2
0

smb.c 34 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. ***************************************************************************/
  25. #include "curl_setup.h"
  26. #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
  27. #ifdef WIN32
  28. #define getpid GetCurrentProcessId
  29. #endif
  30. #include "smb.h"
  31. #include "urldata.h"
  32. #include "sendf.h"
  33. #include "multiif.h"
  34. #include "cfilters.h"
  35. #include "connect.h"
  36. #include "progress.h"
  37. #include "transfer.h"
  38. #include "vtls/vtls.h"
  39. #include "curl_ntlm_core.h"
  40. #include "escape.h"
  41. #include "curl_endian.h"
  42. /* The last #include files should be: */
  43. #include "curl_memory.h"
  44. #include "memdebug.h"
  45. /*
  46. * Definitions for SMB protocol data structures
  47. */
  48. #if defined(_MSC_VER) || defined(__ILEC400__)
  49. # define PACK
  50. # pragma pack(push)
  51. # pragma pack(1)
  52. #elif defined(__GNUC__)
  53. # define PACK __attribute__((packed))
  54. #else
  55. # define PACK
  56. #endif
  57. #define SMB_COM_CLOSE 0x04
  58. #define SMB_COM_READ_ANDX 0x2e
  59. #define SMB_COM_WRITE_ANDX 0x2f
  60. #define SMB_COM_TREE_DISCONNECT 0x71
  61. #define SMB_COM_NEGOTIATE 0x72
  62. #define SMB_COM_SETUP_ANDX 0x73
  63. #define SMB_COM_TREE_CONNECT_ANDX 0x75
  64. #define SMB_COM_NT_CREATE_ANDX 0xa2
  65. #define SMB_COM_NO_ANDX_COMMAND 0xff
  66. #define SMB_WC_CLOSE 0x03
  67. #define SMB_WC_READ_ANDX 0x0c
  68. #define SMB_WC_WRITE_ANDX 0x0e
  69. #define SMB_WC_SETUP_ANDX 0x0d
  70. #define SMB_WC_TREE_CONNECT_ANDX 0x04
  71. #define SMB_WC_NT_CREATE_ANDX 0x18
  72. #define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
  73. #define SMB_FLAGS_CASELESS_PATHNAMES 0x08
  74. #define SMB_FLAGS2_UNICODE_STRINGS 0x8000
  75. #define SMB_FLAGS2_IS_LONG_NAME 0x0040
  76. #define SMB_FLAGS2_KNOWS_LONG_NAME 0x0001
  77. #define SMB_CAP_LARGE_FILES 0x08
  78. #define SMB_GENERIC_WRITE 0x40000000
  79. #define SMB_GENERIC_READ 0x80000000
  80. #define SMB_FILE_SHARE_ALL 0x07
  81. #define SMB_FILE_OPEN 0x01
  82. #define SMB_FILE_OVERWRITE_IF 0x05
  83. #define SMB_ERR_NOACCESS 0x00050001
  84. struct smb_header {
  85. unsigned char nbt_type;
  86. unsigned char nbt_flags;
  87. unsigned short nbt_length;
  88. unsigned char magic[4];
  89. unsigned char command;
  90. unsigned int status;
  91. unsigned char flags;
  92. unsigned short flags2;
  93. unsigned short pid_high;
  94. unsigned char signature[8];
  95. unsigned short pad;
  96. unsigned short tid;
  97. unsigned short pid;
  98. unsigned short uid;
  99. unsigned short mid;
  100. } PACK;
  101. struct smb_negotiate_response {
  102. struct smb_header h;
  103. unsigned char word_count;
  104. unsigned short dialect_index;
  105. unsigned char security_mode;
  106. unsigned short max_mpx_count;
  107. unsigned short max_number_vcs;
  108. unsigned int max_buffer_size;
  109. unsigned int max_raw_size;
  110. unsigned int session_key;
  111. unsigned int capabilities;
  112. unsigned int system_time_low;
  113. unsigned int system_time_high;
  114. unsigned short server_time_zone;
  115. unsigned char encryption_key_length;
  116. unsigned short byte_count;
  117. char bytes[1];
  118. } PACK;
  119. struct andx {
  120. unsigned char command;
  121. unsigned char pad;
  122. unsigned short offset;
  123. } PACK;
  124. struct smb_setup {
  125. unsigned char word_count;
  126. struct andx andx;
  127. unsigned short max_buffer_size;
  128. unsigned short max_mpx_count;
  129. unsigned short vc_number;
  130. unsigned int session_key;
  131. unsigned short lengths[2];
  132. unsigned int pad;
  133. unsigned int capabilities;
  134. unsigned short byte_count;
  135. char bytes[1024];
  136. } PACK;
  137. struct smb_tree_connect {
  138. unsigned char word_count;
  139. struct andx andx;
  140. unsigned short flags;
  141. unsigned short pw_len;
  142. unsigned short byte_count;
  143. char bytes[1024];
  144. } PACK;
  145. struct smb_nt_create {
  146. unsigned char word_count;
  147. struct andx andx;
  148. unsigned char pad;
  149. unsigned short name_length;
  150. unsigned int flags;
  151. unsigned int root_fid;
  152. unsigned int access;
  153. curl_off_t allocation_size;
  154. unsigned int ext_file_attributes;
  155. unsigned int share_access;
  156. unsigned int create_disposition;
  157. unsigned int create_options;
  158. unsigned int impersonation_level;
  159. unsigned char security_flags;
  160. unsigned short byte_count;
  161. char bytes[1024];
  162. } PACK;
  163. struct smb_nt_create_response {
  164. struct smb_header h;
  165. unsigned char word_count;
  166. struct andx andx;
  167. unsigned char op_lock_level;
  168. unsigned short fid;
  169. unsigned int create_disposition;
  170. curl_off_t create_time;
  171. curl_off_t last_access_time;
  172. curl_off_t last_write_time;
  173. curl_off_t last_change_time;
  174. unsigned int ext_file_attributes;
  175. curl_off_t allocation_size;
  176. curl_off_t end_of_file;
  177. } PACK;
  178. struct smb_read {
  179. unsigned char word_count;
  180. struct andx andx;
  181. unsigned short fid;
  182. unsigned int offset;
  183. unsigned short max_bytes;
  184. unsigned short min_bytes;
  185. unsigned int timeout;
  186. unsigned short remaining;
  187. unsigned int offset_high;
  188. unsigned short byte_count;
  189. } PACK;
  190. struct smb_write {
  191. struct smb_header h;
  192. unsigned char word_count;
  193. struct andx andx;
  194. unsigned short fid;
  195. unsigned int offset;
  196. unsigned int timeout;
  197. unsigned short write_mode;
  198. unsigned short remaining;
  199. unsigned short pad;
  200. unsigned short data_length;
  201. unsigned short data_offset;
  202. unsigned int offset_high;
  203. unsigned short byte_count;
  204. unsigned char pad2;
  205. } PACK;
  206. struct smb_close {
  207. unsigned char word_count;
  208. unsigned short fid;
  209. unsigned int last_mtime;
  210. unsigned short byte_count;
  211. } PACK;
  212. struct smb_tree_disconnect {
  213. unsigned char word_count;
  214. unsigned short byte_count;
  215. } PACK;
  216. #if defined(_MSC_VER) || defined(__ILEC400__)
  217. # pragma pack(pop)
  218. #endif
  219. /* Local API functions */
  220. static CURLcode smb_setup_connection(struct Curl_easy *data,
  221. struct connectdata *conn);
  222. static CURLcode smb_connect(struct Curl_easy *data, bool *done);
  223. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
  224. static CURLcode smb_do(struct Curl_easy *data, bool *done);
  225. static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
  226. static CURLcode smb_disconnect(struct Curl_easy *data,
  227. struct connectdata *conn, bool dead);
  228. static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
  229. curl_socket_t *socks);
  230. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  231. struct connectdata *conn);
  232. /*
  233. * SMB handler interface
  234. */
  235. const struct Curl_handler Curl_handler_smb = {
  236. "SMB", /* scheme */
  237. smb_setup_connection, /* setup_connection */
  238. smb_do, /* do_it */
  239. ZERO_NULL, /* done */
  240. ZERO_NULL, /* do_more */
  241. smb_connect, /* connect_it */
  242. smb_connection_state, /* connecting */
  243. smb_request_state, /* doing */
  244. smb_getsock, /* proto_getsock */
  245. smb_getsock, /* doing_getsock */
  246. ZERO_NULL, /* domore_getsock */
  247. ZERO_NULL, /* perform_getsock */
  248. smb_disconnect, /* disconnect */
  249. ZERO_NULL, /* readwrite */
  250. ZERO_NULL, /* connection_check */
  251. ZERO_NULL, /* attach connection */
  252. PORT_SMB, /* defport */
  253. CURLPROTO_SMB, /* protocol */
  254. CURLPROTO_SMB, /* family */
  255. PROTOPT_NONE /* flags */
  256. };
  257. #ifdef USE_SSL
  258. /*
  259. * SMBS handler interface
  260. */
  261. const struct Curl_handler Curl_handler_smbs = {
  262. "SMBS", /* scheme */
  263. smb_setup_connection, /* setup_connection */
  264. smb_do, /* do_it */
  265. ZERO_NULL, /* done */
  266. ZERO_NULL, /* do_more */
  267. smb_connect, /* connect_it */
  268. smb_connection_state, /* connecting */
  269. smb_request_state, /* doing */
  270. smb_getsock, /* proto_getsock */
  271. smb_getsock, /* doing_getsock */
  272. ZERO_NULL, /* domore_getsock */
  273. ZERO_NULL, /* perform_getsock */
  274. smb_disconnect, /* disconnect */
  275. ZERO_NULL, /* readwrite */
  276. ZERO_NULL, /* connection_check */
  277. ZERO_NULL, /* attach connection */
  278. PORT_SMBS, /* defport */
  279. CURLPROTO_SMBS, /* protocol */
  280. CURLPROTO_SMB, /* family */
  281. PROTOPT_SSL /* flags */
  282. };
  283. #endif
  284. #define MAX_PAYLOAD_SIZE 0x8000
  285. #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
  286. #define CLIENTNAME "curl"
  287. #define SERVICENAME "?????"
  288. /* Append a string to an SMB message */
  289. #define MSGCAT(str) \
  290. do { \
  291. strcpy(p, (str)); \
  292. p += strlen(str); \
  293. } while(0)
  294. /* Append a null-terminated string to an SMB message */
  295. #define MSGCATNULL(str) \
  296. do { \
  297. strcpy(p, (str)); \
  298. p += strlen(str) + 1; \
  299. } while(0)
  300. /* SMB is mostly little endian */
  301. #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
  302. defined(__OS400__)
  303. static unsigned short smb_swap16(unsigned short x)
  304. {
  305. return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
  306. }
  307. static unsigned int smb_swap32(unsigned int x)
  308. {
  309. return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
  310. ((x >> 24) & 0xff);
  311. }
  312. static curl_off_t smb_swap64(curl_off_t x)
  313. {
  314. return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
  315. smb_swap32((unsigned int) (x >> 32));
  316. }
  317. #else
  318. # define smb_swap16(x) (x)
  319. # define smb_swap32(x) (x)
  320. # define smb_swap64(x) (x)
  321. #endif
  322. /* SMB request state */
  323. enum smb_req_state {
  324. SMB_REQUESTING,
  325. SMB_TREE_CONNECT,
  326. SMB_OPEN,
  327. SMB_DOWNLOAD,
  328. SMB_UPLOAD,
  329. SMB_CLOSE,
  330. SMB_TREE_DISCONNECT,
  331. SMB_DONE
  332. };
  333. /* SMB request data */
  334. struct smb_request {
  335. enum smb_req_state state;
  336. char *path;
  337. unsigned short tid; /* Even if we connect to the same tree as another */
  338. unsigned short fid; /* request, the tid will be different */
  339. CURLcode result;
  340. };
  341. static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
  342. {
  343. struct smb_conn *smbc = &data->conn->proto.smbc;
  344. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  345. /* For debug purposes */
  346. static const char * const names[] = {
  347. "SMB_NOT_CONNECTED",
  348. "SMB_CONNECTING",
  349. "SMB_NEGOTIATE",
  350. "SMB_SETUP",
  351. "SMB_CONNECTED",
  352. /* LAST */
  353. };
  354. if(smbc->state != newstate)
  355. infof(data, "SMB conn %p state change from %s to %s",
  356. (void *)smbc, names[smbc->state], names[newstate]);
  357. #endif
  358. smbc->state = newstate;
  359. }
  360. static void request_state(struct Curl_easy *data,
  361. enum smb_req_state newstate)
  362. {
  363. struct smb_request *req = data->req.p.smb;
  364. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  365. /* For debug purposes */
  366. static const char * const names[] = {
  367. "SMB_REQUESTING",
  368. "SMB_TREE_CONNECT",
  369. "SMB_OPEN",
  370. "SMB_DOWNLOAD",
  371. "SMB_UPLOAD",
  372. "SMB_CLOSE",
  373. "SMB_TREE_DISCONNECT",
  374. "SMB_DONE",
  375. /* LAST */
  376. };
  377. if(req->state != newstate)
  378. infof(data, "SMB request %p state change from %s to %s",
  379. (void *)req, names[req->state], names[newstate]);
  380. #endif
  381. req->state = newstate;
  382. }
  383. /* this should setup things in the connection, not in the easy
  384. handle */
  385. static CURLcode smb_setup_connection(struct Curl_easy *data,
  386. struct connectdata *conn)
  387. {
  388. struct smb_request *req;
  389. /* Initialize the request state */
  390. data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
  391. if(!req)
  392. return CURLE_OUT_OF_MEMORY;
  393. /* Parse the URL path */
  394. return smb_parse_url_path(data, conn);
  395. }
  396. static CURLcode smb_connect(struct Curl_easy *data, bool *done)
  397. {
  398. struct connectdata *conn = data->conn;
  399. struct smb_conn *smbc = &conn->proto.smbc;
  400. char *slash;
  401. (void) done;
  402. /* Check we have a username and password to authenticate with */
  403. if(!data->state.aptr.user)
  404. return CURLE_LOGIN_DENIED;
  405. /* Initialize the connection state */
  406. smbc->state = SMB_CONNECTING;
  407. smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
  408. if(!smbc->recv_buf)
  409. return CURLE_OUT_OF_MEMORY;
  410. /* Multiple requests are allowed with this connection */
  411. connkeep(conn, "SMB default");
  412. /* Parse the username, domain, and password */
  413. slash = strchr(conn->user, '/');
  414. if(!slash)
  415. slash = strchr(conn->user, '\\');
  416. if(slash) {
  417. smbc->user = slash + 1;
  418. smbc->domain = strdup(conn->user);
  419. if(!smbc->domain)
  420. return CURLE_OUT_OF_MEMORY;
  421. smbc->domain[slash - conn->user] = 0;
  422. }
  423. else {
  424. smbc->user = conn->user;
  425. smbc->domain = strdup(conn->host.name);
  426. if(!smbc->domain)
  427. return CURLE_OUT_OF_MEMORY;
  428. }
  429. return CURLE_OK;
  430. }
  431. static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
  432. {
  433. struct connectdata *conn = data->conn;
  434. curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
  435. struct smb_conn *smbc = &conn->proto.smbc;
  436. char *buf = smbc->recv_buf;
  437. ssize_t bytes_read;
  438. size_t nbt_size;
  439. size_t msg_size;
  440. size_t len = MAX_MESSAGE_SIZE - smbc->got;
  441. CURLcode result;
  442. result = Curl_read(data, sockfd, buf + smbc->got, len, &bytes_read);
  443. if(result)
  444. return result;
  445. if(!bytes_read)
  446. return CURLE_OK;
  447. smbc->got += bytes_read;
  448. /* Check for a 32-bit nbt header */
  449. if(smbc->got < sizeof(unsigned int))
  450. return CURLE_OK;
  451. nbt_size = Curl_read16_be((const unsigned char *)
  452. (buf + sizeof(unsigned short))) +
  453. sizeof(unsigned int);
  454. if(smbc->got < nbt_size)
  455. return CURLE_OK;
  456. msg_size = sizeof(struct smb_header);
  457. if(nbt_size >= msg_size + 1) {
  458. /* Add the word count */
  459. msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
  460. if(nbt_size >= msg_size + sizeof(unsigned short)) {
  461. /* Add the byte count */
  462. msg_size += sizeof(unsigned short) +
  463. Curl_read16_le((const unsigned char *)&buf[msg_size]);
  464. if(nbt_size < msg_size)
  465. return CURLE_READ_ERROR;
  466. }
  467. }
  468. *msg = buf;
  469. return CURLE_OK;
  470. }
  471. static void smb_pop_message(struct connectdata *conn)
  472. {
  473. struct smb_conn *smbc = &conn->proto.smbc;
  474. smbc->got = 0;
  475. }
  476. static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
  477. unsigned char cmd, size_t len)
  478. {
  479. struct connectdata *conn = data->conn;
  480. struct smb_conn *smbc = &conn->proto.smbc;
  481. struct smb_request *req = data->req.p.smb;
  482. unsigned int pid;
  483. memset(h, 0, sizeof(*h));
  484. h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
  485. len));
  486. memcpy((char *)h->magic, "\xffSMB", 4);
  487. h->command = cmd;
  488. h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
  489. h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
  490. h->uid = smb_swap16(smbc->uid);
  491. h->tid = smb_swap16(req->tid);
  492. pid = getpid();
  493. h->pid_high = smb_swap16((unsigned short)(pid >> 16));
  494. h->pid = smb_swap16((unsigned short) pid);
  495. }
  496. static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
  497. size_t upload_size)
  498. {
  499. struct connectdata *conn = data->conn;
  500. curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
  501. struct smb_conn *smbc = &conn->proto.smbc;
  502. ssize_t bytes_written;
  503. CURLcode result;
  504. result = Curl_write(data, sockfd, data->state.ulbuf,
  505. len, &bytes_written);
  506. if(result)
  507. return result;
  508. if(bytes_written != len) {
  509. smbc->send_size = len;
  510. smbc->sent = bytes_written;
  511. }
  512. smbc->upload_size = upload_size;
  513. return CURLE_OK;
  514. }
  515. static CURLcode smb_flush(struct Curl_easy *data)
  516. {
  517. struct connectdata *conn = data->conn;
  518. curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
  519. struct smb_conn *smbc = &conn->proto.smbc;
  520. ssize_t bytes_written;
  521. ssize_t len = smbc->send_size - smbc->sent;
  522. CURLcode result;
  523. if(!smbc->send_size)
  524. return CURLE_OK;
  525. result = Curl_write(data, sockfd,
  526. data->state.ulbuf + smbc->sent,
  527. len, &bytes_written);
  528. if(result)
  529. return result;
  530. if(bytes_written != len)
  531. smbc->sent += bytes_written;
  532. else
  533. smbc->send_size = 0;
  534. return CURLE_OK;
  535. }
  536. static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
  537. const void *msg, size_t msg_len)
  538. {
  539. CURLcode result = Curl_get_upload_buffer(data);
  540. if(result)
  541. return result;
  542. smb_format_message(data, (struct smb_header *)data->state.ulbuf,
  543. cmd, msg_len);
  544. memcpy(data->state.ulbuf + sizeof(struct smb_header),
  545. msg, msg_len);
  546. return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
  547. }
  548. static CURLcode smb_send_negotiate(struct Curl_easy *data)
  549. {
  550. const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
  551. return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
  552. }
  553. static CURLcode smb_send_setup(struct Curl_easy *data)
  554. {
  555. struct connectdata *conn = data->conn;
  556. struct smb_conn *smbc = &conn->proto.smbc;
  557. struct smb_setup msg;
  558. char *p = msg.bytes;
  559. unsigned char lm_hash[21];
  560. unsigned char lm[24];
  561. unsigned char nt_hash[21];
  562. unsigned char nt[24];
  563. size_t byte_count = sizeof(lm) + sizeof(nt);
  564. byte_count += strlen(smbc->user) + strlen(smbc->domain);
  565. byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
  566. if(byte_count > sizeof(msg.bytes))
  567. return CURLE_FILESIZE_EXCEEDED;
  568. Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
  569. Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
  570. Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
  571. Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
  572. memset(&msg, 0, sizeof(msg));
  573. msg.word_count = SMB_WC_SETUP_ANDX;
  574. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  575. msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
  576. msg.max_mpx_count = smb_swap16(1);
  577. msg.vc_number = smb_swap16(1);
  578. msg.session_key = smb_swap32(smbc->session_key);
  579. msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
  580. msg.lengths[0] = smb_swap16(sizeof(lm));
  581. msg.lengths[1] = smb_swap16(sizeof(nt));
  582. memcpy(p, lm, sizeof(lm));
  583. p += sizeof(lm);
  584. memcpy(p, nt, sizeof(nt));
  585. p += sizeof(nt);
  586. MSGCATNULL(smbc->user);
  587. MSGCATNULL(smbc->domain);
  588. MSGCATNULL(OS);
  589. MSGCATNULL(CLIENTNAME);
  590. byte_count = p - msg.bytes;
  591. msg.byte_count = smb_swap16((unsigned short)byte_count);
  592. return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
  593. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  594. }
  595. static CURLcode smb_send_tree_connect(struct Curl_easy *data)
  596. {
  597. struct smb_tree_connect msg;
  598. struct connectdata *conn = data->conn;
  599. struct smb_conn *smbc = &conn->proto.smbc;
  600. char *p = msg.bytes;
  601. size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
  602. byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
  603. if(byte_count > sizeof(msg.bytes))
  604. return CURLE_FILESIZE_EXCEEDED;
  605. memset(&msg, 0, sizeof(msg));
  606. msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
  607. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  608. msg.pw_len = 0;
  609. MSGCAT("\\\\");
  610. MSGCAT(conn->host.name);
  611. MSGCAT("\\");
  612. MSGCATNULL(smbc->share);
  613. MSGCATNULL(SERVICENAME); /* Match any type of service */
  614. byte_count = p - msg.bytes;
  615. msg.byte_count = smb_swap16((unsigned short)byte_count);
  616. return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
  617. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  618. }
  619. static CURLcode smb_send_open(struct Curl_easy *data)
  620. {
  621. struct smb_request *req = data->req.p.smb;
  622. struct smb_nt_create msg;
  623. size_t byte_count;
  624. if((strlen(req->path) + 1) > sizeof(msg.bytes))
  625. return CURLE_FILESIZE_EXCEEDED;
  626. memset(&msg, 0, sizeof(msg));
  627. msg.word_count = SMB_WC_NT_CREATE_ANDX;
  628. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  629. byte_count = strlen(req->path);
  630. msg.name_length = smb_swap16((unsigned short)byte_count);
  631. msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
  632. if(data->state.upload) {
  633. msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
  634. msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
  635. }
  636. else {
  637. msg.access = smb_swap32(SMB_GENERIC_READ);
  638. msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
  639. }
  640. msg.byte_count = smb_swap16((unsigned short) ++byte_count);
  641. strcpy(msg.bytes, req->path);
  642. return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
  643. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  644. }
  645. static CURLcode smb_send_close(struct Curl_easy *data)
  646. {
  647. struct smb_request *req = data->req.p.smb;
  648. struct smb_close msg;
  649. memset(&msg, 0, sizeof(msg));
  650. msg.word_count = SMB_WC_CLOSE;
  651. msg.fid = smb_swap16(req->fid);
  652. return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
  653. }
  654. static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
  655. {
  656. struct smb_tree_disconnect msg;
  657. memset(&msg, 0, sizeof(msg));
  658. return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
  659. }
  660. static CURLcode smb_send_read(struct Curl_easy *data)
  661. {
  662. struct smb_request *req = data->req.p.smb;
  663. curl_off_t offset = data->req.offset;
  664. struct smb_read msg;
  665. memset(&msg, 0, sizeof(msg));
  666. msg.word_count = SMB_WC_READ_ANDX;
  667. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  668. msg.fid = smb_swap16(req->fid);
  669. msg.offset = smb_swap32((unsigned int) offset);
  670. msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
  671. msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  672. msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  673. return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
  674. }
  675. static CURLcode smb_send_write(struct Curl_easy *data)
  676. {
  677. struct smb_write *msg;
  678. struct smb_request *req = data->req.p.smb;
  679. curl_off_t offset = data->req.offset;
  680. curl_off_t upload_size = data->req.size - data->req.bytecount;
  681. CURLcode result = Curl_get_upload_buffer(data);
  682. if(result)
  683. return result;
  684. msg = (struct smb_write *)data->state.ulbuf;
  685. if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
  686. upload_size = MAX_PAYLOAD_SIZE - 1;
  687. memset(msg, 0, sizeof(*msg));
  688. msg->word_count = SMB_WC_WRITE_ANDX;
  689. msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
  690. msg->fid = smb_swap16(req->fid);
  691. msg->offset = smb_swap32((unsigned int) offset);
  692. msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
  693. msg->data_length = smb_swap16((unsigned short) upload_size);
  694. msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
  695. msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
  696. smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
  697. sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
  698. return smb_send(data, sizeof(*msg), (size_t) upload_size);
  699. }
  700. static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
  701. {
  702. struct connectdata *conn = data->conn;
  703. struct smb_conn *smbc = &conn->proto.smbc;
  704. CURLcode result;
  705. *msg = NULL; /* if it returns early */
  706. /* Check if there is data in the transfer buffer */
  707. if(!smbc->send_size && smbc->upload_size) {
  708. size_t nread = smbc->upload_size > (size_t)data->set.upload_buffer_size ?
  709. (size_t)data->set.upload_buffer_size : smbc->upload_size;
  710. data->req.upload_fromhere = data->state.ulbuf;
  711. result = Curl_fillreadbuffer(data, nread, &nread);
  712. if(result && result != CURLE_AGAIN)
  713. return result;
  714. if(!nread)
  715. return CURLE_OK;
  716. smbc->upload_size -= nread;
  717. smbc->send_size = nread;
  718. smbc->sent = 0;
  719. }
  720. /* Check if there is data to send */
  721. if(smbc->send_size) {
  722. result = smb_flush(data);
  723. if(result)
  724. return result;
  725. }
  726. /* Check if there is still data to be sent */
  727. if(smbc->send_size || smbc->upload_size)
  728. return CURLE_AGAIN;
  729. return smb_recv_message(data, msg);
  730. }
  731. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
  732. {
  733. struct connectdata *conn = data->conn;
  734. struct smb_conn *smbc = &conn->proto.smbc;
  735. struct smb_negotiate_response *nrsp;
  736. struct smb_header *h;
  737. CURLcode result;
  738. void *msg = NULL;
  739. if(smbc->state == SMB_CONNECTING) {
  740. #ifdef USE_SSL
  741. if((conn->handler->flags & PROTOPT_SSL)) {
  742. bool ssl_done = FALSE;
  743. result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
  744. if(result && result != CURLE_AGAIN)
  745. return result;
  746. if(!ssl_done)
  747. return CURLE_OK;
  748. }
  749. #endif
  750. result = smb_send_negotiate(data);
  751. if(result) {
  752. connclose(conn, "SMB: failed to send negotiate message");
  753. return result;
  754. }
  755. conn_state(data, SMB_NEGOTIATE);
  756. }
  757. /* Send the previous message and check for a response */
  758. result = smb_send_and_recv(data, &msg);
  759. if(result && result != CURLE_AGAIN) {
  760. connclose(conn, "SMB: failed to communicate");
  761. return result;
  762. }
  763. if(!msg)
  764. return CURLE_OK;
  765. h = msg;
  766. switch(smbc->state) {
  767. case SMB_NEGOTIATE:
  768. if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
  769. h->status) {
  770. connclose(conn, "SMB: negotiation failed");
  771. return CURLE_COULDNT_CONNECT;
  772. }
  773. nrsp = msg;
  774. memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
  775. smbc->session_key = smb_swap32(nrsp->session_key);
  776. result = smb_send_setup(data);
  777. if(result) {
  778. connclose(conn, "SMB: failed to send setup message");
  779. return result;
  780. }
  781. conn_state(data, SMB_SETUP);
  782. break;
  783. case SMB_SETUP:
  784. if(h->status) {
  785. connclose(conn, "SMB: authentication failed");
  786. return CURLE_LOGIN_DENIED;
  787. }
  788. smbc->uid = smb_swap16(h->uid);
  789. conn_state(data, SMB_CONNECTED);
  790. *done = true;
  791. break;
  792. default:
  793. smb_pop_message(conn);
  794. return CURLE_OK; /* ignore */
  795. }
  796. smb_pop_message(conn);
  797. return CURLE_OK;
  798. }
  799. /*
  800. * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
  801. * to Posix time. Cap the output to fit within a time_t.
  802. */
  803. static void get_posix_time(time_t *out, curl_off_t timestamp)
  804. {
  805. timestamp -= 116444736000000000;
  806. timestamp /= 10000000;
  807. #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
  808. if(timestamp > TIME_T_MAX)
  809. *out = TIME_T_MAX;
  810. else if(timestamp < TIME_T_MIN)
  811. *out = TIME_T_MIN;
  812. else
  813. #endif
  814. *out = (time_t) timestamp;
  815. }
  816. static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
  817. {
  818. struct connectdata *conn = data->conn;
  819. struct smb_request *req = data->req.p.smb;
  820. struct smb_header *h;
  821. struct smb_conn *smbc = &conn->proto.smbc;
  822. enum smb_req_state next_state = SMB_DONE;
  823. unsigned short len;
  824. unsigned short off;
  825. CURLcode result;
  826. void *msg = NULL;
  827. const struct smb_nt_create_response *smb_m;
  828. if(data->state.upload && (data->state.infilesize < 0)) {
  829. failf(data, "SMB upload needs to know the size up front");
  830. return CURLE_SEND_ERROR;
  831. }
  832. /* Start the request */
  833. if(req->state == SMB_REQUESTING) {
  834. result = smb_send_tree_connect(data);
  835. if(result) {
  836. connclose(conn, "SMB: failed to send tree connect message");
  837. return result;
  838. }
  839. request_state(data, SMB_TREE_CONNECT);
  840. }
  841. /* Send the previous message and check for a response */
  842. result = smb_send_and_recv(data, &msg);
  843. if(result && result != CURLE_AGAIN) {
  844. connclose(conn, "SMB: failed to communicate");
  845. return result;
  846. }
  847. if(!msg)
  848. return CURLE_OK;
  849. h = msg;
  850. switch(req->state) {
  851. case SMB_TREE_CONNECT:
  852. if(h->status) {
  853. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  854. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  855. req->result = CURLE_REMOTE_ACCESS_DENIED;
  856. break;
  857. }
  858. req->tid = smb_swap16(h->tid);
  859. next_state = SMB_OPEN;
  860. break;
  861. case SMB_OPEN:
  862. if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
  863. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  864. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  865. req->result = CURLE_REMOTE_ACCESS_DENIED;
  866. next_state = SMB_TREE_DISCONNECT;
  867. break;
  868. }
  869. smb_m = (const struct smb_nt_create_response*) msg;
  870. req->fid = smb_swap16(smb_m->fid);
  871. data->req.offset = 0;
  872. if(data->state.upload) {
  873. data->req.size = data->state.infilesize;
  874. Curl_pgrsSetUploadSize(data, data->req.size);
  875. next_state = SMB_UPLOAD;
  876. }
  877. else {
  878. data->req.size = smb_swap64(smb_m->end_of_file);
  879. if(data->req.size < 0) {
  880. req->result = CURLE_WEIRD_SERVER_REPLY;
  881. next_state = SMB_CLOSE;
  882. }
  883. else {
  884. Curl_pgrsSetDownloadSize(data, data->req.size);
  885. if(data->set.get_filetime)
  886. get_posix_time(&data->info.filetime, smb_m->last_change_time);
  887. next_state = SMB_DOWNLOAD;
  888. }
  889. }
  890. break;
  891. case SMB_DOWNLOAD:
  892. if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
  893. req->result = CURLE_RECV_ERROR;
  894. next_state = SMB_CLOSE;
  895. break;
  896. }
  897. len = Curl_read16_le(((const unsigned char *) msg) +
  898. sizeof(struct smb_header) + 11);
  899. off = Curl_read16_le(((const unsigned char *) msg) +
  900. sizeof(struct smb_header) + 13);
  901. if(len > 0) {
  902. if(off + sizeof(unsigned int) + len > smbc->got) {
  903. failf(data, "Invalid input packet");
  904. result = CURLE_RECV_ERROR;
  905. }
  906. else
  907. result = Curl_client_write(data, CLIENTWRITE_BODY,
  908. (char *)msg + off + sizeof(unsigned int),
  909. len);
  910. if(result) {
  911. req->result = result;
  912. next_state = SMB_CLOSE;
  913. break;
  914. }
  915. }
  916. data->req.bytecount += len;
  917. data->req.offset += len;
  918. Curl_pgrsSetDownloadCounter(data, data->req.bytecount);
  919. next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
  920. break;
  921. case SMB_UPLOAD:
  922. if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
  923. req->result = CURLE_UPLOAD_FAILED;
  924. next_state = SMB_CLOSE;
  925. break;
  926. }
  927. len = Curl_read16_le(((const unsigned char *) msg) +
  928. sizeof(struct smb_header) + 5);
  929. data->req.bytecount += len;
  930. data->req.offset += len;
  931. Curl_pgrsSetUploadCounter(data, data->req.bytecount);
  932. if(data->req.bytecount >= data->req.size)
  933. next_state = SMB_CLOSE;
  934. else
  935. next_state = SMB_UPLOAD;
  936. break;
  937. case SMB_CLOSE:
  938. /* We don't care if the close failed, proceed to tree disconnect anyway */
  939. next_state = SMB_TREE_DISCONNECT;
  940. break;
  941. case SMB_TREE_DISCONNECT:
  942. next_state = SMB_DONE;
  943. break;
  944. default:
  945. smb_pop_message(conn);
  946. return CURLE_OK; /* ignore */
  947. }
  948. smb_pop_message(conn);
  949. switch(next_state) {
  950. case SMB_OPEN:
  951. result = smb_send_open(data);
  952. break;
  953. case SMB_DOWNLOAD:
  954. result = smb_send_read(data);
  955. break;
  956. case SMB_UPLOAD:
  957. result = smb_send_write(data);
  958. break;
  959. case SMB_CLOSE:
  960. result = smb_send_close(data);
  961. break;
  962. case SMB_TREE_DISCONNECT:
  963. result = smb_send_tree_disconnect(data);
  964. break;
  965. case SMB_DONE:
  966. result = req->result;
  967. *done = true;
  968. break;
  969. default:
  970. break;
  971. }
  972. if(result) {
  973. connclose(conn, "SMB: failed to send message");
  974. return result;
  975. }
  976. request_state(data, next_state);
  977. return CURLE_OK;
  978. }
  979. static CURLcode smb_disconnect(struct Curl_easy *data,
  980. struct connectdata *conn, bool dead)
  981. {
  982. struct smb_conn *smbc = &conn->proto.smbc;
  983. (void) dead;
  984. (void) data;
  985. Curl_safefree(smbc->share);
  986. Curl_safefree(smbc->domain);
  987. Curl_safefree(smbc->recv_buf);
  988. return CURLE_OK;
  989. }
  990. static int smb_getsock(struct Curl_easy *data,
  991. struct connectdata *conn, curl_socket_t *socks)
  992. {
  993. (void)data;
  994. socks[0] = conn->sock[FIRSTSOCKET];
  995. return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
  996. }
  997. static CURLcode smb_do(struct Curl_easy *data, bool *done)
  998. {
  999. struct connectdata *conn = data->conn;
  1000. struct smb_conn *smbc = &conn->proto.smbc;
  1001. *done = FALSE;
  1002. if(smbc->share) {
  1003. return CURLE_OK;
  1004. }
  1005. return CURLE_URL_MALFORMAT;
  1006. }
  1007. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  1008. struct connectdata *conn)
  1009. {
  1010. struct smb_request *req = data->req.p.smb;
  1011. struct smb_conn *smbc = &conn->proto.smbc;
  1012. char *path;
  1013. char *slash;
  1014. /* URL decode the path */
  1015. CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
  1016. REJECT_CTRL);
  1017. if(result)
  1018. return result;
  1019. /* Parse the path for the share */
  1020. smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
  1021. free(path);
  1022. if(!smbc->share)
  1023. return CURLE_OUT_OF_MEMORY;
  1024. slash = strchr(smbc->share, '/');
  1025. if(!slash)
  1026. slash = strchr(smbc->share, '\\');
  1027. /* The share must be present */
  1028. if(!slash) {
  1029. Curl_safefree(smbc->share);
  1030. failf(data, "missing share in URL path for SMB");
  1031. return CURLE_URL_MALFORMAT;
  1032. }
  1033. /* Parse the path for the file path converting any forward slashes into
  1034. backslashes */
  1035. *slash++ = 0;
  1036. req->path = slash;
  1037. for(; *slash; slash++) {
  1038. if(*slash == '/')
  1039. *slash = '\\';
  1040. }
  1041. return CURLE_OK;
  1042. }
  1043. #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
  1044. SIZEOF_CURL_OFF_T > 4 */