SMB2 TREE_CONNECT response MaximalAccess: file or directory access mask?

Question

SMB2 TREE_CONNECT response MaximalAccess: file or directory access mask?

Diederick Niehorster 1

I have hacked impacket a bit to provide access to the MaximalAccess field in the SMB2 TREE_CONNECT Response. However, I am wondering how to interpret this field. The docs say

Contains the maximal access for the user that establishes the tree connect  
on the share based on the share's permissions. This value takes the form as  
specified in section 2.2.13.1.

and 2.2.13.1 says:

The SMB2 Access Mask Encoding in SMB2 is a 4-byte bit field value that  
contains an array of flags. An access mask can specify access for one of two  
basic groups: either for a file, pipe, or printer (specified in section  
2.2.13.1.1) or for a directory (specified in section 2.2.13.1.2). Each  
access mask MUST be a combination of zero or more of the bit positions  
that are shown below.

So is the MaximalAccess mask one for file, pipe, or printer, or for a directory?
This question is also posted at https://stackoverflow.com/questions/74546047

Sreekanth Nadendla 491 Reputation points Microsoft Employee Moderator

2022-11-28T17:30:12.783+00:00

Hello DiederickNiehorster-8895, the MaximalAccess mask applies to the ShareType in the request i.e. it can a Pipe, Printer or simply the file share.

The SMB 2 Protocol defines three types of shares: file (or disk) shares, which represent a directory tree and its included files; pipe shares, which expose access to named pipes; and print shares, which provide access to print resources on the server. A pipe share as defined by the SMB 2 Protocol must always have the name "IPC$".

Regards,
Sreekanth Nadendla
Microsoft Windows Open Specifications
Diederick Niehorster 1 Reputation point

2022-11-28T20:12:11.627+00:00

Hi Sreekanth,

Thank you, that makes sense. Should the docs/specification then be updated to read:
Contains the maximal access for the user that establishes the tree connect
on the share based on the share's permissions. This value takes the form as
specified in section 2.2.13.1.1.

? So that is, explicitly referring to File_Pipe_Printer_Access_Mask?

Thanks and all the best,
Dee

1 answer

Your answer

Sreekanth Nadendla 491 Reputation points Microsoft Employee Moderator

2022-11-28T17:30:12.783+00:00

Hello DiederickNiehorster-8895, the MaximalAccess mask applies to the ShareType in the request i.e. it can a Pipe, Printer or simply the file share.

The SMB 2 Protocol defines three types of shares: file (or disk) shares, which represent a directory tree and its included files; pipe shares, which expose access to named pipes; and print shares, which provide access to print resources on the server. A pipe share as defined by the SMB 2 Protocol must always have the name "IPC$".

Regards,
Sreekanth Nadendla
Microsoft Windows Open Specifications
Diederick Niehorster 1 Reputation point

2022-11-28T20:12:11.627+00:00

Hi Sreekanth,

Thank you, that makes sense. Should the docs/specification then be updated to read:
Contains the maximal access for the user that establishes the tree connect
on the share based on the share's permissions. This value takes the form as
specified in section 2.2.13.1.1.

? So that is, explicitly referring to File_Pipe_Printer_Access_Mask?

Thanks and all the best,
Dee

Answer 1

Sreekanth Nadendla 491 Microsoft Employee Moderator

Hello DiederickNiehorster-8895, thank you for your question regarding Microsoft Windows Open Specifications. We will review your question and post an update here soon.

Regards,
Sreekanth Nadendla
Microsoft Windows Open Specifications

Share via

SMB2 TREE_CONNECT response MaximalAccess: file or directory access mask?

1 answer

Your answer