1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 2014, Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
9 * Copyright (C) 2016-2018, Daniel Stenberg, <daniel@haxx.se>, et al.
10 *
11 * This software is licensed as described in the file COPYING, which
12 * you should have received as part of this distribution. The terms
13 * are also available at https://curl.haxx.se/docs/copyright.html.
14 *
15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 * copies of the Software, and permit persons to whom the Software is
17 * furnished to do so, under the terms of the COPYING file.
18 *
19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 * KIND, either express or implied.
21 *
22 ***************************************************************************/
23
24 #include "curl_setup.h"
25
26 #if !defined(CURL_DISABLE_SMB) && defined(USE_NTLM) && \
27 (CURL_SIZEOF_CURL_OFF_T > 4)
28
29 #if !defined(USE_WINDOWS_SSPI) || defined(USE_WIN32_CRYPTO)
30
31 #define BUILDING_CURL_SMB_C
32
33 #ifdef HAVE_PROCESS_H
34 #include <process.h>
35 #ifdef CURL_WINDOWS_APP
36 #define getpid GetCurrentProcessId
37 #elif !defined(MSDOS)
38 #define getpid _getpid
39 #endif
40 #endif
41
42 #include "smb.h"
43 #include "urldata.h"
44 #include "sendf.h"
45 #include "multiif.h"
46 #include "connect.h"
47 #include "progress.h"
48 #include "transfer.h"
49 #include "vtls/vtls.h"
50 #include "curl_ntlm_core.h"
51 #include "escape.h"
52 #include "curl_endian.h"
53
54 /* The last #include files should be: */
55 #include "curl_memory.h"
56 #include "memdebug.h"
57
58 /* Local API functions */
59 static CURLcode smb_setup_connection(struct connectdata *conn);
60 static CURLcode smb_connect(struct connectdata *conn, bool *done);
61 static CURLcode smb_connection_state(struct connectdata *conn, bool *done);
62 static CURLcode smb_do(struct connectdata *conn, bool *done);
63 static CURLcode smb_request_state(struct connectdata *conn, bool *done);
64 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
65 bool premature);
66 static CURLcode smb_disconnect(struct connectdata *conn, bool dead);
67 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
68 int numsocks);
69 static CURLcode smb_parse_url_path(struct connectdata *conn);
70
71 /*
72 * SMB handler interface
73 */
74 const struct Curl_handler Curl_handler_smb = {
75 "SMB", /* scheme */
76 smb_setup_connection, /* setup_connection */
77 smb_do, /* do_it */
78 smb_done, /* done */
79 ZERO_NULL, /* do_more */
80 smb_connect, /* connect_it */
81 smb_connection_state, /* connecting */
82 smb_request_state, /* doing */
83 smb_getsock, /* proto_getsock */
84 smb_getsock, /* doing_getsock */
85 ZERO_NULL, /* domore_getsock */
86 ZERO_NULL, /* perform_getsock */
87 smb_disconnect, /* disconnect */
88 ZERO_NULL, /* readwrite */
89 ZERO_NULL, /* connection_check */
90 PORT_SMB, /* defport */
91 CURLPROTO_SMB, /* protocol */
92 PROTOPT_NONE /* flags */
93 };
94
95 #ifdef USE_SSL
96 /*
97 * SMBS handler interface
98 */
99 const struct Curl_handler Curl_handler_smbs = {
100 "SMBS", /* scheme */
101 smb_setup_connection, /* setup_connection */
102 smb_do, /* do_it */
103 smb_done, /* done */
104 ZERO_NULL, /* do_more */
105 smb_connect, /* connect_it */
106 smb_connection_state, /* connecting */
107 smb_request_state, /* doing */
108 smb_getsock, /* proto_getsock */
109 smb_getsock, /* doing_getsock */
110 ZERO_NULL, /* domore_getsock */
111 ZERO_NULL, /* perform_getsock */
112 smb_disconnect, /* disconnect */
113 ZERO_NULL, /* readwrite */
114 ZERO_NULL, /* connection_check */
115 PORT_SMBS, /* defport */
116 CURLPROTO_SMBS, /* protocol */
117 PROTOPT_SSL /* flags */
118 };
119 #endif
120
121 #define MAX_PAYLOAD_SIZE 0x8000
122 #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
123 #define CLIENTNAME "curl"
124 #define SERVICENAME "?????"
125
126 /* Append a string to an SMB message */
127 #define MSGCAT(str) \
128 strcpy(p, (str)); \
129 p += strlen(str);
130
131 /* Append a null-terminated string to an SMB message */
132 #define MSGCATNULL(str) \
133 strcpy(p, (str)); \
134 p += strlen(str) + 1;
135
136 /* SMB is mostly little endian */
137 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
138 defined(__OS400__)
smb_swap16(unsigned short x)139 static unsigned short smb_swap16(unsigned short x)
140 {
141 return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
142 }
143
smb_swap32(unsigned int x)144 static unsigned int smb_swap32(unsigned int x)
145 {
146 return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
147 ((x >> 24) & 0xff);
148 }
149
smb_swap64(curl_off_t x)150 static curl_off_t smb_swap64(curl_off_t x)
151 {
152 return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
153 smb_swap32((unsigned int) (x >> 32));
154 }
155
156 #else
157 # define smb_swap16(x) (x)
158 # define smb_swap32(x) (x)
159 # define smb_swap64(x) (x)
160 #endif
161
162 /* SMB request state */
163 enum smb_req_state {
164 SMB_REQUESTING,
165 SMB_TREE_CONNECT,
166 SMB_OPEN,
167 SMB_DOWNLOAD,
168 SMB_UPLOAD,
169 SMB_CLOSE,
170 SMB_TREE_DISCONNECT,
171 SMB_DONE
172 };
173
174 /* SMB request data */
175 struct smb_request {
176 enum smb_req_state state;
177 char *path;
178 unsigned short tid; /* Even if we connect to the same tree as another */
179 unsigned short fid; /* request, the tid will be different */
180 CURLcode result;
181 };
182
conn_state(struct connectdata * conn,enum smb_conn_state newstate)183 static void conn_state(struct connectdata *conn, enum smb_conn_state newstate)
184 {
185 struct smb_conn *smbc = &conn->proto.smbc;
186 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
187 /* For debug purposes */
188 static const char * const names[] = {
189 "SMB_NOT_CONNECTED",
190 "SMB_CONNECTING",
191 "SMB_NEGOTIATE",
192 "SMB_SETUP",
193 "SMB_CONNECTED",
194 /* LAST */
195 };
196
197 if(smbc->state != newstate)
198 infof(conn->data, "SMB conn %p state change from %s to %s\n",
199 (void *)smbc, names[smbc->state], names[newstate]);
200 #endif
201
202 smbc->state = newstate;
203 }
204
request_state(struct connectdata * conn,enum smb_req_state newstate)205 static void request_state(struct connectdata *conn,
206 enum smb_req_state newstate)
207 {
208 struct smb_request *req = conn->data->req.protop;
209 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
210 /* For debug purposes */
211 static const char * const names[] = {
212 "SMB_REQUESTING",
213 "SMB_TREE_CONNECT",
214 "SMB_OPEN",
215 "SMB_DOWNLOAD",
216 "SMB_UPLOAD",
217 "SMB_CLOSE",
218 "SMB_TREE_DISCONNECT",
219 "SMB_DONE",
220 /* LAST */
221 };
222
223 if(req->state != newstate)
224 infof(conn->data, "SMB request %p state change from %s to %s\n",
225 (void *)req, names[req->state], names[newstate]);
226 #endif
227
228 req->state = newstate;
229 }
230
231 /* this should setup things in the connection, not in the easy
232 handle */
smb_setup_connection(struct connectdata * conn)233 static CURLcode smb_setup_connection(struct connectdata *conn)
234 {
235 struct smb_request *req;
236
237 /* Initialize the request state */
238 conn->data->req.protop = req = calloc(1, sizeof(struct smb_request));
239 if(!req)
240 return CURLE_OUT_OF_MEMORY;
241
242 /* Parse the URL path */
243 return smb_parse_url_path(conn);
244 }
245
smb_connect(struct connectdata * conn,bool * done)246 static CURLcode smb_connect(struct connectdata *conn, bool *done)
247 {
248 struct smb_conn *smbc = &conn->proto.smbc;
249 char *slash;
250
251 (void) done;
252
253 /* Check we have a username and password to authenticate with */
254 if(!conn->bits.user_passwd)
255 return CURLE_LOGIN_DENIED;
256
257 /* Initialize the connection state */
258 smbc->state = SMB_CONNECTING;
259 smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
260 if(!smbc->recv_buf)
261 return CURLE_OUT_OF_MEMORY;
262
263 /* Multiple requests are allowed with this connection */
264 connkeep(conn, "SMB default");
265
266 /* Parse the username, domain, and password */
267 slash = strchr(conn->user, '/');
268 if(!slash)
269 slash = strchr(conn->user, '\\');
270
271 if(slash) {
272 smbc->user = slash + 1;
273 smbc->domain = strdup(conn->user);
274 if(!smbc->domain)
275 return CURLE_OUT_OF_MEMORY;
276 smbc->domain[slash - conn->user] = 0;
277 }
278 else {
279 smbc->user = conn->user;
280 smbc->domain = strdup(conn->host.name);
281 if(!smbc->domain)
282 return CURLE_OUT_OF_MEMORY;
283 }
284
285 return CURLE_OK;
286 }
287
smb_recv_message(struct connectdata * conn,void ** msg)288 static CURLcode smb_recv_message(struct connectdata *conn, void **msg)
289 {
290 struct smb_conn *smbc = &conn->proto.smbc;
291 char *buf = smbc->recv_buf;
292 ssize_t bytes_read;
293 size_t nbt_size;
294 size_t msg_size;
295 size_t len = MAX_MESSAGE_SIZE - smbc->got;
296 CURLcode result;
297
298 result = Curl_read(conn, FIRSTSOCKET, buf + smbc->got, len, &bytes_read);
299 if(result)
300 return result;
301
302 if(!bytes_read)
303 return CURLE_OK;
304
305 smbc->got += bytes_read;
306
307 /* Check for a 32-bit nbt header */
308 if(smbc->got < sizeof(unsigned int))
309 return CURLE_OK;
310
311 nbt_size = Curl_read16_be((const unsigned char *)
312 (buf + sizeof(unsigned short))) +
313 sizeof(unsigned int);
314 if(smbc->got < nbt_size)
315 return CURLE_OK;
316
317 msg_size = sizeof(struct smb_header);
318 if(nbt_size >= msg_size + 1) {
319 /* Add the word count */
320 msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
321 if(nbt_size >= msg_size + sizeof(unsigned short)) {
322 /* Add the byte count */
323 msg_size += sizeof(unsigned short) +
324 Curl_read16_le((const unsigned char *)&buf[msg_size]);
325 if(nbt_size < msg_size)
326 return CURLE_READ_ERROR;
327 }
328 }
329
330 *msg = buf;
331
332 return CURLE_OK;
333 }
334
smb_pop_message(struct connectdata * conn)335 static void smb_pop_message(struct connectdata *conn)
336 {
337 struct smb_conn *smbc = &conn->proto.smbc;
338
339 smbc->got = 0;
340 }
341
smb_format_message(struct connectdata * conn,struct smb_header * h,unsigned char cmd,size_t len)342 static void smb_format_message(struct connectdata *conn, struct smb_header *h,
343 unsigned char cmd, size_t len)
344 {
345 struct smb_conn *smbc = &conn->proto.smbc;
346 struct smb_request *req = conn->data->req.protop;
347 unsigned int pid;
348
349 memset(h, 0, sizeof(*h));
350 h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
351 len));
352 memcpy((char *)h->magic, "\xffSMB", 4);
353 h->command = cmd;
354 h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
355 h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
356 h->uid = smb_swap16(smbc->uid);
357 h->tid = smb_swap16(req->tid);
358 pid = getpid();
359 h->pid_high = smb_swap16((unsigned short)(pid >> 16));
360 h->pid = smb_swap16((unsigned short) pid);
361 }
362
smb_send(struct connectdata * conn,ssize_t len,size_t upload_size)363 static CURLcode smb_send(struct connectdata *conn, ssize_t len,
364 size_t upload_size)
365 {
366 struct smb_conn *smbc = &conn->proto.smbc;
367 ssize_t bytes_written;
368 CURLcode result;
369
370 result = Curl_write(conn, FIRSTSOCKET, conn->data->state.ulbuf,
371 len, &bytes_written);
372 if(result)
373 return result;
374
375 if(bytes_written != len) {
376 smbc->send_size = len;
377 smbc->sent = bytes_written;
378 }
379
380 smbc->upload_size = upload_size;
381
382 return CURLE_OK;
383 }
384
smb_flush(struct connectdata * conn)385 static CURLcode smb_flush(struct connectdata *conn)
386 {
387 struct smb_conn *smbc = &conn->proto.smbc;
388 ssize_t bytes_written;
389 ssize_t len = smbc->send_size - smbc->sent;
390 CURLcode result;
391
392 if(!smbc->send_size)
393 return CURLE_OK;
394
395 result = Curl_write(conn, FIRSTSOCKET,
396 conn->data->state.ulbuf + smbc->sent,
397 len, &bytes_written);
398 if(result)
399 return result;
400
401 if(bytes_written != len)
402 smbc->sent += bytes_written;
403 else
404 smbc->send_size = 0;
405
406 return CURLE_OK;
407 }
408
smb_send_message(struct connectdata * conn,unsigned char cmd,const void * msg,size_t msg_len)409 static CURLcode smb_send_message(struct connectdata *conn, unsigned char cmd,
410 const void *msg, size_t msg_len)
411 {
412 CURLcode result = Curl_get_upload_buffer(conn->data);
413 if(result)
414 return result;
415 smb_format_message(conn, (struct smb_header *)conn->data->state.ulbuf,
416 cmd, msg_len);
417 memcpy(conn->data->state.ulbuf + sizeof(struct smb_header),
418 msg, msg_len);
419
420 return smb_send(conn, sizeof(struct smb_header) + msg_len, 0);
421 }
422
smb_send_negotiate(struct connectdata * conn)423 static CURLcode smb_send_negotiate(struct connectdata *conn)
424 {
425 const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
426
427 return smb_send_message(conn, SMB_COM_NEGOTIATE, msg, 15);
428 }
429
smb_send_setup(struct connectdata * conn)430 static CURLcode smb_send_setup(struct connectdata *conn)
431 {
432 struct smb_conn *smbc = &conn->proto.smbc;
433 struct smb_setup msg;
434 char *p = msg.bytes;
435 unsigned char lm_hash[21];
436 unsigned char lm[24];
437 unsigned char nt_hash[21];
438 unsigned char nt[24];
439
440 size_t byte_count = sizeof(lm) + sizeof(nt);
441 byte_count += strlen(smbc->user) + strlen(smbc->domain);
442 byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
443 if(byte_count > sizeof(msg.bytes))
444 return CURLE_FILESIZE_EXCEEDED;
445
446 Curl_ntlm_core_mk_lm_hash(conn->data, conn->passwd, lm_hash);
447 Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
448 #ifdef USE_NTRESPONSES
449 Curl_ntlm_core_mk_nt_hash(conn->data, conn->passwd, nt_hash);
450 Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
451 #else
452 memset(nt, 0, sizeof(nt));
453 #endif
454
455 memset(&msg, 0, sizeof(msg));
456 msg.word_count = SMB_WC_SETUP_ANDX;
457 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
458 msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
459 msg.max_mpx_count = smb_swap16(1);
460 msg.vc_number = smb_swap16(1);
461 msg.session_key = smb_swap32(smbc->session_key);
462 msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
463 msg.lengths[0] = smb_swap16(sizeof(lm));
464 msg.lengths[1] = smb_swap16(sizeof(nt));
465 memcpy(p, lm, sizeof(lm));
466 p += sizeof(lm);
467 memcpy(p, nt, sizeof(nt));
468 p += sizeof(nt);
469 MSGCATNULL(smbc->user);
470 MSGCATNULL(smbc->domain);
471 MSGCATNULL(OS);
472 MSGCATNULL(CLIENTNAME);
473 byte_count = p - msg.bytes;
474 msg.byte_count = smb_swap16((unsigned short)byte_count);
475
476 return smb_send_message(conn, SMB_COM_SETUP_ANDX, &msg,
477 sizeof(msg) - sizeof(msg.bytes) + byte_count);
478 }
479
smb_send_tree_connect(struct connectdata * conn)480 static CURLcode smb_send_tree_connect(struct connectdata *conn)
481 {
482 struct smb_tree_connect msg;
483 struct smb_conn *smbc = &conn->proto.smbc;
484 char *p = msg.bytes;
485
486 size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
487 byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
488 if(byte_count > sizeof(msg.bytes))
489 return CURLE_FILESIZE_EXCEEDED;
490
491 memset(&msg, 0, sizeof(msg));
492 msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
493 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
494 msg.pw_len = 0;
495 MSGCAT("\\\\");
496 MSGCAT(conn->host.name);
497 MSGCAT("\\");
498 MSGCATNULL(smbc->share);
499 MSGCATNULL(SERVICENAME); /* Match any type of service */
500 byte_count = p - msg.bytes;
501 msg.byte_count = smb_swap16((unsigned short)byte_count);
502
503 return smb_send_message(conn, SMB_COM_TREE_CONNECT_ANDX, &msg,
504 sizeof(msg) - sizeof(msg.bytes) + byte_count);
505 }
506
smb_send_open(struct connectdata * conn)507 static CURLcode smb_send_open(struct connectdata *conn)
508 {
509 struct smb_request *req = conn->data->req.protop;
510 struct smb_nt_create msg;
511 size_t byte_count;
512
513 if((strlen(req->path) + 1) > sizeof(msg.bytes))
514 return CURLE_FILESIZE_EXCEEDED;
515
516 memset(&msg, 0, sizeof(msg));
517 msg.word_count = SMB_WC_NT_CREATE_ANDX;
518 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
519 byte_count = strlen(req->path);
520 msg.name_length = smb_swap16((unsigned short)byte_count);
521 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
522 if(conn->data->set.upload) {
523 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
524 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
525 }
526 else {
527 msg.access = smb_swap32(SMB_GENERIC_READ);
528 msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
529 }
530 msg.byte_count = smb_swap16((unsigned short) ++byte_count);
531 strcpy(msg.bytes, req->path);
532
533 return smb_send_message(conn, SMB_COM_NT_CREATE_ANDX, &msg,
534 sizeof(msg) - sizeof(msg.bytes) + byte_count);
535 }
536
smb_send_close(struct connectdata * conn)537 static CURLcode smb_send_close(struct connectdata *conn)
538 {
539 struct smb_request *req = conn->data->req.protop;
540 struct smb_close msg;
541
542 memset(&msg, 0, sizeof(msg));
543 msg.word_count = SMB_WC_CLOSE;
544 msg.fid = smb_swap16(req->fid);
545
546 return smb_send_message(conn, SMB_COM_CLOSE, &msg, sizeof(msg));
547 }
548
smb_send_tree_disconnect(struct connectdata * conn)549 static CURLcode smb_send_tree_disconnect(struct connectdata *conn)
550 {
551 struct smb_tree_disconnect msg;
552
553 memset(&msg, 0, sizeof(msg));
554
555 return smb_send_message(conn, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
556 }
557
smb_send_read(struct connectdata * conn)558 static CURLcode smb_send_read(struct connectdata *conn)
559 {
560 struct smb_request *req = conn->data->req.protop;
561 curl_off_t offset = conn->data->req.offset;
562 struct smb_read msg;
563
564 memset(&msg, 0, sizeof(msg));
565 msg.word_count = SMB_WC_READ_ANDX;
566 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
567 msg.fid = smb_swap16(req->fid);
568 msg.offset = smb_swap32((unsigned int) offset);
569 msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
570 msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
571 msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
572
573 return smb_send_message(conn, SMB_COM_READ_ANDX, &msg, sizeof(msg));
574 }
575
smb_send_write(struct connectdata * conn)576 static CURLcode smb_send_write(struct connectdata *conn)
577 {
578 struct smb_write *msg;
579 struct smb_request *req = conn->data->req.protop;
580 curl_off_t offset = conn->data->req.offset;
581 curl_off_t upload_size = conn->data->req.size - conn->data->req.bytecount;
582 CURLcode result = Curl_get_upload_buffer(conn->data);
583 if(result)
584 return result;
585 msg = (struct smb_write *)conn->data->state.ulbuf;
586
587 if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
588 upload_size = MAX_PAYLOAD_SIZE - 1;
589
590 memset(msg, 0, sizeof(*msg));
591 msg->word_count = SMB_WC_WRITE_ANDX;
592 msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
593 msg->fid = smb_swap16(req->fid);
594 msg->offset = smb_swap32((unsigned int) offset);
595 msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
596 msg->data_length = smb_swap16((unsigned short) upload_size);
597 msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
598 msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
599
600 smb_format_message(conn, &msg->h, SMB_COM_WRITE_ANDX,
601 sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
602
603 return smb_send(conn, sizeof(*msg), (size_t) upload_size);
604 }
605
smb_send_and_recv(struct connectdata * conn,void ** msg)606 static CURLcode smb_send_and_recv(struct connectdata *conn, void **msg)
607 {
608 struct smb_conn *smbc = &conn->proto.smbc;
609 CURLcode result;
610
611 /* Check if there is data in the transfer buffer */
612 if(!smbc->send_size && smbc->upload_size) {
613 size_t nread = smbc->upload_size > conn->data->set.upload_buffer_size ?
614 conn->data->set.upload_buffer_size :
615 smbc->upload_size;
616 conn->data->req.upload_fromhere = conn->data->state.ulbuf;
617 result = Curl_fillreadbuffer(conn, nread, &nread);
618 if(result && result != CURLE_AGAIN)
619 return result;
620 if(!nread)
621 return CURLE_OK;
622
623 smbc->upload_size -= nread;
624 smbc->send_size = nread;
625 smbc->sent = 0;
626 }
627
628 /* Check if there is data to send */
629 if(smbc->send_size) {
630 result = smb_flush(conn);
631 if(result)
632 return result;
633 }
634
635 /* Check if there is still data to be sent */
636 if(smbc->send_size || smbc->upload_size)
637 return CURLE_AGAIN;
638
639 return smb_recv_message(conn, msg);
640 }
641
smb_connection_state(struct connectdata * conn,bool * done)642 static CURLcode smb_connection_state(struct connectdata *conn, bool *done)
643 {
644 struct smb_conn *smbc = &conn->proto.smbc;
645 struct smb_negotiate_response *nrsp;
646 struct smb_header *h;
647 CURLcode result;
648 void *msg = NULL;
649
650 if(smbc->state == SMB_CONNECTING) {
651 #ifdef USE_SSL
652 if((conn->handler->flags & PROTOPT_SSL)) {
653 bool ssl_done = FALSE;
654 result = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &ssl_done);
655 if(result && result != CURLE_AGAIN)
656 return result;
657 if(!ssl_done)
658 return CURLE_OK;
659 }
660 #endif
661
662 result = smb_send_negotiate(conn);
663 if(result) {
664 connclose(conn, "SMB: failed to send negotiate message");
665 return result;
666 }
667
668 conn_state(conn, SMB_NEGOTIATE);
669 }
670
671 /* Send the previous message and check for a response */
672 result = smb_send_and_recv(conn, &msg);
673 if(result && result != CURLE_AGAIN) {
674 connclose(conn, "SMB: failed to communicate");
675 return result;
676 }
677
678 if(!msg)
679 return CURLE_OK;
680
681 h = msg;
682
683 switch(smbc->state) {
684 case SMB_NEGOTIATE:
685 if(h->status || smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) {
686 connclose(conn, "SMB: negotiation failed");
687 return CURLE_COULDNT_CONNECT;
688 }
689 nrsp = msg;
690 memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
691 smbc->session_key = smb_swap32(nrsp->session_key);
692 result = smb_send_setup(conn);
693 if(result) {
694 connclose(conn, "SMB: failed to send setup message");
695 return result;
696 }
697 conn_state(conn, SMB_SETUP);
698 break;
699
700 case SMB_SETUP:
701 if(h->status) {
702 connclose(conn, "SMB: authentication failed");
703 return CURLE_LOGIN_DENIED;
704 }
705 smbc->uid = smb_swap16(h->uid);
706 conn_state(conn, SMB_CONNECTED);
707 *done = true;
708 break;
709
710 default:
711 smb_pop_message(conn);
712 return CURLE_OK; /* ignore */
713 }
714
715 smb_pop_message(conn);
716
717 return CURLE_OK;
718 }
719
720 /*
721 * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
722 * to Posix time. Cap the output to fit within a time_t.
723 */
get_posix_time(time_t * out,curl_off_t timestamp)724 static void get_posix_time(time_t *out, curl_off_t timestamp)
725 {
726 timestamp -= 116444736000000000;
727 timestamp /= 10000000;
728 #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
729 if(timestamp > TIME_T_MAX)
730 *out = TIME_T_MAX;
731 else if(timestamp < TIME_T_MIN)
732 *out = TIME_T_MIN;
733 else
734 #endif
735 *out = (time_t) timestamp;
736 }
737
smb_request_state(struct connectdata * conn,bool * done)738 static CURLcode smb_request_state(struct connectdata *conn, bool *done)
739 {
740 struct smb_request *req = conn->data->req.protop;
741 struct smb_header *h;
742 struct smb_conn *smbc = &conn->proto.smbc;
743 enum smb_req_state next_state = SMB_DONE;
744 unsigned short len;
745 unsigned short off;
746 CURLcode result;
747 void *msg = NULL;
748 const struct smb_nt_create_response *smb_m;
749
750 /* Start the request */
751 if(req->state == SMB_REQUESTING) {
752 result = smb_send_tree_connect(conn);
753 if(result) {
754 connclose(conn, "SMB: failed to send tree connect message");
755 return result;
756 }
757
758 request_state(conn, SMB_TREE_CONNECT);
759 }
760
761 /* Send the previous message and check for a response */
762 result = smb_send_and_recv(conn, &msg);
763 if(result && result != CURLE_AGAIN) {
764 connclose(conn, "SMB: failed to communicate");
765 return result;
766 }
767
768 if(!msg)
769 return CURLE_OK;
770
771 h = msg;
772
773 switch(req->state) {
774 case SMB_TREE_CONNECT:
775 if(h->status) {
776 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
777 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
778 req->result = CURLE_REMOTE_ACCESS_DENIED;
779 break;
780 }
781 req->tid = smb_swap16(h->tid);
782 next_state = SMB_OPEN;
783 break;
784
785 case SMB_OPEN:
786 if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
787 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
788 next_state = SMB_TREE_DISCONNECT;
789 break;
790 }
791 smb_m = (const struct smb_nt_create_response*) msg;
792 req->fid = smb_swap16(smb_m->fid);
793 conn->data->req.offset = 0;
794 if(conn->data->set.upload) {
795 conn->data->req.size = conn->data->state.infilesize;
796 Curl_pgrsSetUploadSize(conn->data, conn->data->req.size);
797 next_state = SMB_UPLOAD;
798 }
799 else {
800 smb_m = (const struct smb_nt_create_response*) msg;
801 conn->data->req.size = smb_swap64(smb_m->end_of_file);
802 if(conn->data->req.size < 0) {
803 req->result = CURLE_WEIRD_SERVER_REPLY;
804 next_state = SMB_CLOSE;
805 }
806 else {
807 Curl_pgrsSetDownloadSize(conn->data, conn->data->req.size);
808 if(conn->data->set.get_filetime)
809 get_posix_time(&conn->data->info.filetime, smb_m->last_change_time);
810 next_state = SMB_DOWNLOAD;
811 }
812 }
813 break;
814
815 case SMB_DOWNLOAD:
816 if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
817 req->result = CURLE_RECV_ERROR;
818 next_state = SMB_CLOSE;
819 break;
820 }
821 len = Curl_read16_le(((const unsigned char *) msg) +
822 sizeof(struct smb_header) + 11);
823 off = Curl_read16_le(((const unsigned char *) msg) +
824 sizeof(struct smb_header) + 13);
825 if(len > 0) {
826 if(off + sizeof(unsigned int) + len > smbc->got) {
827 failf(conn->data, "Invalid input packet");
828 result = CURLE_RECV_ERROR;
829 }
830 else
831 result = Curl_client_write(conn, CLIENTWRITE_BODY,
832 (char *)msg + off + sizeof(unsigned int),
833 len);
834 if(result) {
835 req->result = result;
836 next_state = SMB_CLOSE;
837 break;
838 }
839 }
840 conn->data->req.bytecount += len;
841 conn->data->req.offset += len;
842 Curl_pgrsSetDownloadCounter(conn->data, conn->data->req.bytecount);
843 next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
844 break;
845
846 case SMB_UPLOAD:
847 if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
848 req->result = CURLE_UPLOAD_FAILED;
849 next_state = SMB_CLOSE;
850 break;
851 }
852 len = Curl_read16_le(((const unsigned char *) msg) +
853 sizeof(struct smb_header) + 5);
854 conn->data->req.bytecount += len;
855 conn->data->req.offset += len;
856 Curl_pgrsSetUploadCounter(conn->data, conn->data->req.bytecount);
857 if(conn->data->req.bytecount >= conn->data->req.size)
858 next_state = SMB_CLOSE;
859 else
860 next_state = SMB_UPLOAD;
861 break;
862
863 case SMB_CLOSE:
864 /* We don't care if the close failed, proceed to tree disconnect anyway */
865 next_state = SMB_TREE_DISCONNECT;
866 break;
867
868 case SMB_TREE_DISCONNECT:
869 next_state = SMB_DONE;
870 break;
871
872 default:
873 smb_pop_message(conn);
874 return CURLE_OK; /* ignore */
875 }
876
877 smb_pop_message(conn);
878
879 switch(next_state) {
880 case SMB_OPEN:
881 result = smb_send_open(conn);
882 break;
883
884 case SMB_DOWNLOAD:
885 result = smb_send_read(conn);
886 break;
887
888 case SMB_UPLOAD:
889 result = smb_send_write(conn);
890 break;
891
892 case SMB_CLOSE:
893 result = smb_send_close(conn);
894 break;
895
896 case SMB_TREE_DISCONNECT:
897 result = smb_send_tree_disconnect(conn);
898 break;
899
900 case SMB_DONE:
901 result = req->result;
902 *done = true;
903 break;
904
905 default:
906 break;
907 }
908
909 if(result) {
910 connclose(conn, "SMB: failed to send message");
911 return result;
912 }
913
914 request_state(conn, next_state);
915
916 return CURLE_OK;
917 }
918
smb_done(struct connectdata * conn,CURLcode status,bool premature)919 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
920 bool premature)
921 {
922 (void) premature;
923 Curl_safefree(conn->data->req.protop);
924 return status;
925 }
926
smb_disconnect(struct connectdata * conn,bool dead)927 static CURLcode smb_disconnect(struct connectdata *conn, bool dead)
928 {
929 struct smb_conn *smbc = &conn->proto.smbc;
930 (void) dead;
931 Curl_safefree(smbc->share);
932 Curl_safefree(smbc->domain);
933 Curl_safefree(smbc->recv_buf);
934 return CURLE_OK;
935 }
936
smb_getsock(struct connectdata * conn,curl_socket_t * socks,int numsocks)937 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
938 int numsocks)
939 {
940 if(!numsocks)
941 return GETSOCK_BLANK;
942
943 socks[0] = conn->sock[FIRSTSOCKET];
944 return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
945 }
946
smb_do(struct connectdata * conn,bool * done)947 static CURLcode smb_do(struct connectdata *conn, bool *done)
948 {
949 struct smb_conn *smbc = &conn->proto.smbc;
950
951 *done = FALSE;
952 if(smbc->share) {
953 return CURLE_OK;
954 }
955 return CURLE_URL_MALFORMAT;
956 }
957
smb_parse_url_path(struct connectdata * conn)958 static CURLcode smb_parse_url_path(struct connectdata *conn)
959 {
960 CURLcode result = CURLE_OK;
961 struct Curl_easy *data = conn->data;
962 struct smb_request *req = data->req.protop;
963 struct smb_conn *smbc = &conn->proto.smbc;
964 char *path;
965 char *slash;
966
967 /* URL decode the path */
968 result = Curl_urldecode(data, data->state.up.path, 0, &path, NULL, TRUE);
969 if(result)
970 return result;
971
972 /* Parse the path for the share */
973 smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
974 free(path);
975 if(!smbc->share)
976 return CURLE_OUT_OF_MEMORY;
977
978 slash = strchr(smbc->share, '/');
979 if(!slash)
980 slash = strchr(smbc->share, '\\');
981
982 /* The share must be present */
983 if(!slash) {
984 Curl_safefree(smbc->share);
985 return CURLE_URL_MALFORMAT;
986 }
987
988 /* Parse the path for the file path converting any forward slashes into
989 backslashes */
990 *slash++ = 0;
991 req->path = slash;
992
993 for(; *slash; slash++) {
994 if(*slash == '/')
995 *slash = '\\';
996 }
997 return CURLE_OK;
998 }
999
1000 #endif /* !USE_WINDOWS_SSPI || USE_WIN32_CRYPTO */
1001
1002 #endif /* CURL_DISABLE_SMB && USE_NTLM && CURL_SIZEOF_CURL_OFF_T > 4 */
1003