Module smb2 

SMB2 protocol loop ([MS-SMB2]).

Implements the full file-serving command surface on top of the shared Vfs abstraction: NEGOTIATE, SESSION_SETUP (both NTLMSSP legs), TREE_CONNECT/DISCONNECT, LOGOFF, CREATE, READ, WRITE, CLOSE, FLUSH, LOCK, QUERY_DIRECTORY, QUERY_INFO and SET_INFO. Frames whose magic is \xFESMB route here from crate::dispatch.

Structs

AsyncCrypto 🔒

Per-session crypto material an async completion needs to sign/seal a frame off the request path (snapshotted at request time so the background task never borrows the connection).

AsyncReply 🔒

Plumbing every async-deferred command reply (LOCK / CHANGE_NOTIFY) shares: crypto material to sign/seal the final frame, the request’s identifiers, the outbound queue to send it on, and its cancellation signal.

Smb2Conn

Per-connection SMB2 state.

Enums

AsyncStart 🔒

Block until a conflicting byte-range lock is released and the requested ranges can be acquired, then emit the final LOCK response ([MS-SMB2] §3.3.5.14). Cancellation yields STATUS_CANCELLED. How an async-capable command (LOCK / CHANGE_NOTIFY) starts: either an immediate reply, or a deferral parked under an async id whose final reply a background worker sends later ([MS-SMB2] §3.3.4.2).

IoctlReply 🔒

The outcome of an IOCTL: either a reply body to encode, or silence because the connection is being terminated ([MS-SMB2] §3.3.5.15.12).

NegotiateReply 🔒

Handle one leg of SPNEGO/NTLMSSP session establishment ([MS-SMB2] §3.3.5.5). How a NEGOTIATE resolves: an immediate reply, or silence because a repeat NEGOTIATE on an already-negotiated connection terminates it ([MS-SMB2] §3.3.5.4).

Routed 🔒

Route a request through the typestate pipeline (io::dispatch) and return the (status, body) the legacy framing still wraps. Used by commands migrated onto io::Command (docs/typestate_plan.md Phases 2–3). How a typestate dispatch resolves for process_single: a body that still flows the common signing/sealing tail, a pre-framed async PDU to send verbatim (the STATUS_PENDING interim), or nothing at all.

Constants

KNOWN_PIPES 🔒

Known pipe names served on IPC$.

LEASE_ACK_TIMEOUT 🔒

How long a conflicting open waits for a lease-break acknowledgment before proceeding ([MS-SMB2] §3.3.1.4). Kept short under test to keep unit tests fast (no real client acks there).

MAX_TRANSACT_SIZE 🔒

MaxTransactSize advertised in our NEGOTIATE response (1 MiB); CHANGE_NOTIFY rejects an OutputBufferLength larger than this ([MS-SMB2] §3.3.5.19).

Functions

arbitrate_lease 🔒

Arbitrate a caching lease for a lease-requesting CREATE ([MS-SMB2] §2.2.13.2). A sole opener gets the requested state (capped at RWH); an open reusing the same lease key shares the existing state; READ and HANDLE caching are shareable, so directory holders with distinct keys coexist, whereas a contending file open strips write caching from existing holders (RWH -> RH) via unsolicited LEASE_BREAKs and is itself capped at RH.

begin_change_notify 🔒

Begin a CHANGE_NOTIFY ([MS-SMB2] §3.3.5.19): validate the directory open, register the watch, and defer with an interim STATUS_PENDING.

begin_lock 🔒

Begin a LOCK ([MS-SMB2] §3.3.5.14): apply unlocks, try acquisitions, and either answer immediately or (for a blocking lock) spawn a waiter and defer.

break_crypto 🔒

Snapshot the crypto material needed to protect an oplock break sent later to this holder.

break_dir_lease 🔒

Revoke caching bits (clear) on a directory lease held on dir when its contents or state change, unless the change originates from the lease holder itself ([MS-SMB2] §3.3.1.4). owner is the file id of the open performing the change, used to suppress a self-break.

break_dir_lease_wait 🔒

Break a directory lease and wait (briefly) for the holder to acknowledge, as a HANDLE-caching break requires before the conflicting operation may proceed ([MS-SMB2] §3.3.1.4).

break_subtree_lease_wait 🔒

Break HANDLE caching on every directory lease across the subtree rooted at dir and wait (briefly) for each holder to acknowledge, as required before a directory rename that invalidates the subtree’s cached handles may be evaluated ([MS-SMB2] §3.3.1.4). owner is the renaming open, suppressed from the break.

build_async_frame 🔒

Build an async-header frame ([MS-SMB2] §3.3.4.2 async mode): SERVER_TO_REDIR|ASYNC_COMMAND flags with the AsyncId occupying the Reserved+TreeId slot. Returned unsigned and unsealed.

build_break_frame 🔒

Build a server-initiated OPLOCK_BREAK frame (unsolicited: MessageId all-ones, sync header). Returned unsigned and unsealed.

build_interface_list 🔒

Encode NETWORK_INTERFACE_INFO entries (RSS/RDMA both disabled, 10 Gbps), chaining Next links; each entry is a fixed 152 bytes (8-byte aligned).

cancel 🔒

Handle a CANCEL ([MS-SMB2] §3.3.5.16): find the pending op by AsyncId (async CANCEL) or MessageId (sync CANCEL) and signal it to complete with STATUS_CANCELLED. CANCEL itself carries no response.

cipher_is_256 🔒

True for the AES-256 cipher variants (32-byte keys).

cipher_is_gcm 🔒

True for the GCM cipher variants ([MS-SMB2] §2.2.3.1.2).

cipher_key_len 🔒

Key length in bytes for a negotiated cipher.

close 🔒

close_all_handles 🔒

collect_subdirs 🔒

Collect subdirectories under root as (absolute_path, backslash_relative) pairs for recursive CHANGE_NOTIFY, capped to bound very deep trees.

copychunk_total 🔒

Read the TotalBytesWritten field out of a SRV_COPYCHUNK_RESPONSE body.

create 🔒

decrypt_transform 🔒

do_copychunk 🔒

Perform a server-side copy: for each chunk read from the source open named by the resume key and write into the target handle. Returns the SRV_COPYCHUNK_RESPONSE body, or (status, body) where the body carries the server limits on a limits violation ([MS-SMB2] §3.3.5.15.6).

durable_reconnect 🔒

Reclaim a preserved durable handle and re-open the file under its persistent id (single-node durable model: the on-disk file, not a live fd, is durable).

durable_reconnect_ids 🔒

Extract (persistent_id, create_guid) when a CREATE carries a durable reconnect context.

encrypt_response 🔒

error_resp 🔒

Build the generic ERROR response body ([MS-SMB2] §2.2.2): StructureSize 9 with no error data. Every failed command carries this so clients can parse the frame (a bare header breaks their compound parser). The body is padded to the structure’s declared 8-byte footprint.

file_id_body_offset 🔒

Body-relative offset of the 16-byte FileId within a request that carries one, used to resolve the wildcard FileId in a related compound follow-up ([MS-SMB2] §3.3.5.2.7.2). None for commands with no FileId field.

filter_to_mask 🔒

Translate an SMB completion filter ([MS-SMB2] §2.2.35) into an inotify watch mask.

finalize_async 🔒

Sign then (optionally) seal a fully-built async frame per the session’s protection, mirroring the request path’s sign-then-encrypt order.

finalize_break 🔒

Seal an oplock/lease break for its holder. Break notifications carry SessionId 0 and are sent unsigned ([MS-SMB2] §3.3.4.6); encrypted sessions still wrap them in a transform header.

g16 🔒

g32 🔒

gmac_nonce 🔒

AES-GMAC nonce for signing ([MS-SMB2] §3.1.4.1): MessageId in the low 8 bytes; in the top 4 bytes bit 0 marks a server-sent message and bit 1 an SMB2 CANCEL request.

grant_durable 🔒

Record a durable-handle grant on the connection and return the response create-context to echo. Directories and one-shot deletes are ineligible. A durable open also requires a batch oplock or a handle-caching lease, so lease_state (the granted lease bits, if any) gates the grant; persistence is only granted on a continuous-availability share (is_ca).

handle_multiprotocol_negotiate

Respond to an SMB1 multi-protocol NEGOTIATE that carries the \xFESMB dialect marker: builds the SMB2 negotiate response so the client upgrades.

hex_str 🔒

ioctl 🔒

IOCTL / FSCTL dispatch ([MS-SMB2] §3.3.5.15). Kept as a free function so the typestate handler and its private FSCTL helpers all live in this module.

mask_to_action 🔒

Map an inotify event mask to a FILE_NOTIFY_INFORMATION action ([MS-FSCC] §2.7.1).

message_signature 🔒

The 16-byte SMB2 signature over msg (signature field pre-zeroed): the negotiated 3.x algorithm (AES-CMAC / AES-GMAC / HMAC-SHA256), or HMAC-SHA256 for 2.x ([MS-SMB2] §3.1.4.1). server_sender picks the AES-GMAC nonce bit.

negotiate 🔒

Negotiate a dialect ([MS-SMB2] §3.3.5.3-4): answer probes with the wildcard response, pick a common dialect, validate 3.1.1 pre-auth contexts, and choose cipher/compression. The response is framed and pre-auth-hashed by the shared tail in process_single.

network_interface_info 🔒

Build a NETWORK_INTERFACE_INFO list ([MS-SMB2] §2.2.32.5) from the host’s interfaces so a multichannel client can discover additional server IPs.

next_file_id 🔒

Allocate a 16-byte SMB2 FileId (counter in the first quadword).

next_offload_id 🔒

A fresh 16-byte identifier embedded in an offload (ODX) token, keying the source bytes captured by FSCTL_OFFLOAD_READ.

next_resume_nonce 🔒

Server-side-copy nonce appended to a resume key so repeated keys on one open stay distinct.

next_session_id 🔒

next_tree_id 🔒

Allocate a fresh TreeId.

parent_dir 🔒

The parent directory portion of a normalized share-relative path, or the share root ("") when the path has no parent component.

pipe_close 🔒

Remove a pipe handle; true when it was one.

pipe_create 🔒

Open a virtual pipe; Err(FILE_NOT_FOUND) for unknown names.

pipe_read 🔒

Drain up to the requested byte count from a pipe’s outbound queue; None when file_id is not a pipe.

pipe_write 🔒

Feed client bytes into a pipe RPC dispatcher; None when file_id is not a pipe. Returns the WRITE response body.

probe_negotiate_resp 🔒

Build the wildcard-dialect NEGOTIATE response used to answer the invalid-status probe ([MS-SMB2] §2.2.3.1.1): DialectRevision 0x02FF with all other fields zero.

process_frame 🔒

Execute one frame (possibly compound) and build its response (None to stay silent). Chained requests ([MS-SMB2] §3.3.5.2) are dispatched in order and their replies concatenated with 8-byte alignment.

process_single 🔒

Process exactly one SMB2 request starting at buf (its own header).

query_directory 🔒

query_info 🔒

read 🔒

response 🔒

Build a 64-byte SMB2 response header + body, echoing MessageId/TreeId and stamping the effective session id ([MS-SMB2] §3.3.4.1).

run_change_notify 🔒

Watch dir_path for one filesystem change (or cancellation) and emit the final CHANGE_NOTIFY response ([MS-SMB2] §2.2.36) on the outbound queue.

run_lock_wait 🔒

seal_pdu 🔒

Seal msg into a transform frame with explicit key material so both the request path and background async tasks can encrypt without borrowing the whole connection.

send_lease_break 🔒

Build, protect and enqueue an unsolicited LEASE_BREAK notification ([MS-SMB2] §2.2.23.2) asking a holder to drop from current to new.

send_oplock_break 🔒

Build, protect and enqueue an unsolicited OPLOCK_BREAK notification ([MS-SMB2] §2.2.23.1) telling holder to break down to level.

serve_client

Serve an SMB2 client connection until EOF/error (used when a connection starts life directly in SMB2 rather than upgrading through SMB1).

session_setup 🔒

set_info 🔒

share_is_ca 🔒

True when the tree behind tid is a continuously-available share, which may grant persistent handles ([MS-SMB2] §3.3.5.9.11).

share_is_ipc 🔒

True when the tree behind tid is the virtual IPC$ share.

share_vfs 🔒

Resolve the VFS backing tid, mirroring the SMB1 path (share by name, unknown trees rejected before handlers run).

sig_gmac 🔒

sign_pdu 🔒

Stamp an SMB2 signature over resp in place ([MS-SMB2] §3.3.4.1.1). Sets the SIGNED flag and fills the 16-byte Signature field (bytes 48..64).

tf_off_end 🔒

End offset (relative to frame start) of transform-wrapped payload.

tree_connect 🔒

verify_channel_sequence 🔒

Verify the request’s ChannelSequence against the open’s ([MS-SMB2] §3.3.5.2.10), updating the open’s counters. Returns false when the caller must fail the WRITE/SET_INFO/IOCTL with STATUS_FILE_NOT_AVAILABLE. An open with no tracked state always passes.

verify_pdu_signature 🔒

Verify a request PDU’s signature against key ([MS-SMB2] §3.3.5.2.4): recompute the negotiated signature over the PDU with the signature field zeroed and compare to the header’s Signature.

vfs_err 🔒

via_typestate 🔒

watch_one_event 🔒

Await the first inotify event on dir_path (mapped from the SMB completion filter) or a cancellation. When watch_tree is set, subdirectories are watched too and the reported name is relative to dir_path. Returns the (action, name) list on an event, or Err(status) carrying the completion status on cancel/handle-close/setup error.

write 🔒