• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /***************************************************************************
2  *                                  _   _ ____  _
3  *  Project                     ___| | | |  _ \| |
4  *                             / __| | | | |_) | |
5  *                            | (__| |_| |  _ <| |___
6  *                             \___|\___/|_| \_\_____|
7  *
8  * Copyright (C) 2014, Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
9  * Copyright (C) 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
10  *
11  * This software is licensed as described in the file COPYING, which
12  * you should have received as part of this distribution. The terms
13  * are also available at https://curl.haxx.se/docs/copyright.html.
14  *
15  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16  * copies of the Software, and permit persons to whom the Software is
17  * furnished to do so, under the terms of the COPYING file.
18  *
19  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20  * KIND, either express or implied.
21  *
22  ***************************************************************************/
23 
24 #include "curl_setup.h"
25 
26 #if !defined(CURL_DISABLE_SMB) && defined(USE_NTLM) && \
27     (CURL_SIZEOF_CURL_OFF_T > 4)
28 
29 #if !defined(USE_WINDOWS_SSPI) || defined(USE_WIN32_CRYPTO)
30 
31 #define BUILDING_CURL_SMB_C
32 
33 #ifdef HAVE_PROCESS_H
34 #include <process.h>
35 #define getpid _getpid
36 #endif
37 
38 #include "smb.h"
39 #include "urldata.h"
40 #include "sendf.h"
41 #include "multiif.h"
42 #include "connect.h"
43 #include "progress.h"
44 #include "transfer.h"
45 #include "vtls/vtls.h"
46 #include "curl_ntlm_core.h"
47 #include "escape.h"
48 #include "curl_endian.h"
49 
50 /* The last #include files should be: */
51 #include "curl_memory.h"
52 #include "memdebug.h"
53 
54 /* Local API functions */
55 static CURLcode smb_setup_connection(struct connectdata *conn);
56 static CURLcode smb_connect(struct connectdata *conn, bool *done);
57 static CURLcode smb_connection_state(struct connectdata *conn, bool *done);
58 static CURLcode smb_request_state(struct connectdata *conn, bool *done);
59 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
60                          bool premature);
61 static CURLcode smb_disconnect(struct connectdata *conn, bool dead);
62 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
63                        int numsocks);
64 static CURLcode smb_parse_url_path(struct connectdata *conn);
65 
66 /*
67  * SMB handler interface
68  */
69 const struct Curl_handler Curl_handler_smb = {
70   "SMB",                                /* scheme */
71   smb_setup_connection,                 /* setup_connection */
72   ZERO_NULL,                            /* do_it */
73   smb_done,                             /* done */
74   ZERO_NULL,                            /* do_more */
75   smb_connect,                          /* connect_it */
76   smb_connection_state,                 /* connecting */
77   smb_request_state,                    /* doing */
78   smb_getsock,                          /* proto_getsock */
79   smb_getsock,                          /* doing_getsock */
80   ZERO_NULL,                            /* domore_getsock */
81   ZERO_NULL,                            /* perform_getsock */
82   smb_disconnect,                       /* disconnect */
83   ZERO_NULL,                            /* readwrite */
84   PORT_SMB,                             /* defport */
85   CURLPROTO_SMB,                        /* protocol */
86   PROTOPT_NONE                          /* flags */
87 };
88 
89 #ifdef USE_SSL
90 /*
91  * SMBS handler interface
92  */
93 const struct Curl_handler Curl_handler_smbs = {
94   "SMBS",                               /* scheme */
95   smb_setup_connection,                 /* setup_connection */
96   ZERO_NULL,                            /* do_it */
97   smb_done,                             /* done */
98   ZERO_NULL,                            /* do_more */
99   smb_connect,                          /* connect_it */
100   smb_connection_state,                 /* connecting */
101   smb_request_state,                    /* doing */
102   smb_getsock,                          /* proto_getsock */
103   smb_getsock,                          /* doing_getsock */
104   ZERO_NULL,                            /* domore_getsock */
105   ZERO_NULL,                            /* perform_getsock */
106   smb_disconnect,                       /* disconnect */
107   ZERO_NULL,                            /* readwrite */
108   PORT_SMBS,                            /* defport */
109   CURLPROTO_SMBS,                       /* protocol */
110   PROTOPT_SSL                           /* flags */
111 };
112 #endif
113 
114 #define MAX_PAYLOAD_SIZE  0x8000
115 #define MAX_MESSAGE_SIZE  (MAX_PAYLOAD_SIZE + 0x1000)
116 #define CLIENTNAME        "curl"
117 #define SERVICENAME       "?????"
118 
119 /* Append a string to an SMB message */
120 #define MSGCAT(str) \
121   strcpy(p, (str)); \
122   p += strlen(str);
123 
124 /* Append a null-terminated string to an SMB message */
125 #define MSGCATNULL(str) \
126   strcpy(p, (str)); \
127   p += strlen(str) + 1;
128 
129 /* SMB is mostly little endian */
130 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
131    defined(__OS400__)
smb_swap16(unsigned short x)132 static unsigned short smb_swap16(unsigned short x)
133 {
134   return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
135 }
136 
smb_swap32(unsigned int x)137 static unsigned int smb_swap32(unsigned int x)
138 {
139   return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
140          ((x >> 24) & 0xff);
141 }
142 
143 #ifdef HAVE_LONGLONG
smb_swap64(unsigned long long x)144 static unsigned long long smb_swap64(unsigned long long x)
145 {
146   return ((unsigned long long) smb_swap32((unsigned int) x) << 32) |
147           smb_swap32((unsigned int) (x >> 32));
148 }
149 #else
smb_swap64(unsigned __int64 x)150 static unsigned __int64 smb_swap64(unsigned __int64 x)
151 {
152   return ((unsigned __int64) smb_swap32((unsigned int) x) << 32) |
153           smb_swap32((unsigned int) (x >> 32));
154 }
155 #endif
156 #else
157 #  define smb_swap16(x) (x)
158 #  define smb_swap32(x) (x)
159 #  define smb_swap64(x) (x)
160 #endif
161 
162 /* SMB request state */
163 enum smb_req_state {
164   SMB_REQUESTING,
165   SMB_TREE_CONNECT,
166   SMB_OPEN,
167   SMB_DOWNLOAD,
168   SMB_UPLOAD,
169   SMB_CLOSE,
170   SMB_TREE_DISCONNECT,
171   SMB_DONE
172 };
173 
174 /* SMB request data */
175 struct smb_request {
176   enum smb_req_state state;
177   char *share;
178   char *path;
179   unsigned short tid; /* Even if we connect to the same tree as another */
180   unsigned short fid; /* request, the tid will be different */
181   CURLcode result;
182 };
183 
conn_state(struct connectdata * conn,enum smb_conn_state newstate)184 static void conn_state(struct connectdata *conn, enum smb_conn_state newstate)
185 {
186   struct smb_conn *smb = &conn->proto.smbc;
187 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
188   /* For debug purposes */
189   static const char * const names[] = {
190     "SMB_NOT_CONNECTED",
191     "SMB_CONNECTING",
192     "SMB_NEGOTIATE",
193     "SMB_SETUP",
194     "SMB_CONNECTED",
195     /* LAST */
196   };
197 
198   if(smb->state != newstate)
199     infof(conn->data, "SMB conn %p state change from %s to %s\n",
200     (void *)smb, names[smb->state], names[newstate]);
201 #endif
202 
203   smb->state = newstate;
204 }
205 
request_state(struct connectdata * conn,enum smb_req_state newstate)206 static void request_state(struct connectdata *conn,
207                           enum smb_req_state newstate)
208 {
209   struct smb_request *req = conn->data->req.protop;
210 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
211   /* For debug purposes */
212   static const char * const names[] = {
213     "SMB_REQUESTING",
214     "SMB_TREE_CONNECT",
215     "SMB_OPEN",
216     "SMB_DOWNLOAD",
217     "SMB_UPLOAD",
218     "SMB_CLOSE",
219     "SMB_TREE_DISCONNECT",
220     "SMB_DONE",
221     /* LAST */
222   };
223 
224   if(req->state != newstate)
225     infof(conn->data, "SMB request %p state change from %s to %s\n",
226     (void *)req, names[req->state], names[newstate]);
227 #endif
228 
229   req->state = newstate;
230 }
231 
smb_setup_connection(struct connectdata * conn)232 static CURLcode smb_setup_connection(struct connectdata *conn)
233 {
234   struct smb_request *req;
235 
236   /* Initialize the request state */
237   conn->data->req.protop = req = calloc(1, sizeof(struct smb_request));
238   if(!req)
239     return CURLE_OUT_OF_MEMORY;
240 
241   /* Parse the URL path */
242   return smb_parse_url_path(conn);
243 }
244 
smb_connect(struct connectdata * conn,bool * done)245 static CURLcode smb_connect(struct connectdata *conn, bool *done)
246 {
247   struct smb_conn *smbc = &conn->proto.smbc;
248   char *slash;
249 
250   (void) done;
251 
252   /* Check we have a username and password to authenticate with */
253   if(!conn->bits.user_passwd)
254     return CURLE_LOGIN_DENIED;
255 
256   /* Initialize the connection state */
257   memset(smbc, 0, sizeof(*smbc));
258   smbc->state = SMB_CONNECTING;
259   smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
260   if(!smbc->recv_buf)
261     return CURLE_OUT_OF_MEMORY;
262 
263   /* Multiple requests are allowed with this connection */
264   connkeep(conn, "SMB default");
265 
266   /* Parse the username, domain, and password */
267   slash = strchr(conn->user, '/');
268   if(!slash)
269     slash = strchr(conn->user, '\\');
270 
271   if(slash) {
272     smbc->user = slash + 1;
273     smbc->domain = strdup(conn->user);
274     if(!smbc->domain)
275       return CURLE_OUT_OF_MEMORY;
276     smbc->domain[slash - conn->user] = 0;
277   }
278   else {
279     smbc->user = conn->user;
280     smbc->domain = strdup(conn->host.name);
281     if(!smbc->domain)
282       return CURLE_OUT_OF_MEMORY;
283   }
284 
285   return CURLE_OK;
286 }
287 
smb_recv_message(struct connectdata * conn,void ** msg)288 static CURLcode smb_recv_message(struct connectdata *conn, void **msg)
289 {
290   struct smb_conn *smbc = &conn->proto.smbc;
291   char *buf = smbc->recv_buf;
292   ssize_t bytes_read;
293   size_t nbt_size;
294   size_t msg_size;
295   size_t len = MAX_MESSAGE_SIZE - smbc->got;
296   CURLcode result;
297 
298   result = Curl_read(conn, FIRSTSOCKET, buf + smbc->got, len, &bytes_read);
299   if(result)
300     return result;
301 
302   if(!bytes_read)
303     return CURLE_OK;
304 
305   smbc->got += bytes_read;
306 
307   /* Check for a 32-bit nbt header */
308   if(smbc->got < sizeof(unsigned int))
309     return CURLE_OK;
310 
311   nbt_size = Curl_read16_be((const unsigned char *)(buf +
312              sizeof(unsigned short))) + sizeof(unsigned int);
313   if(smbc->got < nbt_size)
314     return CURLE_OK;
315 
316   msg_size = sizeof(struct smb_header);
317   if(nbt_size >= msg_size + 1) {
318     /* Add the word count */
319     msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
320     if(nbt_size >= msg_size + sizeof(unsigned short)) {
321       /* Add the byte count */
322       msg_size += sizeof(unsigned short) +
323                   Curl_read16_le((const unsigned char *)&buf[msg_size]);
324       if(nbt_size < msg_size)
325         return CURLE_READ_ERROR;
326     }
327   }
328 
329   *msg = buf;
330 
331   return CURLE_OK;
332 }
333 
smb_pop_message(struct connectdata * conn)334 static void smb_pop_message(struct connectdata *conn)
335 {
336   struct smb_conn *smbc = &conn->proto.smbc;
337 
338   smbc->got = 0;
339 }
340 
smb_format_message(struct connectdata * conn,struct smb_header * h,unsigned char cmd,size_t len)341 static void smb_format_message(struct connectdata *conn, struct smb_header *h,
342                                unsigned char cmd, size_t len)
343 {
344   struct smb_conn *smbc = &conn->proto.smbc;
345   struct smb_request *req = conn->data->req.protop;
346   unsigned int pid;
347 
348   memset(h, 0, sizeof(*h));
349   h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
350                                           len));
351   memcpy((char *)h->magic, "\xffSMB", 4);
352   h->command = cmd;
353   h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
354   h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
355   h->uid = smb_swap16(smbc->uid);
356   h->tid = smb_swap16(req->tid);
357   pid = getpid();
358   h->pid_high = smb_swap16((unsigned short)(pid >> 16));
359   h->pid = smb_swap16((unsigned short) pid);
360 }
361 
smb_send(struct connectdata * conn,ssize_t len,size_t upload_size)362 static CURLcode smb_send(struct connectdata *conn, ssize_t len,
363                          size_t upload_size)
364 {
365   struct smb_conn *smbc = &conn->proto.smbc;
366   ssize_t bytes_written;
367   CURLcode result;
368 
369   result = Curl_write(conn, FIRSTSOCKET, conn->data->state.uploadbuffer,
370                       len, &bytes_written);
371   if(result)
372     return result;
373 
374   if(bytes_written != len) {
375     smbc->send_size = len;
376     smbc->sent = bytes_written;
377   }
378 
379   smbc->upload_size = upload_size;
380 
381   return CURLE_OK;
382 }
383 
smb_flush(struct connectdata * conn)384 static CURLcode smb_flush(struct connectdata *conn)
385 {
386   struct smb_conn *smbc = &conn->proto.smbc;
387   ssize_t bytes_written;
388   ssize_t len = smbc->send_size - smbc->sent;
389   CURLcode result;
390 
391   if(!smbc->send_size)
392     return CURLE_OK;
393 
394   result = Curl_write(conn, FIRSTSOCKET,
395                       conn->data->state.uploadbuffer + smbc->sent,
396                       len, &bytes_written);
397   if(result)
398     return result;
399 
400   if(bytes_written != len)
401     smbc->sent += bytes_written;
402   else
403     smbc->send_size = 0;
404 
405   return CURLE_OK;
406 }
407 
smb_send_message(struct connectdata * conn,unsigned char cmd,const void * msg,size_t msg_len)408 static CURLcode smb_send_message(struct connectdata *conn, unsigned char cmd,
409                                  const void *msg, size_t msg_len)
410 {
411   smb_format_message(conn, (struct smb_header *)conn->data->state.uploadbuffer,
412                      cmd, msg_len);
413   memcpy(conn->data->state.uploadbuffer + sizeof(struct smb_header),
414          msg, msg_len);
415 
416   return smb_send(conn, sizeof(struct smb_header) + msg_len, 0);
417 }
418 
smb_send_negotiate(struct connectdata * conn)419 static CURLcode smb_send_negotiate(struct connectdata *conn)
420 {
421   const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
422 
423   return smb_send_message(conn, SMB_COM_NEGOTIATE, msg, 15);
424 }
425 
smb_send_setup(struct connectdata * conn)426 static CURLcode smb_send_setup(struct connectdata *conn)
427 {
428   struct smb_conn *smbc = &conn->proto.smbc;
429   struct smb_setup msg;
430   char *p = msg.bytes;
431   unsigned char lm_hash[21];
432   unsigned char lm[24];
433   unsigned char nt_hash[21];
434   unsigned char nt[24];
435 
436   size_t byte_count = sizeof(lm) + sizeof(nt);
437   byte_count += strlen(smbc->user) + strlen(smbc->domain);
438   byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
439   if(byte_count > sizeof(msg.bytes))
440     return CURLE_FILESIZE_EXCEEDED;
441 
442   Curl_ntlm_core_mk_lm_hash(conn->data, conn->passwd, lm_hash);
443   Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
444 #if USE_NTRESPONSES
445   Curl_ntlm_core_mk_nt_hash(conn->data, conn->passwd, nt_hash);
446   Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
447 #else
448   memset(nt, 0, sizeof(nt));
449 #endif
450 
451   memset(&msg, 0, sizeof(msg));
452   msg.word_count = SMB_WC_SETUP_ANDX;
453   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
454   msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
455   msg.max_mpx_count = smb_swap16(1);
456   msg.vc_number = smb_swap16(1);
457   msg.session_key = smb_swap32(smbc->session_key);
458   msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
459   msg.lengths[0] = smb_swap16(sizeof(lm));
460   msg.lengths[1] = smb_swap16(sizeof(nt));
461   memcpy(p, lm, sizeof(lm));
462   p += sizeof(lm);
463   memcpy(p, nt, sizeof(nt));
464   p += sizeof(nt);
465   MSGCATNULL(smbc->user);
466   MSGCATNULL(smbc->domain);
467   MSGCATNULL(OS);
468   MSGCATNULL(CLIENTNAME);
469   byte_count = p - msg.bytes;
470   msg.byte_count = smb_swap16((unsigned short)byte_count);
471 
472   return smb_send_message(conn, SMB_COM_SETUP_ANDX, &msg,
473                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
474 }
475 
smb_send_tree_connect(struct connectdata * conn)476 static CURLcode smb_send_tree_connect(struct connectdata *conn)
477 {
478   struct smb_request *req = conn->data->req.protop;
479   struct smb_tree_connect msg;
480   char *p = msg.bytes;
481 
482   size_t byte_count = strlen(conn->host.name) + strlen(req->share);
483   byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
484   if(byte_count > sizeof(msg.bytes))
485     return CURLE_FILESIZE_EXCEEDED;
486 
487   memset(&msg, 0, sizeof(msg));
488   msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
489   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
490   msg.pw_len = 0;
491   MSGCAT("\\\\");
492   MSGCAT(conn->host.name);
493   MSGCAT("\\");
494   MSGCATNULL(req->share);
495   MSGCATNULL(SERVICENAME); /* Match any type of service */
496   byte_count = p - msg.bytes;
497   msg.byte_count = smb_swap16((unsigned short)byte_count);
498 
499   return smb_send_message(conn, SMB_COM_TREE_CONNECT_ANDX, &msg,
500                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
501 }
502 
smb_send_open(struct connectdata * conn)503 static CURLcode smb_send_open(struct connectdata *conn)
504 {
505   struct smb_request *req = conn->data->req.protop;
506   struct smb_nt_create msg;
507   size_t byte_count;
508 
509   if((strlen(req->path) + 1) > sizeof(msg.bytes))
510     return CURLE_FILESIZE_EXCEEDED;
511 
512   memset(&msg, 0, sizeof(msg));
513   msg.word_count = SMB_WC_NT_CREATE_ANDX;
514   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
515   byte_count = strlen(req->path);
516   msg.name_length = smb_swap16((unsigned short)byte_count);
517   msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
518   if(conn->data->set.upload) {
519     msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
520     msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
521   }
522   else {
523     msg.access = smb_swap32(SMB_GENERIC_READ);
524     msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
525   }
526   msg.byte_count = smb_swap16((unsigned short) ++byte_count);
527   strcpy(msg.bytes, req->path);
528 
529   return smb_send_message(conn, SMB_COM_NT_CREATE_ANDX, &msg,
530                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
531 }
532 
smb_send_close(struct connectdata * conn)533 static CURLcode smb_send_close(struct connectdata *conn)
534 {
535   struct smb_request *req = conn->data->req.protop;
536   struct smb_close msg;
537 
538   memset(&msg, 0, sizeof(msg));
539   msg.word_count = SMB_WC_CLOSE;
540   msg.fid = smb_swap16(req->fid);
541 
542   return smb_send_message(conn, SMB_COM_CLOSE, &msg, sizeof(msg));
543 }
544 
smb_send_tree_disconnect(struct connectdata * conn)545 static CURLcode smb_send_tree_disconnect(struct connectdata *conn)
546 {
547   struct smb_tree_disconnect msg;
548 
549   memset(&msg, 0, sizeof(msg));
550 
551   return smb_send_message(conn, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
552 }
553 
smb_send_read(struct connectdata * conn)554 static CURLcode smb_send_read(struct connectdata *conn)
555 {
556   struct smb_request *req = conn->data->req.protop;
557   curl_off_t offset = conn->data->req.offset;
558   struct smb_read msg;
559 
560   memset(&msg, 0, sizeof(msg));
561   msg.word_count = SMB_WC_READ_ANDX;
562   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
563   msg.fid = smb_swap16(req->fid);
564   msg.offset = smb_swap32((unsigned int) offset);
565   msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
566   msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
567   msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
568 
569   return smb_send_message(conn, SMB_COM_READ_ANDX, &msg, sizeof(msg));
570 }
571 
smb_send_write(struct connectdata * conn)572 static CURLcode smb_send_write(struct connectdata *conn)
573 {
574   struct smb_write *msg = (struct smb_write *)conn->data->state.uploadbuffer;
575   struct smb_request *req = conn->data->req.protop;
576   curl_off_t offset = conn->data->req.offset;
577 
578   curl_off_t upload_size = conn->data->req.size - conn->data->req.bytecount;
579   if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
580     upload_size = MAX_PAYLOAD_SIZE - 1;
581 
582   memset(msg, 0, sizeof(*msg));
583   msg->word_count = SMB_WC_WRITE_ANDX;
584   msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
585   msg->fid = smb_swap16(req->fid);
586   msg->offset = smb_swap32((unsigned int) offset);
587   msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
588   msg->data_length = smb_swap16((unsigned short) upload_size);
589   msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
590   msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
591 
592   smb_format_message(conn, &msg->h, SMB_COM_WRITE_ANDX,
593                      sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
594 
595   return smb_send(conn, sizeof(*msg), (size_t) upload_size);
596 }
597 
smb_send_and_recv(struct connectdata * conn,void ** msg)598 static CURLcode smb_send_and_recv(struct connectdata *conn, void **msg)
599 {
600   struct smb_conn *smbc = &conn->proto.smbc;
601   CURLcode result;
602 
603   /* Check if there is data in the transfer buffer */
604   if(!smbc->send_size && smbc->upload_size) {
605     int nread = smbc->upload_size > BUFSIZE ? BUFSIZE :
606                                               (int) smbc->upload_size;
607     conn->data->req.upload_fromhere = conn->data->state.uploadbuffer;
608     result = Curl_fillreadbuffer(conn, nread, &nread);
609     if(result && result != CURLE_AGAIN)
610       return result;
611     if(!nread)
612       return CURLE_OK;
613 
614     smbc->upload_size -= nread;
615     smbc->send_size = nread;
616     smbc->sent = 0;
617   }
618 
619   /* Check if there is data to send */
620   if(smbc->send_size) {
621     result = smb_flush(conn);
622     if(result)
623       return result;
624   }
625 
626   /* Check if there is still data to be sent */
627   if(smbc->send_size || smbc->upload_size)
628     return CURLE_AGAIN;
629 
630   return smb_recv_message(conn, msg);
631 }
632 
smb_connection_state(struct connectdata * conn,bool * done)633 static CURLcode smb_connection_state(struct connectdata *conn, bool *done)
634 {
635   struct smb_conn *smbc = &conn->proto.smbc;
636   struct smb_negotiate_response *nrsp;
637   struct smb_header *h;
638   CURLcode result;
639   void *msg = NULL;
640 
641   if(smbc->state == SMB_CONNECTING) {
642 #ifdef USE_SSL
643     if((conn->handler->flags & PROTOPT_SSL)) {
644       bool ssl_done;
645       result = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &ssl_done);
646       if(result && result != CURLE_AGAIN)
647         return result;
648       if(!ssl_done)
649         return CURLE_OK;
650     }
651 #endif
652 
653     result = smb_send_negotiate(conn);
654     if(result) {
655       connclose(conn, "SMB: failed to send negotiate message");
656       return result;
657     }
658 
659     conn_state(conn, SMB_NEGOTIATE);
660   }
661 
662   /* Send the previous message and check for a response */
663   result = smb_send_and_recv(conn, &msg);
664   if(result && result != CURLE_AGAIN) {
665     connclose(conn, "SMB: failed to communicate");
666     return result;
667   }
668 
669   if(!msg)
670     return CURLE_OK;
671 
672   h = msg;
673 
674   switch(smbc->state) {
675   case SMB_NEGOTIATE:
676     if(h->status || smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) {
677       connclose(conn, "SMB: negotiation failed");
678       return CURLE_COULDNT_CONNECT;
679     }
680     nrsp = msg;
681     memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
682     smbc->session_key = smb_swap32(nrsp->session_key);
683     result = smb_send_setup(conn);
684     if(result) {
685       connclose(conn, "SMB: failed to send setup message");
686       return result;
687     }
688     conn_state(conn, SMB_SETUP);
689     break;
690 
691   case SMB_SETUP:
692     if(h->status) {
693       connclose(conn, "SMB: authentication failed");
694       return CURLE_LOGIN_DENIED;
695     }
696     smbc->uid = smb_swap16(h->uid);
697     conn_state(conn, SMB_CONNECTED);
698     *done = true;
699     break;
700 
701   default:
702     smb_pop_message(conn);
703     return CURLE_OK; /* ignore */
704   }
705 
706   smb_pop_message(conn);
707 
708   return CURLE_OK;
709 }
710 
smb_request_state(struct connectdata * conn,bool * done)711 static CURLcode smb_request_state(struct connectdata *conn, bool *done)
712 {
713   struct smb_request *req = conn->data->req.protop;
714   struct smb_header *h;
715   struct smb_conn *smbc = &conn->proto.smbc;
716   enum smb_req_state next_state = SMB_DONE;
717   unsigned short len;
718   unsigned short off;
719   CURLcode result;
720   void *msg = NULL;
721 
722   /* Start the request */
723   if(req->state == SMB_REQUESTING) {
724     result = smb_send_tree_connect(conn);
725     if(result) {
726       connclose(conn, "SMB: failed to send tree connect message");
727       return result;
728     }
729 
730     request_state(conn, SMB_TREE_CONNECT);
731   }
732 
733   /* Send the previous message and check for a response */
734   result = smb_send_and_recv(conn, &msg);
735   if(result && result != CURLE_AGAIN) {
736     connclose(conn, "SMB: failed to communicate");
737     return result;
738   }
739 
740   if(!msg)
741     return CURLE_OK;
742 
743   h = msg;
744 
745   switch(req->state) {
746   case SMB_TREE_CONNECT:
747     if(h->status) {
748       req->result = CURLE_REMOTE_FILE_NOT_FOUND;
749       if(h->status == smb_swap32(SMB_ERR_NOACCESS))
750         req->result = CURLE_REMOTE_ACCESS_DENIED;
751       break;
752     }
753     req->tid = smb_swap16(h->tid);
754     next_state = SMB_OPEN;
755     break;
756 
757   case SMB_OPEN:
758     if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
759       req->result = CURLE_REMOTE_FILE_NOT_FOUND;
760       next_state = SMB_TREE_DISCONNECT;
761       break;
762     }
763     req->fid = smb_swap16(((struct smb_nt_create_response *)msg)->fid);
764     conn->data->req.offset = 0;
765     if(conn->data->set.upload) {
766       conn->data->req.size = conn->data->state.infilesize;
767       Curl_pgrsSetUploadSize(conn->data, conn->data->req.size);
768       next_state = SMB_UPLOAD;
769     }
770     else {
771       conn->data->req.size =
772         smb_swap64(((struct smb_nt_create_response *)msg)->end_of_file);
773       Curl_pgrsSetDownloadSize(conn->data, conn->data->req.size);
774       next_state = SMB_DOWNLOAD;
775     }
776     break;
777 
778   case SMB_DOWNLOAD:
779     if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
780       req->result = CURLE_RECV_ERROR;
781       next_state = SMB_CLOSE;
782       break;
783     }
784     len = Curl_read16_le(((const unsigned char *) msg) +
785                          sizeof(struct smb_header) + 11);
786     off = Curl_read16_le(((const unsigned char *) msg) +
787                          sizeof(struct smb_header) + 13);
788     if(len > 0) {
789       if(off + sizeof(unsigned int) + len > smbc->got) {
790         failf(conn->data, "Invalid input packet");
791         result = CURLE_RECV_ERROR;
792       }
793       else
794         result = Curl_client_write(conn, CLIENTWRITE_BODY,
795                                    (char *)msg + off + sizeof(unsigned int),
796                                    len);
797       if(result) {
798         req->result = result;
799         next_state = SMB_CLOSE;
800         break;
801       }
802     }
803     conn->data->req.bytecount += len;
804     conn->data->req.offset += len;
805     Curl_pgrsSetDownloadCounter(conn->data, conn->data->req.bytecount);
806     next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
807     break;
808 
809   case SMB_UPLOAD:
810     if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
811       req->result = CURLE_UPLOAD_FAILED;
812       next_state = SMB_CLOSE;
813       break;
814     }
815     len = Curl_read16_le(((const unsigned char *) msg) +
816                          sizeof(struct smb_header) + 5);
817     conn->data->req.bytecount += len;
818     conn->data->req.offset += len;
819     Curl_pgrsSetUploadCounter(conn->data, conn->data->req.bytecount);
820     if(conn->data->req.bytecount >= conn->data->req.size)
821       next_state = SMB_CLOSE;
822     else
823       next_state = SMB_UPLOAD;
824     break;
825 
826   case SMB_CLOSE:
827     /* We don't care if the close failed, proceed to tree disconnect anyway */
828     next_state = SMB_TREE_DISCONNECT;
829     break;
830 
831   case SMB_TREE_DISCONNECT:
832     next_state = SMB_DONE;
833     break;
834 
835   default:
836     smb_pop_message(conn);
837     return CURLE_OK; /* ignore */
838   }
839 
840   smb_pop_message(conn);
841 
842   switch(next_state) {
843   case SMB_OPEN:
844     result = smb_send_open(conn);
845     break;
846 
847   case SMB_DOWNLOAD:
848     result = smb_send_read(conn);
849     break;
850 
851   case SMB_UPLOAD:
852     result = smb_send_write(conn);
853     break;
854 
855   case SMB_CLOSE:
856     result = smb_send_close(conn);
857     break;
858 
859   case SMB_TREE_DISCONNECT:
860     result = smb_send_tree_disconnect(conn);
861     break;
862 
863   case SMB_DONE:
864     result = req->result;
865     *done = true;
866     break;
867 
868   default:
869     break;
870   }
871 
872   if(result) {
873     connclose(conn, "SMB: failed to send message");
874     return result;
875   }
876 
877   request_state(conn, next_state);
878 
879   return CURLE_OK;
880 }
881 
smb_done(struct connectdata * conn,CURLcode status,bool premature)882 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
883                          bool premature)
884 {
885   struct smb_request *req = conn->data->req.protop;
886 
887   (void) premature;
888 
889   Curl_safefree(req->share);
890   Curl_safefree(conn->data->req.protop);
891 
892   return status;
893 }
894 
smb_disconnect(struct connectdata * conn,bool dead)895 static CURLcode smb_disconnect(struct connectdata *conn, bool dead)
896 {
897   struct smb_conn *smbc = &conn->proto.smbc;
898   struct smb_request *req = conn->data->req.protop;
899 
900   (void) dead;
901 
902   Curl_safefree(smbc->domain);
903   Curl_safefree(smbc->recv_buf);
904 
905   /* smb_done is not always called, so cleanup the request */
906   if(req) {
907     Curl_safefree(req->share);
908   }
909 
910   return CURLE_OK;
911 }
912 
smb_getsock(struct connectdata * conn,curl_socket_t * socks,int numsocks)913 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
914                        int numsocks)
915 {
916   struct smb_conn *smbc = &conn->proto.smbc;
917 
918   if(!numsocks)
919     return GETSOCK_BLANK;
920 
921   socks[0] = conn->sock[FIRSTSOCKET];
922 
923   if(smbc->send_size || smbc->upload_size)
924     return GETSOCK_WRITESOCK(0);
925 
926   return GETSOCK_READSOCK(0);
927 }
928 
smb_parse_url_path(struct connectdata * conn)929 static CURLcode smb_parse_url_path(struct connectdata *conn)
930 {
931   CURLcode result = CURLE_OK;
932   struct Curl_easy *data = conn->data;
933   struct smb_request *req = data->req.protop;
934   char *path;
935   char *slash;
936 
937   /* URL decode the path */
938   result = Curl_urldecode(data, data->state.path, 0, &path, NULL, TRUE);
939   if(result)
940     return result;
941 
942   /* Parse the path for the share */
943   req->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
944   if(!req->share) {
945     free(path);
946 
947     return CURLE_OUT_OF_MEMORY;
948   }
949 
950   slash = strchr(req->share, '/');
951   if(!slash)
952     slash = strchr(req->share, '\\');
953 
954   /* The share must be present */
955   if(!slash) {
956     free(path);
957 
958     return CURLE_URL_MALFORMAT;
959   }
960 
961   /* Parse the path for the file path converting any forward slashes into
962      backslashes */
963   *slash++ = 0;
964   req->path = slash;
965   for(; *slash; slash++) {
966     if(*slash == '/')
967       *slash = '\\';
968   }
969 
970   free(path);
971 
972   return CURLE_OK;
973 }
974 
975 #endif /* !USE_WINDOWS_SSPI || USE_WIN32_CRYPTO */
976 
977 #endif /* CURL_DISABLE_SMB && USE_NTLM && CURL_SIZEOF_CURL_OFF_T > 4 */
978