_PROCESS_TERMINATED: u32 = 0xc0000450;
+pub const SMB_NTSTATUS_AMBIGUOUS_SYSTEM_DEVICE: u32 = 0xc0000451;
+pub const SMB_NTSTATUS_SYSTEM_DEVICE_NOT_FOUND: u32 = 0xc0000452;
+pub const SMB_NTSTATUS_RESTART_BOOT_APPLICATION: u32 = 0xc0000453;
+pub const SMB_NTSTATUS_INSUFFICIENT_NVRAM_RESOURCES: u32 = 0xc0000454;
+pub const SMB_NTSTATUS_NO_RANGES_PROCESSED: u32 = 0xc0000460;
+pub const SMB_NTSTATUS_DEVICE_FEATURE_NOT_SUPPORTED: u32 = 0xc0000463;
+pub const SMB_NTSTATUS_DEVICE_UNREACHABLE: u32 = 0xc0000464;
+pub const SMB_NTSTATUS_INVALID_TOKEN: u32 = 0xc0000465;
+pub const SMB_NTSTATUS_SERVER_UNAVAILABLE: u32 = 0xc0000466;
+pub const SMB_NTSTATUS_INVALID_TASK_NAME: u32 = 0xc0000500;
+pub const SMB_NTSTATUS_INVALID_TASK_INDEX: u32 = 0xc0000501;
+pub const SMB_NTSTATUS_THREAD_ALREADY_IN_TASK: u32 = 0xc0000502;
+pub const SMB_NTSTATUS_CALLBACK_BYPASS: u32 = 0xc0000503;
+pub const SMB_NTSTATUS_FAIL_FAST_EXCEPTION: u32 = 0xc0000602;
+pub const SMB_NTSTATUS_IMAGE_CERT_REVOKED: u32 = 0xc0000603;
+pub const SMB_NTSTATUS_PORT_CLOSED: u32 = 0xc0000700;
+pub const SMB_NTSTATUS_MESSAGE_LOST: u32 = 0xc0000701;
+pub const SMB_NTSTATUS_INVALID_MESSAGE: u32 = 0xc0000702;
+pub const SMB_NTSTATUS_REQUEST_CANCELED: u32 = 0xc0000703;
+pub const SMB_NTSTATUS_RECURSIVE_DISPATCH: u32 = 0xc0000704;
+pub const SMB_NTSTATUS_LPC_RECEIVE_BUFFER_EXPECTED: u32 = 0xc0000705;
+pub const SMB_NTSTATUS_LPC_INVALID_CONNECTION_USAGE: u32 = 0xc0000706;
+pub const SMB_NTSTATUS_LPC_REQUESTS_NOT_ALLOWED: u32 = 0xc0000707;
+pub const SMB_NTSTATUS_RESOURCE_IN_USE: u32 = 0xc0000708;
+pub const SMB_NTSTATUS_HARDWARE_MEMORY_ERROR: u32 = 0xc0000709;
+pub const SMB_NTSTATUS_THREADPOOL_HANDLE_EXCEPTION: u32 = 0xc000070a;
+pub const SMB_NTSTATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED: u32 = 0xc000070b;
+pub const SMB_NTSTATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED: u32 = 0xc000070c;
+pub const SMB_NTSTATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED: u32 = 0xc000070d;
+pub const SMB_NTSTATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED: u32 = 0xc000070e;
+pub const SMB_NTSTATUS_THREADPOOL_RELEASED_DURING_OPERATION: u32 = 0xc000070f;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING: u32 = 0xc0000710;
+pub const SMB_NTSTATUS_APC_RETURNED_WHILE_IMPERSONATING: u32 = 0xc0000711;
+pub const SMB_NTSTATUS_PROCESS_IS_PROTECTED: u32 = 0xc0000712;
+pub const SMB_NTSTATUS_MCA_EXCEPTION: u32 = 0xc0000713;
+pub const SMB_NTSTATUS_CERTIFICATE_MAPPING_NOT_UNIQUE: u32 = 0xc0000714;
+pub const SMB_NTSTATUS_SYMLINK_CLASS_DISABLED: u32 = 0xc0000715;
+pub const SMB_NTSTATUS_INVALID_IDN_NORMALIZATION: u32 = 0xc0000716;
+pub const SMB_NTSTATUS_NO_UNICODE_TRANSLATION: u32 = 0xc0000717;
+pub const SMB_NTSTATUS_ALREADY_REGISTERED: u32 = 0xc0000718;
+pub const SMB_NTSTATUS_CONTEXT_MISMATCH: u32 = 0xc0000719;
+pub const SMB_NTSTATUS_PORT_ALREADY_HAS_COMPLETION_LIST: u32 = 0xc000071a;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_THREAD_PRIORITY: u32 = 0xc000071b;
+pub const SMB_NTSTATUS_INVALID_THREAD: u32 = 0xc000071c;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_TRANSACTION: u32 = 0xc000071d;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_LDR_LOCK: u32 = 0xc000071e;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_LANG: u32 = 0xc000071f;
+pub const SMB_NTSTATUS_CALLBACK_RETURNED_PRI_BACK: u32 = 0xc0000720;
+pub const SMB_NTSTATUS_DISK_REPAIR_DISABLED: u32 = 0xc0000800;
+pub const SMB_NTSTATUS_DS_DOMAIN_RENAME_IN_PROGRESS: u32 = 0xc0000801;
+pub const SMB_NTSTATUS_DISK_QUOTA_EXCEEDED: u32 = 0xc0000802;
+pub const SMB_NTSTATUS_CONTENT_BLOCKED: u32 = 0xc0000804;
+pub const SMB_NTSTATUS_BAD_CLUSTERS: u32 = 0xc0000805;
+pub const SMB_NTSTATUS_VOLUME_DIRTY: u32 = 0xc0000806;
+pub const SMB_NTSTATUS_FILE_CHECKED_OUT: u32 = 0xc0000901;
+pub const SMB_NTSTATUS_CHECKOUT_REQUIRED: u32 = 0xc0000902;
+pub const SMB_NTSTATUS_BAD_FILE_TYPE: u32 = 0xc0000903;
+pub const SMB_NTSTATUS_FILE_TOO_LARGE: u32 = 0xc0000904;
+pub const SMB_NTSTATUS_FORMS_AUTH_REQUIRED: u32 = 0xc0000905;
+pub const SMB_NTSTATUS_VIRUS_INFECTED: u32 = 0xc0000906;
+pub const SMB_NTSTATUS_VIRUS_DELETED: u32 = 0xc0000907;
+pub const SMB_NTSTATUS_BAD_MCFG_TABLE: u32 = 0xc0000908;
+pub const SMB_NTSTATUS_CANNOT_BREAK_OPLOCK: u32 = 0xc0000909;
+pub const SMB_NTSTATUS_WOW_ASSERTION: u32 = 0xc0009898;
+pub const SMB_NTSTATUS_INVALID_SIGNATURE: u32 = 0xc000a000;
+pub const SMB_NTSTATUS_HMAC_NOT_SUPPORTED: u32 = 0xc000a001;
+pub const SMB_NTSTATUS_IPSEC_QUEUE_OVERFLOW: u32 = 0xc000a010;
+pub const SMB_NTSTATUS_ND_QUEUE_OVERFLOW: u32 = 0xc000a011;
+pub const SMB_NTSTATUS_HOPLIMIT_EXCEEDED: u32 = 0xc000a012;
+pub const SMB_NTSTATUS_PROTOCOL_NOT_SUPPORTED: u32 = 0xc000a013;
+pub const SMB_NTSTATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED: u32 = 0xc000a080;
+pub const SMB_NTSTATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR: u32 = 0xc000a081;
+pub const SMB_NTSTATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR: u32 = 0xc000a082;
+pub const SMB_NTSTATUS_XML_PARSE_ERROR: u32 = 0xc000a083;
+pub const SMB_NTSTATUS_XMLDSIG_ERROR: u32 = 0xc000a084;
+pub const SMB_NTSTATUS_WRONG_COMPARTMENT: u32 = 0xc000a085;
+pub const SMB_NTSTATUS_AUTHIP_FAILURE: u32 = 0xc000a086;
+pub const SMB_NTSTATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS: u32 = 0xc000a087;
+pub const SMB_NTSTATUS_DS_OID_NOT_FOUND: u32 = 0xc000a088;
+pub const SMB_NTSTATUS_HASH_NOT_SUPPORTED: u32 = 0xc000a100;
+pub const SMB_NTSTATUS_HASH_NOT_PRESENT: u32 = 0xc000a101;
+pub const SMB_NTSTATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED: u32 = 0xc000a2a1;
+pub const SMB_NTSTATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED: u32 = 0xc000a2a2;
+pub const SMB_NTSTATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED: u32 = 0xc000a2a3;
+pub const SMB_NTSTATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED: u32 = 0xc000a2a4;
+pub const SMB_NTDBG_NO_STATE_CHANGE: u32 = 0xc0010001;
+pub const SMB_NTDBG_APP_NOT_IDLE: u32 = 0xc0010002;
+pub const SMB_NTRPC_NT_INVALID_STRING_BINDING: u32 = 0xc0020001;
+pub const SMB_NTRPC_NT_WRONG_KIND_OF_BINDING: u32 = 0xc0020002;
+pub const SMB_NTRPC_NT_INVALID_BINDING: u32 = 0xc0020003;
+pub const SMB_NTRPC_NT_PROTSEQ_NOT_SUPPORTED: u32 = 0xc0020004;
+pub const SMB_NTRPC_NT_INVALID_RPC_PROTSEQ: u32 = 0xc0020005;
+pub const SMB_NTRPC_NT_INVALID_STRING_UUID: u32 = 0xc0020006;
+pub const SMB_NTRPC_NT_INVALID_ENDPOINT_FORMAT: u32 = 0xc0020007;
+pub const SMB_NTRPC_NT_INVALID_NET_ADDR: u32 = 0xc0020008;
+pub const SMB_NTRPC_NT_NO_ENDPOINT_FOUND: u32 = 0xc0020009;
+pub const SMB_NTRPC_NT_INVALID_TIMEOUT: u32 = 0xc002000a;
+pub const SMB_NTRPC_NT_OBJECT_NOT_FOUND: u32 = 0xc002000b;
+pub const SMB_NTRPC_NT_ALREADY_REGISTERED: u32 = 0xc002000c;
+pub const SMB_NTRPC_NT_TYPE_ALREADY_REGISTERED: u32 = 0xc002000d;
+pub const SMB_NTRPC_NT_ALREADY_LISTENING: u32 = 0xc002000e;
+pub const SMB_NTRPC_NT_NO_PROTSEQS_REGISTERED: u32 = 0xc002000f;
+pub const SMB_NTRPC_NT_NOT_LISTENING: u32 = 0xc0020010;
+pub const SMB_NTRPC_NT_UNKNOWN_MGR_TYPE: u32 = 0xc0020011;
+pub const SMB_NTRPC_NT_UNKNOWN_IF: u32 = 0xc0020012;
+pub const SMB_NTRPC_NT_NO_BINDINGS: u32 = 0xc0020013;
+pub const SMB_NTRPC_NT_NO_PROTSEQS: u32 = 0xc0020014;
+pub const SMB_NTRPC_NT_CANT_CREATE_ENDPOINT: u32 = 0xc0020015;
+pub const SMB_NTRPC_NT_OUT_OF_RESOURCES: u32 = 0xc0020016;
+pub const SMB_NTRPC_NT_SERVER_UNAVAILABLE: u32 = 0xc0020017;
+pub const SMB_NTRPC_NT_SERVER_TOO_BUSY: u32 = 0xc0020018;
+pub const SMB_NTRPC_NT_INVALID_NETWORK_OPTIONS: u32 = 0xc0020019;
+pub const SMB_NTRPC_NT_NO_CALL_ACTIVE: u32 = 0xc002001a;
+pub const SMB_NTRPC_NT_CALL_FAILED: u32 = 0xc002001b;
+pub const SMB_NTRPC_NT_CALL_FAILED_DNE: u32 = 0xc002001c;
+pub const SMB_NTRPC_NT_PROTOCOL_ERROR: u32 = 0xc002001d;
+pub const SMB_NTRPC_NT_UNSUPPORTED_TRANS_SYN: u32 = 0xc002001f;
+pub const SMB_NTRPC_NT_UNSUPPORTED_TYPE: u32 = 0xc0020021;
+pub const SMB_NTRPC_NT_INVALID_TAG: u32 = 0xc0020022;
+pub const SMB_NTRPC_NT_INVALID_BOUND: u32 = 0xc0020023;
+pub const SMB_NTRPC_NT_NO_ENTRY_NAME: u32 = 0xc0020024;
+pub const SMB_NTRPC_NT_INVALID_NAME_SYNTAX: u32 = 0xc0020025;
+pub const SMB_NTRPC_NT_UNSUPPORTED_NAME_SYNTAX: u32 = 0xc0020026;
+pub const SMB_NTRPC_NT_UUID_NO_ADDRESS: u32 = 0xc0020028;
+pub const SMB_NTRPC_NT_DUPLICATE_ENDPOINT: u32 = 0xc0020029;
+pub const SMB_NTRPC_NT_UNKNOWN_AUTHN_TYPE: u32 = 0xc002002a;
+pub const SMB_NTRPC_NT_MAX_CALLS_TOO_SMALL: u32 = 0xc002002b;
+pub const SMB_NTRPC_NT_STRING_TOO_LONG: u32 = 0xc002002c;
+pub const SMB_NTRPC_NT_PROTSEQ_NOT_FOUND: u32 = 0xc002002d;
+pub const SMB_NTRPC_NT_PROCNUM_OUT_OF_RANGE: u32 = 0xc002002e;
+pub const SMB_NTRPC_NT_BINDING_HAS_NO_AUTH: u32 = 0xc002002f;
+pub const SMB_NTRPC_NT_UNKNOWN_AUTHN_SERVICE: u32 = 0xc0020030;
+pub const SMB_NTRPC_NT_UNKNOWN_AUTHN_LEVEL: u32 = 0xc0020031;
+pub const SMB_NTRPC_NT_INVALID_AUTH_IDENTITY: u32 = 0xc0020032;
+pub const SMB_NTRPC_NT_UNKNOWN_AUTHZ_SERVICE: u32 = 0xc0020033;
+pub const SMB_NTEPT_NT_INVALID_ENTRY: u32 = 0xc0020034;
+pub const SMB_NTEPT_NT_CANT_PERFORM_OP: u32 = 0xc0020035;
+pub const SMB_NTEPT_NT_NOT_REGISTERED: u32 = 0xc0020036;
+pub const SMB_NTRPC_NT_NOTHING_TO_EXPORT: u32 = 0xc0020037;
+pub const SMB_NTRPC_NT_INCOMPLETE_NAME: u32 = 0xc0020038;
+pub const SMB_NTRPC_NT_INVALID_VERS_OPTION: u32 = 0xc0020039;
+pub const SMB_NTRPC_NT_NO_MORE_MEMBERS: u32 = 0xc002003a;
+pub const SMB_NTRPC_NT_NOT_ALL_OBJS_UNEXPORTED: u32 = 0xc002003b;
+pub const SMB_NTRPC_NT_INTERFACE_NOT_FOUND: u32 = 0xc002003c;
+pub const SMB_NTRPC_NT_ENTRY_ALREADY_EXISTS: u32 = 0xc002003d;
+pub const SMB_NTRPC_NT_ENTRY_NOT_FOUND: u32 = 0xc002003e;
+pub const SMB_NTRPC_NT_NAME_SERVICE_UNAVAILABLE: u32 = 0xc002003f;
+pub const SMB_NTRPC_NT_INVALID_NAF_ID: u32 = 0xc0020040;
+pub const SMB_NTRPC_NT_CANNOT_SUPPORT: u32 = 0xc0020041;
+pub const SMB_NTRPC_NT_NO_CONTEXT_AVAILABLE: u32 = 0xc0020042;
+pub const SMB_NTRPC_NT_INTERNAL_ERROR: u32 = 0xc0020043;
+pub const SMB_NTRPC_NT_ZERO_DIVIDE: u32 = 0xc0020044;
+pub const SMB_NTRPC_NT_ADDRESS_ERROR: u32 = 0xc0020045;
+pub const SMB_NTRPC_NT_FP_DIV_ZERO: u32 = 0xc0020046;
+pub const SMB_NTRPC_NT_FP_UNDERFLOW: u32 = 0xc0020047;
+pub const SMB_NTRPC_NT_FP_OVERFLOW: u32 = 0xc0020048;
+pub const SMB_NTRPC_NT_CALL_IN_PROGRESS: u32 = 0xc0020049;
+pub const SMB_NTRPC_NT_NO_MORE_BINDINGS: u32 = 0xc002004a;
+pub const SMB_NTRPC_NT_GROUP_MEMBER_NOT_FOUND: u32 = 0xc002004b;
+pub const SMB_NTEPT_NT_CANT_CREATE: u32 = 0xc002004c;
+pub const SMB_NTRPC_NT_INVALID_OBJECT: u32 = 0xc002004d;
+pub const SMB_NTRPC_NT_NO_INTERFACES: u32 = 0xc002004f;
+pub const SMB_NTRPC_NT_CALL_CANCELLED: u32 = 0xc0020050;
+pub const SMB_NTRPC_NT_BINDING_INCOMPLETE: u32 = 0xc0020051;
+pub const SMB_NTRPC_NT_COMM_FAILURE: u32 = 0xc0020052;
+pub const SMB_NTRPC_NT_UNSUPPORTED_AUTHN_LEVEL: u32 = 0xc0020053;
+pub const SMB_NTRPC_NT_NO_PRINC_NAME: u32 = 0xc0020054;
+pub const SMB_NTRPC_NT_NOT_RPC_ERROR: u32 = 0xc0020055;
+pub const SMB_NTRPC_NT_SEC_PKG_ERROR: u32 = 0xc0020057;
+pub const SMB_NTRPC_NT_NOT_CANCELLED: u32 = 0xc0020058;
+pub const SMB_NTRPC_NT_INVALID_ASYNC_HANDLE: u32 = 0xc0020062;
+pub const SMB_NTRPC_NT_INVALID_ASYNC_CALL: u32 = 0xc0020063;
+pub const SMB_NTRPC_NT_PROXY_ACCESS_DENIED: u32 = 0xc0020064;
+pub const SMB_NTRPC_NT_NO_MORE_ENTRIES: u32 = 0xc0030001;
+pub const SMB_NTRPC_NT_SS_CHAR_TRANS_OPEN_FAIL: u32 = 0xc0030002;
+pub const SMB_NTRPC_NT_SS_CHAR_TRANS_SHORT_FILE: u32 = 0xc0030003;
+pub const SMB_NTRPC_NT_SS_IN_NULL_CONTEXT: u32 = 0xc0030004;
+pub const SMB_NTRPC_NT_SS_CONTEXT_MISMATCH: u32 = 0xc0030005;
+pub const SMB_NTRPC_NT_SS_CONTEXT_DAMAGED: u32 = 0xc0030006;
+pub const SMB_NTRPC_NT_SS_HANDLES_MISMATCH: u32 = 0xc0030007;
+pub const SMB_NTRPC_NT_SS_CANNOT_GET_CALL_HANDLE: u32 = 0xc0030008;
+pub const SMB_NTRPC_NT_NULL_REF_POINTER: u32 = 0xc0030009;
+pub const SMB_NTRPC_NT_ENUM_VALUE_OUT_OF_RANGE: u32 = 0xc003000a;
+pub const SMB_NTRPC_NT_BYTE_COUNT_TOO_SMALL: u32 = 0xc003000b;
+pub const SMB_NTRPC_NT_BAD_STUB_DATA: u32 = 0xc003000c;
+pub const SMB_NTRPC_NT_INVALID_ES_ACTION: u32 = 0xc0030059;
+pub const SMB_NTRPC_NT_WRONG_ES_VERSION: u32 = 0xc003005a;
+pub const SMB_NTRPC_NT_WRONG_STUB_VERSION: u32 = 0xc003005b;
+pub const SMB_NTRPC_NT_INVALID_PIPE_OBJECT: u32 = 0xc003005c;
+pub const SMB_NTRPC_NT_INVALID_PIPE_OPERATION: u32 = 0xc003005d;
+pub const SMB_NTRPC_NT_WRONG_PIPE_VERSION: u32 = 0xc003005e;
+pub const SMB_NTRPC_NT_PIPE_CLOSED: u32 = 0xc003005f;
+pub const SMB_NTRPC_NT_PIPE_DISCIPLINE_ERROR: u32 = 0xc0030060;
+pub const SMB_NTRPC_NT_PIPE_EMPTY: u32 = 0xc0030061;
+pub const SMB_NTSTATUS_PNP_BAD_MPS_TABLE: u32 = 0xc0040035;
+pub const SMB_NTSTATUS_PNP_TRANSLATION_FAILED: u32 = 0xc0040036;
+pub const SMB_NTSTATUS_PNP_IRQ_TRANSLATION_FAILED: u32 = 0xc0040037;
+pub const SMB_NTSTATUS_PNP_INVALID_ID: u32 = 0xc0040038;
+pub const SMB_NTSTATUS_IO_REISSUE_AS_CACHED: u32 = 0xc0040039;
+pub const SMB_NTSTATUS_CTX_WINSTATION_NAME_INVALID: u32 = 0xc00a0001;
+pub const SMB_NTSTATUS_CTX_INVALID_PD: u32 = 0xc00a0002;
+pub const SMB_NTSTATUS_CTX_PD_NOT_FOUND: u32 = 0xc00a0003;
+pub const SMB_NTSTATUS_CTX_CLOSE_PENDING: u32 = 0xc00a0006;
+pub const SMB_NTSTATUS_CTX_NO_OUTBUF: u32 = 0xc00a0007;
+pub const SMB_NTSTATUS_CTX_MODEM_INF_NOT_FOUND: u32 = 0xc00a0008;
+pub const SMB_NTSTATUS_CTX_INVALID_MODEMNAME: u32 = 0xc00a0009;
+pub const SMB_NTSTATUS_CTX_RESPONSE_ERROR: u32 = 0xc00a000a;
+pub const SMB_NTSTATUS_CTX_MODEM_RESPONSE_TIMEOUT: u32 = 0xc00a000b;
+pub const SMB_NTSTATUS_CTX_MODEM_RESPONSE_NO_CARRIER: u32 = 0xc00a000c;
+pub const SMB_NTSTATUS_CTX_MODEM_RESPONSE_NO_DIALTONE: u32 = 0xc00a000d;
+pub const SMB_NTSTATUS_CTX_MODEM_RESPONSE_BUSY: u32 = 0xc00a000e;
+pub const SMB_NTSTATUS_CTX_MODEM_RESPONSE_VOICE: u32 = 0xc00a000f;
+pub const SMB_NTSTATUS_CTX_TD_ERROR: u32 = 0xc00a0010;
+pub const SMB_NTSTATUS_CTX_LICENSE_CLIENT_INVALID: u32 = 0xc00a0012;
+pub const SMB_NTSTATUS_CTX_LICENSE_NOT_AVAILABLE: u32 = 0xc00a0013;
+pub const SMB_NTSTATUS_CTX_LICENSE_EXPIRED: u32 = 0xc00a0014;
+pub const SMB_NTSTATUS_CTX_WINSTATION_NOT_FOUND: u32 = 0xc00a0015;
+pub const SMB_NTSTATUS_CTX_WINSTATION_NAME_COLLISION: u32 = 0xc00a0016;
+pub const SMB_NTSTATUS_CTX_WINSTATION_BUSY: u32 = 0xc00a0017;
+pub const SMB_NTSTATUS_CTX_BAD_VIDEO_MODE: u32 = 0xc00a0018;
+pub const SMB_NTSTATUS_CTX_GRAPHICS_INVALID: u32 = 0xc00a0022;
+pub const SMB_NTSTATUS_CTX_NOT_CONSOLE: u32 = 0xc00a0024;
+pub const SMB_NTSTATUS_CTX_CLIENT_QUERY_TIMEOUT: u32 = 0xc00a0026;
+pub const SMB_NTSTATUS_CTX_CONSOLE_DISCONNECT: u32 = 0xc00a0027;
+pub const SMB_NTSTATUS_CTX_CONSOLE_CONNECT: u32 = 0xc00a0028;
+pub const SMB_NTSTATUS_CTX_SHADOW_DENIED: u32 = 0xc00a002a;
+pub const SMB_NTSTATUS_CTX_WINSTATION_ACCESS_DENIED: u32 = 0xc00a002b;
+pub const SMB_NTSTATUS_CTX_INVALID_WD: u32 = 0xc00a002e;
+pub const SMB_NTSTATUS_CTX_WD_NOT_FOUND: u32 = 0xc00a002f;
+pub const SMB_NTSTATUS_CTX_SHADOW_INVALID: u32 = 0xc00a0030;
+pub const SMB_NTSTATUS_CTX_SHADOW_DISABLED: u32 = 0xc00a0031;
+pub const SMB_NTSTATUS_RDP_PROTOCOL_ERROR: u32 = 0xc00a0032;
+pub const SMB_NTSTATUS_CTX_CLIENT_LICENSE_NOT_SET: u32 = 0xc00a0033;
+pub const SMB_NTSTATUS_CTX_CLIENT_LICENSE_IN_USE: u32 = 0xc00a0034;
+pub const SMB_NTSTATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE: u32 = 0xc00a0035;
+pub const SMB_NTSTATUS_CTX_SHADOW_NOT_RUNNING: u32 = 0xc00a0036;
+pub const SMB_NTSTATUS_CTX_LOGON_DISABLED: u32 = 0xc00a0037;
+pub const SMB_NTSTATUS_CTX_SECURITY_LAYER_ERROR: u32 = 0xc00a0038;
+pub const SMB_NTSTATUS_TS_INCOMPATIBLE_SESSIONS: u32 = 0xc00a0039;
+pub const SMB_NTSTATUS_MUI_FILE_NOT_FOUND: u32 = 0xc00b0001;
+pub const SMB_NTSTATUS_MUI_INVALID_FILE: u32 = 0xc00b0002;
+pub const SMB_NTSTATUS_MUI_INVALID_RC_CONFIG: u32 = 0xc00b0003;
+pub const SMB_NTSTATUS_MUI_INVALID_LOCALE_NAME: u32 = 0xc00b0004;
+pub const SMB_NTSTATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME: u32 = 0xc00b0005;
+pub const SMB_NTSTATUS_MUI_FILE_NOT_LOADED: u32 = 0xc00b0006;
+pub const SMB_NTSTATUS_RESOURCE_ENUM_USER_STOP: u32 = 0xc00b0007;
+pub const SMB_NTSTATUS_CLUSTER_INVALID_NODE: u32 = 0xc0130001;
+pub const SMB_NTSTATUS_CLUSTER_NODE_EXISTS: u32 = 0xc0130002;
+pub const SMB_NTSTATUS_CLUSTER_JOIN_IN_PROGRESS: u32 = 0xc0130003;
+pub const SMB_NTSTATUS_CLUSTER_NODE_NOT_FOUND: u32 = 0xc0130004;
+pub const SMB_NTSTATUS_CLUSTER_LOCAL_NODE_NOT_FOUND: u32 = 0xc0130005;
+pub const SMB_NTSTATUS_CLUSTER_NETWORK_EXISTS: u32 = 0xc0130006;
+pub const SMB_NTSTATUS_CLUSTER_NETWORK_NOT_FOUND: u32 = 0xc0130007;
+pub const SMB_NTSTATUS_CLUSTER_NETINTERFACE_EXISTS: u32 = 0xc0130008;
+pub const SMB_NTSTATUS_CLUSTER_NETINTERFACE_NOT_FOUND: u32 = 0xc0130009;
+pub const SMB_NTSTATUS_CLUSTER_INVALID_REQUEST: u32 = 0xc013000a;
+pub const SMB_NTSTATUS_CLUSTER_INVALID_NETWORK_PROVIDER: u32 = 0xc013000b;
+pub const SMB_NTSTATUS_CLUSTER_NODE_DOWN: u32 = 0xc013000c;
+pub const SMB_NTSTATUS_CLUSTER_NODE_UNREACHABLE: u32 = 0xc013000d;
+pub const SMB_NTSTATUS_CLUSTER_NODE_NOT_MEMBER: u32 = 0xc013000e;
+pub const SMB_NTSTATUS_CLUSTER_JOIN_NOT_IN_PROGRESS: u32 = 0xc013000f;
+pub const SMB_NTSTATUS_CLUSTER_INVALID_NETWORK: u32 = 0xc0130010;
+pub const SMB_NTSTATUS_CLUSTER_NO_NET_ADAPTERS: u32 = 0xc0130011;
+pub const SMB_NTSTATUS_CLUSTER_NODE_UP: u32 = 0xc0130012;
+pub const SMB_NTSTATUS_CLUSTER_NODE_PAUSED: u32 = 0xc0130013;
+pub const SMB_NTSTATUS_CLUSTER_NODE_NOT_PAUSED: u32 = 0xc0130014;
+pub const SMB_NTSTATUS_CLUSTER_NO_SECURITY_CONTEXT: u32 = 0xc0130015;
+pub const SMB_NTSTATUS_CLUSTER_NETWORK_NOT_INTERNAL: u32 = 0xc0130016;
+pub const SMB_NTSTATUS_CLUSTER_POISONED: u32 = 0xc0130017;
+pub const SMB_NTSTATUS_ACPI_INVALID_OPCODE: u32 = 0xc0140001;
+pub const SMB_NTSTATUS_ACPI_STACK_OVERFLOW: u32 = 0xc0140002;
+pub const SMB_NTSTATUS_ACPI_ASSERT_FAILED: u32 = 0xc0140003;
+pub const SMB_NTSTATUS_ACPI_INVALID_INDEX: u32 = 0xc0140004;
+pub const SMB_NTSTATUS_ACPI_INVALID_ARGUMENT: u32 = 0xc0140005;
+pub const SMB_NTSTATUS_ACPI_FATAL: u32 = 0xc0140006;
+pub const SMB_NTSTATUS_ACPI_INVALID_SUPERNAME: u32 = 0xc0140007;
+pub const SMB_NTSTATUS_ACPI_INVALID_ARGTYPE: u32 = 0xc0140008;
+pub const SMB_NTSTATUS_ACPI_INVALID_OBJTYPE: u32 = 0xc0140009;
+pub const SMB_NTSTATUS_ACPI_INVALID_TARGETTYPE: u32 = 0xc014000a;
+pub const SMB_NTSTATUS_ACPI_INCORRECT_ARGUMENT_COUNT: u32 = 0xc014000b;
+pub const SMB_NTSTATUS_ACPI_ADDRESS_NOT_MAPPED: u32 = 0xc014000c;
+pub const SMB_NTSTATUS_ACPI_INVALID_EVENTTYPE: u32 = 0xc014000d;
+pub const SMB_NTSTATUS_ACPI_HANDLER_COLLISION: u32 = 0xc014000e;
+pub const SMB_NTSTATUS_ACPI_INVALID_DATA: u32 = 0xc014000f;
+pub const SMB_NTSTATUS_ACPI_INVALID_REGION: u32 = 0xc0140010;
+pub const SMB_NTSTATUS_ACPI_INVALID_ACCESS_SIZE: u32 = 0xc0140011;
+pub const SMB_NTSTATUS_ACPI_ACQUIRE_GLOBAL_LOCK: u32 = 0xc0140012;
+pub const SMB_NTSTATUS_ACPI_ALREADY_INITIALIZED: u32 = 0xc0140013;
+pub const SMB_NTSTATUS_ACPI_NOT_INITIALIZED: u32 = 0xc0140014;
+pub const SMB_NTSTATUS_ACPI_INVALID_MUTEX_LEVEL: u32 = 0xc0140015;
+pub const SMB_NTSTATUS_ACPI_MUTEX_NOT_OWNED: u32 = 0xc0140016;
+pub const SMB_NTSTATUS_ACPI_MUTEX_NOT_OWNER: u32 = 0xc0140017;
+pub const SMB_NTSTATUS_ACPI_RS_ACCESS: u32 = 0xc0140018;
+pub const SMB_NTSTATUS_ACPI_INVALID_TABLE: u32 = 0xc0140019;
+pub const SMB_NTSTATUS_ACPI_REG_HANDLER_FAILED: u32 = 0xc0140020;
+pub const SMB_NTSTATUS_ACPI_POWER_REQUEST_FAILED: u32 = 0xc0140021;
+pub const SMB_NTSTATUS_SXS_SECTION_NOT_FOUND: u32 = 0xc0150001;
+pub const SMB_NTSTATUS_SXS_CANT_GEN_ACTCTX: u32 = 0xc0150002;
+pub const SMB_NTSTATUS_SXS_INVALID_ACTCTXDATA_FORMAT: u32 = 0xc0150003;
+pub const SMB_NTSTATUS_SXS_ASSEMBLY_NOT_FOUND: u32 = 0xc0150004;
+pub const SMB_NTSTATUS_SXS_MANIFEST_FORMAT_ERROR: u32 = 0xc0150005;
+pub const SMB_NTSTATUS_SXS_MANIFEST_PARSE_ERROR: u32 = 0xc0150006;
+pub const SMB_NTSTATUS_SXS_ACTIVATION_CONTEXT_DISABLED: u32 = 0xc0150007;
+pub const SMB_NTSTATUS_SXS_KEY_NOT_FOUND: u32 = 0xc0150008;
+pub const SMB_NTSTATUS_SXS_VERSION_CONFLICT: u32 = 0xc0150009;
+pub const SMB_NTSTATUS_SXS_WRONG_SECTION_TYPE: u32 = 0xc015000a;
+pub const SMB_NTSTATUS_SXS_THREAD_QUERIES_DISABLED: u32 = 0xc015000b;
+pub const SMB_NTSTATUS_SXS_ASSEMBLY_MISSING: u32 = 0xc015000c;
+pub const SMB_NTSTATUS_SXS_PROCESS_DEFAULT_ALREADY_SET: u32 = 0xc015000e;
+pub const SMB_NTSTATUS_SXS_EARLY_DEACTIVATION: u32 = 0xc015000f;
+pub const SMB_NTSTATUS_SXS_INVALID_DEACTIVATION: u32 = 0xc0150010;
+pub const SMB_NTSTATUS_SXS_MULTIPLE_DEACTIVATION: u32 = 0xc0150011;
+pub const SMB_NTSTATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY: u32 = 0xc0150012;
+pub const SMB_NTSTATUS_SXS_PROCESS_TERMINATION_REQUESTED: u32 = 0xc0150013;
+pub const SMB_NTSTATUS_SXS_CORRUPT_ACTIVATION_STACK: u32 = 0xc0150014;
+pub const SMB_NTSTATUS_SXS_CORRUPTION: u32 = 0xc0150015;
+pub const SMB_NTSTATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE: u32 = 0xc0150016;
+pub const SMB_NTSTATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME: u32 = 0xc0150017;
+pub const SMB_NTSTATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE: u32 = 0xc0150018;
+pub const SMB_NTSTATUS_SXS_IDENTITY_PARSE_ERROR: u32 = 0xc0150019;
+pub const SMB_NTSTATUS_SXS_COMPONENT_STORE_CORRUPT: u32 = 0xc015001a;
+pub const SMB_NTSTATUS_SXS_FILE_HASH_MISMATCH: u32 = 0xc015001b;
+pub const SMB_NTSTATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT: u32 = 0xc015001c;
+pub const SMB_NTSTATUS_SXS_IDENTITIES_DIFFERENT: u32 = 0xc015001d;
+pub const SMB_NTSTATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT: u32 = 0xc015001e;
+pub const SMB_NTSTATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY: u32 = 0xc015001f;
+pub const SMB_NTSTATUS_ADVANCED_INSTALLER_FAILED: u32 = 0xc0150020;
+pub const SMB_NTSTATUS_XML_ENCODING_MISMATCH: u32 = 0xc0150021;
+pub const SMB_NTSTATUS_SXS_MANIFEST_TOO_BIG: u32 = 0xc0150022;
+pub const SMB_NTSTATUS_SXS_SETTING_NOT_REGISTERED: u32 = 0xc0150023;
+pub const SMB_NTSTATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE: u32 = 0xc0150024;
+pub const SMB_NTSTATUS_SMI_PRIMITIVE_INSTALLER_FAILED: u32 = 0xc0150025;
+pub const SMB_NTSTATUS_GENERIC_COMMAND_FAILED: u32 = 0xc0150026;
+pub const SMB_NTSTATUS_SXS_FILE_HASH_MISSING: u32 = 0xc0150027;
+pub const SMB_NTSTATUS_TRANSACTIONAL_CONFLICT: u32 = 0xc0190001;
+pub const SMB_NTSTATUS_INVALID_TRANSACTION: u32 = 0xc0190002;
+pub const SMB_NTSTATUS_TRANSACTION_NOT_ACTIVE: u32 = 0xc0190003;
+pub const SMB_NTSTATUS_TM_INITIALIZATION_FAILED: u32 = 0xc0190004;
+pub const SMB_NTSTATUS_RM_NOT_ACTIVE: u32 = 0xc0190005;
+pub const SMB_NTSTATUS_RM_METADATA_CORRUPT: u32 = 0xc0190006;
+pub const SMB_NTSTATUS_TRANSACTION_NOT_JOINED: u32 = 0xc0190007;
+pub const SMB_NTSTATUS_DIRECTORY_NOT_RM: u32 = 0xc0190008;
+pub const SMB_NTSTATUS_TRANSACTIONS_UNSUPPORTED_REMOTE: u32 = 0xc019000a;
+pub const SMB_NTSTATUS_LOG_RESIZE_INVALID_SIZE: u32 = 0xc019000b;
+pub const SMB_NTSTATUS_REMOTE_FILE_VERSION_MISMATCH: u32 = 0xc019000c;
+pub const SMB_NTSTATUS_CRM_PROTOCOL_ALREADY_EXISTS: u32 = 0xc019000f;
+pub const SMB_NTSTATUS_TRANSACTION_PROPAGATION_FAILED: u32 = 0xc0190010;
+pub const SMB_NTSTATUS_CRM_PROTOCOL_NOT_FOUND: u32 = 0xc0190011;
+pub const SMB_NTSTATUS_TRANSACTION_SUPERIOR_EXISTS: u32 = 0xc0190012;
+pub const SMB_NTSTATUS_TRANSACTION_REQUEST_NOT_VALID: u32 = 0xc0190013;
+pub const SMB_NTSTATUS_TRANSACTION_NOT_REQUESTED: u32 = 0xc0190014;
+pub const SMB_NTSTATUS_TRANSACTION_ALREADY_ABORTED: u32 = 0xc0190015;
+pub const SMB_NTSTATUS_TRANSACTION_ALREADY_COMMITTED: u32 = 0xc0190016;
+pub const SMB_NTSTATUS_TRANSACTION_INVALID_MARSHALL_BUFFER: u32 = 0xc0190017;
+pub const SMB_NTSTATUS_CURRENT_TRANSACTION_NOT_VALID: u32 = 0xc0190018;
+pub const SMB_NTSTATUS_LOG_GROWTH_FAILED: u32 = 0xc0190019;
+pub const SMB_NTSTATUS_OBJECT_NO_LONGER_EXISTS: u32 = 0xc0190021;
+pub const SMB_NTSTATUS_STREAM_MINIVERSION_NOT_FOUND: u32 = 0xc0190022;
+pub const SMB_NTSTATUS_STREAM_MINIVERSION_NOT_VALID: u32 = 0xc0190023;
+pub const SMB_NTSTATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION: u32 = 0xc0190024;
+pub const SMB_NTSTATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT: u32 = 0xc0190025;
+pub const SMB_NTSTATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS: u32 = 0xc0190026;
+pub const SMB_NTSTATUS_HANDLE_NO_LONGER_VALID: u32 = 0xc0190028;
+pub const SMB_NTSTATUS_LOG_CORRUPTION_DETECTED: u32 = 0xc0190030;
+pub const SMB_NTSTATUS_RM_DISCONNECTED: u32 = 0xc0190032;
+pub const SMB_NTSTATUS_ENLISTMENT_NOT_SUPERIOR: u32 = 0xc0190033;
+pub const SMB_NTSTATUS_FILE_IDENTITY_NOT_PERSISTENT: u32 = 0xc0190036;
+pub const SMB_NTSTATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY: u32 = 0xc0190037;
+pub const SMB_NTSTATUS_CANT_CROSS_RM_BOUNDARY: u32 = 0xc0190038;
+pub const SMB_NTSTATUS_TXF_DIR_NOT_EMPTY: u32 = 0xc0190039;
+pub const SMB_NTSTATUS_INDOUBT_TRANSACTIONS_EXIST: u32 = 0xc019003a;
+pub const SMB_NTSTATUS_TM_VOLATILE: u32 = 0xc019003b;
+pub const SMB_NTSTATUS_ROLLBACK_TIMER_EXPIRED: u32 = 0xc019003c;
+pub const SMB_NTSTATUS_TXF_ATTRIBUTE_CORRUPT: u32 = 0xc019003d;
+pub const SMB_NTSTATUS_EFS_NOT_ALLOWED_IN_TRANSACTION: u32 = 0xc019003e;
+pub const SMB_NTSTATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED: u32 = 0xc019003f;
+pub const SMB_NTSTATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE: u32 = 0xc0190040;
+pub const SMB_NTSTATUS_TRANSACTION_REQUIRED_PROMOTION: u32 = 0xc0190043;
+pub const SMB_NTSTATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION: u32 = 0xc0190044;
+pub const SMB_NTSTATUS_TRANSACTIONS_NOT_FROZEN: u32 = 0xc0190045;
+pub const SMB_NTSTATUS_TRANSACTION_FREEZE_IN_PROGRESS: u32 = 0xc0190046;
+pub const SMB_NTSTATUS_NOT_SNAPSHOT_VOLUME: u32 = 0xc0190047;
+pub const SMB_NTSTATUS_NO_SAVEPOINT_WITH_OPEN_FILES: u32 = 0xc0190048;
+pub const SMB_NTSTATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION: u32 = 0xc0190049;
+pub const SMB_NTSTATUS_TM_IDENTITY_MISMATCH: u32 = 0xc019004a;
+pub const SMB_NTSTATUS_FLOATED_SECTION: u32 = 0xc019004b;
+pub const SMB_NTSTATUS_CANNOT_ACCEPT_TRANSACTED_WORK: u32 = 0xc019004c;
+pub const SMB_NTSTATUS_CANNOT_ABORT_TRANSACTIONS: u32 = 0xc019004d;
+pub const SMB_NTSTATUS_TRANSACTION_NOT_FOUND: u32 = 0xc019004e;
+pub const SMB_NTSTATUS_RESOURCEMANAGER_NOT_FOUND: u32 = 0xc019004f;
+pub const SMB_NTSTATUS_ENLISTMENT_NOT_FOUND: u32 = 0xc0190050;
+pub const SMB_NTSTATUS_TRANSACTIONMANAGER_NOT_FOUND: u32 = 0xc0190051;
+pub const SMB_NTSTATUS_TRANSACTIONMANAGER_NOT_ONLINE: u32 = 0xc0190052;
+pub const SMB_NTSTATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION: u32 = 0xc0190053;
+pub const SMB_NTSTATUS_TRANSACTION_NOT_ROOT: u32 = 0xc0190054;
+pub const SMB_NTSTATUS_TRANSACTION_OBJECT_EXPIRED: u32 = 0xc0190055;
+pub const SMB_NTSTATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION: u32 = 0xc0190056;
+pub const SMB_NTSTATUS_TRANSACTION_RESPONSE_NOT_ENLISTED: u32 = 0xc0190057;
+pub const SMB_NTSTATUS_TRANSACTION_RECORD_TOO_LONG: u32 = 0xc0190058;
+pub const SMB_NTSTATUS_NO_LINK_TRACKING_IN_TRANSACTION: u32 = 0xc0190059;
+pub const SMB_NTSTATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION: u32 = 0xc019005a;
+pub const SMB_NTSTATUS_TRANSACTION_INTEGRITY_VIOLATED: u32 = 0xc019005b;
+pub const SMB_NTSTATUS_EXPIRED_HANDLE: u32 = 0xc0190060;
+pub const SMB_NTSTATUS_TRANSACTION_NOT_ENLISTED: u32 = 0xc0190061;
+pub const SMB_NTSTATUS_LOG_SECTOR_INVALID: u32 = 0xc01a0001;
+pub const SMB_NTSTATUS_LOG_SECTOR_PARITY_INVALID: u32 = 0xc01a0002;
+pub const SMB_NTSTATUS_LOG_SECTOR_REMAPPED: u32 = 0xc01a0003;
+pub const SMB_NTSTATUS_LOG_BLOCK_INCOMPLETE: u32 = 0xc01a0004;
+pub const SMB_NTSTATUS_LOG_INVALID_RANGE: u32 = 0xc01a0005;
+pub const SMB_NTSTATUS_LOG_BLOCKS_EXHAUSTED: u32 = 0xc01a0006;
+pub const SMB_NTSTATUS_LOG_READ_CONTEXT_INVALID: u32 = 0xc01a0007;
+pub const SMB_NTSTATUS_LOG_RESTART_INVALID: u32 = 0xc01a0008;
+pub const SMB_NTSTATUS_LOG_BLOCK_VERSION: u32 = 0xc01a0009;
+pub const SMB_NTSTATUS_LOG_BLOCK_INVALID: u32 = 0xc01a000a;
+pub const SMB_NTSTATUS_LOG_READ_MODE_INVALID: u32 = 0xc01a000b;
+pub const SMB_NTSTATUS_LOG_METADATA_CORRUPT: u32 = 0xc01a000d;
+pub const SMB_NTSTATUS_LOG_METADATA_INVALID: u32 = 0xc01a000e;
+pub const SMB_NTSTATUS_LOG_METADATA_INCONSISTENT: u32 = 0xc01a000f;
+pub const SMB_NTSTATUS_LOG_RESERVATION_INVALID: u32 = 0xc01a0010;
+pub const SMB_NTSTATUS_LOG_CANT_DELETE: u32 = 0xc01a0011;
+pub const SMB_NTSTATUS_LOG_CONTAINER_LIMIT_EXCEEDED: u32 = 0xc01a0012;
+pub const SMB_NTSTATUS_LOG_START_OF_LOG: u32 = 0xc01a0013;
+pub const SMB_NTSTATUS_LOG_POLICY_ALREADY_INSTALLED: u32 = 0xc01a0014;
+pub const SMB_NTSTATUS_LOG_POLICY_NOT_INSTALLED: u32 = 0xc01a0015;
+pub const SMB_NTSTATUS_LOG_POLICY_INVALID: u32 = 0xc01a0016;
+pub const SMB_NTSTATUS_LOG_POLICY_CONFLICT: u32 = 0xc01a0017;
+pub const SMB_NTSTATUS_LOG_PINNED_ARCHIVE_TAIL: u32 = 0xc01a0018;
+pub const SMB_NTSTATUS_LOG_RECORD_NONEXISTENT: u32 = 0xc01a0019;
+pub const SMB_NTSTATUS_LOG_RECORDS_RESERVED_INVALID: u32 = 0xc01a001a;
+pub const SMB_NTSTATUS_LOG_SPACE_RESERVED_INVALID: u32 = 0xc01a001b;
+pub const SMB_NTSTATUS_LOG_TAIL_INVALID: u32 = 0xc01a001c;
+pub const SMB_NTSTATUS_LOG_FULL: u32 = 0xc01a001d;
+pub const SMB_NTSTATUS_LOG_MULTIPLEXED: u32 = 0xc01a001e;
+pub const SMB_NTSTATUS_LOG_DEDICATED: u32 = 0xc01a001f;
+pub const SMB_NTSTATUS_LOG_ARCHIVE_NOT_IN_PROGRESS: u32 = 0xc01a0020;
+pub const SMB_NTSTATUS_LOG_ARCHIVE_IN_PROGRESS: u32 = 0xc01a0021;
+pub const SMB_NTSTATUS_LOG_EPHEMERAL: u32 = 0xc01a0022;
+pub const SMB_NTSTATUS_LOG_NOT_ENOUGH_CONTAINERS: u32 = 0xc01a0023;
+pub const SMB_NTSTATUS_LOG_CLIENT_ALREADY_REGISTERED: u32 = 0xc01a0024;
+pub const SMB_NTSTATUS_LOG_CLIENT_NOT_REGISTERED: u32 = 0xc01a0025;
+pub const SMB_NTSTATUS_LOG_FULL_HANDLER_IN_PROGRESS: u32 = 0xc01a0026;
+pub const SMB_NTSTATUS_LOG_CONTAINER_READ_FAILED: u32 = 0xc01a0027;
+pub const SMB_NTSTATUS_LOG_CONTAINER_WRITE_FAILED: u32 = 0xc01a0028;
+pub const SMB_NTSTATUS_LOG_CONTAINER_OPEN_FAILED: u32 = 0xc01a0029;
+pub const SMB_NTSTATUS_LOG_CONTAINER_STATE_INVALID: u32 = 0xc01a002a;
+pub const SMB_NTSTATUS_LOG_STATE_INVALID: u32 = 0xc01a002b;
+pub const SMB_NTSTATUS_LOG_PINNED: u32 = 0xc01a002c;
+pub const SMB_NTSTATUS_LOG_METADATA_FLUSH_FAILED: u32 = 0xc01a002d;
+pub const SMB_NTSTATUS_LOG_INCONSISTENT_SECURITY: u32 = 0xc01a002e;
+pub const SMB_NTSTATUS_LOG_APPENDED_FLUSH_FAILED: u32 = 0xc01a002f;
+pub const SMB_NTSTATUS_LOG_PINNED_RESERVATION: u32 = 0xc01a0030;
+pub const SMB_NTSTATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD: u32 = 0xc01b00ea;
+pub const SMB_NTSTATUS_FLT_NO_HANDLER_DEFINED: u32 = 0xc01c0001;
+pub const SMB_NTSTATUS_FLT_CONTEXT_ALREADY_DEFINED: u32 = 0xc01c0002;
+pub const SMB_NTSTATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST: u32 = 0xc01c0003;
+pub const SMB_NTSTATUS_FLT_DISALLOW_FAST_IO: u32 = 0xc01c0004;
+pub const SMB_NTSTATUS_FLT_INVALID_NAME_REQUEST: u32 = 0xc01c0005;
+pub const SMB_NTSTATUS_FLT_NOT_SAFE_TO_POST_OPERATION: u32 = 0xc01c0006;
+pub const SMB_NTSTATUS_FLT_NOT_INITIALIZED: u32 = 0xc01c0007;
+pub const SMB_NTSTATUS_FLT_FILTER_NOT_READY: u32 = 0xc01c0008;
+pub const SMB_NTSTATUS_FLT_POST_OPERATION_CLEANUP: u32 = 0xc01c0009;
+pub const SMB_NTSTATUS_FLT_INTERNAL_ERROR: u32 = 0xc01c000a;
+pub const SMB_NTSTATUS_FLT_DELETING_OBJECT: u32 = 0xc01c000b;
+pub const SMB_NTSTATUS_FLT_MUST_BE_NONPAGED_POOL: u32 = 0xc01c000c;
+pub const SMB_NTSTATUS_FLT_DUPLICATE_ENTRY: u32 = 0xc01c000d;
+pub const SMB_NTSTATUS_FLT_CBDQ_DISABLED: u32 = 0xc01c000e;
+pub const SMB_NTSTATUS_FLT_DO_NOT_ATTACH: u32 = 0xc01c000f;
+pub const SMB_NTSTATUS_FLT_DO_NOT_DETACH: u32 = 0xc01c0010;
+pub const SMB_NTSTATUS_FLT_INSTANCE_ALTITUDE_COLLISION: u32 = 0xc01c0011;
+pub const SMB_NTSTATUS_FLT_INSTANCE_NAME_COLLISION: u32 = 0xc01c0012;
+pub const SMB_NTSTATUS_FLT_FILTER_NOT_FOUND: u32 = 0xc01c0013;
+pub const SMB_NTSTATUS_FLT_VOLUME_NOT_FOUND: u32 = 0xc01c0014;
+pub const SMB_NTSTATUS_FLT_INSTANCE_NOT_FOUND: u32 = 0xc01c0015;
+pub const SMB_NTSTATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND: u32 = 0xc01c0016;
+pub const SMB_NTSTATUS_FLT_INVALID_CONTEXT_REGISTRATION: u32 = 0xc01c0017;
+pub const SMB_NTSTATUS_FLT_NAME_CACHE_MISS: u32 = 0xc01c0018;
+pub const SMB_NTSTATUS_FLT_NO_DEVICE_OBJECT: u32 = 0xc01c0019;
+pub const SMB_NTSTATUS_FLT_VOLUME_ALREADY_MOUNTED: u32 = 0xc01c001a;
+pub const SMB_NTSTATUS_FLT_ALREADY_ENLISTED: u32 = 0xc01c001b;
+pub const SMB_NTSTATUS_FLT_CONTEXT_ALREADY_LINKED: u32 = 0xc01c001c;
+pub const SMB_NTSTATUS_FLT_NO_WAITER_FOR_REPLY: u32 = 0xc01c0020;
+pub const SMB_NTSTATUS_MONITOR_NO_DESCRIPTOR: u32 = 0xc01d0001;
+pub const SMB_NTSTATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT: u32 = 0xc01d0002;
+pub const SMB_NTSTATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM: u32 = 0xc01d0003;
+pub const SMB_NTSTATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK: u32 = 0xc01d0004;
+pub const SMB_NTSTATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED: u32 = 0xc01d0005;
+pub const SMB_NTSTATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK: u32 = 0xc01d0006;
+pub const SMB_NTSTATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK: u32 = 0xc01d0007;
+pub const SMB_NTSTATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA: u32 = 0xc01d0008;
+pub const SMB_NTSTATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK: u32 = 0xc01d0009;
+pub const SMB_NTSTATUS_MONITOR_INVALID_MANUFACTURE_DATE: u32 = 0xc01d000a;
+pub const SMB_NTSTATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER: u32 = 0xc01e0000;
+pub const SMB_NTSTATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER: u32 = 0xc01e0001;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER: u32 = 0xc01e0002;
+pub const SMB_NTSTATUS_GRAPHICS_ADAPTER_WAS_RESET: u32 = 0xc01e0003;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_DRIVER_MODEL: u32 = 0xc01e0004;
+pub const SMB_NTSTATUS_GRAPHICS_PRESENT_MODE_CHANGED: u32 = 0xc01e0005;
+pub const SMB_NTSTATUS_GRAPHICS_PRESENT_OCCLUDED: u32 = 0xc01e0006;
+pub const SMB_NTSTATUS_GRAPHICS_PRESENT_DENIED: u32 = 0xc01e0007;
+pub const SMB_NTSTATUS_GRAPHICS_CANNOTCOLORCONVERT: u32 = 0xc01e0008;
+pub const SMB_NTSTATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED: u32 = 0xc01e000b;
+pub const SMB_NTSTATUS_GRAPHICS_PRESENT_UNOCCLUDED: u32 = 0xc01e000c;
+pub const SMB_NTSTATUS_GRAPHICS_NO_VIDEO_MEMORY: u32 = 0xc01e0100;
+pub const SMB_NTSTATUS_GRAPHICS_CANT_LOCK_MEMORY: u32 = 0xc01e0101;
+pub const SMB_NTSTATUS_GRAPHICS_ALLOCATION_BUSY: u32 = 0xc01e0102;
+pub const SMB_NTSTATUS_GRAPHICS_TOO_MANY_REFERENCES: u32 = 0xc01e0103;
+pub const SMB_NTSTATUS_GRAPHICS_TRY_AGAIN_LATER: u32 = 0xc01e0104;
+pub const SMB_NTSTATUS_GRAPHICS_TRY_AGAIN_NOW: u32 = 0xc01e0105;
+pub const SMB_NTSTATUS_GRAPHICS_ALLOCATION_INVALID: u32 = 0xc01e0106;
+pub const SMB_NTSTATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE: u32 = 0xc01e0107;
+pub const SMB_NTSTATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED: u32 = 0xc01e0108;
+pub const SMB_NTSTATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION: u32 = 0xc01e0109;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_ALLOCATION_USAGE: u32 = 0xc01e0110;
+pub const SMB_NTSTATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION: u32 = 0xc01e0111;
+pub const SMB_NTSTATUS_GRAPHICS_ALLOCATION_CLOSED: u32 = 0xc01e0112;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE: u32 = 0xc01e0113;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE: u32 = 0xc01e0114;
+pub const SMB_NTSTATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE: u32 = 0xc01e0115;
+pub const SMB_NTSTATUS_GRAPHICS_ALLOCATION_CONTENT_LOST: u32 = 0xc01e0116;
+pub const SMB_NTSTATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE: u32 = 0xc01e0200;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY: u32 = 0xc01e0300;
+pub const SMB_NTSTATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED: u32 = 0xc01e0301;
+pub const SMB_NTSTATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED: u32 = 0xc01e0302;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN: u32 = 0xc01e0303;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE: u32 = 0xc01e0304;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET: u32 = 0xc01e0305;
+pub const SMB_NTSTATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED: u32 = 0xc01e0306;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET: u32 = 0xc01e0308;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET: u32 = 0xc01e0309;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_FREQUENCY: u32 = 0xc01e030a;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_ACTIVE_REGION: u32 = 0xc01e030b;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_TOTAL_REGION: u32 = 0xc01e030c;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE: u32 = 0xc01e0310;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE: u32 = 0xc01e0311;
+pub const SMB_NTSTATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET: u32 = 0xc01e0312;
+pub const SMB_NTSTATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY: u32 = 0xc01e0313;
+pub const SMB_NTSTATUS_GRAPHICS_MODE_ALREADY_IN_MODESET: u32 = 0xc01e0314;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET: u32 = 0xc01e0315;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET: u32 = 0xc01e0316;
+pub const SMB_NTSTATUS_GRAPHICS_SOURCE_ALREADY_IN_SET: u32 = 0xc01e0317;
+pub const SMB_NTSTATUS_GRAPHICS_TARGET_ALREADY_IN_SET: u32 = 0xc01e0318;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH: u32 = 0xc01e0319;
+pub const SMB_NTSTATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY: u32 = 0xc01e031a;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET: u32 = 0xc01e031b;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE: u32 = 0xc01e031c;
+pub const SMB_NTSTATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET: u32 = 0xc01e031d;
+pub const SMB_NTSTATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET: u32 = 0xc01e031f;
+pub const SMB_NTSTATUS_GRAPHICS_STALE_MODESET: u32 = 0xc01e0320;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET: u32 = 0xc01e0321;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE: u32 = 0xc01e0322;
+pub const SMB_NTSTATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN: u32 = 0xc01e0323;
+pub const SMB_NTSTATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE: u32 = 0xc01e0324;
+pub const SMB_NTSTATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION: u32 = 0xc01e0325;
+pub const SMB_NTSTATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES: u32 = 0xc01e0326;
+pub const SMB_NTSTATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY: u32 = 0xc01e0327;
+pub const SMB_NTSTATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE: u32 = 0xc01e0328;
+pub const SMB_NTSTATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET: u32 = 0xc01e0329;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET: u32 = 0xc01e032a;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR: u32 = 0xc01e032b;
+pub const SMB_NTSTATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET: u32 = 0xc01e032c;
+pub const SMB_NTSTATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET: u32 = 0xc01e032d;
+pub const SMB_NTSTATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE: u32 = 0xc01e032e;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE: u32 = 0xc01e032f;
+pub const SMB_NTSTATUS_GRAPHICS_RESOURCES_NOT_RELATED: u32 = 0xc01e0330;
+pub const SMB_NTSTATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE: u32 = 0xc01e0331;
+pub const SMB_NTSTATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE: u32 = 0xc01e0332;
+pub const SMB_NTSTATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET: u32 = 0xc01e0333;
+pub const SMB_NTSTATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER: u32 = 0xc01e0334;
+pub const SMB_NTSTATUS_GRAPHICS_NO_VIDPNMGR: u32 = 0xc01e0335;
+pub const SMB_NTSTATUS_GRAPHICS_NO_ACTIVE_VIDPN: u32 = 0xc01e0336;
+pub const SMB_NTSTATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY: u32 = 0xc01e0337;
+pub const SMB_NTSTATUS_GRAPHICS_MONITOR_NOT_CONNECTED: u32 = 0xc01e0338;
+pub const SMB_NTSTATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY: u32 = 0xc01e0339;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE: u32 = 0xc01e033a;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE: u32 = 0xc01e033b;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_STRIDE: u32 = 0xc01e033c;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PIXELFORMAT: u32 = 0xc01e033d;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_COLORBASIS: u32 = 0xc01e033e;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE: u32 = 0xc01e033f;
+pub const SMB_NTSTATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY: u32 = 0xc01e0340;
+pub const SMB_NTSTATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT: u32 = 0xc01e0341;
+pub const SMB_NTSTATUS_GRAPHICS_VIDPN_SOURCE_IN_USE: u32 = 0xc01e0342;
+pub const SMB_NTSTATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN: u32 = 0xc01e0343;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL: u32 = 0xc01e0344;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION: u32 = 0xc01e0345;
+pub const SMB_NTSTATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED: u32 = 0xc01e0346;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_GAMMA_RAMP: u32 = 0xc01e0347;
+pub const SMB_NTSTATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED: u32 = 0xc01e0348;
+pub const SMB_NTSTATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED: u32 = 0xc01e0349;
+pub const SMB_NTSTATUS_GRAPHICS_MODE_NOT_IN_MODESET: u32 = 0xc01e034a;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON: u32 = 0xc01e034d;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE: u32 = 0xc01e034e;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE: u32 = 0xc01e034f;
+pub const SMB_NTSTATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS: u32 = 0xc01e0350;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_SCANLINE_ORDERING: u32 = 0xc01e0352;
+pub const SMB_NTSTATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED: u32 = 0xc01e0353;
+pub const SMB_NTSTATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS: u32 = 0xc01e0354;
+pub const SMB_NTSTATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT: u32 = 0xc01e0355;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM: u32 = 0xc01e0356;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN: u32 = 0xc01e0357;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT: u32 = 0xc01e0358;
+pub const SMB_NTSTATUS_GRAPHICS_MAX_NUM_PATHS_REACHED: u32 = 0xc01e0359;
+pub const SMB_NTSTATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION: u32 = 0xc01e035a;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_CLIENT_TYPE: u32 = 0xc01e035b;
+pub const SMB_NTSTATUS_GRAPHICS_CLIENTVIDPN_NOT_SET: u32 = 0xc01e035c;
+pub const SMB_NTSTATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED: u32 = 0xc01e0400;
+pub const SMB_NTSTATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED: u32 = 0xc01e0401;
+pub const SMB_NTSTATUS_GRAPHICS_NOT_A_LINKED_ADAPTER: u32 = 0xc01e0430;
+pub const SMB_NTSTATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED: u32 = 0xc01e0431;
+pub const SMB_NTSTATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED: u32 = 0xc01e0432;
+pub const SMB_NTSTATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY: u32 = 0xc01e0433;
+pub const SMB_NTSTATUS_GRAPHICS_CHAINLINKS_NOT_STARTED: u32 = 0xc01e0434;
+pub const SMB_NTSTATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON: u32 = 0xc01e0435;
+pub const SMB_NTSTATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE: u32 = 0xc01e0436;
+pub const SMB_NTSTATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER: u32 = 0xc01e0438;
+pub const SMB_NTSTATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED: u32 = 0xc01e043b;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_NOT_SUPPORTED: u32 = 0xc01e0500;
+pub const SMB_NTSTATUS_GRAPHICS_COPP_NOT_SUPPORTED: u32 = 0xc01e0501;
+pub const SMB_NTSTATUS_GRAPHICS_UAB_NOT_SUPPORTED: u32 = 0xc01e0502;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS: u32 = 0xc01e0503;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL: u32 = 0xc01e0504;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST: u32 = 0xc01e0505;
+pub const SMB_NTSTATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME: u32 = 0xc01e0506;
+pub const SMB_NTSTATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP: u32 = 0xc01e0507;
+pub const SMB_NTSTATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED: u32 = 0xc01e0508;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INVALID_POINTER: u32 = 0xc01e050a;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INTERNAL_ERROR: u32 = 0xc01e050b;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INVALID_HANDLE: u32 = 0xc01e050c;
+pub const SMB_NTSTATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE: u32 = 0xc01e050d;
+pub const SMB_NTSTATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH: u32 = 0xc01e050e;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED: u32 = 0xc01e050f;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED: u32 = 0xc01e0510;
+pub const SMB_NTSTATUS_GRAPHICS_PVP_HFS_FAILED: u32 = 0xc01e0511;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INVALID_SRM: u32 = 0xc01e0512;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP: u32 = 0xc01e0513;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP: u32 = 0xc01e0514;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA: u32 = 0xc01e0515;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET: u32 = 0xc01e0516;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH: u32 = 0xc01e0517;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE: u32 = 0xc01e0518;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS: u32 = 0xc01e051a;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS: u32 = 0xc01e051b;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS: u32 = 0xc01e051c;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST: u32 = 0xc01e051d;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR: u32 = 0xc01e051e;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS: u32 = 0xc01e051f;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED: u32 = 0xc01e0520;
+pub const SMB_NTSTATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST: u32 = 0xc01e0521;
+pub const SMB_NTSTATUS_GRAPHICS_I2C_NOT_SUPPORTED: u32 = 0xc01e0580;
+pub const SMB_NTSTATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST: u32 = 0xc01e0581;
+pub const SMB_NTSTATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA: u32 = 0xc01e0582;
+pub const SMB_NTSTATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA: u32 = 0xc01e0583;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED: u32 = 0xc01e0584;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_DATA: u32 = 0xc01e0585;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE: u32 = 0xc01e0586;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING: u32 = 0xc01e0587;
+pub const SMB_NTSTATUS_GRAPHICS_MCA_INTERNAL_ERROR: u32 = 0xc01e0588;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND: u32 = 0xc01e0589;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH: u32 = 0xc01e058a;
+pub const SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM: u32 = 0xc01e058b;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE: u32 = 0xc01e058c;
+pub const SMB_NTSTATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS: u32 = 0xc01e058d;
+pub const SMB_NTSTATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED: u32 = 0xc01e05e0;
+pub const SMB_NTSTATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME: u32 = 0xc01e05e1;
+pub const SMB_NTSTATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP: u32 = 0xc01e05e2;
+pub const SMB_NTSTATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED: u32 = 0xc01e05e3;
+pub const SMB_NTSTATUS_GRAPHICS_INVALID_POINTER: u32 = 0xc01e05e4;
+pub const SMB_NTSTATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE: u32 = 0xc01e05e5;
+pub const SMB_NTSTATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL: u32 = 0xc01e05e6;
+pub const SMB_NTSTATUS_GRAPHICS_INTERNAL_ERROR: u32 = 0xc01e05e7;
+pub const SMB_NTSTATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS: u32 = 0xc01e05e8;
+pub const SMB_NTSTATUS_FVE_LOCKED_VOLUME: u32 = 0xc0210000;
+pub const SMB_NTSTATUS_FVE_NOT_ENCRYPTED: u32 = 0xc0210001;
+pub const SMB_NTSTATUS_FVE_BAD_INFORMATION: u32 = 0xc0210002;
+pub const SMB_NTSTATUS_FVE_TOO_SMALL: u32 = 0xc0210003;
+pub const SMB_NTSTATUS_FVE_FAILED_WRONG_FS: u32 = 0xc0210004;
+pub const SMB_NTSTATUS_FVE_FAILED_BAD_FS: u32 = 0xc0210005;
+pub const SMB_NTSTATUS_FVE_FS_NOT_EXTENDED: u32 = 0xc0210006;
+pub const SMB_NTSTATUS_FVE_FS_MOUNTED: u32 = 0xc0210007;
+pub const SMB_NTSTATUS_FVE_NO_LICENSE: u32 = 0xc0210008;
+pub const SMB_NTSTATUS_FVE_ACTION_NOT_ALLOWED: u32 = 0xc0210009;
+pub const SMB_NTSTATUS_FVE_BAD_DATA: u32 = 0xc021000a;
+pub const SMB_NTSTATUS_FVE_VOLUME_NOT_BOUND: u32 = 0xc021000b;
+pub const SMB_NTSTATUS_FVE_NOT_DATA_VOLUME: u32 = 0xc021000c;
+pub const SMB_NTSTATUS_FVE_CONV_READ_ERROR: u32 = 0xc021000d;
+pub const SMB_NTSTATUS_FVE_CONV_WRITE_ERROR: u32 = 0xc021000e;
+pub const SMB_NTSTATUS_FVE_OVERLAPPED_UPDATE: u32 = 0xc021000f;
+pub const SMB_NTSTATUS_FVE_FAILED_SECTOR_SIZE: u32 = 0xc0210010;
+pub const SMB_NTSTATUS_FVE_FAILED_AUTHENTICATION: u32 = 0xc0210011;
+pub const SMB_NTSTATUS_FVE_NOT_OS_VOLUME: u32 = 0xc0210012;
+pub const SMB_NTSTATUS_FVE_KEYFILE_NOT_FOUND: u32 = 0xc0210013;
+pub const SMB_NTSTATUS_FVE_KEYFILE_INVALID: u32 = 0xc0210014;
+pub const SMB_NTSTATUS_FVE_KEYFILE_NO_VMK: u32 = 0xc0210015;
+pub const SMB_NTSTATUS_FVE_TPM_DISABLED: u32 = 0xc0210016;
+pub const SMB_NTSTATUS_FVE_TPM_SRK_AUTH_NOT_ZERO: u32 = 0xc0210017;
+pub const SMB_NTSTATUS_FVE_TPM_INVALID_PCR: u32 = 0xc0210018;
+pub const SMB_NTSTATUS_FVE_TPM_NO_VMK: u32 = 0xc0210019;
+pub const SMB_NTSTATUS_FVE_PIN_INVALID: u32 = 0xc021001a;
+pub const SMB_NTSTATUS_FVE_AUTH_INVALID_APPLICATION: u32 = 0xc021001b;
+pub const SMB_NTSTATUS_FVE_AUTH_INVALID_CONFIG: u32 = 0xc021001c;
+pub const SMB_NTSTATUS_FVE_DEBUGGER_ENABLED: u32 = 0xc021001d;
+pub const SMB_NTSTATUS_FVE_DRY_RUN_FAILED: u32 = 0xc021001e;
+pub const SMB_NTSTATUS_FVE_BAD_METADATA_POINTER: u32 = 0xc021001f;
+pub const SMB_NTSTATUS_FVE_OLD_METADATA_COPY: u32 = 0xc0210020;
+pub const SMB_NTSTATUS_FVE_REBOOT_REQUIRED: u32 = 0xc0210021;
+pub const SMB_NTSTATUS_FVE_RAW_ACCESS: u32 = 0xc0210022;
+pub const SMB_NTSTATUS_FVE_RAW_BLOCKED: u32 = 0xc0210023;
+pub const SMB_NTSTATUS_FVE_NO_FEATURE_LICENSE: u32 = 0xc0210026;
+pub const SMB_NTSTATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED: u32 = 0xc0210027;
+pub const SMB_NTSTATUS_FVE_CONV_RECOVERY_FAILED: u32 = 0xc0210028;
+pub const SMB_NTSTATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG: u32 = 0xc0210029;
+pub const SMB_NTSTATUS_FVE_VOLUME_TOO_SMALL: u32 = 0xc0210030;
+pub const SMB_NTSTATUS_FWP_CALLOUT_NOT_FOUND: u32 = 0xc0220001;
+pub const SMB_NTSTATUS_FWP_CONDITION_NOT_FOUND: u32 = 0xc0220002;
+pub const SMB_NTSTATUS_FWP_FILTER_NOT_FOUND: u32 = 0xc0220003;
+pub const SMB_NTSTATUS_FWP_LAYER_NOT_FOUND: u32 = 0xc0220004;
+pub const SMB_NTSTATUS_FWP_PROVIDER_NOT_FOUND: u32 = 0xc0220005;
+pub const SMB_NTSTATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND: u32 = 0xc0220006;
+pub const SMB_NTSTATUS_FWP_SUBLAYER_NOT_FOUND: u32 = 0xc0220007;
+pub const SMB_NTSTATUS_FWP_NOT_FOUND: u32 = 0xc0220008;
+pub const SMB_NTSTATUS_FWP_ALREADY_EXISTS: u32 = 0xc0220009;
+pub const SMB_NTSTATUS_FWP_IN_USE: u32 = 0xc022000a;
+pub const SMB_NTSTATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS: u32 = 0xc022000b;
+pub const SMB_NTSTATUS_FWP_WRONG_SESSION: u32 = 0xc022000c;
+pub const SMB_NTSTATUS_FWP_NO_TXN_IN_PROGRESS: u32 = 0xc022000d;
+pub const SMB_NTSTATUS_FWP_TXN_IN_PROGRESS: u32 = 0xc022000e;
+pub const SMB_NTSTATUS_FWP_TXN_ABORTED: u32 = 0xc022000f;
+pub const SMB_NTSTATUS_FWP_SESSION_ABORTED: u32 = 0xc0220010;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_TXN: u32 = 0xc0220011;
+pub const SMB_NTSTATUS_FWP_TIMEOUT: u32 = 0xc0220012;
+pub const SMB_NTSTATUS_FWP_NET_EVENTS_DISABLED: u32 = 0xc0220013;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_LAYER: u32 = 0xc0220014;
+pub const SMB_NTSTATUS_FWP_KM_CLIENTS_ONLY: u32 = 0xc0220015;
+pub const SMB_NTSTATUS_FWP_LIFETIME_MISMATCH: u32 = 0xc0220016;
+pub const SMB_NTSTATUS_FWP_BUILTIN_OBJECT: u32 = 0xc0220017;
+pub const SMB_NTSTATUS_FWP_TOO_MANY_BOOTTIME_FILTERS: u32 = 0xc0220018;
+pub const SMB_NTSTATUS_FWP_NOTIFICATION_DROPPED: u32 = 0xc0220019;
+pub const SMB_NTSTATUS_FWP_TRAFFIC_MISMATCH: u32 = 0xc022001a;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_SA_STATE: u32 = 0xc022001b;
+pub const SMB_NTSTATUS_FWP_NULL_POINTER: u32 = 0xc022001c;
+pub const SMB_NTSTATUS_FWP_INVALID_ENUMERATOR: u32 = 0xc022001d;
+pub const SMB_NTSTATUS_FWP_INVALID_FLAGS: u32 = 0xc022001e;
+pub const SMB_NTSTATUS_FWP_INVALID_NET_MASK: u32 = 0xc022001f;
+pub const SMB_NTSTATUS_FWP_INVALID_RANGE: u32 = 0xc0220020;
+pub const SMB_NTSTATUS_FWP_INVALID_INTERVAL: u32 = 0xc0220021;
+pub const SMB_NTSTATUS_FWP_ZERO_LENGTH_ARRAY: u32 = 0xc0220022;
+pub const SMB_NTSTATUS_FWP_NULL_DISPLAY_NAME: u32 = 0xc0220023;
+pub const SMB_NTSTATUS_FWP_INVALID_ACTION_TYPE: u32 = 0xc0220024;
+pub const SMB_NTSTATUS_FWP_INVALID_WEIGHT: u32 = 0xc0220025;
+pub const SMB_NTSTATUS_FWP_MATCH_TYPE_MISMATCH: u32 = 0xc0220026;
+pub const SMB_NTSTATUS_FWP_TYPE_MISMATCH: u32 = 0xc0220027;
+pub const SMB_NTSTATUS_FWP_OUT_OF_BOUNDS: u32 = 0xc0220028;
+pub const SMB_NTSTATUS_FWP_RESERVED: u32 = 0xc0220029;
+pub const SMB_NTSTATUS_FWP_DUPLICATE_CONDITION: u32 = 0xc022002a;
+pub const SMB_NTSTATUS_FWP_DUPLICATE_KEYMOD: u32 = 0xc022002b;
+pub const SMB_NTSTATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER: u32 = 0xc022002c;
+pub const SMB_NTSTATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER: u32 = 0xc022002d;
+pub const SMB_NTSTATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER: u32 = 0xc022002e;
+pub const SMB_NTSTATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT: u32 = 0xc022002f;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_AUTH_METHOD: u32 = 0xc0220030;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_DH_GROUP: u32 = 0xc0220031;
+pub const SMB_NTSTATUS_FWP_EM_NOT_SUPPORTED: u32 = 0xc0220032;
+pub const SMB_NTSTATUS_FWP_NEVER_MATCH: u32 = 0xc0220033;
+pub const SMB_NTSTATUS_FWP_PROVIDER_CONTEXT_MISMATCH: u32 = 0xc0220034;
+pub const SMB_NTSTATUS_FWP_INVALID_PARAMETER: u32 = 0xc0220035;
+pub const SMB_NTSTATUS_FWP_TOO_MANY_SUBLAYERS: u32 = 0xc0220036;
+pub const SMB_NTSTATUS_FWP_CALLOUT_NOTIFICATION_FAILED: u32 = 0xc0220037;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_AUTH_CONFIG: u32 = 0xc0220038;
+pub const SMB_NTSTATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG: u32 = 0xc0220039;
+pub const SMB_NTSTATUS_FWP_DUPLICATE_AUTH_METHOD: u32 = 0xc022003c;
+pub const SMB_NTSTATUS_FWP_TCPIP_NOT_READY: u32 = 0xc0220100;
+pub const SMB_NTSTATUS_FWP_INJECT_HANDLE_CLOSING: u32 = 0xc0220101;
+pub const SMB_NTSTATUS_FWP_INJECT_HANDLE_STALE: u32 = 0xc0220102;
+pub const SMB_NTSTATUS_FWP_CANNOT_PEND: u32 = 0xc0220103;
+pub const SMB_NTSTATUS_NDIS_CLOSING: u32 = 0xc0230002;
+pub const SMB_NTSTATUS_NDIS_BAD_VERSION: u32 = 0xc0230004;
+pub const SMB_NTSTATUS_NDIS_BAD_CHARACTERISTICS: u32 = 0xc0230005;
+pub const SMB_NTSTATUS_NDIS_ADAPTER_NOT_FOUND: u32 = 0xc0230006;
+pub const SMB_NTSTATUS_NDIS_OPEN_FAILED: u32 = 0xc0230007;
+pub const SMB_NTSTATUS_NDIS_DEVICE_FAILED: u32 = 0xc0230008;
+pub const SMB_NTSTATUS_NDIS_MULTICAST_FULL: u32 = 0xc0230009;
+pub const SMB_NTSTATUS_NDIS_MULTICAST_EXISTS: u32 = 0xc023000a;
+pub const SMB_NTSTATUS_NDIS_MULTICAST_NOT_FOUND: u32 = 0xc023000b;
+pub const SMB_NTSTATUS_NDIS_REQUEST_ABORTED: u32 = 0xc023000c;
+pub const SMB_NTSTATUS_NDIS_RESET_IN_PROGRESS: u32 = 0xc023000d;
+pub const SMB_NTSTATUS_NDIS_INVALID_PACKET: u32 = 0xc023000f;
+pub const SMB_NTSTATUS_NDIS_INVALID_DEVICE_REQUEST: u32 = 0xc0230010;
+pub const SMB_NTSTATUS_NDIS_ADAPTER_NOT_READY: u32 = 0xc0230011;
+pub const SMB_NTSTATUS_NDIS_INVALID_LENGTH: u32 = 0xc0230014;
+pub const SMB_NTSTATUS_NDIS_INVALID_DATA: u32 = 0xc0230015;
+pub const SMB_NTSTATUS_NDIS_BUFFER_TOO_SHORT: u32 = 0xc0230016;
+pub const SMB_NTSTATUS_NDIS_INVALID_OID: u32 = 0xc0230017;
+pub const SMB_NTSTATUS_NDIS_ADAPTER_REMOVED: u32 = 0xc0230018;
+pub const SMB_NTSTATUS_NDIS_UNSUPPORTED_MEDIA: u32 = 0xc0230019;
+pub const SMB_NTSTATUS_NDIS_GROUP_ADDRESS_IN_USE: u32 = 0xc023001a;
+pub const SMB_NTSTATUS_NDIS_FILE_NOT_FOUND: u32 = 0xc023001b;
+pub const SMB_NTSTATUS_NDIS_ERROR_READING_FILE: u32 = 0xc023001c;
+pub const SMB_NTSTATUS_NDIS_ALREADY_MAPPED: u32 = 0xc023001d;
+pub const SMB_NTSTATUS_NDIS_RESOURCE_CONFLICT: u32 = 0xc023001e;
+pub const SMB_NTSTATUS_NDIS_MEDIA_DISCONNECTED: u32 = 0xc023001f;
+pub const SMB_NTSTATUS_NDIS_INVALID_ADDRESS: u32 = 0xc0230022;
+pub const SMB_NTSTATUS_NDIS_PAUSED: u32 = 0xc023002a;
+pub const SMB_NTSTATUS_NDIS_INTERFACE_NOT_FOUND: u32 = 0xc023002b;
+pub const SMB_NTSTATUS_NDIS_UNSUPPORTED_REVISION: u32 = 0xc023002c;
+pub const SMB_NTSTATUS_NDIS_INVALID_PORT: u32 = 0xc023002d;
+pub const SMB_NTSTATUS_NDIS_INVALID_PORT_STATE: u32 = 0xc023002e;
+pub const SMB_NTSTATUS_NDIS_LOW_POWER_STATE: u32 = 0xc023002f;
+pub const SMB_NTSTATUS_NDIS_NOT_SUPPORTED: u32 = 0xc02300bb;
+pub const SMB_NTSTATUS_NDIS_OFFLOAD_POLICY: u32 = 0xc023100f;
+pub const SMB_NTSTATUS_NDIS_OFFLOAD_CONNECTION_REJECTED: u32 = 0xc0231012;
+pub const SMB_NTSTATUS_NDIS_OFFLOAD_PATH_REJECTED: u32 = 0xc0231013;
+pub const SMB_NTSTATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED: u32 = 0xc0232000;
+pub const SMB_NTSTATUS_NDIS_DOT11_MEDIA_IN_USE: u32 = 0xc0232001;
+pub const SMB_NTSTATUS_NDIS_DOT11_POWER_STATE_INVALID: u32 = 0xc0232002;
+pub const SMB_NTSTATUS_NDIS_PM_WOL_PATTERN_LIST_FULL: u32 = 0xc0232003;
+pub const SMB_NTSTATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL: u32 = 0xc0232004;
+pub const SMB_NTSTATUS_IPSEC_BAD_SPI: u32 = 0xc0360001;
+pub const SMB_NTSTATUS_IPSEC_SA_LIFETIME_EXPIRED: u32 = 0xc0360002;
+pub const SMB_NTSTATUS_IPSEC_WRONG_SA: u32 = 0xc0360003;
+pub const SMB_NTSTATUS_IPSEC_REPLAY_CHECK_FAILED: u32 = 0xc0360004;
+pub const SMB_NTSTATUS_IPSEC_INVALID_PACKET: u32 = 0xc0360005;
+pub const SMB_NTSTATUS_IPSEC_INTEGRITY_CHECK_FAILED: u32 = 0xc0360006;
+pub const SMB_NTSTATUS_IPSEC_CLEAR_TEXT_DROP: u32 = 0xc0360007;
+pub const SMB_NTSTATUS_IPSEC_AUTH_FIREWALL_DROP: u32 = 0xc0360008;
+pub const SMB_NTSTATUS_IPSEC_THROTTLE_DROP: u32 = 0xc0360009;
+pub const SMB_NTSTATUS_IPSEC_DOSP_BLOCK: u32 = 0xc0368000;
+pub const SMB_NTSTATUS_IPSEC_DOSP_RECEIVED_MULTICAST: u32 = 0xc0368001;
+pub const SMB_NTSTATUS_IPSEC_DOSP_INVALID_PACKET: u32 = 0xc0368002;
+pub const SMB_NTSTATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED: u32 = 0xc0368003;
+pub const SMB_NTSTATUS_IPSEC_DOSP_MAX_ENTRIES: u32 = 0xc0368004;
+pub const SMB_NTSTATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED: u32 = 0xc0368005;
+pub const SMB_NTSTATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES: u32 = 0xc0368006;
+pub const SMB_NTSTATUS_VOLMGR_MIRROR_NOT_SUPPORTED: u32 = 0xc038005b;
+pub const SMB_NTSTATUS_VOLMGR_RAID5_NOT_SUPPORTED: u32 = 0xc038005c;
+pub const SMB_NTSTATUS_VIRTDISK_PROVIDER_NOT_FOUND: u32 = 0xc03a0014;
+pub const SMB_NTSTATUS_VIRTDISK_NOT_VIRTUAL_DISK: u32 = 0xc03a0015;
+pub const SMB_NTSTATUS_VHD_PARENT_VHD_ACCESS_DENIED: u32 = 0xc03a0016;
+pub const SMB_NTSTATUS_VHD_CHILD_PARENT_SIZE_MISMATCH: u32 = 0xc03a0017;
+pub const SMB_NTSTATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED: u32 = 0xc03a0018;
+pub const SMB_NTSTATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT: u32 = 0xc03a0019;
+
+pub fn smb_ntstatus_string(c: u32) -> Option<&'static str> {
+ match c {
+ SMB_NTSTATUS_SUCCESS => Some("STATUS_SUCCESS"),
+ SMB_NTSTATUS_WAIT_1 => Some("STATUS_WAIT_1"),
+ SMB_NTSTATUS_WAIT_2 => Some("STATUS_WAIT_2"),
+ SMB_NTSTATUS_WAIT_3 => Some("STATUS_WAIT_3"),
+ SMB_NTSTATUS_WAIT_63 => Some("STATUS_WAIT_63"),
+ SMB_NTSTATUS_ABANDONED => Some("STATUS_ABANDONED"),
+ SMB_NTSTATUS_ABANDONED_WAIT_63 => Some("STATUS_ABANDONED_WAIT_63"),
+ SMB_NTSTATUS_USER_APC => Some("STATUS_USER_APC"),
+ SMB_NTSTATUS_ALERTED => Some("STATUS_ALERTED"),
+ SMB_NTSTATUS_TIMEOUT => Some("STATUS_TIMEOUT"),
+ SMB_NTSTATUS_PENDING => Some("STATUS_PENDING"),
+ SMB_NTSTATUS_REPARSE => Some("STATUS_REPARSE"),
+ SMB_NTSTATUS_MORE_ENTRIES => Some("STATUS_MORE_ENTRIES"),
+ SMB_NTSTATUS_NOT_ALL_ASSIGNED => Some("STATUS_NOT_ALL_ASSIGNED"),
+ SMB_NTSTATUS_SOME_NOT_MAPPED => Some("STATUS_SOME_NOT_MAPPED"),
+ SMB_NTSTATUS_OPLOCK_BREAK_IN_PROGRESS => Some("STATUS_OPLOCK_BREAK_IN_PROGRESS"),
+ SMB_NTSTATUS_VOLUME_MOUNTED => Some("STATUS_VOLUME_MOUNTED"),
+ SMB_NTSTATUS_RXACT_COMMITTED => Some("STATUS_RXACT_COMMITTED"),
+ SMB_NTSTATUS_NOTIFY_CLEANUP => Some("STATUS_NOTIFY_CLEANUP"),
+ SMB_NTSTATUS_NOTIFY_ENUM_DIR => Some("STATUS_NOTIFY_ENUM_DIR"),
+ SMB_NTSTATUS_NO_QUOTAS_FOR_ACCOUNT => Some("STATUS_NO_QUOTAS_FOR_ACCOUNT"),
+ SMB_NTSTATUS_PRIMARY_TRANSPORT_CONNECT_FAILED => Some("STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED"),
+ SMB_NTSTATUS_PAGE_FAULT_TRANSITION => Some("STATUS_PAGE_FAULT_TRANSITION"),
+ SMB_NTSTATUS_PAGE_FAULT_DEMAND_ZERO => Some("STATUS_PAGE_FAULT_DEMAND_ZERO"),
+ SMB_NTSTATUS_PAGE_FAULT_COPY_ON_WRITE => Some("STATUS_PAGE_FAULT_COPY_ON_WRITE"),
+ SMB_NTSTATUS_PAGE_FAULT_GUARD_PAGE => Some("STATUS_PAGE_FAULT_GUARD_PAGE"),
+ SMB_NTSTATUS_PAGE_FAULT_PAGING_FILE => Some("STATUS_PAGE_FAULT_PAGING_FILE"),
+ SMB_NTSTATUS_CACHE_PAGE_LOCKED => Some("STATUS_CACHE_PAGE_LOCKED"),
+ SMB_NTSTATUS_CRASH_DUMP => Some("STATUS_CRASH_DUMP"),
+ SMB_NTSTATUS_BUFFER_ALL_ZEROS => Some("STATUS_BUFFER_ALL_ZEROS"),
+ SMB_NTSTATUS_REPARSE_OBJECT => Some("STATUS_REPARSE_OBJECT"),
+ SMB_NTSTATUS_RESOURCE_REQUIREMENTS_CHANGED => Some("STATUS_RESOURCE_REQUIREMENTS_CHANGED"),
+ SMB_NTSTATUS_TRANSLATION_COMPLETE => Some("STATUS_TRANSLATION_COMPLETE"),
+ SMB_NTSTATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY => Some("STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY"),
+ SMB_NTSTATUS_NOTHING_TO_TERMINATE => Some("STATUS_NOTHING_TO_TERMINATE"),
+ SMB_NTSTATUS_PROCESS_NOT_IN_JOB => Some("STATUS_PROCESS_NOT_IN_JOB"),
+ SMB_NTSTATUS_PROCESS_IN_JOB => Some("STATUS_PROCESS_IN_JOB"),
+ SMB_NTSTATUS_VOLSNAP_HIBERNATE_READY => Some("STATUS_VOLSNAP_HIBERNATE_READY"),
+ SMB_NTSTATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY => Some("STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY"),
+ SMB_NTSTATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED => Some("STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED"),
+ SMB_NTSTATUS_INTERRUPT_STILL_CONNECTED => Some("STATUS_INTERRUPT_STILL_CONNECTED"),
+ SMB_NTSTATUS_PROCESS_CLONED => Some("STATUS_PROCESS_CLONED"),
+ SMB_NTSTATUS_FILE_LOCKED_WITH_ONLY_READERS => Some("STATUS_FILE_LOCKED_WITH_ONLY_READERS"),
+ SMB_NTSTATUS_FILE_LOCKED_WITH_WRITERS => Some("STATUS_FILE_LOCKED_WITH_WRITERS"),
+ SMB_NTSTATUS_RESOURCEMANAGER_READ_ONLY => Some("STATUS_RESOURCEMANAGER_READ_ONLY"),
+ SMB_NTSTATUS_WAIT_FOR_OPLOCK => Some("STATUS_WAIT_FOR_OPLOCK"),
+ SMB_NTDBG_EXCEPTION_HANDLED => Some("DBG_EXCEPTION_HANDLED"),
+ SMB_NTDBG_CONTINUE => Some("DBG_CONTINUE"),
+ SMB_NTSTATUS_FLT_IO_COMPLETE => Some("STATUS_FLT_IO_COMPLETE"),
+ SMB_NTSTATUS_FILE_NOT_AVAILABLE => Some("STATUS_FILE_NOT_AVAILABLE"),
+ SMB_NTSTATUS_SHARE_UNAVAILABLE => Some("STATUS_SHARE_UNAVAILABLE"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_THREAD_AFFINITY => Some("STATUS_CALLBACK_RETURNED_THREAD_AFFINITY"),
+ SMB_NTSTATUS_OBJECT_NAME_EXISTS => Some("STATUS_OBJECT_NAME_EXISTS"),
+ SMB_NTSTATUS_THREAD_WAS_SUSPENDED => Some("STATUS_THREAD_WAS_SUSPENDED"),
+ SMB_NTSTATUS_WORKING_SET_LIMIT_RANGE => Some("STATUS_WORKING_SET_LIMIT_RANGE"),
+ SMB_NTSTATUS_IMAGE_NOT_AT_BASE => Some("STATUS_IMAGE_NOT_AT_BASE"),
+ SMB_NTSTATUS_RXACT_STATE_CREATED => Some("STATUS_RXACT_STATE_CREATED"),
+ SMB_NTSTATUS_SEGMENT_NOTIFICATION => Some("STATUS_SEGMENT_NOTIFICATION"),
+ SMB_NTSTATUS_LOCAL_USER_SESSION_KEY => Some("STATUS_LOCAL_USER_SESSION_KEY"),
+ SMB_NTSTATUS_BAD_CURRENT_DIRECTORY => Some("STATUS_BAD_CURRENT_DIRECTORY"),
+ SMB_NTSTATUS_SERIAL_MORE_WRITES => Some("STATUS_SERIAL_MORE_WRITES"),
+ SMB_NTSTATUS_REGISTRY_RECOVERED => Some("STATUS_REGISTRY_RECOVERED"),
+ SMB_NTSTATUS_FT_READ_RECOVERY_FROM_BACKUP => Some("STATUS_FT_READ_RECOVERY_FROM_BACKUP"),
+ SMB_NTSTATUS_FT_WRITE_RECOVERY => Some("STATUS_FT_WRITE_RECOVERY"),
+ SMB_NTSTATUS_SERIAL_COUNTER_TIMEOUT => Some("STATUS_SERIAL_COUNTER_TIMEOUT"),
+ SMB_NTSTATUS_NULL_LM_PASSWORD => Some("STATUS_NULL_LM_PASSWORD"),
+ SMB_NTSTATUS_IMAGE_MACHINE_TYPE_MISMATCH => Some("STATUS_IMAGE_MACHINE_TYPE_MISMATCH"),
+ SMB_NTSTATUS_RECEIVE_PARTIAL => Some("STATUS_RECEIVE_PARTIAL"),
+ SMB_NTSTATUS_RECEIVE_EXPEDITED => Some("STATUS_RECEIVE_EXPEDITED"),
+ SMB_NTSTATUS_RECEIVE_PARTIAL_EXPEDITED => Some("STATUS_RECEIVE_PARTIAL_EXPEDITED"),
+ SMB_NTSTATUS_EVENT_DONE => Some("STATUS_EVENT_DONE"),
+ SMB_NTSTATUS_EVENT_PENDING => Some("STATUS_EVENT_PENDING"),
+ SMB_NTSTATUS_CHECKING_FILE_SYSTEM => Some("STATUS_CHECKING_FILE_SYSTEM"),
+ SMB_NTSTATUS_FATAL_APP_EXIT => Some("STATUS_FATAL_APP_EXIT"),
+ SMB_NTSTATUS_PREDEFINED_HANDLE => Some("STATUS_PREDEFINED_HANDLE"),
+ SMB_NTSTATUS_WAS_UNLOCKED => Some("STATUS_WAS_UNLOCKED"),
+ SMB_NTSTATUS_SERVICE_NOTIFICATION => Some("STATUS_SERVICE_NOTIFICATION"),
+ SMB_NTSTATUS_WAS_LOCKED => Some("STATUS_WAS_LOCKED"),
+ SMB_NTSTATUS_LOG_HARD_ERROR => Some("STATUS_LOG_HARD_ERROR"),
+ SMB_NTSTATUS_ALREADY_WIN32 => Some("STATUS_ALREADY_WIN32"),
+ SMB_NTSTATUS_WX86_UNSIMULATE => Some("STATUS_WX86_UNSIMULATE"),
+ SMB_NTSTATUS_WX86_CONTINUE => Some("STATUS_WX86_CONTINUE"),
+ SMB_NTSTATUS_WX86_SINGLE_STEP => Some("STATUS_WX86_SINGLE_STEP"),
+ SMB_NTSTATUS_WX86_BREAKPOINT => Some("STATUS_WX86_BREAKPOINT"),
+ SMB_NTSTATUS_WX86_EXCEPTION_CONTINUE => Some("STATUS_WX86_EXCEPTION_CONTINUE"),
+ SMB_NTSTATUS_WX86_EXCEPTION_LASTCHANCE => Some("STATUS_WX86_EXCEPTION_LASTCHANCE"),
+ SMB_NTSTATUS_WX86_EXCEPTION_CHAIN => Some("STATUS_WX86_EXCEPTION_CHAIN"),
+ SMB_NTSTATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE => Some("STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE"),
+ SMB_NTSTATUS_NO_YIELD_PERFORMED => Some("STATUS_NO_YIELD_PERFORMED"),
+ SMB_NTSTATUS_TIMER_RESUME_IGNORED => Some("STATUS_TIMER_RESUME_IGNORED"),
+ SMB_NTSTATUS_ARBITRATION_UNHANDLED => Some("STATUS_ARBITRATION_UNHANDLED"),
+ SMB_NTSTATUS_CARDBUS_NOT_SUPPORTED => Some("STATUS_CARDBUS_NOT_SUPPORTED"),
+ SMB_NTSTATUS_WX86_CREATEWX86TIB => Some("STATUS_WX86_CREATEWX86TIB"),
+ SMB_NTSTATUS_MP_PROCESSOR_MISMATCH => Some("STATUS_MP_PROCESSOR_MISMATCH"),
+ SMB_NTSTATUS_HIBERNATED => Some("STATUS_HIBERNATED"),
+ SMB_NTSTATUS_RESUME_HIBERNATION => Some("STATUS_RESUME_HIBERNATION"),
+ SMB_NTSTATUS_FIRMWARE_UPDATED => Some("STATUS_FIRMWARE_UPDATED"),
+ SMB_NTSTATUS_DRIVERS_LEAKING_LOCKED_PAGES => Some("STATUS_DRIVERS_LEAKING_LOCKED_PAGES"),
+ SMB_NTSTATUS_MESSAGE_RETRIEVED => Some("STATUS_MESSAGE_RETRIEVED"),
+ SMB_NTSTATUS_SYSTEM_POWERSTATE_TRANSITION => Some("STATUS_SYSTEM_POWERSTATE_TRANSITION"),
+ SMB_NTSTATUS_ALPC_CHECK_COMPLETION_LIST => Some("STATUS_ALPC_CHECK_COMPLETION_LIST"),
+ SMB_NTSTATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION => Some("STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION"),
+ SMB_NTSTATUS_ACCESS_AUDIT_BY_POLICY => Some("STATUS_ACCESS_AUDIT_BY_POLICY"),
+ SMB_NTSTATUS_ABANDON_HIBERFILE => Some("STATUS_ABANDON_HIBERFILE"),
+ SMB_NTSTATUS_BIZRULES_NOT_ENABLED => Some("STATUS_BIZRULES_NOT_ENABLED"),
+ SMB_NTSTATUS_WAKE_SYSTEM => Some("STATUS_WAKE_SYSTEM"),
+ SMB_NTSTATUS_DS_SHUTTING_DOWN => Some("STATUS_DS_SHUTTING_DOWN"),
+ SMB_NTDBG_REPLY_LATER => Some("DBG_REPLY_LATER"),
+ SMB_NTDBG_UNABLE_TO_PROVIDE_HANDLE => Some("DBG_UNABLE_TO_PROVIDE_HANDLE"),
+ SMB_NTDBG_TERMINATE_THREAD => Some("DBG_TERMINATE_THREAD"),
+ SMB_NTDBG_TERMINATE_PROCESS => Some("DBG_TERMINATE_PROCESS"),
+ SMB_NTDBG_CONTROL_C => Some("DBG_CONTROL_C"),
+ SMB_NTDBG_PRINTEXCEPTION_C => Some("DBG_PRINTEXCEPTION_C"),
+ SMB_NTDBG_RIPEXCEPTION => Some("DBG_RIPEXCEPTION"),
+ SMB_NTDBG_CONTROL_BREAK => Some("DBG_CONTROL_BREAK"),
+ SMB_NTDBG_COMMAND_EXCEPTION => Some("DBG_COMMAND_EXCEPTION"),
+ SMB_NTRPC_NT_UUID_LOCAL_ONLY => Some("RPC_NT_UUID_LOCAL_ONLY"),
+ SMB_NTRPC_NT_SEND_INCOMPLETE => Some("RPC_NT_SEND_INCOMPLETE"),
+ SMB_NTSTATUS_CTX_CDM_CONNECT => Some("STATUS_CTX_CDM_CONNECT"),
+ SMB_NTSTATUS_CTX_CDM_DISCONNECT => Some("STATUS_CTX_CDM_DISCONNECT"),
+ SMB_NTSTATUS_SXS_RELEASE_ACTIVATION_CONTEXT => Some("STATUS_SXS_RELEASE_ACTIVATION_CONTEXT"),
+ SMB_NTSTATUS_RECOVERY_NOT_NEEDED => Some("STATUS_RECOVERY_NOT_NEEDED"),
+ SMB_NTSTATUS_RM_ALREADY_STARTED => Some("STATUS_RM_ALREADY_STARTED"),
+ SMB_NTSTATUS_LOG_NO_RESTART => Some("STATUS_LOG_NO_RESTART"),
+ SMB_NTSTATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST => Some("STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST"),
+ SMB_NTSTATUS_GRAPHICS_PARTIAL_DATA_POPULATED => Some("STATUS_GRAPHICS_PARTIAL_DATA_POPULATED"),
+ SMB_NTSTATUS_GRAPHICS_DRIVER_MISMATCH => Some("STATUS_GRAPHICS_DRIVER_MISMATCH"),
+ SMB_NTSTATUS_GRAPHICS_MODE_NOT_PINNED => Some("STATUS_GRAPHICS_MODE_NOT_PINNED"),
+ SMB_NTSTATUS_GRAPHICS_NO_PREFERRED_MODE => Some("STATUS_GRAPHICS_NO_PREFERRED_MODE"),
+ SMB_NTSTATUS_GRAPHICS_DATASET_IS_EMPTY => Some("STATUS_GRAPHICS_DATASET_IS_EMPTY"),
+ SMB_NTSTATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET => Some("STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET"),
+ SMB_NTSTATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED => Some("STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED"),
+ SMB_NTSTATUS_GRAPHICS_UNKNOWN_CHILD_STATUS => Some("STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS"),
+ SMB_NTSTATUS_GRAPHICS_LEADLINK_START_DEFERRED => Some("STATUS_GRAPHICS_LEADLINK_START_DEFERRED"),
+ SMB_NTSTATUS_GRAPHICS_POLLING_TOO_FREQUENTLY => Some("STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY"),
+ SMB_NTSTATUS_GRAPHICS_START_DEFERRED => Some("STATUS_GRAPHICS_START_DEFERRED"),
+ SMB_NTSTATUS_NDIS_INDICATION_REQUIRED => Some("STATUS_NDIS_INDICATION_REQUIRED"),
+ SMB_NTSTATUS_GUARD_PAGE_VIOLATION => Some("STATUS_GUARD_PAGE_VIOLATION"),
+ SMB_NTSTATUS_DATATYPE_MISALIGNMENT => Some("STATUS_DATATYPE_MISALIGNMENT"),
+ SMB_NTSTATUS_BREAKPOINT => Some("STATUS_BREAKPOINT"),
+ SMB_NTSTATUS_SINGLE_STEP => Some("STATUS_SINGLE_STEP"),
+ SMB_NTSTATUS_BUFFER_OVERFLOW => Some("STATUS_BUFFER_OVERFLOW"),
+ SMB_NTSTATUS_NO_MORE_FILES => Some("STATUS_NO_MORE_FILES"),
+ SMB_NTSTATUS_WAKE_SYSTEM_DEBUGGER => Some("STATUS_WAKE_SYSTEM_DEBUGGER"),
+ SMB_NTSTATUS_HANDLES_CLOSED => Some("STATUS_HANDLES_CLOSED"),
+ SMB_NTSTATUS_NO_INHERITANCE => Some("STATUS_NO_INHERITANCE"),
+ SMB_NTSTATUS_GUID_SUBSTITUTION_MADE => Some("STATUS_GUID_SUBSTITUTION_MADE"),
+ SMB_NTSTATUS_PARTIAL_COPY => Some("STATUS_PARTIAL_COPY"),
+ SMB_NTSTATUS_DEVICE_PAPER_EMPTY => Some("STATUS_DEVICE_PAPER_EMPTY"),
+ SMB_NTSTATUS_DEVICE_POWERED_OFF => Some("STATUS_DEVICE_POWERED_OFF"),
+ SMB_NTSTATUS_DEVICE_OFF_LINE => Some("STATUS_DEVICE_OFF_LINE"),
+ SMB_NTSTATUS_DEVICE_BUSY => Some("STATUS_DEVICE_BUSY"),
+ SMB_NTSTATUS_NO_MORE_EAS => Some("STATUS_NO_MORE_EAS"),
+ SMB_NTSTATUS_INVALID_EA_NAME => Some("STATUS_INVALID_EA_NAME"),
+ SMB_NTSTATUS_EA_LIST_INCONSISTENT => Some("STATUS_EA_LIST_INCONSISTENT"),
+ SMB_NTSTATUS_INVALID_EA_FLAG => Some("STATUS_INVALID_EA_FLAG"),
+ SMB_NTSTATUS_VERIFY_REQUIRED => Some("STATUS_VERIFY_REQUIRED"),
+ SMB_NTSTATUS_EXTRANEOUS_INFORMATION => Some("STATUS_EXTRANEOUS_INFORMATION"),
+ SMB_NTSTATUS_RXACT_COMMIT_NECESSARY => Some("STATUS_RXACT_COMMIT_NECESSARY"),
+ SMB_NTSTATUS_NO_MORE_ENTRIES => Some("STATUS_NO_MORE_ENTRIES"),
+ SMB_NTSTATUS_FILEMARK_DETECTED => Some("STATUS_FILEMARK_DETECTED"),
+ SMB_NTSTATUS_MEDIA_CHANGED => Some("STATUS_MEDIA_CHANGED"),
+ SMB_NTSTATUS_BUS_RESET => Some("STATUS_BUS_RESET"),
+ SMB_NTSTATUS_END_OF_MEDIA => Some("STATUS_END_OF_MEDIA"),
+ SMB_NTSTATUS_BEGINNING_OF_MEDIA => Some("STATUS_BEGINNING_OF_MEDIA"),
+ SMB_NTSTATUS_MEDIA_CHECK => Some("STATUS_MEDIA_CHECK"),
+ SMB_NTSTATUS_SETMARK_DETECTED => Some("STATUS_SETMARK_DETECTED"),
+ SMB_NTSTATUS_NO_DATA_DETECTED => Some("STATUS_NO_DATA_DETECTED"),
+ SMB_NTSTATUS_REDIRECTOR_HAS_OPEN_HANDLES => Some("STATUS_REDIRECTOR_HAS_OPEN_HANDLES"),
+ SMB_NTSTATUS_SERVER_HAS_OPEN_HANDLES => Some("STATUS_SERVER_HAS_OPEN_HANDLES"),
+ SMB_NTSTATUS_ALREADY_DISCONNECTED => Some("STATUS_ALREADY_DISCONNECTED"),
+ SMB_NTSTATUS_LONGJUMP => Some("STATUS_LONGJUMP"),
+ SMB_NTSTATUS_CLEANER_CARTRIDGE_INSTALLED => Some("STATUS_CLEANER_CARTRIDGE_INSTALLED"),
+ SMB_NTSTATUS_PLUGPLAY_QUERY_VETOED => Some("STATUS_PLUGPLAY_QUERY_VETOED"),
+ SMB_NTSTATUS_UNWIND_CONSOLIDATE => Some("STATUS_UNWIND_CONSOLIDATE"),
+ SMB_NTSTATUS_REGISTRY_HIVE_RECOVERED => Some("STATUS_REGISTRY_HIVE_RECOVERED"),
+ SMB_NTSTATUS_DLL_MIGHT_BE_INSECURE => Some("STATUS_DLL_MIGHT_BE_INSECURE"),
+ SMB_NTSTATUS_DLL_MIGHT_BE_INCOMPATIBLE => Some("STATUS_DLL_MIGHT_BE_INCOMPATIBLE"),
+ SMB_NTSTATUS_STOPPED_ON_SYMLINK => Some("STATUS_STOPPED_ON_SYMLINK"),
+ SMB_NTSTATUS_DEVICE_REQUIRES_CLEANING => Some("STATUS_DEVICE_REQUIRES_CLEANING"),
+ SMB_NTSTATUS_DEVICE_DOOR_OPEN => Some("STATUS_DEVICE_DOOR_OPEN"),
+ SMB_NTSTATUS_DATA_LOST_REPAIR => Some("STATUS_DATA_LOST_REPAIR"),
+ SMB_NTDBG_EXCEPTION_NOT_HANDLED => Some("DBG_EXCEPTION_NOT_HANDLED"),
+ SMB_NTSTATUS_CLUSTER_NODE_ALREADY_UP => Some("STATUS_CLUSTER_NODE_ALREADY_UP"),
+ SMB_NTSTATUS_CLUSTER_NODE_ALREADY_DOWN => Some("STATUS_CLUSTER_NODE_ALREADY_DOWN"),
+ SMB_NTSTATUS_CLUSTER_NETWORK_ALREADY_ONLINE => Some("STATUS_CLUSTER_NETWORK_ALREADY_ONLINE"),
+ SMB_NTSTATUS_CLUSTER_NETWORK_ALREADY_OFFLINE => Some("STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE"),
+ SMB_NTSTATUS_CLUSTER_NODE_ALREADY_MEMBER => Some("STATUS_CLUSTER_NODE_ALREADY_MEMBER"),
+ SMB_NTSTATUS_COULD_NOT_RESIZE_LOG => Some("STATUS_COULD_NOT_RESIZE_LOG"),
+ SMB_NTSTATUS_NO_TXF_METADATA => Some("STATUS_NO_TXF_METADATA"),
+ SMB_NTSTATUS_CANT_RECOVER_WITH_HANDLE_OPEN => Some("STATUS_CANT_RECOVER_WITH_HANDLE_OPEN"),
+ SMB_NTSTATUS_TXF_METADATA_ALREADY_PRESENT => Some("STATUS_TXF_METADATA_ALREADY_PRESENT"),
+ SMB_NTSTATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET => Some("STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET"),
+ SMB_NTSTATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED => Some("STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED"),
+ SMB_NTSTATUS_FLT_BUFFER_TOO_SMALL => Some("STATUS_FLT_BUFFER_TOO_SMALL"),
+ SMB_NTSTATUS_FVE_PARTIAL_METADATA => Some("STATUS_FVE_PARTIAL_METADATA"),
+ SMB_NTSTATUS_FVE_TRANSIENT_STATE => Some("STATUS_FVE_TRANSIENT_STATE"),
+ SMB_NTSTATUS_UNSUCCESSFUL => Some("STATUS_UNSUCCESSFUL"),
+ SMB_NTSTATUS_NOT_IMPLEMENTED => Some("STATUS_NOT_IMPLEMENTED"),
+ SMB_NTSTATUS_INVALID_INFO_CLASS => Some("STATUS_INVALID_INFO_CLASS"),
+ SMB_NTSTATUS_INFO_LENGTH_MISMATCH => Some("STATUS_INFO_LENGTH_MISMATCH"),
+ SMB_NTSTATUS_ACCESS_VIOLATION => Some("STATUS_ACCESS_VIOLATION"),
+ SMB_NTSTATUS_IN_PAGE_ERROR => Some("STATUS_IN_PAGE_ERROR"),
+ SMB_NTSTATUS_PAGEFILE_QUOTA => Some("STATUS_PAGEFILE_QUOTA"),
+ SMB_NTSTATUS_INVALID_HANDLE => Some("STATUS_INVALID_HANDLE"),
+ SMB_NTSTATUS_BAD_INITIAL_STACK => Some("STATUS_BAD_INITIAL_STACK"),
+ SMB_NTSTATUS_BAD_INITIAL_PC => Some("STATUS_BAD_INITIAL_PC"),
+ SMB_NTSTATUS_INVALID_CID => Some("STATUS_INVALID_CID"),
+ SMB_NTSTATUS_TIMER_NOT_CANCELED => Some("STATUS_TIMER_NOT_CANCELED"),
+ SMB_NTSTATUS_INVALID_PARAMETER => Some("STATUS_INVALID_PARAMETER"),
+ SMB_NTSTATUS_NO_SUCH_DEVICE => Some("STATUS_NO_SUCH_DEVICE"),
+ SMB_NTSTATUS_NO_SUCH_FILE => Some("STATUS_NO_SUCH_FILE"),
+ SMB_NTSTATUS_INVALID_DEVICE_REQUEST => Some("STATUS_INVALID_DEVICE_REQUEST"),
+ SMB_NTSTATUS_END_OF_FILE => Some("STATUS_END_OF_FILE"),
+ SMB_NTSTATUS_WRONG_VOLUME => Some("STATUS_WRONG_VOLUME"),
+ SMB_NTSTATUS_NO_MEDIA_IN_DEVICE => Some("STATUS_NO_MEDIA_IN_DEVICE"),
+ SMB_NTSTATUS_UNRECOGNIZED_MEDIA => Some("STATUS_UNRECOGNIZED_MEDIA"),
+ SMB_NTSTATUS_NONEXISTENT_SECTOR => Some("STATUS_NONEXISTENT_SECTOR"),
+ SMB_NTSTATUS_MORE_PROCESSING_REQUIRED => Some("STATUS_MORE_PROCESSING_REQUIRED"),
+ SMB_NTSTATUS_NO_MEMORY => Some("STATUS_NO_MEMORY"),
+ SMB_NTSTATUS_CONFLICTING_ADDRESSES => Some("STATUS_CONFLICTING_ADDRESSES"),
+ SMB_NTSTATUS_NOT_MAPPED_VIEW => Some("STATUS_NOT_MAPPED_VIEW"),
+ SMB_NTSTATUS_UNABLE_TO_FREE_VM => Some("STATUS_UNABLE_TO_FREE_VM"),
+ SMB_NTSTATUS_UNABLE_TO_DELETE_SECTION => Some("STATUS_UNABLE_TO_DELETE_SECTION"),
+ SMB_NTSTATUS_INVALID_SYSTEM_SERVICE => Some("STATUS_INVALID_SYSTEM_SERVICE"),
+ SMB_NTSTATUS_ILLEGAL_INSTRUCTION => Some("STATUS_ILLEGAL_INSTRUCTION"),
+ SMB_NTSTATUS_INVALID_LOCK_SEQUENCE => Some("STATUS_INVALID_LOCK_SEQUENCE"),
+ SMB_NTSTATUS_INVALID_VIEW_SIZE => Some("STATUS_INVALID_VIEW_SIZE"),
+ SMB_NTSTATUS_INVALID_FILE_FOR_SECTION => Some("STATUS_INVALID_FILE_FOR_SECTION"),
+ SMB_NTSTATUS_ALREADY_COMMITTED => Some("STATUS_ALREADY_COMMITTED"),
+ SMB_NTSTATUS_ACCESS_DENIED => Some("STATUS_ACCESS_DENIED"),
+ SMB_NTSTATUS_BUFFER_TOO_SMALL => Some("STATUS_BUFFER_TOO_SMALL"),
+ SMB_NTSTATUS_OBJECT_TYPE_MISMATCH => Some("STATUS_OBJECT_TYPE_MISMATCH"),
+ SMB_NTSTATUS_NONCONTINUABLE_EXCEPTION => Some("STATUS_NONCONTINUABLE_EXCEPTION"),
+ SMB_NTSTATUS_INVALID_DISPOSITION => Some("STATUS_INVALID_DISPOSITION"),
+ SMB_NTSTATUS_UNWIND => Some("STATUS_UNWIND"),
+ SMB_NTSTATUS_BAD_STACK => Some("STATUS_BAD_STACK"),
+ SMB_NTSTATUS_INVALID_UNWIND_TARGET => Some("STATUS_INVALID_UNWIND_TARGET"),
+ SMB_NTSTATUS_NOT_LOCKED => Some("STATUS_NOT_LOCKED"),
+ SMB_NTSTATUS_PARITY_ERROR => Some("STATUS_PARITY_ERROR"),
+ SMB_NTSTATUS_UNABLE_TO_DECOMMIT_VM => Some("STATUS_UNABLE_TO_DECOMMIT_VM"),
+ SMB_NTSTATUS_NOT_COMMITTED => Some("STATUS_NOT_COMMITTED"),
+ SMB_NTSTATUS_INVALID_PORT_ATTRIBUTES => Some("STATUS_INVALID_PORT_ATTRIBUTES"),
+ SMB_NTSTATUS_PORT_MESSAGE_TOO_LONG => Some("STATUS_PORT_MESSAGE_TOO_LONG"),
+ SMB_NTSTATUS_INVALID_PARAMETER_MIX => Some("STATUS_INVALID_PARAMETER_MIX"),
+ SMB_NTSTATUS_INVALID_QUOTA_LOWER => Some("STATUS_INVALID_QUOTA_LOWER"),
+ SMB_NTSTATUS_DISK_CORRUPT_ERROR => Some("STATUS_DISK_CORRUPT_ERROR"),
+ SMB_NTSTATUS_OBJECT_NAME_INVALID => Some("STATUS_OBJECT_NAME_INVALID"),
+ SMB_NTSTATUS_OBJECT_NAME_NOT_FOUND => Some("STATUS_OBJECT_NAME_NOT_FOUND"),
+ SMB_NTSTATUS_OBJECT_NAME_COLLISION => Some("STATUS_OBJECT_NAME_COLLISION"),
+ SMB_NTSTATUS_PORT_DISCONNECTED => Some("STATUS_PORT_DISCONNECTED"),
+ SMB_NTSTATUS_DEVICE_ALREADY_ATTACHED => Some("STATUS_DEVICE_ALREADY_ATTACHED"),
+ SMB_NTSTATUS_OBJECT_PATH_INVALID => Some("STATUS_OBJECT_PATH_INVALID"),
+ SMB_NTSTATUS_OBJECT_PATH_NOT_FOUND => Some("STATUS_OBJECT_PATH_NOT_FOUND"),
+ SMB_NTSTATUS_OBJECT_PATH_SYNTAX_BAD => Some("STATUS_OBJECT_PATH_SYNTAX_BAD"),
+ SMB_NTSTATUS_DATA_OVERRUN => Some("STATUS_DATA_OVERRUN"),
+ SMB_NTSTATUS_DATA_LATE_ERROR => Some("STATUS_DATA_LATE_ERROR"),
+ SMB_NTSTATUS_DATA_ERROR => Some("STATUS_DATA_ERROR"),
+ SMB_NTSTATUS_CRC_ERROR => Some("STATUS_CRC_ERROR"),
+ SMB_NTSTATUS_SECTION_TOO_BIG => Some("STATUS_SECTION_TOO_BIG"),
+ SMB_NTSTATUS_PORT_CONNECTION_REFUSED => Some("STATUS_PORT_CONNECTION_REFUSED"),
+ SMB_NTSTATUS_INVALID_PORT_HANDLE => Some("STATUS_INVALID_PORT_HANDLE"),
+ SMB_NTSTATUS_SHARING_VIOLATION => Some("STATUS_SHARING_VIOLATION"),
+ SMB_NTSTATUS_QUOTA_EXCEEDED => Some("STATUS_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_INVALID_PAGE_PROTECTION => Some("STATUS_INVALID_PAGE_PROTECTION"),
+ SMB_NTSTATUS_MUTANT_NOT_OWNED => Some("STATUS_MUTANT_NOT_OWNED"),
+ SMB_NTSTATUS_SEMAPHORE_LIMIT_EXCEEDED => Some("STATUS_SEMAPHORE_LIMIT_EXCEEDED"),
+ SMB_NTSTATUS_PORT_ALREADY_SET => Some("STATUS_PORT_ALREADY_SET"),
+ SMB_NTSTATUS_SECTION_NOT_IMAGE => Some("STATUS_SECTION_NOT_IMAGE"),
+ SMB_NTSTATUS_SUSPEND_COUNT_EXCEEDED => Some("STATUS_SUSPEND_COUNT_EXCEEDED"),
+ SMB_NTSTATUS_THREAD_IS_TERMINATING => Some("STATUS_THREAD_IS_TERMINATING"),
+ SMB_NTSTATUS_BAD_WORKING_SET_LIMIT => Some("STATUS_BAD_WORKING_SET_LIMIT"),
+ SMB_NTSTATUS_INCOMPATIBLE_FILE_MAP => Some("STATUS_INCOMPATIBLE_FILE_MAP"),
+ SMB_NTSTATUS_SECTION_PROTECTION => Some("STATUS_SECTION_PROTECTION"),
+ SMB_NTSTATUS_EAS_NOT_SUPPORTED => Some("STATUS_EAS_NOT_SUPPORTED"),
+ SMB_NTSTATUS_EA_TOO_LARGE => Some("STATUS_EA_TOO_LARGE"),
+ SMB_NTSTATUS_NONEXISTENT_EA_ENTRY => Some("STATUS_NONEXISTENT_EA_ENTRY"),
+ SMB_NTSTATUS_NO_EAS_ON_FILE => Some("STATUS_NO_EAS_ON_FILE"),
+ SMB_NTSTATUS_EA_CORRUPT_ERROR => Some("STATUS_EA_CORRUPT_ERROR"),
+ SMB_NTSTATUS_FILE_LOCK_CONFLICT => Some("STATUS_FILE_LOCK_CONFLICT"),
+ SMB_NTSTATUS_LOCK_NOT_GRANTED => Some("STATUS_LOCK_NOT_GRANTED"),
+ SMB_NTSTATUS_DELETE_PENDING => Some("STATUS_DELETE_PENDING"),
+ SMB_NTSTATUS_CTL_FILE_NOT_SUPPORTED => Some("STATUS_CTL_FILE_NOT_SUPPORTED"),
+ SMB_NTSTATUS_UNKNOWN_REVISION => Some("STATUS_UNKNOWN_REVISION"),
+ SMB_NTSTATUS_REVISION_MISMATCH => Some("STATUS_REVISION_MISMATCH"),
+ SMB_NTSTATUS_INVALID_OWNER => Some("STATUS_INVALID_OWNER"),
+ SMB_NTSTATUS_INVALID_PRIMARY_GROUP => Some("STATUS_INVALID_PRIMARY_GROUP"),
+ SMB_NTSTATUS_NO_IMPERSONATION_TOKEN => Some("STATUS_NO_IMPERSONATION_TOKEN"),
+ SMB_NTSTATUS_CANT_DISABLE_MANDATORY => Some("STATUS_CANT_DISABLE_MANDATORY"),
+ SMB_NTSTATUS_NO_LOGON_SERVERS => Some("STATUS_NO_LOGON_SERVERS"),
+ SMB_NTSTATUS_NO_SUCH_LOGON_SESSION => Some("STATUS_NO_SUCH_LOGON_SESSION"),
+ SMB_NTSTATUS_NO_SUCH_PRIVILEGE => Some("STATUS_NO_SUCH_PRIVILEGE"),
+ SMB_NTSTATUS_PRIVILEGE_NOT_HELD => Some("STATUS_PRIVILEGE_NOT_HELD"),
+ SMB_NTSTATUS_INVALID_ACCOUNT_NAME => Some("STATUS_INVALID_ACCOUNT_NAME"),
+ SMB_NTSTATUS_USER_EXISTS => Some("STATUS_USER_EXISTS"),
+ SMB_NTSTATUS_NO_SUCH_USER => Some("STATUS_NO_SUCH_USER"),
+ SMB_NTSTATUS_GROUP_EXISTS => Some("STATUS_GROUP_EXISTS"),
+ SMB_NTSTATUS_NO_SUCH_GROUP => Some("STATUS_NO_SUCH_GROUP"),
+ SMB_NTSTATUS_MEMBER_IN_GROUP => Some("STATUS_MEMBER_IN_GROUP"),
+ SMB_NTSTATUS_MEMBER_NOT_IN_GROUP => Some("STATUS_MEMBER_NOT_IN_GROUP"),
+ SMB_NTSTATUS_LAST_ADMIN => Some("STATUS_LAST_ADMIN"),
+ SMB_NTSTATUS_WRONG_PASSWORD => Some("STATUS_WRONG_PASSWORD"),
+ SMB_NTSTATUS_ILL_FORMED_PASSWORD => Some("STATUS_ILL_FORMED_PASSWORD"),
+ SMB_NTSTATUS_PASSWORD_RESTRICTION => Some("STATUS_PASSWORD_RESTRICTION"),
+ SMB_NTSTATUS_LOGON_FAILURE => Some("STATUS_LOGON_FAILURE"),
+ SMB_NTSTATUS_ACCOUNT_RESTRICTION => Some("STATUS_ACCOUNT_RESTRICTION"),
+ SMB_NTSTATUS_INVALID_LOGON_HOURS => Some("STATUS_INVALID_LOGON_HOURS"),
+ SMB_NTSTATUS_INVALID_WORKSTATION => Some("STATUS_INVALID_WORKSTATION"),
+ SMB_NTSTATUS_PASSWORD_EXPIRED => Some("STATUS_PASSWORD_EXPIRED"),
+ SMB_NTSTATUS_ACCOUNT_DISABLED => Some("STATUS_ACCOUNT_DISABLED"),
+ SMB_NTSTATUS_NONE_MAPPED => Some("STATUS_NONE_MAPPED"),
+ SMB_NTSTATUS_TOO_MANY_LUIDS_REQUESTED => Some("STATUS_TOO_MANY_LUIDS_REQUESTED"),
+ SMB_NTSTATUS_LUIDS_EXHAUSTED => Some("STATUS_LUIDS_EXHAUSTED"),
+ SMB_NTSTATUS_INVALID_SUB_AUTHORITY => Some("STATUS_INVALID_SUB_AUTHORITY"),
+ SMB_NTSTATUS_INVALID_ACL => Some("STATUS_INVALID_ACL"),
+ SMB_NTSTATUS_INVALID_SID => Some("STATUS_INVALID_SID"),
+ SMB_NTSTATUS_INVALID_SECURITY_DESCR => Some("STATUS_INVALID_SECURITY_DESCR"),
+ SMB_NTSTATUS_PROCEDURE_NOT_FOUND => Some("STATUS_PROCEDURE_NOT_FOUND"),
+ SMB_NTSTATUS_INVALID_IMAGE_FORMAT => Some("STATUS_INVALID_IMAGE_FORMAT"),
+ SMB_NTSTATUS_NO_TOKEN => Some("STATUS_NO_TOKEN"),
+ SMB_NTSTATUS_BAD_INHERITANCE_ACL => Some("STATUS_BAD_INHERITANCE_ACL"),
+ SMB_NTSTATUS_RANGE_NOT_LOCKED => Some("STATUS_RANGE_NOT_LOCKED"),
+ SMB_NTSTATUS_DISK_FULL => Some("STATUS_DISK_FULL"),
+ SMB_NTSTATUS_SERVER_DISABLED => Some("STATUS_SERVER_DISABLED"),
+ SMB_NTSTATUS_SERVER_NOT_DISABLED => Some("STATUS_SERVER_NOT_DISABLED"),
+ SMB_NTSTATUS_TOO_MANY_GUIDS_REQUESTED => Some("STATUS_TOO_MANY_GUIDS_REQUESTED"),
+ SMB_NTSTATUS_GUIDS_EXHAUSTED => Some("STATUS_GUIDS_EXHAUSTED"),
+ SMB_NTSTATUS_INVALID_ID_AUTHORITY => Some("STATUS_INVALID_ID_AUTHORITY"),
+ SMB_NTSTATUS_AGENTS_EXHAUSTED => Some("STATUS_AGENTS_EXHAUSTED"),
+ SMB_NTSTATUS_INVALID_VOLUME_LABEL => Some("STATUS_INVALID_VOLUME_LABEL"),
+ SMB_NTSTATUS_SECTION_NOT_EXTENDED => Some("STATUS_SECTION_NOT_EXTENDED"),
+ SMB_NTSTATUS_NOT_MAPPED_DATA => Some("STATUS_NOT_MAPPED_DATA"),
+ SMB_NTSTATUS_RESOURCE_DATA_NOT_FOUND => Some("STATUS_RESOURCE_DATA_NOT_FOUND"),
+ SMB_NTSTATUS_RESOURCE_TYPE_NOT_FOUND => Some("STATUS_RESOURCE_TYPE_NOT_FOUND"),
+ SMB_NTSTATUS_RESOURCE_NAME_NOT_FOUND => Some("STATUS_RESOURCE_NAME_NOT_FOUND"),
+ SMB_NTSTATUS_ARRAY_BOUNDS_EXCEEDED => Some("STATUS_ARRAY_BOUNDS_EXCEEDED"),
+ SMB_NTSTATUS_FLOAT_DENORMAL_OPERAND => Some("STATUS_FLOAT_DENORMAL_OPERAND"),
+ SMB_NTSTATUS_FLOAT_DIVIDE_BY_ZERO => Some("STATUS_FLOAT_DIVIDE_BY_ZERO"),
+ SMB_NTSTATUS_FLOAT_INEXACT_RESULT => Some("STATUS_FLOAT_INEXACT_RESULT"),
+ SMB_NTSTATUS_FLOAT_INVALID_OPERATION => Some("STATUS_FLOAT_INVALID_OPERATION"),
+ SMB_NTSTATUS_FLOAT_OVERFLOW => Some("STATUS_FLOAT_OVERFLOW"),
+ SMB_NTSTATUS_FLOAT_STACK_CHECK => Some("STATUS_FLOAT_STACK_CHECK"),
+ SMB_NTSTATUS_FLOAT_UNDERFLOW => Some("STATUS_FLOAT_UNDERFLOW"),
+ SMB_NTSTATUS_INTEGER_DIVIDE_BY_ZERO => Some("STATUS_INTEGER_DIVIDE_BY_ZERO"),
+ SMB_NTSTATUS_INTEGER_OVERFLOW => Some("STATUS_INTEGER_OVERFLOW"),
+ SMB_NTSTATUS_PRIVILEGED_INSTRUCTION => Some("STATUS_PRIVILEGED_INSTRUCTION"),
+ SMB_NTSTATUS_TOO_MANY_PAGING_FILES => Some("STATUS_TOO_MANY_PAGING_FILES"),
+ SMB_NTSTATUS_FILE_INVALID => Some("STATUS_FILE_INVALID"),
+ SMB_NTSTATUS_ALLOTTED_SPACE_EXCEEDED => Some("STATUS_ALLOTTED_SPACE_EXCEEDED"),
+ SMB_NTSTATUS_INSUFFICIENT_RESOURCES => Some("STATUS_INSUFFICIENT_RESOURCES"),
+ SMB_NTSTATUS_DFS_EXIT_PATH_FOUND => Some("STATUS_DFS_EXIT_PATH_FOUND"),
+ SMB_NTSTATUS_DEVICE_DATA_ERROR => Some("STATUS_DEVICE_DATA_ERROR"),
+ SMB_NTSTATUS_DEVICE_NOT_CONNECTED => Some("STATUS_DEVICE_NOT_CONNECTED"),
+ SMB_NTSTATUS_FREE_VM_NOT_AT_BASE => Some("STATUS_FREE_VM_NOT_AT_BASE"),
+ SMB_NTSTATUS_MEMORY_NOT_ALLOCATED => Some("STATUS_MEMORY_NOT_ALLOCATED"),
+ SMB_NTSTATUS_WORKING_SET_QUOTA => Some("STATUS_WORKING_SET_QUOTA"),
+ SMB_NTSTATUS_MEDIA_WRITE_PROTECTED => Some("STATUS_MEDIA_WRITE_PROTECTED"),
+ SMB_NTSTATUS_DEVICE_NOT_READY => Some("STATUS_DEVICE_NOT_READY"),
+ SMB_NTSTATUS_INVALID_GROUP_ATTRIBUTES => Some("STATUS_INVALID_GROUP_ATTRIBUTES"),
+ SMB_NTSTATUS_BAD_IMPERSONATION_LEVEL => Some("STATUS_BAD_IMPERSONATION_LEVEL"),
+ SMB_NTSTATUS_CANT_OPEN_ANONYMOUS => Some("STATUS_CANT_OPEN_ANONYMOUS"),
+ SMB_NTSTATUS_BAD_VALIDATION_CLASS => Some("STATUS_BAD_VALIDATION_CLASS"),
+ SMB_NTSTATUS_BAD_TOKEN_TYPE => Some("STATUS_BAD_TOKEN_TYPE"),
+ SMB_NTSTATUS_BAD_MASTER_BOOT_RECORD => Some("STATUS_BAD_MASTER_BOOT_RECORD"),
+ SMB_NTSTATUS_INSTRUCTION_MISALIGNMENT => Some("STATUS_INSTRUCTION_MISALIGNMENT"),
+ SMB_NTSTATUS_INSTANCE_NOT_AVAILABLE => Some("STATUS_INSTANCE_NOT_AVAILABLE"),
+ SMB_NTSTATUS_PIPE_NOT_AVAILABLE => Some("STATUS_PIPE_NOT_AVAILABLE"),
+ SMB_NTSTATUS_INVALID_PIPE_STATE => Some("STATUS_INVALID_PIPE_STATE"),
+ SMB_NTSTATUS_PIPE_BUSY => Some("STATUS_PIPE_BUSY"),
+ SMB_NTSTATUS_ILLEGAL_FUNCTION => Some("STATUS_ILLEGAL_FUNCTION"),
+ SMB_NTSTATUS_PIPE_DISCONNECTED => Some("STATUS_PIPE_DISCONNECTED"),
+ SMB_NTSTATUS_PIPE_CLOSING => Some("STATUS_PIPE_CLOSING"),
+ SMB_NTSTATUS_PIPE_CONNECTED => Some("STATUS_PIPE_CONNECTED"),
+ SMB_NTSTATUS_PIPE_LISTENING => Some("STATUS_PIPE_LISTENING"),
+ SMB_NTSTATUS_INVALID_READ_MODE => Some("STATUS_INVALID_READ_MODE"),
+ SMB_NTSTATUS_IO_TIMEOUT => Some("STATUS_IO_TIMEOUT"),
+ SMB_NTSTATUS_FILE_FORCED_CLOSED => Some("STATUS_FILE_FORCED_CLOSED"),
+ SMB_NTSTATUS_PROFILING_NOT_STARTED => Some("STATUS_PROFILING_NOT_STARTED"),
+ SMB_NTSTATUS_PROFILING_NOT_STOPPED => Some("STATUS_PROFILING_NOT_STOPPED"),
+ SMB_NTSTATUS_COULD_NOT_INTERPRET => Some("STATUS_COULD_NOT_INTERPRET"),
+ SMB_NTSTATUS_FILE_IS_A_DIRECTORY => Some("STATUS_FILE_IS_A_DIRECTORY"),
+ SMB_NTSTATUS_NOT_SUPPORTED => Some("STATUS_NOT_SUPPORTED"),
+ SMB_NTSTATUS_REMOTE_NOT_LISTENING => Some("STATUS_REMOTE_NOT_LISTENING"),
+ SMB_NTSTATUS_DUPLICATE_NAME => Some("STATUS_DUPLICATE_NAME"),
+ SMB_NTSTATUS_BAD_NETWORK_PATH => Some("STATUS_BAD_NETWORK_PATH"),
+ SMB_NTSTATUS_NETWORK_BUSY => Some("STATUS_NETWORK_BUSY"),
+ SMB_NTSTATUS_DEVICE_DOES_NOT_EXIST => Some("STATUS_DEVICE_DOES_NOT_EXIST"),
+ SMB_NTSTATUS_TOO_MANY_COMMANDS => Some("STATUS_TOO_MANY_COMMANDS"),
+ SMB_NTSTATUS_ADAPTER_HARDWARE_ERROR => Some("STATUS_ADAPTER_HARDWARE_ERROR"),
+ SMB_NTSTATUS_INVALID_NETWORK_RESPONSE => Some("STATUS_INVALID_NETWORK_RESPONSE"),
+ SMB_NTSTATUS_UNEXPECTED_NETWORK_ERROR => Some("STATUS_UNEXPECTED_NETWORK_ERROR"),
+ SMB_NTSTATUS_BAD_REMOTE_ADAPTER => Some("STATUS_BAD_REMOTE_ADAPTER"),
+ SMB_NTSTATUS_PRINT_QUEUE_FULL => Some("STATUS_PRINT_QUEUE_FULL"),
+ SMB_NTSTATUS_NO_SPOOL_SPACE => Some("STATUS_NO_SPOOL_SPACE"),
+ SMB_NTSTATUS_PRINT_CANCELLED => Some("STATUS_PRINT_CANCELLED"),
+ SMB_NTSTATUS_NETWORK_NAME_DELETED => Some("STATUS_NETWORK_NAME_DELETED"),
+ SMB_NTSTATUS_NETWORK_ACCESS_DENIED => Some("STATUS_NETWORK_ACCESS_DENIED"),
+ SMB_NTSTATUS_BAD_DEVICE_TYPE => Some("STATUS_BAD_DEVICE_TYPE"),
+ SMB_NTSTATUS_BAD_NETWORK_NAME => Some("STATUS_BAD_NETWORK_NAME"),
+ SMB_NTSTATUS_TOO_MANY_NAMES => Some("STATUS_TOO_MANY_NAMES"),
+ SMB_NTSTATUS_TOO_MANY_SESSIONS => Some("STATUS_TOO_MANY_SESSIONS"),
+ SMB_NTSTATUS_SHARING_PAUSED => Some("STATUS_SHARING_PAUSED"),
+ SMB_NTSTATUS_REQUEST_NOT_ACCEPTED => Some("STATUS_REQUEST_NOT_ACCEPTED"),
+ SMB_NTSTATUS_REDIRECTOR_PAUSED => Some("STATUS_REDIRECTOR_PAUSED"),
+ SMB_NTSTATUS_NET_WRITE_FAULT => Some("STATUS_NET_WRITE_FAULT"),
+ SMB_NTSTATUS_PROFILING_AT_LIMIT => Some("STATUS_PROFILING_AT_LIMIT"),
+ SMB_NTSTATUS_NOT_SAME_DEVICE => Some("STATUS_NOT_SAME_DEVICE"),
+ SMB_NTSTATUS_FILE_RENAMED => Some("STATUS_FILE_RENAMED"),
+ SMB_NTSTATUS_VIRTUAL_CIRCUIT_CLOSED => Some("STATUS_VIRTUAL_CIRCUIT_CLOSED"),
+ SMB_NTSTATUS_NO_SECURITY_ON_OBJECT => Some("STATUS_NO_SECURITY_ON_OBJECT"),
+ SMB_NTSTATUS_CANT_WAIT => Some("STATUS_CANT_WAIT"),
+ SMB_NTSTATUS_PIPE_EMPTY => Some("STATUS_PIPE_EMPTY"),
+ SMB_NTSTATUS_CANT_ACCESS_DOMAIN_INFO => Some("STATUS_CANT_ACCESS_DOMAIN_INFO"),
+ SMB_NTSTATUS_CANT_TERMINATE_SELF => Some("STATUS_CANT_TERMINATE_SELF"),
+ SMB_NTSTATUS_INVALID_SERVER_STATE => Some("STATUS_INVALID_SERVER_STATE"),
+ SMB_NTSTATUS_INVALID_DOMAIN_STATE => Some("STATUS_INVALID_DOMAIN_STATE"),
+ SMB_NTSTATUS_INVALID_DOMAIN_ROLE => Some("STATUS_INVALID_DOMAIN_ROLE"),
+ SMB_NTSTATUS_NO_SUCH_DOMAIN => Some("STATUS_NO_SUCH_DOMAIN"),
+ SMB_NTSTATUS_DOMAIN_EXISTS => Some("STATUS_DOMAIN_EXISTS"),
+ SMB_NTSTATUS_DOMAIN_LIMIT_EXCEEDED => Some("STATUS_DOMAIN_LIMIT_EXCEEDED"),
+ SMB_NTSTATUS_OPLOCK_NOT_GRANTED => Some("STATUS_OPLOCK_NOT_GRANTED"),
+ SMB_NTSTATUS_INVALID_OPLOCK_PROTOCOL => Some("STATUS_INVALID_OPLOCK_PROTOCOL"),
+ SMB_NTSTATUS_INTERNAL_DB_CORRUPTION => Some("STATUS_INTERNAL_DB_CORRUPTION"),
+ SMB_NTSTATUS_INTERNAL_ERROR => Some("STATUS_INTERNAL_ERROR"),
+ SMB_NTSTATUS_GENERIC_NOT_MAPPED => Some("STATUS_GENERIC_NOT_MAPPED"),
+ SMB_NTSTATUS_BAD_DESCRIPTOR_FORMAT => Some("STATUS_BAD_DESCRIPTOR_FORMAT"),
+ SMB_NTSTATUS_INVALID_USER_BUFFER => Some("STATUS_INVALID_USER_BUFFER"),
+ SMB_NTSTATUS_UNEXPECTED_IO_ERROR => Some("STATUS_UNEXPECTED_IO_ERROR"),
+ SMB_NTSTATUS_UNEXPECTED_MM_CREATE_ERR => Some("STATUS_UNEXPECTED_MM_CREATE_ERR"),
+ SMB_NTSTATUS_UNEXPECTED_MM_MAP_ERROR => Some("STATUS_UNEXPECTED_MM_MAP_ERROR"),
+ SMB_NTSTATUS_UNEXPECTED_MM_EXTEND_ERR => Some("STATUS_UNEXPECTED_MM_EXTEND_ERR"),
+ SMB_NTSTATUS_NOT_LOGON_PROCESS => Some("STATUS_NOT_LOGON_PROCESS"),
+ SMB_NTSTATUS_LOGON_SESSION_EXISTS => Some("STATUS_LOGON_SESSION_EXISTS"),
+ SMB_NTSTATUS_INVALID_PARAMETER_1 => Some("STATUS_INVALID_PARAMETER_1"),
+ SMB_NTSTATUS_INVALID_PARAMETER_2 => Some("STATUS_INVALID_PARAMETER_2"),
+ SMB_NTSTATUS_INVALID_PARAMETER_3 => Some("STATUS_INVALID_PARAMETER_3"),
+ SMB_NTSTATUS_INVALID_PARAMETER_4 => Some("STATUS_INVALID_PARAMETER_4"),
+ SMB_NTSTATUS_INVALID_PARAMETER_5 => Some("STATUS_INVALID_PARAMETER_5"),
+ SMB_NTSTATUS_INVALID_PARAMETER_6 => Some("STATUS_INVALID_PARAMETER_6"),
+ SMB_NTSTATUS_INVALID_PARAMETER_7 => Some("STATUS_INVALID_PARAMETER_7"),
+ SMB_NTSTATUS_INVALID_PARAMETER_8 => Some("STATUS_INVALID_PARAMETER_8"),
+ SMB_NTSTATUS_INVALID_PARAMETER_9 => Some("STATUS_INVALID_PARAMETER_9"),
+ SMB_NTSTATUS_INVALID_PARAMETER_10 => Some("STATUS_INVALID_PARAMETER_10"),
+ SMB_NTSTATUS_INVALID_PARAMETER_11 => Some("STATUS_INVALID_PARAMETER_11"),
+ SMB_NTSTATUS_INVALID_PARAMETER_12 => Some("STATUS_INVALID_PARAMETER_12"),
+ SMB_NTSTATUS_REDIRECTOR_NOT_STARTED => Some("STATUS_REDIRECTOR_NOT_STARTED"),
+ SMB_NTSTATUS_REDIRECTOR_STARTED => Some("STATUS_REDIRECTOR_STARTED"),
+ SMB_NTSTATUS_STACK_OVERFLOW => Some("STATUS_STACK_OVERFLOW"),
+ SMB_NTSTATUS_NO_SUCH_PACKAGE => Some("STATUS_NO_SUCH_PACKAGE"),
+ SMB_NTSTATUS_BAD_FUNCTION_TABLE => Some("STATUS_BAD_FUNCTION_TABLE"),
+ SMB_NTSTATUS_VARIABLE_NOT_FOUND => Some("STATUS_VARIABLE_NOT_FOUND"),
+ SMB_NTSTATUS_DIRECTORY_NOT_EMPTY => Some("STATUS_DIRECTORY_NOT_EMPTY"),
+ SMB_NTSTATUS_FILE_CORRUPT_ERROR => Some("STATUS_FILE_CORRUPT_ERROR"),
+ SMB_NTSTATUS_NOT_A_DIRECTORY => Some("STATUS_NOT_A_DIRECTORY"),
+ SMB_NTSTATUS_BAD_LOGON_SESSION_STATE => Some("STATUS_BAD_LOGON_SESSION_STATE"),
+ SMB_NTSTATUS_LOGON_SESSION_COLLISION => Some("STATUS_LOGON_SESSION_COLLISION"),
+ SMB_NTSTATUS_NAME_TOO_LONG => Some("STATUS_NAME_TOO_LONG"),
+ SMB_NTSTATUS_FILES_OPEN => Some("STATUS_FILES_OPEN"),
+ SMB_NTSTATUS_CONNECTION_IN_USE => Some("STATUS_CONNECTION_IN_USE"),
+ SMB_NTSTATUS_MESSAGE_NOT_FOUND => Some("STATUS_MESSAGE_NOT_FOUND"),
+ SMB_NTSTATUS_PROCESS_IS_TERMINATING => Some("STATUS_PROCESS_IS_TERMINATING"),
+ SMB_NTSTATUS_INVALID_LOGON_TYPE => Some("STATUS_INVALID_LOGON_TYPE"),
+ SMB_NTSTATUS_NO_GUID_TRANSLATION => Some("STATUS_NO_GUID_TRANSLATION"),
+ SMB_NTSTATUS_CANNOT_IMPERSONATE => Some("STATUS_CANNOT_IMPERSONATE"),
+ SMB_NTSTATUS_IMAGE_ALREADY_LOADED => Some("STATUS_IMAGE_ALREADY_LOADED"),
+ SMB_NTSTATUS_NO_LDT => Some("STATUS_NO_LDT"),
+ SMB_NTSTATUS_INVALID_LDT_SIZE => Some("STATUS_INVALID_LDT_SIZE"),
+ SMB_NTSTATUS_INVALID_LDT_OFFSET => Some("STATUS_INVALID_LDT_OFFSET"),
+ SMB_NTSTATUS_INVALID_LDT_DESCRIPTOR => Some("STATUS_INVALID_LDT_DESCRIPTOR"),
+ SMB_NTSTATUS_INVALID_IMAGE_NE_FORMAT => Some("STATUS_INVALID_IMAGE_NE_FORMAT"),
+ SMB_NTSTATUS_RXACT_INVALID_STATE => Some("STATUS_RXACT_INVALID_STATE"),
+ SMB_NTSTATUS_RXACT_COMMIT_FAILURE => Some("STATUS_RXACT_COMMIT_FAILURE"),
+ SMB_NTSTATUS_MAPPED_FILE_SIZE_ZERO => Some("STATUS_MAPPED_FILE_SIZE_ZERO"),
+ SMB_NTSTATUS_TOO_MANY_OPENED_FILES => Some("STATUS_TOO_MANY_OPENED_FILES"),
+ SMB_NTSTATUS_CANCELLED => Some("STATUS_CANCELLED"),
+ SMB_NTSTATUS_CANNOT_DELETE => Some("STATUS_CANNOT_DELETE"),
+ SMB_NTSTATUS_INVALID_COMPUTER_NAME => Some("STATUS_INVALID_COMPUTER_NAME"),
+ SMB_NTSTATUS_FILE_DELETED => Some("STATUS_FILE_DELETED"),
+ SMB_NTSTATUS_SPECIAL_ACCOUNT => Some("STATUS_SPECIAL_ACCOUNT"),
+ SMB_NTSTATUS_SPECIAL_GROUP => Some("STATUS_SPECIAL_GROUP"),
+ SMB_NTSTATUS_SPECIAL_USER => Some("STATUS_SPECIAL_USER"),
+ SMB_NTSTATUS_MEMBERS_PRIMARY_GROUP => Some("STATUS_MEMBERS_PRIMARY_GROUP"),
+ SMB_NTSTATUS_FILE_CLOSED => Some("STATUS_FILE_CLOSED"),
+ SMB_NTSTATUS_TOO_MANY_THREADS => Some("STATUS_TOO_MANY_THREADS"),
+ SMB_NTSTATUS_THREAD_NOT_IN_PROCESS => Some("STATUS_THREAD_NOT_IN_PROCESS"),
+ SMB_NTSTATUS_TOKEN_ALREADY_IN_USE => Some("STATUS_TOKEN_ALREADY_IN_USE"),
+ SMB_NTSTATUS_PAGEFILE_QUOTA_EXCEEDED => Some("STATUS_PAGEFILE_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_COMMITMENT_LIMIT => Some("STATUS_COMMITMENT_LIMIT"),
+ SMB_NTSTATUS_INVALID_IMAGE_LE_FORMAT => Some("STATUS_INVALID_IMAGE_LE_FORMAT"),
+ SMB_NTSTATUS_INVALID_IMAGE_NOT_MZ => Some("STATUS_INVALID_IMAGE_NOT_MZ"),
+ SMB_NTSTATUS_INVALID_IMAGE_PROTECT => Some("STATUS_INVALID_IMAGE_PROTECT"),
+ SMB_NTSTATUS_INVALID_IMAGE_WIN_16 => Some("STATUS_INVALID_IMAGE_WIN_16"),
+ SMB_NTSTATUS_LOGON_SERVER_CONFLICT => Some("STATUS_LOGON_SERVER_CONFLICT"),
+ SMB_NTSTATUS_TIME_DIFFERENCE_AT_DC => Some("STATUS_TIME_DIFFERENCE_AT_DC"),
+ SMB_NTSTATUS_SYNCHRONIZATION_REQUIRED => Some("STATUS_SYNCHRONIZATION_REQUIRED"),
+ SMB_NTSTATUS_DLL_NOT_FOUND => Some("STATUS_DLL_NOT_FOUND"),
+ SMB_NTSTATUS_OPEN_FAILED => Some("STATUS_OPEN_FAILED"),
+ SMB_NTSTATUS_IO_PRIVILEGE_FAILED => Some("STATUS_IO_PRIVILEGE_FAILED"),
+ SMB_NTSTATUS_ORDINAL_NOT_FOUND => Some("STATUS_ORDINAL_NOT_FOUND"),
+ SMB_NTSTATUS_ENTRYPOINT_NOT_FOUND => Some("STATUS_ENTRYPOINT_NOT_FOUND"),
+ SMB_NTSTATUS_CONTROL_C_EXIT => Some("STATUS_CONTROL_C_EXIT"),
+ SMB_NTSTATUS_LOCAL_DISCONNECT => Some("STATUS_LOCAL_DISCONNECT"),
+ SMB_NTSTATUS_REMOTE_DISCONNECT => Some("STATUS_REMOTE_DISCONNECT"),
+ SMB_NTSTATUS_REMOTE_RESOURCES => Some("STATUS_REMOTE_RESOURCES"),
+ SMB_NTSTATUS_LINK_FAILED => Some("STATUS_LINK_FAILED"),
+ SMB_NTSTATUS_LINK_TIMEOUT => Some("STATUS_LINK_TIMEOUT"),
+ SMB_NTSTATUS_INVALID_CONNECTION => Some("STATUS_INVALID_CONNECTION"),
+ SMB_NTSTATUS_INVALID_ADDRESS => Some("STATUS_INVALID_ADDRESS"),
+ SMB_NTSTATUS_DLL_INIT_FAILED => Some("STATUS_DLL_INIT_FAILED"),
+ SMB_NTSTATUS_MISSING_SYSTEMFILE => Some("STATUS_MISSING_SYSTEMFILE"),
+ SMB_NTSTATUS_UNHANDLED_EXCEPTION => Some("STATUS_UNHANDLED_EXCEPTION"),
+ SMB_NTSTATUS_APP_INIT_FAILURE => Some("STATUS_APP_INIT_FAILURE"),
+ SMB_NTSTATUS_PAGEFILE_CREATE_FAILED => Some("STATUS_PAGEFILE_CREATE_FAILED"),
+ SMB_NTSTATUS_NO_PAGEFILE => Some("STATUS_NO_PAGEFILE"),
+ SMB_NTSTATUS_INVALID_LEVEL => Some("STATUS_INVALID_LEVEL"),
+ SMB_NTSTATUS_WRONG_PASSWORD_CORE => Some("STATUS_WRONG_PASSWORD_CORE"),
+ SMB_NTSTATUS_ILLEGAL_FLOAT_CONTEXT => Some("STATUS_ILLEGAL_FLOAT_CONTEXT"),
+ SMB_NTSTATUS_PIPE_BROKEN => Some("STATUS_PIPE_BROKEN"),
+ SMB_NTSTATUS_REGISTRY_CORRUPT => Some("STATUS_REGISTRY_CORRUPT"),
+ SMB_NTSTATUS_REGISTRY_IO_FAILED => Some("STATUS_REGISTRY_IO_FAILED"),
+ SMB_NTSTATUS_NO_EVENT_PAIR => Some("STATUS_NO_EVENT_PAIR"),
+ SMB_NTSTATUS_UNRECOGNIZED_VOLUME => Some("STATUS_UNRECOGNIZED_VOLUME"),
+ SMB_NTSTATUS_SERIAL_NO_DEVICE_INITED => Some("STATUS_SERIAL_NO_DEVICE_INITED"),
+ SMB_NTSTATUS_NO_SUCH_ALIAS => Some("STATUS_NO_SUCH_ALIAS"),
+ SMB_NTSTATUS_MEMBER_NOT_IN_ALIAS => Some("STATUS_MEMBER_NOT_IN_ALIAS"),
+ SMB_NTSTATUS_MEMBER_IN_ALIAS => Some("STATUS_MEMBER_IN_ALIAS"),
+ SMB_NTSTATUS_ALIAS_EXISTS => Some("STATUS_ALIAS_EXISTS"),
+ SMB_NTSTATUS_LOGON_NOT_GRANTED => Some("STATUS_LOGON_NOT_GRANTED"),
+ SMB_NTSTATUS_TOO_MANY_SECRETS => Some("STATUS_TOO_MANY_SECRETS"),
+ SMB_NTSTATUS_SECRET_TOO_LONG => Some("STATUS_SECRET_TOO_LONG"),
+ SMB_NTSTATUS_INTERNAL_DB_ERROR => Some("STATUS_INTERNAL_DB_ERROR"),
+ SMB_NTSTATUS_FULLSCREEN_MODE => Some("STATUS_FULLSCREEN_MODE"),
+ SMB_NTSTATUS_TOO_MANY_CONTEXT_IDS => Some("STATUS_TOO_MANY_CONTEXT_IDS"),
+ SMB_NTSTATUS_LOGON_TYPE_NOT_GRANTED => Some("STATUS_LOGON_TYPE_NOT_GRANTED"),
+ SMB_NTSTATUS_NOT_REGISTRY_FILE => Some("STATUS_NOT_REGISTRY_FILE"),
+ SMB_NTSTATUS_NT_CROSS_ENCRYPTION_REQUIRED => Some("STATUS_NT_CROSS_ENCRYPTION_REQUIRED"),
+ SMB_NTSTATUS_DOMAIN_CTRLR_CONFIG_ERROR => Some("STATUS_DOMAIN_CTRLR_CONFIG_ERROR"),
+ SMB_NTSTATUS_FT_MISSING_MEMBER => Some("STATUS_FT_MISSING_MEMBER"),
+ SMB_NTSTATUS_ILL_FORMED_SERVICE_ENTRY => Some("STATUS_ILL_FORMED_SERVICE_ENTRY"),
+ SMB_NTSTATUS_ILLEGAL_CHARACTER => Some("STATUS_ILLEGAL_CHARACTER"),
+ SMB_NTSTATUS_UNMAPPABLE_CHARACTER => Some("STATUS_UNMAPPABLE_CHARACTER"),
+ SMB_NTSTATUS_UNDEFINED_CHARACTER => Some("STATUS_UNDEFINED_CHARACTER"),
+ SMB_NTSTATUS_FLOPPY_VOLUME => Some("STATUS_FLOPPY_VOLUME"),
+ SMB_NTSTATUS_FLOPPY_ID_MARK_NOT_FOUND => Some("STATUS_FLOPPY_ID_MARK_NOT_FOUND"),
+ SMB_NTSTATUS_FLOPPY_WRONG_CYLINDER => Some("STATUS_FLOPPY_WRONG_CYLINDER"),
+ SMB_NTSTATUS_FLOPPY_UNKNOWN_ERROR => Some("STATUS_FLOPPY_UNKNOWN_ERROR"),
+ SMB_NTSTATUS_FLOPPY_BAD_REGISTERS => Some("STATUS_FLOPPY_BAD_REGISTERS"),
+ SMB_NTSTATUS_DISK_RECALIBRATE_FAILED => Some("STATUS_DISK_RECALIBRATE_FAILED"),
+ SMB_NTSTATUS_DISK_OPERATION_FAILED => Some("STATUS_DISK_OPERATION_FAILED"),
+ SMB_NTSTATUS_DISK_RESET_FAILED => Some("STATUS_DISK_RESET_FAILED"),
+ SMB_NTSTATUS_SHARED_IRQ_BUSY => Some("STATUS_SHARED_IRQ_BUSY"),
+ SMB_NTSTATUS_FT_ORPHANING => Some("STATUS_FT_ORPHANING"),
+ SMB_NTSTATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT => Some("STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT"),
+ SMB_NTSTATUS_PARTITION_FAILURE => Some("STATUS_PARTITION_FAILURE"),
+ SMB_NTSTATUS_INVALID_BLOCK_LENGTH => Some("STATUS_INVALID_BLOCK_LENGTH"),
+ SMB_NTSTATUS_DEVICE_NOT_PARTITIONED => Some("STATUS_DEVICE_NOT_PARTITIONED"),
+ SMB_NTSTATUS_UNABLE_TO_LOCK_MEDIA => Some("STATUS_UNABLE_TO_LOCK_MEDIA"),
+ SMB_NTSTATUS_UNABLE_TO_UNLOAD_MEDIA => Some("STATUS_UNABLE_TO_UNLOAD_MEDIA"),
+ SMB_NTSTATUS_EOM_OVERFLOW => Some("STATUS_EOM_OVERFLOW"),
+ SMB_NTSTATUS_NO_MEDIA => Some("STATUS_NO_MEDIA"),
+ SMB_NTSTATUS_NO_SUCH_MEMBER => Some("STATUS_NO_SUCH_MEMBER"),
+ SMB_NTSTATUS_INVALID_MEMBER => Some("STATUS_INVALID_MEMBER"),
+ SMB_NTSTATUS_KEY_DELETED => Some("STATUS_KEY_DELETED"),
+ SMB_NTSTATUS_NO_LOG_SPACE => Some("STATUS_NO_LOG_SPACE"),
+ SMB_NTSTATUS_TOO_MANY_SIDS => Some("STATUS_TOO_MANY_SIDS"),
+ SMB_NTSTATUS_LM_CROSS_ENCRYPTION_REQUIRED => Some("STATUS_LM_CROSS_ENCRYPTION_REQUIRED"),
+ SMB_NTSTATUS_KEY_HAS_CHILDREN => Some("STATUS_KEY_HAS_CHILDREN"),
+ SMB_NTSTATUS_CHILD_MUST_BE_VOLATILE => Some("STATUS_CHILD_MUST_BE_VOLATILE"),
+ SMB_NTSTATUS_DEVICE_CONFIGURATION_ERROR => Some("STATUS_DEVICE_CONFIGURATION_ERROR"),
+ SMB_NTSTATUS_DRIVER_INTERNAL_ERROR => Some("STATUS_DRIVER_INTERNAL_ERROR"),
+ SMB_NTSTATUS_INVALID_DEVICE_STATE => Some("STATUS_INVALID_DEVICE_STATE"),
+ SMB_NTSTATUS_IO_DEVICE_ERROR => Some("STATUS_IO_DEVICE_ERROR"),
+ SMB_NTSTATUS_DEVICE_PROTOCOL_ERROR => Some("STATUS_DEVICE_PROTOCOL_ERROR"),
+ SMB_NTSTATUS_BACKUP_CONTROLLER => Some("STATUS_BACKUP_CONTROLLER"),
+ SMB_NTSTATUS_LOG_FILE_FULL => Some("STATUS_LOG_FILE_FULL"),
+ SMB_NTSTATUS_TOO_LATE => Some("STATUS_TOO_LATE"),
+ SMB_NTSTATUS_NO_TRUST_LSA_SECRET => Some("STATUS_NO_TRUST_LSA_SECRET"),
+ SMB_NTSTATUS_NO_TRUST_SAM_ACCOUNT => Some("STATUS_NO_TRUST_SAM_ACCOUNT"),
+ SMB_NTSTATUS_TRUSTED_DOMAIN_FAILURE => Some("STATUS_TRUSTED_DOMAIN_FAILURE"),
+ SMB_NTSTATUS_TRUSTED_RELATIONSHIP_FAILURE => Some("STATUS_TRUSTED_RELATIONSHIP_FAILURE"),
+ SMB_NTSTATUS_EVENTLOG_FILE_CORRUPT => Some("STATUS_EVENTLOG_FILE_CORRUPT"),
+ SMB_NTSTATUS_EVENTLOG_CANT_START => Some("STATUS_EVENTLOG_CANT_START"),
+ SMB_NTSTATUS_TRUST_FAILURE => Some("STATUS_TRUST_FAILURE"),
+ SMB_NTSTATUS_MUTANT_LIMIT_EXCEEDED => Some("STATUS_MUTANT_LIMIT_EXCEEDED"),
+ SMB_NTSTATUS_NETLOGON_NOT_STARTED => Some("STATUS_NETLOGON_NOT_STARTED"),
+ SMB_NTSTATUS_ACCOUNT_EXPIRED => Some("STATUS_ACCOUNT_EXPIRED"),
+ SMB_NTSTATUS_POSSIBLE_DEADLOCK => Some("STATUS_POSSIBLE_DEADLOCK"),
+ SMB_NTSTATUS_NETWORK_CREDENTIAL_CONFLICT => Some("STATUS_NETWORK_CREDENTIAL_CONFLICT"),
+ SMB_NTSTATUS_REMOTE_SESSION_LIMIT => Some("STATUS_REMOTE_SESSION_LIMIT"),
+ SMB_NTSTATUS_EVENTLOG_FILE_CHANGED => Some("STATUS_EVENTLOG_FILE_CHANGED"),
+ SMB_NTSTATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT => Some("STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT"),
+ SMB_NTSTATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT => Some("STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"),
+ SMB_NTSTATUS_NOLOGON_SERVER_TRUST_ACCOUNT => Some("STATUS_NOLOGON_SERVER_TRUST_ACCOUNT"),
+ SMB_NTSTATUS_DOMAIN_TRUST_INCONSISTENT => Some("STATUS_DOMAIN_TRUST_INCONSISTENT"),
+ SMB_NTSTATUS_FS_DRIVER_REQUIRED => Some("STATUS_FS_DRIVER_REQUIRED"),
+ SMB_NTSTATUS_IMAGE_ALREADY_LOADED_AS_DLL => Some("STATUS_IMAGE_ALREADY_LOADED_AS_DLL"),
+ SMB_NTSTATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING => Some("STATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING"),
+ SMB_NTSTATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME => Some("STATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME"),
+ SMB_NTSTATUS_SECURITY_STREAM_IS_INCONSISTENT => Some("STATUS_SECURITY_STREAM_IS_INCONSISTENT"),
+ SMB_NTSTATUS_INVALID_LOCK_RANGE => Some("STATUS_INVALID_LOCK_RANGE"),
+ SMB_NTSTATUS_INVALID_ACE_CONDITION => Some("STATUS_INVALID_ACE_CONDITION"),
+ SMB_NTSTATUS_IMAGE_SUBSYSTEM_NOT_PRESENT => Some("STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT"),
+ SMB_NTSTATUS_NOTIFICATION_GUID_ALREADY_DEFINED => Some("STATUS_NOTIFICATION_GUID_ALREADY_DEFINED"),
+ SMB_NTSTATUS_NETWORK_OPEN_RESTRICTION => Some("STATUS_NETWORK_OPEN_RESTRICTION"),
+ SMB_NTSTATUS_NO_USER_SESSION_KEY => Some("STATUS_NO_USER_SESSION_KEY"),
+ SMB_NTSTATUS_USER_SESSION_DELETED => Some("STATUS_USER_SESSION_DELETED"),
+ SMB_NTSTATUS_RESOURCE_LANG_NOT_FOUND => Some("STATUS_RESOURCE_LANG_NOT_FOUND"),
+ SMB_NTSTATUS_INSUFF_SERVER_RESOURCES => Some("STATUS_INSUFF_SERVER_RESOURCES"),
+ SMB_NTSTATUS_INVALID_BUFFER_SIZE => Some("STATUS_INVALID_BUFFER_SIZE"),
+ SMB_NTSTATUS_INVALID_ADDRESS_COMPONENT => Some("STATUS_INVALID_ADDRESS_COMPONENT"),
+ SMB_NTSTATUS_INVALID_ADDRESS_WILDCARD => Some("STATUS_INVALID_ADDRESS_WILDCARD"),
+ SMB_NTSTATUS_TOO_MANY_ADDRESSES => Some("STATUS_TOO_MANY_ADDRESSES"),
+ SMB_NTSTATUS_ADDRESS_ALREADY_EXISTS => Some("STATUS_ADDRESS_ALREADY_EXISTS"),
+ SMB_NTSTATUS_ADDRESS_CLOSED => Some("STATUS_ADDRESS_CLOSED"),
+ SMB_NTSTATUS_CONNECTION_DISCONNECTED => Some("STATUS_CONNECTION_DISCONNECTED"),
+ SMB_NTSTATUS_CONNECTION_RESET => Some("STATUS_CONNECTION_RESET"),
+ SMB_NTSTATUS_TOO_MANY_NODES => Some("STATUS_TOO_MANY_NODES"),
+ SMB_NTSTATUS_TRANSACTION_ABORTED => Some("STATUS_TRANSACTION_ABORTED"),
+ SMB_NTSTATUS_TRANSACTION_TIMED_OUT => Some("STATUS_TRANSACTION_TIMED_OUT"),
+ SMB_NTSTATUS_TRANSACTION_NO_RELEASE => Some("STATUS_TRANSACTION_NO_RELEASE"),
+ SMB_NTSTATUS_TRANSACTION_NO_MATCH => Some("STATUS_TRANSACTION_NO_MATCH"),
+ SMB_NTSTATUS_TRANSACTION_RESPONDED => Some("STATUS_TRANSACTION_RESPONDED"),
+ SMB_NTSTATUS_TRANSACTION_INVALID_ID => Some("STATUS_TRANSACTION_INVALID_ID"),
+ SMB_NTSTATUS_TRANSACTION_INVALID_TYPE => Some("STATUS_TRANSACTION_INVALID_TYPE"),
+ SMB_NTSTATUS_NOT_SERVER_SESSION => Some("STATUS_NOT_SERVER_SESSION"),
+ SMB_NTSTATUS_NOT_CLIENT_SESSION => Some("STATUS_NOT_CLIENT_SESSION"),
+ SMB_NTSTATUS_CANNOT_LOAD_REGISTRY_FILE => Some("STATUS_CANNOT_LOAD_REGISTRY_FILE"),
+ SMB_NTSTATUS_DEBUG_ATTACH_FAILED => Some("STATUS_DEBUG_ATTACH_FAILED"),
+ SMB_NTSTATUS_SYSTEM_PROCESS_TERMINATED => Some("STATUS_SYSTEM_PROCESS_TERMINATED"),
+ SMB_NTSTATUS_DATA_NOT_ACCEPTED => Some("STATUS_DATA_NOT_ACCEPTED"),
+ SMB_NTSTATUS_NO_BROWSER_SERVERS_FOUND => Some("STATUS_NO_BROWSER_SERVERS_FOUND"),
+ SMB_NTSTATUS_VDM_HARD_ERROR => Some("STATUS_VDM_HARD_ERROR"),
+ SMB_NTSTATUS_DRIVER_CANCEL_TIMEOUT => Some("STATUS_DRIVER_CANCEL_TIMEOUT"),
+ SMB_NTSTATUS_REPLY_MESSAGE_MISMATCH => Some("STATUS_REPLY_MESSAGE_MISMATCH"),
+ SMB_NTSTATUS_MAPPED_ALIGNMENT => Some("STATUS_MAPPED_ALIGNMENT"),
+ SMB_NTSTATUS_IMAGE_CHECKSUM_MISMATCH => Some("STATUS_IMAGE_CHECKSUM_MISMATCH"),
+ SMB_NTSTATUS_LOST_WRITEBEHIND_DATA => Some("STATUS_LOST_WRITEBEHIND_DATA"),
+ SMB_NTSTATUS_CLIENT_SERVER_PARAMETERS_INVALID => Some("STATUS_CLIENT_SERVER_PARAMETERS_INVALID"),
+ SMB_NTSTATUS_PASSWORD_MUST_CHANGE => Some("STATUS_PASSWORD_MUST_CHANGE"),
+ SMB_NTSTATUS_NOT_FOUND => Some("STATUS_NOT_FOUND"),
+ SMB_NTSTATUS_NOT_TINY_STREAM => Some("STATUS_NOT_TINY_STREAM"),
+ SMB_NTSTATUS_RECOVERY_FAILURE => Some("STATUS_RECOVERY_FAILURE"),
+ SMB_NTSTATUS_STACK_OVERFLOW_READ => Some("STATUS_STACK_OVERFLOW_READ"),
+ SMB_NTSTATUS_FAIL_CHECK => Some("STATUS_FAIL_CHECK"),
+ SMB_NTSTATUS_DUPLICATE_OBJECTID => Some("STATUS_DUPLICATE_OBJECTID"),
+ SMB_NTSTATUS_OBJECTID_EXISTS => Some("STATUS_OBJECTID_EXISTS"),
+ SMB_NTSTATUS_CONVERT_TO_LARGE => Some("STATUS_CONVERT_TO_LARGE"),
+ SMB_NTSTATUS_RETRY => Some("STATUS_RETRY"),
+ SMB_NTSTATUS_FOUND_OUT_OF_SCOPE => Some("STATUS_FOUND_OUT_OF_SCOPE"),
+ SMB_NTSTATUS_ALLOCATE_BUCKET => Some("STATUS_ALLOCATE_BUCKET"),
+ SMB_NTSTATUS_PROPSET_NOT_FOUND => Some("STATUS_PROPSET_NOT_FOUND"),
+ SMB_NTSTATUS_MARSHALL_OVERFLOW => Some("STATUS_MARSHALL_OVERFLOW"),
+ SMB_NTSTATUS_INVALID_VARIANT => Some("STATUS_INVALID_VARIANT"),
+ SMB_NTSTATUS_DOMAIN_CONTROLLER_NOT_FOUND => Some("STATUS_DOMAIN_CONTROLLER_NOT_FOUND"),
+ SMB_NTSTATUS_ACCOUNT_LOCKED_OUT => Some("STATUS_ACCOUNT_LOCKED_OUT"),
+ SMB_NTSTATUS_HANDLE_NOT_CLOSABLE => Some("STATUS_HANDLE_NOT_CLOSABLE"),
+ SMB_NTSTATUS_CONNECTION_REFUSED => Some("STATUS_CONNECTION_REFUSED"),
+ SMB_NTSTATUS_GRACEFUL_DISCONNECT => Some("STATUS_GRACEFUL_DISCONNECT"),
+ SMB_NTSTATUS_ADDRESS_ALREADY_ASSOCIATED => Some("STATUS_ADDRESS_ALREADY_ASSOCIATED"),
+ SMB_NTSTATUS_ADDRESS_NOT_ASSOCIATED => Some("STATUS_ADDRESS_NOT_ASSOCIATED"),
+ SMB_NTSTATUS_CONNECTION_INVALID => Some("STATUS_CONNECTION_INVALID"),
+ SMB_NTSTATUS_CONNECTION_ACTIVE => Some("STATUS_CONNECTION_ACTIVE"),
+ SMB_NTSTATUS_NETWORK_UNREACHABLE => Some("STATUS_NETWORK_UNREACHABLE"),
+ SMB_NTSTATUS_HOST_UNREACHABLE => Some("STATUS_HOST_UNREACHABLE"),
+ SMB_NTSTATUS_PROTOCOL_UNREACHABLE => Some("STATUS_PROTOCOL_UNREACHABLE"),
+ SMB_NTSTATUS_PORT_UNREACHABLE => Some("STATUS_PORT_UNREACHABLE"),
+ SMB_NTSTATUS_REQUEST_ABORTED => Some("STATUS_REQUEST_ABORTED"),
+ SMB_NTSTATUS_CONNECTION_ABORTED => Some("STATUS_CONNECTION_ABORTED"),
+ SMB_NTSTATUS_BAD_COMPRESSION_BUFFER => Some("STATUS_BAD_COMPRESSION_BUFFER"),
+ SMB_NTSTATUS_USER_MAPPED_FILE => Some("STATUS_USER_MAPPED_FILE"),
+ SMB_NTSTATUS_AUDIT_FAILED => Some("STATUS_AUDIT_FAILED"),
+ SMB_NTSTATUS_TIMER_RESOLUTION_NOT_SET => Some("STATUS_TIMER_RESOLUTION_NOT_SET"),
+ SMB_NTSTATUS_CONNECTION_COUNT_LIMIT => Some("STATUS_CONNECTION_COUNT_LIMIT"),
+ SMB_NTSTATUS_LOGIN_TIME_RESTRICTION => Some("STATUS_LOGIN_TIME_RESTRICTION"),
+ SMB_NTSTATUS_LOGIN_WKSTA_RESTRICTION => Some("STATUS_LOGIN_WKSTA_RESTRICTION"),
+ SMB_NTSTATUS_IMAGE_MP_UP_MISMATCH => Some("STATUS_IMAGE_MP_UP_MISMATCH"),
+ SMB_NTSTATUS_INSUFFICIENT_LOGON_INFO => Some("STATUS_INSUFFICIENT_LOGON_INFO"),
+ SMB_NTSTATUS_BAD_DLL_ENTRYPOINT => Some("STATUS_BAD_DLL_ENTRYPOINT"),
+ SMB_NTSTATUS_BAD_SERVICE_ENTRYPOINT => Some("STATUS_BAD_SERVICE_ENTRYPOINT"),
+ SMB_NTSTATUS_LPC_REPLY_LOST => Some("STATUS_LPC_REPLY_LOST"),
+ SMB_NTSTATUS_IP_ADDRESS_CONFLICT1 => Some("STATUS_IP_ADDRESS_CONFLICT1"),
+ SMB_NTSTATUS_IP_ADDRESS_CONFLICT2 => Some("STATUS_IP_ADDRESS_CONFLICT2"),
+ SMB_NTSTATUS_REGISTRY_QUOTA_LIMIT => Some("STATUS_REGISTRY_QUOTA_LIMIT"),
+ SMB_NTSTATUS_PATH_NOT_COVERED => Some("STATUS_PATH_NOT_COVERED"),
+ SMB_NTSTATUS_NO_CALLBACK_ACTIVE => Some("STATUS_NO_CALLBACK_ACTIVE"),
+ SMB_NTSTATUS_LICENSE_QUOTA_EXCEEDED => Some("STATUS_LICENSE_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_PWD_TOO_SHORT => Some("STATUS_PWD_TOO_SHORT"),
+ SMB_NTSTATUS_PWD_TOO_RECENT => Some("STATUS_PWD_TOO_RECENT"),
+ SMB_NTSTATUS_PWD_HISTORY_CONFLICT => Some("STATUS_PWD_HISTORY_CONFLICT"),
+ SMB_NTSTATUS_PLUGPLAY_NO_DEVICE => Some("STATUS_PLUGPLAY_NO_DEVICE"),
+ SMB_NTSTATUS_UNSUPPORTED_COMPRESSION => Some("STATUS_UNSUPPORTED_COMPRESSION"),
+ SMB_NTSTATUS_INVALID_HW_PROFILE => Some("STATUS_INVALID_HW_PROFILE"),
+ SMB_NTSTATUS_INVALID_PLUGPLAY_DEVICE_PATH => Some("STATUS_INVALID_PLUGPLAY_DEVICE_PATH"),
+ SMB_NTSTATUS_DRIVER_ORDINAL_NOT_FOUND => Some("STATUS_DRIVER_ORDINAL_NOT_FOUND"),
+ SMB_NTSTATUS_DRIVER_ENTRYPOINT_NOT_FOUND => Some("STATUS_DRIVER_ENTRYPOINT_NOT_FOUND"),
+ SMB_NTSTATUS_RESOURCE_NOT_OWNED => Some("STATUS_RESOURCE_NOT_OWNED"),
+ SMB_NTSTATUS_TOO_MANY_LINKS => Some("STATUS_TOO_MANY_LINKS"),
+ SMB_NTSTATUS_QUOTA_LIST_INCONSISTENT => Some("STATUS_QUOTA_LIST_INCONSISTENT"),
+ SMB_NTSTATUS_FILE_IS_OFFLINE => Some("STATUS_FILE_IS_OFFLINE"),
+ SMB_NTSTATUS_EVALUATION_EXPIRATION => Some("STATUS_EVALUATION_EXPIRATION"),
+ SMB_NTSTATUS_ILLEGAL_DLL_RELOCATION => Some("STATUS_ILLEGAL_DLL_RELOCATION"),
+ SMB_NTSTATUS_LICENSE_VIOLATION => Some("STATUS_LICENSE_VIOLATION"),
+ SMB_NTSTATUS_DLL_INIT_FAILED_LOGOFF => Some("STATUS_DLL_INIT_FAILED_LOGOFF"),
+ SMB_NTSTATUS_DRIVER_UNABLE_TO_LOAD => Some("STATUS_DRIVER_UNABLE_TO_LOAD"),
+ SMB_NTSTATUS_DFS_UNAVAILABLE => Some("STATUS_DFS_UNAVAILABLE"),
+ SMB_NTSTATUS_VOLUME_DISMOUNTED => Some("STATUS_VOLUME_DISMOUNTED"),
+ SMB_NTSTATUS_WX86_INTERNAL_ERROR => Some("STATUS_WX86_INTERNAL_ERROR"),
+ SMB_NTSTATUS_WX86_FLOAT_STACK_CHECK => Some("STATUS_WX86_FLOAT_STACK_CHECK"),
+ SMB_NTSTATUS_VALIDATE_CONTINUE => Some("STATUS_VALIDATE_CONTINUE"),
+ SMB_NTSTATUS_NO_MATCH => Some("STATUS_NO_MATCH"),
+ SMB_NTSTATUS_NO_MORE_MATCHES => Some("STATUS_NO_MORE_MATCHES"),
+ SMB_NTSTATUS_NOT_A_REPARSE_POINT => Some("STATUS_NOT_A_REPARSE_POINT"),
+ SMB_NTSTATUS_IO_REPARSE_TAG_INVALID => Some("STATUS_IO_REPARSE_TAG_INVALID"),
+ SMB_NTSTATUS_IO_REPARSE_TAG_MISMATCH => Some("STATUS_IO_REPARSE_TAG_MISMATCH"),
+ SMB_NTSTATUS_IO_REPARSE_DATA_INVALID => Some("STATUS_IO_REPARSE_DATA_INVALID"),
+ SMB_NTSTATUS_IO_REPARSE_TAG_NOT_HANDLED => Some("STATUS_IO_REPARSE_TAG_NOT_HANDLED"),
+ SMB_NTSTATUS_REPARSE_POINT_NOT_RESOLVED => Some("STATUS_REPARSE_POINT_NOT_RESOLVED"),
+ SMB_NTSTATUS_DIRECTORY_IS_A_REPARSE_POINT => Some("STATUS_DIRECTORY_IS_A_REPARSE_POINT"),
+ SMB_NTSTATUS_RANGE_LIST_CONFLICT => Some("STATUS_RANGE_LIST_CONFLICT"),
+ SMB_NTSTATUS_SOURCE_ELEMENT_EMPTY => Some("STATUS_SOURCE_ELEMENT_EMPTY"),
+ SMB_NTSTATUS_DESTINATION_ELEMENT_FULL => Some("STATUS_DESTINATION_ELEMENT_FULL"),
+ SMB_NTSTATUS_ILLEGAL_ELEMENT_ADDRESS => Some("STATUS_ILLEGAL_ELEMENT_ADDRESS"),
+ SMB_NTSTATUS_MAGAZINE_NOT_PRESENT => Some("STATUS_MAGAZINE_NOT_PRESENT"),
+ SMB_NTSTATUS_REINITIALIZATION_NEEDED => Some("STATUS_REINITIALIZATION_NEEDED"),
+ SMB_NTSTATUS_ENCRYPTION_FAILED => Some("STATUS_ENCRYPTION_FAILED"),
+ SMB_NTSTATUS_DECRYPTION_FAILED => Some("STATUS_DECRYPTION_FAILED"),
+ SMB_NTSTATUS_RANGE_NOT_FOUND => Some("STATUS_RANGE_NOT_FOUND"),
+ SMB_NTSTATUS_NO_RECOVERY_POLICY => Some("STATUS_NO_RECOVERY_POLICY"),
+ SMB_NTSTATUS_NO_EFS => Some("STATUS_NO_EFS"),
+ SMB_NTSTATUS_WRONG_EFS => Some("STATUS_WRONG_EFS"),
+ SMB_NTSTATUS_NO_USER_KEYS => Some("STATUS_NO_USER_KEYS"),
+ SMB_NTSTATUS_FILE_NOT_ENCRYPTED => Some("STATUS_FILE_NOT_ENCRYPTED"),
+ SMB_NTSTATUS_NOT_EXPORT_FORMAT => Some("STATUS_NOT_EXPORT_FORMAT"),
+ SMB_NTSTATUS_FILE_ENCRYPTED => Some("STATUS_FILE_ENCRYPTED"),
+ SMB_NTSTATUS_WMI_GUID_NOT_FOUND => Some("STATUS_WMI_GUID_NOT_FOUND"),
+ SMB_NTSTATUS_WMI_INSTANCE_NOT_FOUND => Some("STATUS_WMI_INSTANCE_NOT_FOUND"),
+ SMB_NTSTATUS_WMI_ITEMID_NOT_FOUND => Some("STATUS_WMI_ITEMID_NOT_FOUND"),
+ SMB_NTSTATUS_WMI_TRY_AGAIN => Some("STATUS_WMI_TRY_AGAIN"),
+ SMB_NTSTATUS_SHARED_POLICY => Some("STATUS_SHARED_POLICY"),
+ SMB_NTSTATUS_POLICY_OBJECT_NOT_FOUND => Some("STATUS_POLICY_OBJECT_NOT_FOUND"),
+ SMB_NTSTATUS_POLICY_ONLY_IN_DS => Some("STATUS_POLICY_ONLY_IN_DS"),
+ SMB_NTSTATUS_VOLUME_NOT_UPGRADED => Some("STATUS_VOLUME_NOT_UPGRADED"),
+ SMB_NTSTATUS_REMOTE_STORAGE_NOT_ACTIVE => Some("STATUS_REMOTE_STORAGE_NOT_ACTIVE"),
+ SMB_NTSTATUS_REMOTE_STORAGE_MEDIA_ERROR => Some("STATUS_REMOTE_STORAGE_MEDIA_ERROR"),
+ SMB_NTSTATUS_NO_TRACKING_SERVICE => Some("STATUS_NO_TRACKING_SERVICE"),
+ SMB_NTSTATUS_SERVER_SID_MISMATCH => Some("STATUS_SERVER_SID_MISMATCH"),
+ SMB_NTSTATUS_DS_NO_ATTRIBUTE_OR_VALUE => Some("STATUS_DS_NO_ATTRIBUTE_OR_VALUE"),
+ SMB_NTSTATUS_DS_INVALID_ATTRIBUTE_SYNTAX => Some("STATUS_DS_INVALID_ATTRIBUTE_SYNTAX"),
+ SMB_NTSTATUS_DS_ATTRIBUTE_TYPE_UNDEFINED => Some("STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED"),
+ SMB_NTSTATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS => Some("STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS"),
+ SMB_NTSTATUS_DS_BUSY => Some("STATUS_DS_BUSY"),
+ SMB_NTSTATUS_DS_UNAVAILABLE => Some("STATUS_DS_UNAVAILABLE"),
+ SMB_NTSTATUS_DS_NO_RIDS_ALLOCATED => Some("STATUS_DS_NO_RIDS_ALLOCATED"),
+ SMB_NTSTATUS_DS_NO_MORE_RIDS => Some("STATUS_DS_NO_MORE_RIDS"),
+ SMB_NTSTATUS_DS_INCORRECT_ROLE_OWNER => Some("STATUS_DS_INCORRECT_ROLE_OWNER"),
+ SMB_NTSTATUS_DS_RIDMGR_INIT_ERROR => Some("STATUS_DS_RIDMGR_INIT_ERROR"),
+ SMB_NTSTATUS_DS_OBJ_CLASS_VIOLATION => Some("STATUS_DS_OBJ_CLASS_VIOLATION"),
+ SMB_NTSTATUS_DS_CANT_ON_NON_LEAF => Some("STATUS_DS_CANT_ON_NON_LEAF"),
+ SMB_NTSTATUS_DS_CANT_ON_RDN => Some("STATUS_DS_CANT_ON_RDN"),
+ SMB_NTSTATUS_DS_CANT_MOD_OBJ_CLASS => Some("STATUS_DS_CANT_MOD_OBJ_CLASS"),
+ SMB_NTSTATUS_DS_CROSS_DOM_MOVE_FAILED => Some("STATUS_DS_CROSS_DOM_MOVE_FAILED"),
+ SMB_NTSTATUS_DS_GC_NOT_AVAILABLE => Some("STATUS_DS_GC_NOT_AVAILABLE"),
+ SMB_NTSTATUS_DIRECTORY_SERVICE_REQUIRED => Some("STATUS_DIRECTORY_SERVICE_REQUIRED"),
+ SMB_NTSTATUS_REPARSE_ATTRIBUTE_CONFLICT => Some("STATUS_REPARSE_ATTRIBUTE_CONFLICT"),
+ SMB_NTSTATUS_CANT_ENABLE_DENY_ONLY => Some("STATUS_CANT_ENABLE_DENY_ONLY"),
+ SMB_NTSTATUS_FLOAT_MULTIPLE_FAULTS => Some("STATUS_FLOAT_MULTIPLE_FAULTS"),
+ SMB_NTSTATUS_FLOAT_MULTIPLE_TRAPS => Some("STATUS_FLOAT_MULTIPLE_TRAPS"),
+ SMB_NTSTATUS_DEVICE_REMOVED => Some("STATUS_DEVICE_REMOVED"),
+ SMB_NTSTATUS_JOURNAL_DELETE_IN_PROGRESS => Some("STATUS_JOURNAL_DELETE_IN_PROGRESS"),
+ SMB_NTSTATUS_JOURNAL_NOT_ACTIVE => Some("STATUS_JOURNAL_NOT_ACTIVE"),
+ SMB_NTSTATUS_NOINTERFACE => Some("STATUS_NOINTERFACE"),
+ SMB_NTSTATUS_DS_ADMIN_LIMIT_EXCEEDED => Some("STATUS_DS_ADMIN_LIMIT_EXCEEDED"),
+ SMB_NTSTATUS_DRIVER_FAILED_SLEEP => Some("STATUS_DRIVER_FAILED_SLEEP"),
+ SMB_NTSTATUS_MUTUAL_AUTHENTICATION_FAILED => Some("STATUS_MUTUAL_AUTHENTICATION_FAILED"),
+ SMB_NTSTATUS_CORRUPT_SYSTEM_FILE => Some("STATUS_CORRUPT_SYSTEM_FILE"),
+ SMB_NTSTATUS_DATATYPE_MISALIGNMENT_ERROR => Some("STATUS_DATATYPE_MISALIGNMENT_ERROR"),
+ SMB_NTSTATUS_WMI_READ_ONLY => Some("STATUS_WMI_READ_ONLY"),
+ SMB_NTSTATUS_WMI_SET_FAILURE => Some("STATUS_WMI_SET_FAILURE"),
+ SMB_NTSTATUS_COMMITMENT_MINIMUM => Some("STATUS_COMMITMENT_MINIMUM"),
+ SMB_NTSTATUS_REG_NAT_CONSUMPTION => Some("STATUS_REG_NAT_CONSUMPTION"),
+ SMB_NTSTATUS_TRANSPORT_FULL => Some("STATUS_TRANSPORT_FULL"),
+ SMB_NTSTATUS_DS_SAM_INIT_FAILURE => Some("STATUS_DS_SAM_INIT_FAILURE"),
+ SMB_NTSTATUS_ONLY_IF_CONNECTED => Some("STATUS_ONLY_IF_CONNECTED"),
+ SMB_NTSTATUS_DS_SENSITIVE_GROUP_VIOLATION => Some("STATUS_DS_SENSITIVE_GROUP_VIOLATION"),
+ SMB_NTSTATUS_PNP_RESTART_ENUMERATION => Some("STATUS_PNP_RESTART_ENUMERATION"),
+ SMB_NTSTATUS_JOURNAL_ENTRY_DELETED => Some("STATUS_JOURNAL_ENTRY_DELETED"),
+ SMB_NTSTATUS_DS_CANT_MOD_PRIMARYGROUPID => Some("STATUS_DS_CANT_MOD_PRIMARYGROUPID"),
+ SMB_NTSTATUS_SYSTEM_IMAGE_BAD_SIGNATURE => Some("STATUS_SYSTEM_IMAGE_BAD_SIGNATURE"),
+ SMB_NTSTATUS_PNP_REBOOT_REQUIRED => Some("STATUS_PNP_REBOOT_REQUIRED"),
+ SMB_NTSTATUS_POWER_STATE_INVALID => Some("STATUS_POWER_STATE_INVALID"),
+ SMB_NTSTATUS_DS_INVALID_GROUP_TYPE => Some("STATUS_DS_INVALID_GROUP_TYPE"),
+ SMB_NTSTATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN => Some("STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN"),
+ SMB_NTSTATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN => Some("STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN"),
+ SMB_NTSTATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER => Some("STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER"),
+ SMB_NTSTATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER => Some("STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER"),
+ SMB_NTSTATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER => Some("STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER"),
+ SMB_NTSTATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER => Some("STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER"),
+ SMB_NTSTATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER => Some("STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER"),
+ SMB_NTSTATUS_DS_HAVE_PRIMARY_MEMBERS => Some("STATUS_DS_HAVE_PRIMARY_MEMBERS"),
+ SMB_NTSTATUS_WMI_NOT_SUPPORTED => Some("STATUS_WMI_NOT_SUPPORTED"),
+ SMB_NTSTATUS_INSUFFICIENT_POWER => Some("STATUS_INSUFFICIENT_POWER"),
+ SMB_NTSTATUS_SAM_NEED_BOOTKEY_PASSWORD => Some("STATUS_SAM_NEED_BOOTKEY_PASSWORD"),
+ SMB_NTSTATUS_SAM_NEED_BOOTKEY_FLOPPY => Some("STATUS_SAM_NEED_BOOTKEY_FLOPPY"),
+ SMB_NTSTATUS_DS_CANT_START => Some("STATUS_DS_CANT_START"),
+ SMB_NTSTATUS_DS_INIT_FAILURE => Some("STATUS_DS_INIT_FAILURE"),
+ SMB_NTSTATUS_SAM_INIT_FAILURE => Some("STATUS_SAM_INIT_FAILURE"),
+ SMB_NTSTATUS_DS_GC_REQUIRED => Some("STATUS_DS_GC_REQUIRED"),
+ SMB_NTSTATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY => Some("STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY"),
+ SMB_NTSTATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS => Some("STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS"),
+ SMB_NTSTATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED => Some("STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_CURRENT_DOMAIN_NOT_ALLOWED => Some("STATUS_CURRENT_DOMAIN_NOT_ALLOWED"),
+ SMB_NTSTATUS_CANNOT_MAKE => Some("STATUS_CANNOT_MAKE"),
+ SMB_NTSTATUS_SYSTEM_SHUTDOWN => Some("STATUS_SYSTEM_SHUTDOWN"),
+ SMB_NTSTATUS_DS_INIT_FAILURE_CONSOLE => Some("STATUS_DS_INIT_FAILURE_CONSOLE"),
+ SMB_NTSTATUS_DS_SAM_INIT_FAILURE_CONSOLE => Some("STATUS_DS_SAM_INIT_FAILURE_CONSOLE"),
+ SMB_NTSTATUS_UNFINISHED_CONTEXT_DELETED => Some("STATUS_UNFINISHED_CONTEXT_DELETED"),
+ SMB_NTSTATUS_NO_TGT_REPLY => Some("STATUS_NO_TGT_REPLY"),
+ SMB_NTSTATUS_OBJECTID_NOT_FOUND => Some("STATUS_OBJECTID_NOT_FOUND"),
+ SMB_NTSTATUS_NO_IP_ADDRESSES => Some("STATUS_NO_IP_ADDRESSES"),
+ SMB_NTSTATUS_WRONG_CREDENTIAL_HANDLE => Some("STATUS_WRONG_CREDENTIAL_HANDLE"),
+ SMB_NTSTATUS_CRYPTO_SYSTEM_INVALID => Some("STATUS_CRYPTO_SYSTEM_INVALID"),
+ SMB_NTSTATUS_MAX_REFERRALS_EXCEEDED => Some("STATUS_MAX_REFERRALS_EXCEEDED"),
+ SMB_NTSTATUS_MUST_BE_KDC => Some("STATUS_MUST_BE_KDC"),
+ SMB_NTSTATUS_STRONG_CRYPTO_NOT_SUPPORTED => Some("STATUS_STRONG_CRYPTO_NOT_SUPPORTED"),
+ SMB_NTSTATUS_TOO_MANY_PRINCIPALS => Some("STATUS_TOO_MANY_PRINCIPALS"),
+ SMB_NTSTATUS_NO_PA_DATA => Some("STATUS_NO_PA_DATA"),
+ SMB_NTSTATUS_PKINIT_NAME_MISMATCH => Some("STATUS_PKINIT_NAME_MISMATCH"),
+ SMB_NTSTATUS_SMARTCARD_LOGON_REQUIRED => Some("STATUS_SMARTCARD_LOGON_REQUIRED"),
+ SMB_NTSTATUS_KDC_INVALID_REQUEST => Some("STATUS_KDC_INVALID_REQUEST"),
+ SMB_NTSTATUS_KDC_UNABLE_TO_REFER => Some("STATUS_KDC_UNABLE_TO_REFER"),
+ SMB_NTSTATUS_KDC_UNKNOWN_ETYPE => Some("STATUS_KDC_UNKNOWN_ETYPE"),
+ SMB_NTSTATUS_SHUTDOWN_IN_PROGRESS => Some("STATUS_SHUTDOWN_IN_PROGRESS"),
+ SMB_NTSTATUS_SERVER_SHUTDOWN_IN_PROGRESS => Some("STATUS_SERVER_SHUTDOWN_IN_PROGRESS"),
+ SMB_NTSTATUS_NOT_SUPPORTED_ON_SBS => Some("STATUS_NOT_SUPPORTED_ON_SBS"),
+ SMB_NTSTATUS_WMI_GUID_DISCONNECTED => Some("STATUS_WMI_GUID_DISCONNECTED"),
+ SMB_NTSTATUS_WMI_ALREADY_DISABLED => Some("STATUS_WMI_ALREADY_DISABLED"),
+ SMB_NTSTATUS_WMI_ALREADY_ENABLED => Some("STATUS_WMI_ALREADY_ENABLED"),
+ SMB_NTSTATUS_MFT_TOO_FRAGMENTED => Some("STATUS_MFT_TOO_FRAGMENTED"),
+ SMB_NTSTATUS_COPY_PROTECTION_FAILURE => Some("STATUS_COPY_PROTECTION_FAILURE"),
+ SMB_NTSTATUS_CSS_AUTHENTICATION_FAILURE => Some("STATUS_CSS_AUTHENTICATION_FAILURE"),
+ SMB_NTSTATUS_CSS_KEY_NOT_PRESENT => Some("STATUS_CSS_KEY_NOT_PRESENT"),
+ SMB_NTSTATUS_CSS_KEY_NOT_ESTABLISHED => Some("STATUS_CSS_KEY_NOT_ESTABLISHED"),
+ SMB_NTSTATUS_CSS_SCRAMBLED_SECTOR => Some("STATUS_CSS_SCRAMBLED_SECTOR"),
+ SMB_NTSTATUS_CSS_REGION_MISMATCH => Some("STATUS_CSS_REGION_MISMATCH"),
+ SMB_NTSTATUS_CSS_RESETS_EXHAUSTED => Some("STATUS_CSS_RESETS_EXHAUSTED"),
+ SMB_NTSTATUS_PKINIT_FAILURE => Some("STATUS_PKINIT_FAILURE"),
+ SMB_NTSTATUS_SMARTCARD_SUBSYSTEM_FAILURE => Some("STATUS_SMARTCARD_SUBSYSTEM_FAILURE"),
+ SMB_NTSTATUS_NO_KERB_KEY => Some("STATUS_NO_KERB_KEY"),
+ SMB_NTSTATUS_HOST_DOWN => Some("STATUS_HOST_DOWN"),
+ SMB_NTSTATUS_UNSUPPORTED_PREAUTH => Some("STATUS_UNSUPPORTED_PREAUTH"),
+ SMB_NTSTATUS_EFS_ALG_BLOB_TOO_BIG => Some("STATUS_EFS_ALG_BLOB_TOO_BIG"),
+ SMB_NTSTATUS_PORT_NOT_SET => Some("STATUS_PORT_NOT_SET"),
+ SMB_NTSTATUS_DEBUGGER_INACTIVE => Some("STATUS_DEBUGGER_INACTIVE"),
+ SMB_NTSTATUS_DS_VERSION_CHECK_FAILURE => Some("STATUS_DS_VERSION_CHECK_FAILURE"),
+ SMB_NTSTATUS_AUDITING_DISABLED => Some("STATUS_AUDITING_DISABLED"),
+ SMB_NTSTATUS_PRENT4_MACHINE_ACCOUNT => Some("STATUS_PRENT4_MACHINE_ACCOUNT"),
+ SMB_NTSTATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER => Some("STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER"),
+ SMB_NTSTATUS_INVALID_IMAGE_WIN_32 => Some("STATUS_INVALID_IMAGE_WIN_32"),
+ SMB_NTSTATUS_INVALID_IMAGE_WIN_64 => Some("STATUS_INVALID_IMAGE_WIN_64"),
+ SMB_NTSTATUS_BAD_BINDINGS => Some("STATUS_BAD_BINDINGS"),
+ SMB_NTSTATUS_NETWORK_SESSION_EXPIRED => Some("STATUS_NETWORK_SESSION_EXPIRED"),
+ SMB_NTSTATUS_APPHELP_BLOCK => Some("STATUS_APPHELP_BLOCK"),
+ SMB_NTSTATUS_ALL_SIDS_FILTERED => Some("STATUS_ALL_SIDS_FILTERED"),
+ SMB_NTSTATUS_NOT_SAFE_MODE_DRIVER => Some("STATUS_NOT_SAFE_MODE_DRIVER"),
+ SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT => Some("STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT"),
+ SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_PATH => Some("STATUS_ACCESS_DISABLED_BY_POLICY_PATH"),
+ SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER => Some("STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER"),
+ SMB_NTSTATUS_ACCESS_DISABLED_BY_POLICY_OTHER => Some("STATUS_ACCESS_DISABLED_BY_POLICY_OTHER"),
+ SMB_NTSTATUS_FAILED_DRIVER_ENTRY => Some("STATUS_FAILED_DRIVER_ENTRY"),
+ SMB_NTSTATUS_DEVICE_ENUMERATION_ERROR => Some("STATUS_DEVICE_ENUMERATION_ERROR"),
+ SMB_NTSTATUS_MOUNT_POINT_NOT_RESOLVED => Some("STATUS_MOUNT_POINT_NOT_RESOLVED"),
+ SMB_NTSTATUS_INVALID_DEVICE_OBJECT_PARAMETER => Some("STATUS_INVALID_DEVICE_OBJECT_PARAMETER"),
+ SMB_NTSTATUS_MCA_OCCURED => Some("STATUS_MCA_OCCURED"),
+ SMB_NTSTATUS_DRIVER_BLOCKED_CRITICAL => Some("STATUS_DRIVER_BLOCKED_CRITICAL"),
+ SMB_NTSTATUS_DRIVER_BLOCKED => Some("STATUS_DRIVER_BLOCKED"),
+ SMB_NTSTATUS_DRIVER_DATABASE_ERROR => Some("STATUS_DRIVER_DATABASE_ERROR"),
+ SMB_NTSTATUS_SYSTEM_HIVE_TOO_LARGE => Some("STATUS_SYSTEM_HIVE_TOO_LARGE"),
+ SMB_NTSTATUS_INVALID_IMPORT_OF_NON_DLL => Some("STATUS_INVALID_IMPORT_OF_NON_DLL"),
+ SMB_NTSTATUS_NO_SECRETS => Some("STATUS_NO_SECRETS"),
+ SMB_NTSTATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY => Some("STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY"),
+ SMB_NTSTATUS_FAILED_STACK_SWITCH => Some("STATUS_FAILED_STACK_SWITCH"),
+ SMB_NTSTATUS_HEAP_CORRUPTION => Some("STATUS_HEAP_CORRUPTION"),
+ SMB_NTSTATUS_SMARTCARD_WRONG_PIN => Some("STATUS_SMARTCARD_WRONG_PIN"),
+ SMB_NTSTATUS_SMARTCARD_CARD_BLOCKED => Some("STATUS_SMARTCARD_CARD_BLOCKED"),
+ SMB_NTSTATUS_SMARTCARD_CARD_NOT_AUTHENTICATED => Some("STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED"),
+ SMB_NTSTATUS_SMARTCARD_NO_CARD => Some("STATUS_SMARTCARD_NO_CARD"),
+ SMB_NTSTATUS_SMARTCARD_NO_KEY_CONTAINER => Some("STATUS_SMARTCARD_NO_KEY_CONTAINER"),
+ SMB_NTSTATUS_SMARTCARD_NO_CERTIFICATE => Some("STATUS_SMARTCARD_NO_CERTIFICATE"),
+ SMB_NTSTATUS_SMARTCARD_NO_KEYSET => Some("STATUS_SMARTCARD_NO_KEYSET"),
+ SMB_NTSTATUS_SMARTCARD_IO_ERROR => Some("STATUS_SMARTCARD_IO_ERROR"),
+ SMB_NTSTATUS_DOWNGRADE_DETECTED => Some("STATUS_DOWNGRADE_DETECTED"),
+ SMB_NTSTATUS_SMARTCARD_CERT_REVOKED => Some("STATUS_SMARTCARD_CERT_REVOKED"),
+ SMB_NTSTATUS_ISSUING_CA_UNTRUSTED => Some("STATUS_ISSUING_CA_UNTRUSTED"),
+ SMB_NTSTATUS_REVOCATION_OFFLINE_C => Some("STATUS_REVOCATION_OFFLINE_C"),
+ SMB_NTSTATUS_PKINIT_CLIENT_FAILURE => Some("STATUS_PKINIT_CLIENT_FAILURE"),
+ SMB_NTSTATUS_SMARTCARD_CERT_EXPIRED => Some("STATUS_SMARTCARD_CERT_EXPIRED"),
+ SMB_NTSTATUS_DRIVER_FAILED_PRIOR_UNLOAD => Some("STATUS_DRIVER_FAILED_PRIOR_UNLOAD"),
+ SMB_NTSTATUS_SMARTCARD_SILENT_CONTEXT => Some("STATUS_SMARTCARD_SILENT_CONTEXT"),
+ SMB_NTSTATUS_PER_USER_TRUST_QUOTA_EXCEEDED => Some("STATUS_PER_USER_TRUST_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_ALL_USER_TRUST_QUOTA_EXCEEDED => Some("STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED => Some("STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_DS_NAME_NOT_UNIQUE => Some("STATUS_DS_NAME_NOT_UNIQUE"),
+ SMB_NTSTATUS_DS_DUPLICATE_ID_FOUND => Some("STATUS_DS_DUPLICATE_ID_FOUND"),
+ SMB_NTSTATUS_DS_GROUP_CONVERSION_ERROR => Some("STATUS_DS_GROUP_CONVERSION_ERROR"),
+ SMB_NTSTATUS_VOLSNAP_PREPARE_HIBERNATE => Some("STATUS_VOLSNAP_PREPARE_HIBERNATE"),
+ SMB_NTSTATUS_USER2USER_REQUIRED => Some("STATUS_USER2USER_REQUIRED"),
+ SMB_NTSTATUS_STACK_BUFFER_OVERRUN => Some("STATUS_STACK_BUFFER_OVERRUN"),
+ SMB_NTSTATUS_NO_S4U_PROT_SUPPORT => Some("STATUS_NO_S4U_PROT_SUPPORT"),
+ SMB_NTSTATUS_CROSSREALM_DELEGATION_FAILURE => Some("STATUS_CROSSREALM_DELEGATION_FAILURE"),
+ SMB_NTSTATUS_REVOCATION_OFFLINE_KDC => Some("STATUS_REVOCATION_OFFLINE_KDC"),
+ SMB_NTSTATUS_ISSUING_CA_UNTRUSTED_KDC => Some("STATUS_ISSUING_CA_UNTRUSTED_KDC"),
+ SMB_NTSTATUS_KDC_CERT_EXPIRED => Some("STATUS_KDC_CERT_EXPIRED"),
+ SMB_NTSTATUS_KDC_CERT_REVOKED => Some("STATUS_KDC_CERT_REVOKED"),
+ SMB_NTSTATUS_PARAMETER_QUOTA_EXCEEDED => Some("STATUS_PARAMETER_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_HIBERNATION_FAILURE => Some("STATUS_HIBERNATION_FAILURE"),
+ SMB_NTSTATUS_DELAY_LOAD_FAILED => Some("STATUS_DELAY_LOAD_FAILED"),
+ SMB_NTSTATUS_AUTHENTICATION_FIREWALL_FAILED => Some("STATUS_AUTHENTICATION_FIREWALL_FAILED"),
+ SMB_NTSTATUS_VDM_DISALLOWED => Some("STATUS_VDM_DISALLOWED"),
+ SMB_NTSTATUS_HUNG_DISPLAY_DRIVER_THREAD => Some("STATUS_HUNG_DISPLAY_DRIVER_THREAD"),
+ SMB_NTSTATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE => Some("STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE"),
+ SMB_NTSTATUS_INVALID_CRUNTIME_PARAMETER => Some("STATUS_INVALID_CRUNTIME_PARAMETER"),
+ SMB_NTSTATUS_NTLM_BLOCKED => Some("STATUS_NTLM_BLOCKED"),
+ SMB_NTSTATUS_DS_SRC_SID_EXISTS_IN_FOREST => Some("STATUS_DS_SRC_SID_EXISTS_IN_FOREST"),
+ SMB_NTSTATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST => Some("STATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST"),
+ SMB_NTSTATUS_DS_FLAT_NAME_EXISTS_IN_FOREST => Some("STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST"),
+ SMB_NTSTATUS_INVALID_USER_PRINCIPAL_NAME => Some("STATUS_INVALID_USER_PRINCIPAL_NAME"),
+ SMB_NTSTATUS_ASSERTION_FAILURE => Some("STATUS_ASSERTION_FAILURE"),
+ SMB_NTSTATUS_VERIFIER_STOP => Some("STATUS_VERIFIER_STOP"),
+ SMB_NTSTATUS_CALLBACK_POP_STACK => Some("STATUS_CALLBACK_POP_STACK"),
+ SMB_NTSTATUS_INCOMPATIBLE_DRIVER_BLOCKED => Some("STATUS_INCOMPATIBLE_DRIVER_BLOCKED"),
+ SMB_NTSTATUS_HIVE_UNLOADED => Some("STATUS_HIVE_UNLOADED"),
+ SMB_NTSTATUS_COMPRESSION_DISABLED => Some("STATUS_COMPRESSION_DISABLED"),
+ SMB_NTSTATUS_FILE_SYSTEM_LIMITATION => Some("STATUS_FILE_SYSTEM_LIMITATION"),
+ SMB_NTSTATUS_INVALID_IMAGE_HASH => Some("STATUS_INVALID_IMAGE_HASH"),
+ SMB_NTSTATUS_NOT_CAPABLE => Some("STATUS_NOT_CAPABLE"),
+ SMB_NTSTATUS_REQUEST_OUT_OF_SEQUENCE => Some("STATUS_REQUEST_OUT_OF_SEQUENCE"),
+ SMB_NTSTATUS_IMPLEMENTATION_LIMIT => Some("STATUS_IMPLEMENTATION_LIMIT"),
+ SMB_NTSTATUS_ELEVATION_REQUIRED => Some("STATUS_ELEVATION_REQUIRED"),
+ SMB_NTSTATUS_NO_SECURITY_CONTEXT => Some("STATUS_NO_SECURITY_CONTEXT"),
+ SMB_NTSTATUS_PKU2U_CERT_FAILURE => Some("STATUS_PKU2U_CERT_FAILURE"),
+ SMB_NTSTATUS_BEYOND_VDL => Some("STATUS_BEYOND_VDL"),
+ SMB_NTSTATUS_ENCOUNTERED_WRITE_IN_PROGRESS => Some("STATUS_ENCOUNTERED_WRITE_IN_PROGRESS"),
+ SMB_NTSTATUS_PTE_CHANGED => Some("STATUS_PTE_CHANGED"),
+ SMB_NTSTATUS_PURGE_FAILED => Some("STATUS_PURGE_FAILED"),
+ SMB_NTSTATUS_CRED_REQUIRES_CONFIRMATION => Some("STATUS_CRED_REQUIRES_CONFIRMATION"),
+ SMB_NTSTATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE => Some("STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE"),
+ SMB_NTSTATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER => Some("STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER"),
+ SMB_NTSTATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE => Some("STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE"),
+ SMB_NTSTATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE => Some("STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE"),
+ SMB_NTSTATUS_CS_ENCRYPTION_FILE_NOT_CSE => Some("STATUS_CS_ENCRYPTION_FILE_NOT_CSE"),
+ SMB_NTSTATUS_INVALID_LABEL => Some("STATUS_INVALID_LABEL"),
+ SMB_NTSTATUS_DRIVER_PROCESS_TERMINATED => Some("STATUS_DRIVER_PROCESS_TERMINATED"),
+ SMB_NTSTATUS_AMBIGUOUS_SYSTEM_DEVICE => Some("STATUS_AMBIGUOUS_SYSTEM_DEVICE"),
+ SMB_NTSTATUS_SYSTEM_DEVICE_NOT_FOUND => Some("STATUS_SYSTEM_DEVICE_NOT_FOUND"),
+ SMB_NTSTATUS_RESTART_BOOT_APPLICATION => Some("STATUS_RESTART_BOOT_APPLICATION"),
+ SMB_NTSTATUS_INSUFFICIENT_NVRAM_RESOURCES => Some("STATUS_INSUFFICIENT_NVRAM_RESOURCES"),
+ SMB_NTSTATUS_NO_RANGES_PROCESSED => Some("STATUS_NO_RANGES_PROCESSED"),
+ SMB_NTSTATUS_DEVICE_FEATURE_NOT_SUPPORTED => Some("STATUS_DEVICE_FEATURE_NOT_SUPPORTED"),
+ SMB_NTSTATUS_DEVICE_UNREACHABLE => Some("STATUS_DEVICE_UNREACHABLE"),
+ SMB_NTSTATUS_INVALID_TOKEN => Some("STATUS_INVALID_TOKEN"),
+ SMB_NTSTATUS_SERVER_UNAVAILABLE => Some("STATUS_SERVER_UNAVAILABLE"),
+ SMB_NTSTATUS_INVALID_TASK_NAME => Some("STATUS_INVALID_TASK_NAME"),
+ SMB_NTSTATUS_INVALID_TASK_INDEX => Some("STATUS_INVALID_TASK_INDEX"),
+ SMB_NTSTATUS_THREAD_ALREADY_IN_TASK => Some("STATUS_THREAD_ALREADY_IN_TASK"),
+ SMB_NTSTATUS_CALLBACK_BYPASS => Some("STATUS_CALLBACK_BYPASS"),
+ SMB_NTSTATUS_FAIL_FAST_EXCEPTION => Some("STATUS_FAIL_FAST_EXCEPTION"),
+ SMB_NTSTATUS_IMAGE_CERT_REVOKED => Some("STATUS_IMAGE_CERT_REVOKED"),
+ SMB_NTSTATUS_PORT_CLOSED => Some("STATUS_PORT_CLOSED"),
+ SMB_NTSTATUS_MESSAGE_LOST => Some("STATUS_MESSAGE_LOST"),
+ SMB_NTSTATUS_INVALID_MESSAGE => Some("STATUS_INVALID_MESSAGE"),
+ SMB_NTSTATUS_REQUEST_CANCELED => Some("STATUS_REQUEST_CANCELED"),
+ SMB_NTSTATUS_RECURSIVE_DISPATCH => Some("STATUS_RECURSIVE_DISPATCH"),
+ SMB_NTSTATUS_LPC_RECEIVE_BUFFER_EXPECTED => Some("STATUS_LPC_RECEIVE_BUFFER_EXPECTED"),
+ SMB_NTSTATUS_LPC_INVALID_CONNECTION_USAGE => Some("STATUS_LPC_INVALID_CONNECTION_USAGE"),
+ SMB_NTSTATUS_LPC_REQUESTS_NOT_ALLOWED => Some("STATUS_LPC_REQUESTS_NOT_ALLOWED"),
+ SMB_NTSTATUS_RESOURCE_IN_USE => Some("STATUS_RESOURCE_IN_USE"),
+ SMB_NTSTATUS_HARDWARE_MEMORY_ERROR => Some("STATUS_HARDWARE_MEMORY_ERROR"),
+ SMB_NTSTATUS_THREADPOOL_HANDLE_EXCEPTION => Some("STATUS_THREADPOOL_HANDLE_EXCEPTION"),
+ SMB_NTSTATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED => Some("STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED"),
+ SMB_NTSTATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED => Some("STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED"),
+ SMB_NTSTATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED => Some("STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED"),
+ SMB_NTSTATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED => Some("STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED"),
+ SMB_NTSTATUS_THREADPOOL_RELEASED_DURING_OPERATION => Some("STATUS_THREADPOOL_RELEASED_DURING_OPERATION"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING => Some("STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING"),
+ SMB_NTSTATUS_APC_RETURNED_WHILE_IMPERSONATING => Some("STATUS_APC_RETURNED_WHILE_IMPERSONATING"),
+ SMB_NTSTATUS_PROCESS_IS_PROTECTED => Some("STATUS_PROCESS_IS_PROTECTED"),
+ SMB_NTSTATUS_MCA_EXCEPTION => Some("STATUS_MCA_EXCEPTION"),
+ SMB_NTSTATUS_CERTIFICATE_MAPPING_NOT_UNIQUE => Some("STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE"),
+ SMB_NTSTATUS_SYMLINK_CLASS_DISABLED => Some("STATUS_SYMLINK_CLASS_DISABLED"),
+ SMB_NTSTATUS_INVALID_IDN_NORMALIZATION => Some("STATUS_INVALID_IDN_NORMALIZATION"),
+ SMB_NTSTATUS_NO_UNICODE_TRANSLATION => Some("STATUS_NO_UNICODE_TRANSLATION"),
+ SMB_NTSTATUS_ALREADY_REGISTERED => Some("STATUS_ALREADY_REGISTERED"),
+ SMB_NTSTATUS_CONTEXT_MISMATCH => Some("STATUS_CONTEXT_MISMATCH"),
+ SMB_NTSTATUS_PORT_ALREADY_HAS_COMPLETION_LIST => Some("STATUS_PORT_ALREADY_HAS_COMPLETION_LIST"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_THREAD_PRIORITY => Some("STATUS_CALLBACK_RETURNED_THREAD_PRIORITY"),
+ SMB_NTSTATUS_INVALID_THREAD => Some("STATUS_INVALID_THREAD"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_TRANSACTION => Some("STATUS_CALLBACK_RETURNED_TRANSACTION"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_LDR_LOCK => Some("STATUS_CALLBACK_RETURNED_LDR_LOCK"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_LANG => Some("STATUS_CALLBACK_RETURNED_LANG"),
+ SMB_NTSTATUS_CALLBACK_RETURNED_PRI_BACK => Some("STATUS_CALLBACK_RETURNED_PRI_BACK"),
+ SMB_NTSTATUS_DISK_REPAIR_DISABLED => Some("STATUS_DISK_REPAIR_DISABLED"),
+ SMB_NTSTATUS_DS_DOMAIN_RENAME_IN_PROGRESS => Some("STATUS_DS_DOMAIN_RENAME_IN_PROGRESS"),
+ SMB_NTSTATUS_DISK_QUOTA_EXCEEDED => Some("STATUS_DISK_QUOTA_EXCEEDED"),
+ SMB_NTSTATUS_CONTENT_BLOCKED => Some("STATUS_CONTENT_BLOCKED"),
+ SMB_NTSTATUS_BAD_CLUSTERS => Some("STATUS_BAD_CLUSTERS"),
+ SMB_NTSTATUS_VOLUME_DIRTY => Some("STATUS_VOLUME_DIRTY"),
+ SMB_NTSTATUS_FILE_CHECKED_OUT => Some("STATUS_FILE_CHECKED_OUT"),
+ SMB_NTSTATUS_CHECKOUT_REQUIRED => Some("STATUS_CHECKOUT_REQUIRED"),
+ SMB_NTSTATUS_BAD_FILE_TYPE => Some("STATUS_BAD_FILE_TYPE"),
+ SMB_NTSTATUS_FILE_TOO_LARGE => Some("STATUS_FILE_TOO_LARGE"),
+ SMB_NTSTATUS_FORMS_AUTH_REQUIRED => Some("STATUS_FORMS_AUTH_REQUIRED"),
+ SMB_NTSTATUS_VIRUS_INFECTED => Some("STATUS_VIRUS_INFECTED"),
+ SMB_NTSTATUS_VIRUS_DELETED => Some("STATUS_VIRUS_DELETED"),
+ SMB_NTSTATUS_BAD_MCFG_TABLE => Some("STATUS_BAD_MCFG_TABLE"),
+ SMB_NTSTATUS_CANNOT_BREAK_OPLOCK => Some("STATUS_CANNOT_BREAK_OPLOCK"),
+ SMB_NTSTATUS_WOW_ASSERTION => Some("STATUS_WOW_ASSERTION"),
+ SMB_NTSTATUS_INVALID_SIGNATURE => Some("STATUS_INVALID_SIGNATURE"),
+ SMB_NTSTATUS_HMAC_NOT_SUPPORTED => Some("STATUS_HMAC_NOT_SUPPORTED"),
+ SMB_NTSTATUS_IPSEC_QUEUE_OVERFLOW => Some("STATUS_IPSEC_QUEUE_OVERFLOW"),
+ SMB_NTSTATUS_ND_QUEUE_OVERFLOW => Some("STATUS_ND_QUEUE_OVERFLOW"),
+ SMB_NTSTATUS_HOPLIMIT_EXCEEDED => Some("STATUS_HOPLIMIT_EXCEEDED"),
+ SMB_NTSTATUS_PROTOCOL_NOT_SUPPORTED => Some("STATUS_PROTOCOL_NOT_SUPPORTED"),
+ SMB_NTSTATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED => Some("STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED"),
+ SMB_NTSTATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR => Some("STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR"),
+ SMB_NTSTATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR => Some("STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR"),
+ SMB_NTSTATUS_XML_PARSE_ERROR => Some("STATUS_XML_PARSE_ERROR"),
+ SMB_NTSTATUS_XMLDSIG_ERROR => Some("STATUS_XMLDSIG_ERROR"),
+ SMB_NTSTATUS_WRONG_COMPARTMENT => Some("STATUS_WRONG_COMPARTMENT"),
+ SMB_NTSTATUS_AUTHIP_FAILURE => Some("STATUS_AUTHIP_FAILURE"),
+ SMB_NTSTATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS => Some("STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS"),
+ SMB_NTSTATUS_DS_OID_NOT_FOUND => Some("STATUS_DS_OID_NOT_FOUND"),
+ SMB_NTSTATUS_HASH_NOT_SUPPORTED => Some("STATUS_HASH_NOT_SUPPORTED"),
+ SMB_NTSTATUS_HASH_NOT_PRESENT => Some("STATUS_HASH_NOT_PRESENT"),
+ SMB_NTSTATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED => Some("STATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED"),
+ SMB_NTSTATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED => Some("STATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED"),
+ SMB_NTSTATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED => Some("STATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED"),
+ SMB_NTSTATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED => Some("STATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED"),
+ SMB_NTDBG_NO_STATE_CHANGE => Some("DBG_NO_STATE_CHANGE"),
+ SMB_NTDBG_APP_NOT_IDLE => Some("DBG_APP_NOT_IDLE"),
+ SMB_NTRPC_NT_INVALID_STRING_BINDING => Some("RPC_NT_INVALID_STRING_BINDING"),
+ SMB_NTRPC_NT_WRONG_KIND_OF_BINDING => Some("RPC_NT_WRONG_KIND_OF_BINDING"),
+ SMB_NTRPC_NT_INVALID_BINDING => Some("RPC_NT_INVALID_BINDING"),
+ SMB_NTRPC_NT_PROTSEQ_NOT_SUPPORTED => Some("RPC_NT_PROTSEQ_NOT_SUPPORTED"),
+ SMB_NTRPC_NT_INVALID_RPC_PROTSEQ => Some("RPC_NT_INVALID_RPC_PROTSEQ"),
+ SMB_NTRPC_NT_INVALID_STRING_UUID => Some("RPC_NT_INVALID_STRING_UUID"),
+ SMB_NTRPC_NT_INVALID_ENDPOINT_FORMAT => Some("RPC_NT_INVALID_ENDPOINT_FORMAT"),
+ SMB_NTRPC_NT_INVALID_NET_ADDR => Some("RPC_NT_INVALID_NET_ADDR"),
+ SMB_NTRPC_NT_NO_ENDPOINT_FOUND => Some("RPC_NT_NO_ENDPOINT_FOUND"),
+ SMB_NTRPC_NT_INVALID_TIMEOUT => Some("RPC_NT_INVALID_TIMEOUT"),
+ SMB_NTRPC_NT_OBJECT_NOT_FOUND => Some("RPC_NT_OBJECT_NOT_FOUND"),
+ SMB_NTRPC_NT_ALREADY_REGISTERED => Some("RPC_NT_ALREADY_REGISTERED"),
+ SMB_NTRPC_NT_TYPE_ALREADY_REGISTERED => Some("RPC_NT_TYPE_ALREADY_REGISTERED"),
+ SMB_NTRPC_NT_ALREADY_LISTENING => Some("RPC_NT_ALREADY_LISTENING"),
+ SMB_NTRPC_NT_NO_PROTSEQS_REGISTERED => Some("RPC_NT_NO_PROTSEQS_REGISTERED"),
+ SMB_NTRPC_NT_NOT_LISTENING => Some("RPC_NT_NOT_LISTENING"),
+ SMB_NTRPC_NT_UNKNOWN_MGR_TYPE => Some("RPC_NT_UNKNOWN_MGR_TYPE"),
+ SMB_NTRPC_NT_UNKNOWN_IF => Some("RPC_NT_UNKNOWN_IF"),
+ SMB_NTRPC_NT_NO_BINDINGS => Some("RPC_NT_NO_BINDINGS"),
+ SMB_NTRPC_NT_NO_PROTSEQS => Some("RPC_NT_NO_PROTSEQS"),
+ SMB_NTRPC_NT_CANT_CREATE_ENDPOINT => Some("RPC_NT_CANT_CREATE_ENDPOINT"),
+ SMB_NTRPC_NT_OUT_OF_RESOURCES => Some("RPC_NT_OUT_OF_RESOURCES"),
+ SMB_NTRPC_NT_SERVER_UNAVAILABLE => Some("RPC_NT_SERVER_UNAVAILABLE"),
+ SMB_NTRPC_NT_SERVER_TOO_BUSY => Some("RPC_NT_SERVER_TOO_BUSY"),
+ SMB_NTRPC_NT_INVALID_NETWORK_OPTIONS => Some("RPC_NT_INVALID_NETWORK_OPTIONS"),
+ SMB_NTRPC_NT_NO_CALL_ACTIVE => Some("RPC_NT_NO_CALL_ACTIVE"),
+ SMB_NTRPC_NT_CALL_FAILED => Some("RPC_NT_CALL_FAILED"),
+ SMB_NTRPC_NT_CALL_FAILED_DNE => Some("RPC_NT_CALL_FAILED_DNE"),
+ SMB_NTRPC_NT_PROTOCOL_ERROR => Some("RPC_NT_PROTOCOL_ERROR"),
+ SMB_NTRPC_NT_UNSUPPORTED_TRANS_SYN => Some("RPC_NT_UNSUPPORTED_TRANS_SYN"),
+ SMB_NTRPC_NT_UNSUPPORTED_TYPE => Some("RPC_NT_UNSUPPORTED_TYPE"),
+ SMB_NTRPC_NT_INVALID_TAG => Some("RPC_NT_INVALID_TAG"),
+ SMB_NTRPC_NT_INVALID_BOUND => Some("RPC_NT_INVALID_BOUND"),
+ SMB_NTRPC_NT_NO_ENTRY_NAME => Some("RPC_NT_NO_ENTRY_NAME"),
+ SMB_NTRPC_NT_INVALID_NAME_SYNTAX => Some("RPC_NT_INVALID_NAME_SYNTAX"),
+ SMB_NTRPC_NT_UNSUPPORTED_NAME_SYNTAX => Some("RPC_NT_UNSUPPORTED_NAME_SYNTAX"),
+ SMB_NTRPC_NT_UUID_NO_ADDRESS => Some("RPC_NT_UUID_NO_ADDRESS"),
+ SMB_NTRPC_NT_DUPLICATE_ENDPOINT => Some("RPC_NT_DUPLICATE_ENDPOINT"),
+ SMB_NTRPC_NT_UNKNOWN_AUTHN_TYPE => Some("RPC_NT_UNKNOWN_AUTHN_TYPE"),
+ SMB_NTRPC_NT_MAX_CALLS_TOO_SMALL => Some("RPC_NT_MAX_CALLS_TOO_SMALL"),
+ SMB_NTRPC_NT_STRING_TOO_LONG => Some("RPC_NT_STRING_TOO_LONG"),
+ SMB_NTRPC_NT_PROTSEQ_NOT_FOUND => Some("RPC_NT_PROTSEQ_NOT_FOUND"),
+ SMB_NTRPC_NT_PROCNUM_OUT_OF_RANGE => Some("RPC_NT_PROCNUM_OUT_OF_RANGE"),
+ SMB_NTRPC_NT_BINDING_HAS_NO_AUTH => Some("RPC_NT_BINDING_HAS_NO_AUTH"),
+ SMB_NTRPC_NT_UNKNOWN_AUTHN_SERVICE => Some("RPC_NT_UNKNOWN_AUTHN_SERVICE"),
+ SMB_NTRPC_NT_UNKNOWN_AUTHN_LEVEL => Some("RPC_NT_UNKNOWN_AUTHN_LEVEL"),
+ SMB_NTRPC_NT_INVALID_AUTH_IDENTITY => Some("RPC_NT_INVALID_AUTH_IDENTITY"),
+ SMB_NTRPC_NT_UNKNOWN_AUTHZ_SERVICE => Some("RPC_NT_UNKNOWN_AUTHZ_SERVICE"),
+ SMB_NTEPT_NT_INVALID_ENTRY => Some("EPT_NT_INVALID_ENTRY"),
+ SMB_NTEPT_NT_CANT_PERFORM_OP => Some("EPT_NT_CANT_PERFORM_OP"),
+ SMB_NTEPT_NT_NOT_REGISTERED => Some("EPT_NT_NOT_REGISTERED"),
+ SMB_NTRPC_NT_NOTHING_TO_EXPORT => Some("RPC_NT_NOTHING_TO_EXPORT"),
+ SMB_NTRPC_NT_INCOMPLETE_NAME => Some("RPC_NT_INCOMPLETE_NAME"),
+ SMB_NTRPC_NT_INVALID_VERS_OPTION => Some("RPC_NT_INVALID_VERS_OPTION"),
+ SMB_NTRPC_NT_NO_MORE_MEMBERS => Some("RPC_NT_NO_MORE_MEMBERS"),
+ SMB_NTRPC_NT_NOT_ALL_OBJS_UNEXPORTED => Some("RPC_NT_NOT_ALL_OBJS_UNEXPORTED"),
+ SMB_NTRPC_NT_INTERFACE_NOT_FOUND => Some("RPC_NT_INTERFACE_NOT_FOUND"),
+ SMB_NTRPC_NT_ENTRY_ALREADY_EXISTS => Some("RPC_NT_ENTRY_ALREADY_EXISTS"),
+ SMB_NTRPC_NT_ENTRY_NOT_FOUND => Some("RPC_NT_ENTRY_NOT_FOUND"),
+ SMB_NTRPC_NT_NAME_SERVICE_UNAVAILABLE => Some("RPC_NT_NAME_SERVICE_UNAVAILABLE"),
+ SMB_NTRPC_NT_INVALID_NAF_ID => Some("RPC_NT_INVALID_NAF_ID"),
+ SMB_NTRPC_NT_CANNOT_SUPPORT => Some("RPC_NT_CANNOT_SUPPORT"),
+ SMB_NTRPC_NT_NO_CONTEXT_AVAILABLE => Some("RPC_NT_NO_CONTEXT_AVAILABLE"),
+ SMB_NTRPC_NT_INTERNAL_ERROR => Some("RPC_NT_INTERNAL_ERROR"),
+ SMB_NTRPC_NT_ZERO_DIVIDE => Some("RPC_NT_ZERO_DIVIDE"),
+ SMB_NTRPC_NT_ADDRESS_ERROR => Some("RPC_NT_ADDRESS_ERROR"),
+ SMB_NTRPC_NT_FP_DIV_ZERO => Some("RPC_NT_FP_DIV_ZERO"),
+ SMB_NTRPC_NT_FP_UNDERFLOW => Some("RPC_NT_FP_UNDERFLOW"),
+ SMB_NTRPC_NT_FP_OVERFLOW => Some("RPC_NT_FP_OVERFLOW"),
+ SMB_NTRPC_NT_CALL_IN_PROGRESS => Some("RPC_NT_CALL_IN_PROGRESS"),
+ SMB_NTRPC_NT_NO_MORE_BINDINGS => Some("RPC_NT_NO_MORE_BINDINGS"),
+ SMB_NTRPC_NT_GROUP_MEMBER_NOT_FOUND => Some("RPC_NT_GROUP_MEMBER_NOT_FOUND"),
+ SMB_NTEPT_NT_CANT_CREATE => Some("EPT_NT_CANT_CREATE"),
+ SMB_NTRPC_NT_INVALID_OBJECT => Some("RPC_NT_INVALID_OBJECT"),
+ SMB_NTRPC_NT_NO_INTERFACES => Some("RPC_NT_NO_INTERFACES"),
+ SMB_NTRPC_NT_CALL_CANCELLED => Some("RPC_NT_CALL_CANCELLED"),
+ SMB_NTRPC_NT_BINDING_INCOMPLETE => Some("RPC_NT_BINDING_INCOMPLETE"),
+ SMB_NTRPC_NT_COMM_FAILURE => Some("RPC_NT_COMM_FAILURE"),
+ SMB_NTRPC_NT_UNSUPPORTED_AUTHN_LEVEL => Some("RPC_NT_UNSUPPORTED_AUTHN_LEVEL"),
+ SMB_NTRPC_NT_NO_PRINC_NAME => Some("RPC_NT_NO_PRINC_NAME"),
+ SMB_NTRPC_NT_NOT_RPC_ERROR => Some("RPC_NT_NOT_RPC_ERROR"),
+ SMB_NTRPC_NT_SEC_PKG_ERROR => Some("RPC_NT_SEC_PKG_ERROR"),
+ SMB_NTRPC_NT_NOT_CANCELLED => Some("RPC_NT_NOT_CANCELLED"),
+ SMB_NTRPC_NT_INVALID_ASYNC_HANDLE => Some("RPC_NT_INVALID_ASYNC_HANDLE"),
+ SMB_NTRPC_NT_INVALID_ASYNC_CALL => Some("RPC_NT_INVALID_ASYNC_CALL"),
+ SMB_NTRPC_NT_PROXY_ACCESS_DENIED => Some("RPC_NT_PROXY_ACCESS_DENIED"),
+ SMB_NTRPC_NT_NO_MORE_ENTRIES => Some("RPC_NT_NO_MORE_ENTRIES"),
+ SMB_NTRPC_NT_SS_CHAR_TRANS_OPEN_FAIL => Some("RPC_NT_SS_CHAR_TRANS_OPEN_FAIL"),
+ SMB_NTRPC_NT_SS_CHAR_TRANS_SHORT_FILE => Some("RPC_NT_SS_CHAR_TRANS_SHORT_FILE"),
+ SMB_NTRPC_NT_SS_IN_NULL_CONTEXT => Some("RPC_NT_SS_IN_NULL_CONTEXT"),
+ SMB_NTRPC_NT_SS_CONTEXT_MISMATCH => Some("RPC_NT_SS_CONTEXT_MISMATCH"),
+ SMB_NTRPC_NT_SS_CONTEXT_DAMAGED => Some("RPC_NT_SS_CONTEXT_DAMAGED"),
+ SMB_NTRPC_NT_SS_HANDLES_MISMATCH => Some("RPC_NT_SS_HANDLES_MISMATCH"),
+ SMB_NTRPC_NT_SS_CANNOT_GET_CALL_HANDLE => Some("RPC_NT_SS_CANNOT_GET_CALL_HANDLE"),
+ SMB_NTRPC_NT_NULL_REF_POINTER => Some("RPC_NT_NULL_REF_POINTER"),
+ SMB_NTRPC_NT_ENUM_VALUE_OUT_OF_RANGE => Some("RPC_NT_ENUM_VALUE_OUT_OF_RANGE"),
+ SMB_NTRPC_NT_BYTE_COUNT_TOO_SMALL => Some("RPC_NT_BYTE_COUNT_TOO_SMALL"),
+ SMB_NTRPC_NT_BAD_STUB_DATA => Some("RPC_NT_BAD_STUB_DATA"),
+ SMB_NTRPC_NT_INVALID_ES_ACTION => Some("RPC_NT_INVALID_ES_ACTION"),
+ SMB_NTRPC_NT_WRONG_ES_VERSION => Some("RPC_NT_WRONG_ES_VERSION"),
+ SMB_NTRPC_NT_WRONG_STUB_VERSION => Some("RPC_NT_WRONG_STUB_VERSION"),
+ SMB_NTRPC_NT_INVALID_PIPE_OBJECT => Some("RPC_NT_INVALID_PIPE_OBJECT"),
+ SMB_NTRPC_NT_INVALID_PIPE_OPERATION => Some("RPC_NT_INVALID_PIPE_OPERATION"),
+ SMB_NTRPC_NT_WRONG_PIPE_VERSION => Some("RPC_NT_WRONG_PIPE_VERSION"),
+ SMB_NTRPC_NT_PIPE_CLOSED => Some("RPC_NT_PIPE_CLOSED"),
+ SMB_NTRPC_NT_PIPE_DISCIPLINE_ERROR => Some("RPC_NT_PIPE_DISCIPLINE_ERROR"),
+ SMB_NTRPC_NT_PIPE_EMPTY => Some("RPC_NT_PIPE_EMPTY"),
+ SMB_NTSTATUS_PNP_BAD_MPS_TABLE => Some("STATUS_PNP_BAD_MPS_TABLE"),
+ SMB_NTSTATUS_PNP_TRANSLATION_FAILED => Some("STATUS_PNP_TRANSLATION_FAILED"),
+ SMB_NTSTATUS_PNP_IRQ_TRANSLATION_FAILED => Some("STATUS_PNP_IRQ_TRANSLATION_FAILED"),
+ SMB_NTSTATUS_PNP_INVALID_ID => Some("STATUS_PNP_INVALID_ID"),
+ SMB_NTSTATUS_IO_REISSUE_AS_CACHED => Some("STATUS_IO_REISSUE_AS_CACHED"),
+ SMB_NTSTATUS_CTX_WINSTATION_NAME_INVALID => Some("STATUS_CTX_WINSTATION_NAME_INVALID"),
+ SMB_NTSTATUS_CTX_INVALID_PD => Some("STATUS_CTX_INVALID_PD"),
+ SMB_NTSTATUS_CTX_PD_NOT_FOUND => Some("STATUS_CTX_PD_NOT_FOUND"),
+ SMB_NTSTATUS_CTX_CLOSE_PENDING => Some("STATUS_CTX_CLOSE_PENDING"),
+ SMB_NTSTATUS_CTX_NO_OUTBUF => Some("STATUS_CTX_NO_OUTBUF"),
+ SMB_NTSTATUS_CTX_MODEM_INF_NOT_FOUND => Some("STATUS_CTX_MODEM_INF_NOT_FOUND"),
+ SMB_NTSTATUS_CTX_INVALID_MODEMNAME => Some("STATUS_CTX_INVALID_MODEMNAME"),
+ SMB_NTSTATUS_CTX_RESPONSE_ERROR => Some("STATUS_CTX_RESPONSE_ERROR"),
+ SMB_NTSTATUS_CTX_MODEM_RESPONSE_TIMEOUT => Some("STATUS_CTX_MODEM_RESPONSE_TIMEOUT"),
+ SMB_NTSTATUS_CTX_MODEM_RESPONSE_NO_CARRIER => Some("STATUS_CTX_MODEM_RESPONSE_NO_CARRIER"),
+ SMB_NTSTATUS_CTX_MODEM_RESPONSE_NO_DIALTONE => Some("STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE"),
+ SMB_NTSTATUS_CTX_MODEM_RESPONSE_BUSY => Some("STATUS_CTX_MODEM_RESPONSE_BUSY"),
+ SMB_NTSTATUS_CTX_MODEM_RESPONSE_VOICE => Some("STATUS_CTX_MODEM_RESPONSE_VOICE"),
+ SMB_NTSTATUS_CTX_TD_ERROR => Some("STATUS_CTX_TD_ERROR"),
+ SMB_NTSTATUS_CTX_LICENSE_CLIENT_INVALID => Some("STATUS_CTX_LICENSE_CLIENT_INVALID"),
+ SMB_NTSTATUS_CTX_LICENSE_NOT_AVAILABLE => Some("STATUS_CTX_LICENSE_NOT_AVAILABLE"),
+ SMB_NTSTATUS_CTX_LICENSE_EXPIRED => Some("STATUS_CTX_LICENSE_EXPIRED"),
+ SMB_NTSTATUS_CTX_WINSTATION_NOT_FOUND => Some("STATUS_CTX_WINSTATION_NOT_FOUND"),
+ SMB_NTSTATUS_CTX_WINSTATION_NAME_COLLISION => Some("STATUS_CTX_WINSTATION_NAME_COLLISION"),
+ SMB_NTSTATUS_CTX_WINSTATION_BUSY => Some("STATUS_CTX_WINSTATION_BUSY"),
+ SMB_NTSTATUS_CTX_BAD_VIDEO_MODE => Some("STATUS_CTX_BAD_VIDEO_MODE"),
+ SMB_NTSTATUS_CTX_GRAPHICS_INVALID => Some("STATUS_CTX_GRAPHICS_INVALID"),
+ SMB_NTSTATUS_CTX_NOT_CONSOLE => Some("STATUS_CTX_NOT_CONSOLE"),
+ SMB_NTSTATUS_CTX_CLIENT_QUERY_TIMEOUT => Some("STATUS_CTX_CLIENT_QUERY_TIMEOUT"),
+ SMB_NTSTATUS_CTX_CONSOLE_DISCONNECT => Some("STATUS_CTX_CONSOLE_DISCONNECT"),
+ SMB_NTSTATUS_CTX_CONSOLE_CONNECT => Some("STATUS_CTX_CONSOLE_CONNECT"),
+ SMB_NTSTATUS_CTX_SHADOW_DENIED => Some("STATUS_CTX_SHADOW_DENIED"),
+ SMB_NTSTATUS_CTX_WINSTATION_ACCESS_DENIED => Some("STATUS_CTX_WINSTATION_ACCESS_DENIED"),
+ SMB_NTSTATUS_CTX_INVALID_WD => Some("STATUS_CTX_INVALID_WD"),
+ SMB_NTSTATUS_CTX_WD_NOT_FOUND => Some("STATUS_CTX_WD_NOT_FOUND"),
+ SMB_NTSTATUS_CTX_SHADOW_INVALID => Some("STATUS_CTX_SHADOW_INVALID"),
+ SMB_NTSTATUS_CTX_SHADOW_DISABLED => Some("STATUS_CTX_SHADOW_DISABLED"),
+ SMB_NTSTATUS_RDP_PROTOCOL_ERROR => Some("STATUS_RDP_PROTOCOL_ERROR"),
+ SMB_NTSTATUS_CTX_CLIENT_LICENSE_NOT_SET => Some("STATUS_CTX_CLIENT_LICENSE_NOT_SET"),
+ SMB_NTSTATUS_CTX_CLIENT_LICENSE_IN_USE => Some("STATUS_CTX_CLIENT_LICENSE_IN_USE"),
+ SMB_NTSTATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE => Some("STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE"),
+ SMB_NTSTATUS_CTX_SHADOW_NOT_RUNNING => Some("STATUS_CTX_SHADOW_NOT_RUNNING"),
+ SMB_NTSTATUS_CTX_LOGON_DISABLED => Some("STATUS_CTX_LOGON_DISABLED"),
+ SMB_NTSTATUS_CTX_SECURITY_LAYER_ERROR => Some("STATUS_CTX_SECURITY_LAYER_ERROR"),
+ SMB_NTSTATUS_TS_INCOMPATIBLE_SESSIONS => Some("STATUS_TS_INCOMPATIBLE_SESSIONS"),
+ SMB_NTSTATUS_MUI_FILE_NOT_FOUND => Some("STATUS_MUI_FILE_NOT_FOUND"),
+ SMB_NTSTATUS_MUI_INVALID_FILE => Some("STATUS_MUI_INVALID_FILE"),
+ SMB_NTSTATUS_MUI_INVALID_RC_CONFIG => Some("STATUS_MUI_INVALID_RC_CONFIG"),
+ SMB_NTSTATUS_MUI_INVALID_LOCALE_NAME => Some("STATUS_MUI_INVALID_LOCALE_NAME"),
+ SMB_NTSTATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME => Some("STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME"),
+ SMB_NTSTATUS_MUI_FILE_NOT_LOADED => Some("STATUS_MUI_FILE_NOT_LOADED"),
+ SMB_NTSTATUS_RESOURCE_ENUM_USER_STOP => Some("STATUS_RESOURCE_ENUM_USER_STOP"),
+ SMB_NTSTATUS_CLUSTER_INVALID_NODE => Some("STATUS_CLUSTER_INVALID_NODE"),
+ SMB_NTSTATUS_CLUSTER_NODE_EXISTS => Some("STATUS_CLUSTER_NODE_EXISTS"),
+ SMB_NTSTATUS_CLUSTER_JOIN_IN_PROGRESS => Some("STATUS_CLUSTER_JOIN_IN_PROGRESS"),
+ SMB_NTSTATUS_CLUSTER_NODE_NOT_FOUND => Some("STATUS_CLUSTER_NODE_NOT_FOUND"),
+ SMB_NTSTATUS_CLUSTER_LOCAL_NODE_NOT_FOUND => Some("STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND"),
+ SMB_NTSTATUS_CLUSTER_NETWORK_EXISTS => Some("STATUS_CLUSTER_NETWORK_EXISTS"),
+ SMB_NTSTATUS_CLUSTER_NETWORK_NOT_FOUND => Some("STATUS_CLUSTER_NETWORK_NOT_FOUND"),
+ SMB_NTSTATUS_CLUSTER_NETINTERFACE_EXISTS => Some("STATUS_CLUSTER_NETINTERFACE_EXISTS"),
+ SMB_NTSTATUS_CLUSTER_NETINTERFACE_NOT_FOUND => Some("STATUS_CLUSTER_NETINTERFACE_NOT_FOUND"),
+ SMB_NTSTATUS_CLUSTER_INVALID_REQUEST => Some("STATUS_CLUSTER_INVALID_REQUEST"),
+ SMB_NTSTATUS_CLUSTER_INVALID_NETWORK_PROVIDER => Some("STATUS_CLUSTER_INVALID_NETWORK_PROVIDER"),
+ SMB_NTSTATUS_CLUSTER_NODE_DOWN => Some("STATUS_CLUSTER_NODE_DOWN"),
+ SMB_NTSTATUS_CLUSTER_NODE_UNREACHABLE => Some("STATUS_CLUSTER_NODE_UNREACHABLE"),
+ SMB_NTSTATUS_CLUSTER_NODE_NOT_MEMBER => Some("STATUS_CLUSTER_NODE_NOT_MEMBER"),
+ SMB_NTSTATUS_CLUSTER_JOIN_NOT_IN_PROGRESS => Some("STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS"),
+ SMB_NTSTATUS_CLUSTER_INVALID_NETWORK => Some("STATUS_CLUSTER_INVALID_NETWORK"),
+ SMB_NTSTATUS_CLUSTER_NO_NET_ADAPTERS => Some("STATUS_CLUSTER_NO_NET_ADAPTERS"),
+ SMB_NTSTATUS_CLUSTER_NODE_UP => Some("STATUS_CLUSTER_NODE_UP"),
+ SMB_NTSTATUS_CLUSTER_NODE_PAUSED => Some("STATUS_CLUSTER_NODE_PAUSED"),
+ SMB_NTSTATUS_CLUSTER_NODE_NOT_PAUSED => Some("STATUS_CLUSTER_NODE_NOT_PAUSED"),
+ SMB_NTSTATUS_CLUSTER_NO_SECURITY_CONTEXT => Some("STATUS_CLUSTER_NO_SECURITY_CONTEXT"),
+ SMB_NTSTATUS_CLUSTER_NETWORK_NOT_INTERNAL => Some("STATUS_CLUSTER_NETWORK_NOT_INTERNAL"),
+ SMB_NTSTATUS_CLUSTER_POISONED => Some("STATUS_CLUSTER_POISONED"),
+ SMB_NTSTATUS_ACPI_INVALID_OPCODE => Some("STATUS_ACPI_INVALID_OPCODE"),
+ SMB_NTSTATUS_ACPI_STACK_OVERFLOW => Some("STATUS_ACPI_STACK_OVERFLOW"),
+ SMB_NTSTATUS_ACPI_ASSERT_FAILED => Some("STATUS_ACPI_ASSERT_FAILED"),
+ SMB_NTSTATUS_ACPI_INVALID_INDEX => Some("STATUS_ACPI_INVALID_INDEX"),
+ SMB_NTSTATUS_ACPI_INVALID_ARGUMENT => Some("STATUS_ACPI_INVALID_ARGUMENT"),
+ SMB_NTSTATUS_ACPI_FATAL => Some("STATUS_ACPI_FATAL"),
+ SMB_NTSTATUS_ACPI_INVALID_SUPERNAME => Some("STATUS_ACPI_INVALID_SUPERNAME"),
+ SMB_NTSTATUS_ACPI_INVALID_ARGTYPE => Some("STATUS_ACPI_INVALID_ARGTYPE"),
+ SMB_NTSTATUS_ACPI_INVALID_OBJTYPE => Some("STATUS_ACPI_INVALID_OBJTYPE"),
+ SMB_NTSTATUS_ACPI_INVALID_TARGETTYPE => Some("STATUS_ACPI_INVALID_TARGETTYPE"),
+ SMB_NTSTATUS_ACPI_INCORRECT_ARGUMENT_COUNT => Some("STATUS_ACPI_INCORRECT_ARGUMENT_COUNT"),
+ SMB_NTSTATUS_ACPI_ADDRESS_NOT_MAPPED => Some("STATUS_ACPI_ADDRESS_NOT_MAPPED"),
+ SMB_NTSTATUS_ACPI_INVALID_EVENTTYPE => Some("STATUS_ACPI_INVALID_EVENTTYPE"),
+ SMB_NTSTATUS_ACPI_HANDLER_COLLISION => Some("STATUS_ACPI_HANDLER_COLLISION"),
+ SMB_NTSTATUS_ACPI_INVALID_DATA => Some("STATUS_ACPI_INVALID_DATA"),
+ SMB_NTSTATUS_ACPI_INVALID_REGION => Some("STATUS_ACPI_INVALID_REGION"),
+ SMB_NTSTATUS_ACPI_INVALID_ACCESS_SIZE => Some("STATUS_ACPI_INVALID_ACCESS_SIZE"),
+ SMB_NTSTATUS_ACPI_ACQUIRE_GLOBAL_LOCK => Some("STATUS_ACPI_ACQUIRE_GLOBAL_LOCK"),
+ SMB_NTSTATUS_ACPI_ALREADY_INITIALIZED => Some("STATUS_ACPI_ALREADY_INITIALIZED"),
+ SMB_NTSTATUS_ACPI_NOT_INITIALIZED => Some("STATUS_ACPI_NOT_INITIALIZED"),
+ SMB_NTSTATUS_ACPI_INVALID_MUTEX_LEVEL => Some("STATUS_ACPI_INVALID_MUTEX_LEVEL"),
+ SMB_NTSTATUS_ACPI_MUTEX_NOT_OWNED => Some("STATUS_ACPI_MUTEX_NOT_OWNED"),
+ SMB_NTSTATUS_ACPI_MUTEX_NOT_OWNER => Some("STATUS_ACPI_MUTEX_NOT_OWNER"),
+ SMB_NTSTATUS_ACPI_RS_ACCESS => Some("STATUS_ACPI_RS_ACCESS"),
+ SMB_NTSTATUS_ACPI_INVALID_TABLE => Some("STATUS_ACPI_INVALID_TABLE"),
+ SMB_NTSTATUS_ACPI_REG_HANDLER_FAILED => Some("STATUS_ACPI_REG_HANDLER_FAILED"),
+ SMB_NTSTATUS_ACPI_POWER_REQUEST_FAILED => Some("STATUS_ACPI_POWER_REQUEST_FAILED"),
+ SMB_NTSTATUS_SXS_SECTION_NOT_FOUND => Some("STATUS_SXS_SECTION_NOT_FOUND"),
+ SMB_NTSTATUS_SXS_CANT_GEN_ACTCTX => Some("STATUS_SXS_CANT_GEN_ACTCTX"),
+ SMB_NTSTATUS_SXS_INVALID_ACTCTXDATA_FORMAT => Some("STATUS_SXS_INVALID_ACTCTXDATA_FORMAT"),
+ SMB_NTSTATUS_SXS_ASSEMBLY_NOT_FOUND => Some("STATUS_SXS_ASSEMBLY_NOT_FOUND"),
+ SMB_NTSTATUS_SXS_MANIFEST_FORMAT_ERROR => Some("STATUS_SXS_MANIFEST_FORMAT_ERROR"),
+ SMB_NTSTATUS_SXS_MANIFEST_PARSE_ERROR => Some("STATUS_SXS_MANIFEST_PARSE_ERROR"),
+ SMB_NTSTATUS_SXS_ACTIVATION_CONTEXT_DISABLED => Some("STATUS_SXS_ACTIVATION_CONTEXT_DISABLED"),
+ SMB_NTSTATUS_SXS_KEY_NOT_FOUND => Some("STATUS_SXS_KEY_NOT_FOUND"),
+ SMB_NTSTATUS_SXS_VERSION_CONFLICT => Some("STATUS_SXS_VERSION_CONFLICT"),
+ SMB_NTSTATUS_SXS_WRONG_SECTION_TYPE => Some("STATUS_SXS_WRONG_SECTION_TYPE"),
+ SMB_NTSTATUS_SXS_THREAD_QUERIES_DISABLED => Some("STATUS_SXS_THREAD_QUERIES_DISABLED"),
+ SMB_NTSTATUS_SXS_ASSEMBLY_MISSING => Some("STATUS_SXS_ASSEMBLY_MISSING"),
+ SMB_NTSTATUS_SXS_PROCESS_DEFAULT_ALREADY_SET => Some("STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET"),
+ SMB_NTSTATUS_SXS_EARLY_DEACTIVATION => Some("STATUS_SXS_EARLY_DEACTIVATION"),
+ SMB_NTSTATUS_SXS_INVALID_DEACTIVATION => Some("STATUS_SXS_INVALID_DEACTIVATION"),
+ SMB_NTSTATUS_SXS_MULTIPLE_DEACTIVATION => Some("STATUS_SXS_MULTIPLE_DEACTIVATION"),
+ SMB_NTSTATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY => Some("STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY"),
+ SMB_NTSTATUS_SXS_PROCESS_TERMINATION_REQUESTED => Some("STATUS_SXS_PROCESS_TERMINATION_REQUESTED"),
+ SMB_NTSTATUS_SXS_CORRUPT_ACTIVATION_STACK => Some("STATUS_SXS_CORRUPT_ACTIVATION_STACK"),
+ SMB_NTSTATUS_SXS_CORRUPTION => Some("STATUS_SXS_CORRUPTION"),
+ SMB_NTSTATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE => Some("STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE"),
+ SMB_NTSTATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME => Some("STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME"),
+ SMB_NTSTATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE => Some("STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE"),
+ SMB_NTSTATUS_SXS_IDENTITY_PARSE_ERROR => Some("STATUS_SXS_IDENTITY_PARSE_ERROR"),
+ SMB_NTSTATUS_SXS_COMPONENT_STORE_CORRUPT => Some("STATUS_SXS_COMPONENT_STORE_CORRUPT"),
+ SMB_NTSTATUS_SXS_FILE_HASH_MISMATCH => Some("STATUS_SXS_FILE_HASH_MISMATCH"),
+ SMB_NTSTATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT => Some("STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT"),
+ SMB_NTSTATUS_SXS_IDENTITIES_DIFFERENT => Some("STATUS_SXS_IDENTITIES_DIFFERENT"),
+ SMB_NTSTATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT => Some("STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT"),
+ SMB_NTSTATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY => Some("STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY"),
+ SMB_NTSTATUS_ADVANCED_INSTALLER_FAILED => Some("STATUS_ADVANCED_INSTALLER_FAILED"),
+ SMB_NTSTATUS_XML_ENCODING_MISMATCH => Some("STATUS_XML_ENCODING_MISMATCH"),
+ SMB_NTSTATUS_SXS_MANIFEST_TOO_BIG => Some("STATUS_SXS_MANIFEST_TOO_BIG"),
+ SMB_NTSTATUS_SXS_SETTING_NOT_REGISTERED => Some("STATUS_SXS_SETTING_NOT_REGISTERED"),
+ SMB_NTSTATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE => Some("STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE"),
+ SMB_NTSTATUS_SMI_PRIMITIVE_INSTALLER_FAILED => Some("STATUS_SMI_PRIMITIVE_INSTALLER_FAILED"),
+ SMB_NTSTATUS_GENERIC_COMMAND_FAILED => Some("STATUS_GENERIC_COMMAND_FAILED"),
+ SMB_NTSTATUS_SXS_FILE_HASH_MISSING => Some("STATUS_SXS_FILE_HASH_MISSING"),
+ SMB_NTSTATUS_TRANSACTIONAL_CONFLICT => Some("STATUS_TRANSACTIONAL_CONFLICT"),
+ SMB_NTSTATUS_INVALID_TRANSACTION => Some("STATUS_INVALID_TRANSACTION"),
+ SMB_NTSTATUS_TRANSACTION_NOT_ACTIVE => Some("STATUS_TRANSACTION_NOT_ACTIVE"),
+ SMB_NTSTATUS_TM_INITIALIZATION_FAILED => Some("STATUS_TM_INITIALIZATION_FAILED"),
+ SMB_NTSTATUS_RM_NOT_ACTIVE => Some("STATUS_RM_NOT_ACTIVE"),
+ SMB_NTSTATUS_RM_METADATA_CORRUPT => Some("STATUS_RM_METADATA_CORRUPT"),
+ SMB_NTSTATUS_TRANSACTION_NOT_JOINED => Some("STATUS_TRANSACTION_NOT_JOINED"),
+ SMB_NTSTATUS_DIRECTORY_NOT_RM => Some("STATUS_DIRECTORY_NOT_RM"),
+ SMB_NTSTATUS_TRANSACTIONS_UNSUPPORTED_REMOTE => Some("STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE"),
+ SMB_NTSTATUS_LOG_RESIZE_INVALID_SIZE => Some("STATUS_LOG_RESIZE_INVALID_SIZE"),
+ SMB_NTSTATUS_REMOTE_FILE_VERSION_MISMATCH => Some("STATUS_REMOTE_FILE_VERSION_MISMATCH"),
+ SMB_NTSTATUS_CRM_PROTOCOL_ALREADY_EXISTS => Some("STATUS_CRM_PROTOCOL_ALREADY_EXISTS"),
+ SMB_NTSTATUS_TRANSACTION_PROPAGATION_FAILED => Some("STATUS_TRANSACTION_PROPAGATION_FAILED"),
+ SMB_NTSTATUS_CRM_PROTOCOL_NOT_FOUND => Some("STATUS_CRM_PROTOCOL_NOT_FOUND"),
+ SMB_NTSTATUS_TRANSACTION_SUPERIOR_EXISTS => Some("STATUS_TRANSACTION_SUPERIOR_EXISTS"),
+ SMB_NTSTATUS_TRANSACTION_REQUEST_NOT_VALID => Some("STATUS_TRANSACTION_REQUEST_NOT_VALID"),
+ SMB_NTSTATUS_TRANSACTION_NOT_REQUESTED => Some("STATUS_TRANSACTION_NOT_REQUESTED"),
+ SMB_NTSTATUS_TRANSACTION_ALREADY_ABORTED => Some("STATUS_TRANSACTION_ALREADY_ABORTED"),
+ SMB_NTSTATUS_TRANSACTION_ALREADY_COMMITTED => Some("STATUS_TRANSACTION_ALREADY_COMMITTED"),
+ SMB_NTSTATUS_TRANSACTION_INVALID_MARSHALL_BUFFER => Some("STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER"),
+ SMB_NTSTATUS_CURRENT_TRANSACTION_NOT_VALID => Some("STATUS_CURRENT_TRANSACTION_NOT_VALID"),
+ SMB_NTSTATUS_LOG_GROWTH_FAILED => Some("STATUS_LOG_GROWTH_FAILED"),
+ SMB_NTSTATUS_OBJECT_NO_LONGER_EXISTS => Some("STATUS_OBJECT_NO_LONGER_EXISTS"),
+ SMB_NTSTATUS_STREAM_MINIVERSION_NOT_FOUND => Some("STATUS_STREAM_MINIVERSION_NOT_FOUND"),
+ SMB_NTSTATUS_STREAM_MINIVERSION_NOT_VALID => Some("STATUS_STREAM_MINIVERSION_NOT_VALID"),
+ SMB_NTSTATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION => Some("STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION"),
+ SMB_NTSTATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT => Some("STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT"),
+ SMB_NTSTATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS => Some("STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS"),
+ SMB_NTSTATUS_HANDLE_NO_LONGER_VALID => Some("STATUS_HANDLE_NO_LONGER_VALID"),
+ SMB_NTSTATUS_LOG_CORRUPTION_DETECTED => Some("STATUS_LOG_CORRUPTION_DETECTED"),
+ SMB_NTSTATUS_RM_DISCONNECTED => Some("STATUS_RM_DISCONNECTED"),
+ SMB_NTSTATUS_ENLISTMENT_NOT_SUPERIOR => Some("STATUS_ENLISTMENT_NOT_SUPERIOR"),
+ SMB_NTSTATUS_FILE_IDENTITY_NOT_PERSISTENT => Some("STATUS_FILE_IDENTITY_NOT_PERSISTENT"),
+ SMB_NTSTATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY => Some("STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY"),
+ SMB_NTSTATUS_CANT_CROSS_RM_BOUNDARY => Some("STATUS_CANT_CROSS_RM_BOUNDARY"),
+ SMB_NTSTATUS_TXF_DIR_NOT_EMPTY => Some("STATUS_TXF_DIR_NOT_EMPTY"),
+ SMB_NTSTATUS_INDOUBT_TRANSACTIONS_EXIST => Some("STATUS_INDOUBT_TRANSACTIONS_EXIST"),
+ SMB_NTSTATUS_TM_VOLATILE => Some("STATUS_TM_VOLATILE"),
+ SMB_NTSTATUS_ROLLBACK_TIMER_EXPIRED => Some("STATUS_ROLLBACK_TIMER_EXPIRED"),
+ SMB_NTSTATUS_TXF_ATTRIBUTE_CORRUPT => Some("STATUS_TXF_ATTRIBUTE_CORRUPT"),
+ SMB_NTSTATUS_EFS_NOT_ALLOWED_IN_TRANSACTION => Some("STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION"),
+ SMB_NTSTATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED => Some("STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED"),
+ SMB_NTSTATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE => Some("STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE"),
+ SMB_NTSTATUS_TRANSACTION_REQUIRED_PROMOTION => Some("STATUS_TRANSACTION_REQUIRED_PROMOTION"),
+ SMB_NTSTATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION => Some("STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION"),
+ SMB_NTSTATUS_TRANSACTIONS_NOT_FROZEN => Some("STATUS_TRANSACTIONS_NOT_FROZEN"),
+ SMB_NTSTATUS_TRANSACTION_FREEZE_IN_PROGRESS => Some("STATUS_TRANSACTION_FREEZE_IN_PROGRESS"),
+ SMB_NTSTATUS_NOT_SNAPSHOT_VOLUME => Some("STATUS_NOT_SNAPSHOT_VOLUME"),
+ SMB_NTSTATUS_NO_SAVEPOINT_WITH_OPEN_FILES => Some("STATUS_NO_SAVEPOINT_WITH_OPEN_FILES"),
+ SMB_NTSTATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION => Some("STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION"),
+ SMB_NTSTATUS_TM_IDENTITY_MISMATCH => Some("STATUS_TM_IDENTITY_MISMATCH"),
+ SMB_NTSTATUS_FLOATED_SECTION => Some("STATUS_FLOATED_SECTION"),
+ SMB_NTSTATUS_CANNOT_ACCEPT_TRANSACTED_WORK => Some("STATUS_CANNOT_ACCEPT_TRANSACTED_WORK"),
+ SMB_NTSTATUS_CANNOT_ABORT_TRANSACTIONS => Some("STATUS_CANNOT_ABORT_TRANSACTIONS"),
+ SMB_NTSTATUS_TRANSACTION_NOT_FOUND => Some("STATUS_TRANSACTION_NOT_FOUND"),
+ SMB_NTSTATUS_RESOURCEMANAGER_NOT_FOUND => Some("STATUS_RESOURCEMANAGER_NOT_FOUND"),
+ SMB_NTSTATUS_ENLISTMENT_NOT_FOUND => Some("STATUS_ENLISTMENT_NOT_FOUND"),
+ SMB_NTSTATUS_TRANSACTIONMANAGER_NOT_FOUND => Some("STATUS_TRANSACTIONMANAGER_NOT_FOUND"),
+ SMB_NTSTATUS_TRANSACTIONMANAGER_NOT_ONLINE => Some("STATUS_TRANSACTIONMANAGER_NOT_ONLINE"),
+ SMB_NTSTATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION => Some("STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION"),
+ SMB_NTSTATUS_TRANSACTION_NOT_ROOT => Some("STATUS_TRANSACTION_NOT_ROOT"),
+ SMB_NTSTATUS_TRANSACTION_OBJECT_EXPIRED => Some("STATUS_TRANSACTION_OBJECT_EXPIRED"),
+ SMB_NTSTATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION => Some("STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION"),
+ SMB_NTSTATUS_TRANSACTION_RESPONSE_NOT_ENLISTED => Some("STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED"),
+ SMB_NTSTATUS_TRANSACTION_RECORD_TOO_LONG => Some("STATUS_TRANSACTION_RECORD_TOO_LONG"),
+ SMB_NTSTATUS_NO_LINK_TRACKING_IN_TRANSACTION => Some("STATUS_NO_LINK_TRACKING_IN_TRANSACTION"),
+ SMB_NTSTATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION => Some("STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION"),
+ SMB_NTSTATUS_TRANSACTION_INTEGRITY_VIOLATED => Some("STATUS_TRANSACTION_INTEGRITY_VIOLATED"),
+ SMB_NTSTATUS_EXPIRED_HANDLE => Some("STATUS_EXPIRED_HANDLE"),
+ SMB_NTSTATUS_TRANSACTION_NOT_ENLISTED => Some("STATUS_TRANSACTION_NOT_ENLISTED"),
+ SMB_NTSTATUS_LOG_SECTOR_INVALID => Some("STATUS_LOG_SECTOR_INVALID"),
+ SMB_NTSTATUS_LOG_SECTOR_PARITY_INVALID => Some("STATUS_LOG_SECTOR_PARITY_INVALID"),
+ SMB_NTSTATUS_LOG_SECTOR_REMAPPED => Some("STATUS_LOG_SECTOR_REMAPPED"),
+ SMB_NTSTATUS_LOG_BLOCK_INCOMPLETE => Some("STATUS_LOG_BLOCK_INCOMPLETE"),
+ SMB_NTSTATUS_LOG_INVALID_RANGE => Some("STATUS_LOG_INVALID_RANGE"),
+ SMB_NTSTATUS_LOG_BLOCKS_EXHAUSTED => Some("STATUS_LOG_BLOCKS_EXHAUSTED"),
+ SMB_NTSTATUS_LOG_READ_CONTEXT_INVALID => Some("STATUS_LOG_READ_CONTEXT_INVALID"),
+ SMB_NTSTATUS_LOG_RESTART_INVALID => Some("STATUS_LOG_RESTART_INVALID"),
+ SMB_NTSTATUS_LOG_BLOCK_VERSION => Some("STATUS_LOG_BLOCK_VERSION"),
+ SMB_NTSTATUS_LOG_BLOCK_INVALID => Some("STATUS_LOG_BLOCK_INVALID"),
+ SMB_NTSTATUS_LOG_READ_MODE_INVALID => Some("STATUS_LOG_READ_MODE_INVALID"),
+ SMB_NTSTATUS_LOG_METADATA_CORRUPT => Some("STATUS_LOG_METADATA_CORRUPT"),
+ SMB_NTSTATUS_LOG_METADATA_INVALID => Some("STATUS_LOG_METADATA_INVALID"),
+ SMB_NTSTATUS_LOG_METADATA_INCONSISTENT => Some("STATUS_LOG_METADATA_INCONSISTENT"),
+ SMB_NTSTATUS_LOG_RESERVATION_INVALID => Some("STATUS_LOG_RESERVATION_INVALID"),
+ SMB_NTSTATUS_LOG_CANT_DELETE => Some("STATUS_LOG_CANT_DELETE"),
+ SMB_NTSTATUS_LOG_CONTAINER_LIMIT_EXCEEDED => Some("STATUS_LOG_CONTAINER_LIMIT_EXCEEDED"),
+ SMB_NTSTATUS_LOG_START_OF_LOG => Some("STATUS_LOG_START_OF_LOG"),
+ SMB_NTSTATUS_LOG_POLICY_ALREADY_INSTALLED => Some("STATUS_LOG_POLICY_ALREADY_INSTALLED"),
+ SMB_NTSTATUS_LOG_POLICY_NOT_INSTALLED => Some("STATUS_LOG_POLICY_NOT_INSTALLED"),
+ SMB_NTSTATUS_LOG_POLICY_INVALID => Some("STATUS_LOG_POLICY_INVALID"),
+ SMB_NTSTATUS_LOG_POLICY_CONFLICT => Some("STATUS_LOG_POLICY_CONFLICT"),
+ SMB_NTSTATUS_LOG_PINNED_ARCHIVE_TAIL => Some("STATUS_LOG_PINNED_ARCHIVE_TAIL"),
+ SMB_NTSTATUS_LOG_RECORD_NONEXISTENT => Some("STATUS_LOG_RECORD_NONEXISTENT"),
+ SMB_NTSTATUS_LOG_RECORDS_RESERVED_INVALID => Some("STATUS_LOG_RECORDS_RESERVED_INVALID"),
+ SMB_NTSTATUS_LOG_SPACE_RESERVED_INVALID => Some("STATUS_LOG_SPACE_RESERVED_INVALID"),
+ SMB_NTSTATUS_LOG_TAIL_INVALID => Some("STATUS_LOG_TAIL_INVALID"),
+ SMB_NTSTATUS_LOG_FULL => Some("STATUS_LOG_FULL"),
+ SMB_NTSTATUS_LOG_MULTIPLEXED => Some("STATUS_LOG_MULTIPLEXED"),
+ SMB_NTSTATUS_LOG_DEDICATED => Some("STATUS_LOG_DEDICATED"),
+ SMB_NTSTATUS_LOG_ARCHIVE_NOT_IN_PROGRESS => Some("STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS"),
+ SMB_NTSTATUS_LOG_ARCHIVE_IN_PROGRESS => Some("STATUS_LOG_ARCHIVE_IN_PROGRESS"),
+ SMB_NTSTATUS_LOG_EPHEMERAL => Some("STATUS_LOG_EPHEMERAL"),
+ SMB_NTSTATUS_LOG_NOT_ENOUGH_CONTAINERS => Some("STATUS_LOG_NOT_ENOUGH_CONTAINERS"),
+ SMB_NTSTATUS_LOG_CLIENT_ALREADY_REGISTERED => Some("STATUS_LOG_CLIENT_ALREADY_REGISTERED"),
+ SMB_NTSTATUS_LOG_CLIENT_NOT_REGISTERED => Some("STATUS_LOG_CLIENT_NOT_REGISTERED"),
+ SMB_NTSTATUS_LOG_FULL_HANDLER_IN_PROGRESS => Some("STATUS_LOG_FULL_HANDLER_IN_PROGRESS"),
+ SMB_NTSTATUS_LOG_CONTAINER_READ_FAILED => Some("STATUS_LOG_CONTAINER_READ_FAILED"),
+ SMB_NTSTATUS_LOG_CONTAINER_WRITE_FAILED => Some("STATUS_LOG_CONTAINER_WRITE_FAILED"),
+ SMB_NTSTATUS_LOG_CONTAINER_OPEN_FAILED => Some("STATUS_LOG_CONTAINER_OPEN_FAILED"),
+ SMB_NTSTATUS_LOG_CONTAINER_STATE_INVALID => Some("STATUS_LOG_CONTAINER_STATE_INVALID"),
+ SMB_NTSTATUS_LOG_STATE_INVALID => Some("STATUS_LOG_STATE_INVALID"),
+ SMB_NTSTATUS_LOG_PINNED => Some("STATUS_LOG_PINNED"),
+ SMB_NTSTATUS_LOG_METADATA_FLUSH_FAILED => Some("STATUS_LOG_METADATA_FLUSH_FAILED"),
+ SMB_NTSTATUS_LOG_INCONSISTENT_SECURITY => Some("STATUS_LOG_INCONSISTENT_SECURITY"),
+ SMB_NTSTATUS_LOG_APPENDED_FLUSH_FAILED => Some("STATUS_LOG_APPENDED_FLUSH_FAILED"),
+ SMB_NTSTATUS_LOG_PINNED_RESERVATION => Some("STATUS_LOG_PINNED_RESERVATION"),
+ SMB_NTSTATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD => Some("STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD"),
+ SMB_NTSTATUS_FLT_NO_HANDLER_DEFINED => Some("STATUS_FLT_NO_HANDLER_DEFINED"),
+ SMB_NTSTATUS_FLT_CONTEXT_ALREADY_DEFINED => Some("STATUS_FLT_CONTEXT_ALREADY_DEFINED"),
+ SMB_NTSTATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST => Some("STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST"),
+ SMB_NTSTATUS_FLT_DISALLOW_FAST_IO => Some("STATUS_FLT_DISALLOW_FAST_IO"),
+ SMB_NTSTATUS_FLT_INVALID_NAME_REQUEST => Some("STATUS_FLT_INVALID_NAME_REQUEST"),
+ SMB_NTSTATUS_FLT_NOT_SAFE_TO_POST_OPERATION => Some("STATUS_FLT_NOT_SAFE_TO_POST_OPERATION"),
+ SMB_NTSTATUS_FLT_NOT_INITIALIZED => Some("STATUS_FLT_NOT_INITIALIZED"),
+ SMB_NTSTATUS_FLT_FILTER_NOT_READY => Some("STATUS_FLT_FILTER_NOT_READY"),
+ SMB_NTSTATUS_FLT_POST_OPERATION_CLEANUP => Some("STATUS_FLT_POST_OPERATION_CLEANUP"),
+ SMB_NTSTATUS_FLT_INTERNAL_ERROR => Some("STATUS_FLT_INTERNAL_ERROR"),
+ SMB_NTSTATUS_FLT_DELETING_OBJECT => Some("STATUS_FLT_DELETING_OBJECT"),
+ SMB_NTSTATUS_FLT_MUST_BE_NONPAGED_POOL => Some("STATUS_FLT_MUST_BE_NONPAGED_POOL"),
+ SMB_NTSTATUS_FLT_DUPLICATE_ENTRY => Some("STATUS_FLT_DUPLICATE_ENTRY"),
+ SMB_NTSTATUS_FLT_CBDQ_DISABLED => Some("STATUS_FLT_CBDQ_DISABLED"),
+ SMB_NTSTATUS_FLT_DO_NOT_ATTACH => Some("STATUS_FLT_DO_NOT_ATTACH"),
+ SMB_NTSTATUS_FLT_DO_NOT_DETACH => Some("STATUS_FLT_DO_NOT_DETACH"),
+ SMB_NTSTATUS_FLT_INSTANCE_ALTITUDE_COLLISION => Some("STATUS_FLT_INSTANCE_ALTITUDE_COLLISION"),
+ SMB_NTSTATUS_FLT_INSTANCE_NAME_COLLISION => Some("STATUS_FLT_INSTANCE_NAME_COLLISION"),
+ SMB_NTSTATUS_FLT_FILTER_NOT_FOUND => Some("STATUS_FLT_FILTER_NOT_FOUND"),
+ SMB_NTSTATUS_FLT_VOLUME_NOT_FOUND => Some("STATUS_FLT_VOLUME_NOT_FOUND"),
+ SMB_NTSTATUS_FLT_INSTANCE_NOT_FOUND => Some("STATUS_FLT_INSTANCE_NOT_FOUND"),
+ SMB_NTSTATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND => Some("STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND"),
+ SMB_NTSTATUS_FLT_INVALID_CONTEXT_REGISTRATION => Some("STATUS_FLT_INVALID_CONTEXT_REGISTRATION"),
+ SMB_NTSTATUS_FLT_NAME_CACHE_MISS => Some("STATUS_FLT_NAME_CACHE_MISS"),
+ SMB_NTSTATUS_FLT_NO_DEVICE_OBJECT => Some("STATUS_FLT_NO_DEVICE_OBJECT"),
+ SMB_NTSTATUS_FLT_VOLUME_ALREADY_MOUNTED => Some("STATUS_FLT_VOLUME_ALREADY_MOUNTED"),
+ SMB_NTSTATUS_FLT_ALREADY_ENLISTED => Some("STATUS_FLT_ALREADY_ENLISTED"),
+ SMB_NTSTATUS_FLT_CONTEXT_ALREADY_LINKED => Some("STATUS_FLT_CONTEXT_ALREADY_LINKED"),
+ SMB_NTSTATUS_FLT_NO_WAITER_FOR_REPLY => Some("STATUS_FLT_NO_WAITER_FOR_REPLY"),
+ SMB_NTSTATUS_MONITOR_NO_DESCRIPTOR => Some("STATUS_MONITOR_NO_DESCRIPTOR"),
+ SMB_NTSTATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT => Some("STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT"),
+ SMB_NTSTATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM => Some("STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM"),
+ SMB_NTSTATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK => Some("STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK"),
+ SMB_NTSTATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED => Some("STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED"),
+ SMB_NTSTATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK => Some("STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK"),
+ SMB_NTSTATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK => Some("STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK"),
+ SMB_NTSTATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA => Some("STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA"),
+ SMB_NTSTATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK => Some("STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK"),
+ SMB_NTSTATUS_MONITOR_INVALID_MANUFACTURE_DATE => Some("STATUS_MONITOR_INVALID_MANUFACTURE_DATE"),
+ SMB_NTSTATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER => Some("STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER"),
+ SMB_NTSTATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER => Some("STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER => Some("STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER"),
+ SMB_NTSTATUS_GRAPHICS_ADAPTER_WAS_RESET => Some("STATUS_GRAPHICS_ADAPTER_WAS_RESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_DRIVER_MODEL => Some("STATUS_GRAPHICS_INVALID_DRIVER_MODEL"),
+ SMB_NTSTATUS_GRAPHICS_PRESENT_MODE_CHANGED => Some("STATUS_GRAPHICS_PRESENT_MODE_CHANGED"),
+ SMB_NTSTATUS_GRAPHICS_PRESENT_OCCLUDED => Some("STATUS_GRAPHICS_PRESENT_OCCLUDED"),
+ SMB_NTSTATUS_GRAPHICS_PRESENT_DENIED => Some("STATUS_GRAPHICS_PRESENT_DENIED"),
+ SMB_NTSTATUS_GRAPHICS_CANNOTCOLORCONVERT => Some("STATUS_GRAPHICS_CANNOTCOLORCONVERT"),
+ SMB_NTSTATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED => Some("STATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED"),
+ SMB_NTSTATUS_GRAPHICS_PRESENT_UNOCCLUDED => Some("STATUS_GRAPHICS_PRESENT_UNOCCLUDED"),
+ SMB_NTSTATUS_GRAPHICS_NO_VIDEO_MEMORY => Some("STATUS_GRAPHICS_NO_VIDEO_MEMORY"),
+ SMB_NTSTATUS_GRAPHICS_CANT_LOCK_MEMORY => Some("STATUS_GRAPHICS_CANT_LOCK_MEMORY"),
+ SMB_NTSTATUS_GRAPHICS_ALLOCATION_BUSY => Some("STATUS_GRAPHICS_ALLOCATION_BUSY"),
+ SMB_NTSTATUS_GRAPHICS_TOO_MANY_REFERENCES => Some("STATUS_GRAPHICS_TOO_MANY_REFERENCES"),
+ SMB_NTSTATUS_GRAPHICS_TRY_AGAIN_LATER => Some("STATUS_GRAPHICS_TRY_AGAIN_LATER"),
+ SMB_NTSTATUS_GRAPHICS_TRY_AGAIN_NOW => Some("STATUS_GRAPHICS_TRY_AGAIN_NOW"),
+ SMB_NTSTATUS_GRAPHICS_ALLOCATION_INVALID => Some("STATUS_GRAPHICS_ALLOCATION_INVALID"),
+ SMB_NTSTATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE => Some("STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE"),
+ SMB_NTSTATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED => Some("STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION => Some("STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_ALLOCATION_USAGE => Some("STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE"),
+ SMB_NTSTATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION => Some("STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION"),
+ SMB_NTSTATUS_GRAPHICS_ALLOCATION_CLOSED => Some("STATUS_GRAPHICS_ALLOCATION_CLOSED"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE => Some("STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE => Some("STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE"),
+ SMB_NTSTATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE => Some("STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE"),
+ SMB_NTSTATUS_GRAPHICS_ALLOCATION_CONTENT_LOST => Some("STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST"),
+ SMB_NTSTATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE => Some("STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY => Some("STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED => Some("STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED => Some("STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN => Some("STATUS_GRAPHICS_INVALID_VIDPN"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE => Some("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET => Some("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET"),
+ SMB_NTSTATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED => Some("STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET => Some("STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET => Some("STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_FREQUENCY => Some("STATUS_GRAPHICS_INVALID_FREQUENCY"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_ACTIVE_REGION => Some("STATUS_GRAPHICS_INVALID_ACTIVE_REGION"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_TOTAL_REGION => Some("STATUS_GRAPHICS_INVALID_TOTAL_REGION"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE => Some("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE => Some("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE"),
+ SMB_NTSTATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET => Some("STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY => Some("STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_MODE_ALREADY_IN_MODESET => Some("STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET => Some("STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET => Some("STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET"),
+ SMB_NTSTATUS_GRAPHICS_SOURCE_ALREADY_IN_SET => Some("STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_TARGET_ALREADY_IN_SET => Some("STATUS_GRAPHICS_TARGET_ALREADY_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH => Some("STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH"),
+ SMB_NTSTATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY => Some("STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET => Some("STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE => Some("STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE"),
+ SMB_NTSTATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET => Some("STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET => Some("STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_STALE_MODESET => Some("STATUS_GRAPHICS_STALE_MODESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET => Some("STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE => Some("STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE"),
+ SMB_NTSTATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN => Some("STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN"),
+ SMB_NTSTATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE => Some("STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE"),
+ SMB_NTSTATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION => Some("STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION"),
+ SMB_NTSTATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES => Some("STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES"),
+ SMB_NTSTATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY => Some("STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE => Some("STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE"),
+ SMB_NTSTATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET => Some("STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET => Some("STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR => Some("STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR"),
+ SMB_NTSTATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET => Some("STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET => Some("STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET"),
+ SMB_NTSTATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE => Some("STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE => Some("STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE"),
+ SMB_NTSTATUS_GRAPHICS_RESOURCES_NOT_RELATED => Some("STATUS_GRAPHICS_RESOURCES_NOT_RELATED"),
+ SMB_NTSTATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE => Some("STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE"),
+ SMB_NTSTATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE => Some("STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE"),
+ SMB_NTSTATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET => Some("STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET"),
+ SMB_NTSTATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER => Some("STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER"),
+ SMB_NTSTATUS_GRAPHICS_NO_VIDPNMGR => Some("STATUS_GRAPHICS_NO_VIDPNMGR"),
+ SMB_NTSTATUS_GRAPHICS_NO_ACTIVE_VIDPN => Some("STATUS_GRAPHICS_NO_ACTIVE_VIDPN"),
+ SMB_NTSTATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY => Some("STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_MONITOR_NOT_CONNECTED => Some("STATUS_GRAPHICS_MONITOR_NOT_CONNECTED"),
+ SMB_NTSTATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY => Some("STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE => Some("STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE => Some("STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_STRIDE => Some("STATUS_GRAPHICS_INVALID_STRIDE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PIXELFORMAT => Some("STATUS_GRAPHICS_INVALID_PIXELFORMAT"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_COLORBASIS => Some("STATUS_GRAPHICS_INVALID_COLORBASIS"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE => Some("STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE"),
+ SMB_NTSTATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY => Some("STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY"),
+ SMB_NTSTATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT => Some("STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT"),
+ SMB_NTSTATUS_GRAPHICS_VIDPN_SOURCE_IN_USE => Some("STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE"),
+ SMB_NTSTATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN => Some("STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL => Some("STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION => Some("STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION"),
+ SMB_NTSTATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED => Some("STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_GAMMA_RAMP => Some("STATUS_GRAPHICS_INVALID_GAMMA_RAMP"),
+ SMB_NTSTATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED => Some("STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED => Some("STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_MODE_NOT_IN_MODESET => Some("STATUS_GRAPHICS_MODE_NOT_IN_MODESET"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON => Some("STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE => Some("STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE => Some("STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE"),
+ SMB_NTSTATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS => Some("STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_SCANLINE_ORDERING => Some("STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING"),
+ SMB_NTSTATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED => Some("STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED"),
+ SMB_NTSTATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS => Some("STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS"),
+ SMB_NTSTATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT => Some("STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM => Some("STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN => Some("STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT => Some("STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT"),
+ SMB_NTSTATUS_GRAPHICS_MAX_NUM_PATHS_REACHED => Some("STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED"),
+ SMB_NTSTATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION => Some("STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_CLIENT_TYPE => Some("STATUS_GRAPHICS_INVALID_CLIENT_TYPE"),
+ SMB_NTSTATUS_GRAPHICS_CLIENTVIDPN_NOT_SET => Some("STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET"),
+ SMB_NTSTATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED => Some("STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED"),
+ SMB_NTSTATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED => Some("STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_NOT_A_LINKED_ADAPTER => Some("STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER"),
+ SMB_NTSTATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED => Some("STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED"),
+ SMB_NTSTATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED => Some("STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED"),
+ SMB_NTSTATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY => Some("STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY"),
+ SMB_NTSTATUS_GRAPHICS_CHAINLINKS_NOT_STARTED => Some("STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED"),
+ SMB_NTSTATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON => Some("STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON"),
+ SMB_NTSTATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE => Some("STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE"),
+ SMB_NTSTATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER => Some("STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER"),
+ SMB_NTSTATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED => Some("STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED"),
+ SMB_NTSTATUS_GRAPHICS_OPM_NOT_SUPPORTED => Some("STATUS_GRAPHICS_OPM_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_COPP_NOT_SUPPORTED => Some("STATUS_GRAPHICS_COPP_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_UAB_NOT_SUPPORTED => Some("STATUS_GRAPHICS_UAB_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS => Some("STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS"),
+ SMB_NTSTATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL => Some("STATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL"),
+ SMB_NTSTATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST => Some("STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST"),
+ SMB_NTSTATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME => Some("STATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME"),
+ SMB_NTSTATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP => Some("STATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP"),
+ SMB_NTSTATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED => Some("STATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INVALID_POINTER => Some("STATUS_GRAPHICS_OPM_INVALID_POINTER"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INTERNAL_ERROR => Some("STATUS_GRAPHICS_OPM_INTERNAL_ERROR"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INVALID_HANDLE => Some("STATUS_GRAPHICS_OPM_INVALID_HANDLE"),
+ SMB_NTSTATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE => Some("STATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE"),
+ SMB_NTSTATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH => Some("STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH"),
+ SMB_NTSTATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED => Some("STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED"),
+ SMB_NTSTATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED => Some("STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED"),
+ SMB_NTSTATUS_GRAPHICS_PVP_HFS_FAILED => Some("STATUS_GRAPHICS_PVP_HFS_FAILED"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INVALID_SRM => Some("STATUS_GRAPHICS_OPM_INVALID_SRM"),
+ SMB_NTSTATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP => Some("STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP"),
+ SMB_NTSTATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP => Some("STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP"),
+ SMB_NTSTATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA => Some("STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA"),
+ SMB_NTSTATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET => Some("STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET"),
+ SMB_NTSTATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH => Some("STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH"),
+ SMB_NTSTATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE => Some("STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE"),
+ SMB_NTSTATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS => Some("STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS"),
+ SMB_NTSTATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS => Some("STATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS"),
+ SMB_NTSTATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS => Some("STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST => Some("STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST"),
+ SMB_NTSTATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR => Some("STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR"),
+ SMB_NTSTATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS => Some("STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS"),
+ SMB_NTSTATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED => Some("STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST => Some("STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST"),
+ SMB_NTSTATUS_GRAPHICS_I2C_NOT_SUPPORTED => Some("STATUS_GRAPHICS_I2C_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST => Some("STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST"),
+ SMB_NTSTATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA => Some("STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA"),
+ SMB_NTSTATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA => Some("STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED => Some("STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_DATA => Some("STATUS_GRAPHICS_DDCCI_INVALID_DATA"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE => Some("STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING => Some("STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING"),
+ SMB_NTSTATUS_GRAPHICS_MCA_INTERNAL_ERROR => Some("STATUS_GRAPHICS_MCA_INTERNAL_ERROR"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND => Some("STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH => Some("STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH"),
+ SMB_NTSTATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM => Some("STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE => Some("STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE"),
+ SMB_NTSTATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS => Some("STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS"),
+ SMB_NTSTATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED => Some("STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME => Some("STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME"),
+ SMB_NTSTATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP => Some("STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP"),
+ SMB_NTSTATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED => Some("STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED"),
+ SMB_NTSTATUS_GRAPHICS_INVALID_POINTER => Some("STATUS_GRAPHICS_INVALID_POINTER"),
+ SMB_NTSTATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE => Some("STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE"),
+ SMB_NTSTATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL => Some("STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL"),
+ SMB_NTSTATUS_GRAPHICS_INTERNAL_ERROR => Some("STATUS_GRAPHICS_INTERNAL_ERROR"),
+ SMB_NTSTATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS => Some("STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS"),
+ SMB_NTSTATUS_FVE_LOCKED_VOLUME => Some("STATUS_FVE_LOCKED_VOLUME"),
+ SMB_NTSTATUS_FVE_NOT_ENCRYPTED => Some("STATUS_FVE_NOT_ENCRYPTED"),
+ SMB_NTSTATUS_FVE_BAD_INFORMATION => Some("STATUS_FVE_BAD_INFORMATION"),
+ SMB_NTSTATUS_FVE_TOO_SMALL => Some("STATUS_FVE_TOO_SMALL"),
+ SMB_NTSTATUS_FVE_FAILED_WRONG_FS => Some("STATUS_FVE_FAILED_WRONG_FS"),
+ SMB_NTSTATUS_FVE_FAILED_BAD_FS => Some("STATUS_FVE_FAILED_BAD_FS"),
+ SMB_NTSTATUS_FVE_FS_NOT_EXTENDED => Some("STATUS_FVE_FS_NOT_EXTENDED"),
+ SMB_NTSTATUS_FVE_FS_MOUNTED => Some("STATUS_FVE_FS_MOUNTED"),
+ SMB_NTSTATUS_FVE_NO_LICENSE => Some("STATUS_FVE_NO_LICENSE"),
+ SMB_NTSTATUS_FVE_ACTION_NOT_ALLOWED => Some("STATUS_FVE_ACTION_NOT_ALLOWED"),
+ SMB_NTSTATUS_FVE_BAD_DATA => Some("STATUS_FVE_BAD_DATA"),
+ SMB_NTSTATUS_FVE_VOLUME_NOT_BOUND => Some("STATUS_FVE_VOLUME_NOT_BOUND"),
+ SMB_NTSTATUS_FVE_NOT_DATA_VOLUME => Some("STATUS_FVE_NOT_DATA_VOLUME"),
+ SMB_NTSTATUS_FVE_CONV_READ_ERROR => Some("STATUS_FVE_CONV_READ_ERROR"),
+ SMB_NTSTATUS_FVE_CONV_WRITE_ERROR => Some("STATUS_FVE_CONV_WRITE_ERROR"),
+ SMB_NTSTATUS_FVE_OVERLAPPED_UPDATE => Some("STATUS_FVE_OVERLAPPED_UPDATE"),
+ SMB_NTSTATUS_FVE_FAILED_SECTOR_SIZE => Some("STATUS_FVE_FAILED_SECTOR_SIZE"),
+ SMB_NTSTATUS_FVE_FAILED_AUTHENTICATION => Some("STATUS_FVE_FAILED_AUTHENTICATION"),
+ SMB_NTSTATUS_FVE_NOT_OS_VOLUME => Some("STATUS_FVE_NOT_OS_VOLUME"),
+ SMB_NTSTATUS_FVE_KEYFILE_NOT_FOUND => Some("STATUS_FVE_KEYFILE_NOT_FOUND"),
+ SMB_NTSTATUS_FVE_KEYFILE_INVALID => Some("STATUS_FVE_KEYFILE_INVALID"),
+ SMB_NTSTATUS_FVE_KEYFILE_NO_VMK => Some("STATUS_FVE_KEYFILE_NO_VMK"),
+ SMB_NTSTATUS_FVE_TPM_DISABLED => Some("STATUS_FVE_TPM_DISABLED"),
+ SMB_NTSTATUS_FVE_TPM_SRK_AUTH_NOT_ZERO => Some("STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO"),
+ SMB_NTSTATUS_FVE_TPM_INVALID_PCR => Some("STATUS_FVE_TPM_INVALID_PCR"),
+ SMB_NTSTATUS_FVE_TPM_NO_VMK => Some("STATUS_FVE_TPM_NO_VMK"),
+ SMB_NTSTATUS_FVE_PIN_INVALID => Some("STATUS_FVE_PIN_INVALID"),
+ SMB_NTSTATUS_FVE_AUTH_INVALID_APPLICATION => Some("STATUS_FVE_AUTH_INVALID_APPLICATION"),
+ SMB_NTSTATUS_FVE_AUTH_INVALID_CONFIG => Some("STATUS_FVE_AUTH_INVALID_CONFIG"),
+ SMB_NTSTATUS_FVE_DEBUGGER_ENABLED => Some("STATUS_FVE_DEBUGGER_ENABLED"),
+ SMB_NTSTATUS_FVE_DRY_RUN_FAILED => Some("STATUS_FVE_DRY_RUN_FAILED"),
+ SMB_NTSTATUS_FVE_BAD_METADATA_POINTER => Some("STATUS_FVE_BAD_METADATA_POINTER"),
+ SMB_NTSTATUS_FVE_OLD_METADATA_COPY => Some("STATUS_FVE_OLD_METADATA_COPY"),
+ SMB_NTSTATUS_FVE_REBOOT_REQUIRED => Some("STATUS_FVE_REBOOT_REQUIRED"),
+ SMB_NTSTATUS_FVE_RAW_ACCESS => Some("STATUS_FVE_RAW_ACCESS"),
+ SMB_NTSTATUS_FVE_RAW_BLOCKED => Some("STATUS_FVE_RAW_BLOCKED"),
+ SMB_NTSTATUS_FVE_NO_FEATURE_LICENSE => Some("STATUS_FVE_NO_FEATURE_LICENSE"),
+ SMB_NTSTATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED => Some("STATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED"),
+ SMB_NTSTATUS_FVE_CONV_RECOVERY_FAILED => Some("STATUS_FVE_CONV_RECOVERY_FAILED"),
+ SMB_NTSTATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG => Some("STATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG"),
+ SMB_NTSTATUS_FVE_VOLUME_TOO_SMALL => Some("STATUS_FVE_VOLUME_TOO_SMALL"),
+ SMB_NTSTATUS_FWP_CALLOUT_NOT_FOUND => Some("STATUS_FWP_CALLOUT_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_CONDITION_NOT_FOUND => Some("STATUS_FWP_CONDITION_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_FILTER_NOT_FOUND => Some("STATUS_FWP_FILTER_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_LAYER_NOT_FOUND => Some("STATUS_FWP_LAYER_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_PROVIDER_NOT_FOUND => Some("STATUS_FWP_PROVIDER_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND => Some("STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_SUBLAYER_NOT_FOUND => Some("STATUS_FWP_SUBLAYER_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_NOT_FOUND => Some("STATUS_FWP_NOT_FOUND"),
+ SMB_NTSTATUS_FWP_ALREADY_EXISTS => Some("STATUS_FWP_ALREADY_EXISTS"),
+ SMB_NTSTATUS_FWP_IN_USE => Some("STATUS_FWP_IN_USE"),
+ SMB_NTSTATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS => Some("STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS"),
+ SMB_NTSTATUS_FWP_WRONG_SESSION => Some("STATUS_FWP_WRONG_SESSION"),
+ SMB_NTSTATUS_FWP_NO_TXN_IN_PROGRESS => Some("STATUS_FWP_NO_TXN_IN_PROGRESS"),
+ SMB_NTSTATUS_FWP_TXN_IN_PROGRESS => Some("STATUS_FWP_TXN_IN_PROGRESS"),
+ SMB_NTSTATUS_FWP_TXN_ABORTED => Some("STATUS_FWP_TXN_ABORTED"),
+ SMB_NTSTATUS_FWP_SESSION_ABORTED => Some("STATUS_FWP_SESSION_ABORTED"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_TXN => Some("STATUS_FWP_INCOMPATIBLE_TXN"),
+ SMB_NTSTATUS_FWP_TIMEOUT => Some("STATUS_FWP_TIMEOUT"),
+ SMB_NTSTATUS_FWP_NET_EVENTS_DISABLED => Some("STATUS_FWP_NET_EVENTS_DISABLED"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_LAYER => Some("STATUS_FWP_INCOMPATIBLE_LAYER"),
+ SMB_NTSTATUS_FWP_KM_CLIENTS_ONLY => Some("STATUS_FWP_KM_CLIENTS_ONLY"),
+ SMB_NTSTATUS_FWP_LIFETIME_MISMATCH => Some("STATUS_FWP_LIFETIME_MISMATCH"),
+ SMB_NTSTATUS_FWP_BUILTIN_OBJECT => Some("STATUS_FWP_BUILTIN_OBJECT"),
+ SMB_NTSTATUS_FWP_TOO_MANY_BOOTTIME_FILTERS => Some("STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS"),
+ SMB_NTSTATUS_FWP_NOTIFICATION_DROPPED => Some("STATUS_FWP_NOTIFICATION_DROPPED"),
+ SMB_NTSTATUS_FWP_TRAFFIC_MISMATCH => Some("STATUS_FWP_TRAFFIC_MISMATCH"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_SA_STATE => Some("STATUS_FWP_INCOMPATIBLE_SA_STATE"),
+ SMB_NTSTATUS_FWP_NULL_POINTER => Some("STATUS_FWP_NULL_POINTER"),
+ SMB_NTSTATUS_FWP_INVALID_ENUMERATOR => Some("STATUS_FWP_INVALID_ENUMERATOR"),
+ SMB_NTSTATUS_FWP_INVALID_FLAGS => Some("STATUS_FWP_INVALID_FLAGS"),
+ SMB_NTSTATUS_FWP_INVALID_NET_MASK => Some("STATUS_FWP_INVALID_NET_MASK"),
+ SMB_NTSTATUS_FWP_INVALID_RANGE => Some("STATUS_FWP_INVALID_RANGE"),
+ SMB_NTSTATUS_FWP_INVALID_INTERVAL => Some("STATUS_FWP_INVALID_INTERVAL"),
+ SMB_NTSTATUS_FWP_ZERO_LENGTH_ARRAY => Some("STATUS_FWP_ZERO_LENGTH_ARRAY"),
+ SMB_NTSTATUS_FWP_NULL_DISPLAY_NAME => Some("STATUS_FWP_NULL_DISPLAY_NAME"),
+ SMB_NTSTATUS_FWP_INVALID_ACTION_TYPE => Some("STATUS_FWP_INVALID_ACTION_TYPE"),
+ SMB_NTSTATUS_FWP_INVALID_WEIGHT => Some("STATUS_FWP_INVALID_WEIGHT"),
+ SMB_NTSTATUS_FWP_MATCH_TYPE_MISMATCH => Some("STATUS_FWP_MATCH_TYPE_MISMATCH"),
+ SMB_NTSTATUS_FWP_TYPE_MISMATCH => Some("STATUS_FWP_TYPE_MISMATCH"),
+ SMB_NTSTATUS_FWP_OUT_OF_BOUNDS => Some("STATUS_FWP_OUT_OF_BOUNDS"),
+ SMB_NTSTATUS_FWP_RESERVED => Some("STATUS_FWP_RESERVED"),
+ SMB_NTSTATUS_FWP_DUPLICATE_CONDITION => Some("STATUS_FWP_DUPLICATE_CONDITION"),
+ SMB_NTSTATUS_FWP_DUPLICATE_KEYMOD => Some("STATUS_FWP_DUPLICATE_KEYMOD"),
+ SMB_NTSTATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER => Some("STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER"),
+ SMB_NTSTATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER => Some("STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER"),
+ SMB_NTSTATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER => Some("STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER"),
+ SMB_NTSTATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT => Some("STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_AUTH_METHOD => Some("STATUS_FWP_INCOMPATIBLE_AUTH_METHOD"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_DH_GROUP => Some("STATUS_FWP_INCOMPATIBLE_DH_GROUP"),
+ SMB_NTSTATUS_FWP_EM_NOT_SUPPORTED => Some("STATUS_FWP_EM_NOT_SUPPORTED"),
+ SMB_NTSTATUS_FWP_NEVER_MATCH => Some("STATUS_FWP_NEVER_MATCH"),
+ SMB_NTSTATUS_FWP_PROVIDER_CONTEXT_MISMATCH => Some("STATUS_FWP_PROVIDER_CONTEXT_MISMATCH"),
+ SMB_NTSTATUS_FWP_INVALID_PARAMETER => Some("STATUS_FWP_INVALID_PARAMETER"),
+ SMB_NTSTATUS_FWP_TOO_MANY_SUBLAYERS => Some("STATUS_FWP_TOO_MANY_SUBLAYERS"),
+ SMB_NTSTATUS_FWP_CALLOUT_NOTIFICATION_FAILED => Some("STATUS_FWP_CALLOUT_NOTIFICATION_FAILED"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_AUTH_CONFIG => Some("STATUS_FWP_INCOMPATIBLE_AUTH_CONFIG"),
+ SMB_NTSTATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG => Some("STATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG"),
+ SMB_NTSTATUS_FWP_DUPLICATE_AUTH_METHOD => Some("STATUS_FWP_DUPLICATE_AUTH_METHOD"),
+ SMB_NTSTATUS_FWP_TCPIP_NOT_READY => Some("STATUS_FWP_TCPIP_NOT_READY"),
+ SMB_NTSTATUS_FWP_INJECT_HANDLE_CLOSING => Some("STATUS_FWP_INJECT_HANDLE_CLOSING"),
+ SMB_NTSTATUS_FWP_INJECT_HANDLE_STALE => Some("STATUS_FWP_INJECT_HANDLE_STALE"),
+ SMB_NTSTATUS_FWP_CANNOT_PEND => Some("STATUS_FWP_CANNOT_PEND"),
+ SMB_NTSTATUS_NDIS_CLOSING => Some("STATUS_NDIS_CLOSING"),
+ SMB_NTSTATUS_NDIS_BAD_VERSION => Some("STATUS_NDIS_BAD_VERSION"),
+ SMB_NTSTATUS_NDIS_BAD_CHARACTERISTICS => Some("STATUS_NDIS_BAD_CHARACTERISTICS"),
+ SMB_NTSTATUS_NDIS_ADAPTER_NOT_FOUND => Some("STATUS_NDIS_ADAPTER_NOT_FOUND"),
+ SMB_NTSTATUS_NDIS_OPEN_FAILED => Some("STATUS_NDIS_OPEN_FAILED"),
+ SMB_NTSTATUS_NDIS_DEVICE_FAILED => Some("STATUS_NDIS_DEVICE_FAILED"),
+ SMB_NTSTATUS_NDIS_MULTICAST_FULL => Some("STATUS_NDIS_MULTICAST_FULL"),
+ SMB_NTSTATUS_NDIS_MULTICAST_EXISTS => Some("STATUS_NDIS_MULTICAST_EXISTS"),
+ SMB_NTSTATUS_NDIS_MULTICAST_NOT_FOUND => Some("STATUS_NDIS_MULTICAST_NOT_FOUND"),
+ SMB_NTSTATUS_NDIS_REQUEST_ABORTED => Some("STATUS_NDIS_REQUEST_ABORTED"),
+ SMB_NTSTATUS_NDIS_RESET_IN_PROGRESS => Some("STATUS_NDIS_RESET_IN_PROGRESS"),
+ SMB_NTSTATUS_NDIS_INVALID_PACKET => Some("STATUS_NDIS_INVALID_PACKET"),
+ SMB_NTSTATUS_NDIS_INVALID_DEVICE_REQUEST => Some("STATUS_NDIS_INVALID_DEVICE_REQUEST"),
+ SMB_NTSTATUS_NDIS_ADAPTER_NOT_READY => Some("STATUS_NDIS_ADAPTER_NOT_READY"),
+ SMB_NTSTATUS_NDIS_INVALID_LENGTH => Some("STATUS_NDIS_INVALID_LENGTH"),
+ SMB_NTSTATUS_NDIS_INVALID_DATA => Some("STATUS_NDIS_INVALID_DATA"),
+ SMB_NTSTATUS_NDIS_BUFFER_TOO_SHORT => Some("STATUS_NDIS_BUFFER_TOO_SHORT"),
+ SMB_NTSTATUS_NDIS_INVALID_OID => Some("STATUS_NDIS_INVALID_OID"),
+ SMB_NTSTATUS_NDIS_ADAPTER_REMOVED => Some("STATUS_NDIS_ADAPTER_REMOVED"),
+ SMB_NTSTATUS_NDIS_UNSUPPORTED_MEDIA => Some("STATUS_NDIS_UNSUPPORTED_MEDIA"),
+ SMB_NTSTATUS_NDIS_GROUP_ADDRESS_IN_USE => Some("STATUS_NDIS_GROUP_ADDRESS_IN_USE"),
+ SMB_NTSTATUS_NDIS_FILE_NOT_FOUND => Some("STATUS_NDIS_FILE_NOT_FOUND"),
+ SMB_NTSTATUS_NDIS_ERROR_READING_FILE => Some("STATUS_NDIS_ERROR_READING_FILE"),
+ SMB_NTSTATUS_NDIS_ALREADY_MAPPED => Some("STATUS_NDIS_ALREADY_MAPPED"),
+ SMB_NTSTATUS_NDIS_RESOURCE_CONFLICT => Some("STATUS_NDIS_RESOURCE_CONFLICT"),
+ SMB_NTSTATUS_NDIS_MEDIA_DISCONNECTED => Some("STATUS_NDIS_MEDIA_DISCONNECTED"),
+ SMB_NTSTATUS_NDIS_INVALID_ADDRESS => Some("STATUS_NDIS_INVALID_ADDRESS"),
+ SMB_NTSTATUS_NDIS_PAUSED => Some("STATUS_NDIS_PAUSED"),
+ SMB_NTSTATUS_NDIS_INTERFACE_NOT_FOUND => Some("STATUS_NDIS_INTERFACE_NOT_FOUND"),
+ SMB_NTSTATUS_NDIS_UNSUPPORTED_REVISION => Some("STATUS_NDIS_UNSUPPORTED_REVISION"),
+ SMB_NTSTATUS_NDIS_INVALID_PORT => Some("STATUS_NDIS_INVALID_PORT"),
+ SMB_NTSTATUS_NDIS_INVALID_PORT_STATE => Some("STATUS_NDIS_INVALID_PORT_STATE"),
+ SMB_NTSTATUS_NDIS_LOW_POWER_STATE => Some("STATUS_NDIS_LOW_POWER_STATE"),
+ SMB_NTSTATUS_NDIS_NOT_SUPPORTED => Some("STATUS_NDIS_NOT_SUPPORTED"),
+ SMB_NTSTATUS_NDIS_OFFLOAD_POLICY => Some("STATUS_NDIS_OFFLOAD_POLICY"),
+ SMB_NTSTATUS_NDIS_OFFLOAD_CONNECTION_REJECTED => Some("STATUS_NDIS_OFFLOAD_CONNECTION_REJECTED"),
+ SMB_NTSTATUS_NDIS_OFFLOAD_PATH_REJECTED => Some("STATUS_NDIS_OFFLOAD_PATH_REJECTED"),
+ SMB_NTSTATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED => Some("STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED"),
+ SMB_NTSTATUS_NDIS_DOT11_MEDIA_IN_USE => Some("STATUS_NDIS_DOT11_MEDIA_IN_USE"),
+ SMB_NTSTATUS_NDIS_DOT11_POWER_STATE_INVALID => Some("STATUS_NDIS_DOT11_POWER_STATE_INVALID"),
+ SMB_NTSTATUS_NDIS_PM_WOL_PATTERN_LIST_FULL => Some("STATUS_NDIS_PM_WOL_PATTERN_LIST_FULL"),
+ SMB_NTSTATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL => Some("STATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL"),
+ SMB_NTSTATUS_IPSEC_BAD_SPI => Some("STATUS_IPSEC_BAD_SPI"),
+ SMB_NTSTATUS_IPSEC_SA_LIFETIME_EXPIRED => Some("STATUS_IPSEC_SA_LIFETIME_EXPIRED"),
+ SMB_NTSTATUS_IPSEC_WRONG_SA => Some("STATUS_IPSEC_WRONG_SA"),
+ SMB_NTSTATUS_IPSEC_REPLAY_CHECK_FAILED => Some("STATUS_IPSEC_REPLAY_CHECK_FAILED"),
+ SMB_NTSTATUS_IPSEC_INVALID_PACKET => Some("STATUS_IPSEC_INVALID_PACKET"),
+ SMB_NTSTATUS_IPSEC_INTEGRITY_CHECK_FAILED => Some("STATUS_IPSEC_INTEGRITY_CHECK_FAILED"),
+ SMB_NTSTATUS_IPSEC_CLEAR_TEXT_DROP => Some("STATUS_IPSEC_CLEAR_TEXT_DROP"),
+ SMB_NTSTATUS_IPSEC_AUTH_FIREWALL_DROP => Some("STATUS_IPSEC_AUTH_FIREWALL_DROP"),
+ SMB_NTSTATUS_IPSEC_THROTTLE_DROP => Some("STATUS_IPSEC_THROTTLE_DROP"),
+ SMB_NTSTATUS_IPSEC_DOSP_BLOCK => Some("STATUS_IPSEC_DOSP_BLOCK"),
+ SMB_NTSTATUS_IPSEC_DOSP_RECEIVED_MULTICAST => Some("STATUS_IPSEC_DOSP_RECEIVED_MULTICAST"),
+ SMB_NTSTATUS_IPSEC_DOSP_INVALID_PACKET => Some("STATUS_IPSEC_DOSP_INVALID_PACKET"),
+ SMB_NTSTATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED => Some("STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED"),
+ SMB_NTSTATUS_IPSEC_DOSP_MAX_ENTRIES => Some("STATUS_IPSEC_DOSP_MAX_ENTRIES"),
+ SMB_NTSTATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED => Some("STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED"),
+ SMB_NTSTATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES => Some("STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES"),
+ SMB_NTSTATUS_VOLMGR_MIRROR_NOT_SUPPORTED => Some("STATUS_VOLMGR_MIRROR_NOT_SUPPORTED"),
+ SMB_NTSTATUS_VOLMGR_RAID5_NOT_SUPPORTED => Some("STATUS_VOLMGR_RAID5_NOT_SUPPORTED"),
+ SMB_NTSTATUS_VIRTDISK_PROVIDER_NOT_FOUND => Some("STATUS_VIRTDISK_PROVIDER_NOT_FOUND"),
+ SMB_NTSTATUS_VIRTDISK_NOT_VIRTUAL_DISK => Some("STATUS_VIRTDISK_NOT_VIRTUAL_DISK"),
+ SMB_NTSTATUS_VHD_PARENT_VHD_ACCESS_DENIED => Some("STATUS_VHD_PARENT_VHD_ACCESS_DENIED"),
+ SMB_NTSTATUS_VHD_CHILD_PARENT_SIZE_MISMATCH => Some("STATUS_VHD_CHILD_PARENT_SIZE_MISMATCH"),
+ SMB_NTSTATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED => Some("STATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED"),
+ SMB_NTSTATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT => Some("STATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT"),
+
+ _ => None,
+ }
+}
+
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-09 18:51:40 +0000