branch: master
smb.c
35150 bytesRaw
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
***************************************************************************/
#include "curl_setup.h"
#include "urldata.h"
#if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
#ifdef HAVE_ARPA_INET_H
#include <arpa/inet.h> /* for htons() */
#endif
#include "smb.h"
#include "url.h"
#include "sendf.h"
#include "curl_trc.h"
#include "cfilters.h"
#include "connect.h"
#include "progress.h"
#include "transfer.h"
#include "select.h"
#include "curl_ntlm_core.h"
#include "escape.h"
#include "curl_endian.h"
#include "curlx/strcopy.h"
/* meta key for storing protocol meta at easy handle */
#define CURL_META_SMB_EASY "meta:proto:smb:easy"
/* meta key for storing protocol meta at connection */
#define CURL_META_SMB_CONN "meta:proto:smb:conn"
enum smb_conn_state {
SMB_NOT_CONNECTED = 0,
SMB_CONNECTING,
SMB_NEGOTIATE,
SMB_SETUP,
SMB_CONNECTED
};
/* SMB connection data, kept at connection */
struct smb_conn {
enum smb_conn_state state;
char *user;
char *domain;
char *share;
unsigned char challenge[8];
unsigned int session_key;
unsigned short uid;
char *recv_buf;
char *send_buf;
size_t upload_size;
size_t send_size;
size_t sent;
size_t got;
};
/* SMB request state */
enum smb_req_state {
SMB_REQUESTING,
SMB_TREE_CONNECT,
SMB_OPEN,
SMB_DOWNLOAD,
SMB_UPLOAD,
SMB_CLOSE,
SMB_TREE_DISCONNECT,
SMB_DONE
};
/* SMB request data, kept at easy handle */
struct smb_request {
enum smb_req_state state;
char *path;
unsigned short tid; /* Even if we connect to the same tree as another */
unsigned short fid; /* request, the tid will be different */
CURLcode result;
};
/*
* Definitions for SMB protocol data structures
*/
#if defined(_MSC_VER) || defined(__ILEC400__)
# define PACK
# pragma pack(push)
# pragma pack(1)
#elif defined(__GNUC__)
# define PACK __attribute__((packed))
#else
# define PACK
#endif
#define SMB_COM_CLOSE 0x04
#define SMB_COM_READ_ANDX 0x2e
#define SMB_COM_WRITE_ANDX 0x2f
#define SMB_COM_TREE_DISCONNECT 0x71
#define SMB_COM_NEGOTIATE 0x72
#define SMB_COM_SETUP_ANDX 0x73
#define SMB_COM_TREE_CONNECT_ANDX 0x75
#define SMB_COM_NT_CREATE_ANDX 0xa2
#define SMB_COM_NO_ANDX_COMMAND 0xff
#define SMB_WC_CLOSE 0x03
#define SMB_WC_READ_ANDX 0x0c
#define SMB_WC_WRITE_ANDX 0x0e
#define SMB_WC_SETUP_ANDX 0x0d
#define SMB_WC_TREE_CONNECT_ANDX 0x04
#define SMB_WC_NT_CREATE_ANDX 0x18
#define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
#define SMB_FLAGS_CASELESS_PATHNAMES 0x08
/* #define SMB_FLAGS2_UNICODE_STRINGS 0x8000 */
#define SMB_FLAGS2_IS_LONG_NAME 0x0040
#define SMB_FLAGS2_KNOWS_LONG_NAME 0x0001
#define SMB_CAP_LARGE_FILES 0x08
#define SMB_GENERIC_WRITE 0x40000000
#define SMB_GENERIC_READ 0x80000000
#define SMB_FILE_SHARE_ALL 0x07
#define SMB_FILE_OPEN 0x01
#define SMB_FILE_OVERWRITE_IF 0x05
#define SMB_ERR_NOACCESS 0x00050001
struct smb_header {
unsigned char nbt_type;
unsigned char nbt_flags;
unsigned short nbt_length;
unsigned char magic[4];
unsigned char command;
unsigned int status;
unsigned char flags;
unsigned short flags2;
unsigned short pid_high;
unsigned char signature[8];
unsigned short pad;
unsigned short tid;
unsigned short pid;
unsigned short uid;
unsigned short mid;
} PACK;
struct smb_negotiate_response {
struct smb_header h;
unsigned char word_count;
unsigned short dialect_index;
unsigned char security_mode;
unsigned short max_mpx_count;
unsigned short max_number_vcs;
unsigned int max_buffer_size;
unsigned int max_raw_size;
unsigned int session_key;
unsigned int capabilities;
unsigned int system_time_low;
unsigned int system_time_high;
unsigned short server_time_zone;
unsigned char encryption_key_length;
unsigned short byte_count;
char bytes[1];
} PACK;
struct andx {
unsigned char command;
unsigned char pad;
unsigned short offset;
} PACK;
struct smb_setup {
unsigned char word_count;
struct andx andx;
unsigned short max_buffer_size;
unsigned short max_mpx_count;
unsigned short vc_number;
unsigned int session_key;
unsigned short lengths[2];
unsigned int pad;
unsigned int capabilities;
unsigned short byte_count;
char bytes[1024];
} PACK;
struct smb_tree_connect {
unsigned char word_count;
struct andx andx;
unsigned short flags;
unsigned short pw_len;
unsigned short byte_count;
char bytes[1024];
} PACK;
struct smb_nt_create {
unsigned char word_count;
struct andx andx;
unsigned char pad;
unsigned short name_length;
unsigned int flags;
unsigned int root_fid;
unsigned int access;
curl_off_t allocation_size;
unsigned int ext_file_attributes;
unsigned int share_access;
unsigned int create_disposition;
unsigned int create_options;
unsigned int impersonation_level;
unsigned char security_flags;
unsigned short byte_count;
char bytes[1024];
} PACK;
struct smb_nt_create_response {
struct smb_header h;
unsigned char word_count;
struct andx andx;
unsigned char op_lock_level;
unsigned short fid;
unsigned int create_disposition;
curl_off_t create_time;
curl_off_t last_access_time;
curl_off_t last_write_time;
curl_off_t last_change_time;
unsigned int ext_file_attributes;
curl_off_t allocation_size;
curl_off_t end_of_file;
} PACK;
struct smb_read {
unsigned char word_count;
struct andx andx;
unsigned short fid;
unsigned int offset;
unsigned short max_bytes;
unsigned short min_bytes;
unsigned int timeout;
unsigned short remaining;
unsigned int offset_high;
unsigned short byte_count;
} PACK;
struct smb_write {
struct smb_header h;
unsigned char word_count;
struct andx andx;
unsigned short fid;
unsigned int offset;
unsigned int timeout;
unsigned short write_mode;
unsigned short remaining;
unsigned short pad;
unsigned short data_length;
unsigned short data_offset;
unsigned int offset_high;
unsigned short byte_count;
unsigned char pad2;
} PACK;
struct smb_close {
unsigned char word_count;
unsigned short fid;
unsigned int last_mtime;
unsigned short byte_count;
} PACK;
struct smb_tree_disconnect {
unsigned char word_count;
unsigned short byte_count;
} PACK;
#if defined(_MSC_VER) || defined(__ILEC400__)
# pragma pack(pop)
#endif
#define MAX_PAYLOAD_SIZE 0x8000
#define MAX_MESSAGE_SIZE (MAX_PAYLOAD_SIZE + 0x1000)
#define CLIENTNAME "curl"
#define SERVICENAME "?????"
/* SMB is mostly little endian */
#if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
defined(__OS400__)
static unsigned short smb_swap16(unsigned short x)
{
return (unsigned short)((x << 8) | ((x >> 8) & 0xff));
}
static unsigned int smb_swap32(unsigned int x)
{
return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
((x >> 24) & 0xff);
}
static curl_off_t smb_swap64(curl_off_t x)
{
return ((curl_off_t)smb_swap32((unsigned int)x) << 32) |
smb_swap32((unsigned int)(x >> 32));
}
#else
# define smb_swap16(x) (x)
# define smb_swap32(x) (x)
# define smb_swap64(x) (x)
#endif
static void conn_state(struct Curl_easy *data, struct smb_conn *smbc,
enum smb_conn_state newstate)
{
#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
/* For debug purposes */
static const char * const names[] = {
"SMB_NOT_CONNECTED",
"SMB_CONNECTING",
"SMB_NEGOTIATE",
"SMB_SETUP",
"SMB_CONNECTED",
/* LAST */
};
if(smbc->state != newstate)
infof(data, "SMB conn %p state change from %s to %s",
(void *)smbc, names[smbc->state], names[newstate]);
#else
(void)data;
#endif
smbc->state = newstate;
}
static void request_state(struct Curl_easy *data,
enum smb_req_state newstate)
{
struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
if(req) {
#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
/* For debug purposes */
static const char * const names[] = {
"SMB_REQUESTING",
"SMB_TREE_CONNECT",
"SMB_OPEN",
"SMB_DOWNLOAD",
"SMB_UPLOAD",
"SMB_CLOSE",
"SMB_TREE_DISCONNECT",
"SMB_DONE",
/* LAST */
};
if(req->state != newstate)
infof(data, "SMB request %p state change from %s to %s",
(void *)req, names[req->state], names[newstate]);
#endif
req->state = newstate;
}
}
static void smb_easy_dtor(void *key, size_t klen, void *entry)
{
struct smb_request *req = entry;
(void)key;
(void)klen;
Curl_safefree(req->path);
curlx_free(req);
}
static void smb_conn_dtor(void *key, size_t klen, void *entry)
{
struct smb_conn *smbc = entry;
(void)key;
(void)klen;
Curl_safefree(smbc->share);
Curl_safefree(smbc->domain);
Curl_safefree(smbc->recv_buf);
Curl_safefree(smbc->send_buf);
curlx_free(smbc);
}
static CURLcode smb_parse_url_path(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
char *path;
char *slash, *s;
CURLcode result;
/* URL decode the path */
result = Curl_urldecode(data->state.up.path, 0, &path, NULL, REJECT_CTRL);
if(result)
return result;
/* Parse the path for the share */
Curl_safefree(smbc->share);
smbc->share = curlx_strdup((*path == '/' || *path == '\\')
? path + 1 : path);
curlx_free(path);
if(!smbc->share)
return CURLE_OUT_OF_MEMORY;
slash = strchr(smbc->share, '/');
if(!slash)
slash = strchr(smbc->share, '\\');
/* The share must be present */
if(!slash) {
Curl_safefree(smbc->share);
failf(data, "missing share in URL path for SMB");
return CURLE_URL_MALFORMAT;
}
/* Parse the path for the file path converting any forward slashes into
backslashes */
*slash++ = 0;
for(s = slash; *s; s++) {
if(*s == '/')
*s = '\\';
}
/* keep a copy at easy struct to not share this with connection state */
req->path = curlx_strdup(slash);
if(!req->path)
return CURLE_OUT_OF_MEMORY;
return CURLE_OK;
}
/* this should setup things in the connection, not in the easy
handle */
static CURLcode smb_setup_connection(struct Curl_easy *data,
struct connectdata *conn)
{
struct smb_conn *smbc;
struct smb_request *req;
/* Initialize the connection state */
smbc = curlx_calloc(1, sizeof(*smbc));
if(!smbc ||
Curl_conn_meta_set(conn, CURL_META_SMB_CONN, smbc, smb_conn_dtor))
return CURLE_OUT_OF_MEMORY;
/* Initialize the request state */
req = curlx_calloc(1, sizeof(*req));
if(!req ||
Curl_meta_set(data, CURL_META_SMB_EASY, req, smb_easy_dtor))
return CURLE_OUT_OF_MEMORY;
/* Parse the URL path */
return smb_parse_url_path(data, smbc, req);
}
static CURLcode smb_connect(struct Curl_easy *data, bool *done)
{
struct connectdata *conn = data->conn;
struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
char *slash;
(void)done;
if(!smbc)
return CURLE_FAILED_INIT;
/* Check we have a username and password to authenticate with */
if(!data->state.aptr.user)
return CURLE_LOGIN_DENIED;
/* Initialize the connection state */
smbc->state = SMB_CONNECTING;
smbc->recv_buf = curlx_malloc(MAX_MESSAGE_SIZE);
if(!smbc->recv_buf)
return CURLE_OUT_OF_MEMORY;
smbc->send_buf = curlx_malloc(MAX_MESSAGE_SIZE);
if(!smbc->send_buf)
return CURLE_OUT_OF_MEMORY;
/* Parse the username, domain, and password */
slash = strchr(conn->user, '/');
if(!slash)
slash = strchr(conn->user, '\\');
if(slash) {
smbc->user = slash + 1;
smbc->domain = curlx_strdup(conn->user);
if(!smbc->domain)
return CURLE_OUT_OF_MEMORY;
smbc->domain[slash - conn->user] = 0;
}
else {
smbc->user = conn->user;
smbc->domain = curlx_strdup(conn->host.name);
if(!smbc->domain)
return CURLE_OUT_OF_MEMORY;
}
return CURLE_OK;
}
static CURLcode smb_recv_message(struct Curl_easy *data,
struct smb_conn *smbc,
void **msg)
{
char *buf = smbc->recv_buf;
size_t bytes_read;
size_t nbt_size;
size_t msg_size = sizeof(struct smb_header);
size_t len = MAX_MESSAGE_SIZE - smbc->got;
CURLcode result;
result = Curl_xfer_recv(data, buf + smbc->got, len, &bytes_read);
if(result)
return result;
if(!bytes_read)
return CURLE_OK;
smbc->got += bytes_read;
/* Check for a 32-bit nbt header */
if(smbc->got < sizeof(unsigned int))
return CURLE_OK;
nbt_size = Curl_read16_be((const unsigned char *)
(buf + sizeof(unsigned short))) +
sizeof(unsigned int);
if(nbt_size > MAX_MESSAGE_SIZE) {
failf(data, "too large NetBIOS frame size %zu", nbt_size);
return CURLE_RECV_ERROR;
}
else if(nbt_size < msg_size) {
/* Each SMB message must be at least this large, e.g. 32 bytes */
failf(data, "too small NetBIOS frame size %zu", nbt_size);
return CURLE_RECV_ERROR;
}
if(smbc->got < nbt_size)
return CURLE_OK;
if(nbt_size >= msg_size + 1) {
/* Add the word count */
msg_size += 1 + (((unsigned char)buf[msg_size]) * sizeof(unsigned short));
if(nbt_size >= msg_size + sizeof(unsigned short)) {
/* Add the byte count */
msg_size += sizeof(unsigned short) +
Curl_read16_le((const unsigned char *)&buf[msg_size]);
if(nbt_size < msg_size)
return CURLE_RECV_ERROR;
}
}
*msg = buf;
return CURLE_OK;
}
static void smb_pop_message(struct smb_conn *smbc)
{
smbc->got = 0;
}
static void smb_format_message(struct smb_conn *smbc,
struct smb_request *req,
struct smb_header *h,
unsigned char cmd, size_t len)
{
const unsigned int pid = 0xbad71d; /* made up */
memset(h, 0, sizeof(*h));
h->nbt_length = htons((unsigned short)(sizeof(*h) - sizeof(unsigned int) +
len));
memcpy((char *)h->magic, "\xffSMB", 4);
h->command = cmd;
h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
h->uid = smb_swap16(smbc->uid);
h->tid = smb_swap16(req->tid);
h->pid_high = smb_swap16((unsigned short)(pid >> 16));
h->pid = smb_swap16((unsigned short)pid);
}
static CURLcode smb_send(struct Curl_easy *data, struct smb_conn *smbc,
size_t len, size_t upload_size)
{
size_t bytes_written;
CURLcode result;
result = Curl_xfer_send(data, smbc->send_buf, len, FALSE, &bytes_written);
if(result)
return result;
if(bytes_written != len) {
smbc->send_size = len;
smbc->sent = bytes_written;
}
smbc->upload_size = upload_size;
return CURLE_OK;
}
static CURLcode smb_flush(struct Curl_easy *data, struct smb_conn *smbc)
{
size_t bytes_written;
size_t len = smbc->send_size - smbc->sent;
CURLcode result;
if(!smbc->send_size)
return CURLE_OK;
result = Curl_xfer_send(data, smbc->send_buf + smbc->sent, len, FALSE,
&bytes_written);
if(result)
return result;
if(bytes_written != len)
smbc->sent += bytes_written;
else
smbc->send_size = 0;
return CURLE_OK;
}
static CURLcode smb_send_message(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req,
unsigned char cmd,
const void *msg, size_t msg_len)
{
if((MAX_MESSAGE_SIZE - sizeof(struct smb_header)) < msg_len) {
DEBUGASSERT(0);
return CURLE_SEND_ERROR;
}
smb_format_message(smbc, req, (struct smb_header *)smbc->send_buf,
cmd, msg_len);
memcpy(smbc->send_buf + sizeof(struct smb_header), msg, msg_len);
return smb_send(data, smbc, sizeof(struct smb_header) + msg_len, 0);
}
static CURLcode smb_send_negotiate(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
return smb_send_message(data, smbc, req, SMB_COM_NEGOTIATE, msg, 15);
}
static CURLcode smb_send_setup(struct Curl_easy *data)
{
struct connectdata *conn = data->conn;
struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
struct smb_setup msg;
char *p = msg.bytes;
unsigned char lm_hash[21];
unsigned char lm[24];
unsigned char nt_hash[21];
unsigned char nt[24];
size_t byte_count;
if(!smbc || !req)
return CURLE_FAILED_INIT;
byte_count = sizeof(lm) + sizeof(nt) +
strlen(smbc->user) + strlen(smbc->domain) +
strlen(CURL_OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
if(byte_count > sizeof(msg.bytes))
return CURLE_FILESIZE_EXCEEDED;
Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
msg.word_count = SMB_WC_SETUP_ANDX;
msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
msg.max_mpx_count = smb_swap16(1);
msg.vc_number = smb_swap16(1);
msg.session_key = smb_swap32(smbc->session_key);
msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
msg.lengths[0] = smb_swap16(sizeof(lm));
msg.lengths[1] = smb_swap16(sizeof(nt));
memcpy(p, lm, sizeof(lm));
p += sizeof(lm);
memcpy(p, nt, sizeof(nt));
p += sizeof(nt);
p += curl_msnprintf(p, byte_count - sizeof(nt) - sizeof(lm),
"%s%c" /* user */
"%s%c" /* domain */
"%s%c" /* OS */
"%s", /* client name */
smbc->user, 0, smbc->domain, 0, CURL_OS, 0, CLIENTNAME);
p++; /* count the final null-termination */
DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
msg.byte_count = smb_swap16((unsigned short)byte_count);
return smb_send_message(data, smbc, req, SMB_COM_SETUP_ANDX, &msg,
sizeof(msg) - sizeof(msg.bytes) + byte_count);
}
static CURLcode smb_send_tree_connect(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
struct smb_tree_connect msg;
struct connectdata *conn = data->conn;
char *p = msg.bytes;
const size_t byte_count = strlen(conn->host.name) + strlen(smbc->share) +
strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
if(byte_count > sizeof(msg.bytes))
return CURLE_FILESIZE_EXCEEDED;
memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
msg.pw_len = 0;
p += curl_msnprintf(p, byte_count,
"\\\\%s\\" /* hostname */
"%s%c" /* share */
"%s", /* service */
conn->host.name, smbc->share, 0, SERVICENAME);
p++; /* count the final null-termination */
DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
msg.byte_count = smb_swap16((unsigned short)byte_count);
return smb_send_message(data, smbc, req, SMB_COM_TREE_CONNECT_ANDX, &msg,
sizeof(msg) - sizeof(msg.bytes) + byte_count);
}
static CURLcode smb_send_open(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
struct smb_nt_create msg;
const size_t byte_count = strlen(req->path) + 1;
if(byte_count > sizeof(msg.bytes))
return CURLE_FILESIZE_EXCEEDED;
memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
msg.word_count = SMB_WC_NT_CREATE_ANDX;
msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
msg.name_length = smb_swap16((unsigned short)(byte_count - 1));
msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
if(data->state.upload) {
msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
}
else {
msg.access = smb_swap32(SMB_GENERIC_READ);
msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
}
msg.byte_count = smb_swap16((unsigned short)byte_count);
curlx_strcopy(msg.bytes, sizeof(msg.bytes), req->path, byte_count - 1);
return smb_send_message(data, smbc, req, SMB_COM_NT_CREATE_ANDX, &msg,
sizeof(msg) - sizeof(msg.bytes) + byte_count);
}
static CURLcode smb_send_close(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
struct smb_close msg;
memset(&msg, 0, sizeof(msg));
msg.word_count = SMB_WC_CLOSE;
msg.fid = smb_swap16(req->fid);
return smb_send_message(data, smbc, req, SMB_COM_CLOSE, &msg, sizeof(msg));
}
static CURLcode smb_send_tree_disconnect(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
struct smb_tree_disconnect msg;
memset(&msg, 0, sizeof(msg));
return smb_send_message(data, smbc, req, SMB_COM_TREE_DISCONNECT,
&msg, sizeof(msg));
}
static CURLcode smb_send_read(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
curl_off_t offset = data->req.offset;
struct smb_read msg;
memset(&msg, 0, sizeof(msg));
msg.word_count = SMB_WC_READ_ANDX;
msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
msg.fid = smb_swap16(req->fid);
msg.offset = smb_swap32((unsigned int)offset);
msg.offset_high = smb_swap32((unsigned int)(offset >> 32));
msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
return smb_send_message(data, smbc, req, SMB_COM_READ_ANDX,
&msg, sizeof(msg));
}
static CURLcode smb_send_write(struct Curl_easy *data,
struct smb_conn *smbc,
struct smb_request *req)
{
struct smb_write *msg;
curl_off_t offset = data->req.offset;
curl_off_t upload_size = data->req.size - data->req.bytecount;
msg = (struct smb_write *)smbc->send_buf;
if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
upload_size = MAX_PAYLOAD_SIZE - 1;
memset(msg, 0, sizeof(*msg));
msg->word_count = SMB_WC_WRITE_ANDX;
msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
msg->fid = smb_swap16(req->fid);
msg->offset = smb_swap32((unsigned int)offset);
msg->offset_high = smb_swap32((unsigned int)(offset >> 32));
msg->data_length = smb_swap16((unsigned short)upload_size);
msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
msg->byte_count = smb_swap16((unsigned short)(upload_size + 1));
smb_format_message(smbc, req, &msg->h, SMB_COM_WRITE_ANDX,
sizeof(*msg) - sizeof(msg->h) + (size_t)upload_size);
return smb_send(data, smbc, sizeof(*msg), (size_t)upload_size);
}
static CURLcode smb_send_and_recv(struct Curl_easy *data,
struct smb_conn *smbc, void **msg)
{
CURLcode result;
*msg = NULL; /* if it returns early */
/* Check if there is data in the transfer buffer */
if(!smbc->send_size && smbc->upload_size) {
size_t nread = smbc->upload_size > (size_t)MAX_MESSAGE_SIZE ?
(size_t)MAX_MESSAGE_SIZE : smbc->upload_size;
bool eos;
result = Curl_client_read(data, smbc->send_buf, nread, &nread, &eos);
if(result && result != CURLE_AGAIN)
return result;
if(!nread)
return CURLE_OK;
smbc->upload_size -= nread;
smbc->send_size = nread;
smbc->sent = 0;
}
/* Check if there is data to send */
if(smbc->send_size) {
result = smb_flush(data, smbc);
if(result)
return result;
}
/* Check if there is still data to be sent */
if(smbc->send_size || smbc->upload_size)
return CURLE_AGAIN;
return smb_recv_message(data, smbc, msg);
}
static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
{
struct connectdata *conn = data->conn;
struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
struct smb_negotiate_response *nrsp;
struct smb_header *h;
CURLcode result;
void *msg = NULL;
if(!smbc || !req)
return CURLE_FAILED_INIT;
if(smbc->state == SMB_CONNECTING) {
#ifdef USE_SSL
if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
bool ssl_done = FALSE;
result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
if(result && result != CURLE_AGAIN)
return result;
if(!ssl_done)
return CURLE_OK;
}
#endif
result = smb_send_negotiate(data, smbc, req);
if(result) {
connclose(conn, "SMB: failed to send negotiate message");
return result;
}
conn_state(data, smbc, SMB_NEGOTIATE);
}
/* Send the previous message and check for a response */
result = smb_send_and_recv(data, smbc, &msg);
if(result && result != CURLE_AGAIN) {
connclose(conn, "SMB: failed to communicate");
return result;
}
if(!msg)
return CURLE_OK;
h = msg;
switch(smbc->state) {
case SMB_NEGOTIATE:
if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
h->status) {
connclose(conn, "SMB: negotiation failed");
return CURLE_COULDNT_CONNECT;
}
nrsp = msg;
#if defined(__GNUC__) && __GNUC__ >= 13
#pragma GCC diagnostic push
/* error: 'memcpy' offset [74, 80] from the object at '<unknown>' is out of
the bounds of referenced subobject 'bytes' with type 'char[1]' */
#pragma GCC diagnostic ignored "-Warray-bounds"
#endif
memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
#if defined(__GNUC__) && __GNUC__ >= 13
#pragma GCC diagnostic pop
#endif
smbc->session_key = smb_swap32(nrsp->session_key);
result = smb_send_setup(data);
if(result) {
connclose(conn, "SMB: failed to send setup message");
return result;
}
conn_state(data, smbc, SMB_SETUP);
break;
case SMB_SETUP:
if(h->status) {
connclose(conn, "SMB: authentication failed");
return CURLE_LOGIN_DENIED;
}
smbc->uid = smb_swap16(h->uid);
conn_state(data, smbc, SMB_CONNECTED);
*done = TRUE;
break;
default:
smb_pop_message(smbc);
return CURLE_OK; /* ignore */
}
smb_pop_message(smbc);
return CURLE_OK;
}
/*
* Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
* to POSIX time. Cap the output to fit within a time_t.
*/
static void get_posix_time(time_t *out, curl_off_t timestamp)
{
if(timestamp >= (curl_off_t)116444736000000000) {
timestamp -= (curl_off_t)116444736000000000;
timestamp /= 10000000;
#if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
if(timestamp > TIME_T_MAX)
*out = TIME_T_MAX;
else if(timestamp < TIME_T_MIN)
*out = TIME_T_MIN;
else
#endif
*out = (time_t)timestamp;
}
else
*out = 0;
}
static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
{
struct connectdata *conn = data->conn;
struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
struct smb_header *h;
enum smb_req_state next_state = SMB_DONE;
unsigned short len;
unsigned short off;
CURLcode result;
void *msg = NULL;
const struct smb_nt_create_response *smb_m;
if(!smbc || !req)
return CURLE_FAILED_INIT;
if(data->state.upload && (data->state.infilesize < 0)) {
failf(data, "SMB upload needs to know the size up front");
return CURLE_SEND_ERROR;
}
/* Start the request */
if(req->state == SMB_REQUESTING) {
result = smb_send_tree_connect(data, smbc, req);
if(result) {
connclose(conn, "SMB: failed to send tree connect message");
return result;
}
request_state(data, SMB_TREE_CONNECT);
}
/* Send the previous message and check for a response */
result = smb_send_and_recv(data, smbc, &msg);
if(result && result != CURLE_AGAIN) {
connclose(conn, "SMB: failed to communicate");
return result;
}
if(!msg)
return CURLE_OK;
h = msg;
switch(req->state) {
case SMB_TREE_CONNECT:
if(h->status) {
req->result = CURLE_REMOTE_FILE_NOT_FOUND;
if(h->status == smb_swap32(SMB_ERR_NOACCESS))
req->result = CURLE_REMOTE_ACCESS_DENIED;
break;
}
req->tid = smb_swap16(h->tid);
next_state = SMB_OPEN;
break;
case SMB_OPEN:
if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
req->result = CURLE_REMOTE_FILE_NOT_FOUND;
if(h->status == smb_swap32(SMB_ERR_NOACCESS))
req->result = CURLE_REMOTE_ACCESS_DENIED;
next_state = SMB_TREE_DISCONNECT;
break;
}
smb_m = (const struct smb_nt_create_response *)msg;
req->fid = smb_swap16(smb_m->fid);
data->req.offset = 0;
if(data->state.upload) {
data->req.size = data->state.infilesize;
Curl_pgrsSetUploadSize(data, data->req.size);
next_state = SMB_UPLOAD;
}
else {
data->req.size = smb_swap64(smb_m->end_of_file);
if(data->req.size < 0) {
req->result = CURLE_WEIRD_SERVER_REPLY;
next_state = SMB_CLOSE;
}
else {
Curl_pgrsSetDownloadSize(data, data->req.size);
if(data->set.get_filetime)
get_posix_time(&data->info.filetime, smb_m->last_change_time);
next_state = SMB_DOWNLOAD;
}
}
break;
case SMB_DOWNLOAD:
if(h->status || smbc->got < sizeof(struct smb_header) + 15) {
req->result = CURLE_RECV_ERROR;
next_state = SMB_CLOSE;
break;
}
len = Curl_read16_le((const unsigned char *)msg +
sizeof(struct smb_header) + 11);
off = Curl_read16_le((const unsigned char *)msg +
sizeof(struct smb_header) + 13);
if(len > 0) {
if(off + sizeof(unsigned int) + len > smbc->got) {
failf(data, "Invalid input packet");
result = CURLE_RECV_ERROR;
}
else
result = Curl_client_write(data, CLIENTWRITE_BODY,
(char *)msg + off + sizeof(unsigned int),
len);
if(result) {
req->result = result;
next_state = SMB_CLOSE;
break;
}
}
data->req.offset += len;
next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
break;
case SMB_UPLOAD:
if(h->status || smbc->got < sizeof(struct smb_header) + 7) {
req->result = CURLE_UPLOAD_FAILED;
next_state = SMB_CLOSE;
break;
}
len = Curl_read16_le((const unsigned char *)msg +
sizeof(struct smb_header) + 5);
data->req.bytecount += len;
data->req.offset += len;
Curl_pgrs_upload_inc(data, len);
if(data->req.bytecount >= data->req.size)
next_state = SMB_CLOSE;
else
next_state = SMB_UPLOAD;
break;
case SMB_CLOSE:
/* We do not care if the close failed, proceed to tree disconnect anyway */
next_state = SMB_TREE_DISCONNECT;
break;
case SMB_TREE_DISCONNECT:
next_state = SMB_DONE;
break;
default:
smb_pop_message(smbc);
return CURLE_OK; /* ignore */
}
smb_pop_message(smbc);
switch(next_state) {
case SMB_OPEN:
result = smb_send_open(data, smbc, req);
break;
case SMB_DOWNLOAD:
result = smb_send_read(data, smbc, req);
break;
case SMB_UPLOAD:
result = smb_send_write(data, smbc, req);
break;
case SMB_CLOSE:
result = smb_send_close(data, smbc, req);
break;
case SMB_TREE_DISCONNECT:
result = smb_send_tree_disconnect(data, smbc, req);
break;
case SMB_DONE:
result = req->result;
*done = TRUE;
break;
default:
break;
}
if(result) {
connclose(conn, "SMB: failed to send message");
return result;
}
request_state(data, next_state);
return CURLE_OK;
}
static CURLcode smb_pollset(struct Curl_easy *data,
struct easy_pollset *ps)
{
return Curl_pollset_add_inout(data, ps, data->conn->sock[FIRSTSOCKET]);
}
static CURLcode smb_do(struct Curl_easy *data, bool *done)
{
struct connectdata *conn = data->conn;
struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
*done = FALSE;
if(!smbc)
return CURLE_FAILED_INIT;
if(smbc->share)
return CURLE_OK;
return CURLE_URL_MALFORMAT;
}
/*
* SMB handler interface
*/
const struct Curl_protocol Curl_protocol_smb = {
smb_setup_connection, /* setup_connection */
smb_do, /* do_it */
ZERO_NULL, /* done */
ZERO_NULL, /* do_more */
smb_connect, /* connect_it */
smb_connection_state, /* connecting */
smb_request_state, /* doing */
smb_pollset, /* proto_pollset */
smb_pollset, /* doing_pollset */
ZERO_NULL, /* domore_pollset */
ZERO_NULL, /* perform_pollset */
ZERO_NULL, /* disconnect */
ZERO_NULL, /* write_resp */
ZERO_NULL, /* write_resp_hd */
ZERO_NULL, /* connection_is_dead */
ZERO_NULL, /* attach connection */
ZERO_NULL, /* follow */
};
#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE && SIZEOF_CURL_OFF_T > 4 */