1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 2016 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
9 * Copyright (C) 2014, Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
10 *
11 * This software is licensed as described in the file COPYING, which
12 * you should have received as part of this distribution. The terms
13 * are also available at https://curl.se/docs/copyright.html.
14 *
15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 * copies of the Software, and permit persons to whom the Software is
17 * furnished to do so, under the terms of the COPYING file.
18 *
19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 * KIND, either express or implied.
21 *
22 ***************************************************************************/
23
24 #include "curl_setup.h"
25
26 #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE) && \
27 (CURL_SIZEOF_CURL_OFF_T > 4)
28
29 #define BUILDING_CURL_SMB_C
30
31 #ifdef HAVE_PROCESS_H
32 #include <process.h>
33 #ifdef CURL_WINDOWS_APP
34 #define getpid GetCurrentProcessId
35 #elif !defined(MSDOS)
36 #define getpid _getpid
37 #endif
38 #endif
39
40 #include "smb.h"
41 #include "urldata.h"
42 #include "sendf.h"
43 #include "multiif.h"
44 #include "connect.h"
45 #include "progress.h"
46 #include "transfer.h"
47 #include "vtls/vtls.h"
48 #include "curl_ntlm_core.h"
49 #include "escape.h"
50 #include "curl_endian.h"
51
52 /* The last #include files should be: */
53 #include "curl_memory.h"
54 #include "memdebug.h"
55
56 /* Local API functions */
57 static CURLcode smb_setup_connection(struct Curl_easy *data,
58 struct connectdata *conn);
59 static CURLcode smb_connect(struct Curl_easy *data, bool *done);
60 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
61 static CURLcode smb_do(struct Curl_easy *data, bool *done);
62 static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
63 static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
64 bool premature);
65 static CURLcode smb_disconnect(struct Curl_easy *data,
66 struct connectdata *conn, bool dead);
67 static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
68 curl_socket_t *socks);
69 static CURLcode smb_parse_url_path(struct Curl_easy *data,
70 struct connectdata *conn);
71
72 /*
73 * SMB handler interface
74 */
75 const struct Curl_handler Curl_handler_smb = {
76 "SMB", /* scheme */
77 smb_setup_connection, /* setup_connection */
78 smb_do, /* do_it */
79 smb_done, /* done */
80 ZERO_NULL, /* do_more */
81 smb_connect, /* connect_it */
82 smb_connection_state, /* connecting */
83 smb_request_state, /* doing */
84 smb_getsock, /* proto_getsock */
85 smb_getsock, /* doing_getsock */
86 ZERO_NULL, /* domore_getsock */
87 ZERO_NULL, /* perform_getsock */
88 smb_disconnect, /* disconnect */
89 ZERO_NULL, /* readwrite */
90 ZERO_NULL, /* connection_check */
91 PORT_SMB, /* defport */
92 CURLPROTO_SMB, /* protocol */
93 CURLPROTO_SMB, /* family */
94 PROTOPT_NONE /* flags */
95 };
96
97 #ifdef USE_SSL
98 /*
99 * SMBS handler interface
100 */
101 const struct Curl_handler Curl_handler_smbs = {
102 "SMBS", /* scheme */
103 smb_setup_connection, /* setup_connection */
104 smb_do, /* do_it */
105 smb_done, /* done */
106 ZERO_NULL, /* do_more */
107 smb_connect, /* connect_it */
108 smb_connection_state, /* connecting */
109 smb_request_state, /* doing */
110 smb_getsock, /* proto_getsock */
111 smb_getsock, /* doing_getsock */
112 ZERO_NULL, /* domore_getsock */
113 ZERO_NULL, /* perform_getsock */
114 smb_disconnect, /* disconnect */
115 ZERO_NULL, /* readwrite */
116 ZERO_NULL, /* connection_check */
117 PORT_SMBS, /* defport */
118 CURLPROTO_SMBS, /* protocol */
119 CURLPROTO_SMB, /* family */
120 PROTOPT_SSL /* flags */
121 };
122 #endif
123
124 #define MAX_PAYLOAD_SIZE 0x8000
125 #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
126 #define CLIENTNAME "curl"
127 #define SERVICENAME "?????"
128
129 /* Append a string to an SMB message */
130 #define MSGCAT(str) \
131 do { \
132 strcpy(p, (str)); \
133 p += strlen(str); \
134 } while(0)
135
136 /* Append a null-terminated string to an SMB message */
137 #define MSGCATNULL(str) \
138 do { \
139 strcpy(p, (str)); \
140 p += strlen(str) + 1; \
141 } while(0)
142
143 /* SMB is mostly little endian */
144 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
145 defined(__OS400__)
smb_swap16(unsigned short x)146 static unsigned short smb_swap16(unsigned short x)
147 {
148 return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
149 }
150
smb_swap32(unsigned int x)151 static unsigned int smb_swap32(unsigned int x)
152 {
153 return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
154 ((x >> 24) & 0xff);
155 }
156
smb_swap64(curl_off_t x)157 static curl_off_t smb_swap64(curl_off_t x)
158 {
159 return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
160 smb_swap32((unsigned int) (x >> 32));
161 }
162
163 #else
164 # define smb_swap16(x) (x)
165 # define smb_swap32(x) (x)
166 # define smb_swap64(x) (x)
167 #endif
168
169 /* SMB request state */
170 enum smb_req_state {
171 SMB_REQUESTING,
172 SMB_TREE_CONNECT,
173 SMB_OPEN,
174 SMB_DOWNLOAD,
175 SMB_UPLOAD,
176 SMB_CLOSE,
177 SMB_TREE_DISCONNECT,
178 SMB_DONE
179 };
180
181 /* SMB request data */
182 struct smb_request {
183 enum smb_req_state state;
184 char *path;
185 unsigned short tid; /* Even if we connect to the same tree as another */
186 unsigned short fid; /* request, the tid will be different */
187 CURLcode result;
188 };
189
conn_state(struct Curl_easy * data,enum smb_conn_state newstate)190 static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
191 {
192 struct smb_conn *smbc = &data->conn->proto.smbc;
193 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
194 /* For debug purposes */
195 static const char * const names[] = {
196 "SMB_NOT_CONNECTED",
197 "SMB_CONNECTING",
198 "SMB_NEGOTIATE",
199 "SMB_SETUP",
200 "SMB_CONNECTED",
201 /* LAST */
202 };
203
204 if(smbc->state != newstate)
205 infof(data, "SMB conn %p state change from %s to %s\n",
206 (void *)smbc, names[smbc->state], names[newstate]);
207 #endif
208
209 smbc->state = newstate;
210 }
211
request_state(struct Curl_easy * data,enum smb_req_state newstate)212 static void request_state(struct Curl_easy *data,
213 enum smb_req_state newstate)
214 {
215 struct smb_request *req = data->req.p.smb;
216 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
217 /* For debug purposes */
218 static const char * const names[] = {
219 "SMB_REQUESTING",
220 "SMB_TREE_CONNECT",
221 "SMB_OPEN",
222 "SMB_DOWNLOAD",
223 "SMB_UPLOAD",
224 "SMB_CLOSE",
225 "SMB_TREE_DISCONNECT",
226 "SMB_DONE",
227 /* LAST */
228 };
229
230 if(req->state != newstate)
231 infof(data, "SMB request %p state change from %s to %s\n",
232 (void *)req, names[req->state], names[newstate]);
233 #endif
234
235 req->state = newstate;
236 }
237
238 /* this should setup things in the connection, not in the easy
239 handle */
smb_setup_connection(struct Curl_easy * data,struct connectdata * conn)240 static CURLcode smb_setup_connection(struct Curl_easy *data,
241 struct connectdata *conn)
242 {
243 struct smb_request *req;
244
245 /* Initialize the request state */
246 data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
247 if(!req)
248 return CURLE_OUT_OF_MEMORY;
249
250 /* Parse the URL path */
251 return smb_parse_url_path(data, conn);
252 }
253
smb_connect(struct Curl_easy * data,bool * done)254 static CURLcode smb_connect(struct Curl_easy *data, bool *done)
255 {
256 struct connectdata *conn = data->conn;
257 struct smb_conn *smbc = &conn->proto.smbc;
258 char *slash;
259
260 (void) done;
261
262 /* Check we have a username and password to authenticate with */
263 if(!conn->bits.user_passwd)
264 return CURLE_LOGIN_DENIED;
265
266 /* Initialize the connection state */
267 smbc->state = SMB_CONNECTING;
268 smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
269 if(!smbc->recv_buf)
270 return CURLE_OUT_OF_MEMORY;
271
272 /* Multiple requests are allowed with this connection */
273 connkeep(conn, "SMB default");
274
275 /* Parse the username, domain, and password */
276 slash = strchr(conn->user, '/');
277 if(!slash)
278 slash = strchr(conn->user, '\\');
279
280 if(slash) {
281 smbc->user = slash + 1;
282 smbc->domain = strdup(conn->user);
283 if(!smbc->domain)
284 return CURLE_OUT_OF_MEMORY;
285 smbc->domain[slash - conn->user] = 0;
286 }
287 else {
288 smbc->user = conn->user;
289 smbc->domain = strdup(conn->host.name);
290 if(!smbc->domain)
291 return CURLE_OUT_OF_MEMORY;
292 }
293
294 return CURLE_OK;
295 }
296
smb_recv_message(struct Curl_easy * data,void ** msg)297 static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
298 {
299 struct connectdata *conn = data->conn;
300 struct smb_conn *smbc = &conn->proto.smbc;
301 char *buf = smbc->recv_buf;
302 ssize_t bytes_read;
303 size_t nbt_size;
304 size_t msg_size;
305 size_t len = MAX_MESSAGE_SIZE - smbc->got;
306 CURLcode result;
307
308 result = Curl_read(data, FIRSTSOCKET, buf + smbc->got, len, &bytes_read);
309 if(result)
310 return result;
311
312 if(!bytes_read)
313 return CURLE_OK;
314
315 smbc->got += bytes_read;
316
317 /* Check for a 32-bit nbt header */
318 if(smbc->got < sizeof(unsigned int))
319 return CURLE_OK;
320
321 nbt_size = Curl_read16_be((const unsigned char *)
322 (buf + sizeof(unsigned short))) +
323 sizeof(unsigned int);
324 if(smbc->got < nbt_size)
325 return CURLE_OK;
326
327 msg_size = sizeof(struct smb_header);
328 if(nbt_size >= msg_size + 1) {
329 /* Add the word count */
330 msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
331 if(nbt_size >= msg_size + sizeof(unsigned short)) {
332 /* Add the byte count */
333 msg_size += sizeof(unsigned short) +
334 Curl_read16_le((const unsigned char *)&buf[msg_size]);
335 if(nbt_size < msg_size)
336 return CURLE_READ_ERROR;
337 }
338 }
339
340 *msg = buf;
341
342 return CURLE_OK;
343 }
344
smb_pop_message(struct connectdata * conn)345 static void smb_pop_message(struct connectdata *conn)
346 {
347 struct smb_conn *smbc = &conn->proto.smbc;
348
349 smbc->got = 0;
350 }
351
smb_format_message(struct Curl_easy * data,struct smb_header * h,unsigned char cmd,size_t len)352 static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
353 unsigned char cmd, size_t len)
354 {
355 struct connectdata *conn = data->conn;
356 struct smb_conn *smbc = &conn->proto.smbc;
357 struct smb_request *req = data->req.p.smb;
358 unsigned int pid;
359
360 memset(h, 0, sizeof(*h));
361 h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
362 len));
363 memcpy((char *)h->magic, "\xffSMB", 4);
364 h->command = cmd;
365 h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
366 h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
367 h->uid = smb_swap16(smbc->uid);
368 h->tid = smb_swap16(req->tid);
369 pid = getpid();
370 h->pid_high = smb_swap16((unsigned short)(pid >> 16));
371 h->pid = smb_swap16((unsigned short) pid);
372 }
373
smb_send(struct Curl_easy * data,ssize_t len,size_t upload_size)374 static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
375 size_t upload_size)
376 {
377 struct connectdata *conn = data->conn;
378 struct smb_conn *smbc = &conn->proto.smbc;
379 ssize_t bytes_written;
380 CURLcode result;
381
382 result = Curl_write(data, FIRSTSOCKET, data->state.ulbuf,
383 len, &bytes_written);
384 if(result)
385 return result;
386
387 if(bytes_written != len) {
388 smbc->send_size = len;
389 smbc->sent = bytes_written;
390 }
391
392 smbc->upload_size = upload_size;
393
394 return CURLE_OK;
395 }
396
smb_flush(struct Curl_easy * data)397 static CURLcode smb_flush(struct Curl_easy *data)
398 {
399 struct connectdata *conn = data->conn;
400 struct smb_conn *smbc = &conn->proto.smbc;
401 ssize_t bytes_written;
402 ssize_t len = smbc->send_size - smbc->sent;
403 CURLcode result;
404
405 if(!smbc->send_size)
406 return CURLE_OK;
407
408 result = Curl_write(data, FIRSTSOCKET,
409 data->state.ulbuf + smbc->sent,
410 len, &bytes_written);
411 if(result)
412 return result;
413
414 if(bytes_written != len)
415 smbc->sent += bytes_written;
416 else
417 smbc->send_size = 0;
418
419 return CURLE_OK;
420 }
421
smb_send_message(struct Curl_easy * data,unsigned char cmd,const void * msg,size_t msg_len)422 static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
423 const void *msg, size_t msg_len)
424 {
425 CURLcode result = Curl_get_upload_buffer(data);
426 if(result)
427 return result;
428 smb_format_message(data, (struct smb_header *)data->state.ulbuf,
429 cmd, msg_len);
430 memcpy(data->state.ulbuf + sizeof(struct smb_header),
431 msg, msg_len);
432
433 return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
434 }
435
smb_send_negotiate(struct Curl_easy * data)436 static CURLcode smb_send_negotiate(struct Curl_easy *data)
437 {
438 const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
439
440 return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
441 }
442
smb_send_setup(struct Curl_easy * data)443 static CURLcode smb_send_setup(struct Curl_easy *data)
444 {
445 struct connectdata *conn = data->conn;
446 struct smb_conn *smbc = &conn->proto.smbc;
447 struct smb_setup msg;
448 char *p = msg.bytes;
449 unsigned char lm_hash[21];
450 unsigned char lm[24];
451 unsigned char nt_hash[21];
452 unsigned char nt[24];
453
454 size_t byte_count = sizeof(lm) + sizeof(nt);
455 byte_count += strlen(smbc->user) + strlen(smbc->domain);
456 byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
457 if(byte_count > sizeof(msg.bytes))
458 return CURLE_FILESIZE_EXCEEDED;
459
460 Curl_ntlm_core_mk_lm_hash(data, conn->passwd, lm_hash);
461 Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
462 #ifdef USE_NTRESPONSES
463 Curl_ntlm_core_mk_nt_hash(data, conn->passwd, nt_hash);
464 Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
465 #else
466 memset(nt, 0, sizeof(nt));
467 #endif
468
469 memset(&msg, 0, sizeof(msg));
470 msg.word_count = SMB_WC_SETUP_ANDX;
471 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
472 msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
473 msg.max_mpx_count = smb_swap16(1);
474 msg.vc_number = smb_swap16(1);
475 msg.session_key = smb_swap32(smbc->session_key);
476 msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
477 msg.lengths[0] = smb_swap16(sizeof(lm));
478 msg.lengths[1] = smb_swap16(sizeof(nt));
479 memcpy(p, lm, sizeof(lm));
480 p += sizeof(lm);
481 memcpy(p, nt, sizeof(nt));
482 p += sizeof(nt);
483 MSGCATNULL(smbc->user);
484 MSGCATNULL(smbc->domain);
485 MSGCATNULL(OS);
486 MSGCATNULL(CLIENTNAME);
487 byte_count = p - msg.bytes;
488 msg.byte_count = smb_swap16((unsigned short)byte_count);
489
490 return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
491 sizeof(msg) - sizeof(msg.bytes) + byte_count);
492 }
493
smb_send_tree_connect(struct Curl_easy * data)494 static CURLcode smb_send_tree_connect(struct Curl_easy *data)
495 {
496 struct smb_tree_connect msg;
497 struct connectdata *conn = data->conn;
498 struct smb_conn *smbc = &conn->proto.smbc;
499 char *p = msg.bytes;
500
501 size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
502 byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
503 if(byte_count > sizeof(msg.bytes))
504 return CURLE_FILESIZE_EXCEEDED;
505
506 memset(&msg, 0, sizeof(msg));
507 msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
508 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
509 msg.pw_len = 0;
510 MSGCAT("\\\\");
511 MSGCAT(conn->host.name);
512 MSGCAT("\\");
513 MSGCATNULL(smbc->share);
514 MSGCATNULL(SERVICENAME); /* Match any type of service */
515 byte_count = p - msg.bytes;
516 msg.byte_count = smb_swap16((unsigned short)byte_count);
517
518 return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
519 sizeof(msg) - sizeof(msg.bytes) + byte_count);
520 }
521
smb_send_open(struct Curl_easy * data)522 static CURLcode smb_send_open(struct Curl_easy *data)
523 {
524 struct smb_request *req = data->req.p.smb;
525 struct smb_nt_create msg;
526 size_t byte_count;
527
528 if((strlen(req->path) + 1) > sizeof(msg.bytes))
529 return CURLE_FILESIZE_EXCEEDED;
530
531 memset(&msg, 0, sizeof(msg));
532 msg.word_count = SMB_WC_NT_CREATE_ANDX;
533 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
534 byte_count = strlen(req->path);
535 msg.name_length = smb_swap16((unsigned short)byte_count);
536 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
537 if(data->set.upload) {
538 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
539 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
540 }
541 else {
542 msg.access = smb_swap32(SMB_GENERIC_READ);
543 msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
544 }
545 msg.byte_count = smb_swap16((unsigned short) ++byte_count);
546 strcpy(msg.bytes, req->path);
547
548 return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
549 sizeof(msg) - sizeof(msg.bytes) + byte_count);
550 }
551
smb_send_close(struct Curl_easy * data)552 static CURLcode smb_send_close(struct Curl_easy *data)
553 {
554 struct smb_request *req = data->req.p.smb;
555 struct smb_close msg;
556
557 memset(&msg, 0, sizeof(msg));
558 msg.word_count = SMB_WC_CLOSE;
559 msg.fid = smb_swap16(req->fid);
560
561 return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
562 }
563
smb_send_tree_disconnect(struct Curl_easy * data)564 static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
565 {
566 struct smb_tree_disconnect msg;
567
568 memset(&msg, 0, sizeof(msg));
569
570 return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
571 }
572
smb_send_read(struct Curl_easy * data)573 static CURLcode smb_send_read(struct Curl_easy *data)
574 {
575 struct smb_request *req = data->req.p.smb;
576 curl_off_t offset = data->req.offset;
577 struct smb_read msg;
578
579 memset(&msg, 0, sizeof(msg));
580 msg.word_count = SMB_WC_READ_ANDX;
581 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
582 msg.fid = smb_swap16(req->fid);
583 msg.offset = smb_swap32((unsigned int) offset);
584 msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
585 msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
586 msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
587
588 return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
589 }
590
smb_send_write(struct Curl_easy * data)591 static CURLcode smb_send_write(struct Curl_easy *data)
592 {
593 struct smb_write *msg;
594 struct smb_request *req = data->req.p.smb;
595 curl_off_t offset = data->req.offset;
596 curl_off_t upload_size = data->req.size - data->req.bytecount;
597 CURLcode result = Curl_get_upload_buffer(data);
598 if(result)
599 return result;
600 msg = (struct smb_write *)data->state.ulbuf;
601
602 if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
603 upload_size = MAX_PAYLOAD_SIZE - 1;
604
605 memset(msg, 0, sizeof(*msg));
606 msg->word_count = SMB_WC_WRITE_ANDX;
607 msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
608 msg->fid = smb_swap16(req->fid);
609 msg->offset = smb_swap32((unsigned int) offset);
610 msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
611 msg->data_length = smb_swap16((unsigned short) upload_size);
612 msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
613 msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
614
615 smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
616 sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
617
618 return smb_send(data, sizeof(*msg), (size_t) upload_size);
619 }
620
smb_send_and_recv(struct Curl_easy * data,void ** msg)621 static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
622 {
623 struct connectdata *conn = data->conn;
624 struct smb_conn *smbc = &conn->proto.smbc;
625 CURLcode result;
626 *msg = NULL; /* if it returns early */
627
628 /* Check if there is data in the transfer buffer */
629 if(!smbc->send_size && smbc->upload_size) {
630 size_t nread = smbc->upload_size > data->set.upload_buffer_size ?
631 data->set.upload_buffer_size :
632 smbc->upload_size;
633 data->req.upload_fromhere = data->state.ulbuf;
634 result = Curl_fillreadbuffer(data, nread, &nread);
635 if(result && result != CURLE_AGAIN)
636 return result;
637 if(!nread)
638 return CURLE_OK;
639
640 smbc->upload_size -= nread;
641 smbc->send_size = nread;
642 smbc->sent = 0;
643 }
644
645 /* Check if there is data to send */
646 if(smbc->send_size) {
647 result = smb_flush(data);
648 if(result)
649 return result;
650 }
651
652 /* Check if there is still data to be sent */
653 if(smbc->send_size || smbc->upload_size)
654 return CURLE_AGAIN;
655
656 return smb_recv_message(data, msg);
657 }
658
smb_connection_state(struct Curl_easy * data,bool * done)659 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
660 {
661 struct connectdata *conn = data->conn;
662 struct smb_conn *smbc = &conn->proto.smbc;
663 struct smb_negotiate_response *nrsp;
664 struct smb_header *h;
665 CURLcode result;
666 void *msg = NULL;
667
668 if(smbc->state == SMB_CONNECTING) {
669 #ifdef USE_SSL
670 if((conn->handler->flags & PROTOPT_SSL)) {
671 bool ssl_done = FALSE;
672 result = Curl_ssl_connect_nonblocking(data, conn,
673 FIRSTSOCKET, &ssl_done);
674 if(result && result != CURLE_AGAIN)
675 return result;
676 if(!ssl_done)
677 return CURLE_OK;
678 }
679 #endif
680
681 result = smb_send_negotiate(data);
682 if(result) {
683 connclose(conn, "SMB: failed to send negotiate message");
684 return result;
685 }
686
687 conn_state(data, SMB_NEGOTIATE);
688 }
689
690 /* Send the previous message and check for a response */
691 result = smb_send_and_recv(data, &msg);
692 if(result && result != CURLE_AGAIN) {
693 connclose(conn, "SMB: failed to communicate");
694 return result;
695 }
696
697 if(!msg)
698 return CURLE_OK;
699
700 h = msg;
701
702 switch(smbc->state) {
703 case SMB_NEGOTIATE:
704 if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
705 h->status) {
706 connclose(conn, "SMB: negotiation failed");
707 return CURLE_COULDNT_CONNECT;
708 }
709 nrsp = msg;
710 memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
711 smbc->session_key = smb_swap32(nrsp->session_key);
712 result = smb_send_setup(data);
713 if(result) {
714 connclose(conn, "SMB: failed to send setup message");
715 return result;
716 }
717 conn_state(data, SMB_SETUP);
718 break;
719
720 case SMB_SETUP:
721 if(h->status) {
722 connclose(conn, "SMB: authentication failed");
723 return CURLE_LOGIN_DENIED;
724 }
725 smbc->uid = smb_swap16(h->uid);
726 conn_state(data, SMB_CONNECTED);
727 *done = true;
728 break;
729
730 default:
731 smb_pop_message(conn);
732 return CURLE_OK; /* ignore */
733 }
734
735 smb_pop_message(conn);
736
737 return CURLE_OK;
738 }
739
740 /*
741 * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
742 * to Posix time. Cap the output to fit within a time_t.
743 */
get_posix_time(time_t * out,curl_off_t timestamp)744 static void get_posix_time(time_t *out, curl_off_t timestamp)
745 {
746 timestamp -= 116444736000000000;
747 timestamp /= 10000000;
748 #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
749 if(timestamp > TIME_T_MAX)
750 *out = TIME_T_MAX;
751 else if(timestamp < TIME_T_MIN)
752 *out = TIME_T_MIN;
753 else
754 #endif
755 *out = (time_t) timestamp;
756 }
757
smb_request_state(struct Curl_easy * data,bool * done)758 static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
759 {
760 struct connectdata *conn = data->conn;
761 struct smb_request *req = data->req.p.smb;
762 struct smb_header *h;
763 struct smb_conn *smbc = &conn->proto.smbc;
764 enum smb_req_state next_state = SMB_DONE;
765 unsigned short len;
766 unsigned short off;
767 CURLcode result;
768 void *msg = NULL;
769 const struct smb_nt_create_response *smb_m;
770
771 /* Start the request */
772 if(req->state == SMB_REQUESTING) {
773 result = smb_send_tree_connect(data);
774 if(result) {
775 connclose(conn, "SMB: failed to send tree connect message");
776 return result;
777 }
778
779 request_state(data, SMB_TREE_CONNECT);
780 }
781
782 /* Send the previous message and check for a response */
783 result = smb_send_and_recv(data, &msg);
784 if(result && result != CURLE_AGAIN) {
785 connclose(conn, "SMB: failed to communicate");
786 return result;
787 }
788
789 if(!msg)
790 return CURLE_OK;
791
792 h = msg;
793
794 switch(req->state) {
795 case SMB_TREE_CONNECT:
796 if(h->status) {
797 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
798 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
799 req->result = CURLE_REMOTE_ACCESS_DENIED;
800 break;
801 }
802 req->tid = smb_swap16(h->tid);
803 next_state = SMB_OPEN;
804 break;
805
806 case SMB_OPEN:
807 if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
808 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
809 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
810 req->result = CURLE_REMOTE_ACCESS_DENIED;
811 next_state = SMB_TREE_DISCONNECT;
812 break;
813 }
814 smb_m = (const struct smb_nt_create_response*) msg;
815 req->fid = smb_swap16(smb_m->fid);
816 data->req.offset = 0;
817 if(data->set.upload) {
818 data->req.size = data->state.infilesize;
819 Curl_pgrsSetUploadSize(data, data->req.size);
820 next_state = SMB_UPLOAD;
821 }
822 else {
823 smb_m = (const struct smb_nt_create_response*) msg;
824 data->req.size = smb_swap64(smb_m->end_of_file);
825 if(data->req.size < 0) {
826 req->result = CURLE_WEIRD_SERVER_REPLY;
827 next_state = SMB_CLOSE;
828 }
829 else {
830 Curl_pgrsSetDownloadSize(data, data->req.size);
831 if(data->set.get_filetime)
832 get_posix_time(&data->info.filetime, smb_m->last_change_time);
833 next_state = SMB_DOWNLOAD;
834 }
835 }
836 break;
837
838 case SMB_DOWNLOAD:
839 if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
840 req->result = CURLE_RECV_ERROR;
841 next_state = SMB_CLOSE;
842 break;
843 }
844 len = Curl_read16_le(((const unsigned char *) msg) +
845 sizeof(struct smb_header) + 11);
846 off = Curl_read16_le(((const unsigned char *) msg) +
847 sizeof(struct smb_header) + 13);
848 if(len > 0) {
849 if(off + sizeof(unsigned int) + len > smbc->got) {
850 failf(data, "Invalid input packet");
851 result = CURLE_RECV_ERROR;
852 }
853 else
854 result = Curl_client_write(data, CLIENTWRITE_BODY,
855 (char *)msg + off + sizeof(unsigned int),
856 len);
857 if(result) {
858 req->result = result;
859 next_state = SMB_CLOSE;
860 break;
861 }
862 }
863 data->req.bytecount += len;
864 data->req.offset += len;
865 Curl_pgrsSetDownloadCounter(data, data->req.bytecount);
866 next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
867 break;
868
869 case SMB_UPLOAD:
870 if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
871 req->result = CURLE_UPLOAD_FAILED;
872 next_state = SMB_CLOSE;
873 break;
874 }
875 len = Curl_read16_le(((const unsigned char *) msg) +
876 sizeof(struct smb_header) + 5);
877 data->req.bytecount += len;
878 data->req.offset += len;
879 Curl_pgrsSetUploadCounter(data, data->req.bytecount);
880 if(data->req.bytecount >= data->req.size)
881 next_state = SMB_CLOSE;
882 else
883 next_state = SMB_UPLOAD;
884 break;
885
886 case SMB_CLOSE:
887 /* We don't care if the close failed, proceed to tree disconnect anyway */
888 next_state = SMB_TREE_DISCONNECT;
889 break;
890
891 case SMB_TREE_DISCONNECT:
892 next_state = SMB_DONE;
893 break;
894
895 default:
896 smb_pop_message(conn);
897 return CURLE_OK; /* ignore */
898 }
899
900 smb_pop_message(conn);
901
902 switch(next_state) {
903 case SMB_OPEN:
904 result = smb_send_open(data);
905 break;
906
907 case SMB_DOWNLOAD:
908 result = smb_send_read(data);
909 break;
910
911 case SMB_UPLOAD:
912 result = smb_send_write(data);
913 break;
914
915 case SMB_CLOSE:
916 result = smb_send_close(data);
917 break;
918
919 case SMB_TREE_DISCONNECT:
920 result = smb_send_tree_disconnect(data);
921 break;
922
923 case SMB_DONE:
924 result = req->result;
925 *done = true;
926 break;
927
928 default:
929 break;
930 }
931
932 if(result) {
933 connclose(conn, "SMB: failed to send message");
934 return result;
935 }
936
937 request_state(data, next_state);
938
939 return CURLE_OK;
940 }
941
smb_done(struct Curl_easy * data,CURLcode status,bool premature)942 static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
943 bool premature)
944 {
945 (void) premature;
946 Curl_safefree(data->req.p.smb);
947 return status;
948 }
949
smb_disconnect(struct Curl_easy * data,struct connectdata * conn,bool dead)950 static CURLcode smb_disconnect(struct Curl_easy *data,
951 struct connectdata *conn, bool dead)
952 {
953 struct smb_conn *smbc = &conn->proto.smbc;
954 (void) dead;
955 (void) data;
956 Curl_safefree(smbc->share);
957 Curl_safefree(smbc->domain);
958 Curl_safefree(smbc->recv_buf);
959 return CURLE_OK;
960 }
961
smb_getsock(struct Curl_easy * data,struct connectdata * conn,curl_socket_t * socks)962 static int smb_getsock(struct Curl_easy *data,
963 struct connectdata *conn, curl_socket_t *socks)
964 {
965 (void)data;
966 socks[0] = conn->sock[FIRSTSOCKET];
967 return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
968 }
969
smb_do(struct Curl_easy * data,bool * done)970 static CURLcode smb_do(struct Curl_easy *data, bool *done)
971 {
972 struct connectdata *conn = data->conn;
973 struct smb_conn *smbc = &conn->proto.smbc;
974
975 *done = FALSE;
976 if(smbc->share) {
977 return CURLE_OK;
978 }
979 return CURLE_URL_MALFORMAT;
980 }
981
smb_parse_url_path(struct Curl_easy * data,struct connectdata * conn)982 static CURLcode smb_parse_url_path(struct Curl_easy *data,
983 struct connectdata *conn)
984 {
985 struct smb_request *req = data->req.p.smb;
986 struct smb_conn *smbc = &conn->proto.smbc;
987 char *path;
988 char *slash;
989
990 /* URL decode the path */
991 CURLcode result = Curl_urldecode(data, data->state.up.path, 0, &path, NULL,
992 REJECT_CTRL);
993 if(result)
994 return result;
995
996 /* Parse the path for the share */
997 smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
998 free(path);
999 if(!smbc->share)
1000 return CURLE_OUT_OF_MEMORY;
1001
1002 slash = strchr(smbc->share, '/');
1003 if(!slash)
1004 slash = strchr(smbc->share, '\\');
1005
1006 /* The share must be present */
1007 if(!slash) {
1008 Curl_safefree(smbc->share);
1009 return CURLE_URL_MALFORMAT;
1010 }
1011
1012 /* Parse the path for the file path converting any forward slashes into
1013 backslashes */
1014 *slash++ = 0;
1015 req->path = slash;
1016
1017 for(; *slash; slash++) {
1018 if(*slash == '/')
1019 *slash = '\\';
1020 }
1021 return CURLE_OK;
1022 }
1023
1024 #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
1025 CURL_SIZEOF_CURL_OFF_T > 4 */
1026