]> bbs.cooldavid.org Git - net-next-2.6.git/blame - fs/cifs/connect.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
x86_64: Ignore compat mode SYSCALL when IA32_EMULATION is not defined
[net-next-2.6.git] / fs / cifs / connect.c
CommitLineData
1da177e4
LT		 1/*
2 * fs/cifs/connect.c
3 *
5815449d 4 * Copyright (C) International Business Machines Corp., 2002,2006
1da177e4
LT		 5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21#include <linux/fs.h>
22#include <linux/net.h>
23#include <linux/string.h>
24#include <linux/list.h>
25#include <linux/wait.h>
26#include <linux/ipv6.h>
27#include <linux/pagemap.h>
28#include <linux/ctype.h>
29#include <linux/utsname.h>
30#include <linux/mempool.h>
b8643e1b 31#include <linux/delay.h>
f191401f 32#include <linux/completion.h>
aaf737ad 33#include <linux/kthread.h>
0ae0efad 34#include <linux/pagevec.h>
7dfb7103 35#include <linux/freezer.h>
1da177e4
LT		 36#include <asm/uaccess.h>
37#include <asm/processor.h>
38#include "cifspdu.h"
39#include "cifsglob.h"
40#include "cifsproto.h"
41#include "cifs_unicode.h"
42#include "cifs_debug.h"
43#include "cifs_fs_sb.h"
44#include "ntlmssp.h"
45#include "nterr.h"
46#include "rfc1002pdu.h"
a2653eba 47#include "cn_cifs.h"
1da177e4
LT		 48
49#define CIFS_PORT 445
50#define RFC1001_PORT 139
51
f191401f
SF		 52static DECLARE_COMPLETION(cifsd_complete);
53
1da177e4
LT		 54extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
55 unsigned char *p24);
56
57extern mempool_t *cifs_req_poolp;
58
59struct smb_vol {
60 char *username;
61 char *password;
62 char *domainname;
63 char *UNC;
64 char *UNCip;
65 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
66 char *iocharset; /* local code page for mapping to and from Unicode */
67 char source_rfc1001_name[16]; /* netbios name of client */
a10faeb2 68 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
1da177e4
LT		 69 uid_t linux_uid;
70 gid_t linux_gid;
71 mode_t file_mode;
72 mode_t dir_mode;
189acaae 73 unsigned secFlg;
1da177e4
LT		 74 unsigned rw:1;
75 unsigned retry:1;
76 unsigned intr:1;
77 unsigned setuids:1;
4523cc30
SF		 78 unsigned override_uid:1;
79 unsigned override_gid:1;
1da177e4
LT		 80 unsigned noperm:1;
81 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
0a4b92c0 82 unsigned cifs_acl:1;
1da177e4
LT		 83 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
84 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
85 unsigned direct_io:1;
6a0b4824 86 unsigned remap:1; /* set to remap seven reserved chars in filenames */
ac67055e 87 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
d7245c2c 88 unsigned sfu_emul:1;
bf820679 89 unsigned nullauth:1; /* attempt to authenticate with null user */
c46fa8ac
SF		 90 unsigned nocase; /* request case insensitive filenames */
91 unsigned nobrl; /* disable sending byte range locks to srv */
1da177e4
LT		 92 unsigned int rsize;
93 unsigned int wsize;
94 unsigned int sockopt;
95 unsigned short int port;
2fe87f02 96 char * prepath;
1da177e4
LT		 97};
98
99static int ipv4_connect(struct sockaddr_in *psin_server,
100 struct socket **csocket,
a10faeb2
SF		 101 char * netb_name,
102 char * server_netb_name);
1da177e4
LT		 103static int ipv6_connect(struct sockaddr_in6 *psin_server,
104 struct socket **csocket);
105
106
107 /*
108 * cifs tcp session reconnection
109 *
110 * mark tcp session as reconnecting so temporarily locked
111 * mark all smb sessions as reconnecting for tcp session
112 * reconnect tcp session
113 * wake up waiters on reconnection? - (not needed currently)
114 */
115
2cd646a2 116static int
1da177e4
LT		 117cifs_reconnect(struct TCP_Server_Info *server)
118{
119 int rc = 0;
120 struct list_head *tmp;
121 struct cifsSesInfo *ses;
122 struct cifsTconInfo *tcon;
123 struct mid_q_entry * mid_entry;
124
125 spin_lock(&GlobalMid_Lock);
aaf737ad 126 if( kthread_should_stop() ) {
1da177e4
LT		 127 /* the demux thread will exit normally
128 next time through the loop */
129 spin_unlock(&GlobalMid_Lock);
130 return rc;
131 } else
132 server->tcpStatus = CifsNeedReconnect;
133 spin_unlock(&GlobalMid_Lock);
134 server->maxBuf = 0;
135
e4eb295d 136 cFYI(1, ("Reconnecting tcp session"));
1da177e4
LT		 137
138 /* before reconnecting the tcp session, mark the smb session (uid)
139 and the tid bad so they are not used until reconnected */
140 read_lock(&GlobalSMBSeslock);
141 list_for_each(tmp, &GlobalSMBSessionList) {
142 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
143 if (ses->server) {
144 if (ses->server == server) {
145 ses->status = CifsNeedReconnect;
146 ses->ipc_tid = 0;
147 }
148 }
149 /* else tcp and smb sessions need reconnection */
150 }
151 list_for_each(tmp, &GlobalTreeConnectionList) {
152 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
153 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
154 tcon->tidStatus = CifsNeedReconnect;
155 }
156 }
157 read_unlock(&GlobalSMBSeslock);
158 /* do not want to be sending data on a socket we are freeing */
159 down(&server->tcpSem);
160 if(server->ssocket) {
161 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
162 server->ssocket->flags));
163 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
164 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
165 server->ssocket->flags));
166 sock_release(server->ssocket);
167 server->ssocket = NULL;
168 }
169
170 spin_lock(&GlobalMid_Lock);
171 list_for_each(tmp, &server->pending_mid_q) {
172 mid_entry = list_entry(tmp, struct
173 mid_q_entry,
174 qhead);
175 if(mid_entry) {
176 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
09d1db5c
SF		 177 /* Mark other intransit requests as needing
178 retry so we do not immediately mark the
179 session bad again (ie after we reconnect
180 below) as they timeout too */
1da177e4
LT		 181 mid_entry->midState = MID_RETRY_NEEDED;
182 }
183 }
184 }
185 spin_unlock(&GlobalMid_Lock);
186 up(&server->tcpSem);
187
aaf737ad 188 while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood))
1da177e4 189 {
6c3d8909 190 try_to_freeze();
1da177e4
LT		 191 if(server->protocolType == IPV6) {
192 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
193 } else {
194 rc = ipv4_connect(&server->addr.sockAddr,
195 &server->ssocket,
a10faeb2
SF		 196 server->workstation_RFC1001_name,
197 server->server_RFC1001_name);
1da177e4
LT		 198 }
199 if(rc) {
b387eaeb 200 cFYI(1,("reconnect error %d",rc));
0cb766ae 201 msleep(3000);
1da177e4
LT		 202 } else {
203 atomic_inc(&tcpSesReconnectCount);
204 spin_lock(&GlobalMid_Lock);
aaf737ad 205 if( !kthread_should_stop() )
1da177e4 206 server->tcpStatus = CifsGood;
ad009ac9
SF		 207 server->sequence_number = 0;
208 spin_unlock(&GlobalMid_Lock);
1da177e4
LT		 209 /* atomic_set(&server->inFlight,0);*/
210 wake_up(&server->response_q);
211 }
212 }
213 return rc;
214}
215
e4eb295d
SF		 216/*
217 return codes:
218 0 not a transact2, or all data present
219 >0 transact2 with that much data missing
220 -EINVAL = invalid transact2
221
222 */
223static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
224{
225 struct smb_t2_rsp * pSMBt;
226 int total_data_size;
227 int data_in_this_rsp;
228 int remaining;
229
230 if(pSMB->Command != SMB_COM_TRANSACTION2)
231 return 0;
232
233 /* check for plausible wct, bcc and t2 data and parm sizes */
234 /* check for parm and data offset going beyond end of smb */
235 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
236 cFYI(1,("invalid transact2 word count"));
237 return -EINVAL;
238 }
239
240 pSMBt = (struct smb_t2_rsp *)pSMB;
241
242 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
243 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
244
245 remaining = total_data_size - data_in_this_rsp;
246
247 if(remaining == 0)
248 return 0;
249 else if(remaining < 0) {
250 cFYI(1,("total data %d smaller than data in frame %d",
251 total_data_size, data_in_this_rsp));
252 return -EINVAL;
253 } else {
254 cFYI(1,("missing %d bytes from transact2, check next response",
255 remaining));
256 if(total_data_size > maxBufSize) {
257 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
258 total_data_size,maxBufSize));
259 return -EINVAL;
260 }
261 return remaining;
262 }
263}
264
265static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
266{
267 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
268 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
269 int total_data_size;
270 int total_in_buf;
271 int remaining;
272 int total_in_buf2;
273 char * data_area_of_target;
274 char * data_area_of_buf2;
275 __u16 byte_count;
276
277 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
278
279 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
280 cFYI(1,("total data sizes of primary and secondary t2 differ"));
281 }
282
283 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
284
285 remaining = total_data_size - total_in_buf;
286
287 if(remaining < 0)
288 return -EINVAL;
289
290 if(remaining == 0) /* nothing to do, ignore */
291 return 0;
292
293 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
294 if(remaining < total_in_buf2) {
295 cFYI(1,("transact2 2nd response contains too much data"));
296 }
297
298 /* find end of first SMB data area */
299 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
300 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
301 /* validate target area */
302
303 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
304 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
305
306 data_area_of_target += total_in_buf;
307
308 /* copy second buffer into end of first buffer */
309 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
310 total_in_buf += total_in_buf2;
311 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
312 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
313 byte_count += total_in_buf2;
314 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
315
70ca734a 316 byte_count = pTargetSMB->smb_buf_length;
e4eb295d
SF		 317 byte_count += total_in_buf2;
318
319 /* BB also add check that we are not beyond maximum buffer size */
320
70ca734a 321 pTargetSMB->smb_buf_length = byte_count;
e4eb295d
SF		 322
323 if(remaining == total_in_buf2) {
324 cFYI(1,("found the last secondary response"));
325 return 0; /* we are done */
326 } else /* more responses to go */
327 return 1;
328
329}
330
1da177e4
LT		 331static int
332cifs_demultiplex_thread(struct TCP_Server_Info *server)
333{
334 int length;
335 unsigned int pdu_length, total_read;
336 struct smb_hdr *smb_buffer = NULL;
b8643e1b
SF		 337 struct smb_hdr *bigbuf = NULL;
338 struct smb_hdr *smallbuf = NULL;
1da177e4
LT		 339 struct msghdr smb_msg;
340 struct kvec iov;
341 struct socket *csocket = server->ssocket;
342 struct list_head *tmp;
343 struct cifsSesInfo *ses;
344 struct task_struct *task_to_wake = NULL;
345 struct mid_q_entry *mid_entry;
70ca734a 346 char temp;
b8643e1b 347 int isLargeBuf = FALSE;
e4eb295d
SF		 348 int isMultiRsp;
349 int reconnect;
1da177e4 350
1da177e4
LT		 351 allow_signal(SIGKILL);
352 current->flags |= PF_MEMALLOC;
353 server->tsk = current; /* save process info to wake at shutdown */
354 cFYI(1, ("Demultiplex PID: %d", current->pid));
355 write_lock(&GlobalSMBSeslock);
356 atomic_inc(&tcpSesAllocCount);
357 length = tcpSesAllocCount.counter;
358 write_unlock(&GlobalSMBSeslock);
f191401f 359 complete(&cifsd_complete);
1da177e4
LT		 360 if(length > 1) {
361 mempool_resize(cifs_req_poolp,
362 length + cifs_min_rcv,
363 GFP_KERNEL);
364 }
365
aaf737ad 366 while (!kthread_should_stop()) {
ede1327e
SF		 367 if (try_to_freeze())
368 continue;
b8643e1b
SF		 369 if (bigbuf == NULL) {
370 bigbuf = cifs_buf_get();
0fd1ffe0
PM		 371 if (!bigbuf) {
372 cERROR(1, ("No memory for large SMB response"));
b8643e1b
SF		 373 msleep(3000);
374 /* retry will check if exiting */
375 continue;
376 }
0fd1ffe0
PM		 377 } else if (isLargeBuf) {
378 /* we are reusing a dirty large buf, clear its start */
b8643e1b 379 memset(bigbuf, 0, sizeof (struct smb_hdr));
1da177e4 380 }
b8643e1b
SF		 381
382 if (smallbuf == NULL) {
383 smallbuf = cifs_small_buf_get();
0fd1ffe0
PM		 384 if (!smallbuf) {
385 cERROR(1, ("No memory for SMB response"));
b8643e1b
SF		 386 msleep(1000);
387 /* retry will check if exiting */
388 continue;
389 }
390 /* beginning of smb buffer is cleared in our buf_get */
391 } else /* if existing small buf clear beginning */
392 memset(smallbuf, 0, sizeof (struct smb_hdr));
393
394 isLargeBuf = FALSE;
e4eb295d 395 isMultiRsp = FALSE;
b8643e1b 396 smb_buffer = smallbuf;
1da177e4
LT		 397 iov.iov_base = smb_buffer;
398 iov.iov_len = 4;
399 smb_msg.msg_control = NULL;
400 smb_msg.msg_controllen = 0;
401 length =
402 kernel_recvmsg(csocket, &smb_msg,
403 &iov, 1, 4, 0 /* BB see socket.h flags */);
404
aaf737ad 405 if ( kthread_should_stop() ) {
1da177e4
LT		 406 break;
407 } else if (server->tcpStatus == CifsNeedReconnect) {
0fd1ffe0 408 cFYI(1, ("Reconnect after server stopped responding"));
1da177e4 409 cifs_reconnect(server);
0fd1ffe0 410 cFYI(1, ("call to reconnect done"));
1da177e4
LT		 411 csocket = server->ssocket;
412 continue;
413 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
b8643e1b 414 msleep(1); /* minimum sleep to prevent looping
1da177e4
LT		 415 allowing socket to clear and app threads to set
416 tcpStatus CifsNeedReconnect if server hung */
417 continue;
418 } else if (length <= 0) {
0fd1ffe0
PM		 419 if (server->tcpStatus == CifsNew) {
420 cFYI(1, ("tcp session abend after SMBnegprot"));
09d1db5c
SF		 421 /* some servers kill the TCP session rather than
422 returning an SMB negprot error, in which
423 case reconnecting here is not going to help,
424 and so simply return error to mount */
1da177e4
LT		 425 break;
426 }
0fd1ffe0 427 if (!try_to_freeze() && (length == -EINTR)) {
1da177e4
LT		 428 cFYI(1,("cifsd thread killed"));
429 break;
430 }
57337e42
SF		 431 cFYI(1,("Reconnect after unexpected peek error %d",
432 length));
1da177e4
LT		 433 cifs_reconnect(server);
434 csocket = server->ssocket;
435 wake_up(&server->response_q);
436 continue;
46810cbf
SF		 437 } else if (length < 4) {
438 cFYI(1,
57337e42 439 ("Frame under four bytes received (%d bytes long)",
46810cbf
SF		 440 length));
441 cifs_reconnect(server);
442 csocket = server->ssocket;
443 wake_up(&server->response_q);
444 continue;
445 }
1da177e4 446
70ca734a
SF		 447 /* The right amount was read from socket - 4 bytes */
448 /* so we can now interpret the length field */
46810cbf 449
70ca734a
SF		 450 /* the first byte big endian of the length field,
451 is actually not part of the length but the type
452 with the most common, zero, as regular data */
453 temp = *((char *) smb_buffer);
46810cbf 454
70ca734a
SF		 455 /* Note that FC 1001 length is big endian on the wire,
456 but we convert it here so it is always manipulated
457 as host byte order */
46810cbf 458 pdu_length = ntohl(smb_buffer->smb_buf_length);
70ca734a
SF		 459 smb_buffer->smb_buf_length = pdu_length;
460
461 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
46810cbf 462
70ca734a 463 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
e4eb295d 464 continue;
70ca734a 465 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
e4eb295d
SF		 466 cFYI(1,("Good RFC 1002 session rsp"));
467 continue;
70ca734a 468 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
46810cbf
SF		 469 /* we get this from Windows 98 instead of
470 an error on SMB negprot response */
e4eb295d 471 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
70ca734a 472 pdu_length));
46810cbf
SF		 473 if(server->tcpStatus == CifsNew) {
474 /* if nack on negprot (rather than
475 ret of smb negprot error) reconnecting
476 not going to help, ret error to mount */
477 break;
478 } else {
479 /* give server a second to
480 clean up before reconnect attempt */
481 msleep(1000);
482 /* always try 445 first on reconnect
483 since we get NACK on some if we ever
484 connected to port 139 (the NACK is
485 since we do not begin with RFC1001
486 session initialize frame) */
487 server->addr.sockAddr.sin_port =
488 htons(CIFS_PORT);
1da177e4
LT		 489 cifs_reconnect(server);
490 csocket = server->ssocket;
46810cbf 491 wake_up(&server->response_q);
1da177e4 492 continue;
46810cbf 493 }
70ca734a 494 } else if (temp != (char) 0) {
46810cbf 495 cERROR(1,("Unknown RFC 1002 frame"));
70ca734a
SF		 496 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
497 length);
46810cbf
SF		 498 cifs_reconnect(server);
499 csocket = server->ssocket;
500 continue;
e4eb295d
SF		 501 }
502
503 /* else we have an SMB response */
504 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
46810cbf 505 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
e4eb295d 506 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
46810cbf 507 length, pdu_length+4));
e4eb295d
SF		 508 cifs_reconnect(server);
509 csocket = server->ssocket;
510 wake_up(&server->response_q);
511 continue;
512 }
513
514 /* else length ok */
515 reconnect = 0;
516
ec637e3f 517 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
e4eb295d
SF		 518 isLargeBuf = TRUE;
519 memcpy(bigbuf, smallbuf, 4);
520 smb_buffer = bigbuf;
521 }
522 length = 0;
523 iov.iov_base = 4 + (char *)smb_buffer;
524 iov.iov_len = pdu_length;
525 for (total_read = 0; total_read < pdu_length;
526 total_read += length) {
527 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
528 pdu_length - total_read, 0);
aaf737ad 529 if( kthread_should_stop() ||
e4eb295d
SF		 530 (length == -EINTR)) {
531 /* then will exit */
532 reconnect = 2;
533 break;
534 } else if (server->tcpStatus == CifsNeedReconnect) {
46810cbf
SF		 535 cifs_reconnect(server);
536 csocket = server->ssocket;
e4eb295d
SF		 537 /* Reconnect wakes up rspns q */
538 /* Now we will reread sock */
539 reconnect = 1;
540 break;
541 } else if ((length == -ERESTARTSYS) ||
542 (length == -EAGAIN)) {
543 msleep(1); /* minimum sleep to prevent looping,
544 allowing socket to clear and app
545 threads to set tcpStatus
546 CifsNeedReconnect if server hung*/
46810cbf 547 continue;
e4eb295d
SF		 548 } else if (length <= 0) {
549 cERROR(1,("Received no data, expecting %d",
550 pdu_length - total_read));
551 cifs_reconnect(server);
552 csocket = server->ssocket;
553 reconnect = 1;
554 break;
46810cbf 555 }
e4eb295d
SF		 556 }
557 if(reconnect == 2)
558 break;
559 else if(reconnect == 1)
560 continue;
1da177e4 561
e4eb295d
SF		 562 length += 4; /* account for rfc1002 hdr */
563
09d1db5c 564
e4eb295d 565 dump_smb(smb_buffer, length);
184ed211 566 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
b387eaeb 567 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
e4eb295d
SF		 568 continue;
569 }
1da177e4 570
e4eb295d
SF		 571
572 task_to_wake = NULL;
573 spin_lock(&GlobalMid_Lock);
574 list_for_each(tmp, &server->pending_mid_q) {
575 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
576
577 if ((mid_entry->mid == smb_buffer->Mid) &&
578 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
579 (mid_entry->command == smb_buffer->Command)) {
e4eb295d
SF		 580 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
581 /* We have a multipart transact2 resp */
cd63499c 582 isMultiRsp = TRUE;
e4eb295d
SF		 583 if(mid_entry->resp_buf) {
584 /* merge response - fix up 1st*/
585 if(coalesce_t2(smb_buffer,
586 mid_entry->resp_buf)) {
3979877e 587 mid_entry->multiRsp = 1;
e4eb295d
SF		 588 break;
589 } else {
590 /* all parts received */
3979877e 591 mid_entry->multiEnd = 1;
e4eb295d
SF		 592 goto multi_t2_fnd;
593 }
594 } else {
595 if(!isLargeBuf) {
596 cERROR(1,("1st trans2 resp needs bigbuf"));
597 /* BB maybe we can fix this up, switch
598 to already allocated large buffer? */
599 } else {
cd63499c 600 /* Have first buffer */
e4eb295d
SF		 601 mid_entry->resp_buf =
602 smb_buffer;
603 mid_entry->largeBuf = 1;
e4eb295d
SF		 604 bigbuf = NULL;
605 }
606 }
607 break;
608 }
609 mid_entry->resp_buf = smb_buffer;
46810cbf 610 if(isLargeBuf)
e4eb295d 611 mid_entry->largeBuf = 1;
46810cbf 612 else
e4eb295d
SF		 613 mid_entry->largeBuf = 0;
614multi_t2_fnd:
615 task_to_wake = mid_entry->tsk;
616 mid_entry->midState = MID_RESPONSE_RECEIVED;
1047abc1
SF		 617#ifdef CONFIG_CIFS_STATS2
618 mid_entry->when_received = jiffies;
619#endif
3a5ff61c
SF		 620 /* so we do not time out requests to server
621 which is still responding (since server could
622 be busy but not dead) */
623 server->lstrp = jiffies;
e4eb295d 624 break;
46810cbf 625 }
1da177e4 626 }
e4eb295d
SF		 627 spin_unlock(&GlobalMid_Lock);
628 if (task_to_wake) {
cd63499c
SF		 629 /* Was previous buf put in mpx struct for multi-rsp? */
630 if(!isMultiRsp) {
631 /* smb buffer will be freed by user thread */
632 if(isLargeBuf) {
633 bigbuf = NULL;
634 } else
635 smallbuf = NULL;
636 }
e4eb295d 637 wake_up_process(task_to_wake);
d7c8c94d 638 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
e4eb295d 639 && (isMultiRsp == FALSE)) {
3979877e 640 cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
70ca734a
SF		 641 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
642 sizeof(struct smb_hdr));
3979877e
SF		 643#ifdef CONFIG_CIFS_DEBUG2
644 cifs_dump_detail(smb_buffer);
645 cifs_dump_mids(server);
646#endif /* CIFS_DEBUG2 */
647
e4eb295d
SF		 648 }
649 } /* end while !EXITING */
650
1da177e4
LT		 651 spin_lock(&GlobalMid_Lock);
652 server->tcpStatus = CifsExiting;
653 server->tsk = NULL;
31ca3bc3
SF		 654 /* check if we have blocked requests that need to free */
655 /* Note that cifs_max_pending is normally 50, but
656 can be set at module install time to as little as two */
657 if(atomic_read(&server->inFlight) >= cifs_max_pending)
658 atomic_set(&server->inFlight, cifs_max_pending - 1);
659 /* We do not want to set the max_pending too low or we
660 could end up with the counter going negative */
1da177e4
LT		 661 spin_unlock(&GlobalMid_Lock);
662 /* Although there should not be any requests blocked on
663 this queue it can not hurt to be paranoid and try to wake up requests
09d1db5c 664 that may haven been blocked when more than 50 at time were on the wire
1da177e4
LT		 665 to the same server - they now will see the session is in exit state
666 and get out of SendReceive. */
667 wake_up_all(&server->request_q);
668 /* give those requests time to exit */
b8643e1b
SF		 669 msleep(125);
670
1da177e4
LT		 671 if(server->ssocket) {
672 sock_release(csocket);
673 server->ssocket = NULL;
674 }
b8643e1b
SF		 675 /* buffer usuallly freed in free_mid - need to free it here on exit */
676 if (bigbuf != NULL)
677 cifs_buf_release(bigbuf);
678 if (smallbuf != NULL)
679 cifs_small_buf_release(smallbuf);
1da177e4
LT		 680
681 read_lock(&GlobalSMBSeslock);
682 if (list_empty(&server->pending_mid_q)) {
09d1db5c
SF		 683 /* loop through server session structures attached to this and
684 mark them dead */
1da177e4
LT		 685 list_for_each(tmp, &GlobalSMBSessionList) {
686 ses =
687 list_entry(tmp, struct cifsSesInfo,
688 cifsSessionList);
689 if (ses->server == server) {
690 ses->status = CifsExiting;
691 ses->server = NULL;
692 }
693 }
694 read_unlock(&GlobalSMBSeslock);
695 } else {
31ca3bc3
SF		 696 /* although we can not zero the server struct pointer yet,
697 since there are active requests which may depnd on them,
698 mark the corresponding SMB sessions as exiting too */
699 list_for_each(tmp, &GlobalSMBSessionList) {
700 ses = list_entry(tmp, struct cifsSesInfo,
701 cifsSessionList);
702 if (ses->server == server) {
703 ses->status = CifsExiting;
704 }
705 }
706
1da177e4
LT		 707 spin_lock(&GlobalMid_Lock);
708 list_for_each(tmp, &server->pending_mid_q) {
709 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
710 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
711 cFYI(1,
09d1db5c 712 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
1da177e4
LT		 713 task_to_wake = mid_entry->tsk;
714 if(task_to_wake) {
715 wake_up_process(task_to_wake);
716 }
717 }
718 }
719 spin_unlock(&GlobalMid_Lock);
720 read_unlock(&GlobalSMBSeslock);
1da177e4 721 /* 1/8th of sec is more than enough time for them to exit */
b8643e1b 722 msleep(125);
1da177e4
LT		 723 }
724
f191401f 725 if (!list_empty(&server->pending_mid_q)) {
1da177e4
LT		 726 /* mpx threads have not exited yet give them
727 at least the smb send timeout time for long ops */
31ca3bc3
SF		 728 /* due to delays on oplock break requests, we need
729 to wait at least 45 seconds before giving up
730 on a request getting a response and going ahead
731 and killing cifsd */
1da177e4 732 cFYI(1, ("Wait for exit from demultiplex thread"));
31ca3bc3 733 msleep(46000);
1da177e4
LT		 734 /* if threads still have not exited they are probably never
735 coming home not much else we can do but free the memory */
736 }
1da177e4
LT		 737
738 write_lock(&GlobalSMBSeslock);
739 atomic_dec(&tcpSesAllocCount);
740 length = tcpSesAllocCount.counter;
31ca3bc3
SF		 741
742 /* last chance to mark ses pointers invalid
743 if there are any pointing to this (e.g
744 if a crazy root user tried to kill cifsd
745 kernel thread explicitly this might happen) */
746 list_for_each(tmp, &GlobalSMBSessionList) {
747 ses = list_entry(tmp, struct cifsSesInfo,
748 cifsSessionList);
749 if (ses->server == server) {
750 ses->server = NULL;
751 }
752 }
1da177e4 753 write_unlock(&GlobalSMBSeslock);
31ca3bc3
SF		 754
755 kfree(server);
1da177e4
LT		 756 if(length > 0) {
757 mempool_resize(cifs_req_poolp,
758 length + cifs_min_rcv,
759 GFP_KERNEL);
760 }
b8643e1b 761
1da177e4
LT		 762 return 0;
763}
764
1da177e4
LT		 765static int
766cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
767{
768 char *value;
769 char *data;
770 unsigned int temp_len, i, j;
771 char separator[2];
772
773 separator[0] = ',';
774 separator[1] = 0;
775
12e36b2f 776 if (Local_System_Name[0] != 0)
2cd646a2
SF		 777 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
778 else {
12e36b2f
LT		 779 char *nodename = utsname()->nodename;
780 int n = strnlen(nodename,15);
2cd646a2 781 memset(vol->source_rfc1001_name,0x20,15);
12e36b2f 782 for(i=0 ; i < n ; i++) {
2cd646a2
SF		 783 /* does not have to be perfect mapping since field is
784 informational, only used for servers that do not support
785 port 445 and it can be overridden at mount time */
12e36b2f 786 vol->source_rfc1001_name[i] = toupper(nodename[i]);
2cd646a2 787 }
1da177e4
LT		 788 }
789 vol->source_rfc1001_name[15] = 0;
a10faeb2
SF		 790 /* null target name indicates to use *SMBSERVR default called name
791 if we end up sending RFC1001 session initialize */
792 vol->target_rfc1001_name[0] = 0;
1da177e4
LT		 793 vol->linux_uid = current->uid; /* current->euid instead? */
794 vol->linux_gid = current->gid;
795 vol->dir_mode = S_IRWXUGO;
796 /* 2767 perms indicate mandatory locking support */
797 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
798
799 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
800 vol->rw = TRUE;
ac67055e
JA		 801 /* default is always to request posix paths. */
802 vol->posix_paths = 1;
803
1da177e4
LT		 804 if (!options)
805 return 1;
806
807 if(strncmp(options,"sep=",4) == 0) {
808 if(options[4] != 0) {
809 separator[0] = options[4];
810 options += 5;
811 } else {
812 cFYI(1,("Null separator not allowed"));
813 }
814 }
815
816 while ((data = strsep(&options, separator)) != NULL) {
817 if (!*data)
818 continue;
819 if ((value = strchr(data, '=')) != NULL)
820 *value++ = '\0';
821
822 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
823 vol->no_xattr = 0;
824 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
825 vol->no_xattr = 1;
826 } else if (strnicmp(data, "user", 4) == 0) {
4b952a9b 827 if (!value) {
1da177e4
LT		 828 printk(KERN_WARNING
829 "CIFS: invalid or missing username\n");
830 return 1; /* needs_arg; */
4b952a9b
SF		 831 } else if(!*value) {
832 /* null user, ie anonymous, authentication */
833 vol->nullauth = 1;
1da177e4
LT		 834 }
835 if (strnlen(value, 200) < 200) {
836 vol->username = value;
837 } else {
838 printk(KERN_WARNING "CIFS: username too long\n");
839 return 1;
840 }
841 } else if (strnicmp(data, "pass", 4) == 0) {
842 if (!value) {
843 vol->password = NULL;
844 continue;
845 } else if(value[0] == 0) {
846 /* check if string begins with double comma
847 since that would mean the password really
848 does start with a comma, and would not
849 indicate an empty string */
850 if(value[1] != separator[0]) {
851 vol->password = NULL;
852 continue;
853 }
854 }
855 temp_len = strlen(value);
856 /* removed password length check, NTLM passwords
857 can be arbitrarily long */
858
859 /* if comma in password, the string will be
860 prematurely null terminated. Commas in password are
861 specified across the cifs mount interface by a double
862 comma ie ,, and a comma used as in other cases ie ','
863 as a parameter delimiter/separator is single and due
864 to the strsep above is temporarily zeroed. */
865
866 /* NB: password legally can have multiple commas and
867 the only illegal character in a password is null */
868
09d1db5c
SF		 869 if ((value[temp_len] == 0) &&
870 (value[temp_len+1] == separator[0])) {
1da177e4
LT		 871 /* reinsert comma */
872 value[temp_len] = separator[0];
873 temp_len+=2; /* move after the second comma */
874 while(value[temp_len] != 0) {
875 if (value[temp_len] == separator[0]) {
09d1db5c
SF		 876 if (value[temp_len+1] ==
877 separator[0]) {
878 /* skip second comma */
879 temp_len++;
1da177e4
LT		 880 } else {
881 /* single comma indicating start
882 of next parm */
883 break;
884 }
885 }
886 temp_len++;
887 }
888 if(value[temp_len] == 0) {
889 options = NULL;
890 } else {
891 value[temp_len] = 0;
892 /* point option to start of next parm */
893 options = value + temp_len + 1;
894 }
895 /* go from value to value + temp_len condensing
896 double commas to singles. Note that this ends up
897 allocating a few bytes too many, which is ok */
e915fc49 898 vol->password = kzalloc(temp_len, GFP_KERNEL);
433dc24f
SF		 899 if(vol->password == NULL) {
900 printk("CIFS: no memory for pass\n");
901 return 1;
902 }
1da177e4
LT		 903 for(i=0,j=0;i<temp_len;i++,j++) {
904 vol->password[j] = value[i];
09d1db5c
SF		 905 if(value[i] == separator[0]
906 && value[i+1] == separator[0]) {
1da177e4
LT		 907 /* skip second comma */
908 i++;
909 }
910 }
911 vol->password[j] = 0;
912 } else {
e915fc49 913 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
433dc24f
SF		 914 if(vol->password == NULL) {
915 printk("CIFS: no memory for pass\n");
916 return 1;
917 }
1da177e4
LT		 918 strcpy(vol->password, value);
919 }
920 } else if (strnicmp(data, "ip", 2) == 0) {
921 if (!value || !*value) {
922 vol->UNCip = NULL;
923 } else if (strnlen(value, 35) < 35) {
924 vol->UNCip = value;
925 } else {
926 printk(KERN_WARNING "CIFS: ip address too long\n");
927 return 1;
928 }
bf820679
SF		 929 } else if (strnicmp(data, "sec", 3) == 0) {
930 if (!value || !*value) {
931 cERROR(1,("no security value specified"));
932 continue;
933 } else if (strnicmp(value, "krb5i", 5) == 0) {
750d1151 934 vol->secFlg |= CIFSSEC_MAY_KRB5 |
189acaae 935 CIFSSEC_MUST_SIGN;
bf820679 936 } else if (strnicmp(value, "krb5p", 5) == 0) {
750d1151 937 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
189acaae 938 CIFSSEC_MAY_KRB5; */
bf820679
SF		 939 cERROR(1,("Krb5 cifs privacy not supported"));
940 return 1;
941 } else if (strnicmp(value, "krb5", 4) == 0) {
750d1151 942 vol->secFlg |= CIFSSEC_MAY_KRB5;
bf820679 943 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
750d1151 944 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
189acaae 945 CIFSSEC_MUST_SIGN;
bf820679 946 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
750d1151 947 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
bf820679 948 } else if (strnicmp(value, "ntlmi", 5) == 0) {
750d1151 949 vol->secFlg |= CIFSSEC_MAY_NTLM |
189acaae 950 CIFSSEC_MUST_SIGN;
bf820679
SF		 951 } else if (strnicmp(value, "ntlm", 4) == 0) {
952 /* ntlm is default so can be turned off too */
750d1151 953 vol->secFlg |= CIFSSEC_MAY_NTLM;
bf820679 954 } else if (strnicmp(value, "nontlm", 6) == 0) {
189acaae 955 /* BB is there a better way to do this? */
750d1151 956 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
189acaae
SF		 957#ifdef CONFIG_CIFS_WEAK_PW_HASH
958 } else if (strnicmp(value, "lanman", 6) == 0) {
750d1151 959 vol->secFlg |= CIFSSEC_MAY_LANMAN;
189acaae 960#endif
bf820679 961 } else if (strnicmp(value, "none", 4) == 0) {
189acaae 962 vol->nullauth = 1;
bf820679
SF		 963 } else {
964 cERROR(1,("bad security option: %s", value));
965 return 1;
966 }
1da177e4
LT		 967 } else if ((strnicmp(data, "unc", 3) == 0)
968 || (strnicmp(data, "target", 6) == 0)
969 || (strnicmp(data, "path", 4) == 0)) {
970 if (!value || !*value) {
971 printk(KERN_WARNING
972 "CIFS: invalid path to network resource\n");
973 return 1; /* needs_arg; */
974 }
975 if ((temp_len = strnlen(value, 300)) < 300) {
976 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
4523cc30 977 if (vol->UNC == NULL)
1da177e4
LT		 978 return 1;
979 strcpy(vol->UNC,value);
980 if (strncmp(vol->UNC, "//", 2) == 0) {
981 vol->UNC[0] = '\\';
982 vol->UNC[1] = '\\';
983 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
984 printk(KERN_WARNING
985 "CIFS: UNC Path does not begin with // or \\\\ \n");
986 return 1;
987 }
988 } else {
989 printk(KERN_WARNING "CIFS: UNC name too long\n");
990 return 1;
991 }
992 } else if ((strnicmp(data, "domain", 3) == 0)
993 || (strnicmp(data, "workgroup", 5) == 0)) {
994 if (!value || !*value) {
995 printk(KERN_WARNING "CIFS: invalid domain name\n");
996 return 1; /* needs_arg; */
997 }
998 /* BB are there cases in which a comma can be valid in
999 a domain name and need special handling? */
3979877e 1000 if (strnlen(value, 256) < 256) {
1da177e4
LT		 1001 vol->domainname = value;
1002 cFYI(1, ("Domain name set"));
1003 } else {
1004 printk(KERN_WARNING "CIFS: domain name too long\n");
1005 return 1;
1006 }
2fe87f02
SF		 1007 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1008 if (!value || !*value) {
1009 printk(KERN_WARNING
1010 "CIFS: invalid path prefix\n");
1011 return 1; /* needs_arg; */
1012 }
1013 if ((temp_len = strnlen(value, 1024)) < 1024) {
4523cc30 1014 if (value[0] != '/')
2fe87f02
SF		 1015 temp_len++; /* missing leading slash */
1016 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
4523cc30 1017 if (vol->prepath == NULL)
2fe87f02 1018 return 1;
4523cc30 1019 if (value[0] != '/') {
2fe87f02
SF		 1020 vol->prepath[0] = '/';
1021 strcpy(vol->prepath+1,value);
1022 } else
1023 strcpy(vol->prepath,value);
1024 cFYI(1,("prefix path %s",vol->prepath));
1025 } else {
1026 printk(KERN_WARNING "CIFS: prefix too long\n");
1027 return 1;
1028 }
1da177e4
LT		 1029 } else if (strnicmp(data, "iocharset", 9) == 0) {
1030 if (!value || !*value) {
1031 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1032 return 1; /* needs_arg; */
1033 }
1034 if (strnlen(value, 65) < 65) {
4523cc30 1035 if (strnicmp(value,"default",7))
1da177e4
LT		 1036 vol->iocharset = value;
1037 /* if iocharset not set load_nls_default used by caller */
1038 cFYI(1, ("iocharset set to %s",value));
1039 } else {
1040 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1041 return 1;
1042 }
1043 } else if (strnicmp(data, "uid", 3) == 0) {
1044 if (value && *value) {
1045 vol->linux_uid =
1046 simple_strtoul(value, &value, 0);
4523cc30 1047 vol->override_uid = 1;
1da177e4
LT		 1048 }
1049 } else if (strnicmp(data, "gid", 3) == 0) {
1050 if (value && *value) {
1051 vol->linux_gid =
1052 simple_strtoul(value, &value, 0);
4523cc30 1053 vol->override_gid = 1;
1da177e4
LT		 1054 }
1055 } else if (strnicmp(data, "file_mode", 4) == 0) {
1056 if (value && *value) {
1057 vol->file_mode =
1058 simple_strtoul(value, &value, 0);
1059 }
1060 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1061 if (value && *value) {
1062 vol->dir_mode =
1063 simple_strtoul(value, &value, 0);
1064 }
1065 } else if (strnicmp(data, "dirmode", 4) == 0) {
1066 if (value && *value) {
1067 vol->dir_mode =
1068 simple_strtoul(value, &value, 0);
1069 }
1070 } else if (strnicmp(data, "port", 4) == 0) {
1071 if (value && *value) {
1072 vol->port =
1073 simple_strtoul(value, &value, 0);
1074 }
1075 } else if (strnicmp(data, "rsize", 5) == 0) {
1076 if (value && *value) {
1077 vol->rsize =
1078 simple_strtoul(value, &value, 0);
1079 }
1080 } else if (strnicmp(data, "wsize", 5) == 0) {
1081 if (value && *value) {
1082 vol->wsize =
1083 simple_strtoul(value, &value, 0);
1084 }
1085 } else if (strnicmp(data, "sockopt", 5) == 0) {
1086 if (value && *value) {
1087 vol->sockopt =
1088 simple_strtoul(value, &value, 0);
1089 }
1090 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1091 if (!value || !*value || (*value == ' ')) {
1092 cFYI(1,("invalid (empty) netbiosname specified"));
1093 } else {
1094 memset(vol->source_rfc1001_name,0x20,15);
1095 for(i=0;i<15;i++) {
1096 /* BB are there cases in which a comma can be
1097 valid in this workstation netbios name (and need
1098 special handling)? */
1099
1100 /* We do not uppercase netbiosname for user */
1101 if (value[i]==0)
1102 break;
1103 else
1104 vol->source_rfc1001_name[i] = value[i];
1105 }
1106 /* The string has 16th byte zero still from
1107 set at top of the function */
4523cc30 1108 if ((i==15) && (value[i] != 0))
a10faeb2
SF		 1109 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1110 }
1111 } else if (strnicmp(data, "servern", 7) == 0) {
1112 /* servernetbiosname specified override *SMBSERVER */
1113 if (!value || !*value || (*value == ' ')) {
1114 cFYI(1,("empty server netbiosname specified"));
1115 } else {
1116 /* last byte, type, is 0x20 for servr type */
1117 memset(vol->target_rfc1001_name,0x20,16);
1118
1119 for(i=0;i<15;i++) {
1120 /* BB are there cases in which a comma can be
1121 valid in this workstation netbios name (and need
1122 special handling)? */
1123
1124 /* user or mount helper must uppercase netbiosname */
1125 if (value[i]==0)
1126 break;
1127 else
1128 vol->target_rfc1001_name[i] = value[i];
1129 }
1130 /* The string has 16th byte zero still from
1131 set at top of the function */
4523cc30 1132 if ((i==15) && (value[i] != 0))
a10faeb2 1133 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1da177e4
LT		 1134 }
1135 } else if (strnicmp(data, "credentials", 4) == 0) {
1136 /* ignore */
1137 } else if (strnicmp(data, "version", 3) == 0) {
1138 /* ignore */
1139 } else if (strnicmp(data, "guest",5) == 0) {
1140 /* ignore */
1141 } else if (strnicmp(data, "rw", 2) == 0) {
1142 vol->rw = TRUE;
1143 } else if ((strnicmp(data, "suid", 4) == 0) ||
1144 (strnicmp(data, "nosuid", 6) == 0) ||
1145 (strnicmp(data, "exec", 4) == 0) ||
1146 (strnicmp(data, "noexec", 6) == 0) ||
1147 (strnicmp(data, "nodev", 5) == 0) ||
1148 (strnicmp(data, "noauto", 6) == 0) ||
1149 (strnicmp(data, "dev", 3) == 0)) {
1150 /* The mount tool or mount.cifs helper (if present)
1151 uses these opts to set flags, and the flags are read
1152 by the kernel vfs layer before we get here (ie
1153 before read super) so there is no point trying to
1154 parse these options again and set anything and it
1155 is ok to just ignore them */
1156 continue;
1157 } else if (strnicmp(data, "ro", 2) == 0) {
1158 vol->rw = FALSE;
1159 } else if (strnicmp(data, "hard", 4) == 0) {
1160 vol->retry = 1;
1161 } else if (strnicmp(data, "soft", 4) == 0) {
1162 vol->retry = 0;
1163 } else if (strnicmp(data, "perm", 4) == 0) {
1164 vol->noperm = 0;
1165 } else if (strnicmp(data, "noperm", 6) == 0) {
1166 vol->noperm = 1;
6a0b4824
SF		 1167 } else if (strnicmp(data, "mapchars", 8) == 0) {
1168 vol->remap = 1;
1169 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1170 vol->remap = 0;
d7245c2c
SF		 1171 } else if (strnicmp(data, "sfu", 3) == 0) {
1172 vol->sfu_emul = 1;
1173 } else if (strnicmp(data, "nosfu", 5) == 0) {
1174 vol->sfu_emul = 0;
ac67055e
JA		 1175 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1176 vol->posix_paths = 1;
1177 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1178 vol->posix_paths = 0;
a10faeb2
SF		 1179 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1180 (strnicmp(data, "ignorecase", 10) == 0)) {
c46fa8ac
SF		 1181 vol->nocase = 1;
1182 } else if (strnicmp(data, "brl", 3) == 0) {
1183 vol->nobrl = 0;
cb8be640 1184 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1c955187 1185 (strnicmp(data, "nolock", 6) == 0)) {
c46fa8ac 1186 vol->nobrl = 1;
d3485d37
SF		 1187 /* turn off mandatory locking in mode
1188 if remote locking is turned off since the
1189 local vfs will do advisory */
1190 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1191 vol->file_mode = S_IALLUGO;
1da177e4
LT		 1192 } else if (strnicmp(data, "setuids", 7) == 0) {
1193 vol->setuids = 1;
1194 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1195 vol->setuids = 0;
1196 } else if (strnicmp(data, "nohard", 6) == 0) {
1197 vol->retry = 0;
1198 } else if (strnicmp(data, "nosoft", 6) == 0) {
1199 vol->retry = 1;
1200 } else if (strnicmp(data, "nointr", 6) == 0) {
1201 vol->intr = 0;
1202 } else if (strnicmp(data, "intr", 4) == 0) {
1203 vol->intr = 1;
1204 } else if (strnicmp(data, "serverino",7) == 0) {
1205 vol->server_ino = 1;
1206 } else if (strnicmp(data, "noserverino",9) == 0) {
1207 vol->server_ino = 0;
0a4b92c0
SF		 1208 } else if (strnicmp(data, "cifsacl",7) == 0) {
1209 vol->cifs_acl = 1;
1210 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1211 vol->cifs_acl = 0;
1da177e4
LT		 1212 } else if (strnicmp(data, "acl",3) == 0) {
1213 vol->no_psx_acl = 0;
1214 } else if (strnicmp(data, "noacl",5) == 0) {
1215 vol->no_psx_acl = 1;
750d1151
SF		 1216 } else if (strnicmp(data, "sign",4) == 0) {
1217 vol->secFlg |= CIFSSEC_MUST_SIGN;
1218/* } else if (strnicmp(data, "seal",4) == 0) {
1219 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1da177e4
LT		 1220 } else if (strnicmp(data, "direct",6) == 0) {
1221 vol->direct_io = 1;
1222 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1223 vol->direct_io = 1;
1224 } else if (strnicmp(data, "in6_addr",8) == 0) {
1225 if (!value || !*value) {
1226 vol->in6_addr = NULL;
1227 } else if (strnlen(value, 49) == 48) {
1228 vol->in6_addr = value;
1229 } else {
1230 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1231 return 1;
1232 }
1233 } else if (strnicmp(data, "noac", 4) == 0) {
1234 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1235 } else
1236 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1237 }
1238 if (vol->UNC == NULL) {
4523cc30 1239 if (devname == NULL) {
1da177e4
LT		 1240 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1241 return 1;
1242 }
1243 if ((temp_len = strnlen(devname, 300)) < 300) {
1244 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
4523cc30 1245 if (vol->UNC == NULL)
1da177e4
LT		 1246 return 1;
1247 strcpy(vol->UNC,devname);
1248 if (strncmp(vol->UNC, "//", 2) == 0) {
1249 vol->UNC[0] = '\\';
1250 vol->UNC[1] = '\\';
1251 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1252 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1253 return 1;
1254 }
1255 } else {
1256 printk(KERN_WARNING "CIFS: UNC name too long\n");
1257 return 1;
1258 }
1259 }
1260 if(vol->UNCip == NULL)
1261 vol->UNCip = &vol->UNC[2];
1262
1263 return 0;
1264}
1265
1266static struct cifsSesInfo *
1267cifs_find_tcp_session(struct in_addr * target_ip_addr,
1268 struct in6_addr *target_ip6_addr,
1269 char *userName, struct TCP_Server_Info **psrvTcp)
1270{
1271 struct list_head *tmp;
1272 struct cifsSesInfo *ses;
1273 *psrvTcp = NULL;
1274 read_lock(&GlobalSMBSeslock);
1275
1276 list_for_each(tmp, &GlobalSMBSessionList) {
1277 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1278 if (ses->server) {
1279 if((target_ip_addr &&
1280 (ses->server->addr.sockAddr.sin_addr.s_addr
1281 == target_ip_addr->s_addr)) || (target_ip6_addr
1282 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1283 target_ip6_addr,sizeof(*target_ip6_addr)))){
1284 /* BB lock server and tcp session and increment use count here?? */
1285 *psrvTcp = ses->server; /* found a match on the TCP session */
1286 /* BB check if reconnection needed */
1287 if (strncmp
1288 (ses->userName, userName,
1289 MAX_USERNAME_SIZE) == 0){
1290 read_unlock(&GlobalSMBSeslock);
1291 return ses; /* found exact match on both tcp and SMB sessions */
1292 }
1293 }
1294 }
1295 /* else tcp and smb sessions need reconnection */
1296 }
1297 read_unlock(&GlobalSMBSeslock);
1298 return NULL;
1299}
1300
1301static struct cifsTconInfo *
1302find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1303{
1304 struct list_head *tmp;
1305 struct cifsTconInfo *tcon;
1306
1307 read_lock(&GlobalSMBSeslock);
1308 list_for_each(tmp, &GlobalTreeConnectionList) {
e466e487 1309 cFYI(1, ("Next tcon"));
1da177e4
LT		 1310 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1311 if (tcon->ses) {
1312 if (tcon->ses->server) {
1313 cFYI(1,
e466e487 1314 ("old ip addr: %x == new ip %x ?",
1da177e4
LT		 1315 tcon->ses->server->addr.sockAddr.sin_addr.
1316 s_addr, new_target_ip_addr));
1317 if (tcon->ses->server->addr.sockAddr.sin_addr.
1318 s_addr == new_target_ip_addr) {
e466e487 1319 /* BB lock tcon, server and tcp session and increment use count here? */
1da177e4
LT		 1320 /* found a match on the TCP session */
1321 /* BB check if reconnection needed */
e466e487 1322 cFYI(1,("IP match, old UNC: %s new: %s",
1da177e4
LT		 1323 tcon->treeName, uncName));
1324 if (strncmp
1325 (tcon->treeName, uncName,
1326 MAX_TREE_SIZE) == 0) {
1327 cFYI(1,
e466e487 1328 ("and old usr: %s new: %s",
1da177e4
LT		 1329 tcon->treeName, uncName));
1330 if (strncmp
1331 (tcon->ses->userName,
1332 userName,
1333 MAX_USERNAME_SIZE) == 0) {
1334 read_unlock(&GlobalSMBSeslock);
e466e487
SF		 1335 /* matched smb session
1336 (user name */
1337 return tcon;
1da177e4
LT		 1338 }
1339 }
1340 }
1341 }
1342 }
1343 }
1344 read_unlock(&GlobalSMBSeslock);
1345 return NULL;
1346}
1347
1348int
1349connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
737b758c
SF		 1350 const char *old_path, const struct nls_table *nls_codepage,
1351 int remap)
1da177e4
LT		 1352{
1353 unsigned char *referrals = NULL;
1354 unsigned int num_referrals;
1355 int rc = 0;
1356
1357 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
737b758c 1358 &num_referrals, &referrals, remap);
1da177e4
LT		 1359
1360 /* BB Add in code to: if valid refrl, if not ip address contact
1361 the helper that resolves tcp names, mount to it, try to
1362 tcon to it unmount it if fail */
1363
f99d49ad 1364 kfree(referrals);
1da177e4
LT		 1365
1366 return rc;
1367}
1368
1369int
1370get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1371 const char *old_path, const struct nls_table *nls_codepage,
737b758c
SF		 1372 unsigned int *pnum_referrals,
1373 unsigned char ** preferrals, int remap)
1da177e4
LT		 1374{
1375 char *temp_unc;
1376 int rc = 0;
1377
1378 *pnum_referrals = 0;
1379
1380 if (pSesInfo->ipc_tid == 0) {
1381 temp_unc = kmalloc(2 /* for slashes */ +
1382 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1383 + 1 + 4 /* slash IPC$ */ + 2,
1384 GFP_KERNEL);
1385 if (temp_unc == NULL)
1386 return -ENOMEM;
1387 temp_unc[0] = '\\';
1388 temp_unc[1] = '\\';
1389 strcpy(temp_unc + 2, pSesInfo->serverName);
1390 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1391 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1392 cFYI(1,
1393 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1394 kfree(temp_unc);
1395 }
1396 if (rc == 0)
1397 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
737b758c 1398 pnum_referrals, nls_codepage, remap);
1da177e4
LT		 1399
1400 return rc;
1401}
1402
1403/* See RFC1001 section 14 on representation of Netbios names */
1404static void rfc1002mangle(char * target,char * source, unsigned int length)
1405{
1406 unsigned int i,j;
1407
1408 for(i=0,j=0;i<(length);i++) {
1409 /* mask a nibble at a time and encode */
1410 target[j] = 'A' + (0x0F & (source[i] >> 4));
1411 target[j+1] = 'A' + (0x0F & source[i]);
1412 j+=2;
1413 }
1414
1415}
1416
1417
1418static int
1419ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
a10faeb2 1420 char * netbios_name, char * target_name)
1da177e4
LT		 1421{
1422 int rc = 0;
1423 int connected = 0;
1424 __be16 orig_port = 0;
1425
1426 if(*csocket == NULL) {
1427 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1428 if (rc < 0) {
1429 cERROR(1, ("Error %d creating socket",rc));
1430 *csocket = NULL;
1431 return rc;
1432 } else {
1433 /* BB other socket options to set KEEPALIVE, NODELAY? */
1434 cFYI(1,("Socket created"));
1435 (*csocket)->sk->sk_allocation = GFP_NOFS;
1436 }
1437 }
1438
1439 psin_server->sin_family = AF_INET;
1440 if(psin_server->sin_port) { /* user overrode default port */
1441 rc = (*csocket)->ops->connect(*csocket,
1442 (struct sockaddr *) psin_server,
1443 sizeof (struct sockaddr_in),0);
1444 if (rc >= 0)
1445 connected = 1;
1446 }
1447
1448 if(!connected) {
1449 /* save original port so we can retry user specified port
1450 later if fall back ports fail this time */
1451 orig_port = psin_server->sin_port;
1452
1453 /* do not retry on the same port we just failed on */
1454 if(psin_server->sin_port != htons(CIFS_PORT)) {
1455 psin_server->sin_port = htons(CIFS_PORT);
1456
1457 rc = (*csocket)->ops->connect(*csocket,
1458 (struct sockaddr *) psin_server,
1459 sizeof (struct sockaddr_in),0);
1460 if (rc >= 0)
1461 connected = 1;
1462 }
1463 }
1464 if (!connected) {
1465 psin_server->sin_port = htons(RFC1001_PORT);
1466 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1467 psin_server, sizeof (struct sockaddr_in),0);
1468 if (rc >= 0)
1469 connected = 1;
1470 }
1471
1472 /* give up here - unless we want to retry on different
1473 protocol families some day */
1474 if (!connected) {
1475 if(orig_port)
1476 psin_server->sin_port = orig_port;
1477 cFYI(1,("Error %d connecting to server via ipv4",rc));
1478 sock_release(*csocket);
1479 *csocket = NULL;
1480 return rc;
1481 }
1482 /* Eventually check for other socket options to change from
1483 the default. sock_setsockopt not used because it expects
1484 user space buffer */
b387eaeb
SF		 1485 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1486 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1da177e4 1487 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
b387eaeb
SF		 1488 /* make the bufsizes depend on wsize/rsize and max requests */
1489 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1490 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1491 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1492 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1da177e4
LT		 1493
1494 /* send RFC1001 sessinit */
1da177e4
LT		 1495 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1496 /* some servers require RFC1001 sessinit before sending
1497 negprot - BB check reconnection in case where second
1498 sessinit is sent but no second negprot */
1499 struct rfc1002_session_packet * ses_init_buf;
1500 struct smb_hdr * smb_buf;
e915fc49 1501 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1da177e4
LT		 1502 if(ses_init_buf) {
1503 ses_init_buf->trailer.session_req.called_len = 32;
a10faeb2
SF		 1504 if(target_name && (target_name[0] != 0)) {
1505 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1506 target_name, 16);
1507 } else {
1508 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1509 DEFAULT_CIFS_CALLED_NAME,16);
1510 }
1511
1da177e4
LT		 1512 ses_init_buf->trailer.session_req.calling_len = 32;
1513 /* calling name ends in null (byte 16) from old smb
1514 convention. */
1515 if(netbios_name && (netbios_name[0] !=0)) {
1516 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1517 netbios_name,16);
1518 } else {
1519 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1520 "LINUX_CIFS_CLNT",16);
1521 }
1522 ses_init_buf->trailer.session_req.scope1 = 0;
1523 ses_init_buf->trailer.session_req.scope2 = 0;
1524 smb_buf = (struct smb_hdr *)ses_init_buf;
1525 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1526 smb_buf->smb_buf_length = 0x81000044;
1527 rc = smb_send(*csocket, smb_buf, 0x44,
1528 (struct sockaddr *)psin_server);
1529 kfree(ses_init_buf);
083d3a2c
SF		 1530 msleep(1); /* RFC1001 layer in at least one server
1531 requires very short break before negprot
1532 presumably because not expecting negprot
1533 to follow so fast. This is a simple
1534 solution that works without
1535 complicating the code and causes no
1536 significant slowing down on mount
1537 for everyone else */
1da177e4
LT		 1538 }
1539 /* else the negprot may still work without this
1540 even though malloc failed */
1541
1542 }
1543
1544 return rc;
1545}
1546
1547static int
1548ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1549{
1550 int rc = 0;
1551 int connected = 0;
1552 __be16 orig_port = 0;
1553
1554 if(*csocket == NULL) {
1555 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1556 if (rc < 0) {
1557 cERROR(1, ("Error %d creating ipv6 socket",rc));
1558 *csocket = NULL;
1559 return rc;
1560 } else {
1561 /* BB other socket options to set KEEPALIVE, NODELAY? */
1562 cFYI(1,("ipv6 Socket created"));
1563 (*csocket)->sk->sk_allocation = GFP_NOFS;
1564 }
1565 }
1566
1567 psin_server->sin6_family = AF_INET6;
1568
1569 if(psin_server->sin6_port) { /* user overrode default port */
1570 rc = (*csocket)->ops->connect(*csocket,
1571 (struct sockaddr *) psin_server,
1572 sizeof (struct sockaddr_in6),0);
1573 if (rc >= 0)
1574 connected = 1;
1575 }
1576
1577 if(!connected) {
1578 /* save original port so we can retry user specified port
1579 later if fall back ports fail this time */
1580
1581 orig_port = psin_server->sin6_port;
1582 /* do not retry on the same port we just failed on */
1583 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1584 psin_server->sin6_port = htons(CIFS_PORT);
1585
1586 rc = (*csocket)->ops->connect(*csocket,
1587 (struct sockaddr *) psin_server,
1588 sizeof (struct sockaddr_in6),0);
1589 if (rc >= 0)
1590 connected = 1;
1591 }
1592 }
1593 if (!connected) {
1594 psin_server->sin6_port = htons(RFC1001_PORT);
1595 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1596 psin_server, sizeof (struct sockaddr_in6),0);
1597 if (rc >= 0)
1598 connected = 1;
1599 }
1600
1601 /* give up here - unless we want to retry on different
1602 protocol families some day */
1603 if (!connected) {
1604 if(orig_port)
1605 psin_server->sin6_port = orig_port;
1606 cFYI(1,("Error %d connecting to server via ipv6",rc));
1607 sock_release(*csocket);
1608 *csocket = NULL;
1609 return rc;
1610 }
1611 /* Eventually check for other socket options to change from
1612 the default. sock_setsockopt not used because it expects
1613 user space buffer */
1614 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1615
1616 return rc;
1617}
1618
8af18971
SF		 1619void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1620 struct super_block * sb, struct smb_vol * vol_info)
1621{
1622 /* if we are reconnecting then should we check to see if
1623 * any requested capabilities changed locally e.g. via
1624 * remount but we can not do much about it here
1625 * if they have (even if we could detect it by the following)
1626 * Perhaps we could add a backpointer to array of sb from tcon
1627 * or if we change to make all sb to same share the same
1628 * sb as NFS - then we only have one backpointer to sb.
1629 * What if we wanted to mount the server share twice once with
1630 * and once without posixacls or posix paths? */
1631 __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1632
1633
1634 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1635 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1636
1637 /* check for reconnect case in which we do not
1638 want to change the mount behavior if we can avoid it */
1639 if(vol_info == NULL) {
1640 /* turn off POSIX ACL and PATHNAMES if not set
1641 originally at mount time */
1642 if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1643 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1644 if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1645 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1646
1647
1648
1649
1650 }
1651
1652 cap &= CIFS_UNIX_CAP_MASK;
1653 if(vol_info && vol_info->no_psx_acl)
1654 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1655 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1656 cFYI(1,("negotiated posix acl support"));
1657 if(sb)
1658 sb->s_flags |= MS_POSIXACL;
1659 }
1660
1661 if(vol_info && vol_info->posix_paths == 0)
1662 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1663 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1664 cFYI(1,("negotiate posix pathnames"));
1665 if(sb)
1666 CIFS_SB(sb)->mnt_cifs_flags |=
1667 CIFS_MOUNT_POSIX_PATHS;
1668 }
984acfe1
SF		 1669
1670 /* We might be setting the path sep back to a different
1671 form if we are reconnecting and the server switched its
1672 posix path capability for this share */
0b2365f8 1673 if(sb && (CIFS_SB(sb)->prepathlen > 0))
984acfe1
SF		 1674 CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1675
8af18971
SF		 1676 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1677#ifdef CONFIG_CIFS_DEBUG2
1678 if(cap & CIFS_UNIX_FCNTL_CAP)
1679 cFYI(1,("FCNTL cap"));
1680 if(cap & CIFS_UNIX_EXTATTR_CAP)
1681 cFYI(1,("EXTATTR cap"));
1682 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1683 cFYI(1,("POSIX path cap"));
1684 if(cap & CIFS_UNIX_XATTR_CAP)
1685 cFYI(1,("XATTR cap"));
1686 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1687 cFYI(1,("POSIX ACL cap"));
1688#endif /* CIFS_DEBUG2 */
1689 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1690 cFYI(1,("setting capabilities failed"));
1691 }
1692 }
1693}
1694
1da177e4
LT		 1695int
1696cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1697 char *mount_data, const char *devname)
1698{
1699 int rc = 0;
1700 int xid;
1701 int address_type = AF_INET;
1702 struct socket *csocket = NULL;
1703 struct sockaddr_in sin_server;
1704 struct sockaddr_in6 sin_server6;
1705 struct smb_vol volume_info;
1706 struct cifsSesInfo *pSesInfo = NULL;
1707 struct cifsSesInfo *existingCifsSes = NULL;
1708 struct cifsTconInfo *tcon = NULL;
1709 struct TCP_Server_Info *srvTcp = NULL;
1710
1711 xid = GetXid();
1712
1713/* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1714
1715 memset(&volume_info,0,sizeof(struct smb_vol));
1716 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
f99d49ad
JJ		 1717 kfree(volume_info.UNC);
1718 kfree(volume_info.password);
2fe87f02 1719 kfree(volume_info.prepath);
1da177e4
LT		 1720 FreeXid(xid);
1721 return -EINVAL;
1722 }
1723
8426c39c
JL		 1724 if (volume_info.nullauth) {
1725 cFYI(1,("null user"));
1726 volume_info.username = NULL;
1727 } else if (volume_info.username) {
1da177e4
LT		 1728 /* BB fixme parse for domain name here */
1729 cFYI(1, ("Username: %s ", volume_info.username));
1da177e4 1730 } else {
bf820679 1731 cifserror("No username specified");
1da177e4
LT		 1732 /* In userspace mount helper we can get user name from alternate
1733 locations such as env variables and files on disk */
f99d49ad
JJ		 1734 kfree(volume_info.UNC);
1735 kfree(volume_info.password);
2fe87f02 1736 kfree(volume_info.prepath);
1da177e4
LT		 1737 FreeXid(xid);
1738 return -EINVAL;
1739 }
1740
1741 if (volume_info.UNCip && volume_info.UNC) {
1742 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1743
1744 if(rc <= 0) {
1745 /* not ipv4 address, try ipv6 */
1746 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1747 if(rc > 0)
1748 address_type = AF_INET6;
1749 } else {
1750 address_type = AF_INET;
1751 }
1752
1753 if(rc <= 0) {
1754 /* we failed translating address */
f99d49ad
JJ		 1755 kfree(volume_info.UNC);
1756 kfree(volume_info.password);
2fe87f02 1757 kfree(volume_info.prepath);
1da177e4
LT		 1758 FreeXid(xid);
1759 return -EINVAL;
1760 }
1761
1762 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1763 /* success */
1764 rc = 0;
1765 } else if (volume_info.UNCip){
1766 /* BB using ip addr as server name connect to the DFS root below */
1767 cERROR(1,("Connecting to DFS root not implemented yet"));
f99d49ad
JJ		 1768 kfree(volume_info.UNC);
1769 kfree(volume_info.password);
2fe87f02 1770 kfree(volume_info.prepath);
1da177e4
LT		 1771 FreeXid(xid);
1772 return -EINVAL;
1773 } else /* which servers DFS root would we conect to */ {
1774 cERROR(1,
bf820679 1775 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
f99d49ad
JJ		 1776 kfree(volume_info.UNC);
1777 kfree(volume_info.password);
2fe87f02 1778 kfree(volume_info.prepath);
1da177e4
LT		 1779 FreeXid(xid);
1780 return -EINVAL;
1781 }
1782
1783 /* this is needed for ASCII cp to Unicode converts */
1784 if(volume_info.iocharset == NULL) {
1785 cifs_sb->local_nls = load_nls_default();
1786 /* load_nls_default can not return null */
1787 } else {
1788 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1789 if(cifs_sb->local_nls == NULL) {
1790 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
f99d49ad
JJ		 1791 kfree(volume_info.UNC);
1792 kfree(volume_info.password);
2fe87f02 1793 kfree(volume_info.prepath);
1da177e4
LT		 1794 FreeXid(xid);
1795 return -ELIBACC;
1796 }
1797 }
1798
1799 if(address_type == AF_INET)
1800 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1801 NULL /* no ipv6 addr */,
1802 volume_info.username, &srvTcp);
5858ae44
SF		 1803 else if(address_type == AF_INET6) {
1804 cFYI(1,("looking for ipv6 address"));
1da177e4
LT		 1805 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1806 &sin_server6.sin6_addr,
1807 volume_info.username, &srvTcp);
5858ae44 1808 } else {
f99d49ad
JJ		 1809 kfree(volume_info.UNC);
1810 kfree(volume_info.password);
2fe87f02 1811 kfree(volume_info.prepath);
1da177e4
LT		 1812 FreeXid(xid);
1813 return -EINVAL;
1814 }
1815
1816
1817 if (srvTcp) {
bf820679 1818 cFYI(1, ("Existing tcp session with server found"));
1da177e4 1819 } else { /* create socket */
4523cc30 1820 if (volume_info.port)
1da177e4
LT		 1821 sin_server.sin_port = htons(volume_info.port);
1822 else
1823 sin_server.sin_port = 0;
5858ae44
SF		 1824 if (address_type == AF_INET6) {
1825 cFYI(1,("attempting ipv6 connect"));
1826 /* BB should we allow ipv6 on port 139? */
1827 /* other OS never observed in Wild doing 139 with v6 */
1828 rc = ipv6_connect(&sin_server6,&csocket);
1829 } else
1830 rc = ipv4_connect(&sin_server,&csocket,
a10faeb2
SF		 1831 volume_info.source_rfc1001_name,
1832 volume_info.target_rfc1001_name);
1da177e4
LT		 1833 if (rc < 0) {
1834 cERROR(1,
5858ae44 1835 ("Error connecting to IPv4 socket. Aborting operation"));
4523cc30 1836 if (csocket != NULL)
1da177e4 1837 sock_release(csocket);
f99d49ad
JJ		 1838 kfree(volume_info.UNC);
1839 kfree(volume_info.password);
2fe87f02 1840 kfree(volume_info.prepath);
1da177e4
LT		 1841 FreeXid(xid);
1842 return rc;
1843 }
1844
1845 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1846 if (srvTcp == NULL) {
1847 rc = -ENOMEM;
1848 sock_release(csocket);
f99d49ad
JJ		 1849 kfree(volume_info.UNC);
1850 kfree(volume_info.password);
2fe87f02 1851 kfree(volume_info.prepath);
1da177e4
LT		 1852 FreeXid(xid);
1853 return rc;
1854 } else {
1855 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1856 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1857 atomic_set(&srvTcp->inFlight,0);
1858 /* BB Add code for ipv6 case too */
1859 srvTcp->ssocket = csocket;
1860 srvTcp->protocolType = IPV4;
1861 init_waitqueue_head(&srvTcp->response_q);
1862 init_waitqueue_head(&srvTcp->request_q);
1863 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1864 /* at this point we are the only ones with the pointer
1865 to the struct since the kernel thread not created yet
1866 so no need to spinlock this init of tcpStatus */
1867 srvTcp->tcpStatus = CifsNew;
1868 init_MUTEX(&srvTcp->tcpSem);
aaf737ad 1869 srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
4523cc30 1870 if ( IS_ERR(srvTcp->tsk) ) {
aaf737ad
IM		 1871 rc = PTR_ERR(srvTcp->tsk);
1872 cERROR(1,("error %d create cifsd thread", rc));
1873 srvTcp->tsk = NULL;
1da177e4 1874 sock_release(csocket);
f99d49ad
JJ		 1875 kfree(volume_info.UNC);
1876 kfree(volume_info.password);
2fe87f02 1877 kfree(volume_info.prepath);
1da177e4
LT		 1878 FreeXid(xid);
1879 return rc;
f191401f
SF		 1880 }
1881 wait_for_completion(&cifsd_complete);
1882 rc = 0;
1da177e4 1883 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
a10faeb2 1884 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
ad009ac9 1885 srvTcp->sequence_number = 0;
1da177e4
LT		 1886 }
1887 }
1888
1889 if (existingCifsSes) {
1890 pSesInfo = existingCifsSes;
bf820679 1891 cFYI(1, ("Existing smb sess found"));
f99d49ad 1892 kfree(volume_info.password);
1da177e4
LT		 1893 /* volume_info.UNC freed at end of function */
1894 } else if (!rc) {
bf820679 1895 cFYI(1, ("Existing smb sess not found"));
1da177e4
LT		 1896 pSesInfo = sesInfoAlloc();
1897 if (pSesInfo == NULL)
1898 rc = -ENOMEM;
1899 else {
1900 pSesInfo->server = srvTcp;
1901 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1902 NIPQUAD(sin_server.sin_addr.s_addr));
1903 }
1904
1905 if (!rc){
1906 /* volume_info.password freed at unmount */
1907 if (volume_info.password)
1908 pSesInfo->password = volume_info.password;
1909 if (volume_info.username)
1910 strncpy(pSesInfo->userName,
1911 volume_info.username,MAX_USERNAME_SIZE);
3979877e
SF		 1912 if (volume_info.domainname) {
1913 int len = strlen(volume_info.domainname);
1914 pSesInfo->domainName =
1915 kmalloc(len + 1, GFP_KERNEL);
4523cc30 1916 if (pSesInfo->domainName)
3979877e
SF		 1917 strcpy(pSesInfo->domainName,
1918 volume_info.domainname);
1919 }
1da177e4 1920 pSesInfo->linux_uid = volume_info.linux_uid;
750d1151 1921 pSesInfo->overrideSecFlg = volume_info.secFlg;
1da177e4 1922 down(&pSesInfo->sesSem);
189acaae 1923 /* BB FIXME need to pass vol->secFlgs BB */
1da177e4
LT		 1924 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1925 up(&pSesInfo->sesSem);
4523cc30 1926 if (!rc)
1da177e4
LT		 1927 atomic_inc(&srvTcp->socketUseCount);
1928 } else
f99d49ad 1929 kfree(volume_info.password);
1da177e4
LT		 1930 }
1931
1932 /* search for existing tcon to this server share */
1933 if (!rc) {
4523cc30 1934 if (volume_info.rsize > CIFSMaxBufSize) {
0ae0efad
SF		 1935 cERROR(1,("rsize %d too large, using MaxBufSize",
1936 volume_info.rsize));
1937 cifs_sb->rsize = CIFSMaxBufSize;
1938 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1da177e4 1939 cifs_sb->rsize = volume_info.rsize;
0ae0efad
SF		 1940 else /* default */
1941 cifs_sb->rsize = CIFSMaxBufSize;
1942
4523cc30 1943 if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
0ae0efad
SF		 1944 cERROR(1,("wsize %d too large using 4096 instead",
1945 volume_info.wsize));
1946 cifs_sb->wsize = 4096;
4523cc30 1947 } else if (volume_info.wsize)
1da177e4
LT		 1948 cifs_sb->wsize = volume_info.wsize;
1949 else
17cbbafe 1950 cifs_sb->wsize =
1877c9ea
SF		 1951 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1952 127*1024);
17cbbafe
SF		 1953 /* old default of CIFSMaxBufSize was too small now
1954 that SMB Write2 can send multiple pages in kvec.
1955 RFC1001 does not describe what happens when frame
1956 bigger than 128K is sent so use that as max in
1957 conjunction with 52K kvec constraint on arch with 4K
1958 page size */
1959
4523cc30 1960 if (cifs_sb->rsize < 2048) {
6cec2aed
SF		 1961 cifs_sb->rsize = 2048;
1962 /* Windows ME may prefer this */
1963 cFYI(1,("readsize set to minimum 2048"));
1da177e4 1964 }
2fe87f02
SF		 1965 /* calculate prepath */
1966 cifs_sb->prepath = volume_info.prepath;
4523cc30 1967 if (cifs_sb->prepath) {
2fe87f02
SF		 1968 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1969 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1970 volume_info.prepath = NULL;
1971 } else
1972 cifs_sb->prepathlen = 0;
1da177e4
LT		 1973 cifs_sb->mnt_uid = volume_info.linux_uid;
1974 cifs_sb->mnt_gid = volume_info.linux_gid;
1975 cifs_sb->mnt_file_mode = volume_info.file_mode;
1976 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
eeac8047
SF		 1977 cFYI(1,("file mode: 0x%x dir mode: 0x%x",
1978 cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1da177e4 1979
4523cc30 1980 if (volume_info.noperm)
1da177e4 1981 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
4523cc30 1982 if (volume_info.setuids)
1da177e4 1983 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
4523cc30 1984 if (volume_info.server_ino)
1da177e4 1985 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
4523cc30 1986 if (volume_info.remap)
6a0b4824 1987 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
4523cc30 1988 if (volume_info.no_xattr)
1da177e4 1989 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
4523cc30 1990 if (volume_info.sfu_emul)
d7245c2c 1991 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
4523cc30 1992 if (volume_info.nobrl)
c46fa8ac 1993 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
4523cc30 1994 if (volume_info.cifs_acl)
0a4b92c0 1995 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
4523cc30
SF		 1996 if (volume_info.override_uid)
1997 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
1998 if (volume_info.override_gid)
1999 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2000 if (volume_info.direct_io) {
c46fa8ac 2001 cFYI(1,("mounting share using direct i/o"));
1da177e4
LT		 2002 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2003 }
2004
2005 tcon =
2006 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
2007 volume_info.username);
2008 if (tcon) {
bf820679 2009 cFYI(1, ("Found match on UNC path"));
1da177e4
LT		 2010 /* we can have only one retry value for a connection
2011 to a share so for resources mounted more than once
2012 to the same server share the last value passed in
2013 for the retry flag is used */
2014 tcon->retry = volume_info.retry;
d3485d37 2015 tcon->nocase = volume_info.nocase;
1da177e4
LT		 2016 } else {
2017 tcon = tconInfoAlloc();
2018 if (tcon == NULL)
2019 rc = -ENOMEM;
2020 else {
8af18971
SF		 2021 /* check for null share name ie connecting to
2022 * dfs root */
1da177e4 2023
8af18971
SF		 2024 /* BB check if this works for exactly length
2025 * three strings */
1da177e4
LT		 2026 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2027 && (strchr(volume_info.UNC + 3, '/') ==
2028 NULL)) {
737b758c 2029 rc = connect_to_dfs_path(xid, pSesInfo,
8af18971
SF		 2030 "", cifs_sb->local_nls,
2031 cifs_sb->mnt_cifs_flags &
2032 CIFS_MOUNT_MAP_SPECIAL_CHR);
f99d49ad 2033 kfree(volume_info.UNC);
1da177e4
LT		 2034 FreeXid(xid);
2035 return -ENODEV;
2036 } else {
8af18971
SF		 2037 /* BB Do we need to wrap sesSem around
2038 * this TCon call and Unix SetFS as
2039 * we do on SessSetup and reconnect? */
1da177e4
LT		 2040 rc = CIFSTCon(xid, pSesInfo,
2041 volume_info.UNC,
2042 tcon, cifs_sb->local_nls);
2043 cFYI(1, ("CIFS Tcon rc = %d", rc));
2044 }
2045 if (!rc) {
2046 atomic_inc(&pSesInfo->inUse);
2047 tcon->retry = volume_info.retry;
d3485d37 2048 tcon->nocase = volume_info.nocase;
1da177e4
LT		 2049 }
2050 }
2051 }
2052 }
4523cc30 2053 if (pSesInfo) {
1da177e4
LT		 2054 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2055 sb->s_maxbytes = (u64) 1 << 63;
2056 } else
2057 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2058 }
2059
8af18971 2060 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
1da177e4
LT		 2061 sb->s_time_gran = 100;
2062
2063/* on error free sesinfo and tcon struct if needed */
2064 if (rc) {
2065 /* if session setup failed, use count is zero but
2066 we still need to free cifsd thread */
4523cc30 2067 if (atomic_read(&srvTcp->socketUseCount) == 0) {
1da177e4
LT		 2068 spin_lock(&GlobalMid_Lock);
2069 srvTcp->tcpStatus = CifsExiting;
2070 spin_unlock(&GlobalMid_Lock);
4523cc30 2071 if (srvTcp->tsk) {
28356a16
SF		 2072 struct task_struct *tsk;
2073 /* If we could verify that kthread_stop would
2074 always wake up processes blocked in
2075 tcp in recv_mesg then we could remove the
2076 send_sig call */
1da177e4 2077 send_sig(SIGKILL,srvTcp->tsk,1);
28356a16
SF		 2078 tsk = srvTcp->tsk;
2079 if(tsk)
f7f7c31c 2080 kthread_stop(tsk);
f191401f 2081 }
1da177e4
LT		 2082 }
2083 /* If find_unc succeeded then rc == 0 so we can not end */
2084 if (tcon) /* up accidently freeing someone elses tcon struct */
2085 tconInfoFree(tcon);
2086 if (existingCifsSes == NULL) {
2087 if (pSesInfo) {
2088 if ((pSesInfo->server) &&
2089 (pSesInfo->status == CifsGood)) {
2090 int temp_rc;
2091 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2092 /* if the socketUseCount is now zero */
4523cc30 2093 if ((temp_rc == -ESHUTDOWN) &&
aaf737ad 2094 (pSesInfo->server) && (pSesInfo->server->tsk)) {
28356a16 2095 struct task_struct *tsk;
1da177e4 2096 send_sig(SIGKILL,pSesInfo->server->tsk,1);
28356a16 2097 tsk = pSesInfo->server->tsk;
f7f7c31c 2098 if (tsk)
28356a16 2099 kthread_stop(tsk);
f191401f 2100 }
1da177e4
LT		 2101 } else
2102 cFYI(1, ("No session or bad tcon"));
2103 sesInfoFree(pSesInfo);
2104 /* pSesInfo = NULL; */
2105 }
2106 }
2107 } else {
2108 atomic_inc(&tcon->useCount);
2109 cifs_sb->tcon = tcon;
2110 tcon->ses = pSesInfo;
2111
82940a46 2112 /* do not care if following two calls succeed - informational */
737b758c
SF		 2113 CIFSSMBQFSDeviceInfo(xid, tcon);
2114 CIFSSMBQFSAttributeInfo(xid, tcon);
8af18971
SF		 2115
2116 /* tell server which Unix caps we support */
2117 if (tcon->ses->capabilities & CAP_UNIX)
2118 reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2119
3e84469d
SF		 2120 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2121 cifs_sb->wsize = min(cifs_sb->wsize,
2122 (tcon->ses->server->maxBuf -
2123 MAX_CIFS_HDR_SIZE));
0ae0efad
SF		 2124 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2125 cifs_sb->rsize = min(cifs_sb->rsize,
2126 (tcon->ses->server->maxBuf -
2127 MAX_CIFS_HDR_SIZE));
1da177e4
LT		 2128 }
2129
2130 /* volume_info.password is freed above when existing session found
2131 (in which case it is not needed anymore) but when new sesion is created
2132 the password ptr is put in the new session structure (in which case the
2133 password will be freed at unmount time) */
f99d49ad 2134 kfree(volume_info.UNC);
2fe87f02 2135 kfree(volume_info.prepath);
1da177e4
LT		 2136 FreeXid(xid);
2137 return rc;
2138}
2139
2140static int
2141CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
7c7b25bc 2142 char session_key[CIFS_SESS_KEY_SIZE],
1da177e4
LT		 2143 const struct nls_table *nls_codepage)
2144{
2145 struct smb_hdr *smb_buffer;
2146 struct smb_hdr *smb_buffer_response;
2147 SESSION_SETUP_ANDX *pSMB;
2148 SESSION_SETUP_ANDX *pSMBr;
2149 char *bcc_ptr;
2150 char *user;
2151 char *domain;
2152 int rc = 0;
2153 int remaining_words = 0;
2154 int bytes_returned = 0;
2155 int len;
2156 __u32 capabilities;
2157 __u16 count;
2158
eeac8047 2159 cFYI(1, ("In sesssetup"));
4523cc30 2160 if (ses == NULL)
1da177e4
LT		 2161 return -EINVAL;
2162 user = ses->userName;
2163 domain = ses->domainName;
2164 smb_buffer = cifs_buf_get();
2165 if (smb_buffer == NULL) {
2166 return -ENOMEM;
2167 }
2168 smb_buffer_response = smb_buffer;
2169 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2170
2171 /* send SMBsessionSetup here */
2172 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2173 NULL /* no tCon exists yet */ , 13 /* wct */ );
2174
1982c344 2175 smb_buffer->Mid = GetNextMid(ses->server);
1da177e4
LT		 2176 pSMB->req_no_secext.AndXCommand = 0xFF;
2177 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2178 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2179
2180 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2181 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2182
2183 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2184 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2185 if (ses->capabilities & CAP_UNICODE) {
2186 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2187 capabilities |= CAP_UNICODE;
2188 }
2189 if (ses->capabilities & CAP_STATUS32) {
2190 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2191 capabilities |= CAP_STATUS32;
2192 }
2193 if (ses->capabilities & CAP_DFS) {
2194 smb_buffer->Flags2 |= SMBFLG2_DFS;
2195 capabilities |= CAP_DFS;
2196 }
2197 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2198
2199 pSMB->req_no_secext.CaseInsensitivePasswordLength =
7c7b25bc 2200 cpu_to_le16(CIFS_SESS_KEY_SIZE);
1da177e4
LT		 2201
2202 pSMB->req_no_secext.CaseSensitivePasswordLength =
7c7b25bc 2203 cpu_to_le16(CIFS_SESS_KEY_SIZE);
1da177e4 2204 bcc_ptr = pByteArea(smb_buffer);
7c7b25bc
SF		 2205 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2206 bcc_ptr += CIFS_SESS_KEY_SIZE;
2207 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2208 bcc_ptr += CIFS_SESS_KEY_SIZE;
1da177e4
LT		 2209
2210 if (ses->capabilities & CAP_UNICODE) {
2211 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2212 *bcc_ptr = 0;
2213 bcc_ptr++;
2214 }
4523cc30 2215 if (user == NULL)
3979877e 2216 bytes_returned = 0; /* skip null user */
1da177e4
LT		 2217 else
2218 bytes_returned =
e89dc920 2219 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
1da177e4
LT		 2220 nls_codepage);
2221 /* convert number of 16 bit words to bytes */
2222 bcc_ptr += 2 * bytes_returned;
2223 bcc_ptr += 2; /* trailing null */
2224 if (domain == NULL)
2225 bytes_returned =
e89dc920 2226 cifs_strtoUCS((__le16 *) bcc_ptr,
1da177e4
LT		 2227 "CIFS_LINUX_DOM", 32, nls_codepage);
2228 else
2229 bytes_returned =
e89dc920 2230 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
1da177e4
LT		 2231 nls_codepage);
2232 bcc_ptr += 2 * bytes_returned;
2233 bcc_ptr += 2;
2234 bytes_returned =
e89dc920 2235 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
1da177e4
LT		 2236 32, nls_codepage);
2237 bcc_ptr += 2 * bytes_returned;
2238 bytes_returned =
e9ff3990 2239 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
1da177e4
LT		 2240 32, nls_codepage);
2241 bcc_ptr += 2 * bytes_returned;
2242 bcc_ptr += 2;
2243 bytes_returned =
e89dc920 2244 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
1da177e4
LT		 2245 64, nls_codepage);
2246 bcc_ptr += 2 * bytes_returned;
2247 bcc_ptr += 2;
2248 } else {
4523cc30 2249 if (user != NULL) {
1da177e4
LT		 2250 strncpy(bcc_ptr, user, 200);
2251 bcc_ptr += strnlen(user, 200);
2252 }
2253 *bcc_ptr = 0;
2254 bcc_ptr++;
2255 if (domain == NULL) {
2256 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2257 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2258 } else {
2259 strncpy(bcc_ptr, domain, 64);
2260 bcc_ptr += strnlen(domain, 64);
2261 *bcc_ptr = 0;
2262 bcc_ptr++;
2263 }
2264 strcpy(bcc_ptr, "Linux version ");
2265 bcc_ptr += strlen("Linux version ");
e9ff3990
SH		 2266 strcpy(bcc_ptr, utsname()->release);
2267 bcc_ptr += strlen(utsname()->release) + 1;
1da177e4
LT		 2268 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2269 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2270 }
2271 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2272 smb_buffer->smb_buf_length += count;
2273 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2274
2275 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2276 &bytes_returned, 1);
2277 if (rc) {
2278/* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2279 } else if ((smb_buffer_response->WordCount == 3)
2280 || (smb_buffer_response->WordCount == 4)) {
2281 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2282 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2283 if (action & GUEST_LOGIN)
2284 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2285 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2286 cFYI(1, ("UID = %d ", ses->Suid));
2287 /* response can have either 3 or 4 word count - Samba sends 3 */
2288 bcc_ptr = pByteArea(smb_buffer_response);
2289 if ((pSMBr->resp.hdr.WordCount == 3)
2290 || ((pSMBr->resp.hdr.WordCount == 4)
2291 && (blob_len < pSMBr->resp.ByteCount))) {
2292 if (pSMBr->resp.hdr.WordCount == 4)
2293 bcc_ptr += blob_len;
2294
2295 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2296 if ((long) (bcc_ptr) % 2) {
2297 remaining_words =
2298 (BCC(smb_buffer_response) - 1) /2;
2299 bcc_ptr++; /* Unicode strings must be word aligned */
2300 } else {
2301 remaining_words =
2302 BCC(smb_buffer_response) / 2;
2303 }
2304 len =
2305 UniStrnlen((wchar_t *) bcc_ptr,
2306 remaining_words - 1);
2307/* We look for obvious messed up bcc or strings in response so we do not go off
2308 the end since (at least) WIN2K and Windows XP have a major bug in not null
2309 terminating last Unicode string in response */
a424f8bf
SF		 2310 if(ses->serverOS)
2311 kfree(ses->serverOS);
e915fc49 2312 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
433dc24f
SF		 2313 if(ses->serverOS == NULL)
2314 goto sesssetup_nomem;
1da177e4 2315 cifs_strfromUCS_le(ses->serverOS,
e89dc920 2316 (__le16 *)bcc_ptr, len,nls_codepage);
1da177e4
LT		 2317 bcc_ptr += 2 * (len + 1);
2318 remaining_words -= len + 1;
2319 ses->serverOS[2 * len] = 0;
2320 ses->serverOS[1 + (2 * len)] = 0;
2321 if (remaining_words > 0) {
2322 len = UniStrnlen((wchar_t *)bcc_ptr,
2323 remaining_words-1);
cd49b492 2324 kfree(ses->serverNOS);
e915fc49 2325 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
433dc24f
SF		 2326 if(ses->serverNOS == NULL)
2327 goto sesssetup_nomem;
1da177e4 2328 cifs_strfromUCS_le(ses->serverNOS,
e89dc920 2329 (__le16 *)bcc_ptr,len,nls_codepage);
1da177e4
LT		 2330 bcc_ptr += 2 * (len + 1);
2331 ses->serverNOS[2 * len] = 0;
2332 ses->serverNOS[1 + (2 * len)] = 0;
2333 if(strncmp(ses->serverNOS,
2334 "NT LAN Manager 4",16) == 0) {
2335 cFYI(1,("NT4 server"));
2336 ses->flags |= CIFS_SES_NT4;
2337 }
2338 remaining_words -= len + 1;
2339 if (remaining_words > 0) {
433dc24f 2340 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
1da177e4 2341 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
a424f8bf
SF		 2342 if(ses->serverDomain)
2343 kfree(ses->serverDomain);
1da177e4 2344 ses->serverDomain =
e915fc49 2345 kzalloc(2*(len+1),GFP_KERNEL);
433dc24f
SF		 2346 if(ses->serverDomain == NULL)
2347 goto sesssetup_nomem;
1da177e4 2348 cifs_strfromUCS_le(ses->serverDomain,
e89dc920 2349 (__le16 *)bcc_ptr,len,nls_codepage);
1da177e4
LT		 2350 bcc_ptr += 2 * (len + 1);
2351 ses->serverDomain[2*len] = 0;
2352 ses->serverDomain[1+(2*len)] = 0;
2353 } /* else no more room so create dummy domain string */
a424f8bf
SF		 2354 else {
2355 if(ses->serverDomain)
2356 kfree(ses->serverDomain);
433dc24f 2357 ses->serverDomain =
e915fc49 2358 kzalloc(2, GFP_KERNEL);
a424f8bf 2359 }
1da177e4 2360 } else { /* no room so create dummy domain and NOS string */
433dc24f
SF		 2361 /* if these kcallocs fail not much we
2362 can do, but better to not fail the
2363 sesssetup itself */
cd49b492 2364 kfree(ses->serverDomain);
1da177e4 2365 ses->serverDomain =
e915fc49 2366 kzalloc(2, GFP_KERNEL);
cd49b492 2367 kfree(ses->serverNOS);
1da177e4 2368 ses->serverNOS =
e915fc49 2369 kzalloc(2, GFP_KERNEL);
1da177e4
LT		 2370 }
2371 } else { /* ASCII */
2372 len = strnlen(bcc_ptr, 1024);
2373 if (((long) bcc_ptr + len) - (long)
2374 pByteArea(smb_buffer_response)
2375 <= BCC(smb_buffer_response)) {
cd49b492 2376 kfree(ses->serverOS);
e915fc49 2377 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
433dc24f
SF		 2378 if(ses->serverOS == NULL)
2379 goto sesssetup_nomem;
1da177e4
LT		 2380 strncpy(ses->serverOS,bcc_ptr, len);
2381
2382 bcc_ptr += len;
2383 bcc_ptr[0] = 0; /* null terminate the string */
2384 bcc_ptr++;
2385
2386 len = strnlen(bcc_ptr, 1024);
cd49b492 2387 kfree(ses->serverNOS);
e915fc49 2388 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
433dc24f
SF		 2389 if(ses->serverNOS == NULL)
2390 goto sesssetup_nomem;
1da177e4
LT		 2391 strncpy(ses->serverNOS, bcc_ptr, len);
2392 bcc_ptr += len;
2393 bcc_ptr[0] = 0;
2394 bcc_ptr++;
2395
2396 len = strnlen(bcc_ptr, 1024);
a424f8bf
SF		 2397 if(ses->serverDomain)
2398 kfree(ses->serverDomain);
e915fc49 2399 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
433dc24f
SF		 2400 if(ses->serverDomain == NULL)
2401 goto sesssetup_nomem;
1da177e4
LT		 2402 strncpy(ses->serverDomain, bcc_ptr, len);
2403 bcc_ptr += len;
2404 bcc_ptr[0] = 0;
2405 bcc_ptr++;
2406 } else
2407 cFYI(1,
2408 ("Variable field of length %d extends beyond end of smb ",
2409 len));
2410 }
2411 } else {
2412 cERROR(1,
2413 (" Security Blob Length extends beyond end of SMB"));
2414 }
2415 } else {
2416 cERROR(1,
2417 (" Invalid Word count %d: ",
2418 smb_buffer_response->WordCount));
2419 rc = -EIO;
2420 }
433dc24f
SF		 2421sesssetup_nomem: /* do not return an error on nomem for the info strings,
2422 since that could make reconnection harder, and
2423 reconnection might be needed to free memory */
1da177e4
LT		 2424 if (smb_buffer)
2425 cifs_buf_release(smb_buffer);
2426
2427 return rc;
2428}
2429
1da177e4
LT		 2430static int
2431CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2432 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2433 const struct nls_table *nls_codepage)
2434{
2435 struct smb_hdr *smb_buffer;
2436 struct smb_hdr *smb_buffer_response;
2437 SESSION_SETUP_ANDX *pSMB;
2438 SESSION_SETUP_ANDX *pSMBr;
2439 char *bcc_ptr;
2440 char *domain;
2441 int rc = 0;
2442 int remaining_words = 0;
2443 int bytes_returned = 0;
2444 int len;
2445 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2446 PNEGOTIATE_MESSAGE SecurityBlob;
2447 PCHALLENGE_MESSAGE SecurityBlob2;
2448 __u32 negotiate_flags, capabilities;
2449 __u16 count;
2450
12b3b8ff 2451 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
1da177e4
LT		 2452 if(ses == NULL)
2453 return -EINVAL;
2454 domain = ses->domainName;
2455 *pNTLMv2_flag = FALSE;
2456 smb_buffer = cifs_buf_get();
2457 if (smb_buffer == NULL) {
2458 return -ENOMEM;
2459 }
2460 smb_buffer_response = smb_buffer;
2461 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2462 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2463
2464 /* send SMBsessionSetup here */
2465 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2466 NULL /* no tCon exists yet */ , 12 /* wct */ );
1982c344
SF		 2467
2468 smb_buffer->Mid = GetNextMid(ses->server);
1da177e4
LT		 2469 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2470 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2471
2472 pSMB->req.AndXCommand = 0xFF;
2473 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2474 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2475
2476 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2477 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2478
2479 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2480 CAP_EXTENDED_SECURITY;
2481 if (ses->capabilities & CAP_UNICODE) {
2482 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2483 capabilities |= CAP_UNICODE;
2484 }
2485 if (ses->capabilities & CAP_STATUS32) {
2486 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2487 capabilities |= CAP_STATUS32;
2488 }
2489 if (ses->capabilities & CAP_DFS) {
2490 smb_buffer->Flags2 |= SMBFLG2_DFS;
2491 capabilities |= CAP_DFS;
2492 }
2493 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2494
2495 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2496 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2497 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2498 SecurityBlob->MessageType = NtLmNegotiate;
2499 negotiate_flags =
2500 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
12b3b8ff
SF		 2501 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2502 NTLMSSP_NEGOTIATE_56 |
1da177e4
LT		 2503 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2504 if(sign_CIFS_PDUs)
2505 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
3979877e
SF		 2506/* if(ntlmv2_support)
2507 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
1da177e4
LT		 2508 /* setup pointers to domain name and workstation name */
2509 bcc_ptr += SecurityBlobLength;
2510
2511 SecurityBlob->WorkstationName.Buffer = 0;
2512 SecurityBlob->WorkstationName.Length = 0;
2513 SecurityBlob->WorkstationName.MaximumLength = 0;
2514
12b3b8ff
SF		 2515 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2516 along with username on auth request (ie the response to challenge) */
2517 SecurityBlob->DomainName.Buffer = 0;
2518 SecurityBlob->DomainName.Length = 0;
2519 SecurityBlob->DomainName.MaximumLength = 0;
1da177e4
LT		 2520 if (ses->capabilities & CAP_UNICODE) {
2521 if ((long) bcc_ptr % 2) {
2522 *bcc_ptr = 0;
2523 bcc_ptr++;
2524 }
2525
2526 bytes_returned =
e89dc920 2527 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
1da177e4
LT		 2528 32, nls_codepage);
2529 bcc_ptr += 2 * bytes_returned;
2530 bytes_returned =
e9ff3990 2531 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
1da177e4
LT		 2532 nls_codepage);
2533 bcc_ptr += 2 * bytes_returned;
2534 bcc_ptr += 2; /* null terminate Linux version */
2535 bytes_returned =
e89dc920 2536 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
1da177e4
LT		 2537 64, nls_codepage);
2538 bcc_ptr += 2 * bytes_returned;
2539 *(bcc_ptr + 1) = 0;
2540 *(bcc_ptr + 2) = 0;
2541 bcc_ptr += 2; /* null terminate network opsys string */
2542 *(bcc_ptr + 1) = 0;
2543 *(bcc_ptr + 2) = 0;
2544 bcc_ptr += 2; /* null domain */
2545 } else { /* ASCII */
2546 strcpy(bcc_ptr, "Linux version ");
2547 bcc_ptr += strlen("Linux version ");
e9ff3990
SH		 2548 strcpy(bcc_ptr, utsname()->release);
2549 bcc_ptr += strlen(utsname()->release) + 1;
1da177e4
LT		 2550 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2551 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2552 bcc_ptr++; /* empty domain field */
2553 *bcc_ptr = 0;
2554 }
2555 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2556 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2557 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2558 smb_buffer->smb_buf_length += count;
2559 pSMB->req.ByteCount = cpu_to_le16(count);
2560
2561 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2562 &bytes_returned, 1);
2563
2564 if (smb_buffer_response->Status.CifsError ==
2565 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2566 rc = 0;
2567
2568 if (rc) {
2569/* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2570 } else if ((smb_buffer_response->WordCount == 3)
2571 || (smb_buffer_response->WordCount == 4)) {
2572 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2573 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2574
2575 if (action & GUEST_LOGIN)
2576 cFYI(1, (" Guest login"));
2577 /* Do we want to set anything in SesInfo struct when guest login? */
2578
2579 bcc_ptr = pByteArea(smb_buffer_response);
2580 /* response can have either 3 or 4 word count - Samba sends 3 */
2581
2582 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2583 if (SecurityBlob2->MessageType != NtLmChallenge) {
2584 cFYI(1,
2585 ("Unexpected NTLMSSP message type received %d",
2586 SecurityBlob2->MessageType));
2587 } else if (ses) {
2588 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
12b3b8ff 2589 cFYI(1, ("UID = %d", ses->Suid));
1da177e4
LT		 2590 if ((pSMBr->resp.hdr.WordCount == 3)
2591 || ((pSMBr->resp.hdr.WordCount == 4)
2592 && (blob_len <
2593 pSMBr->resp.ByteCount))) {
2594
2595 if (pSMBr->resp.hdr.WordCount == 4) {
2596 bcc_ptr += blob_len;
12b3b8ff 2597 cFYI(1, ("Security Blob Length %d",
1da177e4
LT		 2598 blob_len));
2599 }
2600
12b3b8ff 2601 cFYI(1, ("NTLMSSP Challenge rcvd"));
1da177e4
LT		 2602
2603 memcpy(ses->server->cryptKey,
2604 SecurityBlob2->Challenge,
2605 CIFS_CRYPTO_KEY_SIZE);
12b3b8ff
SF		 2606 if(SecurityBlob2->NegotiateFlags &
2607 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
1da177e4
LT		 2608 *pNTLMv2_flag = TRUE;
2609
2610 if((SecurityBlob2->NegotiateFlags &
2611 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2612 || (sign_CIFS_PDUs > 1))
2613 ses->server->secMode |=
2614 SECMODE_SIGN_REQUIRED;
2615 if ((SecurityBlob2->NegotiateFlags &
2616 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2617 ses->server->secMode |=
2618 SECMODE_SIGN_ENABLED;
2619
2620 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2621 if ((long) (bcc_ptr) % 2) {
2622 remaining_words =
2623 (BCC(smb_buffer_response)
2624 - 1) / 2;
2625 bcc_ptr++; /* Unicode strings must be word aligned */
2626 } else {
2627 remaining_words =
2628 BCC
2629 (smb_buffer_response) / 2;
2630 }
2631 len =
2632 UniStrnlen((wchar_t *) bcc_ptr,
2633 remaining_words - 1);
2634/* We look for obvious messed up bcc or strings in response so we do not go off
2635 the end since (at least) WIN2K and Windows XP have a major bug in not null
2636 terminating last Unicode string in response */
a424f8bf
SF		 2637 if(ses->serverOS)
2638 kfree(ses->serverOS);
1da177e4 2639 ses->serverOS =
e915fc49 2640 kzalloc(2 * (len + 1), GFP_KERNEL);
1da177e4 2641 cifs_strfromUCS_le(ses->serverOS,
e89dc920 2642 (__le16 *)
1da177e4
LT		 2643 bcc_ptr, len,
2644 nls_codepage);
2645 bcc_ptr += 2 * (len + 1);
2646 remaining_words -= len + 1;
2647 ses->serverOS[2 * len] = 0;
2648 ses->serverOS[1 + (2 * len)] = 0;
2649 if (remaining_words > 0) {
2650 len = UniStrnlen((wchar_t *)
2651 bcc_ptr,
2652 remaining_words
2653 - 1);
cd49b492 2654 kfree(ses->serverNOS);
1da177e4 2655 ses->serverNOS =
e915fc49 2656 kzalloc(2 * (len + 1),
1da177e4
LT		 2657 GFP_KERNEL);
2658 cifs_strfromUCS_le(ses->
2659 serverNOS,
e89dc920 2660 (__le16 *)
1da177e4
LT		 2661 bcc_ptr,
2662 len,
2663 nls_codepage);
2664 bcc_ptr += 2 * (len + 1);
2665 ses->serverNOS[2 * len] = 0;
2666 ses->serverNOS[1 +
2667 (2 * len)] = 0;
2668 remaining_words -= len + 1;
2669 if (remaining_words > 0) {
2670 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2671 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
cd49b492 2672 kfree(ses->serverDomain);
1da177e4 2673 ses->serverDomain =
e915fc49 2674 kzalloc(2 *
1da177e4
LT		 2675 (len +
2676 1),
2677 GFP_KERNEL);
2678 cifs_strfromUCS_le
e89dc920
SF		 2679 (ses->serverDomain,
2680 (__le16 *)bcc_ptr,
2681 len, nls_codepage);
1da177e4
LT		 2682 bcc_ptr +=
2683 2 * (len + 1);
e89dc920 2684 ses->serverDomain[2*len]
1da177e4 2685 = 0;
e89dc920
SF		 2686 ses->serverDomain
2687 [1 + (2 * len)]
1da177e4
LT		 2688 = 0;
2689 } /* else no more room so create dummy domain string */
a424f8bf 2690 else {
cd49b492 2691 kfree(ses->serverDomain);
1da177e4 2692 ses->serverDomain =
e915fc49 2693 kzalloc(2,
1da177e4 2694 GFP_KERNEL);
a424f8bf 2695 }
1da177e4 2696 } else { /* no room so create dummy domain and NOS string */
cd49b492 2697 kfree(ses->serverDomain);
1da177e4 2698 ses->serverDomain =
e915fc49 2699 kzalloc(2, GFP_KERNEL);
cd49b492 2700 kfree(ses->serverNOS);
1da177e4 2701 ses->serverNOS =
e915fc49 2702 kzalloc(2, GFP_KERNEL);
1da177e4
LT		 2703 }
2704 } else { /* ASCII */
2705 len = strnlen(bcc_ptr, 1024);
2706 if (((long) bcc_ptr + len) - (long)
2707 pByteArea(smb_buffer_response)
2708 <= BCC(smb_buffer_response)) {
a424f8bf
SF		 2709 if(ses->serverOS)
2710 kfree(ses->serverOS);
1da177e4 2711 ses->serverOS =
e915fc49 2712 kzalloc(len + 1,
1da177e4
LT		 2713 GFP_KERNEL);
2714 strncpy(ses->serverOS,
2715 bcc_ptr, len);
2716
2717 bcc_ptr += len;
2718 bcc_ptr[0] = 0; /* null terminate string */
2719 bcc_ptr++;
2720
2721 len = strnlen(bcc_ptr, 1024);
cd49b492 2722 kfree(ses->serverNOS);
1da177e4 2723 ses->serverNOS =
e915fc49 2724 kzalloc(len + 1,
1da177e4
LT		 2725 GFP_KERNEL);
2726 strncpy(ses->serverNOS, bcc_ptr, len);
2727 bcc_ptr += len;
2728 bcc_ptr[0] = 0;
2729 bcc_ptr++;
2730
2731 len = strnlen(bcc_ptr, 1024);
cd49b492 2732 kfree(ses->serverDomain);
1da177e4 2733 ses->serverDomain =
e915fc49 2734 kzalloc(len + 1,
1da177e4
LT		 2735 GFP_KERNEL);
2736 strncpy(ses->serverDomain, bcc_ptr, len);
2737 bcc_ptr += len;
2738 bcc_ptr[0] = 0;
2739 bcc_ptr++;
2740 } else
2741 cFYI(1,
12b3b8ff 2742 ("Variable field of length %d extends beyond end of smb",
1da177e4
LT		 2743 len));
2744 }
2745 } else {
2746 cERROR(1,
2747 (" Security Blob Length extends beyond end of SMB"));
2748 }
2749 } else {
2750 cERROR(1, ("No session structure passed in."));
2751 }
2752 } else {
2753 cERROR(1,
5815449d 2754 (" Invalid Word count %d:",
1da177e4
LT		 2755 smb_buffer_response->WordCount));
2756 rc = -EIO;
2757 }
2758
2759 if (smb_buffer)
2760 cifs_buf_release(smb_buffer);
2761
2762 return rc;
2763}
2764static int
2765CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2766 char *ntlm_session_key, int ntlmv2_flag,
2767 const struct nls_table *nls_codepage)
2768{
2769 struct smb_hdr *smb_buffer;
2770 struct smb_hdr *smb_buffer_response;
2771 SESSION_SETUP_ANDX *pSMB;
2772 SESSION_SETUP_ANDX *pSMBr;
2773 char *bcc_ptr;
2774 char *user;
2775 char *domain;
2776 int rc = 0;
2777 int remaining_words = 0;
2778 int bytes_returned = 0;
2779 int len;
2780 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2781 PAUTHENTICATE_MESSAGE SecurityBlob;
2782 __u32 negotiate_flags, capabilities;
2783 __u16 count;
2784
2785 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2786 if(ses == NULL)
2787 return -EINVAL;
2788 user = ses->userName;
2789 domain = ses->domainName;
2790 smb_buffer = cifs_buf_get();
2791 if (smb_buffer == NULL) {
2792 return -ENOMEM;
2793 }
2794 smb_buffer_response = smb_buffer;
2795 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2796 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2797
2798 /* send SMBsessionSetup here */
2799 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2800 NULL /* no tCon exists yet */ , 12 /* wct */ );
1982c344
SF		 2801
2802 smb_buffer->Mid = GetNextMid(ses->server);
1da177e4
LT		 2803 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2804 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2805 pSMB->req.AndXCommand = 0xFF;
2806 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2807 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2808
2809 pSMB->req.hdr.Uid = ses->Suid;
2810
2811 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2812 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2813
2814 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2815 CAP_EXTENDED_SECURITY;
2816 if (ses->capabilities & CAP_UNICODE) {
2817 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2818 capabilities |= CAP_UNICODE;
2819 }
2820 if (ses->capabilities & CAP_STATUS32) {
2821 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2822 capabilities |= CAP_STATUS32;
2823 }
2824 if (ses->capabilities & CAP_DFS) {
2825 smb_buffer->Flags2 |= SMBFLG2_DFS;
2826 capabilities |= CAP_DFS;
2827 }
2828 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2829
2830 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2831 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2832 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2833 SecurityBlob->MessageType = NtLmAuthenticate;
2834 bcc_ptr += SecurityBlobLength;
2835 negotiate_flags =
2836 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2837 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2838 0x80000000 | NTLMSSP_NEGOTIATE_128;
2839 if(sign_CIFS_PDUs)
2840 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2841 if(ntlmv2_flag)
2842 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2843
2844/* setup pointers to domain name and workstation name */
2845
2846 SecurityBlob->WorkstationName.Buffer = 0;
2847 SecurityBlob->WorkstationName.Length = 0;
2848 SecurityBlob->WorkstationName.MaximumLength = 0;
2849 SecurityBlob->SessionKey.Length = 0;
2850 SecurityBlob->SessionKey.MaximumLength = 0;
2851 SecurityBlob->SessionKey.Buffer = 0;
2852
2853 SecurityBlob->LmChallengeResponse.Length = 0;
2854 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2855 SecurityBlob->LmChallengeResponse.Buffer = 0;
2856
2857 SecurityBlob->NtChallengeResponse.Length =
7c7b25bc 2858 cpu_to_le16(CIFS_SESS_KEY_SIZE);
1da177e4 2859 SecurityBlob->NtChallengeResponse.MaximumLength =
7c7b25bc
SF		 2860 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2861 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
1da177e4
LT		 2862 SecurityBlob->NtChallengeResponse.Buffer =
2863 cpu_to_le32(SecurityBlobLength);
7c7b25bc
SF		 2864 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2865 bcc_ptr += CIFS_SESS_KEY_SIZE;
1da177e4
LT		 2866
2867 if (ses->capabilities & CAP_UNICODE) {
2868 if (domain == NULL) {
2869 SecurityBlob->DomainName.Buffer = 0;
2870 SecurityBlob->DomainName.Length = 0;
2871 SecurityBlob->DomainName.MaximumLength = 0;
2872 } else {
2873 __u16 len =
e89dc920 2874 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
1da177e4
LT		 2875 nls_codepage);
2876 len *= 2;
2877 SecurityBlob->DomainName.MaximumLength =
2878 cpu_to_le16(len);
2879 SecurityBlob->DomainName.Buffer =
2880 cpu_to_le32(SecurityBlobLength);
2881 bcc_ptr += len;
2882 SecurityBlobLength += len;
2883 SecurityBlob->DomainName.Length =
2884 cpu_to_le16(len);
2885 }
2886 if (user == NULL) {
2887 SecurityBlob->UserName.Buffer = 0;
2888 SecurityBlob->UserName.Length = 0;
2889 SecurityBlob->UserName.MaximumLength = 0;
2890 } else {
2891 __u16 len =
e89dc920 2892 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
1da177e4
LT		 2893 nls_codepage);
2894 len *= 2;
2895 SecurityBlob->UserName.MaximumLength =
2896 cpu_to_le16(len);
2897 SecurityBlob->UserName.Buffer =
2898 cpu_to_le32(SecurityBlobLength);
2899 bcc_ptr += len;
2900 SecurityBlobLength += len;
2901 SecurityBlob->UserName.Length =
2902 cpu_to_le16(len);
2903 }
2904
e89dc920 2905 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
1da177e4
LT		 2906 SecurityBlob->WorkstationName.Length *= 2;
2907 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2908 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2909 bcc_ptr += SecurityBlob->WorkstationName.Length;
2910 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2911 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2912
2913 if ((long) bcc_ptr % 2) {
2914 *bcc_ptr = 0;
2915 bcc_ptr++;
2916 }
2917 bytes_returned =
e89dc920 2918 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
1da177e4
LT		 2919 32, nls_codepage);
2920 bcc_ptr += 2 * bytes_returned;
2921 bytes_returned =
e9ff3990 2922 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
1da177e4
LT		 2923 nls_codepage);
2924 bcc_ptr += 2 * bytes_returned;
2925 bcc_ptr += 2; /* null term version string */
2926 bytes_returned =
e89dc920 2927 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
1da177e4
LT		 2928 64, nls_codepage);
2929 bcc_ptr += 2 * bytes_returned;
2930 *(bcc_ptr + 1) = 0;
2931 *(bcc_ptr + 2) = 0;
2932 bcc_ptr += 2; /* null terminate network opsys string */
2933 *(bcc_ptr + 1) = 0;
2934 *(bcc_ptr + 2) = 0;
2935 bcc_ptr += 2; /* null domain */
2936 } else { /* ASCII */
2937 if (domain == NULL) {
2938 SecurityBlob->DomainName.Buffer = 0;
2939 SecurityBlob->DomainName.Length = 0;
2940 SecurityBlob->DomainName.MaximumLength = 0;
2941 } else {
2942 __u16 len;
2943 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2944 strncpy(bcc_ptr, domain, 63);
2945 len = strnlen(domain, 64);
2946 SecurityBlob->DomainName.MaximumLength =
2947 cpu_to_le16(len);
2948 SecurityBlob->DomainName.Buffer =
2949 cpu_to_le32(SecurityBlobLength);
2950 bcc_ptr += len;
2951 SecurityBlobLength += len;
2952 SecurityBlob->DomainName.Length = cpu_to_le16(len);
2953 }
2954 if (user == NULL) {
2955 SecurityBlob->UserName.Buffer = 0;
2956 SecurityBlob->UserName.Length = 0;
2957 SecurityBlob->UserName.MaximumLength = 0;
2958 } else {
2959 __u16 len;
2960 strncpy(bcc_ptr, user, 63);
2961 len = strnlen(user, 64);
2962 SecurityBlob->UserName.MaximumLength =
2963 cpu_to_le16(len);
2964 SecurityBlob->UserName.Buffer =
2965 cpu_to_le32(SecurityBlobLength);
2966 bcc_ptr += len;
2967 SecurityBlobLength += len;
2968 SecurityBlob->UserName.Length = cpu_to_le16(len);
2969 }
2970 /* BB fill in our workstation name if known BB */
2971
2972 strcpy(bcc_ptr, "Linux version ");
2973 bcc_ptr += strlen("Linux version ");
e9ff3990
SH		 2974 strcpy(bcc_ptr, utsname()->release);
2975 bcc_ptr += strlen(utsname()->release) + 1;
1da177e4
LT		 2976 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2977 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2978 bcc_ptr++; /* null domain */
2979 *bcc_ptr = 0;
2980 }
2981 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2982 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2983 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2984 smb_buffer->smb_buf_length += count;
2985 pSMB->req.ByteCount = cpu_to_le16(count);
2986
2987 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2988 &bytes_returned, 1);
2989 if (rc) {
2990/* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2991 } else if ((smb_buffer_response->WordCount == 3)
2992 || (smb_buffer_response->WordCount == 4)) {
2993 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2994 __u16 blob_len =
2995 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2996 if (action & GUEST_LOGIN)
2997 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
2998/* if(SecurityBlob2->MessageType != NtLm??){
2999 cFYI("Unexpected message type on auth response is %d "));
3000 } */
3001 if (ses) {
3002 cFYI(1,
3003 ("Does UID on challenge %d match auth response UID %d ",
3004 ses->Suid, smb_buffer_response->Uid));
3005 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
3006 bcc_ptr = pByteArea(smb_buffer_response);
3007 /* response can have either 3 or 4 word count - Samba sends 3 */
3008 if ((pSMBr->resp.hdr.WordCount == 3)
3009 || ((pSMBr->resp.hdr.WordCount == 4)
3010 && (blob_len <
3011 pSMBr->resp.ByteCount))) {
3012 if (pSMBr->resp.hdr.WordCount == 4) {
3013 bcc_ptr +=
3014 blob_len;
3015 cFYI(1,
3016 ("Security Blob Length %d ",
3017 blob_len));
3018 }
3019
3020 cFYI(1,
3021 ("NTLMSSP response to Authenticate "));
3022
3023 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3024 if ((long) (bcc_ptr) % 2) {
3025 remaining_words =
3026 (BCC(smb_buffer_response)
3027 - 1) / 2;
3028 bcc_ptr++; /* Unicode strings must be word aligned */
3029 } else {
3030 remaining_words = BCC(smb_buffer_response) / 2;
3031 }
3032 len =
3033 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3034/* We look for obvious messed up bcc or strings in response so we do not go off
3035 the end since (at least) WIN2K and Windows XP have a major bug in not null
3036 terminating last Unicode string in response */
a424f8bf 3037 if(ses->serverOS)
08775834 3038 kfree(ses->serverOS);
1da177e4 3039 ses->serverOS =
e915fc49 3040 kzalloc(2 * (len + 1), GFP_KERNEL);
1da177e4 3041 cifs_strfromUCS_le(ses->serverOS,
e89dc920 3042 (__le16 *)
1da177e4
LT		 3043 bcc_ptr, len,
3044 nls_codepage);
3045 bcc_ptr += 2 * (len + 1);
3046 remaining_words -= len + 1;
3047 ses->serverOS[2 * len] = 0;
3048 ses->serverOS[1 + (2 * len)] = 0;
3049 if (remaining_words > 0) {
3050 len = UniStrnlen((wchar_t *)
3051 bcc_ptr,
3052 remaining_words
3053 - 1);
cd49b492 3054 kfree(ses->serverNOS);
1da177e4 3055 ses->serverNOS =
e915fc49 3056 kzalloc(2 * (len + 1),
1da177e4
LT		 3057 GFP_KERNEL);
3058 cifs_strfromUCS_le(ses->
3059 serverNOS,
e89dc920 3060 (__le16 *)
1da177e4
LT		 3061 bcc_ptr,
3062 len,
3063 nls_codepage);
3064 bcc_ptr += 2 * (len + 1);
3065 ses->serverNOS[2 * len] = 0;
3066 ses->serverNOS[1+(2*len)] = 0;
3067 remaining_words -= len + 1;
3068 if (remaining_words > 0) {
3069 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3070 /* last string not always null terminated (e.g. for Windows XP & 2000) */
a424f8bf
SF		 3071 if(ses->serverDomain)
3072 kfree(ses->serverDomain);
1da177e4 3073 ses->serverDomain =
e915fc49 3074 kzalloc(2 *
1da177e4
LT		 3075 (len +
3076 1),
3077 GFP_KERNEL);
3078 cifs_strfromUCS_le
3079 (ses->
3080 serverDomain,
e89dc920 3081 (__le16 *)
1da177e4
LT		 3082 bcc_ptr, len,
3083 nls_codepage);
3084 bcc_ptr +=
3085 2 * (len + 1);
3086 ses->
3087 serverDomain[2
3088 * len]
3089 = 0;
3090 ses->
3091 serverDomain[1
3092 +
3093 (2
3094 *
3095 len)]
3096 = 0;
3097 } /* else no more room so create dummy domain string */
a424f8bf
SF		 3098 else {
3099 if(ses->serverDomain)
3100 kfree(ses->serverDomain);
e915fc49 3101 ses->serverDomain = kzalloc(2,GFP_KERNEL);
a424f8bf 3102 }
1da177e4 3103 } else { /* no room so create dummy domain and NOS string */
a424f8bf
SF		 3104 if(ses->serverDomain)
3105 kfree(ses->serverDomain);
e915fc49 3106 ses->serverDomain = kzalloc(2, GFP_KERNEL);
cd49b492 3107 kfree(ses->serverNOS);
e915fc49 3108 ses->serverNOS = kzalloc(2, GFP_KERNEL);
1da177e4
LT		 3109 }
3110 } else { /* ASCII */
3111 len = strnlen(bcc_ptr, 1024);
3112 if (((long) bcc_ptr + len) -
3113 (long) pByteArea(smb_buffer_response)
3114 <= BCC(smb_buffer_response)) {
a424f8bf
SF		 3115 if(ses->serverOS)
3116 kfree(ses->serverOS);
e915fc49 3117 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
1da177e4
LT		 3118 strncpy(ses->serverOS,bcc_ptr, len);
3119
3120 bcc_ptr += len;
3121 bcc_ptr[0] = 0; /* null terminate the string */
3122 bcc_ptr++;
3123
3124 len = strnlen(bcc_ptr, 1024);
cd49b492 3125 kfree(ses->serverNOS);
e915fc49 3126 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
1da177e4
LT		 3127 strncpy(ses->serverNOS, bcc_ptr, len);
3128 bcc_ptr += len;
3129 bcc_ptr[0] = 0;
3130 bcc_ptr++;
3131
3132 len = strnlen(bcc_ptr, 1024);
a424f8bf
SF		 3133 if(ses->serverDomain)
3134 kfree(ses->serverDomain);
e915fc49 3135 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
1da177e4
LT		 3136 strncpy(ses->serverDomain, bcc_ptr, len);
3137 bcc_ptr += len;
3138 bcc_ptr[0] = 0;
3139 bcc_ptr++;
3140 } else
3141 cFYI(1,
3142 ("Variable field of length %d extends beyond end of smb ",
3143 len));
3144 }
3145 } else {
3146 cERROR(1,
3147 (" Security Blob Length extends beyond end of SMB"));
3148 }
3149 } else {
3150 cERROR(1, ("No session structure passed in."));
3151 }
3152 } else {
3153 cERROR(1,
3154 (" Invalid Word count %d: ",
3155 smb_buffer_response->WordCount));
3156 rc = -EIO;
3157 }
3158
3159 if (smb_buffer)
3160 cifs_buf_release(smb_buffer);
3161
3162 return rc;
3163}
3164
3165int
3166CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3167 const char *tree, struct cifsTconInfo *tcon,
3168 const struct nls_table *nls_codepage)
3169{
3170 struct smb_hdr *smb_buffer;
3171 struct smb_hdr *smb_buffer_response;
3172 TCONX_REQ *pSMB;
3173 TCONX_RSP *pSMBr;
3174 unsigned char *bcc_ptr;
3175 int rc = 0;
3176 int length;
3177 __u16 count;
3178
3179 if (ses == NULL)
3180 return -EIO;
3181
3182 smb_buffer = cifs_buf_get();
3183 if (smb_buffer == NULL) {
3184 return -ENOMEM;
3185 }
3186 smb_buffer_response = smb_buffer;
3187
3188 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3189 NULL /*no tid */ , 4 /*wct */ );
1982c344
SF		 3190
3191 smb_buffer->Mid = GetNextMid(ses->server);
1da177e4
LT		 3192 smb_buffer->Uid = ses->Suid;
3193 pSMB = (TCONX_REQ *) smb_buffer;
3194 pSMBr = (TCONX_RSP *) smb_buffer_response;
3195
3196 pSMB->AndXCommand = 0xFF;
3197 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
1da177e4 3198 bcc_ptr = &pSMB->Password[0];
eeac8047
SF		 3199 if((ses->server->secMode) & SECMODE_USER) {
3200 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
7c7b25bc 3201 *bcc_ptr = 0; /* password is null byte */
eeac8047 3202 bcc_ptr++; /* skip password */
7c7b25bc 3203 /* already aligned so no need to do it below */
eeac8047 3204 } else {
7c7b25bc 3205 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
eeac8047
SF		 3206 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3207 specified as required (when that support is added to
3208 the vfs in the future) as only NTLM or the much
7c7b25bc 3209 weaker LANMAN (which we do not send by default) is accepted
eeac8047
SF		 3210 by Samba (not sure whether other servers allow
3211 NTLMv2 password here) */
7c7b25bc
SF		 3212#ifdef CONFIG_CIFS_WEAK_PW_HASH
3213 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3214 (ses->server->secType == LANMAN))
3215 calc_lanman_hash(ses, bcc_ptr);
3216 else
3217#endif /* CIFS_WEAK_PW_HASH */
eeac8047
SF		 3218 SMBNTencrypt(ses->password,
3219 ses->server->cryptKey,
3220 bcc_ptr);
3221
7c7b25bc
SF		 3222 bcc_ptr += CIFS_SESS_KEY_SIZE;
3223 if(ses->capabilities & CAP_UNICODE) {
3224 /* must align unicode strings */
3225 *bcc_ptr = 0; /* null byte password */
3226 bcc_ptr++;
3227 }
eeac8047 3228 }
1da177e4 3229
a878fb22
SF		 3230 if(ses->server->secMode &
3231 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
1da177e4
LT		 3232 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3233
3234 if (ses->capabilities & CAP_STATUS32) {
3235 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3236 }
3237 if (ses->capabilities & CAP_DFS) {
3238 smb_buffer->Flags2 |= SMBFLG2_DFS;
3239 }
3240 if (ses->capabilities & CAP_UNICODE) {
3241 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3242 length =
a878fb22
SF		 3243 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3244 6 /* max utf8 char length in bytes */ *
3245 (/* server len*/ + 256 /* share len */), nls_codepage);
3246 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
1da177e4
LT		 3247 bcc_ptr += 2; /* skip trailing null */
3248 } else { /* ASCII */
1da177e4
LT		 3249 strcpy(bcc_ptr, tree);
3250 bcc_ptr += strlen(tree) + 1;
3251 }
3252 strcpy(bcc_ptr, "?????");
3253 bcc_ptr += strlen("?????");
3254 bcc_ptr += 1;
3255 count = bcc_ptr - &pSMB->Password[0];
3256 pSMB->hdr.smb_buf_length += count;
3257 pSMB->ByteCount = cpu_to_le16(count);
3258
3259 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3260
3261 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3262 /* above now done in SendReceive */
3263 if ((rc == 0) && (tcon != NULL)) {
3264 tcon->tidStatus = CifsGood;
3265 tcon->tid = smb_buffer_response->Tid;
3266 bcc_ptr = pByteArea(smb_buffer_response);
3267 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3268 /* skip service field (NB: this field is always ASCII) */
3269 bcc_ptr += length + 1;
3270 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3271 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3272 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3273 if ((bcc_ptr + (2 * length)) -
3274 pByteArea(smb_buffer_response) <=
3275 BCC(smb_buffer_response)) {
f99d49ad 3276 kfree(tcon->nativeFileSystem);
1da177e4 3277 tcon->nativeFileSystem =
e915fc49 3278 kzalloc(length + 2, GFP_KERNEL);
1da177e4 3279 cifs_strfromUCS_le(tcon->nativeFileSystem,
e89dc920 3280 (__le16 *) bcc_ptr,
1da177e4
LT		 3281 length, nls_codepage);
3282 bcc_ptr += 2 * length;
3283 bcc_ptr[0] = 0; /* null terminate the string */
3284 bcc_ptr[1] = 0;
3285 bcc_ptr += 2;
3286 }
3287 /* else do not bother copying these informational fields */
3288 } else {
3289 length = strnlen(bcc_ptr, 1024);
3290 if ((bcc_ptr + length) -
3291 pByteArea(smb_buffer_response) <=
3292 BCC(smb_buffer_response)) {
f99d49ad 3293 kfree(tcon->nativeFileSystem);
1da177e4 3294 tcon->nativeFileSystem =
e915fc49 3295 kzalloc(length + 1, GFP_KERNEL);
1da177e4
LT		 3296 strncpy(tcon->nativeFileSystem, bcc_ptr,
3297 length);
3298 }
3299 /* else do not bother copying these informational fields */
3300 }
1a4e15a0
SF		 3301 if((smb_buffer_response->WordCount == 3) ||
3302 (smb_buffer_response->WordCount == 7))
3303 /* field is in same location */
3979877e
SF		 3304 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3305 else
3306 tcon->Flags = 0;
1da177e4
LT		 3307 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3308 } else if ((rc == 0) && tcon == NULL) {
3309 /* all we need to save for IPC$ connection */
3310 ses->ipc_tid = smb_buffer_response->Tid;
3311 }
3312
3313 if (smb_buffer)
3314 cifs_buf_release(smb_buffer);
3315 return rc;
3316}
3317
3318int
3319cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3320{
3321 int rc = 0;
3322 int xid;
3323 struct cifsSesInfo *ses = NULL;
3324 struct task_struct *cifsd_task;
2fe87f02 3325 char * tmp;
1da177e4
LT		 3326
3327 xid = GetXid();
3328
3329 if (cifs_sb->tcon) {
3330 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3331 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3332 if (rc == -EBUSY) {
3333 FreeXid(xid);
3334 return 0;
3335 }
3336 tconInfoFree(cifs_sb->tcon);
3337 if ((ses) && (ses->server)) {
3338 /* save off task so we do not refer to ses later */
3339 cifsd_task = ses->server->tsk;
3340 cFYI(1, ("About to do SMBLogoff "));
3341 rc = CIFSSMBLogoff(xid, ses);
3342 if (rc == -EBUSY) {
3343 FreeXid(xid);
3344 return 0;
3345 } else if (rc == -ESHUTDOWN) {
3346 cFYI(1,("Waking up socket by sending it signal"));
f7f7c31c 3347 if (cifsd_task) {
1da177e4 3348 send_sig(SIGKILL,cifsd_task,1);
aaf737ad 3349 kthread_stop(cifsd_task);
f191401f 3350 }
1da177e4
LT		 3351 rc = 0;
3352 } /* else - we have an smb session
3353 left on this socket do not kill cifsd */
3354 } else
3355 cFYI(1, ("No session or bad tcon"));
3356 }
3357
3358 cifs_sb->tcon = NULL;
2fe87f02
SF		 3359 tmp = cifs_sb->prepath;
3360 cifs_sb->prepathlen = 0;
3361 cifs_sb->prepath = NULL;
3362 kfree(tmp);
041e0e3b
NA		 3363 if (ses)
3364 schedule_timeout_interruptible(msecs_to_jiffies(500));
1da177e4
LT		 3365 if (ses)
3366 sesInfoFree(ses);
3367
3368 FreeXid(xid);
3369 return rc; /* BB check if we should always return zero here */
3370}
3371
3372int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3373 struct nls_table * nls_info)
3374{
3375 int rc = 0;
7c7b25bc 3376 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
1da177e4 3377 int ntlmv2_flag = FALSE;
ad009ac9 3378 int first_time = 0;
1da177e4
LT		 3379
3380 /* what if server changes its buffer size after dropping the session? */
3381 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3382 rc = CIFSSMBNegotiate(xid, pSesInfo);
3383 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3384 rc = CIFSSMBNegotiate(xid, pSesInfo);
3385 if(rc == -EAGAIN)
3386 rc = -EHOSTDOWN;
3387 }
3388 if(rc == 0) {
3389 spin_lock(&GlobalMid_Lock);
3390 if(pSesInfo->server->tcpStatus != CifsExiting)
3391 pSesInfo->server->tcpStatus = CifsGood;
3392 else
3393 rc = -EHOSTDOWN;
3394 spin_unlock(&GlobalMid_Lock);
3395
3396 }
ad009ac9 3397 first_time = 1;
1da177e4
LT		 3398 }
3399 if (!rc) {
9ac00b7d 3400 pSesInfo->flags = 0;
1da177e4
LT		 3401 pSesInfo->capabilities = pSesInfo->server->capabilities;
3402 if(linuxExtEnabled == 0)
3403 pSesInfo->capabilities &= (~CAP_UNIX);
ad009ac9 3404 /* pSesInfo->sequence_number = 0;*/
175ec9e1 3405 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
1da177e4
LT		 3406 pSesInfo->server->secMode,
3407 pSesInfo->server->capabilities,
175ec9e1 3408 pSesInfo->server->timeAdj));
189acaae 3409 if(experimEnabled < 2)
3979877e
SF		 3410 rc = CIFS_SessSetup(xid, pSesInfo,
3411 first_time, nls_info);
189acaae 3412 else if (extended_security
175ec9e1
SF		 3413 && (pSesInfo->capabilities
3414 & CAP_EXTENDED_SECURITY)
1da177e4 3415 && (pSesInfo->server->secType == NTLMSSP)) {
189acaae 3416 rc = -EOPNOTSUPP;
1da177e4
LT		 3417 } else if (extended_security
3418 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3419 && (pSesInfo->server->secType == RawNTLMSSP)) {
5815449d 3420 cFYI(1, ("NTLMSSP sesssetup"));
1da177e4
LT		 3421 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3422 pSesInfo,
3423 &ntlmv2_flag,
3424 nls_info);
3425 if (!rc) {
3426 if(ntlmv2_flag) {
3427 char * v2_response;
175ec9e1 3428 cFYI(1,("more secure NTLM ver2 hash"));
1da177e4
LT		 3429 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3430 nls_info)) {
3431 rc = -ENOMEM;
3432 goto ss_err_exit;
3433 } else
3434 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3435 if(v2_response) {
3436 CalcNTLMv2_response(pSesInfo,v2_response);
ad009ac9
SF		 3437 /* if(first_time)
3438 cifs_calculate_ntlmv2_mac_key(
3439 pSesInfo->server->mac_signing_key,
3440 response, ntlm_session_key, */
1da177e4
LT		 3441 kfree(v2_response);
3442 /* BB Put dummy sig in SessSetup PDU? */
3443 } else {
3444 rc = -ENOMEM;
3445 goto ss_err_exit;
3446 }
3447
3448 } else {
3449 SMBNTencrypt(pSesInfo->password,
3450 pSesInfo->server->cryptKey,
3451 ntlm_session_key);
3452
ad009ac9
SF		 3453 if(first_time)
3454 cifs_calculate_mac_key(
3455 pSesInfo->server->mac_signing_key,
3456 ntlm_session_key,
3457 pSesInfo->password);
1da177e4
LT		 3458 }
3459 /* for better security the weaker lanman hash not sent
3460 in AuthSessSetup so we no longer calculate it */
3461
3462 rc = CIFSNTLMSSPAuthSessSetup(xid,
3463 pSesInfo,
3464 ntlm_session_key,
3465 ntlmv2_flag,
3466 nls_info);
3467 }
3468 } else { /* old style NTLM 0.12 session setup */
3469 SMBNTencrypt(pSesInfo->password,
3470 pSesInfo->server->cryptKey,
3471 ntlm_session_key);
3472
ad009ac9
SF		 3473 if(first_time)
3474 cifs_calculate_mac_key(
3475 pSesInfo->server->mac_signing_key,
3476 ntlm_session_key, pSesInfo->password);
3477
1da177e4
LT		 3478 rc = CIFSSessSetup(xid, pSesInfo,
3479 ntlm_session_key, nls_info);
3480 }
3481 if (rc) {
3482 cERROR(1,("Send error in SessSetup = %d",rc));
3483 } else {
3484 cFYI(1,("CIFS Session Established successfully"));
3485 pSesInfo->status = CifsGood;
3486 }
3487 }
3488ss_err_exit:
3489 return rc;
3490}
3491
Clone of davem's net-next-2.6 tree