1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9 * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
10 *
11 * This software is licensed as described in the file COPYING, which
12 * you should have received as part of this distribution. The terms
13 * are also available at https://curl.se/docs/copyright.html.
14 *
15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 * copies of the Software, and permit persons to whom the Software is
17 * furnished to do so, under the terms of the COPYING file.
18 *
19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 * KIND, either express or implied.
21 *
22 * SPDX-License-Identifier: curl
23 *
24 ***************************************************************************/
25
26 #include "curl_setup.h"
27
28 #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
29
30 #ifdef _WIN32
31 #define Curl_getpid() ((unsigned int)GetCurrentProcessId())
32 #else
33 #define Curl_getpid() ((unsigned int)getpid())
34 #endif
35
36 #include "smb.h"
37 #include "urldata.h"
38 #include "sendf.h"
39 #include "multiif.h"
40 #include "cfilters.h"
41 #include "connect.h"
42 #include "progress.h"
43 #include "transfer.h"
44 #include "vtls/vtls.h"
45 #include "curl_ntlm_core.h"
46 #include "escape.h"
47 #include "curl_endian.h"
48
49 /* The last 3 #include files should be in this order */
50 #include "curl_printf.h"
51 #include "curl_memory.h"
52 #include "memdebug.h"
53
54 /*
55 * Definitions for SMB protocol data structures
56 */
57 #if defined(_MSC_VER) || defined(__ILEC400__)
58 # define PACK
59 # pragma pack(push)
60 # pragma pack(1)
61 #elif defined(__GNUC__)
62 # define PACK __attribute__((packed))
63 #else
64 # define PACK
65 #endif
66
67 #define SMB_COM_CLOSE 0x04
68 #define SMB_COM_READ_ANDX 0x2e
69 #define SMB_COM_WRITE_ANDX 0x2f
70 #define SMB_COM_TREE_DISCONNECT 0x71
71 #define SMB_COM_NEGOTIATE 0x72
72 #define SMB_COM_SETUP_ANDX 0x73
73 #define SMB_COM_TREE_CONNECT_ANDX 0x75
74 #define SMB_COM_NT_CREATE_ANDX 0xa2
75 #define SMB_COM_NO_ANDX_COMMAND 0xff
76
77 #define SMB_WC_CLOSE 0x03
78 #define SMB_WC_READ_ANDX 0x0c
79 #define SMB_WC_WRITE_ANDX 0x0e
80 #define SMB_WC_SETUP_ANDX 0x0d
81 #define SMB_WC_TREE_CONNECT_ANDX 0x04
82 #define SMB_WC_NT_CREATE_ANDX 0x18
83
84 #define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
85 #define SMB_FLAGS_CASELESS_PATHNAMES 0x08
86 #define SMB_FLAGS2_UNICODE_STRINGS 0x8000
87 #define SMB_FLAGS2_IS_LONG_NAME 0x0040
88 #define SMB_FLAGS2_KNOWS_LONG_NAME 0x0001
89
90 #define SMB_CAP_LARGE_FILES 0x08
91 #define SMB_GENERIC_WRITE 0x40000000
92 #define SMB_GENERIC_READ 0x80000000
93 #define SMB_FILE_SHARE_ALL 0x07
94 #define SMB_FILE_OPEN 0x01
95 #define SMB_FILE_OVERWRITE_IF 0x05
96
97 #define SMB_ERR_NOACCESS 0x00050001
98
99 struct smb_header {
100 unsigned char nbt_type;
101 unsigned char nbt_flags;
102 unsigned short nbt_length;
103 unsigned char magic[4];
104 unsigned char command;
105 unsigned int status;
106 unsigned char flags;
107 unsigned short flags2;
108 unsigned short pid_high;
109 unsigned char signature[8];
110 unsigned short pad;
111 unsigned short tid;
112 unsigned short pid;
113 unsigned short uid;
114 unsigned short mid;
115 } PACK;
116
117 struct smb_negotiate_response {
118 struct smb_header h;
119 unsigned char word_count;
120 unsigned short dialect_index;
121 unsigned char security_mode;
122 unsigned short max_mpx_count;
123 unsigned short max_number_vcs;
124 unsigned int max_buffer_size;
125 unsigned int max_raw_size;
126 unsigned int session_key;
127 unsigned int capabilities;
128 unsigned int system_time_low;
129 unsigned int system_time_high;
130 unsigned short server_time_zone;
131 unsigned char encryption_key_length;
132 unsigned short byte_count;
133 char bytes[1];
134 } PACK;
135
136 struct andx {
137 unsigned char command;
138 unsigned char pad;
139 unsigned short offset;
140 } PACK;
141
142 struct smb_setup {
143 unsigned char word_count;
144 struct andx andx;
145 unsigned short max_buffer_size;
146 unsigned short max_mpx_count;
147 unsigned short vc_number;
148 unsigned int session_key;
149 unsigned short lengths[2];
150 unsigned int pad;
151 unsigned int capabilities;
152 unsigned short byte_count;
153 char bytes[1024];
154 } PACK;
155
156 struct smb_tree_connect {
157 unsigned char word_count;
158 struct andx andx;
159 unsigned short flags;
160 unsigned short pw_len;
161 unsigned short byte_count;
162 char bytes[1024];
163 } PACK;
164
165 struct smb_nt_create {
166 unsigned char word_count;
167 struct andx andx;
168 unsigned char pad;
169 unsigned short name_length;
170 unsigned int flags;
171 unsigned int root_fid;
172 unsigned int access;
173 curl_off_t allocation_size;
174 unsigned int ext_file_attributes;
175 unsigned int share_access;
176 unsigned int create_disposition;
177 unsigned int create_options;
178 unsigned int impersonation_level;
179 unsigned char security_flags;
180 unsigned short byte_count;
181 char bytes[1024];
182 } PACK;
183
184 struct smb_nt_create_response {
185 struct smb_header h;
186 unsigned char word_count;
187 struct andx andx;
188 unsigned char op_lock_level;
189 unsigned short fid;
190 unsigned int create_disposition;
191
192 curl_off_t create_time;
193 curl_off_t last_access_time;
194 curl_off_t last_write_time;
195 curl_off_t last_change_time;
196 unsigned int ext_file_attributes;
197 curl_off_t allocation_size;
198 curl_off_t end_of_file;
199 } PACK;
200
201 struct smb_read {
202 unsigned char word_count;
203 struct andx andx;
204 unsigned short fid;
205 unsigned int offset;
206 unsigned short max_bytes;
207 unsigned short min_bytes;
208 unsigned int timeout;
209 unsigned short remaining;
210 unsigned int offset_high;
211 unsigned short byte_count;
212 } PACK;
213
214 struct smb_write {
215 struct smb_header h;
216 unsigned char word_count;
217 struct andx andx;
218 unsigned short fid;
219 unsigned int offset;
220 unsigned int timeout;
221 unsigned short write_mode;
222 unsigned short remaining;
223 unsigned short pad;
224 unsigned short data_length;
225 unsigned short data_offset;
226 unsigned int offset_high;
227 unsigned short byte_count;
228 unsigned char pad2;
229 } PACK;
230
231 struct smb_close {
232 unsigned char word_count;
233 unsigned short fid;
234 unsigned int last_mtime;
235 unsigned short byte_count;
236 } PACK;
237
238 struct smb_tree_disconnect {
239 unsigned char word_count;
240 unsigned short byte_count;
241 } PACK;
242
243 #if defined(_MSC_VER) || defined(__ILEC400__)
244 # pragma pack(pop)
245 #endif
246
247 /* Local API functions */
248 static CURLcode smb_setup_connection(struct Curl_easy *data,
249 struct connectdata *conn);
250 static CURLcode smb_connect(struct Curl_easy *data, bool *done);
251 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
252 static CURLcode smb_do(struct Curl_easy *data, bool *done);
253 static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
254 static CURLcode smb_disconnect(struct Curl_easy *data,
255 struct connectdata *conn, bool dead);
256 static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
257 curl_socket_t *socks);
258 static CURLcode smb_parse_url_path(struct Curl_easy *data,
259 struct connectdata *conn);
260
261 /*
262 * SMB handler interface
263 */
264 const struct Curl_handler Curl_handler_smb = {
265 "smb", /* scheme */
266 smb_setup_connection, /* setup_connection */
267 smb_do, /* do_it */
268 ZERO_NULL, /* done */
269 ZERO_NULL, /* do_more */
270 smb_connect, /* connect_it */
271 smb_connection_state, /* connecting */
272 smb_request_state, /* doing */
273 smb_getsock, /* proto_getsock */
274 smb_getsock, /* doing_getsock */
275 ZERO_NULL, /* domore_getsock */
276 ZERO_NULL, /* perform_getsock */
277 smb_disconnect, /* disconnect */
278 ZERO_NULL, /* write_resp */
279 ZERO_NULL, /* write_resp_hd */
280 ZERO_NULL, /* connection_check */
281 ZERO_NULL, /* attach connection */
282 PORT_SMB, /* defport */
283 CURLPROTO_SMB, /* protocol */
284 CURLPROTO_SMB, /* family */
285 PROTOPT_NONE /* flags */
286 };
287
288 #ifdef USE_SSL
289 /*
290 * SMBS handler interface
291 */
292 const struct Curl_handler Curl_handler_smbs = {
293 "smbs", /* scheme */
294 smb_setup_connection, /* setup_connection */
295 smb_do, /* do_it */
296 ZERO_NULL, /* done */
297 ZERO_NULL, /* do_more */
298 smb_connect, /* connect_it */
299 smb_connection_state, /* connecting */
300 smb_request_state, /* doing */
301 smb_getsock, /* proto_getsock */
302 smb_getsock, /* doing_getsock */
303 ZERO_NULL, /* domore_getsock */
304 ZERO_NULL, /* perform_getsock */
305 smb_disconnect, /* disconnect */
306 ZERO_NULL, /* write_resp */
307 ZERO_NULL, /* write_resp_hd */
308 ZERO_NULL, /* connection_check */
309 ZERO_NULL, /* attach connection */
310 PORT_SMBS, /* defport */
311 CURLPROTO_SMBS, /* protocol */
312 CURLPROTO_SMB, /* family */
313 PROTOPT_SSL /* flags */
314 };
315 #endif
316
317 #define MAX_PAYLOAD_SIZE 0x8000
318 #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
319 #define CLIENTNAME "curl"
320 #define SERVICENAME "?????"
321
322 /* SMB is mostly little endian */
323 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
324 defined(__OS400__)
smb_swap16(unsigned short x)325 static unsigned short smb_swap16(unsigned short x)
326 {
327 return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
328 }
329
smb_swap32(unsigned int x)330 static unsigned int smb_swap32(unsigned int x)
331 {
332 return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
333 ((x >> 24) & 0xff);
334 }
335
smb_swap64(curl_off_t x)336 static curl_off_t smb_swap64(curl_off_t x)
337 {
338 return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
339 smb_swap32((unsigned int) (x >> 32));
340 }
341
342 #else
343 # define smb_swap16(x) (x)
344 # define smb_swap32(x) (x)
345 # define smb_swap64(x) (x)
346 #endif
347
348 /* SMB request state */
349 enum smb_req_state {
350 SMB_REQUESTING,
351 SMB_TREE_CONNECT,
352 SMB_OPEN,
353 SMB_DOWNLOAD,
354 SMB_UPLOAD,
355 SMB_CLOSE,
356 SMB_TREE_DISCONNECT,
357 SMB_DONE
358 };
359
360 /* SMB request data */
361 struct smb_request {
362 enum smb_req_state state;
363 char *path;
364 unsigned short tid; /* Even if we connect to the same tree as another */
365 unsigned short fid; /* request, the tid will be different */
366 CURLcode result;
367 };
368
conn_state(struct Curl_easy * data,enum smb_conn_state newstate)369 static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
370 {
371 struct smb_conn *smbc = &data->conn->proto.smbc;
372 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
373 /* For debug purposes */
374 static const char * const names[] = {
375 "SMB_NOT_CONNECTED",
376 "SMB_CONNECTING",
377 "SMB_NEGOTIATE",
378 "SMB_SETUP",
379 "SMB_CONNECTED",
380 /* LAST */
381 };
382
383 if(smbc->state != newstate)
384 infof(data, "SMB conn %p state change from %s to %s",
385 (void *)smbc, names[smbc->state], names[newstate]);
386 #endif
387
388 smbc->state = newstate;
389 }
390
request_state(struct Curl_easy * data,enum smb_req_state newstate)391 static void request_state(struct Curl_easy *data,
392 enum smb_req_state newstate)
393 {
394 struct smb_request *req = data->req.p.smb;
395 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
396 /* For debug purposes */
397 static const char * const names[] = {
398 "SMB_REQUESTING",
399 "SMB_TREE_CONNECT",
400 "SMB_OPEN",
401 "SMB_DOWNLOAD",
402 "SMB_UPLOAD",
403 "SMB_CLOSE",
404 "SMB_TREE_DISCONNECT",
405 "SMB_DONE",
406 /* LAST */
407 };
408
409 if(req->state != newstate)
410 infof(data, "SMB request %p state change from %s to %s",
411 (void *)req, names[req->state], names[newstate]);
412 #endif
413
414 req->state = newstate;
415 }
416
417 /* this should setup things in the connection, not in the easy
418 handle */
smb_setup_connection(struct Curl_easy * data,struct connectdata * conn)419 static CURLcode smb_setup_connection(struct Curl_easy *data,
420 struct connectdata *conn)
421 {
422 struct smb_request *req;
423
424 /* Initialize the request state */
425 data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
426 if(!req)
427 return CURLE_OUT_OF_MEMORY;
428
429 /* Parse the URL path */
430 return smb_parse_url_path(data, conn);
431 }
432
smb_connect(struct Curl_easy * data,bool * done)433 static CURLcode smb_connect(struct Curl_easy *data, bool *done)
434 {
435 struct connectdata *conn = data->conn;
436 struct smb_conn *smbc = &conn->proto.smbc;
437 char *slash;
438
439 (void) done;
440
441 /* Check we have a username and password to authenticate with */
442 if(!data->state.aptr.user)
443 return CURLE_LOGIN_DENIED;
444
445 /* Initialize the connection state */
446 smbc->state = SMB_CONNECTING;
447 smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
448 if(!smbc->recv_buf)
449 return CURLE_OUT_OF_MEMORY;
450 smbc->send_buf = malloc(MAX_MESSAGE_SIZE);
451 if(!smbc->send_buf)
452 return CURLE_OUT_OF_MEMORY;
453
454 /* Multiple requests are allowed with this connection */
455 connkeep(conn, "SMB default");
456
457 /* Parse the username, domain, and password */
458 slash = strchr(conn->user, '/');
459 if(!slash)
460 slash = strchr(conn->user, '\\');
461
462 if(slash) {
463 smbc->user = slash + 1;
464 smbc->domain = strdup(conn->user);
465 if(!smbc->domain)
466 return CURLE_OUT_OF_MEMORY;
467 smbc->domain[slash - conn->user] = 0;
468 }
469 else {
470 smbc->user = conn->user;
471 smbc->domain = strdup(conn->host.name);
472 if(!smbc->domain)
473 return CURLE_OUT_OF_MEMORY;
474 }
475
476 return CURLE_OK;
477 }
478
smb_recv_message(struct Curl_easy * data,void ** msg)479 static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
480 {
481 struct connectdata *conn = data->conn;
482 struct smb_conn *smbc = &conn->proto.smbc;
483 char *buf = smbc->recv_buf;
484 ssize_t bytes_read;
485 size_t nbt_size;
486 size_t msg_size;
487 size_t len = MAX_MESSAGE_SIZE - smbc->got;
488 CURLcode result;
489
490 result = Curl_xfer_recv(data, buf + smbc->got, len, &bytes_read);
491 if(result)
492 return result;
493
494 if(!bytes_read)
495 return CURLE_OK;
496
497 smbc->got += bytes_read;
498
499 /* Check for a 32-bit nbt header */
500 if(smbc->got < sizeof(unsigned int))
501 return CURLE_OK;
502
503 nbt_size = Curl_read16_be((const unsigned char *)
504 (buf + sizeof(unsigned short))) +
505 sizeof(unsigned int);
506 if(smbc->got < nbt_size)
507 return CURLE_OK;
508
509 msg_size = sizeof(struct smb_header);
510 if(nbt_size >= msg_size + 1) {
511 /* Add the word count */
512 msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
513 if(nbt_size >= msg_size + sizeof(unsigned short)) {
514 /* Add the byte count */
515 msg_size += sizeof(unsigned short) +
516 Curl_read16_le((const unsigned char *)&buf[msg_size]);
517 if(nbt_size < msg_size)
518 return CURLE_READ_ERROR;
519 }
520 }
521
522 *msg = buf;
523
524 return CURLE_OK;
525 }
526
smb_pop_message(struct connectdata * conn)527 static void smb_pop_message(struct connectdata *conn)
528 {
529 struct smb_conn *smbc = &conn->proto.smbc;
530
531 smbc->got = 0;
532 }
533
smb_format_message(struct Curl_easy * data,struct smb_header * h,unsigned char cmd,size_t len)534 static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
535 unsigned char cmd, size_t len)
536 {
537 struct connectdata *conn = data->conn;
538 struct smb_conn *smbc = &conn->proto.smbc;
539 struct smb_request *req = data->req.p.smb;
540 unsigned int pid;
541
542 memset(h, 0, sizeof(*h));
543 h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
544 len));
545 memcpy((char *)h->magic, "\xffSMB", 4);
546 h->command = cmd;
547 h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
548 h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
549 h->uid = smb_swap16(smbc->uid);
550 h->tid = smb_swap16(req->tid);
551 pid = Curl_getpid();
552 h->pid_high = smb_swap16((unsigned short)(pid >> 16));
553 h->pid = smb_swap16((unsigned short) pid);
554 }
555
smb_send(struct Curl_easy * data,size_t len,size_t upload_size)556 static CURLcode smb_send(struct Curl_easy *data, size_t len,
557 size_t upload_size)
558 {
559 struct connectdata *conn = data->conn;
560 struct smb_conn *smbc = &conn->proto.smbc;
561 size_t bytes_written;
562 CURLcode result;
563
564 result = Curl_xfer_send(data, smbc->send_buf, len, FALSE, &bytes_written);
565 if(result)
566 return result;
567
568 if(bytes_written != len) {
569 smbc->send_size = len;
570 smbc->sent = bytes_written;
571 }
572
573 smbc->upload_size = upload_size;
574
575 return CURLE_OK;
576 }
577
smb_flush(struct Curl_easy * data)578 static CURLcode smb_flush(struct Curl_easy *data)
579 {
580 struct connectdata *conn = data->conn;
581 struct smb_conn *smbc = &conn->proto.smbc;
582 size_t bytes_written;
583 size_t len = smbc->send_size - smbc->sent;
584 CURLcode result;
585
586 if(!smbc->send_size)
587 return CURLE_OK;
588
589 result = Curl_xfer_send(data, smbc->send_buf + smbc->sent, len, FALSE,
590 &bytes_written);
591 if(result)
592 return result;
593
594 if(bytes_written != len)
595 smbc->sent += bytes_written;
596 else
597 smbc->send_size = 0;
598
599 return CURLE_OK;
600 }
601
smb_send_message(struct Curl_easy * data,unsigned char cmd,const void * msg,size_t msg_len)602 static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
603 const void *msg, size_t msg_len)
604 {
605 struct connectdata *conn = data->conn;
606 struct smb_conn *smbc = &conn->proto.smbc;
607
608 smb_format_message(data, (struct smb_header *)smbc->send_buf,
609 cmd, msg_len);
610 DEBUGASSERT((sizeof(struct smb_header) + msg_len) <= MAX_MESSAGE_SIZE);
611 memcpy(smbc->send_buf + sizeof(struct smb_header), msg, msg_len);
612
613 return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
614 }
615
smb_send_negotiate(struct Curl_easy * data)616 static CURLcode smb_send_negotiate(struct Curl_easy *data)
617 {
618 const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
619
620 return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
621 }
622
smb_send_setup(struct Curl_easy * data)623 static CURLcode smb_send_setup(struct Curl_easy *data)
624 {
625 struct connectdata *conn = data->conn;
626 struct smb_conn *smbc = &conn->proto.smbc;
627 struct smb_setup msg;
628 char *p = msg.bytes;
629 unsigned char lm_hash[21];
630 unsigned char lm[24];
631 unsigned char nt_hash[21];
632 unsigned char nt[24];
633
634 const size_t byte_count = sizeof(lm) + sizeof(nt) +
635 strlen(smbc->user) + strlen(smbc->domain) +
636 strlen(CURL_OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
637 if(byte_count > sizeof(msg.bytes))
638 return CURLE_FILESIZE_EXCEEDED;
639
640 Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
641 Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
642 Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
643 Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
644
645 memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
646 msg.word_count = SMB_WC_SETUP_ANDX;
647 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
648 msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
649 msg.max_mpx_count = smb_swap16(1);
650 msg.vc_number = smb_swap16(1);
651 msg.session_key = smb_swap32(smbc->session_key);
652 msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
653 msg.lengths[0] = smb_swap16(sizeof(lm));
654 msg.lengths[1] = smb_swap16(sizeof(nt));
655 memcpy(p, lm, sizeof(lm));
656 p += sizeof(lm);
657 memcpy(p, nt, sizeof(nt));
658 p += sizeof(nt);
659 p += msnprintf(p, byte_count - sizeof(nt) - sizeof(lm),
660 "%s%c" /* user */
661 "%s%c" /* domain */
662 "%s%c" /* OS */
663 "%s", /* client name */
664 smbc->user, 0, smbc->domain, 0, CURL_OS, 0, CLIENTNAME);
665 p++; /* count the final null termination */
666 DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
667 msg.byte_count = smb_swap16((unsigned short)byte_count);
668
669 return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
670 sizeof(msg) - sizeof(msg.bytes) + byte_count);
671 }
672
smb_send_tree_connect(struct Curl_easy * data)673 static CURLcode smb_send_tree_connect(struct Curl_easy *data)
674 {
675 struct smb_tree_connect msg;
676 struct connectdata *conn = data->conn;
677 struct smb_conn *smbc = &conn->proto.smbc;
678 char *p = msg.bytes;
679
680 const size_t byte_count = strlen(conn->host.name) + strlen(smbc->share) +
681 strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
682 if(byte_count > sizeof(msg.bytes))
683 return CURLE_FILESIZE_EXCEEDED;
684
685 memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
686 msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
687 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
688 msg.pw_len = 0;
689
690 p += msnprintf(p, byte_count,
691 "\\\\%s\\" /* hostname */
692 "%s%c" /* share */
693 "%s", /* service */
694 conn->host.name, smbc->share, 0, SERVICENAME);
695 p++; /* count the final null termination */
696 DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
697 msg.byte_count = smb_swap16((unsigned short)byte_count);
698
699 return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
700 sizeof(msg) - sizeof(msg.bytes) + byte_count);
701 }
702
smb_send_open(struct Curl_easy * data)703 static CURLcode smb_send_open(struct Curl_easy *data)
704 {
705 struct smb_request *req = data->req.p.smb;
706 struct smb_nt_create msg;
707 const size_t byte_count = strlen(req->path) + 1;
708
709 if(byte_count > sizeof(msg.bytes))
710 return CURLE_FILESIZE_EXCEEDED;
711
712 memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
713 msg.word_count = SMB_WC_NT_CREATE_ANDX;
714 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
715 msg.name_length = smb_swap16((unsigned short)(byte_count - 1));
716 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
717 if(data->state.upload) {
718 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
719 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
720 }
721 else {
722 msg.access = smb_swap32(SMB_GENERIC_READ);
723 msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
724 }
725 msg.byte_count = smb_swap16((unsigned short) byte_count);
726 strcpy(msg.bytes, req->path);
727
728 return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
729 sizeof(msg) - sizeof(msg.bytes) + byte_count);
730 }
731
smb_send_close(struct Curl_easy * data)732 static CURLcode smb_send_close(struct Curl_easy *data)
733 {
734 struct smb_request *req = data->req.p.smb;
735 struct smb_close msg;
736
737 memset(&msg, 0, sizeof(msg));
738 msg.word_count = SMB_WC_CLOSE;
739 msg.fid = smb_swap16(req->fid);
740
741 return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
742 }
743
smb_send_tree_disconnect(struct Curl_easy * data)744 static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
745 {
746 struct smb_tree_disconnect msg;
747
748 memset(&msg, 0, sizeof(msg));
749
750 return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
751 }
752
smb_send_read(struct Curl_easy * data)753 static CURLcode smb_send_read(struct Curl_easy *data)
754 {
755 struct smb_request *req = data->req.p.smb;
756 curl_off_t offset = data->req.offset;
757 struct smb_read msg;
758
759 memset(&msg, 0, sizeof(msg));
760 msg.word_count = SMB_WC_READ_ANDX;
761 msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
762 msg.fid = smb_swap16(req->fid);
763 msg.offset = smb_swap32((unsigned int) offset);
764 msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
765 msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
766 msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
767
768 return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
769 }
770
smb_send_write(struct Curl_easy * data)771 static CURLcode smb_send_write(struct Curl_easy *data)
772 {
773 struct connectdata *conn = data->conn;
774 struct smb_conn *smbc = &conn->proto.smbc;
775 struct smb_write *msg;
776 struct smb_request *req = data->req.p.smb;
777 curl_off_t offset = data->req.offset;
778 curl_off_t upload_size = data->req.size - data->req.bytecount;
779
780 msg = (struct smb_write *)smbc->send_buf;
781 if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
782 upload_size = MAX_PAYLOAD_SIZE - 1;
783
784 memset(msg, 0, sizeof(*msg));
785 msg->word_count = SMB_WC_WRITE_ANDX;
786 msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
787 msg->fid = smb_swap16(req->fid);
788 msg->offset = smb_swap32((unsigned int) offset);
789 msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
790 msg->data_length = smb_swap16((unsigned short) upload_size);
791 msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
792 msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
793
794 smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
795 sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
796
797 return smb_send(data, sizeof(*msg), (size_t) upload_size);
798 }
799
smb_send_and_recv(struct Curl_easy * data,void ** msg)800 static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
801 {
802 struct connectdata *conn = data->conn;
803 struct smb_conn *smbc = &conn->proto.smbc;
804 CURLcode result;
805 *msg = NULL; /* if it returns early */
806
807 /* Check if there is data in the transfer buffer */
808 if(!smbc->send_size && smbc->upload_size) {
809 size_t nread = smbc->upload_size > (size_t)MAX_MESSAGE_SIZE ?
810 (size_t)MAX_MESSAGE_SIZE : smbc->upload_size;
811 bool eos;
812
813 result = Curl_client_read(data, smbc->send_buf, nread, &nread, &eos);
814 if(result && result != CURLE_AGAIN)
815 return result;
816 if(!nread)
817 return CURLE_OK;
818
819 smbc->upload_size -= nread;
820 smbc->send_size = nread;
821 smbc->sent = 0;
822 }
823
824 /* Check if there is data to send */
825 if(smbc->send_size) {
826 result = smb_flush(data);
827 if(result)
828 return result;
829 }
830
831 /* Check if there is still data to be sent */
832 if(smbc->send_size || smbc->upload_size)
833 return CURLE_AGAIN;
834
835 return smb_recv_message(data, msg);
836 }
837
smb_connection_state(struct Curl_easy * data,bool * done)838 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
839 {
840 struct connectdata *conn = data->conn;
841 struct smb_conn *smbc = &conn->proto.smbc;
842 struct smb_negotiate_response *nrsp;
843 struct smb_header *h;
844 CURLcode result;
845 void *msg = NULL;
846
847 if(smbc->state == SMB_CONNECTING) {
848 #ifdef USE_SSL
849 if((conn->handler->flags & PROTOPT_SSL)) {
850 bool ssl_done = FALSE;
851 result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
852 if(result && result != CURLE_AGAIN)
853 return result;
854 if(!ssl_done)
855 return CURLE_OK;
856 }
857 #endif
858
859 result = smb_send_negotiate(data);
860 if(result) {
861 connclose(conn, "SMB: failed to send negotiate message");
862 return result;
863 }
864
865 conn_state(data, SMB_NEGOTIATE);
866 }
867
868 /* Send the previous message and check for a response */
869 result = smb_send_and_recv(data, &msg);
870 if(result && result != CURLE_AGAIN) {
871 connclose(conn, "SMB: failed to communicate");
872 return result;
873 }
874
875 if(!msg)
876 return CURLE_OK;
877
878 h = msg;
879
880 switch(smbc->state) {
881 case SMB_NEGOTIATE:
882 if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
883 h->status) {
884 connclose(conn, "SMB: negotiation failed");
885 return CURLE_COULDNT_CONNECT;
886 }
887 nrsp = msg;
888 memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
889 smbc->session_key = smb_swap32(nrsp->session_key);
890 result = smb_send_setup(data);
891 if(result) {
892 connclose(conn, "SMB: failed to send setup message");
893 return result;
894 }
895 conn_state(data, SMB_SETUP);
896 break;
897
898 case SMB_SETUP:
899 if(h->status) {
900 connclose(conn, "SMB: authentication failed");
901 return CURLE_LOGIN_DENIED;
902 }
903 smbc->uid = smb_swap16(h->uid);
904 conn_state(data, SMB_CONNECTED);
905 *done = TRUE;
906 break;
907
908 default:
909 smb_pop_message(conn);
910 return CURLE_OK; /* ignore */
911 }
912
913 smb_pop_message(conn);
914
915 return CURLE_OK;
916 }
917
918 /*
919 * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
920 * to POSIX time. Cap the output to fit within a time_t.
921 */
get_posix_time(time_t * out,curl_off_t timestamp)922 static void get_posix_time(time_t *out, curl_off_t timestamp)
923 {
924 timestamp -= 116444736000000000;
925 timestamp /= 10000000;
926 #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
927 if(timestamp > TIME_T_MAX)
928 *out = TIME_T_MAX;
929 else if(timestamp < TIME_T_MIN)
930 *out = TIME_T_MIN;
931 else
932 #endif
933 *out = (time_t) timestamp;
934 }
935
smb_request_state(struct Curl_easy * data,bool * done)936 static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
937 {
938 struct connectdata *conn = data->conn;
939 struct smb_request *req = data->req.p.smb;
940 struct smb_header *h;
941 struct smb_conn *smbc = &conn->proto.smbc;
942 enum smb_req_state next_state = SMB_DONE;
943 unsigned short len;
944 unsigned short off;
945 CURLcode result;
946 void *msg = NULL;
947 const struct smb_nt_create_response *smb_m;
948
949 if(data->state.upload && (data->state.infilesize < 0)) {
950 failf(data, "SMB upload needs to know the size up front");
951 return CURLE_SEND_ERROR;
952 }
953
954 /* Start the request */
955 if(req->state == SMB_REQUESTING) {
956 result = smb_send_tree_connect(data);
957 if(result) {
958 connclose(conn, "SMB: failed to send tree connect message");
959 return result;
960 }
961
962 request_state(data, SMB_TREE_CONNECT);
963 }
964
965 /* Send the previous message and check for a response */
966 result = smb_send_and_recv(data, &msg);
967 if(result && result != CURLE_AGAIN) {
968 connclose(conn, "SMB: failed to communicate");
969 return result;
970 }
971
972 if(!msg)
973 return CURLE_OK;
974
975 h = msg;
976
977 switch(req->state) {
978 case SMB_TREE_CONNECT:
979 if(h->status) {
980 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
981 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
982 req->result = CURLE_REMOTE_ACCESS_DENIED;
983 break;
984 }
985 req->tid = smb_swap16(h->tid);
986 next_state = SMB_OPEN;
987 break;
988
989 case SMB_OPEN:
990 if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
991 req->result = CURLE_REMOTE_FILE_NOT_FOUND;
992 if(h->status == smb_swap32(SMB_ERR_NOACCESS))
993 req->result = CURLE_REMOTE_ACCESS_DENIED;
994 next_state = SMB_TREE_DISCONNECT;
995 break;
996 }
997 smb_m = (const struct smb_nt_create_response*) msg;
998 req->fid = smb_swap16(smb_m->fid);
999 data->req.offset = 0;
1000 if(data->state.upload) {
1001 data->req.size = data->state.infilesize;
1002 Curl_pgrsSetUploadSize(data, data->req.size);
1003 next_state = SMB_UPLOAD;
1004 }
1005 else {
1006 data->req.size = smb_swap64(smb_m->end_of_file);
1007 if(data->req.size < 0) {
1008 req->result = CURLE_WEIRD_SERVER_REPLY;
1009 next_state = SMB_CLOSE;
1010 }
1011 else {
1012 Curl_pgrsSetDownloadSize(data, data->req.size);
1013 if(data->set.get_filetime)
1014 get_posix_time(&data->info.filetime, smb_m->last_change_time);
1015 next_state = SMB_DOWNLOAD;
1016 }
1017 }
1018 break;
1019
1020 case SMB_DOWNLOAD:
1021 if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
1022 req->result = CURLE_RECV_ERROR;
1023 next_state = SMB_CLOSE;
1024 break;
1025 }
1026 len = Curl_read16_le(((const unsigned char *) msg) +
1027 sizeof(struct smb_header) + 11);
1028 off = Curl_read16_le(((const unsigned char *) msg) +
1029 sizeof(struct smb_header) + 13);
1030 if(len > 0) {
1031 if(off + sizeof(unsigned int) + len > smbc->got) {
1032 failf(data, "Invalid input packet");
1033 result = CURLE_RECV_ERROR;
1034 }
1035 else
1036 result = Curl_client_write(data, CLIENTWRITE_BODY,
1037 (char *)msg + off + sizeof(unsigned int),
1038 len);
1039 if(result) {
1040 req->result = result;
1041 next_state = SMB_CLOSE;
1042 break;
1043 }
1044 }
1045 data->req.offset += len;
1046 next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
1047 break;
1048
1049 case SMB_UPLOAD:
1050 if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
1051 req->result = CURLE_UPLOAD_FAILED;
1052 next_state = SMB_CLOSE;
1053 break;
1054 }
1055 len = Curl_read16_le(((const unsigned char *) msg) +
1056 sizeof(struct smb_header) + 5);
1057 data->req.bytecount += len;
1058 data->req.offset += len;
1059 Curl_pgrsSetUploadCounter(data, data->req.bytecount);
1060 if(data->req.bytecount >= data->req.size)
1061 next_state = SMB_CLOSE;
1062 else
1063 next_state = SMB_UPLOAD;
1064 break;
1065
1066 case SMB_CLOSE:
1067 /* We do not care if the close failed, proceed to tree disconnect anyway */
1068 next_state = SMB_TREE_DISCONNECT;
1069 break;
1070
1071 case SMB_TREE_DISCONNECT:
1072 next_state = SMB_DONE;
1073 break;
1074
1075 default:
1076 smb_pop_message(conn);
1077 return CURLE_OK; /* ignore */
1078 }
1079
1080 smb_pop_message(conn);
1081
1082 switch(next_state) {
1083 case SMB_OPEN:
1084 result = smb_send_open(data);
1085 break;
1086
1087 case SMB_DOWNLOAD:
1088 result = smb_send_read(data);
1089 break;
1090
1091 case SMB_UPLOAD:
1092 result = smb_send_write(data);
1093 break;
1094
1095 case SMB_CLOSE:
1096 result = smb_send_close(data);
1097 break;
1098
1099 case SMB_TREE_DISCONNECT:
1100 result = smb_send_tree_disconnect(data);
1101 break;
1102
1103 case SMB_DONE:
1104 result = req->result;
1105 *done = TRUE;
1106 break;
1107
1108 default:
1109 break;
1110 }
1111
1112 if(result) {
1113 connclose(conn, "SMB: failed to send message");
1114 return result;
1115 }
1116
1117 request_state(data, next_state);
1118
1119 return CURLE_OK;
1120 }
1121
smb_disconnect(struct Curl_easy * data,struct connectdata * conn,bool dead)1122 static CURLcode smb_disconnect(struct Curl_easy *data,
1123 struct connectdata *conn, bool dead)
1124 {
1125 struct smb_conn *smbc = &conn->proto.smbc;
1126 (void) dead;
1127 (void) data;
1128 Curl_safefree(smbc->share);
1129 Curl_safefree(smbc->domain);
1130 Curl_safefree(smbc->recv_buf);
1131 Curl_safefree(smbc->send_buf);
1132 return CURLE_OK;
1133 }
1134
smb_getsock(struct Curl_easy * data,struct connectdata * conn,curl_socket_t * socks)1135 static int smb_getsock(struct Curl_easy *data,
1136 struct connectdata *conn, curl_socket_t *socks)
1137 {
1138 (void)data;
1139 socks[0] = conn->sock[FIRSTSOCKET];
1140 return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
1141 }
1142
smb_do(struct Curl_easy * data,bool * done)1143 static CURLcode smb_do(struct Curl_easy *data, bool *done)
1144 {
1145 struct connectdata *conn = data->conn;
1146 struct smb_conn *smbc = &conn->proto.smbc;
1147
1148 *done = FALSE;
1149 if(smbc->share) {
1150 return CURLE_OK;
1151 }
1152 return CURLE_URL_MALFORMAT;
1153 }
1154
smb_parse_url_path(struct Curl_easy * data,struct connectdata * conn)1155 static CURLcode smb_parse_url_path(struct Curl_easy *data,
1156 struct connectdata *conn)
1157 {
1158 struct smb_request *req = data->req.p.smb;
1159 struct smb_conn *smbc = &conn->proto.smbc;
1160 char *path;
1161 char *slash;
1162
1163 /* URL decode the path */
1164 CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
1165 REJECT_CTRL);
1166 if(result)
1167 return result;
1168
1169 /* Parse the path for the share */
1170 smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
1171 free(path);
1172 if(!smbc->share)
1173 return CURLE_OUT_OF_MEMORY;
1174
1175 slash = strchr(smbc->share, '/');
1176 if(!slash)
1177 slash = strchr(smbc->share, '\\');
1178
1179 /* The share must be present */
1180 if(!slash) {
1181 Curl_safefree(smbc->share);
1182 failf(data, "missing share in URL path for SMB");
1183 return CURLE_URL_MALFORMAT;
1184 }
1185
1186 /* Parse the path for the file path converting any forward slashes into
1187 backslashes */
1188 *slash++ = 0;
1189 req->path = slash;
1190
1191 for(; *slash; slash++) {
1192 if(*slash == '/')
1193 *slash = '\\';
1194 }
1195 return CURLE_OK;
1196 }
1197
1198 #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
1199 SIZEOF_CURL_OFF_T > 4 */
1200
