1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9 * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
10 *
11 * This software is licensed as described in the file COPYING, which
12 * you should have received as part of this distribution. The terms
13 * are also available at https://curl.se/docs/copyright.html.
14 *
15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 * copies of the Software, and permit persons to whom the Software is
17 * furnished to do so, under the terms of the COPYING file.
18 *
19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 * KIND, either express or implied.
21 *
22 * SPDX-License-Identifier: curl
23 *
24 ***************************************************************************/
25
26 #include "curl_setup.h"
27
28 #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
29
30 #define BUILDING_CURL_SMB_C
31
32 #ifdef WIN32
33 #define getpid GetCurrentProcessId
34 #endif
35
36 #include "smb.h"
37 #include "urldata.h"
38 #include "sendf.h"
39 #include "multiif.h"
40 #include "cfilters.h"
41 #include "connect.h"
42 #include "progress.h"
43 #include "transfer.h"
44 #include "vtls/vtls.h"
45 #include "curl_ntlm_core.h"
46 #include "escape.h"
47 #include "curl_endian.h"
48
49 /* The last #include files should be: */
50 #include "curl_memory.h"
51 #include "memdebug.h"
52
53 /* Local API functions */
54 static CURLcode smb_setup_connection(struct Curl_easy *data,
55 struct connectdata *conn);
56 static CURLcode smb_connect(struct Curl_easy *data, bool *done);
57 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
58 static CURLcode smb_do(struct Curl_easy *data, bool *done);
59 static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
60 static CURLcode smb_disconnect(struct Curl_easy *data,
61 struct connectdata *conn, bool dead);
62 static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
63 curl_socket_t *socks);
64 static CURLcode smb_parse_url_path(struct Curl_easy *data,
65 struct connectdata *conn);
66
67 /*
68 * SMB handler interface
69 */
70 const struct Curl_handler Curl_handler_smb = {
71 "SMB", /* scheme */
72 smb_setup_connection, /* setup_connection */
73 smb_do, /* do_it */
74 ZERO_NULL, /* done */
75 ZERO_NULL, /* do_more */
76 smb_connect, /* connect_it */
77 smb_connection_state, /* connecting */
78 smb_request_state, /* doing */
79 smb_getsock, /* proto_getsock */
80 smb_getsock, /* doing_getsock */
81 ZERO_NULL, /* domore_getsock */
82 ZERO_NULL, /* perform_getsock */
83 smb_disconnect, /* disconnect */
84 ZERO_NULL, /* readwrite */
85 ZERO_NULL, /* connection_check */
86 ZERO_NULL, /* attach connection */
87 PORT_SMB, /* defport */
88 CURLPROTO_SMB, /* protocol */
89 CURLPROTO_SMB, /* family */
90 PROTOPT_NONE /* flags */
91 };
92
93 #ifdef USE_SSL
94 /*
95 * SMBS handler interface
96 */
97 const struct Curl_handler Curl_handler_smbs = {
98 "SMBS", /* scheme */
99 smb_setup_connection, /* setup_connection */
100 smb_do, /* do_it */
101 ZERO_NULL, /* done */
102 ZERO_NULL, /* do_more */
103 smb_connect, /* connect_it */
104 smb_connection_state, /* connecting */
105 smb_request_state, /* doing */
106 smb_getsock, /* proto_getsock */
107 smb_getsock, /* doing_getsock */
108 ZERO_NULL, /* domore_getsock */
109 ZERO_NULL, /* perform_getsock */
110 smb_disconnect, /* disconnect */
111 ZERO_NULL, /* readwrite */
112 ZERO_NULL, /* connection_check */
113 ZERO_NULL, /* attach connection */
114 PORT_SMBS, /* defport */
115 CURLPROTO_SMBS, /* protocol */
116 CURLPROTO_SMB, /* family */
117 PROTOPT_SSL /* flags */
118 };
119 #endif
120
121 #define MAX_PAYLOAD_SIZE 0x8000
122 #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
123 #define CLIENTNAME "curl"
124 #define SERVICENAME "?????"
125
126 /* Append a string to an SMB message */
127 #define MSGCAT(str) \
128 do { \
129 strcpy(p, (str)); \
130 p += strlen(str); \
131 } while(0)
132
133 /* Append a null-terminated string to an SMB message */
134 #define MSGCATNULL(str) \
135 do { \
136 strcpy(p, (str)); \
137 p += strlen(str) + 1; \
138 } while(0)
139
140 /* SMB is mostly little endian */
141 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
142 defined(__OS400__)
smb_swap16(unsigned short x)143 static unsigned short smb_swap16(unsigned short x)
144 {
145 return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
146 }
147
smb_swap32(unsigned int x)148 static unsigned int smb_swap32(unsigned int x)
149 {
150 return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
151 ((x >> 24) & 0xff);
152 }
153
smb_swap64(curl_off_t x)154 static curl_off_t smb_swap64(curl_off_t x)
155 {
156 return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
157 smb_swap32((unsigned int) (x >> 32));
158 }
159
160 #else
161 # define smb_swap16(x) (x)
162 # define smb_swap32(x) (x)
163 # define smb_swap64(x) (x)
164 #endif
165
166 /* SMB request state */
167 enum smb_req_state {
168 SMB_REQUESTING,
169 SMB_TREE_CONNECT,
170 SMB_OPEN,
171 SMB_DOWNLOAD,
172 SMB_UPLOAD,
173 SMB_CLOSE,
174 SMB_TREE_DISCONNECT,
175 SMB_DONE
176 };
177
178 /* SMB request data */
179 struct smb_request {
180 enum smb_req_state state;
181 char *path;
182 unsigned short tid; /* Even if we connect to the same tree as another */
183 unsigned short fid; /* request, the tid will be different */
184 CURLcode result;
185 };
186
conn_state(struct Curl_easy * data,enum smb_conn_state newstate)187 static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
188 {
189 struct smb_conn *smbc = &data->conn->proto.smbc;
190 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
191 /* For debug purposes */
192 static const char * const names[] = {
193 "SMB_NOT_CONNECTED",
194 "SMB_CONNECTING",
195 "SMB_NEGOTIATE",
196 "SMB_SETUP",
197 "SMB_CONNECTED",
198 /* LAST */
199 };
200
201 if(smbc->state != newstate)
202 infof(data, "SMB conn %p state change from %s to %s",
203 (void *)smbc, names[smbc->state], names[newstate]);
204 #endif
205
206 smbc->state = newstate;
207 }
208
request_state(struct Curl_easy * data,enum smb_req_state newstate)209 static void request_state(struct Curl_easy *data,
210 enum smb_req_state newstate)
211 {
212 struct smb_request *req = data->req.p.smb;
213 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
214 /* For debug purposes */
215 static const char * const names[] = {
216 "SMB_REQUESTING",
217 "SMB_TREE_CONNECT",
218 "SMB_OPEN",
219 "SMB_DOWNLOAD",
220 "SMB_UPLOAD",
221 "SMB_CLOSE",
222 "SMB_TREE_DISCONNECT",
223 "SMB_DONE",
224 /* LAST */
225 };
226
227 if(req->state != newstate)
228 infof(data, "SMB request %p state change from %s to %s",
229 (void *)req, names[req->state], names[newstate]);
230 #endif
231
232 req->state = newstate;
233 }
234
235 /* this should setup things in the connection, not in the easy
236 handle */
smb_setup_connection(struct Curl_easy * data,struct connectdata * conn)237 static CURLcode smb_setup_connection(struct Curl_easy *data,
238 struct connectdata *conn)
239 {
240 struct smb_request *req;
241
242 /* Initialize the request state */
243 data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
244 if(!req)
245 return CURLE_OUT_OF_MEMORY;
246
247 /* Parse the URL path */
248 return smb_parse_url_path(data, conn);
249 }
250
smb_connect(struct Curl_easy * data,bool * done)251 static CURLcode smb_connect(struct Curl_easy *data, bool *done)
252 {
253 struct connectdata *conn = data->conn;
254 struct smb_conn *smbc = &conn->proto.smbc;
255 char *slash;
256
257 (void) done;
258
259 /* Check we have a username and password to authenticate with */
260 if(!data->state.aptr.user)
261 return CURLE_LOGIN_DENIED;
262
263 /* Initialize the connection state */
264 smbc->state = SMB_CONNECTING;
265 smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
266 if(!smbc->recv_buf)
267 return CURLE_OUT_OF_MEMORY;
268
269 /* Multiple requests are allowed with this connection */
270 connkeep(conn, "SMB default");
271
272 /* Parse the username, domain, and password */
273 slash = strchr(conn->user, '/');
274 if(!slash)
275 slash = strchr(conn->user, '\\');
276
277 if(slash) {
278 smbc->user = slash + 1;
279 smbc->domain = strdup(conn->user);
280 if(!smbc->domain)
281 return CURLE_OUT_OF_MEMORY;
282 smbc->domain[slash - conn->user] = 0;
283 }
284 else {
285 smbc->user = conn->user;
286 smbc->domain = strdup(conn->host.name);
287 if(!smbc->domain)
288 return CURLE_OUT_OF_MEMORY;
289 }
290
291 return CURLE_OK;
292 }
293
smb_recv_message(struct Curl_easy * data,void ** msg)294 static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
295 {
296 struct connectdata *conn = data->conn;
297 curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
298 struct smb_conn *smbc = &conn->proto.smbc;
299 char *buf = smbc->recv_buf;
300 ssize_t bytes_read;
301 size_t nbt_size;
302 size_t msg_size;
303 size_t len = MAX_MESSAGE_SIZE - smbc->got;
304 CURLcode result;
305
306 result = Curl_read(data, sockfd, buf + smbc->got, len, &bytes_read);
307 if(result)
308 return result;
309
310 if(!bytes_read)
311 return CURLE_OK;
312
313 smbc->got += bytes_read;
314
315 /* Check for a 32-bit nbt header */
316 if(smbc->got < sizeof(unsigned int))
317 return CURLE_OK;
318
319 nbt_size = Curl_read16_be((const unsigned char *)
320 (buf + sizeof(unsigned short))) +
321 sizeof(unsigned int);
322 if(smbc->got < nbt_size)
323 return CURLE_OK;
324
325 msg_size = sizeof(struct smb_header);
326 if(nbt_size >= msg_size + 1) {
327 /* Add the word count */
328 msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
329 if(nbt_size >= msg_size + sizeof(unsigned short)) {
330 /* Add the byte count */
331 msg_size += sizeof(unsigned short) +
332 Curl_read16_le((const unsigned char *)&buf[msg_size]);
333 if(nbt_size < msg_size)
334 return CURLE_READ_ERROR;
335 }
336 }
337
338 *msg = buf;
339
340 return CURLE_OK;
341 }
342
smb_pop_message(struct connectdata * conn)343 static void smb_pop_message(struct connectdata *conn)
344 {
345 struct smb_conn *smbc = &conn->proto.smbc;
346
347 smbc->got = 0;
348 }
349
smb_format_message(struct Curl_easy * data,struct smb_header * h,unsigned char cmd,size_t len)350 static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
351 unsigned char cmd, size_t len)
352 {
353 struct connectdata *conn = data->conn;
354 struct smb_conn *smbc = &conn->proto.smbc;
355 struct smb_request *req = data->req.p.smb;
356 unsigned int pid;
357
358 memset(h, 0, sizeof(*h));
359 h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
360 len));
361 memcpy((char *)h->magic, "\xffSMB", 4);
362 h->command = cmd;
363 h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
364 h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
365 h->uid = smb_swap16(smbc->uid);
366 h->tid = smb_swap16(req->tid);
367 pid = getpid();
368 h->pid_high = smb_swap16((unsigned short)(pid >> 16));
369 h->pid = smb_swap16((unsigned short) pid);
370 }
371
smb_send(struct Curl_easy * data,ssize_t len,size_t upload_size)372 static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
373 size_t upload_size)
374 {
375 struct connectdata *conn = data->conn;
376 curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
377 struct smb_conn *smbc = &conn->proto.smbc;
378 ssize_t bytes_written;
379 CURLcode result;
380
381 result = Curl_write(data, sockfd, data->state.ulbuf,
382 len, &bytes_written);
383 if(result)
384 return result;
385
386 if(bytes_written != len) {
387 smbc->send_size = len;
388 smbc->sent = bytes_written;
389 }
390
391 smbc->upload_size = upload_size;
392
393 return CURLE_OK;
394 }
395
smb_flush(struct Curl_easy * data)396 static CURLcode smb_flush(struct Curl_easy *data)
397 {
398 struct connectdata *conn = data->conn;
399 curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
400 struct smb_conn *smbc = &conn->proto.smbc;
401 ssize_t bytes_written;
402 ssize_t len = smbc->send_size - smbc->sent;
403 CURLcode result;
404
405 if(!smbc->send_size)
406 return CURLE_OK;
407
408 result = Curl_write(data, sockfd,
409 data->state.ulbuf + smbc->sent,
410 len, &bytes_written);
411 if(result)
412 return result;
413
414 if(bytes_written != len)
415 smbc->sent += bytes_written;
416 else
417 smbc->send_size = 0;
418
419 return CURLE_OK;
420 }
421
smb_send_message(struct Curl_easy * data,unsigned char cmd,const void * msg,size_t msg_len)422 static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
423 const void *msg, size_t msg_len)
424 {
425 CURLcode result = Curl_get_upload_buffer(data);
426 if(result)
427 return result;
428 smb_format_message(data, (struct smb_header *)data->state.ulbuf,
429 cmd, msg_len);
430 memcpy(data->state.ulbuf + sizeof(struct smb_header),
431 msg, msg_len);
432
433 return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
434 }
435
smb_send_negotiate(struct Curl_easy * data)436 static CURLcode smb_send_negotiate(struct Curl_easy *data)
437 {
438 const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
439
440 return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
441 }
442
smb_send_setup(struct Curl_easy * data)443 static CURLcode smb_send_setup(struct Curl_easy *data)
444 {
445 struct connectdata *conn = data->conn;
446 struct smb_conn *smbc = &conn->proto.smbc;
447 struct smb_setup msg;
448 char *p = msg.bytes;
449 unsigned char lm_hash[21];
450 unsigned char lm[24];
451 unsigned char nt_hash[21];
452 unsigned char nt[24];
453
454 size_t byte_count = sizeof(lm) + sizeof(nt);
455 byte_count += strlen(smbc->user) + strlen(smbc->domain);
456 byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
457 if(byte_count > sizeof(msg.bytes))
458 return CURLE_FILESIZE_EXCEEDED;
459
460 Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
461 Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
462 Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
463 Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
464
465 memset(&msg, 0, sizeof(msg));
466 msg.word_count = SMB_WC_SETUP_ANDX;
467 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
468 msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
469 msg.max_mpx_count = smb_swap16(1);
470 msg.vc_number = smb_swap16(1);
471 msg.session_key = smb_swap32(smbc->session_key);
472 msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
473 msg.lengths[0] = smb_swap16(sizeof(lm));
474 msg.lengths[1] = smb_swap16(sizeof(nt));
475 memcpy(p, lm, sizeof(lm));
476 p += sizeof(lm);
477 memcpy(p, nt, sizeof(nt));
478 p += sizeof(nt);
479 MSGCATNULL(smbc->user);
480 MSGCATNULL(smbc->domain);
481 MSGCATNULL(OS);
482 MSGCATNULL(CLIENTNAME);
483 byte_count = p - msg.bytes;
484 msg.byte_count = smb_swap16((unsigned short)byte_count);
485
486 return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
487 sizeof(msg) - sizeof(msg.bytes) + byte_count);
488 }
489
smb_send_tree_connect(struct Curl_easy * data)490 static CURLcode smb_send_tree_connect(struct Curl_easy *data)
491 {
492 struct smb_tree_connect msg;
493 struct connectdata *conn = data->conn;
494 struct smb_conn *smbc = &conn->proto.smbc;
495 char *p = msg.bytes;
496
497 size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
498 byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
499 if(byte_count > sizeof(msg.bytes))
500 return CURLE_FILESIZE_EXCEEDED;
501
502 memset(&msg, 0, sizeof(msg));
503 msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
504 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
505 msg.pw_len = 0;
506 MSGCAT("\\\\");
507 MSGCAT(conn->host.name);
508 MSGCAT("\\");
509 MSGCATNULL(smbc->share);
510 MSGCATNULL(SERVICENAME); /* Match any type of service */
511 byte_count = p - msg.bytes;
512 msg.byte_count = smb_swap16((unsigned short)byte_count);
513
514 return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
515 sizeof(msg) - sizeof(msg.bytes) + byte_count);
516 }
517
smb_send_open(struct Curl_easy * data)518 static CURLcode smb_send_open(struct Curl_easy *data)
519 {
520 struct smb_request *req = data->req.p.smb;
521 struct smb_nt_create msg;
522 size_t byte_count;
523
524 if((strlen(req->path) + 1) > sizeof(msg.bytes))
525 return CURLE_FILESIZE_EXCEEDED;
526
527 memset(&msg, 0, sizeof(msg));
528 msg.word_count = SMB_WC_NT_CREATE_ANDX;
529 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
530 byte_count = strlen(req->path);
531 msg.name_length = smb_swap16((unsigned short)byte_count);
532 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
533 if(data->set.upload) {
534 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
535 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
536 }
537 else {
538 msg.access = smb_swap32(SMB_GENERIC_READ);
539 msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
540 }
541 msg.byte_count = smb_swap16((unsigned short) ++byte_count);
542 strcpy(msg.bytes, req->path);
543
544 return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
545 sizeof(msg) - sizeof(msg.bytes) + byte_count);
546 }
547
smb_send_close(struct Curl_easy * data)548 static CURLcode smb_send_close(struct Curl_easy *data)
549 {
550 struct smb_request *req = data->req.p.smb;
551 struct smb_close msg;
552
553 memset(&msg, 0, sizeof(msg));
554 msg.word_count = SMB_WC_CLOSE;
555 msg.fid = smb_swap16(req->fid);
556
557 return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
558 }
559
smb_send_tree_disconnect(struct Curl_easy * data)560 static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
561 {
562 struct smb_tree_disconnect msg;
563
564 memset(&msg, 0, sizeof(msg));
565
566 return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
567 }
568
smb_send_read(struct Curl_easy * data)569 static CURLcode smb_send_read(struct Curl_easy *data)
570 {
571 struct smb_request *req = data->req.p.smb;
572 curl_off_t offset = data->req.offset;
573 struct smb_read msg;
574
575 memset(&msg, 0, sizeof(msg));
576 msg.word_count = SMB_WC_READ_ANDX;
577 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
578 msg.fid = smb_swap16(req->fid);
579 msg.offset = smb_swap32((unsigned int) offset);
580 msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
581 msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
582 msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
583
584 return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
585 }
586
smb_send_write(struct Curl_easy * data)587 static CURLcode smb_send_write(struct Curl_easy *data)
588 {
589 struct smb_write *msg;
590 struct smb_request *req = data->req.p.smb;
591 curl_off_t offset = data->req.offset;
592 curl_off_t upload_size = data->req.size - data->req.bytecount;
593 CURLcode result = Curl_get_upload_buffer(data);
594 if(result)
595 return result;
596 msg = (struct smb_write *)data->state.ulbuf;
597
598 if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
599 upload_size = MAX_PAYLOAD_SIZE - 1;
600
601 memset(msg, 0, sizeof(*msg));
602 msg->word_count = SMB_WC_WRITE_ANDX;
603 msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
604 msg->fid = smb_swap16(req->fid);
605 msg->offset = smb_swap32((unsigned int) offset);
606 msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
607 msg->data_length = smb_swap16((unsigned short) upload_size);
608 msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
609 msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
610
611 smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
612 sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
613
614 return smb_send(data, sizeof(*msg), (size_t) upload_size);
615 }
616
smb_send_and_recv(struct Curl_easy * data,void ** msg)617 static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
618 {
619 struct connectdata *conn = data->conn;
620 struct smb_conn *smbc = &conn->proto.smbc;
621 CURLcode result;
622 *msg = NULL; /* if it returns early */
623
624 /* Check if there is data in the transfer buffer */
625 if(!smbc->send_size && smbc->upload_size) {
626 size_t nread = smbc->upload_size > (size_t)data->set.upload_buffer_size ?
627 (size_t)data->set.upload_buffer_size : smbc->upload_size;
628 data->req.upload_fromhere = data->state.ulbuf;
629 result = Curl_fillreadbuffer(data, nread, &nread);
630 if(result && result != CURLE_AGAIN)
631 return result;
632 if(!nread)
633 return CURLE_OK;
634
635 smbc->upload_size -= nread;
636 smbc->send_size = nread;
637 smbc->sent = 0;
638 }
639
640 /* Check if there is data to send */
641 if(smbc->send_size) {
642 result = smb_flush(data);
643 if(result)
644 return result;
645 }
646
647 /* Check if there is still data to be sent */
648 if(smbc->send_size || smbc->upload_size)
649 return CURLE_AGAIN;
650
651 return smb_recv_message(data, msg);
652 }
653
smb_connection_state(struct Curl_easy * data,bool * done)654 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
655 {
656 struct connectdata *conn = data->conn;
657 struct smb_conn *smbc = &conn->proto.smbc;
658 struct smb_negotiate_response *nrsp;
659 struct smb_header *h;
660 CURLcode result;
661 void *msg = NULL;
662
663 if(smbc->state == SMB_CONNECTING) {
664 #ifdef USE_SSL
665 if((conn->handler->flags & PROTOPT_SSL)) {
666 bool ssl_done = FALSE;
667 result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
668 if(result && result != CURLE_AGAIN)
669 return result;
670 if(!ssl_done)
671 return CURLE_OK;
672 }
673 #endif
674
675 result = smb_send_negotiate(data);
676 if(result) {
677 connclose(conn, "SMB: failed to send negotiate message");
678 return result;
679 }
680
681 conn_state(data, SMB_NEGOTIATE);
682 }
683
684 /* Send the previous message and check for a response */
685 result = smb_send_and_recv(data, &msg);
686 if(result && result != CURLE_AGAIN) {
687 connclose(conn, "SMB: failed to communicate");
688 return result;
689 }
690
691 if(!msg)
692 return CURLE_OK;
693
694 h = msg;
695
696 switch(smbc->state) {
697 case SMB_NEGOTIATE:
698 if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
699 h->status) {
700 connclose(conn, "SMB: negotiation failed");
701 return CURLE_COULDNT_CONNECT;
702 }
703 nrsp = msg;
704 memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
705 smbc->session_key = smb_swap32(nrsp->session_key);
706 result = smb_send_setup(data);
707 if(result) {
708 connclose(conn, "SMB: failed to send setup message");
709 return result;
710 }
711 conn_state(data, SMB_SETUP);
712 break;
713
714 case SMB_SETUP:
715 if(h->status) {
716 connclose(conn, "SMB: authentication failed");
717 return CURLE_LOGIN_DENIED;
718 }
719 smbc->uid = smb_swap16(h->uid);
720 conn_state(data, SMB_CONNECTED);
721 *done = true;
722 break;
723
724 default:
725 smb_pop_message(conn);
726 return CURLE_OK; /* ignore */
727 }
728
729 smb_pop_message(conn);
730
731 return CURLE_OK;
732 }
733
734 /*
735 * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
736 * to Posix time. Cap the output to fit within a time_t.
737 */
get_posix_time(time_t * out,curl_off_t timestamp)738 static void get_posix_time(time_t *out, curl_off_t timestamp)
739 {
740 timestamp -= 116444736000000000;
741 timestamp /= 10000000;
742 #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
743 if(timestamp > TIME_T_MAX)
744 *out = TIME_T_MAX;
745 else if(timestamp < TIME_T_MIN)
746 *out = TIME_T_MIN;
747 else
748 #endif
749 *out = (time_t) timestamp;
750 }
751
smb_request_state(struct Curl_easy * data,bool * done)752 static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
753 {
754 struct connectdata *conn = data->conn;
755 struct smb_request *req = data->req.p.smb;
756 struct smb_header *h;
757 struct smb_conn *smbc = &conn->proto.smbc;
758 enum smb_req_state next_state = SMB_DONE;
759 unsigned short len;
760 unsigned short off;
761 CURLcode result;
762 void *msg = NULL;
763 const struct smb_nt_create_response *smb_m;
764
765 if(data->set.upload && (data->state.infilesize < 0)) {
766 failf(data, "SMB upload needs to know the size up front");
767 return CURLE_SEND_ERROR;
768 }
769
770 /* Start the request */
771 if(req->state == SMB_REQUESTING) {
772 result = smb_send_tree_connect(data);
773 if(result) {
774 connclose(conn, "SMB: failed to send tree connect message");
775 return result;
776 }
777
778 request_state(data, SMB_TREE_CONNECT);
779 }
780
781 /* Send the previous message and check for a response */
782 result = smb_send_and_recv(data, &msg);
783 if(result && result != CURLE_AGAIN) {
784 connclose(conn, "SMB: failed to communicate");
785 return result;
786 }
787
788 if(!msg)
789 return CURLE_OK;
790
791 h = msg;
792
793 switch(req->state) {
794 case SMB_TREE_CONNECT:
795 if(h->status) {
796 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
797 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
798 req->result = CURLE_REMOTE_ACCESS_DENIED;
799 break;
800 }
801 req->tid = smb_swap16(h->tid);
802 next_state = SMB_OPEN;
803 break;
804
805 case SMB_OPEN:
806 if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
807 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
808 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
809 req->result = CURLE_REMOTE_ACCESS_DENIED;
810 next_state = SMB_TREE_DISCONNECT;
811 break;
812 }
813 smb_m = (const struct smb_nt_create_response*) msg;
814 req->fid = smb_swap16(smb_m->fid);
815 data->req.offset = 0;
816 if(data->set.upload) {
817 data->req.size = data->state.infilesize;
818 Curl_pgrsSetUploadSize(data, data->req.size);
819 next_state = SMB_UPLOAD;
820 }
821 else {
822 smb_m = (const struct smb_nt_create_response*) msg;
823 data->req.size = smb_swap64(smb_m->end_of_file);
824 if(data->req.size < 0) {
825 req->result = CURLE_WEIRD_SERVER_REPLY;
826 next_state = SMB_CLOSE;
827 }
828 else {
829 Curl_pgrsSetDownloadSize(data, data->req.size);
830 if(data->set.get_filetime)
831 get_posix_time(&data->info.filetime, smb_m->last_change_time);
832 next_state = SMB_DOWNLOAD;
833 }
834 }
835 break;
836
837 case SMB_DOWNLOAD:
838 if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
839 req->result = CURLE_RECV_ERROR;
840 next_state = SMB_CLOSE;
841 break;
842 }
843 len = Curl_read16_le(((const unsigned char *) msg) +
844 sizeof(struct smb_header) + 11);
845 off = Curl_read16_le(((const unsigned char *) msg) +
846 sizeof(struct smb_header) + 13);
847 if(len > 0) {
848 if(off + sizeof(unsigned int) + len > smbc->got) {
849 failf(data, "Invalid input packet");
850 result = CURLE_RECV_ERROR;
851 }
852 else
853 result = Curl_client_write(data, CLIENTWRITE_BODY,
854 (char *)msg + off + sizeof(unsigned int),
855 len);
856 if(result) {
857 req->result = result;
858 next_state = SMB_CLOSE;
859 break;
860 }
861 }
862 data->req.bytecount += len;
863 data->req.offset += len;
864 Curl_pgrsSetDownloadCounter(data, data->req.bytecount);
865 next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
866 break;
867
868 case SMB_UPLOAD:
869 if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
870 req->result = CURLE_UPLOAD_FAILED;
871 next_state = SMB_CLOSE;
872 break;
873 }
874 len = Curl_read16_le(((const unsigned char *) msg) +
875 sizeof(struct smb_header) + 5);
876 data->req.bytecount += len;
877 data->req.offset += len;
878 Curl_pgrsSetUploadCounter(data, data->req.bytecount);
879 if(data->req.bytecount >= data->req.size)
880 next_state = SMB_CLOSE;
881 else
882 next_state = SMB_UPLOAD;
883 break;
884
885 case SMB_CLOSE:
886 /* We don't care if the close failed, proceed to tree disconnect anyway */
887 next_state = SMB_TREE_DISCONNECT;
888 break;
889
890 case SMB_TREE_DISCONNECT:
891 next_state = SMB_DONE;
892 break;
893
894 default:
895 smb_pop_message(conn);
896 return CURLE_OK; /* ignore */
897 }
898
899 smb_pop_message(conn);
900
901 switch(next_state) {
902 case SMB_OPEN:
903 result = smb_send_open(data);
904 break;
905
906 case SMB_DOWNLOAD:
907 result = smb_send_read(data);
908 break;
909
910 case SMB_UPLOAD:
911 result = smb_send_write(data);
912 break;
913
914 case SMB_CLOSE:
915 result = smb_send_close(data);
916 break;
917
918 case SMB_TREE_DISCONNECT:
919 result = smb_send_tree_disconnect(data);
920 break;
921
922 case SMB_DONE:
923 result = req->result;
924 *done = true;
925 break;
926
927 default:
928 break;
929 }
930
931 if(result) {
932 connclose(conn, "SMB: failed to send message");
933 return result;
934 }
935
936 request_state(data, next_state);
937
938 return CURLE_OK;
939 }
940
smb_disconnect(struct Curl_easy * data,struct connectdata * conn,bool dead)941 static CURLcode smb_disconnect(struct Curl_easy *data,
942 struct connectdata *conn, bool dead)
943 {
944 struct smb_conn *smbc = &conn->proto.smbc;
945 (void) dead;
946 (void) data;
947 Curl_safefree(smbc->share);
948 Curl_safefree(smbc->domain);
949 Curl_safefree(smbc->recv_buf);
950 return CURLE_OK;
951 }
952
smb_getsock(struct Curl_easy * data,struct connectdata * conn,curl_socket_t * socks)953 static int smb_getsock(struct Curl_easy *data,
954 struct connectdata *conn, curl_socket_t *socks)
955 {
956 (void)data;
957 socks[0] = conn->sock[FIRSTSOCKET];
958 return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
959 }
960
smb_do(struct Curl_easy * data,bool * done)961 static CURLcode smb_do(struct Curl_easy *data, bool *done)
962 {
963 struct connectdata *conn = data->conn;
964 struct smb_conn *smbc = &conn->proto.smbc;
965
966 *done = FALSE;
967 if(smbc->share) {
968 return CURLE_OK;
969 }
970 return CURLE_URL_MALFORMAT;
971 }
972
smb_parse_url_path(struct Curl_easy * data,struct connectdata * conn)973 static CURLcode smb_parse_url_path(struct Curl_easy *data,
974 struct connectdata *conn)
975 {
976 struct smb_request *req = data->req.p.smb;
977 struct smb_conn *smbc = &conn->proto.smbc;
978 char *path;
979 char *slash;
980
981 /* URL decode the path */
982 CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
983 REJECT_CTRL);
984 if(result)
985 return result;
986
987 /* Parse the path for the share */
988 smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
989 free(path);
990 if(!smbc->share)
991 return CURLE_OUT_OF_MEMORY;
992
993 slash = strchr(smbc->share, '/');
994 if(!slash)
995 slash = strchr(smbc->share, '\\');
996
997 /* The share must be present */
998 if(!slash) {
999 Curl_safefree(smbc->share);
1000 failf(data, "missing share in URL path for SMB");
1001 return CURLE_URL_MALFORMAT;
1002 }
1003
1004 /* Parse the path for the file path converting any forward slashes into
1005 backslashes */
1006 *slash++ = 0;
1007 req->path = slash;
1008
1009 for(; *slash; slash++) {
1010 if(*slash == '/')
1011 *slash = '\\';
1012 }
1013 return CURLE_OK;
1014 }
1015
1016 #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
1017 SIZEOF_CURL_OFF_T > 4 */
1018