SMB2与SMB3协议详解：微软文件共享核心技术

需积分: 15 158 浏览量更新于2024-07-20 收藏 9.35MB PDF 举报

"微软文件共享协议涉及的是Server Message Block (SMB) 协议的第二版和第三版，这些协议主要用于客户端和服务器之间的文件共享和通信。SMB是一种网络通信协议，允许网络上的用户访问和共享文件、打印机以及其他资源。本文档的版权属于微软公司，并在2016年7月14日发布。微软开放规格文档中包含的技术信息涵盖了知识产权声明，允许开发者基于这些文档开发协议的实现，并在他们的实现中分发部分内容，以便于正确地记录和解释实现细节。此外，文档可能还包括与协议相关的模式（schemas）和接口定义语言（IDL）等部分。" 详细说明： SMB（Server Message Block）协议是微软操作系统中的核心组件，它允许在网络环境中进行文件共享、打印服务以及命名管道通信。SMB协议最初是为IBM的LAN Manager开发的，后来被广泛应用于Windows系统中。随着技术的发展，SMB经历了多次升级，从最初的SMB 1.0到现在的SMB 3.x，其中SMB 2和SMB 3是两个重要的版本。 MS-SMB2（SMB Protocol Version 2）是SMB协议的一个重要改进，它提高了性能，减少了网络延迟，引入了多通道功能，允许多个TCP连接同时处理不同的数据流，增强了安全性，如支持加密。此外，SMB 2还优化了文件打开和关闭的操作，降低了开销。 MS-SMB2之后，微软推出了SMB 3，进一步提升了协议的效率和安全性。SMB 3引入了对分布式文件系统复制（DFS-R）的支持，增强了对故障转移群集的兼容性，以及在存储区域网络（SAN）环境下的无缝操作。它还增强了加密机制，以保护数据在传输过程中的安全，并且在客户端断线后能够恢复文件传输。 MS-CIFS（Common Internet File System）是SMB协议的一种互联网标准形式，它旨在使SMB协议能够更好地与其他操作系统和网络环境兼容。CIFS在SMB的基础上添加了对Internet标准的遵从性，包括TCP/IP协议栈和HTTP等。在实际应用中，SMB协议通过网络层的TCP/IP协议进行传输，客户端通过发起SMB请求来连接服务器，服务器则响应这些请求，提供文件或资源的访问权限。整个过程中，SMB协议负责处理身份验证、权限检查、文件锁定、数据块传输等一系列操作。微软的文件共享协议是构建在SMB 2和SMB 3基础之上的，它不仅提供了高效、安全的文件共享方式，还考虑到了网络环境的多样性和复杂性，确保了跨平台的互操作性。开发者可以依据MS-SMB2和MS-CIFS等相关文档来实现自己的SMB客户端或服务器，从而参与到这个广泛使用的文件共享生态系统中。

16 / 435

[MS-SMB2] - v20160714

Server Message Block (SMB) Protocol Versions 2 and 3

Release: July 14, 2016

supported if the negotiated SMB Dialect is NT LM 0.12 or later. When a client opens a file, it

requests the server to grant it a particular type of oplock on the file. The response from the

server indicates the type of oplock granted to the client. The client uses the granted oplock

type to adjust its buffering policy.

reparse point: An attribute that can be added to a file to store a collection of user-defined data

that is opaque to NTFS or ReFS. If a file that has a reparse point is opened, the open will

normally fail with STATUS_REPARSE, so that the relevant file system filter driver can detect the

open of a file associated with (owned by) this reparse point. At that point, each installed filter

driver can check to see if it is the owner of the reparse point, and, if so, perform any special

processing required for a file with that reparse point. The format of this data is understood by

the application that stores the data and the file system filter that interprets the data and

processes the file. For example, an encryption filter that is marked as the owner of a file's

reparse point could look up the encryption key for that file. A file can have (at most) 1 reparse

point associated with it. For more information, see [MS-FSCC].

security context: An abstract data structure that contains authorization information for a

particular security principal in the form of a Token/Authorization Context (see [MS-DTYP]

section 2.5.2). A server uses the authorization information in a security context to check

access to requested resources. A security context also contains a key identifier that associates

mutually established cryptographic keys, along with other information needed to perform secure

communication with another security principal.

security descriptor: A data structure containing the security information associated with a

securable object. A security descriptor identifies an object's owner by its security identifier

(SID). If access control is configured for the object, its security descriptor contains a

discretionary access control list (DACL) with SIDs for the security principals who are

allowed or denied access. Applications use this structure to set and query an object's security

status. The security descriptor is used to guard access to an object as well as to control which

type of auditing takes place when the object is accessed. The security descriptor format is

specified in [MS-DTYP] section 2.4.6; a string representation of security descriptors, called

SDDL, is specified in [MS-DTYP] section 2.5.1.

security identifier (SID): An identifier for security principals in Windows that is used to

identify an account or a group. Conceptually, the SID is composed of an account authority

portion (typically a domain) and a smaller integer representing an identity relative to the

account authority, termed the relative identifier (RID). The SID format is specified in [MS-DTYP]

section 2.4.2; a string representation of SIDs is specified in [MS-DTYP] section 2.4.2 and [MS-

AZOD] section 1.1.1.2.

security principal: A unique entity that is identifiable through cryptographic means by at least

one key. It frequently corresponds to a human user, but also can be a service that offers a

resource to other security principals. Also referred to as principal.

sequence number: A number that uniquely identifies a request and response that is sent on an

SMB 2 Protocol connection. For a description of how sequence numbers are allocated, see [MS-

SMB2] sections 3.2.4.1.6 and 3.3.1.1.

session: An authenticated context that is established between an SMB 2 Protocol client and an

SMB 2 Protocol server over an SMB 2 Protocol connection for a specific security principal. There

could be multiple active sessions over a single SMB 2 Protocol connection. The SessionId field

in the SMB2 packet header distinguishes the various sessions.

share: A local resource that is offered by an SMB 2 Protocol server for access by SMB 2 Protocol

clients over the network. The SMB 2 Protocol defines three types of shares: file (or disk)

shares, which represent a directory tree and its included files; pipe shares, which expose

access to named pipes; and print shares, which provide access to print resources on the server.

A pipe share as defined by the SMB 2 Protocol must always have the name "IPC$". A pipe

share must only allow named pipe operations and DFS referral requests to itself.

17 / 435

[MS-SMB2] - v20160714

Server Message Block (SMB) Protocol Versions 2 and 3

Release: July 14, 2016

snapshot: The point in time at which a shadow copy of a volume is made.

symbolic link: A symbolic link is a reparse point that points to another file system object. The

object being pointed to is called the target. Symbolic links are transparent to users; the links

appear as normal files or directories, and can be acted upon by the user or application in exactly

the same manner. Symbolic links can be created using the FSCTL_SET_REPARSE_POINT

request as specified in [MS-FSCC] section 2.3.61. They can be deleted using the

FSCTL_DELETE_REPARSE_POINT request as specified in [MS-FSCC] section 2.3.5. Implementing

symbolic links is optional for a file system.

system access control list (SACL): An access control list (ACL) that controls the generation of

audit messages for attempts to access a securable object. The ability to get or set an object's

SACL is controlled by a privilege typically held only by system administrators.

Transmission Control Protocol (TCP): A protocol used with the Internet Protocol (IP) to send

data in the form of message units between computers over the Internet. TCP handles keeping

track of the individual units of data (called packets) that a message is divided into for efficient

routing through the Internet.

tree connect: A connection by a specific session on an SMB 2 Protocol client to a specific share on

an SMB 2 Protocol server over an SMB 2 Protocol connection. There could be multiple tree

connects over a single SMB 2 Protocol connection. The TreeId field in the SMB2 packet header

distinguishes the various tree connects.

Unicode: A character encoding standard developed by the Unicode Consortium that represents

almost all of the written languages of the world. The Unicode standard [UNICODE5.0.0/2007]

provides three forms (UTF-8, UTF-16, and UTF-32) and seven schemes (UTF-8, UTF-16, UTF-16

BE, UTF-16 LE, UTF-32, UTF-32 LE, and UTF-32 BE).

MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as defined

in [RFC2119]. All statements of optional behavior use either MAY, SHOULD, or SHOULD NOT.

1.2 References

Links to a document in the Microsoft Open Specifications library point to the correct section in the

most recently published version of the referenced document. However, because individual documents

in the library are not updated at the same time, the section numbers in the documents may not

match. You can confirm the correct section numbering by checking the Errata.

1.2.1 Normative References

We conduct frequent surveys of the normative references to assure their continued availability. If you

have any issue with finding a normative reference, please contact dochelp@microsoft.com. We will

assist you in finding the relevant information.

[FIPS180-4] FIPS PUBS, "Secure Hash Standards (SHS)", March 2012,

http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf

[IANAPORT] IANA, "Service Name and Transport Protocol Port Number Registry", November 2006,

http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

[MS-CIFS] Microsoft Corporation, "Common Internet File System (CIFS) Protocol".

[MS-DFSC] Microsoft Corporation, "Distributed File System (DFS): Referral Protocol".

[MS-DTYP] Microsoft Corporation, "Windows Data Types".

[MS-ERREF] Microsoft Corporation, "Windows Error Codes".

18 / 435

[MS-SMB2] - v20160714

Server Message Block (SMB) Protocol Versions 2 and 3

Release: July 14, 2016

[MS-FSA] Microsoft Corporation, "File System Algorithms".

[MS-FSCC] Microsoft Corporation, "File System Control Codes".

[MS-KILE] Microsoft Corporation, "Kerberos Protocol Extensions".

[MS-NLMP] Microsoft Corporation, "NT LAN Manager (NTLM) Authentication Protocol".

[MS-PCCRC] Microsoft Corporation, "Peer Content Caching and Retrieval: Content Identification".

[MS-RPCE] Microsoft Corporation, "Remote Procedure Call Protocol Extensions".

[MS-RSVD] Microsoft Corporation, "Remote Shared Virtual Disk Protocol".

[MS-SMB] Microsoft Corporation, "Server Message Block (SMB) Protocol".

[MS-SPNG] Microsoft Corporation, "Simple and Protected GSS-API Negotiation Mechanism (SPNEGO)

Extension".

[MS-SRVS] Microsoft Corporation, "Server Service Remote Protocol".

[RFC1001] Network Working Group, "Protocol Standard for a NetBIOS Service on a TCP/UDP

Transport: Concepts and Methods", RFC 1001, March 1987, http://www.ietf.org/rfc/rfc1001.txt

[RFC1002] Network Working Group, "Protocol Standard for a NetBIOS Service on a TCP/UDP

Transport: Detailed Specifications", STD 19, RFC 1002, March 1987, http://www.rfc-

editor.org/rfc/rfc1002.txt

[RFC2104] Krawczyk, H., Bellare, M., and Canetti, R., "HMAC: Keyed-Hashing for Message

Authentication", RFC 2104, February 1997, http://www.ietf.org/rfc/rfc2104.txt

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC

2119, March 1997, http://www.rfc-editor.org/rfc/rfc2119.txt

[RFC2743] Linn, J., "Generic Security Service Application Program Interface Version 2, Update 1", RFC

2743, January 2000, http://www.rfc-editor.org/rfc/rfc2743.txt

[RFC4178] Zhu, L., Leach, P., Jaganathan, K., and Ingersoll, W., "The Simple and Protected Generic

Security Service Application Program Interface (GSS-API) Negotiation Mechanism", RFC 4178, October

2005, http://www.rfc-editor.org/rfc/rfc4178.txt

[RFC4309] Housley, R., "Using Advanced Encryption Standard (AES) CCM Mode with IPsec

Encapsulating Security Payload (ESP)", RFC 4309, December 2005, http://www.ietf.org/rfc/rfc4309.txt

[RFC4493] Song, JH., Poovendran, R., Lee, J., and Iwata, T., "The AES-CMAC Algorithm", RFC 4493,

June 2006, http://www.ietf.org/rfc/rfc4493.txt

[RFC5084] Housley, R., "Using AES-CCM and AES-GCM Authenticated Encryption in the Cryptographic

Message Syntax (CMS)", RFC 5084, November 2007, http://www.ietf.org/rfc/rfc5084.txt

[SP800-108] National Institute of Standards and Technology., "Special Publication 800-108,

Recommendation for Key Derivation Using Pseudorandom Functions", October 2009,

http://csrc.nist.gov/publications/nistpubs/800-108/sp800-108.pdf

[UNICODE] The Unicode Consortium, "The Unicode Consortium Home Page", 2006,

http://www.unicode.org/

19 / 435

[MS-SMB2] - v20160714

Server Message Block (SMB) Protocol Versions 2 and 3

Release: July 14, 2016

1.2.2 Informative References

[FSBO] Microsoft Corporation, "File System Behavior in the Microsoft Windows Environment", June

2008, http://download.microsoft.com/download/4/3/8/43889780-8d45-4b2e-9d3a-

c696a890309f/File%20System%20Behavior%20Overview.pdf

[KB2770917] Microsoft Corporation, "Windows 8 and Windows Server 2012 update rollup: November

2012", Version 6.0, http://support.microsoft.com/kb/2770917/en-us

[MS-AUTHSOD] Microsoft Corporation, "Authentication Services Protocols Overview".

[MS-LSAD] Microsoft Corporation, "Local Security Authority (Domain Policy) Remote Protocol".

[MS-PCCRR] Microsoft Corporation, "Peer Content Caching and Retrieval: Retrieval Protocol".

[MS-SMBD] Microsoft Corporation, "SMB2 Remote Direct Memory Access (RDMA) Transport Protocol".

[MS-SQOS] Microsoft Corporation, "Storage Quality of Service Protocol".

[MS-SWN] Microsoft Corporation, "Service Witness Protocol".

[MS-WPO] Microsoft Corporation, "Windows Protocols Overview".

[MSDFS] Microsoft Corporation, "How DFS Works", March 2003, http://technet.microsoft.com/en-

us/library/cc782417%28WS.10%29.aspx

[MSDN-IMPERS] Microsoft Corporation, "Impersonation", http://msdn.microsoft.com/en-

us/library/ms691341.aspx

[MSDN-IoCtlCodes] Microsoft Corporation, "Defining I/O Control Codes",

http://msdn.microsoft.com/en-us/library/ff543023.aspx

[MSKB-2536275] Microsoft Corporation, "Vulnerability in SMB Server could allow denial of service",

MS11-048, June 2011, http://support.microsoft.com/kb/2536275

[MSKB-2934016] Microsoft Corporation, "Windows RT, Windows 8, and Windows Server 2012 update

rollup: April 2014", http://support.microsoft.com/kb/2934016

[MSKB-2976995] Microsoft Corporation, "You cannot access an SMB share that is located on a

Windows 8.1 or Windows Server 2012 R2-based file server", August 2014,

http://support.microsoft.com/kb/2976995

[MSKB-978491] Microsoft Corporation, "FIX: A server that is running Server Message Block Version 2

does not respond to certain FSCTL_SRV_NOTIFY_TRANSACTION requests from clients that are running

Windows Vista or Windows Server 2008", 2011, http://support.microsoft.com/kb/978491

[OFFLINE] Microsoft Corporation, "Offline Files", January 2005,

http://technet2.microsoft.com/WindowsServer/en/Library/830323a2-23ca-4875-af3c-

06671d68ca9a1033.mspx

1.3 Overview

The Server Message Block (SMB) Protocol Versions 2 and 3, hereafter referred to as "SMB 2 Protocol",

is an extension of the original Server Message Block (SMB) Protocol (as specified in [MS-SMB] and

[MS-CIFS]). Both protocols are used by clients to request file and print services from a server system

over the network. Both are stateful protocols in which clients establish a connection to a server,

establish an authenticated context on that connection, and then issue a variety of requests to

access files, printers, and named pipes for interprocess communication.

20 / 435

[MS-SMB2] - v20160714

Server Message Block (SMB) Protocol Versions 2 and 3

Release: July 14, 2016

The SMB 2 Protocol is a major revision of the existing SMB Protocol, as specified in [MS-SMB]. The

packet formats are completely different from those of the SMB Protocol; however, many of the

underlying concepts are carried over. The underlying transports that are used to initiate and accept

connections are either Direct TCP as specified in section 2.1 or NetBIOS over TCP transports as

specified in [RFC1001] and [RFC1002].

To retain compatibility with existing clients and servers, the existing SMB Protocol can be used to

negotiate the use of the SMB 2 Protocol, as described in section 1.7. However, the two protocols will

never be intermixed on a specified connection after one is selected during negotiation.

Like its predecessor, which was the original SMB Protocol (as specified in [MS-SMB]), the SMB 2

Protocol supports the following features:

 Establishing one or more authenticated contexts for different security principals on a

connection.

 Connecting to multiple shared resources on the target server on a connection.

 Opening, reading, modifying, or closing multiple files or named pipes on the target server.

 Using the opportunistic locking of files to allow clients to cache data for better performance.

 Querying and applying attributes to files or volumes on the target server.

 Canceling outstanding operations.

 Passing through IO control code operations to the underlying object store on the server machine.

 Validating the integrity of requests and responses.

 Support for share scoping and server aliases to allow a single server to appear as multiple distinct

servers, as described in [MS-SRVS] section 1.3.

The SMB 2 Protocol provides several enhancements in addition to the preceding features:

 Allowing an open to a file to be reestablished after a client connection becomes temporarily

disconnected.

 Allowing the server to balance the number of simultaneous operations that a client can have

outstanding at any time.

 Providing scalability in terms of the number of shares, users, and simultaneously open files.

 Supporting symbolic links.

 Using a stronger algorithm to validate the integrity of requests and responses.

The SMB 2.1 dialect introduces the following enhancements:

 Allowing a client to indicate support for multiple SMB 2 dialects in a multi-protocol negotiate

request.

 Allowing a client to obtain and preserve client caching state across multiple opens from the same

client.

 Allowing a client to mark individual write operations on unbuffered handles to be treated as write-

through.

 Allowing a client to retrieve hashes of a file for use in branch cache retrieval, as specified in [MS-

PCCRC] section 2.3.

The SMB 3.0 dialect introduces the following enhancements:

剩余434页未读，继续阅读

Alvin-leon

粉丝: 4
资源: 2

SMB2与SMB3协议详解：微软文件共享核心技术

Microsoft 网络的文件和打印机共享协议安装文件

pen-在浏览器中从您最喜爱的编辑器实时预览Markdown

USB_protocal_协议英文版

Windows服务器文件共享与权限管理

windows共享文件协议

smb协议 访问共享文件

局域网文件共享软件 c#源码

xp的smbv1共享协议如何访问win10

samba共享文件windows无法访问

cifs和smb的区别

最新资源

smb协议访问共享文件