smb.c 34 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. ***************************************************************************/
  25. #include "curl_setup.h"
  26. #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
  27. #ifdef WIN32
  28. #define getpid GetCurrentProcessId
  29. #endif
  30. #include "smb.h"
  31. #include "urldata.h"
  32. #include "sendf.h"
  33. #include "multiif.h"
  34. #include "cfilters.h"
  35. #include "connect.h"
  36. #include "progress.h"
  37. #include "transfer.h"
  38. #include "vtls/vtls.h"
  39. #include "curl_ntlm_core.h"
  40. #include "escape.h"
  41. #include "curl_endian.h"
  42. /* The last #include files should be: */
  43. #include "curl_memory.h"
  44. #include "memdebug.h"
  45. /*
  46. * Definitions for SMB protocol data structures
  47. */
  48. #if defined(_MSC_VER) || defined(__ILEC400__)
  49. # define PACK
  50. # pragma pack(push)
  51. # pragma pack(1)
  52. #elif defined(__GNUC__)
  53. # define PACK __attribute__((packed))
  54. #else
  55. # define PACK
  56. #endif
  57. #define SMB_COM_CLOSE 0x04
  58. #define SMB_COM_READ_ANDX 0x2e
  59. #define SMB_COM_WRITE_ANDX 0x2f
  60. #define SMB_COM_TREE_DISCONNECT 0x71
  61. #define SMB_COM_NEGOTIATE 0x72
  62. #define SMB_COM_SETUP_ANDX 0x73
  63. #define SMB_COM_TREE_CONNECT_ANDX 0x75
  64. #define SMB_COM_NT_CREATE_ANDX 0xa2
  65. #define SMB_COM_NO_ANDX_COMMAND 0xff
  66. #define SMB_WC_CLOSE 0x03
  67. #define SMB_WC_READ_ANDX 0x0c
  68. #define SMB_WC_WRITE_ANDX 0x0e
  69. #define SMB_WC_SETUP_ANDX 0x0d
  70. #define SMB_WC_TREE_CONNECT_ANDX 0x04
  71. #define SMB_WC_NT_CREATE_ANDX 0x18
  72. #define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
  73. #define SMB_FLAGS_CASELESS_PATHNAMES 0x08
  74. #define SMB_FLAGS2_UNICODE_STRINGS 0x8000
  75. #define SMB_FLAGS2_IS_LONG_NAME 0x0040
  76. #define SMB_FLAGS2_KNOWS_LONG_NAME 0x0001
  77. #define SMB_CAP_LARGE_FILES 0x08
  78. #define SMB_GENERIC_WRITE 0x40000000
  79. #define SMB_GENERIC_READ 0x80000000
  80. #define SMB_FILE_SHARE_ALL 0x07
  81. #define SMB_FILE_OPEN 0x01
  82. #define SMB_FILE_OVERWRITE_IF 0x05
  83. #define SMB_ERR_NOACCESS 0x00050001
  84. struct smb_header {
  85. unsigned char nbt_type;
  86. unsigned char nbt_flags;
  87. unsigned short nbt_length;
  88. unsigned char magic[4];
  89. unsigned char command;
  90. unsigned int status;
  91. unsigned char flags;
  92. unsigned short flags2;
  93. unsigned short pid_high;
  94. unsigned char signature[8];
  95. unsigned short pad;
  96. unsigned short tid;
  97. unsigned short pid;
  98. unsigned short uid;
  99. unsigned short mid;
  100. } PACK;
  101. struct smb_negotiate_response {
  102. struct smb_header h;
  103. unsigned char word_count;
  104. unsigned short dialect_index;
  105. unsigned char security_mode;
  106. unsigned short max_mpx_count;
  107. unsigned short max_number_vcs;
  108. unsigned int max_buffer_size;
  109. unsigned int max_raw_size;
  110. unsigned int session_key;
  111. unsigned int capabilities;
  112. unsigned int system_time_low;
  113. unsigned int system_time_high;
  114. unsigned short server_time_zone;
  115. unsigned char encryption_key_length;
  116. unsigned short byte_count;
  117. char bytes[1];
  118. } PACK;
  119. struct andx {
  120. unsigned char command;
  121. unsigned char pad;
  122. unsigned short offset;
  123. } PACK;
  124. struct smb_setup {
  125. unsigned char word_count;
  126. struct andx andx;
  127. unsigned short max_buffer_size;
  128. unsigned short max_mpx_count;
  129. unsigned short vc_number;
  130. unsigned int session_key;
  131. unsigned short lengths[2];
  132. unsigned int pad;
  133. unsigned int capabilities;
  134. unsigned short byte_count;
  135. char bytes[1024];
  136. } PACK;
  137. struct smb_tree_connect {
  138. unsigned char word_count;
  139. struct andx andx;
  140. unsigned short flags;
  141. unsigned short pw_len;
  142. unsigned short byte_count;
  143. char bytes[1024];
  144. } PACK;
  145. struct smb_nt_create {
  146. unsigned char word_count;
  147. struct andx andx;
  148. unsigned char pad;
  149. unsigned short name_length;
  150. unsigned int flags;
  151. unsigned int root_fid;
  152. unsigned int access;
  153. curl_off_t allocation_size;
  154. unsigned int ext_file_attributes;
  155. unsigned int share_access;
  156. unsigned int create_disposition;
  157. unsigned int create_options;
  158. unsigned int impersonation_level;
  159. unsigned char security_flags;
  160. unsigned short byte_count;
  161. char bytes[1024];
  162. } PACK;
  163. struct smb_nt_create_response {
  164. struct smb_header h;
  165. unsigned char word_count;
  166. struct andx andx;
  167. unsigned char op_lock_level;
  168. unsigned short fid;
  169. unsigned int create_disposition;
  170. curl_off_t create_time;
  171. curl_off_t last_access_time;
  172. curl_off_t last_write_time;
  173. curl_off_t last_change_time;
  174. unsigned int ext_file_attributes;
  175. curl_off_t allocation_size;
  176. curl_off_t end_of_file;
  177. } PACK;
  178. struct smb_read {
  179. unsigned char word_count;
  180. struct andx andx;
  181. unsigned short fid;
  182. unsigned int offset;
  183. unsigned short max_bytes;
  184. unsigned short min_bytes;
  185. unsigned int timeout;
  186. unsigned short remaining;
  187. unsigned int offset_high;
  188. unsigned short byte_count;
  189. } PACK;
  190. struct smb_write {
  191. struct smb_header h;
  192. unsigned char word_count;
  193. struct andx andx;
  194. unsigned short fid;
  195. unsigned int offset;
  196. unsigned int timeout;
  197. unsigned short write_mode;
  198. unsigned short remaining;
  199. unsigned short pad;
  200. unsigned short data_length;
  201. unsigned short data_offset;
  202. unsigned int offset_high;
  203. unsigned short byte_count;
  204. unsigned char pad2;
  205. } PACK;
  206. struct smb_close {
  207. unsigned char word_count;
  208. unsigned short fid;
  209. unsigned int last_mtime;
  210. unsigned short byte_count;
  211. } PACK;
  212. struct smb_tree_disconnect {
  213. unsigned char word_count;
  214. unsigned short byte_count;
  215. } PACK;
  216. #if defined(_MSC_VER) || defined(__ILEC400__)
  217. # pragma pack(pop)
  218. #endif
  219. /* Local API functions */
  220. static CURLcode smb_setup_connection(struct Curl_easy *data,
  221. struct connectdata *conn);
  222. static CURLcode smb_connect(struct Curl_easy *data, bool *done);
  223. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
  224. static CURLcode smb_do(struct Curl_easy *data, bool *done);
  225. static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
  226. static CURLcode smb_disconnect(struct Curl_easy *data,
  227. struct connectdata *conn, bool dead);
  228. static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
  229. curl_socket_t *socks);
  230. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  231. struct connectdata *conn);
  232. /*
  233. * SMB handler interface
  234. */
  235. const struct Curl_handler Curl_handler_smb = {
  236. "SMB", /* scheme */
  237. smb_setup_connection, /* setup_connection */
  238. smb_do, /* do_it */
  239. ZERO_NULL, /* done */
  240. ZERO_NULL, /* do_more */
  241. smb_connect, /* connect_it */
  242. smb_connection_state, /* connecting */
  243. smb_request_state, /* doing */
  244. smb_getsock, /* proto_getsock */
  245. smb_getsock, /* doing_getsock */
  246. ZERO_NULL, /* domore_getsock */
  247. ZERO_NULL, /* perform_getsock */
  248. smb_disconnect, /* disconnect */
  249. ZERO_NULL, /* readwrite */
  250. ZERO_NULL, /* connection_check */
  251. ZERO_NULL, /* attach connection */
  252. PORT_SMB, /* defport */
  253. CURLPROTO_SMB, /* protocol */
  254. CURLPROTO_SMB, /* family */
  255. PROTOPT_NONE /* flags */
  256. };
  257. #ifdef USE_SSL
  258. /*
  259. * SMBS handler interface
  260. */
  261. const struct Curl_handler Curl_handler_smbs = {
  262. "SMBS", /* scheme */
  263. smb_setup_connection, /* setup_connection */
  264. smb_do, /* do_it */
  265. ZERO_NULL, /* done */
  266. ZERO_NULL, /* do_more */
  267. smb_connect, /* connect_it */
  268. smb_connection_state, /* connecting */
  269. smb_request_state, /* doing */
  270. smb_getsock, /* proto_getsock */
  271. smb_getsock, /* doing_getsock */
  272. ZERO_NULL, /* domore_getsock */
  273. ZERO_NULL, /* perform_getsock */
  274. smb_disconnect, /* disconnect */
  275. ZERO_NULL, /* readwrite */
  276. ZERO_NULL, /* connection_check */
  277. ZERO_NULL, /* attach connection */
  278. PORT_SMBS, /* defport */
  279. CURLPROTO_SMBS, /* protocol */
  280. CURLPROTO_SMB, /* family */
  281. PROTOPT_SSL /* flags */
  282. };
  283. #endif
  284. #define MAX_PAYLOAD_SIZE 0x8000
  285. #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
  286. #define CLIENTNAME "curl"
  287. #define SERVICENAME "?????"
  288. /* Append a string to an SMB message */
  289. #define MSGCAT(str) \
  290. do { \
  291. strcpy(p, (str)); \
  292. p += strlen(str); \
  293. } while(0)
  294. /* Append a null-terminated string to an SMB message */
  295. #define MSGCATNULL(str) \
  296. do { \
  297. strcpy(p, (str)); \
  298. p += strlen(str) + 1; \
  299. } while(0)
  300. /* SMB is mostly little endian */
  301. #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
  302. defined(__OS400__)
  303. static unsigned short smb_swap16(unsigned short x)
  304. {
  305. return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
  306. }
  307. static unsigned int smb_swap32(unsigned int x)
  308. {
  309. return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
  310. ((x >> 24) & 0xff);
  311. }
  312. static curl_off_t smb_swap64(curl_off_t x)
  313. {
  314. return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
  315. smb_swap32((unsigned int) (x >> 32));
  316. }
  317. #else
  318. # define smb_swap16(x) (x)
  319. # define smb_swap32(x) (x)
  320. # define smb_swap64(x) (x)
  321. #endif
  322. /* SMB request state */
  323. enum smb_req_state {
  324. SMB_REQUESTING,
  325. SMB_TREE_CONNECT,
  326. SMB_OPEN,
  327. SMB_DOWNLOAD,
  328. SMB_UPLOAD,
  329. SMB_CLOSE,
  330. SMB_TREE_DISCONNECT,
  331. SMB_DONE
  332. };
  333. /* SMB request data */
  334. struct smb_request {
  335. enum smb_req_state state;
  336. char *path;
  337. unsigned short tid; /* Even if we connect to the same tree as another */
  338. unsigned short fid; /* request, the tid will be different */
  339. CURLcode result;
  340. };
  341. static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
  342. {
  343. struct smb_conn *smbc = &data->conn->proto.smbc;
  344. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  345. /* For debug purposes */
  346. static const char * const names[] = {
  347. "SMB_NOT_CONNECTED",
  348. "SMB_CONNECTING",
  349. "SMB_NEGOTIATE",
  350. "SMB_SETUP",
  351. "SMB_CONNECTED",
  352. /* LAST */
  353. };
  354. if(smbc->state != newstate)
  355. infof(data, "SMB conn %p state change from %s to %s",
  356. (void *)smbc, names[smbc->state], names[newstate]);
  357. #endif
  358. smbc->state = newstate;
  359. }
  360. static void request_state(struct Curl_easy *data,
  361. enum smb_req_state newstate)
  362. {
  363. struct smb_request *req = data->req.p.smb;
  364. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  365. /* For debug purposes */
  366. static const char * const names[] = {
  367. "SMB_REQUESTING",
  368. "SMB_TREE_CONNECT",
  369. "SMB_OPEN",
  370. "SMB_DOWNLOAD",
  371. "SMB_UPLOAD",
  372. "SMB_CLOSE",
  373. "SMB_TREE_DISCONNECT",
  374. "SMB_DONE",
  375. /* LAST */
  376. };
  377. if(req->state != newstate)
  378. infof(data, "SMB request %p state change from %s to %s",
  379. (void *)req, names[req->state], names[newstate]);
  380. #endif
  381. req->state = newstate;
  382. }
  383. /* this should setup things in the connection, not in the easy
  384. handle */
  385. static CURLcode smb_setup_connection(struct Curl_easy *data,
  386. struct connectdata *conn)
  387. {
  388. struct smb_request *req;
  389. /* Initialize the request state */
  390. data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
  391. if(!req)
  392. return CURLE_OUT_OF_MEMORY;
  393. /* Parse the URL path */
  394. return smb_parse_url_path(data, conn);
  395. }
  396. static CURLcode smb_connect(struct Curl_easy *data, bool *done)
  397. {
  398. struct connectdata *conn = data->conn;
  399. struct smb_conn *smbc = &conn->proto.smbc;
  400. char *slash;
  401. (void) done;
  402. /* Check we have a username and password to authenticate with */
  403. if(!data->state.aptr.user)
  404. return CURLE_LOGIN_DENIED;
  405. /* Initialize the connection state */
  406. smbc->state = SMB_CONNECTING;
  407. smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
  408. if(!smbc->recv_buf)
  409. return CURLE_OUT_OF_MEMORY;
  410. /* Multiple requests are allowed with this connection */
  411. connkeep(conn, "SMB default");
  412. /* Parse the username, domain, and password */
  413. slash = strchr(conn->user, '/');
  414. if(!slash)
  415. slash = strchr(conn->user, '\\');
  416. if(slash) {
  417. smbc->user = slash + 1;
  418. smbc->domain = strdup(conn->user);
  419. if(!smbc->domain)
  420. return CURLE_OUT_OF_MEMORY;
  421. smbc->domain[slash - conn->user] = 0;
  422. }
  423. else {
  424. smbc->user = conn->user;
  425. smbc->domain = strdup(conn->host.name);
  426. if(!smbc->domain)
  427. return CURLE_OUT_OF_MEMORY;
  428. }
  429. return CURLE_OK;
  430. }
  431. static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
  432. {
  433. struct connectdata *conn = data->conn;
  434. curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
  435. struct smb_conn *smbc = &conn->proto.smbc;
  436. char *buf = smbc->recv_buf;
  437. ssize_t bytes_read;
  438. size_t nbt_size;
  439. size_t msg_size;
  440. size_t len = MAX_MESSAGE_SIZE - smbc->got;
  441. CURLcode result;
  442. result = Curl_read(data, sockfd, buf + smbc->got, len, &bytes_read);
  443. if(result)
  444. return result;
  445. if(!bytes_read)
  446. return CURLE_OK;
  447. smbc->got += bytes_read;
  448. /* Check for a 32-bit nbt header */
  449. if(smbc->got < sizeof(unsigned int))
  450. return CURLE_OK;
  451. nbt_size = Curl_read16_be((const unsigned char *)
  452. (buf + sizeof(unsigned short))) +
  453. sizeof(unsigned int);
  454. if(smbc->got < nbt_size)
  455. return CURLE_OK;
  456. msg_size = sizeof(struct smb_header);
  457. if(nbt_size >= msg_size + 1) {
  458. /* Add the word count */
  459. msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
  460. if(nbt_size >= msg_size + sizeof(unsigned short)) {
  461. /* Add the byte count */
  462. msg_size += sizeof(unsigned short) +
  463. Curl_read16_le((const unsigned char *)&buf[msg_size]);
  464. if(nbt_size < msg_size)
  465. return CURLE_READ_ERROR;
  466. }
  467. }
  468. *msg = buf;
  469. return CURLE_OK;
  470. }
  471. static void smb_pop_message(struct connectdata *conn)
  472. {
  473. struct smb_conn *smbc = &conn->proto.smbc;
  474. smbc->got = 0;
  475. }
  476. static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
  477. unsigned char cmd, size_t len)
  478. {
  479. struct connectdata *conn = data->conn;
  480. struct smb_conn *smbc = &conn->proto.smbc;
  481. struct smb_request *req = data->req.p.smb;
  482. unsigned int pid;
  483. memset(h, 0, sizeof(*h));
  484. h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
  485. len));
  486. memcpy((char *)h->magic, "\xffSMB", 4);
  487. h->command = cmd;
  488. h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
  489. h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
  490. h->uid = smb_swap16(smbc->uid);
  491. h->tid = smb_swap16(req->tid);
  492. pid = getpid();
  493. h->pid_high = smb_swap16((unsigned short)(pid >> 16));
  494. h->pid = smb_swap16((unsigned short) pid);
  495. }
  496. static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
  497. size_t upload_size)
  498. {
  499. struct connectdata *conn = data->conn;
  500. struct smb_conn *smbc = &conn->proto.smbc;
  501. ssize_t bytes_written;
  502. CURLcode result;
  503. result = Curl_nwrite(data, FIRSTSOCKET, data->state.ulbuf,
  504. len, &bytes_written);
  505. if(result)
  506. return result;
  507. if(bytes_written != len) {
  508. smbc->send_size = len;
  509. smbc->sent = bytes_written;
  510. }
  511. smbc->upload_size = upload_size;
  512. return CURLE_OK;
  513. }
  514. static CURLcode smb_flush(struct Curl_easy *data)
  515. {
  516. struct connectdata *conn = data->conn;
  517. struct smb_conn *smbc = &conn->proto.smbc;
  518. ssize_t bytes_written;
  519. ssize_t len = smbc->send_size - smbc->sent;
  520. CURLcode result;
  521. if(!smbc->send_size)
  522. return CURLE_OK;
  523. result = Curl_nwrite(data, FIRSTSOCKET,
  524. data->state.ulbuf + smbc->sent,
  525. len, &bytes_written);
  526. if(result)
  527. return result;
  528. if(bytes_written != len)
  529. smbc->sent += bytes_written;
  530. else
  531. smbc->send_size = 0;
  532. return CURLE_OK;
  533. }
  534. static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
  535. const void *msg, size_t msg_len)
  536. {
  537. CURLcode result = Curl_get_upload_buffer(data);
  538. if(result)
  539. return result;
  540. smb_format_message(data, (struct smb_header *)data->state.ulbuf,
  541. cmd, msg_len);
  542. memcpy(data->state.ulbuf + sizeof(struct smb_header),
  543. msg, msg_len);
  544. return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
  545. }
  546. static CURLcode smb_send_negotiate(struct Curl_easy *data)
  547. {
  548. const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
  549. return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
  550. }
  551. static CURLcode smb_send_setup(struct Curl_easy *data)
  552. {
  553. struct connectdata *conn = data->conn;
  554. struct smb_conn *smbc = &conn->proto.smbc;
  555. struct smb_setup msg;
  556. char *p = msg.bytes;
  557. unsigned char lm_hash[21];
  558. unsigned char lm[24];
  559. unsigned char nt_hash[21];
  560. unsigned char nt[24];
  561. size_t byte_count = sizeof(lm) + sizeof(nt);
  562. byte_count += strlen(smbc->user) + strlen(smbc->domain);
  563. byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
  564. if(byte_count > sizeof(msg.bytes))
  565. return CURLE_FILESIZE_EXCEEDED;
  566. Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
  567. Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
  568. Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
  569. Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
  570. memset(&msg, 0, sizeof(msg));
  571. msg.word_count = SMB_WC_SETUP_ANDX;
  572. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  573. msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
  574. msg.max_mpx_count = smb_swap16(1);
  575. msg.vc_number = smb_swap16(1);
  576. msg.session_key = smb_swap32(smbc->session_key);
  577. msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
  578. msg.lengths[0] = smb_swap16(sizeof(lm));
  579. msg.lengths[1] = smb_swap16(sizeof(nt));
  580. memcpy(p, lm, sizeof(lm));
  581. p += sizeof(lm);
  582. memcpy(p, nt, sizeof(nt));
  583. p += sizeof(nt);
  584. MSGCATNULL(smbc->user);
  585. MSGCATNULL(smbc->domain);
  586. MSGCATNULL(OS);
  587. MSGCATNULL(CLIENTNAME);
  588. byte_count = p - msg.bytes;
  589. msg.byte_count = smb_swap16((unsigned short)byte_count);
  590. return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
  591. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  592. }
  593. static CURLcode smb_send_tree_connect(struct Curl_easy *data)
  594. {
  595. struct smb_tree_connect msg;
  596. struct connectdata *conn = data->conn;
  597. struct smb_conn *smbc = &conn->proto.smbc;
  598. char *p = msg.bytes;
  599. size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
  600. byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
  601. if(byte_count > sizeof(msg.bytes))
  602. return CURLE_FILESIZE_EXCEEDED;
  603. memset(&msg, 0, sizeof(msg));
  604. msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
  605. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  606. msg.pw_len = 0;
  607. MSGCAT("\\\\");
  608. MSGCAT(conn->host.name);
  609. MSGCAT("\\");
  610. MSGCATNULL(smbc->share);
  611. MSGCATNULL(SERVICENAME); /* Match any type of service */
  612. byte_count = p - msg.bytes;
  613. msg.byte_count = smb_swap16((unsigned short)byte_count);
  614. return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
  615. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  616. }
  617. static CURLcode smb_send_open(struct Curl_easy *data)
  618. {
  619. struct smb_request *req = data->req.p.smb;
  620. struct smb_nt_create msg;
  621. size_t byte_count;
  622. if((strlen(req->path) + 1) > sizeof(msg.bytes))
  623. return CURLE_FILESIZE_EXCEEDED;
  624. memset(&msg, 0, sizeof(msg));
  625. msg.word_count = SMB_WC_NT_CREATE_ANDX;
  626. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  627. byte_count = strlen(req->path);
  628. msg.name_length = smb_swap16((unsigned short)byte_count);
  629. msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
  630. if(data->state.upload) {
  631. msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
  632. msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
  633. }
  634. else {
  635. msg.access = smb_swap32(SMB_GENERIC_READ);
  636. msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
  637. }
  638. msg.byte_count = smb_swap16((unsigned short) ++byte_count);
  639. strcpy(msg.bytes, req->path);
  640. return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
  641. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  642. }
  643. static CURLcode smb_send_close(struct Curl_easy *data)
  644. {
  645. struct smb_request *req = data->req.p.smb;
  646. struct smb_close msg;
  647. memset(&msg, 0, sizeof(msg));
  648. msg.word_count = SMB_WC_CLOSE;
  649. msg.fid = smb_swap16(req->fid);
  650. return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
  651. }
  652. static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
  653. {
  654. struct smb_tree_disconnect msg;
  655. memset(&msg, 0, sizeof(msg));
  656. return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
  657. }
  658. static CURLcode smb_send_read(struct Curl_easy *data)
  659. {
  660. struct smb_request *req = data->req.p.smb;
  661. curl_off_t offset = data->req.offset;
  662. struct smb_read msg;
  663. memset(&msg, 0, sizeof(msg));
  664. msg.word_count = SMB_WC_READ_ANDX;
  665. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  666. msg.fid = smb_swap16(req->fid);
  667. msg.offset = smb_swap32((unsigned int) offset);
  668. msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
  669. msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  670. msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  671. return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
  672. }
  673. static CURLcode smb_send_write(struct Curl_easy *data)
  674. {
  675. struct smb_write *msg;
  676. struct smb_request *req = data->req.p.smb;
  677. curl_off_t offset = data->req.offset;
  678. curl_off_t upload_size = data->req.size - data->req.bytecount;
  679. CURLcode result = Curl_get_upload_buffer(data);
  680. if(result)
  681. return result;
  682. msg = (struct smb_write *)data->state.ulbuf;
  683. if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
  684. upload_size = MAX_PAYLOAD_SIZE - 1;
  685. memset(msg, 0, sizeof(*msg));
  686. msg->word_count = SMB_WC_WRITE_ANDX;
  687. msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
  688. msg->fid = smb_swap16(req->fid);
  689. msg->offset = smb_swap32((unsigned int) offset);
  690. msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
  691. msg->data_length = smb_swap16((unsigned short) upload_size);
  692. msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
  693. msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
  694. smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
  695. sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
  696. return smb_send(data, sizeof(*msg), (size_t) upload_size);
  697. }
  698. static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
  699. {
  700. struct connectdata *conn = data->conn;
  701. struct smb_conn *smbc = &conn->proto.smbc;
  702. CURLcode result;
  703. *msg = NULL; /* if it returns early */
  704. /* Check if there is data in the transfer buffer */
  705. if(!smbc->send_size && smbc->upload_size) {
  706. size_t nread = smbc->upload_size > (size_t)data->set.upload_buffer_size ?
  707. (size_t)data->set.upload_buffer_size : smbc->upload_size;
  708. data->req.upload_fromhere = data->state.ulbuf;
  709. result = Curl_fillreadbuffer(data, nread, &nread);
  710. if(result && result != CURLE_AGAIN)
  711. return result;
  712. if(!nread)
  713. return CURLE_OK;
  714. smbc->upload_size -= nread;
  715. smbc->send_size = nread;
  716. smbc->sent = 0;
  717. }
  718. /* Check if there is data to send */
  719. if(smbc->send_size) {
  720. result = smb_flush(data);
  721. if(result)
  722. return result;
  723. }
  724. /* Check if there is still data to be sent */
  725. if(smbc->send_size || smbc->upload_size)
  726. return CURLE_AGAIN;
  727. return smb_recv_message(data, msg);
  728. }
  729. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
  730. {
  731. struct connectdata *conn = data->conn;
  732. struct smb_conn *smbc = &conn->proto.smbc;
  733. struct smb_negotiate_response *nrsp;
  734. struct smb_header *h;
  735. CURLcode result;
  736. void *msg = NULL;
  737. if(smbc->state == SMB_CONNECTING) {
  738. #ifdef USE_SSL
  739. if((conn->handler->flags & PROTOPT_SSL)) {
  740. bool ssl_done = FALSE;
  741. result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
  742. if(result && result != CURLE_AGAIN)
  743. return result;
  744. if(!ssl_done)
  745. return CURLE_OK;
  746. }
  747. #endif
  748. result = smb_send_negotiate(data);
  749. if(result) {
  750. connclose(conn, "SMB: failed to send negotiate message");
  751. return result;
  752. }
  753. conn_state(data, SMB_NEGOTIATE);
  754. }
  755. /* Send the previous message and check for a response */
  756. result = smb_send_and_recv(data, &msg);
  757. if(result && result != CURLE_AGAIN) {
  758. connclose(conn, "SMB: failed to communicate");
  759. return result;
  760. }
  761. if(!msg)
  762. return CURLE_OK;
  763. h = msg;
  764. switch(smbc->state) {
  765. case SMB_NEGOTIATE:
  766. if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
  767. h->status) {
  768. connclose(conn, "SMB: negotiation failed");
  769. return CURLE_COULDNT_CONNECT;
  770. }
  771. nrsp = msg;
  772. memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
  773. smbc->session_key = smb_swap32(nrsp->session_key);
  774. result = smb_send_setup(data);
  775. if(result) {
  776. connclose(conn, "SMB: failed to send setup message");
  777. return result;
  778. }
  779. conn_state(data, SMB_SETUP);
  780. break;
  781. case SMB_SETUP:
  782. if(h->status) {
  783. connclose(conn, "SMB: authentication failed");
  784. return CURLE_LOGIN_DENIED;
  785. }
  786. smbc->uid = smb_swap16(h->uid);
  787. conn_state(data, SMB_CONNECTED);
  788. *done = true;
  789. break;
  790. default:
  791. smb_pop_message(conn);
  792. return CURLE_OK; /* ignore */
  793. }
  794. smb_pop_message(conn);
  795. return CURLE_OK;
  796. }
  797. /*
  798. * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
  799. * to Posix time. Cap the output to fit within a time_t.
  800. */
  801. static void get_posix_time(time_t *out, curl_off_t timestamp)
  802. {
  803. timestamp -= 116444736000000000;
  804. timestamp /= 10000000;
  805. #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
  806. if(timestamp > TIME_T_MAX)
  807. *out = TIME_T_MAX;
  808. else if(timestamp < TIME_T_MIN)
  809. *out = TIME_T_MIN;
  810. else
  811. #endif
  812. *out = (time_t) timestamp;
  813. }
  814. static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
  815. {
  816. struct connectdata *conn = data->conn;
  817. struct smb_request *req = data->req.p.smb;
  818. struct smb_header *h;
  819. struct smb_conn *smbc = &conn->proto.smbc;
  820. enum smb_req_state next_state = SMB_DONE;
  821. unsigned short len;
  822. unsigned short off;
  823. CURLcode result;
  824. void *msg = NULL;
  825. const struct smb_nt_create_response *smb_m;
  826. if(data->state.upload && (data->state.infilesize < 0)) {
  827. failf(data, "SMB upload needs to know the size up front");
  828. return CURLE_SEND_ERROR;
  829. }
  830. /* Start the request */
  831. if(req->state == SMB_REQUESTING) {
  832. result = smb_send_tree_connect(data);
  833. if(result) {
  834. connclose(conn, "SMB: failed to send tree connect message");
  835. return result;
  836. }
  837. request_state(data, SMB_TREE_CONNECT);
  838. }
  839. /* Send the previous message and check for a response */
  840. result = smb_send_and_recv(data, &msg);
  841. if(result && result != CURLE_AGAIN) {
  842. connclose(conn, "SMB: failed to communicate");
  843. return result;
  844. }
  845. if(!msg)
  846. return CURLE_OK;
  847. h = msg;
  848. switch(req->state) {
  849. case SMB_TREE_CONNECT:
  850. if(h->status) {
  851. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  852. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  853. req->result = CURLE_REMOTE_ACCESS_DENIED;
  854. break;
  855. }
  856. req->tid = smb_swap16(h->tid);
  857. next_state = SMB_OPEN;
  858. break;
  859. case SMB_OPEN:
  860. if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
  861. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  862. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  863. req->result = CURLE_REMOTE_ACCESS_DENIED;
  864. next_state = SMB_TREE_DISCONNECT;
  865. break;
  866. }
  867. smb_m = (const struct smb_nt_create_response*) msg;
  868. req->fid = smb_swap16(smb_m->fid);
  869. data->req.offset = 0;
  870. if(data->state.upload) {
  871. data->req.size = data->state.infilesize;
  872. Curl_pgrsSetUploadSize(data, data->req.size);
  873. next_state = SMB_UPLOAD;
  874. }
  875. else {
  876. data->req.size = smb_swap64(smb_m->end_of_file);
  877. if(data->req.size < 0) {
  878. req->result = CURLE_WEIRD_SERVER_REPLY;
  879. next_state = SMB_CLOSE;
  880. }
  881. else {
  882. Curl_pgrsSetDownloadSize(data, data->req.size);
  883. if(data->set.get_filetime)
  884. get_posix_time(&data->info.filetime, smb_m->last_change_time);
  885. next_state = SMB_DOWNLOAD;
  886. }
  887. }
  888. break;
  889. case SMB_DOWNLOAD:
  890. if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
  891. req->result = CURLE_RECV_ERROR;
  892. next_state = SMB_CLOSE;
  893. break;
  894. }
  895. len = Curl_read16_le(((const unsigned char *) msg) +
  896. sizeof(struct smb_header) + 11);
  897. off = Curl_read16_le(((const unsigned char *) msg) +
  898. sizeof(struct smb_header) + 13);
  899. if(len > 0) {
  900. if(off + sizeof(unsigned int) + len > smbc->got) {
  901. failf(data, "Invalid input packet");
  902. result = CURLE_RECV_ERROR;
  903. }
  904. else
  905. result = Curl_client_write(data, CLIENTWRITE_BODY,
  906. (char *)msg + off + sizeof(unsigned int),
  907. len);
  908. if(result) {
  909. req->result = result;
  910. next_state = SMB_CLOSE;
  911. break;
  912. }
  913. }
  914. data->req.bytecount += len;
  915. data->req.offset += len;
  916. result = Curl_pgrsSetDownloadCounter(data, data->req.bytecount);
  917. if(result) {
  918. req->result = result;
  919. next_state = SMB_CLOSE;
  920. break;
  921. }
  922. next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
  923. break;
  924. case SMB_UPLOAD:
  925. if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
  926. req->result = CURLE_UPLOAD_FAILED;
  927. next_state = SMB_CLOSE;
  928. break;
  929. }
  930. len = Curl_read16_le(((const unsigned char *) msg) +
  931. sizeof(struct smb_header) + 5);
  932. data->req.bytecount += len;
  933. data->req.offset += len;
  934. Curl_pgrsSetUploadCounter(data, data->req.bytecount);
  935. if(data->req.bytecount >= data->req.size)
  936. next_state = SMB_CLOSE;
  937. else
  938. next_state = SMB_UPLOAD;
  939. break;
  940. case SMB_CLOSE:
  941. /* We don't care if the close failed, proceed to tree disconnect anyway */
  942. next_state = SMB_TREE_DISCONNECT;
  943. break;
  944. case SMB_TREE_DISCONNECT:
  945. next_state = SMB_DONE;
  946. break;
  947. default:
  948. smb_pop_message(conn);
  949. return CURLE_OK; /* ignore */
  950. }
  951. smb_pop_message(conn);
  952. switch(next_state) {
  953. case SMB_OPEN:
  954. result = smb_send_open(data);
  955. break;
  956. case SMB_DOWNLOAD:
  957. result = smb_send_read(data);
  958. break;
  959. case SMB_UPLOAD:
  960. result = smb_send_write(data);
  961. break;
  962. case SMB_CLOSE:
  963. result = smb_send_close(data);
  964. break;
  965. case SMB_TREE_DISCONNECT:
  966. result = smb_send_tree_disconnect(data);
  967. break;
  968. case SMB_DONE:
  969. result = req->result;
  970. *done = true;
  971. break;
  972. default:
  973. break;
  974. }
  975. if(result) {
  976. connclose(conn, "SMB: failed to send message");
  977. return result;
  978. }
  979. request_state(data, next_state);
  980. return CURLE_OK;
  981. }
  982. static CURLcode smb_disconnect(struct Curl_easy *data,
  983. struct connectdata *conn, bool dead)
  984. {
  985. struct smb_conn *smbc = &conn->proto.smbc;
  986. (void) dead;
  987. (void) data;
  988. Curl_safefree(smbc->share);
  989. Curl_safefree(smbc->domain);
  990. Curl_safefree(smbc->recv_buf);
  991. return CURLE_OK;
  992. }
  993. static int smb_getsock(struct Curl_easy *data,
  994. struct connectdata *conn, curl_socket_t *socks)
  995. {
  996. (void)data;
  997. socks[0] = conn->sock[FIRSTSOCKET];
  998. return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
  999. }
  1000. static CURLcode smb_do(struct Curl_easy *data, bool *done)
  1001. {
  1002. struct connectdata *conn = data->conn;
  1003. struct smb_conn *smbc = &conn->proto.smbc;
  1004. *done = FALSE;
  1005. if(smbc->share) {
  1006. return CURLE_OK;
  1007. }
  1008. return CURLE_URL_MALFORMAT;
  1009. }
  1010. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  1011. struct connectdata *conn)
  1012. {
  1013. struct smb_request *req = data->req.p.smb;
  1014. struct smb_conn *smbc = &conn->proto.smbc;
  1015. char *path;
  1016. char *slash;
  1017. /* URL decode the path */
  1018. CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
  1019. REJECT_CTRL);
  1020. if(result)
  1021. return result;
  1022. /* Parse the path for the share */
  1023. smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
  1024. free(path);
  1025. if(!smbc->share)
  1026. return CURLE_OUT_OF_MEMORY;
  1027. slash = strchr(smbc->share, '/');
  1028. if(!slash)
  1029. slash = strchr(smbc->share, '\\');
  1030. /* The share must be present */
  1031. if(!slash) {
  1032. Curl_safefree(smbc->share);
  1033. failf(data, "missing share in URL path for SMB");
  1034. return CURLE_URL_MALFORMAT;
  1035. }
  1036. /* Parse the path for the file path converting any forward slashes into
  1037. backslashes */
  1038. *slash++ = 0;
  1039. req->path = slash;
  1040. for(; *slash; slash++) {
  1041. if(*slash == '/')
  1042. *slash = '\\';
  1043. }
  1044. return CURLE_OK;
  1045. }
  1046. #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
  1047. SIZEOF_CURL_OFF_T > 4 */