luna - curl/lib/smb.c

   1/***************************************************************************
   2 *                                  _   _ ____  _
   3 *  Project                     ___| | | |  _ \| |
   4 *                             / __| | | | |_) | |
   5 *                            | (__| |_| |  _ <| |___
   6 *                             \___|\___/|_| \_\_____|
   7 *
   8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
   9 * Copyright (C) Bill Nagel <wnagel@tycoint.com>, Exacq Technologies
  10 *
  11 * This software is licensed as described in the file COPYING, which
  12 * you should have received as part of this distribution. The terms
  13 * are also available at https://curl.se/docs/copyright.html.
  14 *
  15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16 * copies of the Software, and permit persons to whom the Software is
  17 * furnished to do so, under the terms of the COPYING file.
  18 *
  19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20 * KIND, either express or implied.
  21 *
  22 * SPDX-License-Identifier: curl
  23 *
  24 ***************************************************************************/
  25#include "curl_setup.h"
  26#include "urldata.h"
  27
  28#if defined(CURL_ENABLE_SMB) && defined(USE_CURL_NTLM_CORE)
  29
  30#ifdef HAVE_ARPA_INET_H
  31#include <arpa/inet.h>  /* for htons() */
  32#endif
  33
  34#include "smb.h"
  35#include "url.h"
  36#include "sendf.h"
  37#include "curl_trc.h"
  38#include "cfilters.h"
  39#include "connect.h"
  40#include "progress.h"
  41#include "transfer.h"
  42#include "select.h"
  43#include "curl_ntlm_core.h"
  44#include "escape.h"
  45#include "curl_endian.h"
  46#include "curlx/strcopy.h"
  47
  48/* meta key for storing protocol meta at easy handle */
  49#define CURL_META_SMB_EASY   "meta:proto:smb:easy"
  50/* meta key for storing protocol meta at connection */
  51#define CURL_META_SMB_CONN   "meta:proto:smb:conn"
  52
  53enum smb_conn_state {
  54  SMB_NOT_CONNECTED = 0,
  55  SMB_CONNECTING,
  56  SMB_NEGOTIATE,
  57  SMB_SETUP,
  58  SMB_CONNECTED
  59};
  60
  61/* SMB connection data, kept at connection */
  62struct smb_conn {
  63  enum smb_conn_state state;
  64  const char *user;
  65  char *domain;
  66  char *share;
  67  unsigned char challenge[8];
  68  unsigned int session_key;
  69  unsigned short uid;
  70  char *recv_buf;
  71  char *send_buf;
  72  size_t upload_size;
  73  size_t send_size;
  74  size_t sent;
  75  size_t got;
  76};
  77
  78/* SMB request state */
  79enum smb_req_state {
  80  SMB_REQUESTING,
  81  SMB_TREE_CONNECT,
  82  SMB_OPEN,
  83  SMB_DOWNLOAD,
  84  SMB_UPLOAD,
  85  SMB_CLOSE,
  86  SMB_TREE_DISCONNECT,
  87  SMB_DONE
  88};
  89
  90/* SMB request data, kept at easy handle */
  91struct smb_request {
  92  enum smb_req_state state;
  93  char *path;
  94  unsigned short tid; /* Even if we connect to the same tree as another */
  95  unsigned short fid; /* request, the tid will be different */
  96  CURLcode result;
  97};
  98
  99/*
 100 * Definitions for SMB protocol data structures
 101 */
 102#if defined(_MSC_VER) || defined(__ILEC400__)
 103#  define PACK
 104#  pragma pack(push)
 105#  pragma pack(1)
 106#elif defined(__GNUC__)
 107#  define PACK __attribute__((packed))
 108#else
 109#  define PACK
 110#endif
 111
 112#define SMB_COM_CLOSE                 0x04
 113#define SMB_COM_READ_ANDX             0x2e
 114#define SMB_COM_WRITE_ANDX            0x2f
 115#define SMB_COM_TREE_DISCONNECT       0x71
 116#define SMB_COM_NEGOTIATE             0x72
 117#define SMB_COM_SETUP_ANDX            0x73
 118#define SMB_COM_TREE_CONNECT_ANDX     0x75
 119#define SMB_COM_NT_CREATE_ANDX        0xa2
 120#define SMB_COM_NO_ANDX_COMMAND       0xff
 121
 122#define SMB_WC_CLOSE                  0x03
 123#define SMB_WC_READ_ANDX              0x0c
 124#define SMB_WC_WRITE_ANDX             0x0e
 125#define SMB_WC_SETUP_ANDX             0x0d
 126#define SMB_WC_TREE_CONNECT_ANDX      0x04
 127#define SMB_WC_NT_CREATE_ANDX         0x18
 128
 129#define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
 130#define SMB_FLAGS_CASELESS_PATHNAMES  0x08
 131/* #define SMB_FLAGS2_UNICODE_STRINGS    0x8000 */
 132#define SMB_FLAGS2_IS_LONG_NAME       0x0040
 133#define SMB_FLAGS2_KNOWS_LONG_NAME    0x0001
 134
 135#define SMB_CAP_LARGE_FILES           0x08
 136#define SMB_GENERIC_WRITE             0x40000000
 137#define SMB_GENERIC_READ              0x80000000
 138#define SMB_FILE_SHARE_ALL            0x07
 139#define SMB_FILE_OPEN                 0x01
 140#define SMB_FILE_OVERWRITE_IF         0x05
 141
 142#define SMB_ERR_NOACCESS              0x00050001
 143
 144struct smb_header {
 145  unsigned char nbt_type;
 146  unsigned char nbt_flags;
 147  unsigned short nbt_length;
 148  unsigned char magic[4];
 149  unsigned char command;
 150  unsigned int status;
 151  unsigned char flags;
 152  unsigned short flags2;
 153  unsigned short pid_high;
 154  unsigned char signature[8];
 155  unsigned short pad;
 156  unsigned short tid;
 157  unsigned short pid;
 158  unsigned short uid;
 159  unsigned short mid;
 160} PACK;
 161
 162struct smb_negotiate_response {
 163  struct smb_header h;
 164  unsigned char word_count;
 165  unsigned short dialect_index;
 166  unsigned char security_mode;
 167  unsigned short max_mpx_count;
 168  unsigned short max_number_vcs;
 169  unsigned int max_buffer_size;
 170  unsigned int max_raw_size;
 171  unsigned int session_key;
 172  unsigned int capabilities;
 173  unsigned int system_time_low;
 174  unsigned int system_time_high;
 175  unsigned short server_time_zone;
 176  unsigned char encryption_key_length;
 177  unsigned short byte_count;
 178  char bytes[1];
 179} PACK;
 180
 181struct andx {
 182  unsigned char command;
 183  unsigned char pad;
 184  unsigned short offset;
 185} PACK;
 186
 187struct smb_setup {
 188  unsigned char word_count;
 189  struct andx andx;
 190  unsigned short max_buffer_size;
 191  unsigned short max_mpx_count;
 192  unsigned short vc_number;
 193  unsigned int session_key;
 194  unsigned short lengths[2];
 195  unsigned int pad;
 196  unsigned int capabilities;
 197  unsigned short byte_count;
 198  char bytes[1024];
 199} PACK;
 200
 201struct smb_tree_connect {
 202  unsigned char word_count;
 203  struct andx andx;
 204  unsigned short flags;
 205  unsigned short pw_len;
 206  unsigned short byte_count;
 207  char bytes[1024];
 208} PACK;
 209
 210struct smb_nt_create {
 211  unsigned char word_count;
 212  struct andx andx;
 213  unsigned char pad;
 214  unsigned short name_length;
 215  unsigned int flags;
 216  unsigned int root_fid;
 217  unsigned int access;
 218  curl_off_t allocation_size;
 219  unsigned int ext_file_attributes;
 220  unsigned int share_access;
 221  unsigned int create_disposition;
 222  unsigned int create_options;
 223  unsigned int impersonation_level;
 224  unsigned char security_flags;
 225  unsigned short byte_count;
 226  char bytes[1024];
 227} PACK;
 228
 229struct smb_nt_create_response {
 230  struct smb_header h;
 231  unsigned char word_count;
 232  struct andx andx;
 233  unsigned char op_lock_level;
 234  unsigned short fid;
 235  unsigned int create_disposition;
 236
 237  curl_off_t create_time;
 238  curl_off_t last_access_time;
 239  curl_off_t last_write_time;
 240  curl_off_t last_change_time;
 241  unsigned int ext_file_attributes;
 242  curl_off_t allocation_size;
 243  curl_off_t end_of_file;
 244} PACK;
 245
 246struct smb_read {
 247  unsigned char word_count;
 248  struct andx andx;
 249  unsigned short fid;
 250  unsigned int offset;
 251  unsigned short max_bytes;
 252  unsigned short min_bytes;
 253  unsigned int timeout;
 254  unsigned short remaining;
 255  unsigned int offset_high;
 256  unsigned short byte_count;
 257} PACK;
 258
 259struct smb_write {
 260  struct smb_header h;
 261  unsigned char word_count;
 262  struct andx andx;
 263  unsigned short fid;
 264  unsigned int offset;
 265  unsigned int timeout;
 266  unsigned short write_mode;
 267  unsigned short remaining;
 268  unsigned short pad;
 269  unsigned short data_length;
 270  unsigned short data_offset;
 271  unsigned int offset_high;
 272  unsigned short byte_count;
 273  unsigned char pad2;
 274} PACK;
 275
 276struct smb_close {
 277  unsigned char word_count;
 278  unsigned short fid;
 279  unsigned int last_mtime;
 280  unsigned short byte_count;
 281} PACK;
 282
 283struct smb_tree_disconnect {
 284  unsigned char word_count;
 285  unsigned short byte_count;
 286} PACK;
 287
 288#if defined(_MSC_VER) || defined(__ILEC400__)
 289#  pragma pack(pop)
 290#endif
 291
 292#define MAX_PAYLOAD_SIZE  0x8000
 293#define MAX_MESSAGE_SIZE  (MAX_PAYLOAD_SIZE + 0x1000)
 294#define CLIENTNAME        "curl"
 295#define SERVICENAME       "?????"
 296
 297/* SMB is mostly little endian */
 298#if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
 299  defined(__OS400__)
 300static unsigned short smb_swap16(unsigned short x)
 301{
 302  return (unsigned short)((x << 8) | ((x >> 8) & 0xff));
 303}
 304
 305static unsigned int smb_swap32(unsigned int x)
 306{
 307  return (x << 24) | ((x << 8) & 0xff0000) | ((x >> 8) & 0xff00) |
 308    ((x >> 24) & 0xff);
 309}
 310
 311static curl_off_t smb_swap64(curl_off_t x)
 312{
 313  return ((curl_off_t)smb_swap32((unsigned int)x) << 32) |
 314    smb_swap32((unsigned int)(x >> 32));
 315}
 316
 317#else
 318#  define smb_swap16(x) (x)
 319#  define smb_swap32(x) (x)
 320#  define smb_swap64(x) (x)
 321#endif
 322
 323static void conn_state(struct Curl_easy *data, struct smb_conn *smbc,
 324                       enum smb_conn_state newstate)
 325{
 326#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
 327  /* For debug purposes */
 328  static const char * const names[] = {
 329    "SMB_NOT_CONNECTED",
 330    "SMB_CONNECTING",
 331    "SMB_NEGOTIATE",
 332    "SMB_SETUP",
 333    "SMB_CONNECTED",
 334    /* LAST */
 335  };
 336
 337  if(smbc->state != newstate)
 338    infof(data, "SMB conn %p state change from %s to %s",
 339          (void *)smbc, names[smbc->state], names[newstate]);
 340#else
 341  (void)data;
 342#endif
 343  smbc->state = newstate;
 344}
 345
 346static void request_state(struct Curl_easy *data,
 347                          enum smb_req_state newstate)
 348{
 349  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
 350  if(req) {
 351#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
 352    /* For debug purposes */
 353    static const char * const names[] = {
 354      "SMB_REQUESTING",
 355      "SMB_TREE_CONNECT",
 356      "SMB_OPEN",
 357      "SMB_DOWNLOAD",
 358      "SMB_UPLOAD",
 359      "SMB_CLOSE",
 360      "SMB_TREE_DISCONNECT",
 361      "SMB_DONE",
 362      /* LAST */
 363    };
 364
 365    if(req->state != newstate)
 366      infof(data, "SMB request %p state change from %s to %s",
 367            (void *)req, names[req->state], names[newstate]);
 368#endif
 369
 370    req->state = newstate;
 371  }
 372}
 373
 374static void smb_easy_dtor(void *key, size_t klen, void *entry)
 375{
 376  struct smb_request *req = entry;
 377  (void)key;
 378  (void)klen;
 379  curlx_safefree(req->path);
 380  curlx_free(req);
 381}
 382
 383static void smb_conn_dtor(void *key, size_t klen, void *entry)
 384{
 385  struct smb_conn *smbc = entry;
 386  (void)key;
 387  (void)klen;
 388  curlx_safefree(smbc->share);
 389  curlx_safefree(smbc->domain);
 390  curlx_safefree(smbc->recv_buf);
 391  curlx_safefree(smbc->send_buf);
 392  curlx_free(smbc);
 393}
 394
 395static CURLcode smb_parse_url_path(struct Curl_easy *data,
 396                                   struct smb_conn *smbc,
 397                                   struct smb_request *req)
 398{
 399  char *path;
 400  char *slash, *s;
 401  CURLcode result;
 402
 403  /* URL decode the path */
 404  result = Curl_urldecode(data->state.up.path, 0, &path, NULL, REJECT_CTRL);
 405  if(result)
 406    return result;
 407
 408  /* Parse the path for the share */
 409  curlx_safefree(smbc->share);
 410  smbc->share = curlx_strdup((*path == '/' || *path == '\\')
 411                             ? path + 1 : path);
 412  curlx_free(path);
 413  if(!smbc->share)
 414    return CURLE_OUT_OF_MEMORY;
 415
 416  slash = strchr(smbc->share, '/');
 417  if(!slash)
 418    slash = strchr(smbc->share, '\\');
 419
 420  /* The share must be present */
 421  if(!slash) {
 422    curlx_safefree(smbc->share);
 423    failf(data, "missing share in URL path for SMB");
 424    return CURLE_URL_MALFORMAT;
 425  }
 426
 427  /* Parse the path for the file path converting any forward slashes into
 428     backslashes */
 429  *slash++ = 0;
 430  for(s = slash; *s; s++) {
 431    if(*s == '/')
 432      *s = '\\';
 433  }
 434  /* keep a copy at easy struct to not share this with connection state */
 435  req->path = curlx_strdup(slash);
 436  if(!req->path)
 437    return CURLE_OUT_OF_MEMORY;
 438
 439  return CURLE_OK;
 440}
 441
 442/* this should setup things in the connection, not in the easy
 443   handle */
 444static CURLcode smb_setup_connection(struct Curl_easy *data,
 445                                     struct connectdata *conn)
 446{
 447  struct smb_conn *smbc;
 448  struct smb_request *req;
 449
 450  /* Initialize the connection state */
 451  smbc = curlx_calloc(1, sizeof(*smbc));
 452  if(!smbc ||
 453     Curl_conn_meta_set(conn, CURL_META_SMB_CONN, smbc, smb_conn_dtor))
 454    return CURLE_OUT_OF_MEMORY;
 455
 456  /* Initialize the request state */
 457  req = curlx_calloc(1, sizeof(*req));
 458  if(!req ||
 459     Curl_meta_set(data, CURL_META_SMB_EASY, req, smb_easy_dtor))
 460    return CURLE_OUT_OF_MEMORY;
 461
 462  /* Parse the URL path */
 463  return smb_parse_url_path(data, smbc, req);
 464}
 465
 466static CURLcode smb_connect(struct Curl_easy *data, bool *done)
 467{
 468  struct connectdata *conn = data->conn;
 469  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
 470  char *slash;
 471  const char *user = Curl_creds_user(conn->creds);
 472
 473  (void)done;
 474  if(!smbc)
 475    return CURLE_FAILED_INIT;
 476
 477  /* Check we have a username and password to authenticate with */
 478  if(!Curl_creds_has_user(data->state.creds))
 479    return CURLE_LOGIN_DENIED;
 480
 481  /* Initialize the connection state */
 482  smbc->state = SMB_CONNECTING;
 483  smbc->recv_buf = curlx_malloc(MAX_MESSAGE_SIZE);
 484  if(!smbc->recv_buf)
 485    return CURLE_OUT_OF_MEMORY;
 486  smbc->send_buf = curlx_malloc(MAX_MESSAGE_SIZE);
 487  if(!smbc->send_buf)
 488    return CURLE_OUT_OF_MEMORY;
 489
 490  /* Parse the username, domain, and password */
 491  slash = strchr(user, '/');
 492  if(!slash)
 493    slash = strchr(user, '\\');
 494
 495  if(slash) {
 496    smbc->user = slash + 1;
 497    smbc->domain = curlx_strdup(user);
 498    if(!smbc->domain)
 499      return CURLE_OUT_OF_MEMORY;
 500    smbc->domain[slash - user] = 0;
 501  }
 502  else {
 503    smbc->user = user;
 504    smbc->domain = curlx_strdup(conn->origin->hostname);
 505    if(!smbc->domain)
 506      return CURLE_OUT_OF_MEMORY;
 507  }
 508
 509  return CURLE_OK;
 510}
 511
 512static CURLcode smb_recv_message(struct Curl_easy *data,
 513                                 struct smb_conn *smbc,
 514                                 void **msg)
 515{
 516  char *buf = smbc->recv_buf;
 517  size_t bytes_read;
 518  size_t nbt_size;
 519  size_t msg_size = sizeof(struct smb_header);
 520  size_t len = MAX_MESSAGE_SIZE - smbc->got;
 521  CURLcode result;
 522
 523  result = Curl_xfer_recv(data, buf + smbc->got, len, &bytes_read);
 524  if(result)
 525    return result;
 526
 527  if(!bytes_read)
 528    return CURLE_OK;
 529
 530  smbc->got += bytes_read;
 531
 532  /* Check for a 32-bit nbt header */
 533  if(smbc->got < sizeof(unsigned int))
 534    return CURLE_OK;
 535
 536  nbt_size = Curl_read16_be((const unsigned char *)
 537                            (buf + sizeof(unsigned short))) +
 538    sizeof(unsigned int);
 539  if(nbt_size > MAX_MESSAGE_SIZE) {
 540    failf(data, "too large NetBIOS frame size %zu", nbt_size);
 541    return CURLE_RECV_ERROR;
 542  }
 543  else if(nbt_size < msg_size) {
 544    /* Each SMB message must be at least this large, e.g. 32 bytes */
 545    failf(data, "too small NetBIOS frame size %zu", nbt_size);
 546    return CURLE_RECV_ERROR;
 547  }
 548
 549  if(smbc->got < nbt_size)
 550    return CURLE_OK;
 551
 552  if(nbt_size >= msg_size + 1) {
 553    /* Add the word count */
 554    msg_size += 1 + (((unsigned char)buf[msg_size]) * sizeof(unsigned short));
 555    if(nbt_size >= msg_size + sizeof(unsigned short)) {
 556      /* Add the byte count */
 557      msg_size += sizeof(unsigned short) +
 558        Curl_read16_le((const unsigned char *)&buf[msg_size]);
 559      if(nbt_size < msg_size)
 560        return CURLE_RECV_ERROR;
 561    }
 562  }
 563
 564  *msg = buf;
 565
 566  return CURLE_OK;
 567}
 568
 569static void smb_pop_message(struct smb_conn *smbc)
 570{
 571  smbc->got = 0;
 572}
 573
 574static void smb_format_message(struct smb_conn *smbc,
 575                               struct smb_request *req,
 576                               struct smb_header *h,
 577                               unsigned char cmd, size_t len)
 578{
 579  const unsigned int pid = 0xbad71d; /* made up */
 580
 581  memset(h, 0, sizeof(*h));
 582  h->nbt_length = htons((unsigned short)(sizeof(*h) - sizeof(unsigned int) +
 583                                         len));
 584  memcpy((char *)h->magic, "\xffSMB", 4);
 585  h->command = cmd;
 586  h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
 587  h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
 588  h->uid = smb_swap16(smbc->uid);
 589  h->tid = smb_swap16(req->tid);
 590  h->pid_high = smb_swap16((unsigned short)(pid >> 16));
 591  h->pid = smb_swap16((unsigned short)pid);
 592}
 593
 594static CURLcode smb_send(struct Curl_easy *data, struct smb_conn *smbc,
 595                         size_t len, size_t upload_size)
 596{
 597  size_t bytes_written;
 598  CURLcode result;
 599
 600  result = Curl_xfer_send(data, smbc->send_buf, len, FALSE, &bytes_written);
 601  if(result)
 602    return result;
 603
 604  if(bytes_written != len) {
 605    smbc->send_size = len;
 606    smbc->sent = bytes_written;
 607  }
 608
 609  smbc->upload_size = upload_size;
 610
 611  return CURLE_OK;
 612}
 613
 614static CURLcode smb_flush(struct Curl_easy *data, struct smb_conn *smbc)
 615{
 616  size_t bytes_written;
 617  size_t len = smbc->send_size - smbc->sent;
 618  CURLcode result;
 619
 620  if(!smbc->send_size)
 621    return CURLE_OK;
 622
 623  result = Curl_xfer_send(data, smbc->send_buf + smbc->sent, len, FALSE,
 624                          &bytes_written);
 625  if(result)
 626    return result;
 627
 628  if(bytes_written != len)
 629    smbc->sent += bytes_written;
 630  else
 631    smbc->send_size = 0;
 632
 633  return CURLE_OK;
 634}
 635
 636static CURLcode smb_send_message(struct Curl_easy *data,
 637                                 struct smb_conn *smbc,
 638                                 struct smb_request *req,
 639                                 unsigned char cmd,
 640                                 const void *msg, size_t msg_len)
 641{
 642  if((MAX_MESSAGE_SIZE - sizeof(struct smb_header)) < msg_len) {
 643    DEBUGASSERT(0);
 644    return CURLE_SEND_ERROR;
 645  }
 646  smb_format_message(smbc, req, (struct smb_header *)smbc->send_buf,
 647                     cmd, msg_len);
 648  memcpy(smbc->send_buf + sizeof(struct smb_header), msg, msg_len);
 649
 650  return smb_send(data, smbc, sizeof(struct smb_header) + msg_len, 0);
 651}
 652
 653static CURLcode smb_send_negotiate(struct Curl_easy *data,
 654                                   struct smb_conn *smbc,
 655                                   struct smb_request *req)
 656{
 657  const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
 658
 659  return smb_send_message(data, smbc, req, SMB_COM_NEGOTIATE, msg, 15);
 660}
 661
 662static CURLcode smb_send_setup(struct Curl_easy *data)
 663{
 664  struct connectdata *conn = data->conn;
 665  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
 666  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
 667  struct smb_setup msg;
 668  char *p = msg.bytes;
 669  unsigned char lm_hash[21];
 670  unsigned char lm[24];
 671  unsigned char nt_hash[21];
 672  unsigned char nt[24];
 673  size_t byte_count;
 674  const char *passwd = Curl_creds_passwd(conn->creds);
 675
 676  if(!smbc || !req)
 677    return CURLE_FAILED_INIT;
 678
 679  byte_count = sizeof(lm) + sizeof(nt) +
 680    strlen(smbc->user) + strlen(smbc->domain) +
 681    strlen(CURL_OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
 682  if(byte_count > sizeof(msg.bytes))
 683    return CURLE_FILESIZE_EXCEEDED;
 684
 685  Curl_ntlm_core_mk_lm_hash(passwd, lm_hash);
 686  Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
 687  Curl_ntlm_core_mk_nt_hash(passwd, nt_hash);
 688  Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
 689
 690  memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
 691  msg.word_count = SMB_WC_SETUP_ANDX;
 692  msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
 693  msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
 694  msg.max_mpx_count = smb_swap16(1);
 695  msg.vc_number = smb_swap16(1);
 696  msg.session_key = smb_swap32(smbc->session_key);
 697  msg.capabilities = smb_swap32(SMB_CAP_LARGE_FILES);
 698  msg.lengths[0] = smb_swap16(sizeof(lm));
 699  msg.lengths[1] = smb_swap16(sizeof(nt));
 700  memcpy(p, lm, sizeof(lm));
 701  p += sizeof(lm);
 702  memcpy(p, nt, sizeof(nt));
 703  p += sizeof(nt);
 704  p += curl_msnprintf(p, byte_count - sizeof(nt) - sizeof(lm),
 705                      "%s%c"  /* user */
 706                      "%s%c"  /* domain */
 707                      "%s%c"  /* OS */
 708                      "%s", /* client name */
 709                      smbc->user, 0, smbc->domain, 0, CURL_OS, 0, CLIENTNAME);
 710  p++; /* count the final null-termination */
 711  DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
 712  msg.byte_count = smb_swap16((unsigned short)byte_count);
 713
 714  return smb_send_message(data, smbc, req, SMB_COM_SETUP_ANDX, &msg,
 715                          sizeof(msg) - sizeof(msg.bytes) + byte_count);
 716}
 717
 718static CURLcode smb_send_tree_connect(struct Curl_easy *data,
 719                                      struct smb_conn *smbc,
 720                                      struct smb_request *req)
 721{
 722  struct smb_tree_connect msg;
 723  struct connectdata *conn = data->conn;
 724  char *p = msg.bytes;
 725  const size_t byte_count = strlen(conn->origin->hostname) +
 726    strlen(smbc->share) +
 727    strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
 728
 729  if(byte_count > sizeof(msg.bytes))
 730    return CURLE_FILESIZE_EXCEEDED;
 731
 732  memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
 733  msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
 734  msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
 735  msg.pw_len = 0;
 736
 737  p += curl_msnprintf(p, byte_count,
 738                      "\\\\%s\\"  /* hostname */
 739                      "%s%c"      /* share */
 740                      "%s",       /* service */
 741                      conn->origin->hostname, smbc->share, 0, SERVICENAME);
 742  p++; /* count the final null-termination */
 743  DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
 744  msg.byte_count = smb_swap16((unsigned short)byte_count);
 745
 746  return smb_send_message(data, smbc, req, SMB_COM_TREE_CONNECT_ANDX, &msg,
 747                          sizeof(msg) - sizeof(msg.bytes) + byte_count);
 748}
 749
 750static CURLcode smb_send_open(struct Curl_easy *data,
 751                              struct smb_conn *smbc,
 752                              struct smb_request *req)
 753{
 754  struct smb_nt_create msg;
 755  const size_t byte_count = strlen(req->path) + 1;
 756
 757  if(byte_count > sizeof(msg.bytes))
 758    return CURLE_FILESIZE_EXCEEDED;
 759
 760  memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
 761  msg.word_count = SMB_WC_NT_CREATE_ANDX;
 762  msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
 763  msg.name_length = smb_swap16((unsigned short)(byte_count - 1));
 764  msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
 765  if(data->state.upload) {
 766    msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
 767    msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
 768  }
 769  else {
 770    msg.access = smb_swap32(SMB_GENERIC_READ);
 771    msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
 772  }
 773  msg.byte_count = smb_swap16((unsigned short)byte_count);
 774  curlx_strcopy(msg.bytes, sizeof(msg.bytes), req->path, byte_count - 1);
 775
 776  return smb_send_message(data, smbc, req, SMB_COM_NT_CREATE_ANDX, &msg,
 777                          sizeof(msg) - sizeof(msg.bytes) + byte_count);
 778}
 779
 780static CURLcode smb_send_close(struct Curl_easy *data,
 781                               struct smb_conn *smbc,
 782                               struct smb_request *req)
 783{
 784  struct smb_close msg;
 785
 786  memset(&msg, 0, sizeof(msg));
 787  msg.word_count = SMB_WC_CLOSE;
 788  msg.fid = smb_swap16(req->fid);
 789
 790  return smb_send_message(data, smbc, req, SMB_COM_CLOSE, &msg, sizeof(msg));
 791}
 792
 793static CURLcode smb_send_tree_disconnect(struct Curl_easy *data,
 794                                         struct smb_conn *smbc,
 795                                         struct smb_request *req)
 796{
 797  struct smb_tree_disconnect msg;
 798  memset(&msg, 0, sizeof(msg));
 799  return smb_send_message(data, smbc, req, SMB_COM_TREE_DISCONNECT,
 800                          &msg, sizeof(msg));
 801}
 802
 803static CURLcode smb_send_read(struct Curl_easy *data,
 804                              struct smb_conn *smbc,
 805                              struct smb_request *req)
 806{
 807  curl_off_t offset = data->req.offset;
 808  struct smb_read msg;
 809
 810  memset(&msg, 0, sizeof(msg));
 811  msg.word_count = SMB_WC_READ_ANDX;
 812  msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
 813  msg.fid = smb_swap16(req->fid);
 814  msg.offset = smb_swap32((unsigned int)offset);
 815  msg.offset_high = smb_swap32((unsigned int)(offset >> 32));
 816  msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
 817  msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
 818
 819  return smb_send_message(data, smbc, req, SMB_COM_READ_ANDX,
 820                          &msg, sizeof(msg));
 821}
 822
 823static CURLcode smb_send_write(struct Curl_easy *data,
 824                               struct smb_conn *smbc,
 825                               struct smb_request *req)
 826{
 827  struct smb_write *msg;
 828  curl_off_t offset = data->req.offset;
 829  curl_off_t upload_size = data->req.size - data->req.bytecount;
 830
 831  msg = (struct smb_write *)smbc->send_buf;
 832  if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
 833    upload_size = MAX_PAYLOAD_SIZE - 1;
 834
 835  memset(msg, 0, sizeof(*msg));
 836  msg->word_count = SMB_WC_WRITE_ANDX;
 837  msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
 838  msg->fid = smb_swap16(req->fid);
 839  msg->offset = smb_swap32((unsigned int)offset);
 840  msg->offset_high = smb_swap32((unsigned int)(offset >> 32));
 841  msg->data_length = smb_swap16((unsigned short)upload_size);
 842  msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
 843  msg->byte_count = smb_swap16((unsigned short)(upload_size + 1));
 844
 845  smb_format_message(smbc, req, &msg->h, SMB_COM_WRITE_ANDX,
 846                     sizeof(*msg) - sizeof(msg->h) + (size_t)upload_size);
 847
 848  return smb_send(data, smbc, sizeof(*msg), (size_t)upload_size);
 849}
 850
 851static CURLcode smb_send_and_recv(struct Curl_easy *data,
 852                                  struct smb_conn *smbc, void **msg)
 853{
 854  CURLcode result;
 855  *msg = NULL; /* if it returns early */
 856
 857  /* Check if there is data in the transfer buffer */
 858  if(!smbc->send_size && smbc->upload_size) {
 859    size_t nread = smbc->upload_size > (size_t)MAX_MESSAGE_SIZE ?
 860      (size_t)MAX_MESSAGE_SIZE : smbc->upload_size;
 861    bool eos;
 862
 863    result = Curl_client_read(data, smbc->send_buf, nread, &nread, &eos);
 864    if(result && result != CURLE_AGAIN)
 865      return result;
 866    if(!nread)
 867      return CURLE_OK;
 868
 869    smbc->upload_size -= nread;
 870    smbc->send_size = nread;
 871    smbc->sent = 0;
 872  }
 873
 874  /* Check if there is data to send */
 875  if(smbc->send_size) {
 876    result = smb_flush(data, smbc);
 877    if(result)
 878      return result;
 879  }
 880
 881  /* Check if there is still data to be sent */
 882  if(smbc->send_size || smbc->upload_size)
 883    return CURLE_AGAIN;
 884
 885  return smb_recv_message(data, smbc, msg);
 886}
 887
 888static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
 889{
 890  struct connectdata *conn = data->conn;
 891  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
 892  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
 893  struct smb_negotiate_response *nrsp;
 894  struct smb_header *h;
 895  CURLcode result;
 896  void *msg = NULL;
 897
 898  if(!smbc || !req)
 899    return CURLE_FAILED_INIT;
 900
 901  if(smbc->state == SMB_CONNECTING) {
 902#ifdef USE_SSL
 903    if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
 904      bool ssl_done = FALSE;
 905      result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
 906      if(result && result != CURLE_AGAIN)
 907        return result;
 908      if(!ssl_done)
 909        return CURLE_OK;
 910    }
 911#endif
 912
 913    result = smb_send_negotiate(data, smbc, req);
 914    if(result) {
 915      connclose(conn, "SMB: failed to send negotiate message");
 916      return result;
 917    }
 918
 919    conn_state(data, smbc, SMB_NEGOTIATE);
 920  }
 921
 922  /* Send the previous message and check for a response */
 923  result = smb_send_and_recv(data, smbc, &msg);
 924  if(result && result != CURLE_AGAIN) {
 925    connclose(conn, "SMB: failed to communicate");
 926    return result;
 927  }
 928
 929  if(!msg)
 930    return CURLE_OK;
 931
 932  h = msg;
 933
 934  switch(smbc->state) {
 935  case SMB_NEGOTIATE:
 936    if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
 937       h->status) {
 938      connclose(conn, "SMB: negotiation failed");
 939      return CURLE_COULDNT_CONNECT;
 940    }
 941    nrsp = msg;
 942#if defined(__GNUC__) && __GNUC__ >= 13
 943#pragma GCC diagnostic push
 944/* error: 'memcpy' offset [74, 80] from the object at '<unknown>' is out of
 945   the bounds of referenced subobject 'bytes' with type 'char[1]' */
 946#pragma GCC diagnostic ignored "-Warray-bounds"
 947#endif
 948    memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
 949#if defined(__GNUC__) && __GNUC__ >= 13
 950#pragma GCC diagnostic pop
 951#endif
 952    smbc->session_key = smb_swap32(nrsp->session_key);
 953    result = smb_send_setup(data);
 954    if(result) {
 955      connclose(conn, "SMB: failed to send setup message");
 956      return result;
 957    }
 958    conn_state(data, smbc, SMB_SETUP);
 959    break;
 960
 961  case SMB_SETUP:
 962    if(h->status) {
 963      connclose(conn, "SMB: authentication failed");
 964      return CURLE_LOGIN_DENIED;
 965    }
 966    smbc->uid = smb_swap16(h->uid);
 967    conn_state(data, smbc, SMB_CONNECTED);
 968    *done = TRUE;
 969    break;
 970
 971  default:
 972    smb_pop_message(smbc);
 973    return CURLE_OK; /* ignore */
 974  }
 975
 976  smb_pop_message(smbc);
 977
 978  return CURLE_OK;
 979}
 980
 981/*
 982 * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
 983 * to POSIX time. Cap the output to fit within a time_t.
 984 */
 985static void get_posix_time(time_t *out, curl_off_t timestamp)
 986{
 987  if(timestamp >= (curl_off_t)116444736000000000) {
 988    timestamp -= (curl_off_t)116444736000000000;
 989    timestamp /= 10000000;
 990#if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
 991    if(timestamp > TIME_T_MAX)
 992      *out = TIME_T_MAX;
 993    else if(timestamp < TIME_T_MIN)
 994      *out = TIME_T_MIN;
 995    else
 996#endif
 997      *out = (time_t)timestamp;
 998  }
 999  else
1000    *out = 0;
1001}
1002
1003static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
1004{
1005  struct connectdata *conn = data->conn;
1006  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
1007  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
1008  struct smb_header *h;
1009  enum smb_req_state next_state = SMB_DONE;
1010  unsigned short len;
1011  unsigned short off;
1012  CURLcode result;
1013  void *msg = NULL;
1014  const struct smb_nt_create_response *smb_m;
1015
1016  if(!smbc || !req)
1017    return CURLE_FAILED_INIT;
1018
1019  if(data->state.upload && (data->state.infilesize < 0)) {
1020    failf(data, "SMB upload needs to know the size up front");
1021    return CURLE_SEND_ERROR;
1022  }
1023
1024  /* Start the request */
1025  if(req->state == SMB_REQUESTING) {
1026    result = smb_send_tree_connect(data, smbc, req);
1027    if(result) {
1028      connclose(conn, "SMB: failed to send tree connect message");
1029      return result;
1030    }
1031
1032    request_state(data, SMB_TREE_CONNECT);
1033  }
1034
1035  /* Send the previous message and check for a response */
1036  result = smb_send_and_recv(data, smbc, &msg);
1037  if(result && result != CURLE_AGAIN) {
1038    connclose(conn, "SMB: failed to communicate");
1039    return result;
1040  }
1041
1042  if(!msg)
1043    return CURLE_OK;
1044
1045  h = msg;
1046
1047  switch(req->state) {
1048  case SMB_TREE_CONNECT:
1049    if(h->status) {
1050      req->result = CURLE_REMOTE_FILE_NOT_FOUND;
1051      if(h->status == smb_swap32(SMB_ERR_NOACCESS))
1052        req->result = CURLE_REMOTE_ACCESS_DENIED;
1053      break;
1054    }
1055    req->tid = smb_swap16(h->tid);
1056    next_state = SMB_OPEN;
1057    break;
1058
1059  case SMB_OPEN:
1060    if(h->status || smbc->got < sizeof(struct smb_nt_create_response)) {
1061      req->result = CURLE_REMOTE_FILE_NOT_FOUND;
1062      if(h->status == smb_swap32(SMB_ERR_NOACCESS))
1063        req->result = CURLE_REMOTE_ACCESS_DENIED;
1064      next_state = SMB_TREE_DISCONNECT;
1065      break;
1066    }
1067    smb_m = (const struct smb_nt_create_response *)msg;
1068    req->fid = smb_swap16(smb_m->fid);
1069    data->req.offset = 0;
1070    if(data->state.upload) {
1071      data->req.size = data->state.infilesize;
1072      Curl_pgrsSetUploadSize(data, data->req.size);
1073      next_state = SMB_UPLOAD;
1074    }
1075    else {
1076      data->req.size = smb_swap64(smb_m->end_of_file);
1077      if(data->req.size < 0) {
1078        req->result = CURLE_WEIRD_SERVER_REPLY;
1079        next_state = SMB_CLOSE;
1080      }
1081      else {
1082        Curl_pgrsSetDownloadSize(data, data->req.size);
1083        if(data->set.get_filetime)
1084          get_posix_time(&data->info.filetime, smb_m->last_change_time);
1085        next_state = SMB_DOWNLOAD;
1086      }
1087    }
1088    break;
1089
1090  case SMB_DOWNLOAD:
1091    if(h->status || smbc->got < sizeof(struct smb_header) + 15) {
1092      req->result = CURLE_RECV_ERROR;
1093      next_state = SMB_CLOSE;
1094      break;
1095    }
1096    len = Curl_read16_le((const unsigned char *)msg +
1097                         sizeof(struct smb_header) + 11);
1098    off = Curl_read16_le((const unsigned char *)msg +
1099                         sizeof(struct smb_header) + 13);
1100    if(len > 0) {
1101      if(off + sizeof(unsigned int) + len > smbc->got) {
1102        failf(data, "Invalid input packet");
1103        result = CURLE_RECV_ERROR;
1104      }
1105      else
1106        result = Curl_client_write(data, CLIENTWRITE_BODY,
1107                                   (char *)msg + off + sizeof(unsigned int),
1108                                   len);
1109      if(result) {
1110        req->result = result;
1111        next_state = SMB_CLOSE;
1112        break;
1113      }
1114    }
1115    data->req.offset += len;
1116    next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
1117    break;
1118
1119  case SMB_UPLOAD:
1120    if(h->status || smbc->got < sizeof(struct smb_header) + 7) {
1121      req->result = CURLE_UPLOAD_FAILED;
1122      next_state = SMB_CLOSE;
1123      break;
1124    }
1125    len = Curl_read16_le((const unsigned char *)msg +
1126                         sizeof(struct smb_header) + 5);
1127    data->req.bytecount += len;
1128    data->req.offset += len;
1129    Curl_pgrs_upload_inc(data, len);
1130    if(data->req.bytecount >= data->req.size)
1131      next_state = SMB_CLOSE;
1132    else
1133      next_state = SMB_UPLOAD;
1134    break;
1135
1136  case SMB_CLOSE:
1137    /* We do not care if the close failed, proceed to tree disconnect anyway */
1138    next_state = SMB_TREE_DISCONNECT;
1139    break;
1140
1141  case SMB_TREE_DISCONNECT:
1142    next_state = SMB_DONE;
1143    break;
1144
1145  default:
1146    smb_pop_message(smbc);
1147    return CURLE_OK; /* ignore */
1148  }
1149
1150  smb_pop_message(smbc);
1151
1152  switch(next_state) {
1153  case SMB_OPEN:
1154    result = smb_send_open(data, smbc, req);
1155    break;
1156
1157  case SMB_DOWNLOAD:
1158    result = smb_send_read(data, smbc, req);
1159    break;
1160
1161  case SMB_UPLOAD:
1162    result = smb_send_write(data, smbc, req);
1163    break;
1164
1165  case SMB_CLOSE:
1166    result = smb_send_close(data, smbc, req);
1167    break;
1168
1169  case SMB_TREE_DISCONNECT:
1170    result = smb_send_tree_disconnect(data, smbc, req);
1171    break;
1172
1173  case SMB_DONE:
1174    result = req->result;
1175    *done = TRUE;
1176    break;
1177
1178  default:
1179    break;
1180  }
1181
1182  if(result) {
1183    connclose(conn, "SMB: failed to send message");
1184    return result;
1185  }
1186
1187  request_state(data, next_state);
1188
1189  return CURLE_OK;
1190}
1191
1192static CURLcode smb_pollset(struct Curl_easy *data,
1193                            struct easy_pollset *ps)
1194{
1195  return Curl_pollset_add_inout(data, ps, data->conn->sock[FIRSTSOCKET]);
1196}
1197
1198static CURLcode smb_do(struct Curl_easy *data, bool *done)
1199{
1200  struct connectdata *conn = data->conn;
1201  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
1202
1203  *done = FALSE;
1204  if(!smbc)
1205    return CURLE_FAILED_INIT;
1206  if(smbc->share)
1207    return CURLE_OK;
1208  return CURLE_URL_MALFORMAT;
1209}
1210
1211/*
1212 * SMB handler interface
1213 */
1214const struct Curl_protocol Curl_protocol_smb = {
1215  smb_setup_connection,                 /* setup_connection */
1216  smb_do,                               /* do_it */
1217  ZERO_NULL,                            /* done */
1218  ZERO_NULL,                            /* do_more */
1219  smb_connect,                          /* connect_it */
1220  smb_connection_state,                 /* connecting */
1221  smb_request_state,                    /* doing */
1222  smb_pollset,                          /* proto_pollset */
1223  smb_pollset,                          /* doing_pollset */
1224  ZERO_NULL,                            /* domore_pollset */
1225  ZERO_NULL,                            /* perform_pollset */
1226  ZERO_NULL,                            /* disconnect */
1227  ZERO_NULL,                            /* write_resp */
1228  ZERO_NULL,                            /* write_resp_hd */
1229  ZERO_NULL,                            /* connection_is_dead */
1230  ZERO_NULL,                            /* attach connection */
1231  ZERO_NULL,                            /* follow */
1232};
1233
1234#endif /* CURL_ENABLE_SMB && USE_CURL_NTLM_CORE && SIZEOF_CURL_OFF_T > 4 */