1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 2014, Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
9 * Copyright (C) 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
10 *
11 * This software is licensed as described in the file COPYING, which
12 * you should have received as part of this distribution. The terms
13 * are also available at https://curl.haxx.se/docs/copyright.html.
14 *
15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 * copies of the Software, and permit persons to whom the Software is
17 * furnished to do so, under the terms of the COPYING file.
18 *
19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 * KIND, either express or implied.
21 *
22 ***************************************************************************/
23
24 #include "curl_setup.h"
25
26 #if !defined(CURL_DISABLE_SMB) && defined(USE_NTLM) && \
27 (CURL_SIZEOF_CURL_OFF_T > 4)
28
29 #if !defined(USE_WINDOWS_SSPI) || defined(USE_WIN32_CRYPTO)
30
31 #define BUILDING_CURL_SMB_C
32
33 #ifdef HAVE_PROCESS_H
34 #include <process.h>
35 #define getpid _getpid
36 #endif
37
38 #include "smb.h"
39 #include "urldata.h"
40 #include "sendf.h"
41 #include "multiif.h"
42 #include "connect.h"
43 #include "progress.h"
44 #include "transfer.h"
45 #include "vtls/vtls.h"
46 #include "curl_ntlm_core.h"
47 #include "escape.h"
48 #include "curl_endian.h"
49
50 /* The last #include files should be: */
51 #include "curl_memory.h"
52 #include "memdebug.h"
53
54 /* Local API functions */
55 static CURLcode smb_setup_connection(struct connectdata *conn);
56 static CURLcode smb_connect(struct connectdata *conn, bool *done);
57 static CURLcode smb_connection_state(struct connectdata *conn, bool *done);
58 static CURLcode smb_request_state(struct connectdata *conn, bool *done);
59 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
60 bool premature);
61 static CURLcode smb_disconnect(struct connectdata *conn, bool dead);
62 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
63 int numsocks);
64 static CURLcode smb_parse_url_path(struct connectdata *conn);
65
66 /*
67 * SMB handler interface
68 */
69 const struct Curl_handler Curl_handler_smb = {
70 "SMB", /* scheme */
71 smb_setup_connection, /* setup_connection */
72 ZERO_NULL, /* do_it */
73 smb_done, /* done */
74 ZERO_NULL, /* do_more */
75 smb_connect, /* connect_it */
76 smb_connection_state, /* connecting */
77 smb_request_state, /* doing */
78 smb_getsock, /* proto_getsock */
79 smb_getsock, /* doing_getsock */
80 ZERO_NULL, /* domore_getsock */
81 ZERO_NULL, /* perform_getsock */
82 smb_disconnect, /* disconnect */
83 ZERO_NULL, /* readwrite */
84 PORT_SMB, /* defport */
85 CURLPROTO_SMB, /* protocol */
86 PROTOPT_NONE /* flags */
87 };
88
89 #ifdef USE_SSL
90 /*
91 * SMBS handler interface
92 */
93 const struct Curl_handler Curl_handler_smbs = {
94 "SMBS", /* scheme */
95 smb_setup_connection, /* setup_connection */
96 ZERO_NULL, /* do_it */
97 smb_done, /* done */
98 ZERO_NULL, /* do_more */
99 smb_connect, /* connect_it */
100 smb_connection_state, /* connecting */
101 smb_request_state, /* doing */
102 smb_getsock, /* proto_getsock */
103 smb_getsock, /* doing_getsock */
104 ZERO_NULL, /* domore_getsock */
105 ZERO_NULL, /* perform_getsock */
106 smb_disconnect, /* disconnect */
107 ZERO_NULL, /* readwrite */
108 PORT_SMBS, /* defport */
109 CURLPROTO_SMBS, /* protocol */
110 PROTOPT_SSL /* flags */
111 };
112 #endif
113
114 #define MAX_PAYLOAD_SIZE 0x8000
115 #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
116 #define CLIENTNAME "curl"
117 #define SERVICENAME "?????"
118
119 /* Append a string to an SMB message */
120 #define MSGCAT(str) \
121 strcpy(p, (str)); \
122 p += strlen(str);
123
124 /* Append a null-terminated string to an SMB message */
125 #define MSGCATNULL(str) \
126 strcpy(p, (str)); \
127 p += strlen(str) + 1;
128
129 /* SMB is mostly little endian */
130 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
131 defined(__OS400__)
smb_swap16(unsigned short x)132 static unsigned short smb_swap16(unsigned short x)
133 {
134 return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
135 }
136
smb_swap32(unsigned int x)137 static unsigned int smb_swap32(unsigned int x)
138 {
139 return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
140 ((x >> 24) & 0xff);
141 }
142
143 #ifdef HAVE_LONGLONG
smb_swap64(unsigned long long x)144 static unsigned long long smb_swap64(unsigned long long x)
145 {
146 return ((unsigned long long) smb_swap32((unsigned int) x) << 32) |
147 smb_swap32((unsigned int) (x >> 32));
148 }
149 #else
smb_swap64(unsigned __int64 x)150 static unsigned __int64 smb_swap64(unsigned __int64 x)
151 {
152 return ((unsigned __int64) smb_swap32((unsigned int) x) << 32) |
153 smb_swap32((unsigned int) (x >> 32));
154 }
155 #endif
156 #else
157 # define smb_swap16(x) (x)
158 # define smb_swap32(x) (x)
159 # define smb_swap64(x) (x)
160 #endif
161
162 /* SMB request state */
163 enum smb_req_state {
164 SMB_REQUESTING,
165 SMB_TREE_CONNECT,
166 SMB_OPEN,
167 SMB_DOWNLOAD,
168 SMB_UPLOAD,
169 SMB_CLOSE,
170 SMB_TREE_DISCONNECT,
171 SMB_DONE
172 };
173
174 /* SMB request data */
175 struct smb_request {
176 enum smb_req_state state;
177 char *share;
178 char *path;
179 unsigned short tid; /* Even if we connect to the same tree as another */
180 unsigned short fid; /* request, the tid will be different */
181 CURLcode result;
182 };
183
conn_state(struct connectdata * conn,enum smb_conn_state newstate)184 static void conn_state(struct connectdata *conn, enum smb_conn_state newstate)
185 {
186 struct smb_conn *smb = &conn->proto.smbc;
187 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
188 /* For debug purposes */
189 static const char * const names[] = {
190 "SMB_NOT_CONNECTED",
191 "SMB_CONNECTING",
192 "SMB_NEGOTIATE",
193 "SMB_SETUP",
194 "SMB_CONNECTED",
195 /* LAST */
196 };
197
198 if(smb->state != newstate)
199 infof(conn->data, "SMB conn %p state change from %s to %s\n",
200 (void *)smb, names[smb->state], names[newstate]);
201 #endif
202
203 smb->state = newstate;
204 }
205
request_state(struct connectdata * conn,enum smb_req_state newstate)206 static void request_state(struct connectdata *conn,
207 enum smb_req_state newstate)
208 {
209 struct smb_request *req = conn->data->req.protop;
210 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
211 /* For debug purposes */
212 static const char * const names[] = {
213 "SMB_REQUESTING",
214 "SMB_TREE_CONNECT",
215 "SMB_OPEN",
216 "SMB_DOWNLOAD",
217 "SMB_UPLOAD",
218 "SMB_CLOSE",
219 "SMB_TREE_DISCONNECT",
220 "SMB_DONE",
221 /* LAST */
222 };
223
224 if(req->state != newstate)
225 infof(conn->data, "SMB request %p state change from %s to %s\n",
226 (void *)req, names[req->state], names[newstate]);
227 #endif
228
229 req->state = newstate;
230 }
231
smb_setup_connection(struct connectdata * conn)232 static CURLcode smb_setup_connection(struct connectdata *conn)
233 {
234 struct smb_request *req;
235
236 /* Initialize the request state */
237 conn->data->req.protop = req = calloc(1, sizeof(struct smb_request));
238 if(!req)
239 return CURLE_OUT_OF_MEMORY;
240
241 /* Parse the URL path */
242 return smb_parse_url_path(conn);
243 }
244
smb_connect(struct connectdata * conn,bool * done)245 static CURLcode smb_connect(struct connectdata *conn, bool *done)
246 {
247 struct smb_conn *smbc = &conn->proto.smbc;
248 char *slash;
249
250 (void) done;
251
252 /* Check we have a username and password to authenticate with */
253 if(!conn->bits.user_passwd)
254 return CURLE_LOGIN_DENIED;
255
256 /* Initialize the connection state */
257 memset(smbc, 0, sizeof(*smbc));
258 smbc->state = SMB_CONNECTING;
259 smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
260 if(!smbc->recv_buf)
261 return CURLE_OUT_OF_MEMORY;
262
263 /* Multiple requests are allowed with this connection */
264 connkeep(conn, "SMB default");
265
266 /* Parse the username, domain, and password */
267 slash = strchr(conn->user, '/');
268 if(!slash)
269 slash = strchr(conn->user, '\\');
270
271 if(slash) {
272 smbc->user = slash + 1;
273 smbc->domain = strdup(conn->user);
274 if(!smbc->domain)
275 return CURLE_OUT_OF_MEMORY;
276 smbc->domain[slash - conn->user] = 0;
277 }
278 else {
279 smbc->user = conn->user;
280 smbc->domain = strdup(conn->host.name);
281 if(!smbc->domain)
282 return CURLE_OUT_OF_MEMORY;
283 }
284
285 return CURLE_OK;
286 }
287
smb_recv_message(struct connectdata * conn,void ** msg)288 static CURLcode smb_recv_message(struct connectdata *conn, void **msg)
289 {
290 struct smb_conn *smbc = &conn->proto.smbc;
291 char *buf = smbc->recv_buf;
292 ssize_t bytes_read;
293 size_t nbt_size;
294 size_t msg_size;
295 size_t len = MAX_MESSAGE_SIZE - smbc->got;
296 CURLcode result;
297
298 result = Curl_read(conn, FIRSTSOCKET, buf + smbc->got, len, &bytes_read);
299 if(result)
300 return result;
301
302 if(!bytes_read)
303 return CURLE_OK;
304
305 smbc->got += bytes_read;
306
307 /* Check for a 32-bit nbt header */
308 if(smbc->got < sizeof(unsigned int))
309 return CURLE_OK;
310
311 nbt_size = Curl_read16_be((const unsigned char *)(buf +
312 sizeof(unsigned short))) + sizeof(unsigned int);
313 if(smbc->got < nbt_size)
314 return CURLE_OK;
315
316 msg_size = sizeof(struct smb_header);
317 if(nbt_size >= msg_size + 1) {
318 /* Add the word count */
319 msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
320 if(nbt_size >= msg_size + sizeof(unsigned short)) {
321 /* Add the byte count */
322 msg_size += sizeof(unsigned short) +
323 Curl_read16_le((const unsigned char *)&buf[msg_size]);
324 if(nbt_size < msg_size)
325 return CURLE_READ_ERROR;
326 }
327 }
328
329 *msg = buf;
330
331 return CURLE_OK;
332 }
333
smb_pop_message(struct connectdata * conn)334 static void smb_pop_message(struct connectdata *conn)
335 {
336 struct smb_conn *smbc = &conn->proto.smbc;
337
338 smbc->got = 0;
339 }
340
smb_format_message(struct connectdata * conn,struct smb_header * h,unsigned char cmd,size_t len)341 static void smb_format_message(struct connectdata *conn, struct smb_header *h,
342 unsigned char cmd, size_t len)
343 {
344 struct smb_conn *smbc = &conn->proto.smbc;
345 struct smb_request *req = conn->data->req.protop;
346 unsigned int pid;
347
348 memset(h, 0, sizeof(*h));
349 h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
350 len));
351 memcpy((char *)h->magic, "\xffSMB", 4);
352 h->command = cmd;
353 h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
354 h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
355 h->uid = smb_swap16(smbc->uid);
356 h->tid = smb_swap16(req->tid);
357 pid = getpid();
358 h->pid_high = smb_swap16((unsigned short)(pid >> 16));
359 h->pid = smb_swap16((unsigned short) pid);
360 }
361
smb_send(struct connectdata * conn,ssize_t len,size_t upload_size)362 static CURLcode smb_send(struct connectdata *conn, ssize_t len,
363 size_t upload_size)
364 {
365 struct smb_conn *smbc = &conn->proto.smbc;
366 ssize_t bytes_written;
367 CURLcode result;
368
369 result = Curl_write(conn, FIRSTSOCKET, conn->data->state.uploadbuffer,
370 len, &bytes_written);
371 if(result)
372 return result;
373
374 if(bytes_written != len) {
375 smbc->send_size = len;
376 smbc->sent = bytes_written;
377 }
378
379 smbc->upload_size = upload_size;
380
381 return CURLE_OK;
382 }
383
smb_flush(struct connectdata * conn)384 static CURLcode smb_flush(struct connectdata *conn)
385 {
386 struct smb_conn *smbc = &conn->proto.smbc;
387 ssize_t bytes_written;
388 ssize_t len = smbc->send_size - smbc->sent;
389 CURLcode result;
390
391 if(!smbc->send_size)
392 return CURLE_OK;
393
394 result = Curl_write(conn, FIRSTSOCKET,
395 conn->data->state.uploadbuffer + smbc->sent,
396 len, &bytes_written);
397 if(result)
398 return result;
399
400 if(bytes_written != len)
401 smbc->sent += bytes_written;
402 else
403 smbc->send_size = 0;
404
405 return CURLE_OK;
406 }
407
smb_send_message(struct connectdata * conn,unsigned char cmd,const void * msg,size_t msg_len)408 static CURLcode smb_send_message(struct connectdata *conn, unsigned char cmd,
409 const void *msg, size_t msg_len)
410 {
411 smb_format_message(conn, (struct smb_header *)conn->data->state.uploadbuffer,
412 cmd, msg_len);
413 memcpy(conn->data->state.uploadbuffer + sizeof(struct smb_header),
414 msg, msg_len);
415
416 return smb_send(conn, sizeof(struct smb_header) + msg_len, 0);
417 }
418
smb_send_negotiate(struct connectdata * conn)419 static CURLcode smb_send_negotiate(struct connectdata *conn)
420 {
421 const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
422
423 return smb_send_message(conn, SMB_COM_NEGOTIATE, msg, 15);
424 }
425
smb_send_setup(struct connectdata * conn)426 static CURLcode smb_send_setup(struct connectdata *conn)
427 {
428 struct smb_conn *smbc = &conn->proto.smbc;
429 struct smb_setup msg;
430 char *p = msg.bytes;
431 unsigned char lm_hash[21];
432 unsigned char lm[24];
433 unsigned char nt_hash[21];
434 unsigned char nt[24];
435
436 size_t byte_count = sizeof(lm) + sizeof(nt);
437 byte_count += strlen(smbc->user) + strlen(smbc->domain);
438 byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
439 if(byte_count > sizeof(msg.bytes))
440 return CURLE_FILESIZE_EXCEEDED;
441
442 Curl_ntlm_core_mk_lm_hash(conn->data, conn->passwd, lm_hash);
443 Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
444 #if USE_NTRESPONSES
445 Curl_ntlm_core_mk_nt_hash(conn->data, conn->passwd, nt_hash);
446 Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
447 #else
448 memset(nt, 0, sizeof(nt));
449 #endif
450
451 memset(&msg, 0, sizeof(msg));
452 msg.word_count = SMB_WC_SETUP_ANDX;
453 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
454 msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
455 msg.max_mpx_count = smb_swap16(1);
456 msg.vc_number = smb_swap16(1);
457 msg.session_key = smb_swap32(smbc->session_key);
458 msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
459 msg.lengths[0] = smb_swap16(sizeof(lm));
460 msg.lengths[1] = smb_swap16(sizeof(nt));
461 memcpy(p, lm, sizeof(lm));
462 p += sizeof(lm);
463 memcpy(p, nt, sizeof(nt));
464 p += sizeof(nt);
465 MSGCATNULL(smbc->user);
466 MSGCATNULL(smbc->domain);
467 MSGCATNULL(OS);
468 MSGCATNULL(CLIENTNAME);
469 byte_count = p - msg.bytes;
470 msg.byte_count = smb_swap16((unsigned short)byte_count);
471
472 return smb_send_message(conn, SMB_COM_SETUP_ANDX, &msg,
473 sizeof(msg) - sizeof(msg.bytes) + byte_count);
474 }
475
smb_send_tree_connect(struct connectdata * conn)476 static CURLcode smb_send_tree_connect(struct connectdata *conn)
477 {
478 struct smb_request *req = conn->data->req.protop;
479 struct smb_tree_connect msg;
480 char *p = msg.bytes;
481
482 size_t byte_count = strlen(conn->host.name) + strlen(req->share);
483 byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
484 if(byte_count > sizeof(msg.bytes))
485 return CURLE_FILESIZE_EXCEEDED;
486
487 memset(&msg, 0, sizeof(msg));
488 msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
489 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
490 msg.pw_len = 0;
491 MSGCAT("\\\\");
492 MSGCAT(conn->host.name);
493 MSGCAT("\\");
494 MSGCATNULL(req->share);
495 MSGCATNULL(SERVICENAME); /* Match any type of service */
496 byte_count = p - msg.bytes;
497 msg.byte_count = smb_swap16((unsigned short)byte_count);
498
499 return smb_send_message(conn, SMB_COM_TREE_CONNECT_ANDX, &msg,
500 sizeof(msg) - sizeof(msg.bytes) + byte_count);
501 }
502
smb_send_open(struct connectdata * conn)503 static CURLcode smb_send_open(struct connectdata *conn)
504 {
505 struct smb_request *req = conn->data->req.protop;
506 struct smb_nt_create msg;
507 size_t byte_count;
508
509 if((strlen(req->path) + 1) > sizeof(msg.bytes))
510 return CURLE_FILESIZE_EXCEEDED;
511
512 memset(&msg, 0, sizeof(msg));
513 msg.word_count = SMB_WC_NT_CREATE_ANDX;
514 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
515 byte_count = strlen(req->path);
516 msg.name_length = smb_swap16((unsigned short)byte_count);
517 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
518 if(conn->data->set.upload) {
519 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
520 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
521 }
522 else {
523 msg.access = smb_swap32(SMB_GENERIC_READ);
524 msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
525 }
526 msg.byte_count = smb_swap16((unsigned short) ++byte_count);
527 strcpy(msg.bytes, req->path);
528
529 return smb_send_message(conn, SMB_COM_NT_CREATE_ANDX, &msg,
530 sizeof(msg) - sizeof(msg.bytes) + byte_count);
531 }
532
smb_send_close(struct connectdata * conn)533 static CURLcode smb_send_close(struct connectdata *conn)
534 {
535 struct smb_request *req = conn->data->req.protop;
536 struct smb_close msg;
537
538 memset(&msg, 0, sizeof(msg));
539 msg.word_count = SMB_WC_CLOSE;
540 msg.fid = smb_swap16(req->fid);
541
542 return smb_send_message(conn, SMB_COM_CLOSE, &msg, sizeof(msg));
543 }
544
smb_send_tree_disconnect(struct connectdata * conn)545 static CURLcode smb_send_tree_disconnect(struct connectdata *conn)
546 {
547 struct smb_tree_disconnect msg;
548
549 memset(&msg, 0, sizeof(msg));
550
551 return smb_send_message(conn, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
552 }
553
smb_send_read(struct connectdata * conn)554 static CURLcode smb_send_read(struct connectdata *conn)
555 {
556 struct smb_request *req = conn->data->req.protop;
557 curl_off_t offset = conn->data->req.offset;
558 struct smb_read msg;
559
560 memset(&msg, 0, sizeof(msg));
561 msg.word_count = SMB_WC_READ_ANDX;
562 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
563 msg.fid = smb_swap16(req->fid);
564 msg.offset = smb_swap32((unsigned int) offset);
565 msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
566 msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
567 msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
568
569 return smb_send_message(conn, SMB_COM_READ_ANDX, &msg, sizeof(msg));
570 }
571
smb_send_write(struct connectdata * conn)572 static CURLcode smb_send_write(struct connectdata *conn)
573 {
574 struct smb_write *msg = (struct smb_write *)conn->data->state.uploadbuffer;
575 struct smb_request *req = conn->data->req.protop;
576 curl_off_t offset = conn->data->req.offset;
577
578 curl_off_t upload_size = conn->data->req.size - conn->data->req.bytecount;
579 if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
580 upload_size = MAX_PAYLOAD_SIZE - 1;
581
582 memset(msg, 0, sizeof(*msg));
583 msg->word_count = SMB_WC_WRITE_ANDX;
584 msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
585 msg->fid = smb_swap16(req->fid);
586 msg->offset = smb_swap32((unsigned int) offset);
587 msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
588 msg->data_length = smb_swap16((unsigned short) upload_size);
589 msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
590 msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
591
592 smb_format_message(conn, &msg->h, SMB_COM_WRITE_ANDX,
593 sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
594
595 return smb_send(conn, sizeof(*msg), (size_t) upload_size);
596 }
597
smb_send_and_recv(struct connectdata * conn,void ** msg)598 static CURLcode smb_send_and_recv(struct connectdata *conn, void **msg)
599 {
600 struct smb_conn *smbc = &conn->proto.smbc;
601 CURLcode result;
602
603 /* Check if there is data in the transfer buffer */
604 if(!smbc->send_size && smbc->upload_size) {
605 int nread = smbc->upload_size > BUFSIZE ? BUFSIZE :
606 (int) smbc->upload_size;
607 conn->data->req.upload_fromhere = conn->data->state.uploadbuffer;
608 result = Curl_fillreadbuffer(conn, nread, &nread);
609 if(result && result != CURLE_AGAIN)
610 return result;
611 if(!nread)
612 return CURLE_OK;
613
614 smbc->upload_size -= nread;
615 smbc->send_size = nread;
616 smbc->sent = 0;
617 }
618
619 /* Check if there is data to send */
620 if(smbc->send_size) {
621 result = smb_flush(conn);
622 if(result)
623 return result;
624 }
625
626 /* Check if there is still data to be sent */
627 if(smbc->send_size || smbc->upload_size)
628 return CURLE_AGAIN;
629
630 return smb_recv_message(conn, msg);
631 }
632
smb_connection_state(struct connectdata * conn,bool * done)633 static CURLcode smb_connection_state(struct connectdata *conn, bool *done)
634 {
635 struct smb_conn *smbc = &conn->proto.smbc;
636 struct smb_negotiate_response *nrsp;
637 struct smb_header *h;
638 CURLcode result;
639 void *msg = NULL;
640
641 if(smbc->state == SMB_CONNECTING) {
642 #ifdef USE_SSL
643 if((conn->handler->flags & PROTOPT_SSL)) {
644 bool ssl_done;
645 result = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &ssl_done);
646 if(result && result != CURLE_AGAIN)
647 return result;
648 if(!ssl_done)
649 return CURLE_OK;
650 }
651 #endif
652
653 result = smb_send_negotiate(conn);
654 if(result) {
655 connclose(conn, "SMB: failed to send negotiate message");
656 return result;
657 }
658
659 conn_state(conn, SMB_NEGOTIATE);
660 }
661
662 /* Send the previous message and check for a response */
663 result = smb_send_and_recv(conn, &msg);
664 if(result && result != CURLE_AGAIN) {
665 connclose(conn, "SMB: failed to communicate");
666 return result;
667 }
668
669 if(!msg)
670 return CURLE_OK;
671
672 h = msg;
673
674 switch(smbc->state) {
675 case SMB_NEGOTIATE:
676 if(h->status || smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) {
677 connclose(conn, "SMB: negotiation failed");
678 return CURLE_COULDNT_CONNECT;
679 }
680 nrsp = msg;
681 memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
682 smbc->session_key = smb_swap32(nrsp->session_key);
683 result = smb_send_setup(conn);
684 if(result) {
685 connclose(conn, "SMB: failed to send setup message");
686 return result;
687 }
688 conn_state(conn, SMB_SETUP);
689 break;
690
691 case SMB_SETUP:
692 if(h->status) {
693 connclose(conn, "SMB: authentication failed");
694 return CURLE_LOGIN_DENIED;
695 }
696 smbc->uid = smb_swap16(h->uid);
697 conn_state(conn, SMB_CONNECTED);
698 *done = true;
699 break;
700
701 default:
702 smb_pop_message(conn);
703 return CURLE_OK; /* ignore */
704 }
705
706 smb_pop_message(conn);
707
708 return CURLE_OK;
709 }
710
smb_request_state(struct connectdata * conn,bool * done)711 static CURLcode smb_request_state(struct connectdata *conn, bool *done)
712 {
713 struct smb_request *req = conn->data->req.protop;
714 struct smb_header *h;
715 struct smb_conn *smbc = &conn->proto.smbc;
716 enum smb_req_state next_state = SMB_DONE;
717 unsigned short len;
718 unsigned short off;
719 CURLcode result;
720 void *msg = NULL;
721
722 /* Start the request */
723 if(req->state == SMB_REQUESTING) {
724 result = smb_send_tree_connect(conn);
725 if(result) {
726 connclose(conn, "SMB: failed to send tree connect message");
727 return result;
728 }
729
730 request_state(conn, SMB_TREE_CONNECT);
731 }
732
733 /* Send the previous message and check for a response */
734 result = smb_send_and_recv(conn, &msg);
735 if(result && result != CURLE_AGAIN) {
736 connclose(conn, "SMB: failed to communicate");
737 return result;
738 }
739
740 if(!msg)
741 return CURLE_OK;
742
743 h = msg;
744
745 switch(req->state) {
746 case SMB_TREE_CONNECT:
747 if(h->status) {
748 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
749 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
750 req->result = CURLE_REMOTE_ACCESS_DENIED;
751 break;
752 }
753 req->tid = smb_swap16(h->tid);
754 next_state = SMB_OPEN;
755 break;
756
757 case SMB_OPEN:
758 if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
759 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
760 next_state = SMB_TREE_DISCONNECT;
761 break;
762 }
763 req->fid = smb_swap16(((struct smb_nt_create_response *)msg)->fid);
764 conn->data->req.offset = 0;
765 if(conn->data->set.upload) {
766 conn->data->req.size = conn->data->state.infilesize;
767 Curl_pgrsSetUploadSize(conn->data, conn->data->req.size);
768 next_state = SMB_UPLOAD;
769 }
770 else {
771 conn->data->req.size =
772 smb_swap64(((struct smb_nt_create_response *)msg)->end_of_file);
773 Curl_pgrsSetDownloadSize(conn->data, conn->data->req.size);
774 next_state = SMB_DOWNLOAD;
775 }
776 break;
777
778 case SMB_DOWNLOAD:
779 if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
780 req->result = CURLE_RECV_ERROR;
781 next_state = SMB_CLOSE;
782 break;
783 }
784 len = Curl_read16_le(((const unsigned char *) msg) +
785 sizeof(struct smb_header) + 11);
786 off = Curl_read16_le(((const unsigned char *) msg) +
787 sizeof(struct smb_header) + 13);
788 if(len > 0) {
789 if(off + sizeof(unsigned int) + len > smbc->got) {
790 failf(conn->data, "Invalid input packet");
791 result = CURLE_RECV_ERROR;
792 }
793 else
794 result = Curl_client_write(conn, CLIENTWRITE_BODY,
795 (char *)msg + off + sizeof(unsigned int),
796 len);
797 if(result) {
798 req->result = result;
799 next_state = SMB_CLOSE;
800 break;
801 }
802 }
803 conn->data->req.bytecount += len;
804 conn->data->req.offset += len;
805 Curl_pgrsSetDownloadCounter(conn->data, conn->data->req.bytecount);
806 next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
807 break;
808
809 case SMB_UPLOAD:
810 if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
811 req->result = CURLE_UPLOAD_FAILED;
812 next_state = SMB_CLOSE;
813 break;
814 }
815 len = Curl_read16_le(((const unsigned char *) msg) +
816 sizeof(struct smb_header) + 5);
817 conn->data->req.bytecount += len;
818 conn->data->req.offset += len;
819 Curl_pgrsSetUploadCounter(conn->data, conn->data->req.bytecount);
820 if(conn->data->req.bytecount >= conn->data->req.size)
821 next_state = SMB_CLOSE;
822 else
823 next_state = SMB_UPLOAD;
824 break;
825
826 case SMB_CLOSE:
827 /* We don't care if the close failed, proceed to tree disconnect anyway */
828 next_state = SMB_TREE_DISCONNECT;
829 break;
830
831 case SMB_TREE_DISCONNECT:
832 next_state = SMB_DONE;
833 break;
834
835 default:
836 smb_pop_message(conn);
837 return CURLE_OK; /* ignore */
838 }
839
840 smb_pop_message(conn);
841
842 switch(next_state) {
843 case SMB_OPEN:
844 result = smb_send_open(conn);
845 break;
846
847 case SMB_DOWNLOAD:
848 result = smb_send_read(conn);
849 break;
850
851 case SMB_UPLOAD:
852 result = smb_send_write(conn);
853 break;
854
855 case SMB_CLOSE:
856 result = smb_send_close(conn);
857 break;
858
859 case SMB_TREE_DISCONNECT:
860 result = smb_send_tree_disconnect(conn);
861 break;
862
863 case SMB_DONE:
864 result = req->result;
865 *done = true;
866 break;
867
868 default:
869 break;
870 }
871
872 if(result) {
873 connclose(conn, "SMB: failed to send message");
874 return result;
875 }
876
877 request_state(conn, next_state);
878
879 return CURLE_OK;
880 }
881
smb_done(struct connectdata * conn,CURLcode status,bool premature)882 static CURLcode smb_done(struct connectdata *conn, CURLcode status,
883 bool premature)
884 {
885 struct smb_request *req = conn->data->req.protop;
886
887 (void) premature;
888
889 Curl_safefree(req->share);
890 Curl_safefree(conn->data->req.protop);
891
892 return status;
893 }
894
smb_disconnect(struct connectdata * conn,bool dead)895 static CURLcode smb_disconnect(struct connectdata *conn, bool dead)
896 {
897 struct smb_conn *smbc = &conn->proto.smbc;
898 struct smb_request *req = conn->data->req.protop;
899
900 (void) dead;
901
902 Curl_safefree(smbc->domain);
903 Curl_safefree(smbc->recv_buf);
904
905 /* smb_done is not always called, so cleanup the request */
906 if(req) {
907 Curl_safefree(req->share);
908 }
909
910 return CURLE_OK;
911 }
912
smb_getsock(struct connectdata * conn,curl_socket_t * socks,int numsocks)913 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
914 int numsocks)
915 {
916 struct smb_conn *smbc = &conn->proto.smbc;
917
918 if(!numsocks)
919 return GETSOCK_BLANK;
920
921 socks[0] = conn->sock[FIRSTSOCKET];
922
923 if(smbc->send_size || smbc->upload_size)
924 return GETSOCK_WRITESOCK(0);
925
926 return GETSOCK_READSOCK(0);
927 }
928
smb_parse_url_path(struct connectdata * conn)929 static CURLcode smb_parse_url_path(struct connectdata *conn)
930 {
931 CURLcode result = CURLE_OK;
932 struct Curl_easy *data = conn->data;
933 struct smb_request *req = data->req.protop;
934 char *path;
935 char *slash;
936
937 /* URL decode the path */
938 result = Curl_urldecode(data, data->state.path, 0, &path, NULL, TRUE);
939 if(result)
940 return result;
941
942 /* Parse the path for the share */
943 req->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
944 if(!req->share) {
945 free(path);
946
947 return CURLE_OUT_OF_MEMORY;
948 }
949
950 slash = strchr(req->share, '/');
951 if(!slash)
952 slash = strchr(req->share, '\\');
953
954 /* The share must be present */
955 if(!slash) {
956 free(path);
957
958 return CURLE_URL_MALFORMAT;
959 }
960
961 /* Parse the path for the file path converting any forward slashes into
962 backslashes */
963 *slash++ = 0;
964 req->path = slash;
965 for(; *slash; slash++) {
966 if(*slash == '/')
967 *slash = '\\';
968 }
969
970 free(path);
971
972 return CURLE_OK;
973 }
974
975 #endif /* !USE_WINDOWS_SSPI || USE_WIN32_CRYPTO */
976
977 #endif /* CURL_DISABLE_SMB && USE_NTLM && CURL_SIZEOF_CURL_OFF_T > 4 */
978