smb.c 33 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. ***************************************************************************/
  25. #include "curl_setup.h"
  26. #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
  27. #ifdef _WIN32
  28. #define getpid GetCurrentProcessId
  29. #endif
  30. #include "smb.h"
  31. #include "urldata.h"
  32. #include "sendf.h"
  33. #include "multiif.h"
  34. #include "cfilters.h"
  35. #include "connect.h"
  36. #include "progress.h"
  37. #include "transfer.h"
  38. #include "vtls/vtls.h"
  39. #include "curl_ntlm_core.h"
  40. #include "escape.h"
  41. #include "curl_endian.h"
  42. /* The last #include files should be: */
  43. #include "curl_memory.h"
  44. #include "memdebug.h"
  45. /*
  46. * Definitions for SMB protocol data structures
  47. */
  48. #if defined(_MSC_VER) || defined(__ILEC400__)
  49. # define PACK
  50. # pragma pack(push)
  51. # pragma pack(1)
  52. #elif defined(__GNUC__)
  53. # define PACK __attribute__((packed))
  54. #else
  55. # define PACK
  56. #endif
  57. #define SMB_COM_CLOSE 0x04
  58. #define SMB_COM_READ_ANDX 0x2e
  59. #define SMB_COM_WRITE_ANDX 0x2f
  60. #define SMB_COM_TREE_DISCONNECT 0x71
  61. #define SMB_COM_NEGOTIATE 0x72
  62. #define SMB_COM_SETUP_ANDX 0x73
  63. #define SMB_COM_TREE_CONNECT_ANDX 0x75
  64. #define SMB_COM_NT_CREATE_ANDX 0xa2
  65. #define SMB_COM_NO_ANDX_COMMAND 0xff
  66. #define SMB_WC_CLOSE 0x03
  67. #define SMB_WC_READ_ANDX 0x0c
  68. #define SMB_WC_WRITE_ANDX 0x0e
  69. #define SMB_WC_SETUP_ANDX 0x0d
  70. #define SMB_WC_TREE_CONNECT_ANDX 0x04
  71. #define SMB_WC_NT_CREATE_ANDX 0x18
  72. #define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
  73. #define SMB_FLAGS_CASELESS_PATHNAMES 0x08
  74. #define SMB_FLAGS2_UNICODE_STRINGS 0x8000
  75. #define SMB_FLAGS2_IS_LONG_NAME 0x0040
  76. #define SMB_FLAGS2_KNOWS_LONG_NAME 0x0001
  77. #define SMB_CAP_LARGE_FILES 0x08
  78. #define SMB_GENERIC_WRITE 0x40000000
  79. #define SMB_GENERIC_READ 0x80000000
  80. #define SMB_FILE_SHARE_ALL 0x07
  81. #define SMB_FILE_OPEN 0x01
  82. #define SMB_FILE_OVERWRITE_IF 0x05
  83. #define SMB_ERR_NOACCESS 0x00050001
  84. struct smb_header {
  85. unsigned char nbt_type;
  86. unsigned char nbt_flags;
  87. unsigned short nbt_length;
  88. unsigned char magic[4];
  89. unsigned char command;
  90. unsigned int status;
  91. unsigned char flags;
  92. unsigned short flags2;
  93. unsigned short pid_high;
  94. unsigned char signature[8];
  95. unsigned short pad;
  96. unsigned short tid;
  97. unsigned short pid;
  98. unsigned short uid;
  99. unsigned short mid;
  100. } PACK;
  101. struct smb_negotiate_response {
  102. struct smb_header h;
  103. unsigned char word_count;
  104. unsigned short dialect_index;
  105. unsigned char security_mode;
  106. unsigned short max_mpx_count;
  107. unsigned short max_number_vcs;
  108. unsigned int max_buffer_size;
  109. unsigned int max_raw_size;
  110. unsigned int session_key;
  111. unsigned int capabilities;
  112. unsigned int system_time_low;
  113. unsigned int system_time_high;
  114. unsigned short server_time_zone;
  115. unsigned char encryption_key_length;
  116. unsigned short byte_count;
  117. char bytes[1];
  118. } PACK;
  119. struct andx {
  120. unsigned char command;
  121. unsigned char pad;
  122. unsigned short offset;
  123. } PACK;
  124. struct smb_setup {
  125. unsigned char word_count;
  126. struct andx andx;
  127. unsigned short max_buffer_size;
  128. unsigned short max_mpx_count;
  129. unsigned short vc_number;
  130. unsigned int session_key;
  131. unsigned short lengths[2];
  132. unsigned int pad;
  133. unsigned int capabilities;
  134. unsigned short byte_count;
  135. char bytes[1024];
  136. } PACK;
  137. struct smb_tree_connect {
  138. unsigned char word_count;
  139. struct andx andx;
  140. unsigned short flags;
  141. unsigned short pw_len;
  142. unsigned short byte_count;
  143. char bytes[1024];
  144. } PACK;
  145. struct smb_nt_create {
  146. unsigned char word_count;
  147. struct andx andx;
  148. unsigned char pad;
  149. unsigned short name_length;
  150. unsigned int flags;
  151. unsigned int root_fid;
  152. unsigned int access;
  153. curl_off_t allocation_size;
  154. unsigned int ext_file_attributes;
  155. unsigned int share_access;
  156. unsigned int create_disposition;
  157. unsigned int create_options;
  158. unsigned int impersonation_level;
  159. unsigned char security_flags;
  160. unsigned short byte_count;
  161. char bytes[1024];
  162. } PACK;
  163. struct smb_nt_create_response {
  164. struct smb_header h;
  165. unsigned char word_count;
  166. struct andx andx;
  167. unsigned char op_lock_level;
  168. unsigned short fid;
  169. unsigned int create_disposition;
  170. curl_off_t create_time;
  171. curl_off_t last_access_time;
  172. curl_off_t last_write_time;
  173. curl_off_t last_change_time;
  174. unsigned int ext_file_attributes;
  175. curl_off_t allocation_size;
  176. curl_off_t end_of_file;
  177. } PACK;
  178. struct smb_read {
  179. unsigned char word_count;
  180. struct andx andx;
  181. unsigned short fid;
  182. unsigned int offset;
  183. unsigned short max_bytes;
  184. unsigned short min_bytes;
  185. unsigned int timeout;
  186. unsigned short remaining;
  187. unsigned int offset_high;
  188. unsigned short byte_count;
  189. } PACK;
  190. struct smb_write {
  191. struct smb_header h;
  192. unsigned char word_count;
  193. struct andx andx;
  194. unsigned short fid;
  195. unsigned int offset;
  196. unsigned int timeout;
  197. unsigned short write_mode;
  198. unsigned short remaining;
  199. unsigned short pad;
  200. unsigned short data_length;
  201. unsigned short data_offset;
  202. unsigned int offset_high;
  203. unsigned short byte_count;
  204. unsigned char pad2;
  205. } PACK;
  206. struct smb_close {
  207. unsigned char word_count;
  208. unsigned short fid;
  209. unsigned int last_mtime;
  210. unsigned short byte_count;
  211. } PACK;
  212. struct smb_tree_disconnect {
  213. unsigned char word_count;
  214. unsigned short byte_count;
  215. } PACK;
  216. #if defined(_MSC_VER) || defined(__ILEC400__)
  217. # pragma pack(pop)
  218. #endif
  219. /* Local API functions */
  220. static CURLcode smb_setup_connection(struct Curl_easy *data,
  221. struct connectdata *conn);
  222. static CURLcode smb_connect(struct Curl_easy *data, bool *done);
  223. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
  224. static CURLcode smb_do(struct Curl_easy *data, bool *done);
  225. static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
  226. static CURLcode smb_disconnect(struct Curl_easy *data,
  227. struct connectdata *conn, bool dead);
  228. static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
  229. curl_socket_t *socks);
  230. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  231. struct connectdata *conn);
  232. /*
  233. * SMB handler interface
  234. */
  235. const struct Curl_handler Curl_handler_smb = {
  236. "SMB", /* scheme */
  237. smb_setup_connection, /* setup_connection */
  238. smb_do, /* do_it */
  239. ZERO_NULL, /* done */
  240. ZERO_NULL, /* do_more */
  241. smb_connect, /* connect_it */
  242. smb_connection_state, /* connecting */
  243. smb_request_state, /* doing */
  244. smb_getsock, /* proto_getsock */
  245. smb_getsock, /* doing_getsock */
  246. ZERO_NULL, /* domore_getsock */
  247. ZERO_NULL, /* perform_getsock */
  248. smb_disconnect, /* disconnect */
  249. ZERO_NULL, /* readwrite */
  250. ZERO_NULL, /* connection_check */
  251. ZERO_NULL, /* attach connection */
  252. PORT_SMB, /* defport */
  253. CURLPROTO_SMB, /* protocol */
  254. CURLPROTO_SMB, /* family */
  255. PROTOPT_NONE /* flags */
  256. };
  257. #ifdef USE_SSL
  258. /*
  259. * SMBS handler interface
  260. */
  261. const struct Curl_handler Curl_handler_smbs = {
  262. "SMBS", /* scheme */
  263. smb_setup_connection, /* setup_connection */
  264. smb_do, /* do_it */
  265. ZERO_NULL, /* done */
  266. ZERO_NULL, /* do_more */
  267. smb_connect, /* connect_it */
  268. smb_connection_state, /* connecting */
  269. smb_request_state, /* doing */
  270. smb_getsock, /* proto_getsock */
  271. smb_getsock, /* doing_getsock */
  272. ZERO_NULL, /* domore_getsock */
  273. ZERO_NULL, /* perform_getsock */
  274. smb_disconnect, /* disconnect */
  275. ZERO_NULL, /* readwrite */
  276. ZERO_NULL, /* connection_check */
  277. ZERO_NULL, /* attach connection */
  278. PORT_SMBS, /* defport */
  279. CURLPROTO_SMBS, /* protocol */
  280. CURLPROTO_SMB, /* family */
  281. PROTOPT_SSL /* flags */
  282. };
  283. #endif
  284. #define MAX_PAYLOAD_SIZE 0x8000
  285. #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
  286. #define CLIENTNAME "curl"
  287. #define SERVICENAME "?????"
  288. /* Append a string to an SMB message */
  289. #define MSGCAT(str) \
  290. do { \
  291. strcpy(p, (str)); \
  292. p += strlen(str); \
  293. } while(0)
  294. /* Append a null-terminated string to an SMB message */
  295. #define MSGCATNULL(str) \
  296. do { \
  297. strcpy(p, (str)); \
  298. p += strlen(str) + 1; \
  299. } while(0)
  300. /* SMB is mostly little endian */
  301. #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
  302. defined(__OS400__)
  303. static unsigned short smb_swap16(unsigned short x)
  304. {
  305. return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
  306. }
  307. static unsigned int smb_swap32(unsigned int x)
  308. {
  309. return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
  310. ((x >> 24) & 0xff);
  311. }
  312. static curl_off_t smb_swap64(curl_off_t x)
  313. {
  314. return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
  315. smb_swap32((unsigned int) (x >> 32));
  316. }
  317. #else
  318. # define smb_swap16(x) (x)
  319. # define smb_swap32(x) (x)
  320. # define smb_swap64(x) (x)
  321. #endif
  322. /* SMB request state */
  323. enum smb_req_state {
  324. SMB_REQUESTING,
  325. SMB_TREE_CONNECT,
  326. SMB_OPEN,
  327. SMB_DOWNLOAD,
  328. SMB_UPLOAD,
  329. SMB_CLOSE,
  330. SMB_TREE_DISCONNECT,
  331. SMB_DONE
  332. };
  333. /* SMB request data */
  334. struct smb_request {
  335. enum smb_req_state state;
  336. char *path;
  337. unsigned short tid; /* Even if we connect to the same tree as another */
  338. unsigned short fid; /* request, the tid will be different */
  339. CURLcode result;
  340. };
  341. static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
  342. {
  343. struct smb_conn *smbc = &data->conn->proto.smbc;
  344. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  345. /* For debug purposes */
  346. static const char * const names[] = {
  347. "SMB_NOT_CONNECTED",
  348. "SMB_CONNECTING",
  349. "SMB_NEGOTIATE",
  350. "SMB_SETUP",
  351. "SMB_CONNECTED",
  352. /* LAST */
  353. };
  354. if(smbc->state != newstate)
  355. infof(data, "SMB conn %p state change from %s to %s",
  356. (void *)smbc, names[smbc->state], names[newstate]);
  357. #endif
  358. smbc->state = newstate;
  359. }
  360. static void request_state(struct Curl_easy *data,
  361. enum smb_req_state newstate)
  362. {
  363. struct smb_request *req = data->req.p.smb;
  364. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  365. /* For debug purposes */
  366. static const char * const names[] = {
  367. "SMB_REQUESTING",
  368. "SMB_TREE_CONNECT",
  369. "SMB_OPEN",
  370. "SMB_DOWNLOAD",
  371. "SMB_UPLOAD",
  372. "SMB_CLOSE",
  373. "SMB_TREE_DISCONNECT",
  374. "SMB_DONE",
  375. /* LAST */
  376. };
  377. if(req->state != newstate)
  378. infof(data, "SMB request %p state change from %s to %s",
  379. (void *)req, names[req->state], names[newstate]);
  380. #endif
  381. req->state = newstate;
  382. }
  383. /* this should setup things in the connection, not in the easy
  384. handle */
  385. static CURLcode smb_setup_connection(struct Curl_easy *data,
  386. struct connectdata *conn)
  387. {
  388. struct smb_request *req;
  389. /* Initialize the request state */
  390. data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
  391. if(!req)
  392. return CURLE_OUT_OF_MEMORY;
  393. /* Parse the URL path */
  394. return smb_parse_url_path(data, conn);
  395. }
  396. static CURLcode smb_connect(struct Curl_easy *data, bool *done)
  397. {
  398. struct connectdata *conn = data->conn;
  399. struct smb_conn *smbc = &conn->proto.smbc;
  400. char *slash;
  401. (void) done;
  402. /* Check we have a username and password to authenticate with */
  403. if(!data->state.aptr.user)
  404. return CURLE_LOGIN_DENIED;
  405. /* Initialize the connection state */
  406. smbc->state = SMB_CONNECTING;
  407. smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
  408. if(!smbc->recv_buf)
  409. return CURLE_OUT_OF_MEMORY;
  410. /* Multiple requests are allowed with this connection */
  411. connkeep(conn, "SMB default");
  412. /* Parse the username, domain, and password */
  413. slash = strchr(conn->user, '/');
  414. if(!slash)
  415. slash = strchr(conn->user, '\\');
  416. if(slash) {
  417. smbc->user = slash + 1;
  418. smbc->domain = strdup(conn->user);
  419. if(!smbc->domain)
  420. return CURLE_OUT_OF_MEMORY;
  421. smbc->domain[slash - conn->user] = 0;
  422. }
  423. else {
  424. smbc->user = conn->user;
  425. smbc->domain = strdup(conn->host.name);
  426. if(!smbc->domain)
  427. return CURLE_OUT_OF_MEMORY;
  428. }
  429. return CURLE_OK;
  430. }
  431. static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
  432. {
  433. struct connectdata *conn = data->conn;
  434. curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
  435. struct smb_conn *smbc = &conn->proto.smbc;
  436. char *buf = smbc->recv_buf;
  437. ssize_t bytes_read;
  438. size_t nbt_size;
  439. size_t msg_size;
  440. size_t len = MAX_MESSAGE_SIZE - smbc->got;
  441. CURLcode result;
  442. result = Curl_read(data, sockfd, buf + smbc->got, len, &bytes_read);
  443. if(result)
  444. return result;
  445. if(!bytes_read)
  446. return CURLE_OK;
  447. smbc->got += bytes_read;
  448. /* Check for a 32-bit nbt header */
  449. if(smbc->got < sizeof(unsigned int))
  450. return CURLE_OK;
  451. nbt_size = Curl_read16_be((const unsigned char *)
  452. (buf + sizeof(unsigned short))) +
  453. sizeof(unsigned int);
  454. if(smbc->got < nbt_size)
  455. return CURLE_OK;
  456. msg_size = sizeof(struct smb_header);
  457. if(nbt_size >= msg_size + 1) {
  458. /* Add the word count */
  459. msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
  460. if(nbt_size >= msg_size + sizeof(unsigned short)) {
  461. /* Add the byte count */
  462. msg_size += sizeof(unsigned short) +
  463. Curl_read16_le((const unsigned char *)&buf[msg_size]);
  464. if(nbt_size < msg_size)
  465. return CURLE_READ_ERROR;
  466. }
  467. }
  468. *msg = buf;
  469. return CURLE_OK;
  470. }
  471. static void smb_pop_message(struct connectdata *conn)
  472. {
  473. struct smb_conn *smbc = &conn->proto.smbc;
  474. smbc->got = 0;
  475. }
  476. static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
  477. unsigned char cmd, size_t len)
  478. {
  479. struct connectdata *conn = data->conn;
  480. struct smb_conn *smbc = &conn->proto.smbc;
  481. struct smb_request *req = data->req.p.smb;
  482. unsigned int pid;
  483. memset(h, 0, sizeof(*h));
  484. h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
  485. len));
  486. memcpy((char *)h->magic, "\xffSMB", 4);
  487. h->command = cmd;
  488. h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
  489. h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
  490. h->uid = smb_swap16(smbc->uid);
  491. h->tid = smb_swap16(req->tid);
  492. pid = getpid();
  493. h->pid_high = smb_swap16((unsigned short)(pid >> 16));
  494. h->pid = smb_swap16((unsigned short) pid);
  495. }
  496. static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
  497. size_t upload_size)
  498. {
  499. struct connectdata *conn = data->conn;
  500. struct smb_conn *smbc = &conn->proto.smbc;
  501. ssize_t bytes_written;
  502. CURLcode result;
  503. result = Curl_nwrite(data, FIRSTSOCKET, data->state.ulbuf,
  504. len, &bytes_written);
  505. if(result)
  506. return result;
  507. if(bytes_written != len) {
  508. smbc->send_size = len;
  509. smbc->sent = bytes_written;
  510. }
  511. smbc->upload_size = upload_size;
  512. return CURLE_OK;
  513. }
  514. static CURLcode smb_flush(struct Curl_easy *data)
  515. {
  516. struct connectdata *conn = data->conn;
  517. struct smb_conn *smbc = &conn->proto.smbc;
  518. ssize_t bytes_written;
  519. ssize_t len = smbc->send_size - smbc->sent;
  520. CURLcode result;
  521. if(!smbc->send_size)
  522. return CURLE_OK;
  523. result = Curl_nwrite(data, FIRSTSOCKET,
  524. data->state.ulbuf + smbc->sent,
  525. len, &bytes_written);
  526. if(result)
  527. return result;
  528. if(bytes_written != len)
  529. smbc->sent += bytes_written;
  530. else
  531. smbc->send_size = 0;
  532. return CURLE_OK;
  533. }
  534. static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
  535. const void *msg, size_t msg_len)
  536. {
  537. CURLcode result = Curl_get_upload_buffer(data);
  538. if(result)
  539. return result;
  540. smb_format_message(data, (struct smb_header *)data->state.ulbuf,
  541. cmd, msg_len);
  542. memcpy(data->state.ulbuf + sizeof(struct smb_header),
  543. msg, msg_len);
  544. return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
  545. }
  546. static CURLcode smb_send_negotiate(struct Curl_easy *data)
  547. {
  548. const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
  549. return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
  550. }
  551. static CURLcode smb_send_setup(struct Curl_easy *data)
  552. {
  553. struct connectdata *conn = data->conn;
  554. struct smb_conn *smbc = &conn->proto.smbc;
  555. struct smb_setup msg;
  556. char *p = msg.bytes;
  557. unsigned char lm_hash[21];
  558. unsigned char lm[24];
  559. unsigned char nt_hash[21];
  560. unsigned char nt[24];
  561. size_t byte_count = sizeof(lm) + sizeof(nt);
  562. byte_count += strlen(smbc->user) + strlen(smbc->domain);
  563. byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
  564. if(byte_count > sizeof(msg.bytes))
  565. return CURLE_FILESIZE_EXCEEDED;
  566. Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
  567. Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
  568. Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
  569. Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
  570. memset(&msg, 0, sizeof(msg));
  571. msg.word_count = SMB_WC_SETUP_ANDX;
  572. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  573. msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
  574. msg.max_mpx_count = smb_swap16(1);
  575. msg.vc_number = smb_swap16(1);
  576. msg.session_key = smb_swap32(smbc->session_key);
  577. msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
  578. msg.lengths[0] = smb_swap16(sizeof(lm));
  579. msg.lengths[1] = smb_swap16(sizeof(nt));
  580. memcpy(p, lm, sizeof(lm));
  581. p += sizeof(lm);
  582. memcpy(p, nt, sizeof(nt));
  583. p += sizeof(nt);
  584. MSGCATNULL(smbc->user);
  585. MSGCATNULL(smbc->domain);
  586. MSGCATNULL(OS);
  587. MSGCATNULL(CLIENTNAME);
  588. byte_count = p - msg.bytes;
  589. msg.byte_count = smb_swap16((unsigned short)byte_count);
  590. return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
  591. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  592. }
  593. static CURLcode smb_send_tree_connect(struct Curl_easy *data)
  594. {
  595. struct smb_tree_connect msg;
  596. struct connectdata *conn = data->conn;
  597. struct smb_conn *smbc = &conn->proto.smbc;
  598. char *p = msg.bytes;
  599. size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
  600. byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
  601. if(byte_count > sizeof(msg.bytes))
  602. return CURLE_FILESIZE_EXCEEDED;
  603. memset(&msg, 0, sizeof(msg));
  604. msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
  605. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  606. msg.pw_len = 0;
  607. MSGCAT("\\\\");
  608. MSGCAT(conn->host.name);
  609. MSGCAT("\\");
  610. MSGCATNULL(smbc->share);
  611. MSGCATNULL(SERVICENAME); /* Match any type of service */
  612. byte_count = p - msg.bytes;
  613. msg.byte_count = smb_swap16((unsigned short)byte_count);
  614. return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
  615. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  616. }
  617. static CURLcode smb_send_open(struct Curl_easy *data)
  618. {
  619. struct smb_request *req = data->req.p.smb;
  620. struct smb_nt_create msg;
  621. size_t byte_count;
  622. if((strlen(req->path) + 1) > sizeof(msg.bytes))
  623. return CURLE_FILESIZE_EXCEEDED;
  624. memset(&msg, 0, sizeof(msg));
  625. msg.word_count = SMB_WC_NT_CREATE_ANDX;
  626. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  627. byte_count = strlen(req->path);
  628. msg.name_length = smb_swap16((unsigned short)byte_count);
  629. msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
  630. if(data->state.upload) {
  631. msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
  632. msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
  633. }
  634. else {
  635. msg.access = smb_swap32(SMB_GENERIC_READ);
  636. msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
  637. }
  638. msg.byte_count = smb_swap16((unsigned short) ++byte_count);
  639. strcpy(msg.bytes, req->path);
  640. return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
  641. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  642. }
  643. static CURLcode smb_send_close(struct Curl_easy *data)
  644. {
  645. struct smb_request *req = data->req.p.smb;
  646. struct smb_close msg;
  647. memset(&msg, 0, sizeof(msg));
  648. msg.word_count = SMB_WC_CLOSE;
  649. msg.fid = smb_swap16(req->fid);
  650. return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
  651. }
  652. static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
  653. {
  654. struct smb_tree_disconnect msg;
  655. memset(&msg, 0, sizeof(msg));
  656. return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
  657. }
  658. static CURLcode smb_send_read(struct Curl_easy *data)
  659. {
  660. struct smb_request *req = data->req.p.smb;
  661. curl_off_t offset = data->req.offset;
  662. struct smb_read msg;
  663. memset(&msg, 0, sizeof(msg));
  664. msg.word_count = SMB_WC_READ_ANDX;
  665. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  666. msg.fid = smb_swap16(req->fid);
  667. msg.offset = smb_swap32((unsigned int) offset);
  668. msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
  669. msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  670. msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  671. return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
  672. }
  673. static CURLcode smb_send_write(struct Curl_easy *data)
  674. {
  675. struct smb_write *msg;
  676. struct smb_request *req = data->req.p.smb;
  677. curl_off_t offset = data->req.offset;
  678. curl_off_t upload_size = data->req.size - data->req.bytecount;
  679. CURLcode result = Curl_get_upload_buffer(data);
  680. if(result)
  681. return result;
  682. msg = (struct smb_write *)data->state.ulbuf;
  683. if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
  684. upload_size = MAX_PAYLOAD_SIZE - 1;
  685. memset(msg, 0, sizeof(*msg));
  686. msg->word_count = SMB_WC_WRITE_ANDX;
  687. msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
  688. msg->fid = smb_swap16(req->fid);
  689. msg->offset = smb_swap32((unsigned int) offset);
  690. msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
  691. msg->data_length = smb_swap16((unsigned short) upload_size);
  692. msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
  693. msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
  694. smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
  695. sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
  696. return smb_send(data, sizeof(*msg), (size_t) upload_size);
  697. }
  698. static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
  699. {
  700. struct connectdata *conn = data->conn;
  701. struct smb_conn *smbc = &conn->proto.smbc;
  702. CURLcode result;
  703. *msg = NULL; /* if it returns early */
  704. /* Check if there is data in the transfer buffer */
  705. if(!smbc->send_size && smbc->upload_size) {
  706. size_t nread = smbc->upload_size > (size_t)data->set.upload_buffer_size ?
  707. (size_t)data->set.upload_buffer_size : smbc->upload_size;
  708. data->req.upload_fromhere = data->state.ulbuf;
  709. result = Curl_fillreadbuffer(data, nread, &nread);
  710. if(result && result != CURLE_AGAIN)
  711. return result;
  712. if(!nread)
  713. return CURLE_OK;
  714. smbc->upload_size -= nread;
  715. smbc->send_size = nread;
  716. smbc->sent = 0;
  717. }
  718. /* Check if there is data to send */
  719. if(smbc->send_size) {
  720. result = smb_flush(data);
  721. if(result)
  722. return result;
  723. }
  724. /* Check if there is still data to be sent */
  725. if(smbc->send_size || smbc->upload_size)
  726. return CURLE_AGAIN;
  727. return smb_recv_message(data, msg);
  728. }
  729. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
  730. {
  731. struct connectdata *conn = data->conn;
  732. struct smb_conn *smbc = &conn->proto.smbc;
  733. struct smb_negotiate_response *nrsp;
  734. struct smb_header *h;
  735. CURLcode result;
  736. void *msg = NULL;
  737. if(smbc->state == SMB_CONNECTING) {
  738. #ifdef USE_SSL
  739. if((conn->handler->flags & PROTOPT_SSL)) {
  740. bool ssl_done = FALSE;
  741. result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
  742. if(result && result != CURLE_AGAIN)
  743. return result;
  744. if(!ssl_done)
  745. return CURLE_OK;
  746. }
  747. #endif
  748. result = smb_send_negotiate(data);
  749. if(result) {
  750. connclose(conn, "SMB: failed to send negotiate message");
  751. return result;
  752. }
  753. conn_state(data, SMB_NEGOTIATE);
  754. }
  755. /* Send the previous message and check for a response */
  756. result = smb_send_and_recv(data, &msg);
  757. if(result && result != CURLE_AGAIN) {
  758. connclose(conn, "SMB: failed to communicate");
  759. return result;
  760. }
  761. if(!msg)
  762. return CURLE_OK;
  763. h = msg;
  764. switch(smbc->state) {
  765. case SMB_NEGOTIATE:
  766. if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
  767. h->status) {
  768. connclose(conn, "SMB: negotiation failed");
  769. return CURLE_COULDNT_CONNECT;
  770. }
  771. nrsp = msg;
  772. memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
  773. smbc->session_key = smb_swap32(nrsp->session_key);
  774. result = smb_send_setup(data);
  775. if(result) {
  776. connclose(conn, "SMB: failed to send setup message");
  777. return result;
  778. }
  779. conn_state(data, SMB_SETUP);
  780. break;
  781. case SMB_SETUP:
  782. if(h->status) {
  783. connclose(conn, "SMB: authentication failed");
  784. return CURLE_LOGIN_DENIED;
  785. }
  786. smbc->uid = smb_swap16(h->uid);
  787. conn_state(data, SMB_CONNECTED);
  788. *done = true;
  789. break;
  790. default:
  791. smb_pop_message(conn);
  792. return CURLE_OK; /* ignore */
  793. }
  794. smb_pop_message(conn);
  795. return CURLE_OK;
  796. }
  797. /*
  798. * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
  799. * to Posix time. Cap the output to fit within a time_t.
  800. */
  801. static void get_posix_time(time_t *out, curl_off_t timestamp)
  802. {
  803. timestamp -= 116444736000000000;
  804. timestamp /= 10000000;
  805. #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
  806. if(timestamp > TIME_T_MAX)
  807. *out = TIME_T_MAX;
  808. else if(timestamp < TIME_T_MIN)
  809. *out = TIME_T_MIN;
  810. else
  811. #endif
  812. *out = (time_t) timestamp;
  813. }
  814. static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
  815. {
  816. struct connectdata *conn = data->conn;
  817. struct smb_request *req = data->req.p.smb;
  818. struct smb_header *h;
  819. struct smb_conn *smbc = &conn->proto.smbc;
  820. enum smb_req_state next_state = SMB_DONE;
  821. unsigned short len;
  822. unsigned short off;
  823. CURLcode result;
  824. void *msg = NULL;
  825. const struct smb_nt_create_response *smb_m;
  826. if(data->state.upload && (data->state.infilesize < 0)) {
  827. failf(data, "SMB upload needs to know the size up front");
  828. return CURLE_SEND_ERROR;
  829. }
  830. /* Start the request */
  831. if(req->state == SMB_REQUESTING) {
  832. result = smb_send_tree_connect(data);
  833. if(result) {
  834. connclose(conn, "SMB: failed to send tree connect message");
  835. return result;
  836. }
  837. request_state(data, SMB_TREE_CONNECT);
  838. }
  839. /* Send the previous message and check for a response */
  840. result = smb_send_and_recv(data, &msg);
  841. if(result && result != CURLE_AGAIN) {
  842. connclose(conn, "SMB: failed to communicate");
  843. return result;
  844. }
  845. if(!msg)
  846. return CURLE_OK;
  847. h = msg;
  848. switch(req->state) {
  849. case SMB_TREE_CONNECT:
  850. if(h->status) {
  851. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  852. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  853. req->result = CURLE_REMOTE_ACCESS_DENIED;
  854. break;
  855. }
  856. req->tid = smb_swap16(h->tid);
  857. next_state = SMB_OPEN;
  858. break;
  859. case SMB_OPEN:
  860. if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
  861. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  862. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  863. req->result = CURLE_REMOTE_ACCESS_DENIED;
  864. next_state = SMB_TREE_DISCONNECT;
  865. break;
  866. }
  867. smb_m = (const struct smb_nt_create_response*) msg;
  868. req->fid = smb_swap16(smb_m->fid);
  869. data->req.offset = 0;
  870. if(data->state.upload) {
  871. data->req.size = data->state.infilesize;
  872. Curl_pgrsSetUploadSize(data, data->req.size);
  873. next_state = SMB_UPLOAD;
  874. }
  875. else {
  876. data->req.size = smb_swap64(smb_m->end_of_file);
  877. if(data->req.size < 0) {
  878. req->result = CURLE_WEIRD_SERVER_REPLY;
  879. next_state = SMB_CLOSE;
  880. }
  881. else {
  882. Curl_pgrsSetDownloadSize(data, data->req.size);
  883. if(data->set.get_filetime)
  884. get_posix_time(&data->info.filetime, smb_m->last_change_time);
  885. next_state = SMB_DOWNLOAD;
  886. }
  887. }
  888. break;
  889. case SMB_DOWNLOAD:
  890. if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
  891. req->result = CURLE_RECV_ERROR;
  892. next_state = SMB_CLOSE;
  893. break;
  894. }
  895. len = Curl_read16_le(((const unsigned char *) msg) +
  896. sizeof(struct smb_header) + 11);
  897. off = Curl_read16_le(((const unsigned char *) msg) +
  898. sizeof(struct smb_header) + 13);
  899. if(len > 0) {
  900. if(off + sizeof(unsigned int) + len > smbc->got) {
  901. failf(data, "Invalid input packet");
  902. result = CURLE_RECV_ERROR;
  903. }
  904. else
  905. result = Curl_client_write(data, CLIENTWRITE_BODY,
  906. (char *)msg + off + sizeof(unsigned int),
  907. len);
  908. if(result) {
  909. req->result = result;
  910. next_state = SMB_CLOSE;
  911. break;
  912. }
  913. }
  914. data->req.offset += len;
  915. next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
  916. break;
  917. case SMB_UPLOAD:
  918. if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
  919. req->result = CURLE_UPLOAD_FAILED;
  920. next_state = SMB_CLOSE;
  921. break;
  922. }
  923. len = Curl_read16_le(((const unsigned char *) msg) +
  924. sizeof(struct smb_header) + 5);
  925. data->req.bytecount += len;
  926. data->req.offset += len;
  927. Curl_pgrsSetUploadCounter(data, data->req.bytecount);
  928. if(data->req.bytecount >= data->req.size)
  929. next_state = SMB_CLOSE;
  930. else
  931. next_state = SMB_UPLOAD;
  932. break;
  933. case SMB_CLOSE:
  934. /* We don't care if the close failed, proceed to tree disconnect anyway */
  935. next_state = SMB_TREE_DISCONNECT;
  936. break;
  937. case SMB_TREE_DISCONNECT:
  938. next_state = SMB_DONE;
  939. break;
  940. default:
  941. smb_pop_message(conn);
  942. return CURLE_OK; /* ignore */
  943. }
  944. smb_pop_message(conn);
  945. switch(next_state) {
  946. case SMB_OPEN:
  947. result = smb_send_open(data);
  948. break;
  949. case SMB_DOWNLOAD:
  950. result = smb_send_read(data);
  951. break;
  952. case SMB_UPLOAD:
  953. result = smb_send_write(data);
  954. break;
  955. case SMB_CLOSE:
  956. result = smb_send_close(data);
  957. break;
  958. case SMB_TREE_DISCONNECT:
  959. result = smb_send_tree_disconnect(data);
  960. break;
  961. case SMB_DONE:
  962. result = req->result;
  963. *done = true;
  964. break;
  965. default:
  966. break;
  967. }
  968. if(result) {
  969. connclose(conn, "SMB: failed to send message");
  970. return result;
  971. }
  972. request_state(data, next_state);
  973. return CURLE_OK;
  974. }
  975. static CURLcode smb_disconnect(struct Curl_easy *data,
  976. struct connectdata *conn, bool dead)
  977. {
  978. struct smb_conn *smbc = &conn->proto.smbc;
  979. (void) dead;
  980. (void) data;
  981. Curl_safefree(smbc->share);
  982. Curl_safefree(smbc->domain);
  983. Curl_safefree(smbc->recv_buf);
  984. return CURLE_OK;
  985. }
  986. static int smb_getsock(struct Curl_easy *data,
  987. struct connectdata *conn, curl_socket_t *socks)
  988. {
  989. (void)data;
  990. socks[0] = conn->sock[FIRSTSOCKET];
  991. return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
  992. }
  993. static CURLcode smb_do(struct Curl_easy *data, bool *done)
  994. {
  995. struct connectdata *conn = data->conn;
  996. struct smb_conn *smbc = &conn->proto.smbc;
  997. *done = FALSE;
  998. if(smbc->share) {
  999. return CURLE_OK;
  1000. }
  1001. return CURLE_URL_MALFORMAT;
  1002. }
  1003. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  1004. struct connectdata *conn)
  1005. {
  1006. struct smb_request *req = data->req.p.smb;
  1007. struct smb_conn *smbc = &conn->proto.smbc;
  1008. char *path;
  1009. char *slash;
  1010. /* URL decode the path */
  1011. CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
  1012. REJECT_CTRL);
  1013. if(result)
  1014. return result;
  1015. /* Parse the path for the share */
  1016. smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
  1017. free(path);
  1018. if(!smbc->share)
  1019. return CURLE_OUT_OF_MEMORY;
  1020. slash = strchr(smbc->share, '/');
  1021. if(!slash)
  1022. slash = strchr(smbc->share, '\\');
  1023. /* The share must be present */
  1024. if(!slash) {
  1025. Curl_safefree(smbc->share);
  1026. failf(data, "missing share in URL path for SMB");
  1027. return CURLE_URL_MALFORMAT;
  1028. }
  1029. /* Parse the path for the file path converting any forward slashes into
  1030. backslashes */
  1031. *slash++ = 0;
  1032. req->path = slash;
  1033. for(; *slash; slash++) {
  1034. if(*slash == '/')
  1035. *slash = '\\';
  1036. }
  1037. return CURLE_OK;
  1038. }
  1039. #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
  1040. SIZEOF_CURL_OFF_T > 4 */