CIFS协议详解：微软文件共享通信规范

需积分: 9 114 浏览量更新于2024-07-20 收藏 21.89MB PDF 举报

"微软文件共享协议2" 微软文件共享协议2（MS-SMB2）是微软在CIFS（Common Internet File System）协议的基础上发展出来的一种高级网络文件共享协议，旨在提高文件共享的性能、安全性和效率。CIFS是互联网上广泛使用的文件共享标准，允许不同操作系统之间的计算机共享文件和打印机。 MS-SMB2相对于早期的SMB（Server Message Block）协议，引入了多项改进。例如，减少了网络通信中的往返次数，通过批量请求和响应优化了数据传输，从而提高了文件访问速度。此外，MS-SMB2还支持更强大的安全特性，如加密的数据传输，确保了文件共享过程中的信息安全。 MS-SMB2协议包含以下几个关键特性： 1. **多通道支持**：允许多个并发的TCP连接，增加了带宽利用和容错能力，如果一个连接断开，其他连接仍可继续传输数据。 2. **压缩功能**：允许客户端和服务器之间压缩数据，减少网络负载，提高传输效率。 3. **增强的安全性**：除了支持NTLM和Kerberos身份验证之外，MS-SMB2还引入了对AES-128加密的支持，保护了数据在传输过程中的隐私。 4. **更快的文件打开和关闭操作**：通过减少文件打开和关闭所需的网络交互，显著提升了性能。 5. **更改通知**：客户端可以订阅服务器上的文件或目录更改，而无需持续轮询，节省了网络资源。 6. **缓存协调**：改进了客户端和服务器之间的缓存同步，减少了冲突和数据不一致的可能性。 7. **元数据操作优化**：通过一次性获取大量文件元数据，减少了网络流量。 MS-SMB2协议的实施通常涉及到多个微软的技术文档，包括MS-SMB（SMB版本1的规范）和MS-CIFS（CIFS协议的详细描述）。这些文档详细定义了协议的各个部分，包括消息格式、操作码、状态代码和错误处理。例如，[MS-CIFS]文档提供了CIFS协议的详细信息，涵盖了协议的基本结构、消息交换和协议扩展等内容。开发者在实现MS-SMB2协议时，可以根据微软发布的开放规格文档（Open Specifications Documentation）来指导工作。这些文档的版权属于微软，但微软允许开发人员复制和分发文档，以便开发和支持与这些技术相关的实现。同时，开发者可以在自己的实现中使用、修改或包含文档中的模式、IDL（接口定义语言）和代码样本，以便正确记录和实现协议。微软文件共享协议2（MS-SMB2）是现代网络环境中实现高效、安全文件共享的关键技术，其设计考虑了性能优化、安全增强以及与多种系统的兼容性，是Windows操作系统和其他支持CIFS协议的系统进行文件共享的基础。

16 / 723

[MS-CIFS] - v20160714

Common Internet File System (CIFS) Protocol

Release: July 14, 2016

1 Introduction

The Common Internet File System (CIFS) Protocol is a cross-platform, transport-independent protocol

that provides a mechanism for client systems to use file and print services made available by server

systems over a network.

CIFS is a dialect of the Server Message Block (SMB) protocol, which was originally developed by

IBM Corporation and then further enhanced by Microsoft, IBM, Intel, 3Com, and others. There are

several dialects of SMB. A standard for the SMB protocol, covering dialects prior to CIFS, was

published by X/Open (now The Open Group) as [XOPEN-SMB].

The meaning of the term "CIFS" has changed since it was first introduced. It was originally used to

indicate a proposed standard version of SMB based upon the design of the Windows NT 4.0 operating

system and Windows 2000 operating system implementations. In some references, "CIFS" has been

used as a name for the SMB protocol in general (all dialects) and, additionally, the suite of protocols

that support and include SMB. In this document, the term "CIFS" is used specifically to identify the

Windows NT LAN Manager (NTLM) dialect of SMB as designed for use with Windows: in particular,

Windows NT Server 3.51 operating system and Windows NT Server 4.0 operating system, Windows NT

Workstation 4.0 operating system, and Microsoft Windows 98 operating system.

This document defines the protocol as it was designed for Windows NT operating system. It also

specifies the behaviors of Windows NT and Windows 98, with respect to optional behavior, and

documents known errors and variances in implementation. Changes and enhancements made to the

SMB protocol are documented in [MS-SMB].

Sections 1.5, 1.8, 1.9, 2, and 3 of this specification are normative. All other sections and examples in

this specification are informative.

1.1 Glossary

This document uses the following terms:

8.3 name: A file name string restricted in length to 12 characters that includes a base name of up

to eight characters, one character for a period, and up to three characters for a file name

extension. For more information on 8.3 file names, see [MS-CIFS] section 2.2.1.1.1.

ASCII: The American Standard Code for Information Interchange (ASCII) is an 8-bit character-

encoding scheme based on the English alphabet. ASCII codes represent text in computers,

communications equipment, and other devices that work with text. ASCII refers to a single 8-bit

ASCII character or an array of 8-bit ASCII characters with the high bit of each character set to

zero.

authentication: The ability of one entity to determine the identity of another entity.

blocking mode: Determines if input/output (I/O) operations will wait for their entire data to be

transferred before returning to the caller. For a write operation, if blocking is enabled, the write

request will not complete until the named pipe reader has consumed all of the data inserted

into the named pipe as part of a write request. If blocking is not enabled, the write will

complete as soon as the data has been inserted into the named pipe, regardless of when the

data in the named pipe is consumed. For a read operation, if blocking is enabled, the read

request will be suspended until the data is available to be read. If blocking is not enabled, the

read will complete immediately, even if there is no data available to be read.

broadcast: A style of resource location or data transmission in which a client makes a request to

all parties on a network simultaneously (a one-to-many communication). Also, a mode of

resource location that does not use a name service.

17 / 723

[MS-CIFS] - v20160714

Common Internet File System (CIFS) Protocol

Release: July 14, 2016

byte mode: One of two kinds of named pipe, the other of which is message mode. In byte

mode, the data sent or received on the named pipe does not have message boundaries but is

treated as a continuous stream. [XOPEN-SMB] uses the term stream mode instead of byte

mode, and [SMB-LM1X] refers to byte mode as byte stream mode.

Common Internet File System (CIFS): The "NT LM 0.12" / NT LAN Manager dialect of the

Server Message Block (SMB) Protocol, as implemented in Windows NT. The CIFS name

originated in the 1990's as part of an attempt to create an Internet standard for SMB, based

upon the then-current Windows NT implementation.

connection: Each user that has a session with a server can create multiple share connections, or

resource connections, using that user ID. This resource connection is created using a tree

connect Server Message Block (SMB) and is identified by an SMB TreeID or TID.

deprecated: A deprecated feature is one that has been superseded in the protocol by a newer

feature. Use of deprecated features is discouraged. Server implementations might need to

implement deprecated features to support clients that negotiate earlier SMB dialects.

dialog: The exchange of messages between client and server over a given SMB connection.

discretionary access control list (DACL): An access control list (ACL) that is controlled by the

owner of an object and that specifies the access particular users or groups can have to the

object.

disk: A persistent storage device that can include physical hard disks, removable disk units, optical

drive units, and logical unit numbers (LUNs) unmasked to the system.

Distributed File System (DFS): A file system that logically groups physical shared folders located

on different servers by transparently connecting them to one or more hierarchical namespaces.

DFS also provides fault-tolerance and load-sharing capabilities. DFS refers to the Microsoft DFS

available in Windows Server operating system platforms.

Distributed File System (DFS) namespace: A virtual view of shares on different servers as

provided by DFS. Each file in the namespace has a logical name and a corresponding address

(path). A DFS namespace consists of a root and many links and targets. The namespace starts

with a root that maps to one or more root targets. Below the root are links that map to their

own targets.

Distributed File System (DFS) path: Any Universal Naming Convention (UNC) path that

starts with a DFS root and is used for accessing a file or directory in a DFS namespace.

Distributed File System (DFS) referral: A DFS client issues a DFS referral request to a DFS

root target or a DC, depending on the DFS path accessed, to resolve a DFS root to a set of DFS

root targets, or a DFS link to a set of DFS link targets. The DFS client uses the referral request

process as needed to finally identify the actual share on a server that has accessed the leaf

component of the DFS path. The request for a DFS referral is referred to as DFS referral

request, and the response for such a request is referred to as DFS referral response.

Distributed File System (DFS) referral request: The request for a DFS referral.

Distributed File System (DFS) referral response: The response to a Distributed File System

(DFS) referral request.

encryption: In cryptography, the process of obscuring information to make it unreadable without

special knowledge.

error code: An integer that indicates success or failure. In Microsoft implementations, this is

defined as a Windows error code. A zero value indicates success; a nonzero value indicates

failure.

18 / 723

[MS-CIFS] - v20160714

Common Internet File System (CIFS) Protocol

Release: July 14, 2016

exchange: A pair of messages, consisting of a request and a response.

Fid: A 16-bit value that the Server Message Block (SMB) server uses to represent an opened

file, named pipe, printer, or device. A Fid is returned by an SMB server in response to a client

request to open or create a file, named pipe, printer, or device. The SMB server guarantees

that the Fid value returned is unique for a given SMB connection until the SMB connection is

closed, at which time the Fid value can be reused. The Fid is used by the SMB client in

subsequent SMB commands to identify the opened file, named pipe, printer, or device.

file: An entity of data in the file system that a user can access and manage. A file must have a

unique name in its directory. It consists of one or more streams of bytes that hold a set of

related data, plus a set of attributes (also called properties) that describe the file or the data

within the file. The creation time of a file is an example of a file attribute.

file attribute: A 32-bit bitmask containing information on a file's properties. For instance,

0x00000001 is used for the read-only attribute.

file system control (FSCTL): A command issued to a file system to alter or query the behavior of

the file system and/or set or query metadata that is associated with a particular file or with the

file system itself.

flags: A set of values used to configure or report options or settings.

guest account: A security account available to users who do not have an account on the

computer.

I/O control (IOCTL): A command that is issued to a target file system or target device in order

to query or alter the behavior of the target; or to query or alter the data and attributes that are

associated with the target or the objects that are exposed by the target.

information level: A number used to identify the volume, file, or device information being

requested by a client. Corresponding to each information level, the server returns a specific

structure to the client that contains different information in the response.

Internet Protocol version 6 (IPv6): A revised version of the Internet Protocol (IP) designed to

address growth on the Internet. Improvements include a 128-bit IP address size, expanded

routing capabilities, and support for authentication and privacy.

Internetwork Packet Exchange (IPX): A protocol (see [IPX]) maintained by Novell's NetWare

product that provides connectionless datagram delivery of messages. IPX is based on Xerox

Corporation's Internetwork Packet protocol, XNS.

little-endian: Multiple-byte values that are byte-ordered with the least significant byte stored in

the memory location with the lowest address.

mailslot: A mechanism for one-way interprocess communications (IPC). For more information, see

[MSLOT] and [MS-MAIL].

message mode: A named pipe can be of two types: byte mode or message mode. In byte

mode, the data sent or received on the named pipe does not have message boundaries but is

treated as a continuous Stream. In message mode, message boundaries are enforced.

named pipe: A named, one-way, or duplex pipe for communication between a pipe server and one

or more pipe clients.

NetBIOS: A particular network transport that is part of the LAN Manager protocol suite. NetBIOS

uses a broadcast communication style that was applicable to early segmented local area

networks. The LAN Manager protocols were the default in Windows NT environments prior to

Windows 2000. A protocol family including name resolution, datagram, and connection services.

For more information, see [RFC1001] and [RFC1002].

19 / 723

[MS-CIFS] - v20160714

Common Internet File System (CIFS) Protocol

Release: July 14, 2016

NetBIOS datagram service: An implementation of NetBIOS services in a datagram environment

as specified in [RFC1001] section 17.

NetBIOS name: A 16-byte address that is used to identify a NetBIOS resource on the network.

For more information, see [RFC1001] and [RFC1002].

NetBIOS Name Server (NBNS): A server that stores NetBIOS name-to-IPv4 address mappings

and that resolves NetBIOS names for NBT-enabled hosts. A server running the Windows

Internet Name Service (WINS) is the Microsoft implementation of an NBNS.

network address translation (NAT): The process of converting between IP addresses used

within an intranet, or other private network, and Internet IP addresses.

non-blocking mode (of a named pipe): Determines if input/output (I/O) operations on a

named pipe will return to the caller without waiting for the data transfer to complete. When

non-blocking mode is set, read requests return with all data available to be read from the

named pipe, up to the maximum read size set in the request; write requests return after writing

data to the named pipe without waiting for the data to be consumed.

NT file system (NTFS): A proprietary Microsoft file system. For more information, see [MSFT-

NTFS].

NT LAN Manager (NTLM): A Microsoft authentication protocol that is based on a challenge-

response sequence for authentication. NT refers to the Windows operating system. For more

information, see [MS-NLMP].

object store: A system that provides the ability to create, query, modify, or apply policy to a local

resource on behalf of a remote client. The object store is backed by a file system, a named pipe,

or a print job that is accessed as a file.

Obsolescent: A feature that has no replacement but is becoming obsolete. Although the use of

obsolescent features is discouraged, server implementations might need to implement them to

support clients that negotiate earlier SMB dialects.

obsolete: An obsolete feature is one that was introduced in an earlier dialect but that is no longer

supported in the NT LAN Manager dialect. Support for obsolete features is to be avoided in new

implementations.

open: A runtime object that corresponds to a currently established access to a specific file or a

named pipe from a specific client to a specific server, using a specific user security context. Both

clients and servers maintain opens that represent active accesses.

oplock break: An unsolicited request sent by a Server Message Block (SMB) server to an SMB

client to inform the client to change the oplock level for a file.

opportunistic lock (oplock): A mechanism designed to allow clients to dynamically alter their

buffering strategy in a consistent manner to increase performance and reduce network use. The

network performance for remote file operations may be increased if a client can locally buffer file

data, which reduces or eliminates the need to send and receive network packets. For example, a

client may not have to write information into a file on a remote server if the client knows that no

other process is accessing the data. Likewise, the client may buffer read-ahead data from the

remote file if the client knows that no other process is writing data to the remote file. There are

three types of oplocks: Exclusive oplock allows a client to open a file for exclusive access and

allows the client to perform arbitrary buffering. Batch oplock allows a client to keep a file open

on the server even though the local accessor on the client machine has closed the file. Level II

oplock indicates that there are multiple readers of a file and no writers. Level II Oplocks are

supported if the negotiated SMB Dialect is NT LM 0.12 or later. When a client opens a file, it

requests the server to grant it a particular type of oplock on the file. The response from the

server indicates the type of oplock granted to the client. The client uses the granted oplock

type to adjust its buffering policy.

20 / 723

[MS-CIFS] - v20160714

Common Internet File System (CIFS) Protocol

Release: July 14, 2016

original equipment manufacturer (OEM) character: An 8-bit encoding used in MS-DOS and

Windows operating systems to associate a sequence of bits with specific characters. The ASCII

character set maps the letters, numerals, and specified punctuation and control characters to

the numbers from 0 to 127. The term "code page" is used to refer to extensions of the ASCII

character set that map specified characters and symbols to the numbers from 128 to 255. These

code pages are referred to as OEM character sets. For more information, see [MSCHARSET].

original equipment manufacturer (OEM) character set: A character encoding used where the

mappings between characters is dependent upon the code page configured on the machine,

typically by the manufacturer.

path: When referring to a file path on a file system, a hierarchical sequence of folders. When

referring to a connection to a storage device, a connection through which a machine can

communicate with the storage device.

pipe instance: A request to open a named pipe by a client application. Multiple Server Message

Block (SMB) clients can open the same named pipe. Each request to open the same named

pipe is a pipe instance.

pipe state: A series of attributes that describe how the pipe interacts with processes for various

input/output (I/O) operations and that indicate how much data is currently available to be read

from the named pipe.

print job: The rendered page description language (PDL) output data sent to a print device for a

particular application or user request.

process identifier (PID): A nonzero integer used by some operating systems (for example,

Windows and UNIX) to uniquely identify a process. For more information, see [PROCESS].

raw read (on a named pipe): The act of reading data from a named pipe that ignores message

boundaries even if the pipe was set up as a message mode pipe.

RPC client: A computer on the network that sends messages using remote procedure call (RPC) as

its transport, waits for responses, and is the initiator in an RPC exchange.

RPC server: A computer on the network that waits for messages, processes them when they

arrive, and sends responses using RPC as its transport acts as the responder during a remote

procedure call (RPC) exchange.

security context: An abstract data structure that contains authorization information for a

particular security principal in the form of a Token/Authorization Context (see [MS-DTYP] section

2.5.2). A server uses the authorization information in a security context to check access to

requested resources. A security context also contains a key identifier that associates mutually

established cryptographic keys, along with other information needed to perform secure

communication with another security principal.

security descriptor: A data structure containing the security information associated with a

securable object. A security descriptor identifies an object's owner by its security identifier

(SID). If access control is configured for the object, its security descriptor contains a

discretionary access control list (DACL) with SIDs for the security principals who are

allowed or denied access. Applications use this structure to set and query an object's security

status. The security descriptor is used to guard access to an object as well as to control which

type of auditing takes place when the object is accessed. The security descriptor format is

specified in [MS-DTYP] section 2.4.6; a string representation of security descriptors, called

SDDL, is specified in [MS-DTYP] section 2.5.1.

Server Message Block (SMB): A protocol that is used to request file and print services from

server systems over a network. The SMB protocol extends the CIFS protocol with additional

security, file, and disk management support. For more information, see [CIFS] and [MS-SMB].

剩余722页未读，继续阅读

Alvin-leon

粉丝: 4
资源: 2

CIFS协议详解：微软文件共享通信规范

微软文件共享协议

windows共享文件协议

smb协议 访问共享文件

局域网文件共享软件 c#源码

xp的smbv1共享协议如何访问win10

微软什么API可以设置局域网共享文件夹

samba共享文件windows无法访问

win10打印机共享补丁

cifs和smb的区别

cifs 和nfs 挂载是一样的吗

最新资源

smb协议访问共享文件