smb.c 34 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. ***************************************************************************/
  25. #include "curl_setup.h"
  26. #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
  27. #ifdef _WIN32
  28. #define getpid GetCurrentProcessId
  29. #endif
  30. #include "smb.h"
  31. #include "urldata.h"
  32. #include "sendf.h"
  33. #include "multiif.h"
  34. #include "cfilters.h"
  35. #include "connect.h"
  36. #include "progress.h"
  37. #include "transfer.h"
  38. #include "vtls/vtls.h"
  39. #include "curl_ntlm_core.h"
  40. #include "escape.h"
  41. #include "curl_endian.h"
  42. /* The last 3 #include files should be in this order */
  43. #include "curl_printf.h"
  44. #include "curl_memory.h"
  45. #include "memdebug.h"
  46. /*
  47. * Definitions for SMB protocol data structures
  48. */
  49. #if defined(_MSC_VER) || defined(__ILEC400__)
  50. # define PACK
  51. # pragma pack(push)
  52. # pragma pack(1)
  53. #elif defined(__GNUC__)
  54. # define PACK __attribute__((packed))
  55. #else
  56. # define PACK
  57. #endif
  58. #define SMB_COM_CLOSE 0x04
  59. #define SMB_COM_READ_ANDX 0x2e
  60. #define SMB_COM_WRITE_ANDX 0x2f
  61. #define SMB_COM_TREE_DISCONNECT 0x71
  62. #define SMB_COM_NEGOTIATE 0x72
  63. #define SMB_COM_SETUP_ANDX 0x73
  64. #define SMB_COM_TREE_CONNECT_ANDX 0x75
  65. #define SMB_COM_NT_CREATE_ANDX 0xa2
  66. #define SMB_COM_NO_ANDX_COMMAND 0xff
  67. #define SMB_WC_CLOSE 0x03
  68. #define SMB_WC_READ_ANDX 0x0c
  69. #define SMB_WC_WRITE_ANDX 0x0e
  70. #define SMB_WC_SETUP_ANDX 0x0d
  71. #define SMB_WC_TREE_CONNECT_ANDX 0x04
  72. #define SMB_WC_NT_CREATE_ANDX 0x18
  73. #define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
  74. #define SMB_FLAGS_CASELESS_PATHNAMES 0x08
  75. #define SMB_FLAGS2_UNICODE_STRINGS 0x8000
  76. #define SMB_FLAGS2_IS_LONG_NAME 0x0040
  77. #define SMB_FLAGS2_KNOWS_LONG_NAME 0x0001
  78. #define SMB_CAP_LARGE_FILES 0x08
  79. #define SMB_GENERIC_WRITE 0x40000000
  80. #define SMB_GENERIC_READ 0x80000000
  81. #define SMB_FILE_SHARE_ALL 0x07
  82. #define SMB_FILE_OPEN 0x01
  83. #define SMB_FILE_OVERWRITE_IF 0x05
  84. #define SMB_ERR_NOACCESS 0x00050001
  85. struct smb_header {
  86. unsigned char nbt_type;
  87. unsigned char nbt_flags;
  88. unsigned short nbt_length;
  89. unsigned char magic[4];
  90. unsigned char command;
  91. unsigned int status;
  92. unsigned char flags;
  93. unsigned short flags2;
  94. unsigned short pid_high;
  95. unsigned char signature[8];
  96. unsigned short pad;
  97. unsigned short tid;
  98. unsigned short pid;
  99. unsigned short uid;
  100. unsigned short mid;
  101. } PACK;
  102. struct smb_negotiate_response {
  103. struct smb_header h;
  104. unsigned char word_count;
  105. unsigned short dialect_index;
  106. unsigned char security_mode;
  107. unsigned short max_mpx_count;
  108. unsigned short max_number_vcs;
  109. unsigned int max_buffer_size;
  110. unsigned int max_raw_size;
  111. unsigned int session_key;
  112. unsigned int capabilities;
  113. unsigned int system_time_low;
  114. unsigned int system_time_high;
  115. unsigned short server_time_zone;
  116. unsigned char encryption_key_length;
  117. unsigned short byte_count;
  118. char bytes[1];
  119. } PACK;
  120. struct andx {
  121. unsigned char command;
  122. unsigned char pad;
  123. unsigned short offset;
  124. } PACK;
  125. struct smb_setup {
  126. unsigned char word_count;
  127. struct andx andx;
  128. unsigned short max_buffer_size;
  129. unsigned short max_mpx_count;
  130. unsigned short vc_number;
  131. unsigned int session_key;
  132. unsigned short lengths[2];
  133. unsigned int pad;
  134. unsigned int capabilities;
  135. unsigned short byte_count;
  136. char bytes[1024];
  137. } PACK;
  138. struct smb_tree_connect {
  139. unsigned char word_count;
  140. struct andx andx;
  141. unsigned short flags;
  142. unsigned short pw_len;
  143. unsigned short byte_count;
  144. char bytes[1024];
  145. } PACK;
  146. struct smb_nt_create {
  147. unsigned char word_count;
  148. struct andx andx;
  149. unsigned char pad;
  150. unsigned short name_length;
  151. unsigned int flags;
  152. unsigned int root_fid;
  153. unsigned int access;
  154. curl_off_t allocation_size;
  155. unsigned int ext_file_attributes;
  156. unsigned int share_access;
  157. unsigned int create_disposition;
  158. unsigned int create_options;
  159. unsigned int impersonation_level;
  160. unsigned char security_flags;
  161. unsigned short byte_count;
  162. char bytes[1024];
  163. } PACK;
  164. struct smb_nt_create_response {
  165. struct smb_header h;
  166. unsigned char word_count;
  167. struct andx andx;
  168. unsigned char op_lock_level;
  169. unsigned short fid;
  170. unsigned int create_disposition;
  171. curl_off_t create_time;
  172. curl_off_t last_access_time;
  173. curl_off_t last_write_time;
  174. curl_off_t last_change_time;
  175. unsigned int ext_file_attributes;
  176. curl_off_t allocation_size;
  177. curl_off_t end_of_file;
  178. } PACK;
  179. struct smb_read {
  180. unsigned char word_count;
  181. struct andx andx;
  182. unsigned short fid;
  183. unsigned int offset;
  184. unsigned short max_bytes;
  185. unsigned short min_bytes;
  186. unsigned int timeout;
  187. unsigned short remaining;
  188. unsigned int offset_high;
  189. unsigned short byte_count;
  190. } PACK;
  191. struct smb_write {
  192. struct smb_header h;
  193. unsigned char word_count;
  194. struct andx andx;
  195. unsigned short fid;
  196. unsigned int offset;
  197. unsigned int timeout;
  198. unsigned short write_mode;
  199. unsigned short remaining;
  200. unsigned short pad;
  201. unsigned short data_length;
  202. unsigned short data_offset;
  203. unsigned int offset_high;
  204. unsigned short byte_count;
  205. unsigned char pad2;
  206. } PACK;
  207. struct smb_close {
  208. unsigned char word_count;
  209. unsigned short fid;
  210. unsigned int last_mtime;
  211. unsigned short byte_count;
  212. } PACK;
  213. struct smb_tree_disconnect {
  214. unsigned char word_count;
  215. unsigned short byte_count;
  216. } PACK;
  217. #if defined(_MSC_VER) || defined(__ILEC400__)
  218. # pragma pack(pop)
  219. #endif
  220. /* Local API functions */
  221. static CURLcode smb_setup_connection(struct Curl_easy *data,
  222. struct connectdata *conn);
  223. static CURLcode smb_connect(struct Curl_easy *data, bool *done);
  224. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
  225. static CURLcode smb_do(struct Curl_easy *data, bool *done);
  226. static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
  227. static CURLcode smb_disconnect(struct Curl_easy *data,
  228. struct connectdata *conn, bool dead);
  229. static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
  230. curl_socket_t *socks);
  231. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  232. struct connectdata *conn);
  233. /*
  234. * SMB handler interface
  235. */
  236. const struct Curl_handler Curl_handler_smb = {
  237. "smb", /* scheme */
  238. smb_setup_connection, /* setup_connection */
  239. smb_do, /* do_it */
  240. ZERO_NULL, /* done */
  241. ZERO_NULL, /* do_more */
  242. smb_connect, /* connect_it */
  243. smb_connection_state, /* connecting */
  244. smb_request_state, /* doing */
  245. smb_getsock, /* proto_getsock */
  246. smb_getsock, /* doing_getsock */
  247. ZERO_NULL, /* domore_getsock */
  248. ZERO_NULL, /* perform_getsock */
  249. smb_disconnect, /* disconnect */
  250. ZERO_NULL, /* write_resp */
  251. ZERO_NULL, /* write_resp_hd */
  252. ZERO_NULL, /* connection_check */
  253. ZERO_NULL, /* attach connection */
  254. PORT_SMB, /* defport */
  255. CURLPROTO_SMB, /* protocol */
  256. CURLPROTO_SMB, /* family */
  257. PROTOPT_NONE /* flags */
  258. };
  259. #ifdef USE_SSL
  260. /*
  261. * SMBS handler interface
  262. */
  263. const struct Curl_handler Curl_handler_smbs = {
  264. "smbs", /* scheme */
  265. smb_setup_connection, /* setup_connection */
  266. smb_do, /* do_it */
  267. ZERO_NULL, /* done */
  268. ZERO_NULL, /* do_more */
  269. smb_connect, /* connect_it */
  270. smb_connection_state, /* connecting */
  271. smb_request_state, /* doing */
  272. smb_getsock, /* proto_getsock */
  273. smb_getsock, /* doing_getsock */
  274. ZERO_NULL, /* domore_getsock */
  275. ZERO_NULL, /* perform_getsock */
  276. smb_disconnect, /* disconnect */
  277. ZERO_NULL, /* write_resp */
  278. ZERO_NULL, /* write_resp_hd */
  279. ZERO_NULL, /* connection_check */
  280. ZERO_NULL, /* attach connection */
  281. PORT_SMBS, /* defport */
  282. CURLPROTO_SMBS, /* protocol */
  283. CURLPROTO_SMB, /* family */
  284. PROTOPT_SSL /* flags */
  285. };
  286. #endif
  287. #define MAX_PAYLOAD_SIZE 0x8000
  288. #define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
  289. #define CLIENTNAME "curl"
  290. #define SERVICENAME "?????"
  291. /* SMB is mostly little endian */
  292. #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
  293. defined(__OS400__)
  294. static unsigned short smb_swap16(unsigned short x)
  295. {
  296. return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
  297. }
  298. static unsigned int smb_swap32(unsigned int x)
  299. {
  300. return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
  301. ((x >> 24) & 0xff);
  302. }
  303. static curl_off_t smb_swap64(curl_off_t x)
  304. {
  305. return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
  306. smb_swap32((unsigned int) (x >> 32));
  307. }
  308. #else
  309. # define smb_swap16(x) (x)
  310. # define smb_swap32(x) (x)
  311. # define smb_swap64(x) (x)
  312. #endif
  313. /* SMB request state */
  314. enum smb_req_state {
  315. SMB_REQUESTING,
  316. SMB_TREE_CONNECT,
  317. SMB_OPEN,
  318. SMB_DOWNLOAD,
  319. SMB_UPLOAD,
  320. SMB_CLOSE,
  321. SMB_TREE_DISCONNECT,
  322. SMB_DONE
  323. };
  324. /* SMB request data */
  325. struct smb_request {
  326. enum smb_req_state state;
  327. char *path;
  328. unsigned short tid; /* Even if we connect to the same tree as another */
  329. unsigned short fid; /* request, the tid will be different */
  330. CURLcode result;
  331. };
  332. static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
  333. {
  334. struct smb_conn *smbc = &data->conn->proto.smbc;
  335. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  336. /* For debug purposes */
  337. static const char * const names[] = {
  338. "SMB_NOT_CONNECTED",
  339. "SMB_CONNECTING",
  340. "SMB_NEGOTIATE",
  341. "SMB_SETUP",
  342. "SMB_CONNECTED",
  343. /* LAST */
  344. };
  345. if(smbc->state != newstate)
  346. infof(data, "SMB conn %p state change from %s to %s",
  347. (void *)smbc, names[smbc->state], names[newstate]);
  348. #endif
  349. smbc->state = newstate;
  350. }
  351. static void request_state(struct Curl_easy *data,
  352. enum smb_req_state newstate)
  353. {
  354. struct smb_request *req = data->req.p.smb;
  355. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  356. /* For debug purposes */
  357. static const char * const names[] = {
  358. "SMB_REQUESTING",
  359. "SMB_TREE_CONNECT",
  360. "SMB_OPEN",
  361. "SMB_DOWNLOAD",
  362. "SMB_UPLOAD",
  363. "SMB_CLOSE",
  364. "SMB_TREE_DISCONNECT",
  365. "SMB_DONE",
  366. /* LAST */
  367. };
  368. if(req->state != newstate)
  369. infof(data, "SMB request %p state change from %s to %s",
  370. (void *)req, names[req->state], names[newstate]);
  371. #endif
  372. req->state = newstate;
  373. }
  374. /* this should setup things in the connection, not in the easy
  375. handle */
  376. static CURLcode smb_setup_connection(struct Curl_easy *data,
  377. struct connectdata *conn)
  378. {
  379. struct smb_request *req;
  380. /* Initialize the request state */
  381. data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
  382. if(!req)
  383. return CURLE_OUT_OF_MEMORY;
  384. /* Parse the URL path */
  385. return smb_parse_url_path(data, conn);
  386. }
  387. static CURLcode smb_connect(struct Curl_easy *data, bool *done)
  388. {
  389. struct connectdata *conn = data->conn;
  390. struct smb_conn *smbc = &conn->proto.smbc;
  391. char *slash;
  392. (void) done;
  393. /* Check we have a username and password to authenticate with */
  394. if(!data->state.aptr.user)
  395. return CURLE_LOGIN_DENIED;
  396. /* Initialize the connection state */
  397. smbc->state = SMB_CONNECTING;
  398. smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
  399. if(!smbc->recv_buf)
  400. return CURLE_OUT_OF_MEMORY;
  401. smbc->send_buf = malloc(MAX_MESSAGE_SIZE);
  402. if(!smbc->send_buf)
  403. return CURLE_OUT_OF_MEMORY;
  404. /* Multiple requests are allowed with this connection */
  405. connkeep(conn, "SMB default");
  406. /* Parse the username, domain, and password */
  407. slash = strchr(conn->user, '/');
  408. if(!slash)
  409. slash = strchr(conn->user, '\\');
  410. if(slash) {
  411. smbc->user = slash + 1;
  412. smbc->domain = strdup(conn->user);
  413. if(!smbc->domain)
  414. return CURLE_OUT_OF_MEMORY;
  415. smbc->domain[slash - conn->user] = 0;
  416. }
  417. else {
  418. smbc->user = conn->user;
  419. smbc->domain = strdup(conn->host.name);
  420. if(!smbc->domain)
  421. return CURLE_OUT_OF_MEMORY;
  422. }
  423. return CURLE_OK;
  424. }
  425. static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
  426. {
  427. struct connectdata *conn = data->conn;
  428. struct smb_conn *smbc = &conn->proto.smbc;
  429. char *buf = smbc->recv_buf;
  430. ssize_t bytes_read;
  431. size_t nbt_size;
  432. size_t msg_size;
  433. size_t len = MAX_MESSAGE_SIZE - smbc->got;
  434. CURLcode result;
  435. result = Curl_xfer_recv(data, buf + smbc->got, len, &bytes_read);
  436. if(result)
  437. return result;
  438. if(!bytes_read)
  439. return CURLE_OK;
  440. smbc->got += bytes_read;
  441. /* Check for a 32-bit nbt header */
  442. if(smbc->got < sizeof(unsigned int))
  443. return CURLE_OK;
  444. nbt_size = Curl_read16_be((const unsigned char *)
  445. (buf + sizeof(unsigned short))) +
  446. sizeof(unsigned int);
  447. if(smbc->got < nbt_size)
  448. return CURLE_OK;
  449. msg_size = sizeof(struct smb_header);
  450. if(nbt_size >= msg_size + 1) {
  451. /* Add the word count */
  452. msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
  453. if(nbt_size >= msg_size + sizeof(unsigned short)) {
  454. /* Add the byte count */
  455. msg_size += sizeof(unsigned short) +
  456. Curl_read16_le((const unsigned char *)&buf[msg_size]);
  457. if(nbt_size < msg_size)
  458. return CURLE_READ_ERROR;
  459. }
  460. }
  461. *msg = buf;
  462. return CURLE_OK;
  463. }
  464. static void smb_pop_message(struct connectdata *conn)
  465. {
  466. struct smb_conn *smbc = &conn->proto.smbc;
  467. smbc->got = 0;
  468. }
  469. static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
  470. unsigned char cmd, size_t len)
  471. {
  472. struct connectdata *conn = data->conn;
  473. struct smb_conn *smbc = &conn->proto.smbc;
  474. struct smb_request *req = data->req.p.smb;
  475. unsigned int pid;
  476. memset(h, 0, sizeof(*h));
  477. h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
  478. len));
  479. memcpy((char *)h->magic, "\xffSMB", 4);
  480. h->command = cmd;
  481. h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
  482. h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
  483. h->uid = smb_swap16(smbc->uid);
  484. h->tid = smb_swap16(req->tid);
  485. pid = (unsigned int)getpid();
  486. h->pid_high = smb_swap16((unsigned short)(pid >> 16));
  487. h->pid = smb_swap16((unsigned short) pid);
  488. }
  489. static CURLcode smb_send(struct Curl_easy *data, size_t len,
  490. size_t upload_size)
  491. {
  492. struct connectdata *conn = data->conn;
  493. struct smb_conn *smbc = &conn->proto.smbc;
  494. size_t bytes_written;
  495. CURLcode result;
  496. result = Curl_xfer_send(data, smbc->send_buf, len, FALSE, &bytes_written);
  497. if(result)
  498. return result;
  499. if(bytes_written != len) {
  500. smbc->send_size = len;
  501. smbc->sent = bytes_written;
  502. }
  503. smbc->upload_size = upload_size;
  504. return CURLE_OK;
  505. }
  506. static CURLcode smb_flush(struct Curl_easy *data)
  507. {
  508. struct connectdata *conn = data->conn;
  509. struct smb_conn *smbc = &conn->proto.smbc;
  510. size_t bytes_written;
  511. size_t len = smbc->send_size - smbc->sent;
  512. CURLcode result;
  513. if(!smbc->send_size)
  514. return CURLE_OK;
  515. result = Curl_xfer_send(data, smbc->send_buf + smbc->sent, len, FALSE,
  516. &bytes_written);
  517. if(result)
  518. return result;
  519. if(bytes_written != len)
  520. smbc->sent += bytes_written;
  521. else
  522. smbc->send_size = 0;
  523. return CURLE_OK;
  524. }
  525. static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
  526. const void *msg, size_t msg_len)
  527. {
  528. struct connectdata *conn = data->conn;
  529. struct smb_conn *smbc = &conn->proto.smbc;
  530. smb_format_message(data, (struct smb_header *)smbc->send_buf,
  531. cmd, msg_len);
  532. DEBUGASSERT((sizeof(struct smb_header) + msg_len) <= MAX_MESSAGE_SIZE);
  533. memcpy(smbc->send_buf + sizeof(struct smb_header), msg, msg_len);
  534. return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
  535. }
  536. static CURLcode smb_send_negotiate(struct Curl_easy *data)
  537. {
  538. const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
  539. return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
  540. }
  541. static CURLcode smb_send_setup(struct Curl_easy *data)
  542. {
  543. struct connectdata *conn = data->conn;
  544. struct smb_conn *smbc = &conn->proto.smbc;
  545. struct smb_setup msg;
  546. char *p = msg.bytes;
  547. unsigned char lm_hash[21];
  548. unsigned char lm[24];
  549. unsigned char nt_hash[21];
  550. unsigned char nt[24];
  551. const size_t byte_count = sizeof(lm) + sizeof(nt) +
  552. strlen(smbc->user) + strlen(smbc->domain) +
  553. strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
  554. if(byte_count > sizeof(msg.bytes))
  555. return CURLE_FILESIZE_EXCEEDED;
  556. Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
  557. Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
  558. Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
  559. Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
  560. memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
  561. msg.word_count = SMB_WC_SETUP_ANDX;
  562. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  563. msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
  564. msg.max_mpx_count = smb_swap16(1);
  565. msg.vc_number = smb_swap16(1);
  566. msg.session_key = smb_swap32(smbc->session_key);
  567. msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
  568. msg.lengths[0] = smb_swap16(sizeof(lm));
  569. msg.lengths[1] = smb_swap16(sizeof(nt));
  570. memcpy(p, lm, sizeof(lm));
  571. p += sizeof(lm);
  572. memcpy(p, nt, sizeof(nt));
  573. p += sizeof(nt);
  574. p += msnprintf(p, byte_count - sizeof(nt) - sizeof(lm),
  575. "%s%c" /* user */
  576. "%s%c" /* domain */
  577. "%s%c" /* OS */
  578. "%s", /* client name */
  579. smbc->user, 0, smbc->domain, 0, OS, 0, CLIENTNAME);
  580. p++; /* count the final null termination */
  581. DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
  582. msg.byte_count = smb_swap16((unsigned short)byte_count);
  583. return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
  584. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  585. }
  586. static CURLcode smb_send_tree_connect(struct Curl_easy *data)
  587. {
  588. struct smb_tree_connect msg;
  589. struct connectdata *conn = data->conn;
  590. struct smb_conn *smbc = &conn->proto.smbc;
  591. char *p = msg.bytes;
  592. const size_t byte_count = strlen(conn->host.name) + strlen(smbc->share) +
  593. strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
  594. if(byte_count > sizeof(msg.bytes))
  595. return CURLE_FILESIZE_EXCEEDED;
  596. memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
  597. msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
  598. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  599. msg.pw_len = 0;
  600. p += msnprintf(p, byte_count,
  601. "\\\\%s\\" /* hostname */
  602. "%s%c" /* share */
  603. "%s", /* service */
  604. conn->host.name, smbc->share, 0, SERVICENAME);
  605. p++; /* count the final null termination */
  606. DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
  607. msg.byte_count = smb_swap16((unsigned short)byte_count);
  608. return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
  609. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  610. }
  611. static CURLcode smb_send_open(struct Curl_easy *data)
  612. {
  613. struct smb_request *req = data->req.p.smb;
  614. struct smb_nt_create msg;
  615. const size_t byte_count = strlen(req->path) + 1;
  616. if(byte_count > sizeof(msg.bytes))
  617. return CURLE_FILESIZE_EXCEEDED;
  618. memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
  619. msg.word_count = SMB_WC_NT_CREATE_ANDX;
  620. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  621. msg.name_length = smb_swap16((unsigned short)(byte_count - 1));
  622. msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
  623. if(data->state.upload) {
  624. msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
  625. msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
  626. }
  627. else {
  628. msg.access = smb_swap32(SMB_GENERIC_READ);
  629. msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
  630. }
  631. msg.byte_count = smb_swap16((unsigned short) byte_count);
  632. strcpy(msg.bytes, req->path);
  633. return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
  634. sizeof(msg) - sizeof(msg.bytes) + byte_count);
  635. }
  636. static CURLcode smb_send_close(struct Curl_easy *data)
  637. {
  638. struct smb_request *req = data->req.p.smb;
  639. struct smb_close msg;
  640. memset(&msg, 0, sizeof(msg));
  641. msg.word_count = SMB_WC_CLOSE;
  642. msg.fid = smb_swap16(req->fid);
  643. return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
  644. }
  645. static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
  646. {
  647. struct smb_tree_disconnect msg;
  648. memset(&msg, 0, sizeof(msg));
  649. return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
  650. }
  651. static CURLcode smb_send_read(struct Curl_easy *data)
  652. {
  653. struct smb_request *req = data->req.p.smb;
  654. curl_off_t offset = data->req.offset;
  655. struct smb_read msg;
  656. memset(&msg, 0, sizeof(msg));
  657. msg.word_count = SMB_WC_READ_ANDX;
  658. msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
  659. msg.fid = smb_swap16(req->fid);
  660. msg.offset = smb_swap32((unsigned int) offset);
  661. msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
  662. msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  663. msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
  664. return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
  665. }
  666. static CURLcode smb_send_write(struct Curl_easy *data)
  667. {
  668. struct connectdata *conn = data->conn;
  669. struct smb_conn *smbc = &conn->proto.smbc;
  670. struct smb_write *msg;
  671. struct smb_request *req = data->req.p.smb;
  672. curl_off_t offset = data->req.offset;
  673. curl_off_t upload_size = data->req.size - data->req.bytecount;
  674. msg = (struct smb_write *)smbc->send_buf;
  675. if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
  676. upload_size = MAX_PAYLOAD_SIZE - 1;
  677. memset(msg, 0, sizeof(*msg));
  678. msg->word_count = SMB_WC_WRITE_ANDX;
  679. msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
  680. msg->fid = smb_swap16(req->fid);
  681. msg->offset = smb_swap32((unsigned int) offset);
  682. msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
  683. msg->data_length = smb_swap16((unsigned short) upload_size);
  684. msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
  685. msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
  686. smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
  687. sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
  688. return smb_send(data, sizeof(*msg), (size_t) upload_size);
  689. }
  690. static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
  691. {
  692. struct connectdata *conn = data->conn;
  693. struct smb_conn *smbc = &conn->proto.smbc;
  694. CURLcode result;
  695. *msg = NULL; /* if it returns early */
  696. /* Check if there is data in the transfer buffer */
  697. if(!smbc->send_size && smbc->upload_size) {
  698. size_t nread = smbc->upload_size > (size_t)MAX_MESSAGE_SIZE ?
  699. (size_t)MAX_MESSAGE_SIZE : smbc->upload_size;
  700. bool eos;
  701. result = Curl_client_read(data, smbc->send_buf, nread, &nread, &eos);
  702. if(result && result != CURLE_AGAIN)
  703. return result;
  704. if(!nread)
  705. return CURLE_OK;
  706. smbc->upload_size -= nread;
  707. smbc->send_size = nread;
  708. smbc->sent = 0;
  709. }
  710. /* Check if there is data to send */
  711. if(smbc->send_size) {
  712. result = smb_flush(data);
  713. if(result)
  714. return result;
  715. }
  716. /* Check if there is still data to be sent */
  717. if(smbc->send_size || smbc->upload_size)
  718. return CURLE_AGAIN;
  719. return smb_recv_message(data, msg);
  720. }
  721. static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
  722. {
  723. struct connectdata *conn = data->conn;
  724. struct smb_conn *smbc = &conn->proto.smbc;
  725. struct smb_negotiate_response *nrsp;
  726. struct smb_header *h;
  727. CURLcode result;
  728. void *msg = NULL;
  729. if(smbc->state == SMB_CONNECTING) {
  730. #ifdef USE_SSL
  731. if((conn->handler->flags & PROTOPT_SSL)) {
  732. bool ssl_done = FALSE;
  733. result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
  734. if(result && result != CURLE_AGAIN)
  735. return result;
  736. if(!ssl_done)
  737. return CURLE_OK;
  738. }
  739. #endif
  740. result = smb_send_negotiate(data);
  741. if(result) {
  742. connclose(conn, "SMB: failed to send negotiate message");
  743. return result;
  744. }
  745. conn_state(data, SMB_NEGOTIATE);
  746. }
  747. /* Send the previous message and check for a response */
  748. result = smb_send_and_recv(data, &msg);
  749. if(result && result != CURLE_AGAIN) {
  750. connclose(conn, "SMB: failed to communicate");
  751. return result;
  752. }
  753. if(!msg)
  754. return CURLE_OK;
  755. h = msg;
  756. switch(smbc->state) {
  757. case SMB_NEGOTIATE:
  758. if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
  759. h->status) {
  760. connclose(conn, "SMB: negotiation failed");
  761. return CURLE_COULDNT_CONNECT;
  762. }
  763. nrsp = msg;
  764. memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
  765. smbc->session_key = smb_swap32(nrsp->session_key);
  766. result = smb_send_setup(data);
  767. if(result) {
  768. connclose(conn, "SMB: failed to send setup message");
  769. return result;
  770. }
  771. conn_state(data, SMB_SETUP);
  772. break;
  773. case SMB_SETUP:
  774. if(h->status) {
  775. connclose(conn, "SMB: authentication failed");
  776. return CURLE_LOGIN_DENIED;
  777. }
  778. smbc->uid = smb_swap16(h->uid);
  779. conn_state(data, SMB_CONNECTED);
  780. *done = TRUE;
  781. break;
  782. default:
  783. smb_pop_message(conn);
  784. return CURLE_OK; /* ignore */
  785. }
  786. smb_pop_message(conn);
  787. return CURLE_OK;
  788. }
  789. /*
  790. * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
  791. * to POSIX time. Cap the output to fit within a time_t.
  792. */
  793. static void get_posix_time(time_t *out, curl_off_t timestamp)
  794. {
  795. timestamp -= 116444736000000000;
  796. timestamp /= 10000000;
  797. #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
  798. if(timestamp > TIME_T_MAX)
  799. *out = TIME_T_MAX;
  800. else if(timestamp < TIME_T_MIN)
  801. *out = TIME_T_MIN;
  802. else
  803. #endif
  804. *out = (time_t) timestamp;
  805. }
  806. static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
  807. {
  808. struct connectdata *conn = data->conn;
  809. struct smb_request *req = data->req.p.smb;
  810. struct smb_header *h;
  811. struct smb_conn *smbc = &conn->proto.smbc;
  812. enum smb_req_state next_state = SMB_DONE;
  813. unsigned short len;
  814. unsigned short off;
  815. CURLcode result;
  816. void *msg = NULL;
  817. const struct smb_nt_create_response *smb_m;
  818. if(data->state.upload && (data->state.infilesize < 0)) {
  819. failf(data, "SMB upload needs to know the size up front");
  820. return CURLE_SEND_ERROR;
  821. }
  822. /* Start the request */
  823. if(req->state == SMB_REQUESTING) {
  824. result = smb_send_tree_connect(data);
  825. if(result) {
  826. connclose(conn, "SMB: failed to send tree connect message");
  827. return result;
  828. }
  829. request_state(data, SMB_TREE_CONNECT);
  830. }
  831. /* Send the previous message and check for a response */
  832. result = smb_send_and_recv(data, &msg);
  833. if(result && result != CURLE_AGAIN) {
  834. connclose(conn, "SMB: failed to communicate");
  835. return result;
  836. }
  837. if(!msg)
  838. return CURLE_OK;
  839. h = msg;
  840. switch(req->state) {
  841. case SMB_TREE_CONNECT:
  842. if(h->status) {
  843. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  844. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  845. req->result = CURLE_REMOTE_ACCESS_DENIED;
  846. break;
  847. }
  848. req->tid = smb_swap16(h->tid);
  849. next_state = SMB_OPEN;
  850. break;
  851. case SMB_OPEN:
  852. if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
  853. req->result = CURLE_REMOTE_FILE_NOT_FOUND;
  854. if(h->status == smb_swap32(SMB_ERR_NOACCESS))
  855. req->result = CURLE_REMOTE_ACCESS_DENIED;
  856. next_state = SMB_TREE_DISCONNECT;
  857. break;
  858. }
  859. smb_m = (const struct smb_nt_create_response*) msg;
  860. req->fid = smb_swap16(smb_m->fid);
  861. data->req.offset = 0;
  862. if(data->state.upload) {
  863. data->req.size = data->state.infilesize;
  864. Curl_pgrsSetUploadSize(data, data->req.size);
  865. next_state = SMB_UPLOAD;
  866. }
  867. else {
  868. data->req.size = smb_swap64(smb_m->end_of_file);
  869. if(data->req.size < 0) {
  870. req->result = CURLE_WEIRD_SERVER_REPLY;
  871. next_state = SMB_CLOSE;
  872. }
  873. else {
  874. Curl_pgrsSetDownloadSize(data, data->req.size);
  875. if(data->set.get_filetime)
  876. get_posix_time(&data->info.filetime, smb_m->last_change_time);
  877. next_state = SMB_DOWNLOAD;
  878. }
  879. }
  880. break;
  881. case SMB_DOWNLOAD:
  882. if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
  883. req->result = CURLE_RECV_ERROR;
  884. next_state = SMB_CLOSE;
  885. break;
  886. }
  887. len = Curl_read16_le(((const unsigned char *) msg) +
  888. sizeof(struct smb_header) + 11);
  889. off = Curl_read16_le(((const unsigned char *) msg) +
  890. sizeof(struct smb_header) + 13);
  891. if(len > 0) {
  892. if(off + sizeof(unsigned int) + len > smbc->got) {
  893. failf(data, "Invalid input packet");
  894. result = CURLE_RECV_ERROR;
  895. }
  896. else
  897. result = Curl_client_write(data, CLIENTWRITE_BODY,
  898. (char *)msg + off + sizeof(unsigned int),
  899. len);
  900. if(result) {
  901. req->result = result;
  902. next_state = SMB_CLOSE;
  903. break;
  904. }
  905. }
  906. data->req.offset += len;
  907. next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
  908. break;
  909. case SMB_UPLOAD:
  910. if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
  911. req->result = CURLE_UPLOAD_FAILED;
  912. next_state = SMB_CLOSE;
  913. break;
  914. }
  915. len = Curl_read16_le(((const unsigned char *) msg) +
  916. sizeof(struct smb_header) + 5);
  917. data->req.bytecount += len;
  918. data->req.offset += len;
  919. Curl_pgrsSetUploadCounter(data, data->req.bytecount);
  920. if(data->req.bytecount >= data->req.size)
  921. next_state = SMB_CLOSE;
  922. else
  923. next_state = SMB_UPLOAD;
  924. break;
  925. case SMB_CLOSE:
  926. /* We do not care if the close failed, proceed to tree disconnect anyway */
  927. next_state = SMB_TREE_DISCONNECT;
  928. break;
  929. case SMB_TREE_DISCONNECT:
  930. next_state = SMB_DONE;
  931. break;
  932. default:
  933. smb_pop_message(conn);
  934. return CURLE_OK; /* ignore */
  935. }
  936. smb_pop_message(conn);
  937. switch(next_state) {
  938. case SMB_OPEN:
  939. result = smb_send_open(data);
  940. break;
  941. case SMB_DOWNLOAD:
  942. result = smb_send_read(data);
  943. break;
  944. case SMB_UPLOAD:
  945. result = smb_send_write(data);
  946. break;
  947. case SMB_CLOSE:
  948. result = smb_send_close(data);
  949. break;
  950. case SMB_TREE_DISCONNECT:
  951. result = smb_send_tree_disconnect(data);
  952. break;
  953. case SMB_DONE:
  954. result = req->result;
  955. *done = TRUE;
  956. break;
  957. default:
  958. break;
  959. }
  960. if(result) {
  961. connclose(conn, "SMB: failed to send message");
  962. return result;
  963. }
  964. request_state(data, next_state);
  965. return CURLE_OK;
  966. }
  967. static CURLcode smb_disconnect(struct Curl_easy *data,
  968. struct connectdata *conn, bool dead)
  969. {
  970. struct smb_conn *smbc = &conn->proto.smbc;
  971. (void) dead;
  972. (void) data;
  973. Curl_safefree(smbc->share);
  974. Curl_safefree(smbc->domain);
  975. Curl_safefree(smbc->recv_buf);
  976. Curl_safefree(smbc->send_buf);
  977. return CURLE_OK;
  978. }
  979. static int smb_getsock(struct Curl_easy *data,
  980. struct connectdata *conn, curl_socket_t *socks)
  981. {
  982. (void)data;
  983. socks[0] = conn->sock[FIRSTSOCKET];
  984. return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
  985. }
  986. static CURLcode smb_do(struct Curl_easy *data, bool *done)
  987. {
  988. struct connectdata *conn = data->conn;
  989. struct smb_conn *smbc = &conn->proto.smbc;
  990. *done = FALSE;
  991. if(smbc->share) {
  992. return CURLE_OK;
  993. }
  994. return CURLE_URL_MALFORMAT;
  995. }
  996. static CURLcode smb_parse_url_path(struct Curl_easy *data,
  997. struct connectdata *conn)
  998. {
  999. struct smb_request *req = data->req.p.smb;
  1000. struct smb_conn *smbc = &conn->proto.smbc;
  1001. char *path;
  1002. char *slash;
  1003. /* URL decode the path */
  1004. CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
  1005. REJECT_CTRL);
  1006. if(result)
  1007. return result;
  1008. /* Parse the path for the share */
  1009. smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
  1010. free(path);
  1011. if(!smbc->share)
  1012. return CURLE_OUT_OF_MEMORY;
  1013. slash = strchr(smbc->share, '/');
  1014. if(!slash)
  1015. slash = strchr(smbc->share, '\\');
  1016. /* The share must be present */
  1017. if(!slash) {
  1018. Curl_safefree(smbc->share);
  1019. failf(data, "missing share in URL path for SMB");
  1020. return CURLE_URL_MALFORMAT;
  1021. }
  1022. /* Parse the path for the file path converting any forward slashes into
  1023. backslashes */
  1024. *slash++ = 0;
  1025. req->path = slash;
  1026. for(; *slash; slash++) {
  1027. if(*slash == '/')
  1028. *slash = '\\';
  1029. }
  1030. return CURLE_OK;
  1031. }
  1032. #endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
  1033. SIZEOF_CURL_OFF_T > 4 */