• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /***************************************************************************
2  *                                  _   _ ____  _
3  *  Project                     ___| | | |  _ \| |
4  *                             / __| | | | |_) | |
5  *                            | (__| |_| |  _ <| |___
6  *                             \___|\___/|_| \_\_____|
7  *
8  * Copyright (C) 2014, Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
9  * Copyright (C) 2016-2018, Daniel Stenberg, <daniel@haxx.se>, et al.
10  *
11  * This software is licensed as described in the file COPYING, which
12  * you should have received as part of this distribution. The terms
13  * are also available at https://curl.haxx.se/docs/copyright.html.
14  *
15  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16  * copies of the Software, and permit persons to whom the Software is
17  * furnished to do so, under the terms of the COPYING file.
18  *
19  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20  * KIND, either express or implied.
21  *
22  ***************************************************************************/
23 
24 #include "curl_setup.h"
25 
26 #if !defined(CURL_DISABLE_SMB) && defined(USE_NTLM) &&  \
27   (CURL_SIZEOF_CURL_OFF_T > 4)
28 
29 #if !defined(USE_WINDOWS_SSPI) || defined(USE_WIN32_CRYPTO)
30 
31 #define BUILDING_CURL_SMB_C
32 
33 #ifdef HAVE_PROCESS_H
34 #include <process.h>
35 #ifdef CURL_WINDOWS_APP
36 #define getpid GetCurrentProcessId
37 #elif !defined(MSDOS)
38 #define getpid _getpid
39 #endif
40 #endif
41 
42 #include "smb.h"
43 #include "urldata.h"
44 #include "sendf.h"
45 #include "multiif.h"
46 #include "connect.h"
47 #include "progress.h"
48 #include "transfer.h"
49 #include "vtls/vtls.h"
50 #include "curl_ntlm_core.h"
51 #include "escape.h"
52 #include "curl_endian.h"
53 
54 /* The last #include files should be: */
55 #include "curl_memory.h"
56 #include "memdebug.h"
57 
58 /* Local API functions */
59 static CURLcode smb_setup_connection(struct connectdata *conn);
60 static CURLcode smb_connect(struct connectdata *conn, bool *done);
61 static CURLcode smb_connection_state(struct connectdata *conn, bool *done);
62 static CURLcode smb_do(struct connectdata *conn, bool *done);
63 static CURLcode smb_request_state(struct connectdata *conn, bool *done);
64 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
65                          bool premature);
66 static CURLcode smb_disconnect(struct connectdata *conn, bool dead);
67 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
68                        int numsocks);
69 static CURLcode smb_parse_url_path(struct connectdata *conn);
70 
71 /*
72  * SMB handler interface
73  */
74 const struct Curl_handler Curl_handler_smb = {
75   "SMB",                                /* scheme */
76   smb_setup_connection,                 /* setup_connection */
77   smb_do,                               /* do_it */
78   smb_done,                             /* done */
79   ZERO_NULL,                            /* do_more */
80   smb_connect,                          /* connect_it */
81   smb_connection_state,                 /* connecting */
82   smb_request_state,                    /* doing */
83   smb_getsock,                          /* proto_getsock */
84   smb_getsock,                          /* doing_getsock */
85   ZERO_NULL,                            /* domore_getsock */
86   ZERO_NULL,                            /* perform_getsock */
87   smb_disconnect,                       /* disconnect */
88   ZERO_NULL,                            /* readwrite */
89   ZERO_NULL,                            /* connection_check */
90   PORT_SMB,                             /* defport */
91   CURLPROTO_SMB,                        /* protocol */
92   PROTOPT_NONE                          /* flags */
93 };
94 
95 #ifdef USE_SSL
96 /*
97  * SMBS handler interface
98  */
99 const struct Curl_handler Curl_handler_smbs = {
100   "SMBS",                               /* scheme */
101   smb_setup_connection,                 /* setup_connection */
102   smb_do,                               /* do_it */
103   smb_done,                             /* done */
104   ZERO_NULL,                            /* do_more */
105   smb_connect,                          /* connect_it */
106   smb_connection_state,                 /* connecting */
107   smb_request_state,                    /* doing */
108   smb_getsock,                          /* proto_getsock */
109   smb_getsock,                          /* doing_getsock */
110   ZERO_NULL,                            /* domore_getsock */
111   ZERO_NULL,                            /* perform_getsock */
112   smb_disconnect,                       /* disconnect */
113   ZERO_NULL,                            /* readwrite */
114   ZERO_NULL,                            /* connection_check */
115   PORT_SMBS,                            /* defport */
116   CURLPROTO_SMBS,                       /* protocol */
117   PROTOPT_SSL                           /* flags */
118 };
119 #endif
120 
121 #define MAX_PAYLOAD_SIZE  0x8000
122 #define MAX_MESSAGE_SIZE  (MAX_PAYLOAD_SIZE + 0x1000)
123 #define CLIENTNAME        "curl"
124 #define SERVICENAME       "?????"
125 
126 /* Append a string to an SMB message */
127 #define MSGCAT(str)                             \
128   strcpy(p, (str));                             \
129   p += strlen(str);
130 
131 /* Append a null-terminated string to an SMB message */
132 #define MSGCATNULL(str)                         \
133   strcpy(p, (str));                             \
134   p += strlen(str) + 1;
135 
136 /* SMB is mostly little endian */
137 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
138   defined(__OS400__)
smb_swap16(unsigned short x)139 static unsigned short smb_swap16(unsigned short x)
140 {
141   return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
142 }
143 
smb_swap32(unsigned int x)144 static unsigned int smb_swap32(unsigned int x)
145 {
146   return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
147     ((x >> 24) & 0xff);
148 }
149 
smb_swap64(curl_off_t x)150 static curl_off_t smb_swap64(curl_off_t x)
151 {
152   return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
153     smb_swap32((unsigned int) (x >> 32));
154 }
155 
156 #else
157 #  define smb_swap16(x) (x)
158 #  define smb_swap32(x) (x)
159 #  define smb_swap64(x) (x)
160 #endif
161 
162 /* SMB request state */
163 enum smb_req_state {
164   SMB_REQUESTING,
165   SMB_TREE_CONNECT,
166   SMB_OPEN,
167   SMB_DOWNLOAD,
168   SMB_UPLOAD,
169   SMB_CLOSE,
170   SMB_TREE_DISCONNECT,
171   SMB_DONE
172 };
173 
174 /* SMB request data */
175 struct smb_request {
176   enum smb_req_state state;
177   char *path;
178   unsigned short tid; /* Even if we connect to the same tree as another */
179   unsigned short fid; /* request, the tid will be different */
180   CURLcode result;
181 };
182 
conn_state(struct connectdata * conn,enum smb_conn_state newstate)183 static void conn_state(struct connectdata *conn, enum smb_conn_state newstate)
184 {
185   struct smb_conn *smbc = &conn->proto.smbc;
186 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
187   /* For debug purposes */
188   static const char * const names[] = {
189     "SMB_NOT_CONNECTED",
190     "SMB_CONNECTING",
191     "SMB_NEGOTIATE",
192     "SMB_SETUP",
193     "SMB_CONNECTED",
194     /* LAST */
195   };
196 
197   if(smbc->state != newstate)
198     infof(conn->data, "SMB conn %p state change from %s to %s\n",
199           (void *)smbc, names[smbc->state], names[newstate]);
200 #endif
201 
202   smbc->state = newstate;
203 }
204 
request_state(struct connectdata * conn,enum smb_req_state newstate)205 static void request_state(struct connectdata *conn,
206                           enum smb_req_state newstate)
207 {
208   struct smb_request *req = conn->data->req.protop;
209 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
210   /* For debug purposes */
211   static const char * const names[] = {
212     "SMB_REQUESTING",
213     "SMB_TREE_CONNECT",
214     "SMB_OPEN",
215     "SMB_DOWNLOAD",
216     "SMB_UPLOAD",
217     "SMB_CLOSE",
218     "SMB_TREE_DISCONNECT",
219     "SMB_DONE",
220     /* LAST */
221   };
222 
223   if(req->state != newstate)
224     infof(conn->data, "SMB request %p state change from %s to %s\n",
225           (void *)req, names[req->state], names[newstate]);
226 #endif
227 
228   req->state = newstate;
229 }
230 
231 /* this should setup things in the connection, not in the easy
232    handle */
smb_setup_connection(struct connectdata * conn)233 static CURLcode smb_setup_connection(struct connectdata *conn)
234 {
235   struct smb_request *req;
236 
237   /* Initialize the request state */
238   conn->data->req.protop = req = calloc(1, sizeof(struct smb_request));
239   if(!req)
240     return CURLE_OUT_OF_MEMORY;
241 
242   /* Parse the URL path */
243   return smb_parse_url_path(conn);
244 }
245 
smb_connect(struct connectdata * conn,bool * done)246 static CURLcode smb_connect(struct connectdata *conn, bool *done)
247 {
248   struct smb_conn *smbc = &conn->proto.smbc;
249   char *slash;
250 
251   (void) done;
252 
253   /* Check we have a username and password to authenticate with */
254   if(!conn->bits.user_passwd)
255     return CURLE_LOGIN_DENIED;
256 
257   /* Initialize the connection state */
258   smbc->state = SMB_CONNECTING;
259   smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
260   if(!smbc->recv_buf)
261     return CURLE_OUT_OF_MEMORY;
262 
263   /* Multiple requests are allowed with this connection */
264   connkeep(conn, "SMB default");
265 
266   /* Parse the username, domain, and password */
267   slash = strchr(conn->user, '/');
268   if(!slash)
269     slash = strchr(conn->user, '\\');
270 
271   if(slash) {
272     smbc->user = slash + 1;
273     smbc->domain = strdup(conn->user);
274     if(!smbc->domain)
275       return CURLE_OUT_OF_MEMORY;
276     smbc->domain[slash - conn->user] = 0;
277   }
278   else {
279     smbc->user = conn->user;
280     smbc->domain = strdup(conn->host.name);
281     if(!smbc->domain)
282       return CURLE_OUT_OF_MEMORY;
283   }
284 
285   return CURLE_OK;
286 }
287 
smb_recv_message(struct connectdata * conn,void ** msg)288 static CURLcode smb_recv_message(struct connectdata *conn, void **msg)
289 {
290   struct smb_conn *smbc = &conn->proto.smbc;
291   char *buf = smbc->recv_buf;
292   ssize_t bytes_read;
293   size_t nbt_size;
294   size_t msg_size;
295   size_t len = MAX_MESSAGE_SIZE - smbc->got;
296   CURLcode result;
297 
298   result = Curl_read(conn, FIRSTSOCKET, buf + smbc->got, len, &bytes_read);
299   if(result)
300     return result;
301 
302   if(!bytes_read)
303     return CURLE_OK;
304 
305   smbc->got += bytes_read;
306 
307   /* Check for a 32-bit nbt header */
308   if(smbc->got < sizeof(unsigned int))
309     return CURLE_OK;
310 
311   nbt_size = Curl_read16_be((const unsigned char *)
312                             (buf + sizeof(unsigned short))) +
313     sizeof(unsigned int);
314   if(smbc->got < nbt_size)
315     return CURLE_OK;
316 
317   msg_size = sizeof(struct smb_header);
318   if(nbt_size >= msg_size + 1) {
319     /* Add the word count */
320     msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
321     if(nbt_size >= msg_size + sizeof(unsigned short)) {
322       /* Add the byte count */
323       msg_size += sizeof(unsigned short) +
324         Curl_read16_le((const unsigned char *)&buf[msg_size]);
325       if(nbt_size < msg_size)
326         return CURLE_READ_ERROR;
327     }
328   }
329 
330   *msg = buf;
331 
332   return CURLE_OK;
333 }
334 
smb_pop_message(struct connectdata * conn)335 static void smb_pop_message(struct connectdata *conn)
336 {
337   struct smb_conn *smbc = &conn->proto.smbc;
338 
339   smbc->got = 0;
340 }
341 
smb_format_message(struct connectdata * conn,struct smb_header * h,unsigned char cmd,size_t len)342 static void smb_format_message(struct connectdata *conn, struct smb_header *h,
343                                unsigned char cmd, size_t len)
344 {
345   struct smb_conn *smbc = &conn->proto.smbc;
346   struct smb_request *req = conn->data->req.protop;
347   unsigned int pid;
348 
349   memset(h, 0, sizeof(*h));
350   h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
351                                           len));
352   memcpy((char *)h->magic, "\xffSMB", 4);
353   h->command = cmd;
354   h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
355   h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
356   h->uid = smb_swap16(smbc->uid);
357   h->tid = smb_swap16(req->tid);
358   pid = getpid();
359   h->pid_high = smb_swap16((unsigned short)(pid >> 16));
360   h->pid = smb_swap16((unsigned short) pid);
361 }
362 
smb_send(struct connectdata * conn,ssize_t len,size_t upload_size)363 static CURLcode smb_send(struct connectdata *conn, ssize_t len,
364                          size_t upload_size)
365 {
366   struct smb_conn *smbc = &conn->proto.smbc;
367   ssize_t bytes_written;
368   CURLcode result;
369 
370   result = Curl_write(conn, FIRSTSOCKET, conn->data->state.ulbuf,
371                       len, &bytes_written);
372   if(result)
373     return result;
374 
375   if(bytes_written != len) {
376     smbc->send_size = len;
377     smbc->sent = bytes_written;
378   }
379 
380   smbc->upload_size = upload_size;
381 
382   return CURLE_OK;
383 }
384 
smb_flush(struct connectdata * conn)385 static CURLcode smb_flush(struct connectdata *conn)
386 {
387   struct smb_conn *smbc = &conn->proto.smbc;
388   ssize_t bytes_written;
389   ssize_t len = smbc->send_size - smbc->sent;
390   CURLcode result;
391 
392   if(!smbc->send_size)
393     return CURLE_OK;
394 
395   result = Curl_write(conn, FIRSTSOCKET,
396                       conn->data->state.ulbuf + smbc->sent,
397                       len, &bytes_written);
398   if(result)
399     return result;
400 
401   if(bytes_written != len)
402     smbc->sent += bytes_written;
403   else
404     smbc->send_size = 0;
405 
406   return CURLE_OK;
407 }
408 
smb_send_message(struct connectdata * conn,unsigned char cmd,const void * msg,size_t msg_len)409 static CURLcode smb_send_message(struct connectdata *conn, unsigned char cmd,
410                                  const void *msg, size_t msg_len)
411 {
412   CURLcode result = Curl_get_upload_buffer(conn->data);
413   if(result)
414     return result;
415   smb_format_message(conn, (struct smb_header *)conn->data->state.ulbuf,
416                      cmd, msg_len);
417   memcpy(conn->data->state.ulbuf + sizeof(struct smb_header),
418          msg, msg_len);
419 
420   return smb_send(conn, sizeof(struct smb_header) + msg_len, 0);
421 }
422 
smb_send_negotiate(struct connectdata * conn)423 static CURLcode smb_send_negotiate(struct connectdata *conn)
424 {
425   const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
426 
427   return smb_send_message(conn, SMB_COM_NEGOTIATE, msg, 15);
428 }
429 
smb_send_setup(struct connectdata * conn)430 static CURLcode smb_send_setup(struct connectdata *conn)
431 {
432   struct smb_conn *smbc = &conn->proto.smbc;
433   struct smb_setup msg;
434   char *p = msg.bytes;
435   unsigned char lm_hash[21];
436   unsigned char lm[24];
437   unsigned char nt_hash[21];
438   unsigned char nt[24];
439 
440   size_t byte_count = sizeof(lm) + sizeof(nt);
441   byte_count += strlen(smbc->user) + strlen(smbc->domain);
442   byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
443   if(byte_count > sizeof(msg.bytes))
444     return CURLE_FILESIZE_EXCEEDED;
445 
446   Curl_ntlm_core_mk_lm_hash(conn->data, conn->passwd, lm_hash);
447   Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
448 #ifdef USE_NTRESPONSES
449   Curl_ntlm_core_mk_nt_hash(conn->data, conn->passwd, nt_hash);
450   Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
451 #else
452   memset(nt, 0, sizeof(nt));
453 #endif
454 
455   memset(&msg, 0, sizeof(msg));
456   msg.word_count = SMB_WC_SETUP_ANDX;
457   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
458   msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
459   msg.max_mpx_count = smb_swap16(1);
460   msg.vc_number = smb_swap16(1);
461   msg.session_key = smb_swap32(smbc->session_key);
462   msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
463   msg.lengths[0] = smb_swap16(sizeof(lm));
464   msg.lengths[1] = smb_swap16(sizeof(nt));
465   memcpy(p, lm, sizeof(lm));
466   p += sizeof(lm);
467   memcpy(p, nt, sizeof(nt));
468   p += sizeof(nt);
469   MSGCATNULL(smbc->user);
470   MSGCATNULL(smbc->domain);
471   MSGCATNULL(OS);
472   MSGCATNULL(CLIENTNAME);
473   byte_count = p - msg.bytes;
474   msg.byte_count = smb_swap16((unsigned short)byte_count);
475 
476   return smb_send_message(conn, SMB_COM_SETUP_ANDX, &msg,
477                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
478 }
479 
smb_send_tree_connect(struct connectdata * conn)480 static CURLcode smb_send_tree_connect(struct connectdata *conn)
481 {
482   struct smb_tree_connect msg;
483   struct smb_conn *smbc = &conn->proto.smbc;
484   char *p = msg.bytes;
485 
486   size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
487   byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
488   if(byte_count > sizeof(msg.bytes))
489     return CURLE_FILESIZE_EXCEEDED;
490 
491   memset(&msg, 0, sizeof(msg));
492   msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
493   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
494   msg.pw_len = 0;
495   MSGCAT("\\\\");
496   MSGCAT(conn->host.name);
497   MSGCAT("\\");
498   MSGCATNULL(smbc->share);
499   MSGCATNULL(SERVICENAME); /* Match any type of service */
500   byte_count = p - msg.bytes;
501   msg.byte_count = smb_swap16((unsigned short)byte_count);
502 
503   return smb_send_message(conn, SMB_COM_TREE_CONNECT_ANDX, &msg,
504                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
505 }
506 
smb_send_open(struct connectdata * conn)507 static CURLcode smb_send_open(struct connectdata *conn)
508 {
509   struct smb_request *req = conn->data->req.protop;
510   struct smb_nt_create msg;
511   size_t byte_count;
512 
513   if((strlen(req->path) + 1) > sizeof(msg.bytes))
514     return CURLE_FILESIZE_EXCEEDED;
515 
516   memset(&msg, 0, sizeof(msg));
517   msg.word_count = SMB_WC_NT_CREATE_ANDX;
518   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
519   byte_count = strlen(req->path);
520   msg.name_length = smb_swap16((unsigned short)byte_count);
521   msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
522   if(conn->data->set.upload) {
523     msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
524     msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
525   }
526   else {
527     msg.access = smb_swap32(SMB_GENERIC_READ);
528     msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
529   }
530   msg.byte_count = smb_swap16((unsigned short) ++byte_count);
531   strcpy(msg.bytes, req->path);
532 
533   return smb_send_message(conn, SMB_COM_NT_CREATE_ANDX, &msg,
534                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
535 }
536 
smb_send_close(struct connectdata * conn)537 static CURLcode smb_send_close(struct connectdata *conn)
538 {
539   struct smb_request *req = conn->data->req.protop;
540   struct smb_close msg;
541 
542   memset(&msg, 0, sizeof(msg));
543   msg.word_count = SMB_WC_CLOSE;
544   msg.fid = smb_swap16(req->fid);
545 
546   return smb_send_message(conn, SMB_COM_CLOSE, &msg, sizeof(msg));
547 }
548 
smb_send_tree_disconnect(struct connectdata * conn)549 static CURLcode smb_send_tree_disconnect(struct connectdata *conn)
550 {
551   struct smb_tree_disconnect msg;
552 
553   memset(&msg, 0, sizeof(msg));
554 
555   return smb_send_message(conn, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
556 }
557 
smb_send_read(struct connectdata * conn)558 static CURLcode smb_send_read(struct connectdata *conn)
559 {
560   struct smb_request *req = conn->data->req.protop;
561   curl_off_t offset = conn->data->req.offset;
562   struct smb_read msg;
563 
564   memset(&msg, 0, sizeof(msg));
565   msg.word_count = SMB_WC_READ_ANDX;
566   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
567   msg.fid = smb_swap16(req->fid);
568   msg.offset = smb_swap32((unsigned int) offset);
569   msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
570   msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
571   msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
572 
573   return smb_send_message(conn, SMB_COM_READ_ANDX, &msg, sizeof(msg));
574 }
575 
smb_send_write(struct connectdata * conn)576 static CURLcode smb_send_write(struct connectdata *conn)
577 {
578   struct smb_write *msg;
579   struct smb_request *req = conn->data->req.protop;
580   curl_off_t offset = conn->data->req.offset;
581   curl_off_t upload_size = conn->data->req.size - conn->data->req.bytecount;
582   CURLcode result = Curl_get_upload_buffer(conn->data);
583   if(result)
584     return result;
585   msg = (struct smb_write *)conn->data->state.ulbuf;
586 
587   if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
588     upload_size = MAX_PAYLOAD_SIZE - 1;
589 
590   memset(msg, 0, sizeof(*msg));
591   msg->word_count = SMB_WC_WRITE_ANDX;
592   msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
593   msg->fid = smb_swap16(req->fid);
594   msg->offset = smb_swap32((unsigned int) offset);
595   msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
596   msg->data_length = smb_swap16((unsigned short) upload_size);
597   msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
598   msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
599 
600   smb_format_message(conn, &msg->h, SMB_COM_WRITE_ANDX,
601                      sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
602 
603   return smb_send(conn, sizeof(*msg), (size_t) upload_size);
604 }
605 
smb_send_and_recv(struct connectdata * conn,void ** msg)606 static CURLcode smb_send_and_recv(struct connectdata *conn, void **msg)
607 {
608   struct smb_conn *smbc = &conn->proto.smbc;
609   CURLcode result;
610 
611   /* Check if there is data in the transfer buffer */
612   if(!smbc->send_size && smbc->upload_size) {
613     size_t nread = smbc->upload_size > conn->data->set.upload_buffer_size ?
614       conn->data->set.upload_buffer_size :
615       smbc->upload_size;
616     conn->data->req.upload_fromhere = conn->data->state.ulbuf;
617     result = Curl_fillreadbuffer(conn, nread, &nread);
618     if(result && result != CURLE_AGAIN)
619       return result;
620     if(!nread)
621       return CURLE_OK;
622 
623     smbc->upload_size -= nread;
624     smbc->send_size = nread;
625     smbc->sent = 0;
626   }
627 
628   /* Check if there is data to send */
629   if(smbc->send_size) {
630     result = smb_flush(conn);
631     if(result)
632       return result;
633   }
634 
635   /* Check if there is still data to be sent */
636   if(smbc->send_size || smbc->upload_size)
637     return CURLE_AGAIN;
638 
639   return smb_recv_message(conn, msg);
640 }
641 
smb_connection_state(struct connectdata * conn,bool * done)642 static CURLcode smb_connection_state(struct connectdata *conn, bool *done)
643 {
644   struct smb_conn *smbc = &conn->proto.smbc;
645   struct smb_negotiate_response *nrsp;
646   struct smb_header *h;
647   CURLcode result;
648   void *msg = NULL;
649 
650   if(smbc->state == SMB_CONNECTING) {
651 #ifdef USE_SSL
652     if((conn->handler->flags & PROTOPT_SSL)) {
653       bool ssl_done = FALSE;
654       result = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &ssl_done);
655       if(result && result != CURLE_AGAIN)
656         return result;
657       if(!ssl_done)
658         return CURLE_OK;
659     }
660 #endif
661 
662     result = smb_send_negotiate(conn);
663     if(result) {
664       connclose(conn, "SMB: failed to send negotiate message");
665       return result;
666     }
667 
668     conn_state(conn, SMB_NEGOTIATE);
669   }
670 
671   /* Send the previous message and check for a response */
672   result = smb_send_and_recv(conn, &msg);
673   if(result && result != CURLE_AGAIN) {
674     connclose(conn, "SMB: failed to communicate");
675     return result;
676   }
677 
678   if(!msg)
679     return CURLE_OK;
680 
681   h = msg;
682 
683   switch(smbc->state) {
684   case SMB_NEGOTIATE:
685     if(h->status || smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) {
686       connclose(conn, "SMB: negotiation failed");
687       return CURLE_COULDNT_CONNECT;
688     }
689     nrsp = msg;
690     memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
691     smbc->session_key = smb_swap32(nrsp->session_key);
692     result = smb_send_setup(conn);
693     if(result) {
694       connclose(conn, "SMB: failed to send setup message");
695       return result;
696     }
697     conn_state(conn, SMB_SETUP);
698     break;
699 
700   case SMB_SETUP:
701     if(h->status) {
702       connclose(conn, "SMB: authentication failed");
703       return CURLE_LOGIN_DENIED;
704     }
705     smbc->uid = smb_swap16(h->uid);
706     conn_state(conn, SMB_CONNECTED);
707     *done = true;
708     break;
709 
710   default:
711     smb_pop_message(conn);
712     return CURLE_OK; /* ignore */
713   }
714 
715   smb_pop_message(conn);
716 
717   return CURLE_OK;
718 }
719 
720 /*
721  * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
722  * to Posix time. Cap the output to fit within a time_t.
723  */
get_posix_time(time_t * out,curl_off_t timestamp)724 static void get_posix_time(time_t *out, curl_off_t timestamp)
725 {
726   timestamp -= 116444736000000000;
727   timestamp /= 10000000;
728 #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
729   if(timestamp > TIME_T_MAX)
730     *out = TIME_T_MAX;
731   else if(timestamp < TIME_T_MIN)
732     *out = TIME_T_MIN;
733   else
734 #endif
735     *out = (time_t) timestamp;
736 }
737 
smb_request_state(struct connectdata * conn,bool * done)738 static CURLcode smb_request_state(struct connectdata *conn, bool *done)
739 {
740   struct smb_request *req = conn->data->req.protop;
741   struct smb_header *h;
742   struct smb_conn *smbc = &conn->proto.smbc;
743   enum smb_req_state next_state = SMB_DONE;
744   unsigned short len;
745   unsigned short off;
746   CURLcode result;
747   void *msg = NULL;
748   const struct smb_nt_create_response *smb_m;
749 
750   /* Start the request */
751   if(req->state == SMB_REQUESTING) {
752     result = smb_send_tree_connect(conn);
753     if(result) {
754       connclose(conn, "SMB: failed to send tree connect message");
755       return result;
756     }
757 
758     request_state(conn, SMB_TREE_CONNECT);
759   }
760 
761   /* Send the previous message and check for a response */
762   result = smb_send_and_recv(conn, &msg);
763   if(result && result != CURLE_AGAIN) {
764     connclose(conn, "SMB: failed to communicate");
765     return result;
766   }
767 
768   if(!msg)
769     return CURLE_OK;
770 
771   h = msg;
772 
773   switch(req->state) {
774   case SMB_TREE_CONNECT:
775     if(h->status) {
776       req->result = CURLE_REMOTE_FILE_NOT_FOUND;
777       if(h->status == smb_swap32(SMB_ERR_NOACCESS))
778         req->result = CURLE_REMOTE_ACCESS_DENIED;
779       break;
780     }
781     req->tid = smb_swap16(h->tid);
782     next_state = SMB_OPEN;
783     break;
784 
785   case SMB_OPEN:
786     if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
787       req->result = CURLE_REMOTE_FILE_NOT_FOUND;
788       next_state = SMB_TREE_DISCONNECT;
789       break;
790     }
791     smb_m = (const struct smb_nt_create_response*) msg;
792     req->fid = smb_swap16(smb_m->fid);
793     conn->data->req.offset = 0;
794     if(conn->data->set.upload) {
795       conn->data->req.size = conn->data->state.infilesize;
796       Curl_pgrsSetUploadSize(conn->data, conn->data->req.size);
797       next_state = SMB_UPLOAD;
798     }
799     else {
800       smb_m = (const struct smb_nt_create_response*) msg;
801       conn->data->req.size = smb_swap64(smb_m->end_of_file);
802       if(conn->data->req.size < 0) {
803         req->result = CURLE_WEIRD_SERVER_REPLY;
804         next_state = SMB_CLOSE;
805       }
806       else {
807         Curl_pgrsSetDownloadSize(conn->data, conn->data->req.size);
808         if(conn->data->set.get_filetime)
809           get_posix_time(&conn->data->info.filetime, smb_m->last_change_time);
810         next_state = SMB_DOWNLOAD;
811       }
812     }
813     break;
814 
815   case SMB_DOWNLOAD:
816     if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
817       req->result = CURLE_RECV_ERROR;
818       next_state = SMB_CLOSE;
819       break;
820     }
821     len = Curl_read16_le(((const unsigned char *) msg) +
822                          sizeof(struct smb_header) + 11);
823     off = Curl_read16_le(((const unsigned char *) msg) +
824                          sizeof(struct smb_header) + 13);
825     if(len > 0) {
826       if(off + sizeof(unsigned int) + len > smbc->got) {
827         failf(conn->data, "Invalid input packet");
828         result = CURLE_RECV_ERROR;
829       }
830       else
831         result = Curl_client_write(conn, CLIENTWRITE_BODY,
832                                    (char *)msg + off + sizeof(unsigned int),
833                                    len);
834       if(result) {
835         req->result = result;
836         next_state = SMB_CLOSE;
837         break;
838       }
839     }
840     conn->data->req.bytecount += len;
841     conn->data->req.offset += len;
842     Curl_pgrsSetDownloadCounter(conn->data, conn->data->req.bytecount);
843     next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
844     break;
845 
846   case SMB_UPLOAD:
847     if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
848       req->result = CURLE_UPLOAD_FAILED;
849       next_state = SMB_CLOSE;
850       break;
851     }
852     len = Curl_read16_le(((const unsigned char *) msg) +
853                          sizeof(struct smb_header) + 5);
854     conn->data->req.bytecount += len;
855     conn->data->req.offset += len;
856     Curl_pgrsSetUploadCounter(conn->data, conn->data->req.bytecount);
857     if(conn->data->req.bytecount >= conn->data->req.size)
858       next_state = SMB_CLOSE;
859     else
860       next_state = SMB_UPLOAD;
861     break;
862 
863   case SMB_CLOSE:
864     /* We don't care if the close failed, proceed to tree disconnect anyway */
865     next_state = SMB_TREE_DISCONNECT;
866     break;
867 
868   case SMB_TREE_DISCONNECT:
869     next_state = SMB_DONE;
870     break;
871 
872   default:
873     smb_pop_message(conn);
874     return CURLE_OK; /* ignore */
875   }
876 
877   smb_pop_message(conn);
878 
879   switch(next_state) {
880   case SMB_OPEN:
881     result = smb_send_open(conn);
882     break;
883 
884   case SMB_DOWNLOAD:
885     result = smb_send_read(conn);
886     break;
887 
888   case SMB_UPLOAD:
889     result = smb_send_write(conn);
890     break;
891 
892   case SMB_CLOSE:
893     result = smb_send_close(conn);
894     break;
895 
896   case SMB_TREE_DISCONNECT:
897     result = smb_send_tree_disconnect(conn);
898     break;
899 
900   case SMB_DONE:
901     result = req->result;
902     *done = true;
903     break;
904 
905   default:
906     break;
907   }
908 
909   if(result) {
910     connclose(conn, "SMB: failed to send message");
911     return result;
912   }
913 
914   request_state(conn, next_state);
915 
916   return CURLE_OK;
917 }
918 
smb_done(struct connectdata * conn,CURLcode status,bool premature)919 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
920                          bool premature)
921 {
922   (void) premature;
923   Curl_safefree(conn->data->req.protop);
924   return status;
925 }
926 
smb_disconnect(struct connectdata * conn,bool dead)927 static CURLcode smb_disconnect(struct connectdata *conn, bool dead)
928 {
929   struct smb_conn *smbc = &conn->proto.smbc;
930   (void) dead;
931   Curl_safefree(smbc->share);
932   Curl_safefree(smbc->domain);
933   Curl_safefree(smbc->recv_buf);
934   return CURLE_OK;
935 }
936 
smb_getsock(struct connectdata * conn,curl_socket_t * socks,int numsocks)937 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
938                        int numsocks)
939 {
940   if(!numsocks)
941     return GETSOCK_BLANK;
942 
943   socks[0] = conn->sock[FIRSTSOCKET];
944   return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
945 }
946 
smb_do(struct connectdata * conn,bool * done)947 static CURLcode smb_do(struct connectdata *conn, bool *done)
948 {
949   struct smb_conn *smbc = &conn->proto.smbc;
950 
951   *done = FALSE;
952   if(smbc->share) {
953     return CURLE_OK;
954   }
955   return CURLE_URL_MALFORMAT;
956 }
957 
smb_parse_url_path(struct connectdata * conn)958 static CURLcode smb_parse_url_path(struct connectdata *conn)
959 {
960   CURLcode result = CURLE_OK;
961   struct Curl_easy *data = conn->data;
962   struct smb_request *req = data->req.protop;
963   struct smb_conn *smbc = &conn->proto.smbc;
964   char *path;
965   char *slash;
966 
967   /* URL decode the path */
968   result = Curl_urldecode(data, data->state.up.path, 0, &path, NULL, TRUE);
969   if(result)
970     return result;
971 
972   /* Parse the path for the share */
973   smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
974   free(path);
975   if(!smbc->share)
976     return CURLE_OUT_OF_MEMORY;
977 
978   slash = strchr(smbc->share, '/');
979   if(!slash)
980     slash = strchr(smbc->share, '\\');
981 
982   /* The share must be present */
983   if(!slash) {
984     Curl_safefree(smbc->share);
985     return CURLE_URL_MALFORMAT;
986   }
987 
988   /* Parse the path for the file path converting any forward slashes into
989      backslashes */
990   *slash++ = 0;
991   req->path = slash;
992 
993   for(; *slash; slash++) {
994     if(*slash == '/')
995       *slash = '\\';
996   }
997   return CURLE_OK;
998 }
999 
1000 #endif /* !USE_WINDOWS_SSPI || USE_WIN32_CRYPTO */
1001 
1002 #endif /* CURL_DISABLE_SMB && USE_NTLM && CURL_SIZEOF_CURL_OFF_T > 4 */
1003