2.2.4.6.2 Server Response Extensions

When extended security is being used (see section 3.2.4.2.4), a successful response MUST take the following form. Aside from the SecurityBlobLength field, the additional capabilities used in the Capabilities field, the ByteCount and SecurityBlob fields, and the omission of the PrimaryDomain field, all of the other fields are as specified in [MS-CIFS] section 2.2.4.53.2.

 SMB_Parameters
   {
   UCHAR  WordCount;
   Words
     {
     UCHAR  AndXCommand;
     UCHAR  AndXReserved;
     USHORT AndXOffset;
     USHORT Action;
     USHORT SecurityBlobLength;
     }
   }
 SMB_Data
   {
   USHORT ByteCount;
   Bytes
     {
     UCHAR      SecurityBlob[SecurityBlobLength];
     UCHAR      Pad[];
     SMB_STRING NativeOS[];
     SMB_STRING NativeLanMan[];
            
     }
   }

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
SMB_Parameters
...
...								SMB_Data (variable)
...

SMB_Parameters (9 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
WordCount								Words
...
...

WordCount (1 byte): The value of this field MUST be 0x04.

Words (8 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
AndXCommand								AndXReserved								AndXOffset
Action																SecurityBlobLength

Action (2 bytes): A 16-bit field. The two lowest-order bits have been defined.

Name and bitmask	Meaning
SMB_SETUP_GUEST 0x0001	If clear (0), then the user successfully authenticated and is logged in. If set (1), then authentication failed but the server has granted guest access; the user is logged in as a Guest.
SMB_SETUP_USE_LANMAN_KEY 0x0002	This bit is not used with extended security and MUST be clear.

The server's response does not specify whether the access granted is of type Anonymous. However, the security system can provide that information once authorization completes.

SecurityBlobLength (2 bytes): This value MUST specify the length, in bytes, of the variable-length SecurityBlob that is contained within the response.

SMB_Data (variable):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
ByteCount																Bytes (variable)
...

ByteCount (2 bytes): If SMB_FLAGS2_UNICODE is set in the SMB_Header.Flags2 field, then this field MUST be greater than or equal to 0x0006. If SMB_FLAGS2_UNICODE is not set, then this field MUST be greater than or equal to 0x0003.

Bytes (variable):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
SecurityBlob (variable)
...
Pad (variable)
...
NativeOS (variable)
...
NativeLanMan (variable)
...

SecurityBlob (variable): This value MUST contain the authentication token being returned to the client, as specified in section 3.3.5.3 and [RFC2743].

NativeOS (variable): A string that represents the native operating system of the server. If SMB_FLAGS2_UNICODE is set in the Flags2 field of the SMB header of the response, then the string MUST be a NULL-terminated array of 16-bit Unicode characters. Otherwise, the string MUST be a NULL-terminated array of OEM characters. If the name string consists of Unicode characters, then this field MUST be aligned to start on a 2-byte boundary from the start of the SMB header.

NativeLanMan (variable): A string that represents the native LAN Manager type of the server. If SMB_FLAGS2_UNICODE is set in the Flags2 field of the SMB header of the response, then the string MUST be a NULL-terminated array of 16-bit Unicode characters. Otherwise, the string MUST be a NULL-terminated array of OEM characters. If the name string consists of Unicode characters, then this field MUST be aligned to start on a 2-byte boundary from the start of the SMB header.<46>