?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
drm: add better explanation for i830/i915
[linux/fpc-iii.git] / fs / cifs / connect.c
blob5d394c726860740316e6fb96172aeccc888d6214
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2006
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/pagevec.h>
34 #include <asm/uaccess.h>
35 #include <asm/processor.h>
36 #include "cifspdu.h"
37 #include "cifsglob.h"
38 #include "cifsproto.h"
39 #include "cifs_unicode.h"
40 #include "cifs_debug.h"
41 #include "cifs_fs_sb.h"
42 #include "ntlmssp.h"
43 #include "nterr.h"
44 #include "rfc1002pdu.h"
45 #include "cn_cifs.h"
46
47 #define CIFS_PORT 445
48 #define RFC1001_PORT 139
49
50 static DECLARE_COMPLETION(cifsd_complete);
51
52 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
53 unsigned char *p24);
54
55 extern mempool_t *cifs_req_poolp;
56
57 struct smb_vol {
58 char *username;
59 char *password;
60 char *domainname;
61 char *UNC;
62 char *UNCip;
63 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
64 char *iocharset; /* local code page for mapping to and from Unicode */
65 char source_rfc1001_name[16]; /* netbios name of client */
66 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
67 uid_t linux_uid;
68 gid_t linux_gid;
69 mode_t file_mode;
70 mode_t dir_mode;
71 unsigned secFlg;
72 unsigned rw:1;
73 unsigned retry:1;
74 unsigned intr:1;
75 unsigned setuids:1;
76 unsigned noperm:1;
77 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
78 unsigned cifs_acl:1;
79 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
80 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
81 unsigned direct_io:1;
82 unsigned remap:1; /* set to remap seven reserved chars in filenames */
83 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
84 unsigned sfu_emul:1;
85 unsigned nullauth:1; /* attempt to authenticate with null user */
86 unsigned nocase; /* request case insensitive filenames */
87 unsigned nobrl; /* disable sending byte range locks to srv */
88 unsigned int rsize;
89 unsigned int wsize;
90 unsigned int sockopt;
91 unsigned short int port;
92 };
93
94 static int ipv4_connect(struct sockaddr_in *psin_server,
95 struct socket **csocket,
96 char * netb_name,
97 char * server_netb_name);
98 static int ipv6_connect(struct sockaddr_in6 *psin_server,
99 struct socket **csocket);
100
101
102 /*
103 * cifs tcp session reconnection
104 *
105 * mark tcp session as reconnecting so temporarily locked
106 * mark all smb sessions as reconnecting for tcp session
107 * reconnect tcp session
108 * wake up waiters on reconnection? - (not needed currently)
109 */
110
111 int
112 cifs_reconnect(struct TCP_Server_Info *server)
113 {
114 int rc = 0;
115 struct list_head *tmp;
116 struct cifsSesInfo *ses;
117 struct cifsTconInfo *tcon;
118 struct mid_q_entry * mid_entry;
119
120 spin_lock(&GlobalMid_Lock);
121 if(server->tcpStatus == CifsExiting) {
122 /* the demux thread will exit normally
123 next time through the loop */
124 spin_unlock(&GlobalMid_Lock);
125 return rc;
126 } else
127 server->tcpStatus = CifsNeedReconnect;
128 spin_unlock(&GlobalMid_Lock);
129 server->maxBuf = 0;
130
131 cFYI(1, ("Reconnecting tcp session"));
132
133 /* before reconnecting the tcp session, mark the smb session (uid)
134 and the tid bad so they are not used until reconnected */
135 read_lock(&GlobalSMBSeslock);
136 list_for_each(tmp, &GlobalSMBSessionList) {
137 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
138 if (ses->server) {
139 if (ses->server == server) {
140 ses->status = CifsNeedReconnect;
141 ses->ipc_tid = 0;
142 }
143 }
144 /* else tcp and smb sessions need reconnection */
145 }
146 list_for_each(tmp, &GlobalTreeConnectionList) {
147 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
148 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
149 tcon->tidStatus = CifsNeedReconnect;
150 }
151 }
152 read_unlock(&GlobalSMBSeslock);
153 /* do not want to be sending data on a socket we are freeing */
154 down(&server->tcpSem);
155 if(server->ssocket) {
156 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
157 server->ssocket->flags));
158 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
159 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
160 server->ssocket->flags));
161 sock_release(server->ssocket);
162 server->ssocket = NULL;
163 }
164
165 spin_lock(&GlobalMid_Lock);
166 list_for_each(tmp, &server->pending_mid_q) {
167 mid_entry = list_entry(tmp, struct
168 mid_q_entry,
169 qhead);
170 if(mid_entry) {
171 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
172 /* Mark other intransit requests as needing
173 retry so we do not immediately mark the
174 session bad again (ie after we reconnect
175 below) as they timeout too */
176 mid_entry->midState = MID_RETRY_NEEDED;
177 }
178 }
179 }
180 spin_unlock(&GlobalMid_Lock);
181 up(&server->tcpSem);
182
183 while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
184 {
185 try_to_freeze();
186 if(server->protocolType == IPV6) {
187 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
188 } else {
189 rc = ipv4_connect(&server->addr.sockAddr,
190 &server->ssocket,
191 server->workstation_RFC1001_name,
192 server->server_RFC1001_name);
193 }
194 if(rc) {
195 cFYI(1,("reconnect error %d",rc));
196 msleep(3000);
197 } else {
198 atomic_inc(&tcpSesReconnectCount);
199 spin_lock(&GlobalMid_Lock);
200 if(server->tcpStatus != CifsExiting)
201 server->tcpStatus = CifsGood;
202 server->sequence_number = 0;
203 spin_unlock(&GlobalMid_Lock);
204 /* atomic_set(&server->inFlight,0);*/
205 wake_up(&server->response_q);
206 }
207 }
208 return rc;
209 }
210
211 /*
212 return codes:
213 0 not a transact2, or all data present
214 >0 transact2 with that much data missing
215 -EINVAL = invalid transact2
216
217 */
218 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
219 {
220 struct smb_t2_rsp * pSMBt;
221 int total_data_size;
222 int data_in_this_rsp;
223 int remaining;
224
225 if(pSMB->Command != SMB_COM_TRANSACTION2)
226 return 0;
227
228 /* check for plausible wct, bcc and t2 data and parm sizes */
229 /* check for parm and data offset going beyond end of smb */
230 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
231 cFYI(1,("invalid transact2 word count"));
232 return -EINVAL;
233 }
234
235 pSMBt = (struct smb_t2_rsp *)pSMB;
236
237 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
238 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
239
240 remaining = total_data_size - data_in_this_rsp;
241
242 if(remaining == 0)
243 return 0;
244 else if(remaining < 0) {
245 cFYI(1,("total data %d smaller than data in frame %d",
246 total_data_size, data_in_this_rsp));
247 return -EINVAL;
248 } else {
249 cFYI(1,("missing %d bytes from transact2, check next response",
250 remaining));
251 if(total_data_size > maxBufSize) {
252 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
253 total_data_size,maxBufSize));
254 return -EINVAL;
255 }
256 return remaining;
257 }
258 }
259
260 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
261 {
262 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
263 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
264 int total_data_size;
265 int total_in_buf;
266 int remaining;
267 int total_in_buf2;
268 char * data_area_of_target;
269 char * data_area_of_buf2;
270 __u16 byte_count;
271
272 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
273
274 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
275 cFYI(1,("total data sizes of primary and secondary t2 differ"));
276 }
277
278 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
279
280 remaining = total_data_size - total_in_buf;
281
282 if(remaining < 0)
283 return -EINVAL;
284
285 if(remaining == 0) /* nothing to do, ignore */
286 return 0;
287
288 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
289 if(remaining < total_in_buf2) {
290 cFYI(1,("transact2 2nd response contains too much data"));
291 }
292
293 /* find end of first SMB data area */
294 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
295 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
296 /* validate target area */
297
298 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
299 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
300
301 data_area_of_target += total_in_buf;
302
303 /* copy second buffer into end of first buffer */
304 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
305 total_in_buf += total_in_buf2;
306 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
307 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
308 byte_count += total_in_buf2;
309 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
310
311 byte_count = pTargetSMB->smb_buf_length;
312 byte_count += total_in_buf2;
313
314 /* BB also add check that we are not beyond maximum buffer size */
315
316 pTargetSMB->smb_buf_length = byte_count;
317
318 if(remaining == total_in_buf2) {
319 cFYI(1,("found the last secondary response"));
320 return 0; /* we are done */
321 } else /* more responses to go */
322 return 1;
323
324 }
325
326 static int
327 cifs_demultiplex_thread(struct TCP_Server_Info *server)
328 {
329 int length;
330 unsigned int pdu_length, total_read;
331 struct smb_hdr *smb_buffer = NULL;
332 struct smb_hdr *bigbuf = NULL;
333 struct smb_hdr *smallbuf = NULL;
334 struct msghdr smb_msg;
335 struct kvec iov;
336 struct socket *csocket = server->ssocket;
337 struct list_head *tmp;
338 struct cifsSesInfo *ses;
339 struct task_struct *task_to_wake = NULL;
340 struct mid_q_entry *mid_entry;
341 char temp;
342 int isLargeBuf = FALSE;
343 int isMultiRsp;
344 int reconnect;
345
346 daemonize("cifsd");
347 allow_signal(SIGKILL);
348 current->flags |= PF_MEMALLOC;
349 server->tsk = current; /* save process info to wake at shutdown */
350 cFYI(1, ("Demultiplex PID: %d", current->pid));
351 write_lock(&GlobalSMBSeslock);
352 atomic_inc(&tcpSesAllocCount);
353 length = tcpSesAllocCount.counter;
354 write_unlock(&GlobalSMBSeslock);
355 complete(&cifsd_complete);
356 if(length > 1) {
357 mempool_resize(cifs_req_poolp,
358 length + cifs_min_rcv,
359 GFP_KERNEL);
360 }
361
362 while (server->tcpStatus != CifsExiting) {
363 if (try_to_freeze())
364 continue;
365 if (bigbuf == NULL) {
366 bigbuf = cifs_buf_get();
367 if (!bigbuf) {
368 cERROR(1, ("No memory for large SMB response"));
369 msleep(3000);
370 /* retry will check if exiting */
371 continue;
372 }
373 } else if (isLargeBuf) {
374 /* we are reusing a dirty large buf, clear its start */
375 memset(bigbuf, 0, sizeof (struct smb_hdr));
376 }
377
378 if (smallbuf == NULL) {
379 smallbuf = cifs_small_buf_get();
380 if (!smallbuf) {
381 cERROR(1, ("No memory for SMB response"));
382 msleep(1000);
383 /* retry will check if exiting */
384 continue;
385 }
386 /* beginning of smb buffer is cleared in our buf_get */
387 } else /* if existing small buf clear beginning */
388 memset(smallbuf, 0, sizeof (struct smb_hdr));
389
390 isLargeBuf = FALSE;
391 isMultiRsp = FALSE;
392 smb_buffer = smallbuf;
393 iov.iov_base = smb_buffer;
394 iov.iov_len = 4;
395 smb_msg.msg_control = NULL;
396 smb_msg.msg_controllen = 0;
397 length =
398 kernel_recvmsg(csocket, &smb_msg,
399 &iov, 1, 4, 0 /* BB see socket.h flags */);
400
401 if (server->tcpStatus == CifsExiting) {
402 break;
403 } else if (server->tcpStatus == CifsNeedReconnect) {
404 cFYI(1, ("Reconnect after server stopped responding"));
405 cifs_reconnect(server);
406 cFYI(1, ("call to reconnect done"));
407 csocket = server->ssocket;
408 continue;
409 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
410 msleep(1); /* minimum sleep to prevent looping
411 allowing socket to clear and app threads to set
412 tcpStatus CifsNeedReconnect if server hung */
413 continue;
414 } else if (length <= 0) {
415 if (server->tcpStatus == CifsNew) {
416 cFYI(1, ("tcp session abend after SMBnegprot"));
417 /* some servers kill the TCP session rather than
418 returning an SMB negprot error, in which
419 case reconnecting here is not going to help,
420 and so simply return error to mount */
421 break;
422 }
423 if (!try_to_freeze() && (length == -EINTR)) {
424 cFYI(1,("cifsd thread killed"));
425 break;
426 }
427 cFYI(1,("Reconnect after unexpected peek error %d",
428 length));
429 cifs_reconnect(server);
430 csocket = server->ssocket;
431 wake_up(&server->response_q);
432 continue;
433 } else if (length < 4) {
434 cFYI(1,
435 ("Frame under four bytes received (%d bytes long)",
436 length));
437 cifs_reconnect(server);
438 csocket = server->ssocket;
439 wake_up(&server->response_q);
440 continue;
441 }
442
443 /* The right amount was read from socket - 4 bytes */
444 /* so we can now interpret the length field */
445
446 /* the first byte big endian of the length field,
447 is actually not part of the length but the type
448 with the most common, zero, as regular data */
449 temp = *((char *) smb_buffer);
450
451 /* Note that FC 1001 length is big endian on the wire,
452 but we convert it here so it is always manipulated
453 as host byte order */
454 pdu_length = ntohl(smb_buffer->smb_buf_length);
455 smb_buffer->smb_buf_length = pdu_length;
456
457 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
458
459 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
460 continue;
461 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
462 cFYI(1,("Good RFC 1002 session rsp"));
463 continue;
464 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
465 /* we get this from Windows 98 instead of
466 an error on SMB negprot response */
467 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
468 pdu_length));
469 if(server->tcpStatus == CifsNew) {
470 /* if nack on negprot (rather than
471 ret of smb negprot error) reconnecting
472 not going to help, ret error to mount */
473 break;
474 } else {
475 /* give server a second to
476 clean up before reconnect attempt */
477 msleep(1000);
478 /* always try 445 first on reconnect
479 since we get NACK on some if we ever
480 connected to port 139 (the NACK is
481 since we do not begin with RFC1001
482 session initialize frame) */
483 server->addr.sockAddr.sin_port =
484 htons(CIFS_PORT);
485 cifs_reconnect(server);
486 csocket = server->ssocket;
487 wake_up(&server->response_q);
488 continue;
489 }
490 } else if (temp != (char) 0) {
491 cERROR(1,("Unknown RFC 1002 frame"));
492 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
493 length);
494 cifs_reconnect(server);
495 csocket = server->ssocket;
496 continue;
497 }
498
499 /* else we have an SMB response */
500 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
501 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
502 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
503 length, pdu_length+4));
504 cifs_reconnect(server);
505 csocket = server->ssocket;
506 wake_up(&server->response_q);
507 continue;
508 }
509
510 /* else length ok */
511 reconnect = 0;
512
513 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
514 isLargeBuf = TRUE;
515 memcpy(bigbuf, smallbuf, 4);
516 smb_buffer = bigbuf;
517 }
518 length = 0;
519 iov.iov_base = 4 + (char *)smb_buffer;
520 iov.iov_len = pdu_length;
521 for (total_read = 0; total_read < pdu_length;
522 total_read += length) {
523 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
524 pdu_length - total_read, 0);
525 if((server->tcpStatus == CifsExiting) ||
526 (length == -EINTR)) {
527 /* then will exit */
528 reconnect = 2;
529 break;
530 } else if (server->tcpStatus == CifsNeedReconnect) {
531 cifs_reconnect(server);
532 csocket = server->ssocket;
533 /* Reconnect wakes up rspns q */
534 /* Now we will reread sock */
535 reconnect = 1;
536 break;
537 } else if ((length == -ERESTARTSYS) ||
538 (length == -EAGAIN)) {
539 msleep(1); /* minimum sleep to prevent looping,
540 allowing socket to clear and app
541 threads to set tcpStatus
542 CifsNeedReconnect if server hung*/
543 continue;
544 } else if (length <= 0) {
545 cERROR(1,("Received no data, expecting %d",
546 pdu_length - total_read));
547 cifs_reconnect(server);
548 csocket = server->ssocket;
549 reconnect = 1;
550 break;
551 }
552 }
553 if(reconnect == 2)
554 break;
555 else if(reconnect == 1)
556 continue;
557
558 length += 4; /* account for rfc1002 hdr */
559
560
561 dump_smb(smb_buffer, length);
562 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
563 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
564 continue;
565 }
566
567
568 task_to_wake = NULL;
569 spin_lock(&GlobalMid_Lock);
570 list_for_each(tmp, &server->pending_mid_q) {
571 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
572
573 if ((mid_entry->mid == smb_buffer->Mid) &&
574 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
575 (mid_entry->command == smb_buffer->Command)) {
576 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
577 /* We have a multipart transact2 resp */
578 isMultiRsp = TRUE;
579 if(mid_entry->resp_buf) {
580 /* merge response - fix up 1st*/
581 if(coalesce_t2(smb_buffer,
582 mid_entry->resp_buf)) {
583 mid_entry->multiRsp = 1;
584 break;
585 } else {
586 /* all parts received */
587 mid_entry->multiEnd = 1;
588 goto multi_t2_fnd;
589 }
590 } else {
591 if(!isLargeBuf) {
592 cERROR(1,("1st trans2 resp needs bigbuf"));
593 /* BB maybe we can fix this up, switch
594 to already allocated large buffer? */
595 } else {
596 /* Have first buffer */
597 mid_entry->resp_buf =
598 smb_buffer;
599 mid_entry->largeBuf = 1;
600 bigbuf = NULL;
601 }
602 }
603 break;
604 }
605 mid_entry->resp_buf = smb_buffer;
606 if(isLargeBuf)
607 mid_entry->largeBuf = 1;
608 else
609 mid_entry->largeBuf = 0;
610 multi_t2_fnd:
611 task_to_wake = mid_entry->tsk;
612 mid_entry->midState = MID_RESPONSE_RECEIVED;
613 #ifdef CONFIG_CIFS_STATS2
614 mid_entry->when_received = jiffies;
615 #endif
616 /* so we do not time out requests to server
617 which is still responding (since server could
618 be busy but not dead) */
619 server->lstrp = jiffies;
620 break;
621 }
622 }
623 spin_unlock(&GlobalMid_Lock);
624 if (task_to_wake) {
625 /* Was previous buf put in mpx struct for multi-rsp? */
626 if(!isMultiRsp) {
627 /* smb buffer will be freed by user thread */
628 if(isLargeBuf) {
629 bigbuf = NULL;
630 } else
631 smallbuf = NULL;
632 }
633 wake_up_process(task_to_wake);
634 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
635 && (isMultiRsp == FALSE)) {
636 cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
637 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
638 sizeof(struct smb_hdr));
639 #ifdef CONFIG_CIFS_DEBUG2
640 cifs_dump_detail(smb_buffer);
641 cifs_dump_mids(server);
642 #endif /* CIFS_DEBUG2 */
643
644 }
645 } /* end while !EXITING */
646
647 spin_lock(&GlobalMid_Lock);
648 server->tcpStatus = CifsExiting;
649 server->tsk = NULL;
650 /* check if we have blocked requests that need to free */
651 /* Note that cifs_max_pending is normally 50, but
652 can be set at module install time to as little as two */
653 if(atomic_read(&server->inFlight) >= cifs_max_pending)
654 atomic_set(&server->inFlight, cifs_max_pending - 1);
655 /* We do not want to set the max_pending too low or we
656 could end up with the counter going negative */
657 spin_unlock(&GlobalMid_Lock);
658 /* Although there should not be any requests blocked on
659 this queue it can not hurt to be paranoid and try to wake up requests
660 that may haven been blocked when more than 50 at time were on the wire
661 to the same server - they now will see the session is in exit state
662 and get out of SendReceive. */
663 wake_up_all(&server->request_q);
664 /* give those requests time to exit */
665 msleep(125);
666
667 if(server->ssocket) {
668 sock_release(csocket);
669 server->ssocket = NULL;
670 }
671 /* buffer usuallly freed in free_mid - need to free it here on exit */
672 if (bigbuf != NULL)
673 cifs_buf_release(bigbuf);
674 if (smallbuf != NULL)
675 cifs_small_buf_release(smallbuf);
676
677 read_lock(&GlobalSMBSeslock);
678 if (list_empty(&server->pending_mid_q)) {
679 /* loop through server session structures attached to this and
680 mark them dead */
681 list_for_each(tmp, &GlobalSMBSessionList) {
682 ses =
683 list_entry(tmp, struct cifsSesInfo,
684 cifsSessionList);
685 if (ses->server == server) {
686 ses->status = CifsExiting;
687 ses->server = NULL;
688 }
689 }
690 read_unlock(&GlobalSMBSeslock);
691 } else {
692 /* although we can not zero the server struct pointer yet,
693 since there are active requests which may depnd on them,
694 mark the corresponding SMB sessions as exiting too */
695 list_for_each(tmp, &GlobalSMBSessionList) {
696 ses = list_entry(tmp, struct cifsSesInfo,
697 cifsSessionList);
698 if (ses->server == server) {
699 ses->status = CifsExiting;
700 }
701 }
702
703 spin_lock(&GlobalMid_Lock);
704 list_for_each(tmp, &server->pending_mid_q) {
705 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
706 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
707 cFYI(1,
708 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
709 task_to_wake = mid_entry->tsk;
710 if(task_to_wake) {
711 wake_up_process(task_to_wake);
712 }
713 }
714 }
715 spin_unlock(&GlobalMid_Lock);
716 read_unlock(&GlobalSMBSeslock);
717 /* 1/8th of sec is more than enough time for them to exit */
718 msleep(125);
719 }
720
721 if (!list_empty(&server->pending_mid_q)) {
722 /* mpx threads have not exited yet give them
723 at least the smb send timeout time for long ops */
724 /* due to delays on oplock break requests, we need
725 to wait at least 45 seconds before giving up
726 on a request getting a response and going ahead
727 and killing cifsd */
728 cFYI(1, ("Wait for exit from demultiplex thread"));
729 msleep(46000);
730 /* if threads still have not exited they are probably never
731 coming home not much else we can do but free the memory */
732 }
733
734 write_lock(&GlobalSMBSeslock);
735 atomic_dec(&tcpSesAllocCount);
736 length = tcpSesAllocCount.counter;
737
738 /* last chance to mark ses pointers invalid
739 if there are any pointing to this (e.g
740 if a crazy root user tried to kill cifsd
741 kernel thread explicitly this might happen) */
742 list_for_each(tmp, &GlobalSMBSessionList) {
743 ses = list_entry(tmp, struct cifsSesInfo,
744 cifsSessionList);
745 if (ses->server == server) {
746 ses->server = NULL;
747 }
748 }
749 write_unlock(&GlobalSMBSeslock);
750
751 kfree(server);
752 if(length > 0) {
753 mempool_resize(cifs_req_poolp,
754 length + cifs_min_rcv,
755 GFP_KERNEL);
756 }
757
758 complete_and_exit(&cifsd_complete, 0);
759 return 0;
760 }
761
762 static int
763 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
764 {
765 char *value;
766 char *data;
767 unsigned int temp_len, i, j;
768 char separator[2];
769
770 separator[0] = ',';
771 separator[1] = 0;
772
773 memset(vol->source_rfc1001_name,0x20,15);
774 for(i=0;i < strnlen(system_utsname.nodename,15);i++) {
775 /* does not have to be a perfect mapping since the field is
776 informational, only used for servers that do not support
777 port 445 and it can be overridden at mount time */
778 vol->source_rfc1001_name[i] =
779 toupper(system_utsname.nodename[i]);
780 }
781 vol->source_rfc1001_name[15] = 0;
782 /* null target name indicates to use *SMBSERVR default called name
783 if we end up sending RFC1001 session initialize */
784 vol->target_rfc1001_name[0] = 0;
785 vol->linux_uid = current->uid; /* current->euid instead? */
786 vol->linux_gid = current->gid;
787 vol->dir_mode = S_IRWXUGO;
788 /* 2767 perms indicate mandatory locking support */
789 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
790
791 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
792 vol->rw = TRUE;
793 /* default is always to request posix paths. */
794 vol->posix_paths = 1;
795
796 if (!options)
797 return 1;
798
799 if(strncmp(options,"sep=",4) == 0) {
800 if(options[4] != 0) {
801 separator[0] = options[4];
802 options += 5;
803 } else {
804 cFYI(1,("Null separator not allowed"));
805 }
806 }
807
808 while ((data = strsep(&options, separator)) != NULL) {
809 if (!*data)
810 continue;
811 if ((value = strchr(data, '=')) != NULL)
812 *value++ = '\0';
813
814 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
815 vol->no_xattr = 0;
816 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
817 vol->no_xattr = 1;
818 } else if (strnicmp(data, "user", 4) == 0) {
819 if (!value || !*value) {
820 printk(KERN_WARNING
821 "CIFS: invalid or missing username\n");
822 return 1; /* needs_arg; */
823 }
824 if (strnlen(value, 200) < 200) {
825 vol->username = value;
826 } else {
827 printk(KERN_WARNING "CIFS: username too long\n");
828 return 1;
829 }
830 } else if (strnicmp(data, "pass", 4) == 0) {
831 if (!value) {
832 vol->password = NULL;
833 continue;
834 } else if(value[0] == 0) {
835 /* check if string begins with double comma
836 since that would mean the password really
837 does start with a comma, and would not
838 indicate an empty string */
839 if(value[1] != separator[0]) {
840 vol->password = NULL;
841 continue;
842 }
843 }
844 temp_len = strlen(value);
845 /* removed password length check, NTLM passwords
846 can be arbitrarily long */
847
848 /* if comma in password, the string will be
849 prematurely null terminated. Commas in password are
850 specified across the cifs mount interface by a double
851 comma ie ,, and a comma used as in other cases ie ','
852 as a parameter delimiter/separator is single and due
853 to the strsep above is temporarily zeroed. */
854
855 /* NB: password legally can have multiple commas and
856 the only illegal character in a password is null */
857
858 if ((value[temp_len] == 0) &&
859 (value[temp_len+1] == separator[0])) {
860 /* reinsert comma */
861 value[temp_len] = separator[0];
862 temp_len+=2; /* move after the second comma */
863 while(value[temp_len] != 0) {
864 if (value[temp_len] == separator[0]) {
865 if (value[temp_len+1] ==
866 separator[0]) {
867 /* skip second comma */
868 temp_len++;
869 } else {
870 /* single comma indicating start
871 of next parm */
872 break;
873 }
874 }
875 temp_len++;
876 }
877 if(value[temp_len] == 0) {
878 options = NULL;
879 } else {
880 value[temp_len] = 0;
881 /* point option to start of next parm */
882 options = value + temp_len + 1;
883 }
884 /* go from value to value + temp_len condensing
885 double commas to singles. Note that this ends up
886 allocating a few bytes too many, which is ok */
887 vol->password = kzalloc(temp_len, GFP_KERNEL);
888 if(vol->password == NULL) {
889 printk("CIFS: no memory for pass\n");
890 return 1;
891 }
892 for(i=0,j=0;i<temp_len;i++,j++) {
893 vol->password[j] = value[i];
894 if(value[i] == separator[0]
895 && value[i+1] == separator[0]) {
896 /* skip second comma */
897 i++;
898 }
899 }
900 vol->password[j] = 0;
901 } else {
902 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
903 if(vol->password == NULL) {
904 printk("CIFS: no memory for pass\n");
905 return 1;
906 }
907 strcpy(vol->password, value);
908 }
909 } else if (strnicmp(data, "ip", 2) == 0) {
910 if (!value || !*value) {
911 vol->UNCip = NULL;
912 } else if (strnlen(value, 35) < 35) {
913 vol->UNCip = value;
914 } else {
915 printk(KERN_WARNING "CIFS: ip address too long\n");
916 return 1;
917 }
918 } else if (strnicmp(data, "sec", 3) == 0) {
919 if (!value || !*value) {
920 cERROR(1,("no security value specified"));
921 continue;
922 } else if (strnicmp(value, "krb5i", 5) == 0) {
923 vol->secFlg |= CIFSSEC_MAY_KRB5 |
924 CIFSSEC_MUST_SIGN;
925 } else if (strnicmp(value, "krb5p", 5) == 0) {
926 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
927 CIFSSEC_MAY_KRB5; */
928 cERROR(1,("Krb5 cifs privacy not supported"));
929 return 1;
930 } else if (strnicmp(value, "krb5", 4) == 0) {
931 vol->secFlg |= CIFSSEC_MAY_KRB5;
932 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
933 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
934 CIFSSEC_MUST_SIGN;
935 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
936 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
937 } else if (strnicmp(value, "ntlmi", 5) == 0) {
938 vol->secFlg |= CIFSSEC_MAY_NTLM |
939 CIFSSEC_MUST_SIGN;
940 } else if (strnicmp(value, "ntlm", 4) == 0) {
941 /* ntlm is default so can be turned off too */
942 vol->secFlg |= CIFSSEC_MAY_NTLM;
943 } else if (strnicmp(value, "nontlm", 6) == 0) {
944 /* BB is there a better way to do this? */
945 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
946 #ifdef CONFIG_CIFS_WEAK_PW_HASH
947 } else if (strnicmp(value, "lanman", 6) == 0) {
948 vol->secFlg |= CIFSSEC_MAY_LANMAN;
949 #endif
950 } else if (strnicmp(value, "none", 4) == 0) {
951 vol->nullauth = 1;
952 } else {
953 cERROR(1,("bad security option: %s", value));
954 return 1;
955 }
956 } else if ((strnicmp(data, "unc", 3) == 0)
957 || (strnicmp(data, "target", 6) == 0)
958 || (strnicmp(data, "path", 4) == 0)) {
959 if (!value || !*value) {
960 printk(KERN_WARNING
961 "CIFS: invalid path to network resource\n");
962 return 1; /* needs_arg; */
963 }
964 if ((temp_len = strnlen(value, 300)) < 300) {
965 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
966 if(vol->UNC == NULL)
967 return 1;
968 strcpy(vol->UNC,value);
969 if (strncmp(vol->UNC, "//", 2) == 0) {
970 vol->UNC[0] = '\\';
971 vol->UNC[1] = '\\';
972 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
973 printk(KERN_WARNING
974 "CIFS: UNC Path does not begin with // or \\\\ \n");
975 return 1;
976 }
977 } else {
978 printk(KERN_WARNING "CIFS: UNC name too long\n");
979 return 1;
980 }
981 } else if ((strnicmp(data, "domain", 3) == 0)
982 || (strnicmp(data, "workgroup", 5) == 0)) {
983 if (!value || !*value) {
984 printk(KERN_WARNING "CIFS: invalid domain name\n");
985 return 1; /* needs_arg; */
986 }
987 /* BB are there cases in which a comma can be valid in
988 a domain name and need special handling? */
989 if (strnlen(value, 256) < 256) {
990 vol->domainname = value;
991 cFYI(1, ("Domain name set"));
992 } else {
993 printk(KERN_WARNING "CIFS: domain name too long\n");
994 return 1;
995 }
996 } else if (strnicmp(data, "iocharset", 9) == 0) {
997 if (!value || !*value) {
998 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
999 return 1; /* needs_arg; */
1000 }
1001 if (strnlen(value, 65) < 65) {
1002 if(strnicmp(value,"default",7))
1003 vol->iocharset = value;
1004 /* if iocharset not set load_nls_default used by caller */
1005 cFYI(1, ("iocharset set to %s",value));
1006 } else {
1007 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1008 return 1;
1009 }
1010 } else if (strnicmp(data, "uid", 3) == 0) {
1011 if (value && *value) {
1012 vol->linux_uid =
1013 simple_strtoul(value, &value, 0);
1014 }
1015 } else if (strnicmp(data, "gid", 3) == 0) {
1016 if (value && *value) {
1017 vol->linux_gid =
1018 simple_strtoul(value, &value, 0);
1019 }
1020 } else if (strnicmp(data, "file_mode", 4) == 0) {
1021 if (value && *value) {
1022 vol->file_mode =
1023 simple_strtoul(value, &value, 0);
1024 }
1025 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1026 if (value && *value) {
1027 vol->dir_mode =
1028 simple_strtoul(value, &value, 0);
1029 }
1030 } else if (strnicmp(data, "dirmode", 4) == 0) {
1031 if (value && *value) {
1032 vol->dir_mode =
1033 simple_strtoul(value, &value, 0);
1034 }
1035 } else if (strnicmp(data, "port", 4) == 0) {
1036 if (value && *value) {
1037 vol->port =
1038 simple_strtoul(value, &value, 0);
1039 }
1040 } else if (strnicmp(data, "rsize", 5) == 0) {
1041 if (value && *value) {
1042 vol->rsize =
1043 simple_strtoul(value, &value, 0);
1044 }
1045 } else if (strnicmp(data, "wsize", 5) == 0) {
1046 if (value && *value) {
1047 vol->wsize =
1048 simple_strtoul(value, &value, 0);
1049 }
1050 } else if (strnicmp(data, "sockopt", 5) == 0) {
1051 if (value && *value) {
1052 vol->sockopt =
1053 simple_strtoul(value, &value, 0);
1054 }
1055 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1056 if (!value || !*value || (*value == ' ')) {
1057 cFYI(1,("invalid (empty) netbiosname specified"));
1058 } else {
1059 memset(vol->source_rfc1001_name,0x20,15);
1060 for(i=0;i<15;i++) {
1061 /* BB are there cases in which a comma can be
1062 valid in this workstation netbios name (and need
1063 special handling)? */
1064
1065 /* We do not uppercase netbiosname for user */
1066 if (value[i]==0)
1067 break;
1068 else
1069 vol->source_rfc1001_name[i] = value[i];
1070 }
1071 /* The string has 16th byte zero still from
1072 set at top of the function */
1073 if((i==15) && (value[i] != 0))
1074 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1075 }
1076 } else if (strnicmp(data, "servern", 7) == 0) {
1077 /* servernetbiosname specified override *SMBSERVER */
1078 if (!value || !*value || (*value == ' ')) {
1079 cFYI(1,("empty server netbiosname specified"));
1080 } else {
1081 /* last byte, type, is 0x20 for servr type */
1082 memset(vol->target_rfc1001_name,0x20,16);
1083
1084 for(i=0;i<15;i++) {
1085 /* BB are there cases in which a comma can be
1086 valid in this workstation netbios name (and need
1087 special handling)? */
1088
1089 /* user or mount helper must uppercase netbiosname */
1090 if (value[i]==0)
1091 break;
1092 else
1093 vol->target_rfc1001_name[i] = value[i];
1094 }
1095 /* The string has 16th byte zero still from
1096 set at top of the function */
1097 if((i==15) && (value[i] != 0))
1098 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1099 }
1100 } else if (strnicmp(data, "credentials", 4) == 0) {
1101 /* ignore */
1102 } else if (strnicmp(data, "version", 3) == 0) {
1103 /* ignore */
1104 } else if (strnicmp(data, "guest",5) == 0) {
1105 /* ignore */
1106 } else if (strnicmp(data, "rw", 2) == 0) {
1107 vol->rw = TRUE;
1108 } else if ((strnicmp(data, "suid", 4) == 0) ||
1109 (strnicmp(data, "nosuid", 6) == 0) ||
1110 (strnicmp(data, "exec", 4) == 0) ||
1111 (strnicmp(data, "noexec", 6) == 0) ||
1112 (strnicmp(data, "nodev", 5) == 0) ||
1113 (strnicmp(data, "noauto", 6) == 0) ||
1114 (strnicmp(data, "dev", 3) == 0)) {
1115 /* The mount tool or mount.cifs helper (if present)
1116 uses these opts to set flags, and the flags are read
1117 by the kernel vfs layer before we get here (ie
1118 before read super) so there is no point trying to
1119 parse these options again and set anything and it
1120 is ok to just ignore them */
1121 continue;
1122 } else if (strnicmp(data, "ro", 2) == 0) {
1123 vol->rw = FALSE;
1124 } else if (strnicmp(data, "hard", 4) == 0) {
1125 vol->retry = 1;
1126 } else if (strnicmp(data, "soft", 4) == 0) {
1127 vol->retry = 0;
1128 } else if (strnicmp(data, "perm", 4) == 0) {
1129 vol->noperm = 0;
1130 } else if (strnicmp(data, "noperm", 6) == 0) {
1131 vol->noperm = 1;
1132 } else if (strnicmp(data, "mapchars", 8) == 0) {
1133 vol->remap = 1;
1134 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1135 vol->remap = 0;
1136 } else if (strnicmp(data, "sfu", 3) == 0) {
1137 vol->sfu_emul = 1;
1138 } else if (strnicmp(data, "nosfu", 5) == 0) {
1139 vol->sfu_emul = 0;
1140 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1141 vol->posix_paths = 1;
1142 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1143 vol->posix_paths = 0;
1144 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1145 (strnicmp(data, "ignorecase", 10) == 0)) {
1146 vol->nocase = 1;
1147 } else if (strnicmp(data, "brl", 3) == 0) {
1148 vol->nobrl = 0;
1149 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1150 (strnicmp(data, "nolock", 6) == 0)) {
1151 vol->nobrl = 1;
1152 /* turn off mandatory locking in mode
1153 if remote locking is turned off since the
1154 local vfs will do advisory */
1155 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1156 vol->file_mode = S_IALLUGO;
1157 } else if (strnicmp(data, "setuids", 7) == 0) {
1158 vol->setuids = 1;
1159 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1160 vol->setuids = 0;
1161 } else if (strnicmp(data, "nohard", 6) == 0) {
1162 vol->retry = 0;
1163 } else if (strnicmp(data, "nosoft", 6) == 0) {
1164 vol->retry = 1;
1165 } else if (strnicmp(data, "nointr", 6) == 0) {
1166 vol->intr = 0;
1167 } else if (strnicmp(data, "intr", 4) == 0) {
1168 vol->intr = 1;
1169 } else if (strnicmp(data, "serverino",7) == 0) {
1170 vol->server_ino = 1;
1171 } else if (strnicmp(data, "noserverino",9) == 0) {
1172 vol->server_ino = 0;
1173 } else if (strnicmp(data, "cifsacl",7) == 0) {
1174 vol->cifs_acl = 1;
1175 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1176 vol->cifs_acl = 0;
1177 } else if (strnicmp(data, "acl",3) == 0) {
1178 vol->no_psx_acl = 0;
1179 } else if (strnicmp(data, "noacl",5) == 0) {
1180 vol->no_psx_acl = 1;
1181 } else if (strnicmp(data, "sign",4) == 0) {
1182 vol->secFlg |= CIFSSEC_MUST_SIGN;
1183 /* } else if (strnicmp(data, "seal",4) == 0) {
1184 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1185 } else if (strnicmp(data, "direct",6) == 0) {
1186 vol->direct_io = 1;
1187 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1188 vol->direct_io = 1;
1189 } else if (strnicmp(data, "in6_addr",8) == 0) {
1190 if (!value || !*value) {
1191 vol->in6_addr = NULL;
1192 } else if (strnlen(value, 49) == 48) {
1193 vol->in6_addr = value;
1194 } else {
1195 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1196 return 1;
1197 }
1198 } else if (strnicmp(data, "noac", 4) == 0) {
1199 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1200 } else
1201 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1202 }
1203 if (vol->UNC == NULL) {
1204 if(devname == NULL) {
1205 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1206 return 1;
1207 }
1208 if ((temp_len = strnlen(devname, 300)) < 300) {
1209 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1210 if(vol->UNC == NULL)
1211 return 1;
1212 strcpy(vol->UNC,devname);
1213 if (strncmp(vol->UNC, "//", 2) == 0) {
1214 vol->UNC[0] = '\\';
1215 vol->UNC[1] = '\\';
1216 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1217 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1218 return 1;
1219 }
1220 } else {
1221 printk(KERN_WARNING "CIFS: UNC name too long\n");
1222 return 1;
1223 }
1224 }
1225 if(vol->UNCip == NULL)
1226 vol->UNCip = &vol->UNC[2];
1227
1228 return 0;
1229 }
1230
1231 static struct cifsSesInfo *
1232 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1233 struct in6_addr *target_ip6_addr,
1234 char *userName, struct TCP_Server_Info **psrvTcp)
1235 {
1236 struct list_head *tmp;
1237 struct cifsSesInfo *ses;
1238 *psrvTcp = NULL;
1239 read_lock(&GlobalSMBSeslock);
1240
1241 list_for_each(tmp, &GlobalSMBSessionList) {
1242 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1243 if (ses->server) {
1244 if((target_ip_addr &&
1245 (ses->server->addr.sockAddr.sin_addr.s_addr
1246 == target_ip_addr->s_addr)) || (target_ip6_addr
1247 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1248 target_ip6_addr,sizeof(*target_ip6_addr)))){
1249 /* BB lock server and tcp session and increment use count here?? */
1250 *psrvTcp = ses->server; /* found a match on the TCP session */
1251 /* BB check if reconnection needed */
1252 if (strncmp
1253 (ses->userName, userName,
1254 MAX_USERNAME_SIZE) == 0){
1255 read_unlock(&GlobalSMBSeslock);
1256 return ses; /* found exact match on both tcp and SMB sessions */
1257 }
1258 }
1259 }
1260 /* else tcp and smb sessions need reconnection */
1261 }
1262 read_unlock(&GlobalSMBSeslock);
1263 return NULL;
1264 }
1265
1266 static struct cifsTconInfo *
1267 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1268 {
1269 struct list_head *tmp;
1270 struct cifsTconInfo *tcon;
1271
1272 read_lock(&GlobalSMBSeslock);
1273 list_for_each(tmp, &GlobalTreeConnectionList) {
1274 cFYI(1, ("Next tcon"));
1275 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1276 if (tcon->ses) {
1277 if (tcon->ses->server) {
1278 cFYI(1,
1279 ("old ip addr: %x == new ip %x ?",
1280 tcon->ses->server->addr.sockAddr.sin_addr.
1281 s_addr, new_target_ip_addr));
1282 if (tcon->ses->server->addr.sockAddr.sin_addr.
1283 s_addr == new_target_ip_addr) {
1284 /* BB lock tcon, server and tcp session and increment use count here? */
1285 /* found a match on the TCP session */
1286 /* BB check if reconnection needed */
1287 cFYI(1,("IP match, old UNC: %s new: %s",
1288 tcon->treeName, uncName));
1289 if (strncmp
1290 (tcon->treeName, uncName,
1291 MAX_TREE_SIZE) == 0) {
1292 cFYI(1,
1293 ("and old usr: %s new: %s",
1294 tcon->treeName, uncName));
1295 if (strncmp
1296 (tcon->ses->userName,
1297 userName,
1298 MAX_USERNAME_SIZE) == 0) {
1299 read_unlock(&GlobalSMBSeslock);
1300 /* matched smb session
1301 (user name */
1302 return tcon;
1303 }
1304 }
1305 }
1306 }
1307 }
1308 }
1309 read_unlock(&GlobalSMBSeslock);
1310 return NULL;
1311 }
1312
1313 int
1314 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1315 const char *old_path, const struct nls_table *nls_codepage,
1316 int remap)
1317 {
1318 unsigned char *referrals = NULL;
1319 unsigned int num_referrals;
1320 int rc = 0;
1321
1322 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1323 &num_referrals, &referrals, remap);
1324
1325 /* BB Add in code to: if valid refrl, if not ip address contact
1326 the helper that resolves tcp names, mount to it, try to
1327 tcon to it unmount it if fail */
1328
1329 kfree(referrals);
1330
1331 return rc;
1332 }
1333
1334 int
1335 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1336 const char *old_path, const struct nls_table *nls_codepage,
1337 unsigned int *pnum_referrals,
1338 unsigned char ** preferrals, int remap)
1339 {
1340 char *temp_unc;
1341 int rc = 0;
1342
1343 *pnum_referrals = 0;
1344
1345 if (pSesInfo->ipc_tid == 0) {
1346 temp_unc = kmalloc(2 /* for slashes */ +
1347 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1348 + 1 + 4 /* slash IPC$ */ + 2,
1349 GFP_KERNEL);
1350 if (temp_unc == NULL)
1351 return -ENOMEM;
1352 temp_unc[0] = '\\';
1353 temp_unc[1] = '\\';
1354 strcpy(temp_unc + 2, pSesInfo->serverName);
1355 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1356 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1357 cFYI(1,
1358 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1359 kfree(temp_unc);
1360 }
1361 if (rc == 0)
1362 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1363 pnum_referrals, nls_codepage, remap);
1364
1365 return rc;
1366 }
1367
1368 /* See RFC1001 section 14 on representation of Netbios names */
1369 static void rfc1002mangle(char * target,char * source, unsigned int length)
1370 {
1371 unsigned int i,j;
1372
1373 for(i=0,j=0;i<(length);i++) {
1374 /* mask a nibble at a time and encode */
1375 target[j] = 'A' + (0x0F & (source[i] >> 4));
1376 target[j+1] = 'A' + (0x0F & source[i]);
1377 j+=2;
1378 }
1379
1380 }
1381
1382
1383 static int
1384 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1385 char * netbios_name, char * target_name)
1386 {
1387 int rc = 0;
1388 int connected = 0;
1389 __be16 orig_port = 0;
1390
1391 if(*csocket == NULL) {
1392 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1393 if (rc < 0) {
1394 cERROR(1, ("Error %d creating socket",rc));
1395 *csocket = NULL;
1396 return rc;
1397 } else {
1398 /* BB other socket options to set KEEPALIVE, NODELAY? */
1399 cFYI(1,("Socket created"));
1400 (*csocket)->sk->sk_allocation = GFP_NOFS;
1401 }
1402 }
1403
1404 psin_server->sin_family = AF_INET;
1405 if(psin_server->sin_port) { /* user overrode default port */
1406 rc = (*csocket)->ops->connect(*csocket,
1407 (struct sockaddr *) psin_server,
1408 sizeof (struct sockaddr_in),0);
1409 if (rc >= 0)
1410 connected = 1;
1411 }
1412
1413 if(!connected) {
1414 /* save original port so we can retry user specified port
1415 later if fall back ports fail this time */
1416 orig_port = psin_server->sin_port;
1417
1418 /* do not retry on the same port we just failed on */
1419 if(psin_server->sin_port != htons(CIFS_PORT)) {
1420 psin_server->sin_port = htons(CIFS_PORT);
1421
1422 rc = (*csocket)->ops->connect(*csocket,
1423 (struct sockaddr *) psin_server,
1424 sizeof (struct sockaddr_in),0);
1425 if (rc >= 0)
1426 connected = 1;
1427 }
1428 }
1429 if (!connected) {
1430 psin_server->sin_port = htons(RFC1001_PORT);
1431 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1432 psin_server, sizeof (struct sockaddr_in),0);
1433 if (rc >= 0)
1434 connected = 1;
1435 }
1436
1437 /* give up here - unless we want to retry on different
1438 protocol families some day */
1439 if (!connected) {
1440 if(orig_port)
1441 psin_server->sin_port = orig_port;
1442 cFYI(1,("Error %d connecting to server via ipv4",rc));
1443 sock_release(*csocket);
1444 *csocket = NULL;
1445 return rc;
1446 }
1447 /* Eventually check for other socket options to change from
1448 the default. sock_setsockopt not used because it expects
1449 user space buffer */
1450 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1451 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1452 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1453 /* make the bufsizes depend on wsize/rsize and max requests */
1454 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1455 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1456 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1457 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1458
1459 /* send RFC1001 sessinit */
1460 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1461 /* some servers require RFC1001 sessinit before sending
1462 negprot - BB check reconnection in case where second
1463 sessinit is sent but no second negprot */
1464 struct rfc1002_session_packet * ses_init_buf;
1465 struct smb_hdr * smb_buf;
1466 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1467 if(ses_init_buf) {
1468 ses_init_buf->trailer.session_req.called_len = 32;
1469 if(target_name && (target_name[0] != 0)) {
1470 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1471 target_name, 16);
1472 } else {
1473 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1474 DEFAULT_CIFS_CALLED_NAME,16);
1475 }
1476
1477 ses_init_buf->trailer.session_req.calling_len = 32;
1478 /* calling name ends in null (byte 16) from old smb
1479 convention. */
1480 if(netbios_name && (netbios_name[0] !=0)) {
1481 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1482 netbios_name,16);
1483 } else {
1484 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1485 "LINUX_CIFS_CLNT",16);
1486 }
1487 ses_init_buf->trailer.session_req.scope1 = 0;
1488 ses_init_buf->trailer.session_req.scope2 = 0;
1489 smb_buf = (struct smb_hdr *)ses_init_buf;
1490 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1491 smb_buf->smb_buf_length = 0x81000044;
1492 rc = smb_send(*csocket, smb_buf, 0x44,
1493 (struct sockaddr *)psin_server);
1494 kfree(ses_init_buf);
1495 msleep(1); /* RFC1001 layer in at least one server
1496 requires very short break before negprot
1497 presumably because not expecting negprot
1498 to follow so fast. This is a simple
1499 solution that works without
1500 complicating the code and causes no
1501 significant slowing down on mount
1502 for everyone else */
1503 }
1504 /* else the negprot may still work without this
1505 even though malloc failed */
1506
1507 }
1508
1509 return rc;
1510 }
1511
1512 static int
1513 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1514 {
1515 int rc = 0;
1516 int connected = 0;
1517 __be16 orig_port = 0;
1518
1519 if(*csocket == NULL) {
1520 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1521 if (rc < 0) {
1522 cERROR(1, ("Error %d creating ipv6 socket",rc));
1523 *csocket = NULL;
1524 return rc;
1525 } else {
1526 /* BB other socket options to set KEEPALIVE, NODELAY? */
1527 cFYI(1,("ipv6 Socket created"));
1528 (*csocket)->sk->sk_allocation = GFP_NOFS;
1529 }
1530 }
1531
1532 psin_server->sin6_family = AF_INET6;
1533
1534 if(psin_server->sin6_port) { /* user overrode default port */
1535 rc = (*csocket)->ops->connect(*csocket,
1536 (struct sockaddr *) psin_server,
1537 sizeof (struct sockaddr_in6),0);
1538 if (rc >= 0)
1539 connected = 1;
1540 }
1541
1542 if(!connected) {
1543 /* save original port so we can retry user specified port
1544 later if fall back ports fail this time */
1545
1546 orig_port = psin_server->sin6_port;
1547 /* do not retry on the same port we just failed on */
1548 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1549 psin_server->sin6_port = htons(CIFS_PORT);
1550
1551 rc = (*csocket)->ops->connect(*csocket,
1552 (struct sockaddr *) psin_server,
1553 sizeof (struct sockaddr_in6),0);
1554 if (rc >= 0)
1555 connected = 1;
1556 }
1557 }
1558 if (!connected) {
1559 psin_server->sin6_port = htons(RFC1001_PORT);
1560 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1561 psin_server, sizeof (struct sockaddr_in6),0);
1562 if (rc >= 0)
1563 connected = 1;
1564 }
1565
1566 /* give up here - unless we want to retry on different
1567 protocol families some day */
1568 if (!connected) {
1569 if(orig_port)
1570 psin_server->sin6_port = orig_port;
1571 cFYI(1,("Error %d connecting to server via ipv6",rc));
1572 sock_release(*csocket);
1573 *csocket = NULL;
1574 return rc;
1575 }
1576 /* Eventually check for other socket options to change from
1577 the default. sock_setsockopt not used because it expects
1578 user space buffer */
1579 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1580
1581 return rc;
1582 }
1583
1584 int
1585 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1586 char *mount_data, const char *devname)
1587 {
1588 int rc = 0;
1589 int xid;
1590 int address_type = AF_INET;
1591 struct socket *csocket = NULL;
1592 struct sockaddr_in sin_server;
1593 struct sockaddr_in6 sin_server6;
1594 struct smb_vol volume_info;
1595 struct cifsSesInfo *pSesInfo = NULL;
1596 struct cifsSesInfo *existingCifsSes = NULL;
1597 struct cifsTconInfo *tcon = NULL;
1598 struct TCP_Server_Info *srvTcp = NULL;
1599
1600 xid = GetXid();
1601
1602 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1603
1604 memset(&volume_info,0,sizeof(struct smb_vol));
1605 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1606 kfree(volume_info.UNC);
1607 kfree(volume_info.password);
1608 FreeXid(xid);
1609 return -EINVAL;
1610 }
1611
1612 if (volume_info.username) {
1613 /* BB fixme parse for domain name here */
1614 cFYI(1, ("Username: %s ", volume_info.username));
1615
1616 } else {
1617 cifserror("No username specified");
1618 /* In userspace mount helper we can get user name from alternate
1619 locations such as env variables and files on disk */
1620 kfree(volume_info.UNC);
1621 kfree(volume_info.password);
1622 FreeXid(xid);
1623 return -EINVAL;
1624 }
1625
1626 if (volume_info.UNCip && volume_info.UNC) {
1627 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1628
1629 if(rc <= 0) {
1630 /* not ipv4 address, try ipv6 */
1631 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1632 if(rc > 0)
1633 address_type = AF_INET6;
1634 } else {
1635 address_type = AF_INET;
1636 }
1637
1638 if(rc <= 0) {
1639 /* we failed translating address */
1640 kfree(volume_info.UNC);
1641 kfree(volume_info.password);
1642 FreeXid(xid);
1643 return -EINVAL;
1644 }
1645
1646 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1647 /* success */
1648 rc = 0;
1649 } else if (volume_info.UNCip){
1650 /* BB using ip addr as server name connect to the DFS root below */
1651 cERROR(1,("Connecting to DFS root not implemented yet"));
1652 kfree(volume_info.UNC);
1653 kfree(volume_info.password);
1654 FreeXid(xid);
1655 return -EINVAL;
1656 } else /* which servers DFS root would we conect to */ {
1657 cERROR(1,
1658 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1659 kfree(volume_info.UNC);
1660 kfree(volume_info.password);
1661 FreeXid(xid);
1662 return -EINVAL;
1663 }
1664
1665 /* this is needed for ASCII cp to Unicode converts */
1666 if(volume_info.iocharset == NULL) {
1667 cifs_sb->local_nls = load_nls_default();
1668 /* load_nls_default can not return null */
1669 } else {
1670 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1671 if(cifs_sb->local_nls == NULL) {
1672 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1673 kfree(volume_info.UNC);
1674 kfree(volume_info.password);
1675 FreeXid(xid);
1676 return -ELIBACC;
1677 }
1678 }
1679
1680 if(address_type == AF_INET)
1681 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1682 NULL /* no ipv6 addr */,
1683 volume_info.username, &srvTcp);
1684 else if(address_type == AF_INET6)
1685 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1686 &sin_server6.sin6_addr,
1687 volume_info.username, &srvTcp);
1688 else {
1689 kfree(volume_info.UNC);
1690 kfree(volume_info.password);
1691 FreeXid(xid);
1692 return -EINVAL;
1693 }
1694
1695
1696 if (srvTcp) {
1697 cFYI(1, ("Existing tcp session with server found"));
1698 } else { /* create socket */
1699 if(volume_info.port)
1700 sin_server.sin_port = htons(volume_info.port);
1701 else
1702 sin_server.sin_port = 0;
1703 rc = ipv4_connect(&sin_server,&csocket,
1704 volume_info.source_rfc1001_name,
1705 volume_info.target_rfc1001_name);
1706 if (rc < 0) {
1707 cERROR(1,
1708 ("Error connecting to IPv4 socket. Aborting operation"));
1709 if(csocket != NULL)
1710 sock_release(csocket);
1711 kfree(volume_info.UNC);
1712 kfree(volume_info.password);
1713 FreeXid(xid);
1714 return rc;
1715 }
1716
1717 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1718 if (srvTcp == NULL) {
1719 rc = -ENOMEM;
1720 sock_release(csocket);
1721 kfree(volume_info.UNC);
1722 kfree(volume_info.password);
1723 FreeXid(xid);
1724 return rc;
1725 } else {
1726 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1727 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1728 atomic_set(&srvTcp->inFlight,0);
1729 /* BB Add code for ipv6 case too */
1730 srvTcp->ssocket = csocket;
1731 srvTcp->protocolType = IPV4;
1732 init_waitqueue_head(&srvTcp->response_q);
1733 init_waitqueue_head(&srvTcp->request_q);
1734 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1735 /* at this point we are the only ones with the pointer
1736 to the struct since the kernel thread not created yet
1737 so no need to spinlock this init of tcpStatus */
1738 srvTcp->tcpStatus = CifsNew;
1739 init_MUTEX(&srvTcp->tcpSem);
1740 rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1741 CLONE_FS | CLONE_FILES | CLONE_VM);
1742 if(rc < 0) {
1743 rc = -ENOMEM;
1744 sock_release(csocket);
1745 kfree(volume_info.UNC);
1746 kfree(volume_info.password);
1747 FreeXid(xid);
1748 return rc;
1749 }
1750 wait_for_completion(&cifsd_complete);
1751 rc = 0;
1752 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1753 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1754 srvTcp->sequence_number = 0;
1755 }
1756 }
1757
1758 if (existingCifsSes) {
1759 pSesInfo = existingCifsSes;
1760 cFYI(1, ("Existing smb sess found"));
1761 kfree(volume_info.password);
1762 /* volume_info.UNC freed at end of function */
1763 } else if (!rc) {
1764 cFYI(1, ("Existing smb sess not found"));
1765 pSesInfo = sesInfoAlloc();
1766 if (pSesInfo == NULL)
1767 rc = -ENOMEM;
1768 else {
1769 pSesInfo->server = srvTcp;
1770 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1771 NIPQUAD(sin_server.sin_addr.s_addr));
1772 }
1773
1774 if (!rc){
1775 /* volume_info.password freed at unmount */
1776 if (volume_info.password)
1777 pSesInfo->password = volume_info.password;
1778 if (volume_info.username)
1779 strncpy(pSesInfo->userName,
1780 volume_info.username,MAX_USERNAME_SIZE);
1781 if (volume_info.domainname) {
1782 int len = strlen(volume_info.domainname);
1783 pSesInfo->domainName =
1784 kmalloc(len + 1, GFP_KERNEL);
1785 if(pSesInfo->domainName)
1786 strcpy(pSesInfo->domainName,
1787 volume_info.domainname);
1788 }
1789 pSesInfo->linux_uid = volume_info.linux_uid;
1790 pSesInfo->overrideSecFlg = volume_info.secFlg;
1791 down(&pSesInfo->sesSem);
1792 /* BB FIXME need to pass vol->secFlgs BB */
1793 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1794 up(&pSesInfo->sesSem);
1795 if(!rc)
1796 atomic_inc(&srvTcp->socketUseCount);
1797 } else
1798 kfree(volume_info.password);
1799 }
1800
1801 /* search for existing tcon to this server share */
1802 if (!rc) {
1803 if(volume_info.rsize > CIFSMaxBufSize) {
1804 cERROR(1,("rsize %d too large, using MaxBufSize",
1805 volume_info.rsize));
1806 cifs_sb->rsize = CIFSMaxBufSize;
1807 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1808 cifs_sb->rsize = volume_info.rsize;
1809 else /* default */
1810 cifs_sb->rsize = CIFSMaxBufSize;
1811
1812 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1813 cERROR(1,("wsize %d too large using 4096 instead",
1814 volume_info.wsize));
1815 cifs_sb->wsize = 4096;
1816 } else if(volume_info.wsize)
1817 cifs_sb->wsize = volume_info.wsize;
1818 else
1819 cifs_sb->wsize =
1820 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1821 127*1024);
1822 /* old default of CIFSMaxBufSize was too small now
1823 that SMB Write2 can send multiple pages in kvec.
1824 RFC1001 does not describe what happens when frame
1825 bigger than 128K is sent so use that as max in
1826 conjunction with 52K kvec constraint on arch with 4K
1827 page size */
1828
1829 if(cifs_sb->rsize < 2048) {
1830 cifs_sb->rsize = 2048;
1831 /* Windows ME may prefer this */
1832 cFYI(1,("readsize set to minimum 2048"));
1833 }
1834 cifs_sb->mnt_uid = volume_info.linux_uid;
1835 cifs_sb->mnt_gid = volume_info.linux_gid;
1836 cifs_sb->mnt_file_mode = volume_info.file_mode;
1837 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1838 cFYI(1,("file mode: 0x%x dir mode: 0x%x",
1839 cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1840
1841 if(volume_info.noperm)
1842 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1843 if(volume_info.setuids)
1844 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1845 if(volume_info.server_ino)
1846 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1847 if(volume_info.remap)
1848 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1849 if(volume_info.no_xattr)
1850 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1851 if(volume_info.sfu_emul)
1852 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1853 if(volume_info.nobrl)
1854 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1855 if(volume_info.cifs_acl)
1856 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1857
1858 if(volume_info.direct_io) {
1859 cFYI(1,("mounting share using direct i/o"));
1860 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1861 }
1862
1863 tcon =
1864 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1865 volume_info.username);
1866 if (tcon) {
1867 cFYI(1, ("Found match on UNC path"));
1868 /* we can have only one retry value for a connection
1869 to a share so for resources mounted more than once
1870 to the same server share the last value passed in
1871 for the retry flag is used */
1872 tcon->retry = volume_info.retry;
1873 tcon->nocase = volume_info.nocase;
1874 } else {
1875 tcon = tconInfoAlloc();
1876 if (tcon == NULL)
1877 rc = -ENOMEM;
1878 else {
1879 /* check for null share name ie connect to dfs root */
1880
1881 /* BB check if this works for exactly length three strings */
1882 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
1883 && (strchr(volume_info.UNC + 3, '/') ==
1884 NULL)) {
1885 rc = connect_to_dfs_path(xid, pSesInfo,
1886 "", cifs_sb->local_nls,
1887 cifs_sb->mnt_cifs_flags &
1888 CIFS_MOUNT_MAP_SPECIAL_CHR);
1889 kfree(volume_info.UNC);
1890 FreeXid(xid);
1891 return -ENODEV;
1892 } else {
1893 rc = CIFSTCon(xid, pSesInfo,
1894 volume_info.UNC,
1895 tcon, cifs_sb->local_nls);
1896 cFYI(1, ("CIFS Tcon rc = %d", rc));
1897 }
1898 if (!rc) {
1899 atomic_inc(&pSesInfo->inUse);
1900 tcon->retry = volume_info.retry;
1901 tcon->nocase = volume_info.nocase;
1902 }
1903 }
1904 }
1905 }
1906 if(pSesInfo) {
1907 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
1908 sb->s_maxbytes = (u64) 1 << 63;
1909 } else
1910 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
1911 }
1912
1913 sb->s_time_gran = 100;
1914
1915 /* on error free sesinfo and tcon struct if needed */
1916 if (rc) {
1917 /* if session setup failed, use count is zero but
1918 we still need to free cifsd thread */
1919 if(atomic_read(&srvTcp->socketUseCount) == 0) {
1920 spin_lock(&GlobalMid_Lock);
1921 srvTcp->tcpStatus = CifsExiting;
1922 spin_unlock(&GlobalMid_Lock);
1923 if(srvTcp->tsk) {
1924 send_sig(SIGKILL,srvTcp->tsk,1);
1925 wait_for_completion(&cifsd_complete);
1926 }
1927 }
1928 /* If find_unc succeeded then rc == 0 so we can not end */
1929 if (tcon) /* up accidently freeing someone elses tcon struct */
1930 tconInfoFree(tcon);
1931 if (existingCifsSes == NULL) {
1932 if (pSesInfo) {
1933 if ((pSesInfo->server) &&
1934 (pSesInfo->status == CifsGood)) {
1935 int temp_rc;
1936 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
1937 /* if the socketUseCount is now zero */
1938 if((temp_rc == -ESHUTDOWN) &&
1939 (pSesInfo->server->tsk)) {
1940 send_sig(SIGKILL,pSesInfo->server->tsk,1);
1941 wait_for_completion(&cifsd_complete);
1942 }
1943 } else
1944 cFYI(1, ("No session or bad tcon"));
1945 sesInfoFree(pSesInfo);
1946 /* pSesInfo = NULL; */
1947 }
1948 }
1949 } else {
1950 atomic_inc(&tcon->useCount);
1951 cifs_sb->tcon = tcon;
1952 tcon->ses = pSesInfo;
1953
1954 /* do not care if following two calls succeed - informational */
1955 CIFSSMBQFSDeviceInfo(xid, tcon);
1956 CIFSSMBQFSAttributeInfo(xid, tcon);
1957
1958 if (tcon->ses->capabilities & CAP_UNIX) {
1959 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1960 __u64 cap =
1961 le64_to_cpu(tcon->fsUnixInfo.Capability);
1962 cap &= CIFS_UNIX_CAP_MASK;
1963 if(volume_info.no_psx_acl)
1964 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1965 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1966 cFYI(1,("negotiated posix acl support"));
1967 sb->s_flags |= MS_POSIXACL;
1968 }
1969
1970 if(volume_info.posix_paths == 0)
1971 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1972 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1973 cFYI(1,("negotiate posix pathnames"));
1974 cifs_sb->mnt_cifs_flags |=
1975 CIFS_MOUNT_POSIX_PATHS;
1976 }
1977
1978 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1979 #ifdef CONFIG_CIFS_DEBUG2
1980 if(cap & CIFS_UNIX_FCNTL_CAP)
1981 cFYI(1,("FCNTL cap"));
1982 if(cap & CIFS_UNIX_EXTATTR_CAP)
1983 cFYI(1,("EXTATTR cap"));
1984 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1985 cFYI(1,("POSIX path cap"));
1986 if(cap & CIFS_UNIX_XATTR_CAP)
1987 cFYI(1,("XATTR cap"));
1988 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1989 cFYI(1,("POSIX ACL cap"));
1990 #endif /* CIFS_DEBUG2 */
1991 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1992 cFYI(1,("setting capabilities failed"));
1993 }
1994 }
1995 }
1996 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
1997 cifs_sb->wsize = min(cifs_sb->wsize,
1998 (tcon->ses->server->maxBuf -
1999 MAX_CIFS_HDR_SIZE));
2000 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2001 cifs_sb->rsize = min(cifs_sb->rsize,
2002 (tcon->ses->server->maxBuf -
2003 MAX_CIFS_HDR_SIZE));
2004 }
2005
2006 /* volume_info.password is freed above when existing session found
2007 (in which case it is not needed anymore) but when new sesion is created
2008 the password ptr is put in the new session structure (in which case the
2009 password will be freed at unmount time) */
2010 kfree(volume_info.UNC);
2011 FreeXid(xid);
2012 return rc;
2013 }
2014
2015 static int
2016 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2017 char session_key[CIFS_SESS_KEY_SIZE],
2018 const struct nls_table *nls_codepage)
2019 {
2020 struct smb_hdr *smb_buffer;
2021 struct smb_hdr *smb_buffer_response;
2022 SESSION_SETUP_ANDX *pSMB;
2023 SESSION_SETUP_ANDX *pSMBr;
2024 char *bcc_ptr;
2025 char *user;
2026 char *domain;
2027 int rc = 0;
2028 int remaining_words = 0;
2029 int bytes_returned = 0;
2030 int len;
2031 __u32 capabilities;
2032 __u16 count;
2033
2034 cFYI(1, ("In sesssetup"));
2035 if(ses == NULL)
2036 return -EINVAL;
2037 user = ses->userName;
2038 domain = ses->domainName;
2039 smb_buffer = cifs_buf_get();
2040 if (smb_buffer == NULL) {
2041 return -ENOMEM;
2042 }
2043 smb_buffer_response = smb_buffer;
2044 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2045
2046 /* send SMBsessionSetup here */
2047 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2048 NULL /* no tCon exists yet */ , 13 /* wct */ );
2049
2050 smb_buffer->Mid = GetNextMid(ses->server);
2051 pSMB->req_no_secext.AndXCommand = 0xFF;
2052 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2053 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2054
2055 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2056 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2057
2058 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2059 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2060 if (ses->capabilities & CAP_UNICODE) {
2061 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2062 capabilities |= CAP_UNICODE;
2063 }
2064 if (ses->capabilities & CAP_STATUS32) {
2065 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2066 capabilities |= CAP_STATUS32;
2067 }
2068 if (ses->capabilities & CAP_DFS) {
2069 smb_buffer->Flags2 |= SMBFLG2_DFS;
2070 capabilities |= CAP_DFS;
2071 }
2072 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2073
2074 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2075 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2076
2077 pSMB->req_no_secext.CaseSensitivePasswordLength =
2078 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2079 bcc_ptr = pByteArea(smb_buffer);
2080 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2081 bcc_ptr += CIFS_SESS_KEY_SIZE;
2082 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2083 bcc_ptr += CIFS_SESS_KEY_SIZE;
2084
2085 if (ses->capabilities & CAP_UNICODE) {
2086 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2087 *bcc_ptr = 0;
2088 bcc_ptr++;
2089 }
2090 if(user == NULL)
2091 bytes_returned = 0; /* skip null user */
2092 else
2093 bytes_returned =
2094 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2095 nls_codepage);
2096 /* convert number of 16 bit words to bytes */
2097 bcc_ptr += 2 * bytes_returned;
2098 bcc_ptr += 2; /* trailing null */
2099 if (domain == NULL)
2100 bytes_returned =
2101 cifs_strtoUCS((__le16 *) bcc_ptr,
2102 "CIFS_LINUX_DOM", 32, nls_codepage);
2103 else
2104 bytes_returned =
2105 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2106 nls_codepage);
2107 bcc_ptr += 2 * bytes_returned;
2108 bcc_ptr += 2;
2109 bytes_returned =
2110 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2111 32, nls_codepage);
2112 bcc_ptr += 2 * bytes_returned;
2113 bytes_returned =
2114 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release,
2115 32, nls_codepage);
2116 bcc_ptr += 2 * bytes_returned;
2117 bcc_ptr += 2;
2118 bytes_returned =
2119 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2120 64, nls_codepage);
2121 bcc_ptr += 2 * bytes_returned;
2122 bcc_ptr += 2;
2123 } else {
2124 if(user != NULL) {
2125 strncpy(bcc_ptr, user, 200);
2126 bcc_ptr += strnlen(user, 200);
2127 }
2128 *bcc_ptr = 0;
2129 bcc_ptr++;
2130 if (domain == NULL) {
2131 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2132 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2133 } else {
2134 strncpy(bcc_ptr, domain, 64);
2135 bcc_ptr += strnlen(domain, 64);
2136 *bcc_ptr = 0;
2137 bcc_ptr++;
2138 }
2139 strcpy(bcc_ptr, "Linux version ");
2140 bcc_ptr += strlen("Linux version ");
2141 strcpy(bcc_ptr, system_utsname.release);
2142 bcc_ptr += strlen(system_utsname.release) + 1;
2143 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2144 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2145 }
2146 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2147 smb_buffer->smb_buf_length += count;
2148 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2149
2150 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2151 &bytes_returned, 1);
2152 if (rc) {
2153 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2154 } else if ((smb_buffer_response->WordCount == 3)
2155 || (smb_buffer_response->WordCount == 4)) {
2156 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2157 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2158 if (action & GUEST_LOGIN)
2159 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2160 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2161 cFYI(1, ("UID = %d ", ses->Suid));
2162 /* response can have either 3 or 4 word count - Samba sends 3 */
2163 bcc_ptr = pByteArea(smb_buffer_response);
2164 if ((pSMBr->resp.hdr.WordCount == 3)
2165 || ((pSMBr->resp.hdr.WordCount == 4)
2166 && (blob_len < pSMBr->resp.ByteCount))) {
2167 if (pSMBr->resp.hdr.WordCount == 4)
2168 bcc_ptr += blob_len;
2169
2170 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2171 if ((long) (bcc_ptr) % 2) {
2172 remaining_words =
2173 (BCC(smb_buffer_response) - 1) /2;
2174 bcc_ptr++; /* Unicode strings must be word aligned */
2175 } else {
2176 remaining_words =
2177 BCC(smb_buffer_response) / 2;
2178 }
2179 len =
2180 UniStrnlen((wchar_t *) bcc_ptr,
2181 remaining_words - 1);
2182 /* We look for obvious messed up bcc or strings in response so we do not go off
2183 the end since (at least) WIN2K and Windows XP have a major bug in not null
2184 terminating last Unicode string in response */
2185 if(ses->serverOS)
2186 kfree(ses->serverOS);
2187 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2188 if(ses->serverOS == NULL)
2189 goto sesssetup_nomem;
2190 cifs_strfromUCS_le(ses->serverOS,
2191 (__le16 *)bcc_ptr, len,nls_codepage);
2192 bcc_ptr += 2 * (len + 1);
2193 remaining_words -= len + 1;
2194 ses->serverOS[2 * len] = 0;
2195 ses->serverOS[1 + (2 * len)] = 0;
2196 if (remaining_words > 0) {
2197 len = UniStrnlen((wchar_t *)bcc_ptr,
2198 remaining_words-1);
2199 kfree(ses->serverNOS);
2200 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2201 if(ses->serverNOS == NULL)
2202 goto sesssetup_nomem;
2203 cifs_strfromUCS_le(ses->serverNOS,
2204 (__le16 *)bcc_ptr,len,nls_codepage);
2205 bcc_ptr += 2 * (len + 1);
2206 ses->serverNOS[2 * len] = 0;
2207 ses->serverNOS[1 + (2 * len)] = 0;
2208 if(strncmp(ses->serverNOS,
2209 "NT LAN Manager 4",16) == 0) {
2210 cFYI(1,("NT4 server"));
2211 ses->flags |= CIFS_SES_NT4;
2212 }
2213 remaining_words -= len + 1;
2214 if (remaining_words > 0) {
2215 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2216 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2217 if(ses->serverDomain)
2218 kfree(ses->serverDomain);
2219 ses->serverDomain =
2220 kzalloc(2*(len+1),GFP_KERNEL);
2221 if(ses->serverDomain == NULL)
2222 goto sesssetup_nomem;
2223 cifs_strfromUCS_le(ses->serverDomain,
2224 (__le16 *)bcc_ptr,len,nls_codepage);
2225 bcc_ptr += 2 * (len + 1);
2226 ses->serverDomain[2*len] = 0;
2227 ses->serverDomain[1+(2*len)] = 0;
2228 } /* else no more room so create dummy domain string */
2229 else {
2230 if(ses->serverDomain)
2231 kfree(ses->serverDomain);
2232 ses->serverDomain =
2233 kzalloc(2, GFP_KERNEL);
2234 }
2235 } else { /* no room so create dummy domain and NOS string */
2236 /* if these kcallocs fail not much we
2237 can do, but better to not fail the
2238 sesssetup itself */
2239 kfree(ses->serverDomain);
2240 ses->serverDomain =
2241 kzalloc(2, GFP_KERNEL);
2242 kfree(ses->serverNOS);
2243 ses->serverNOS =
2244 kzalloc(2, GFP_KERNEL);
2245 }
2246 } else { /* ASCII */
2247 len = strnlen(bcc_ptr, 1024);
2248 if (((long) bcc_ptr + len) - (long)
2249 pByteArea(smb_buffer_response)
2250 <= BCC(smb_buffer_response)) {
2251 kfree(ses->serverOS);
2252 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2253 if(ses->serverOS == NULL)
2254 goto sesssetup_nomem;
2255 strncpy(ses->serverOS,bcc_ptr, len);
2256
2257 bcc_ptr += len;
2258 bcc_ptr[0] = 0; /* null terminate the string */
2259 bcc_ptr++;
2260
2261 len = strnlen(bcc_ptr, 1024);
2262 kfree(ses->serverNOS);
2263 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2264 if(ses->serverNOS == NULL)
2265 goto sesssetup_nomem;
2266 strncpy(ses->serverNOS, bcc_ptr, len);
2267 bcc_ptr += len;
2268 bcc_ptr[0] = 0;
2269 bcc_ptr++;
2270
2271 len = strnlen(bcc_ptr, 1024);
2272 if(ses->serverDomain)
2273 kfree(ses->serverDomain);
2274 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2275 if(ses->serverDomain == NULL)
2276 goto sesssetup_nomem;
2277 strncpy(ses->serverDomain, bcc_ptr, len);
2278 bcc_ptr += len;
2279 bcc_ptr[0] = 0;
2280 bcc_ptr++;
2281 } else
2282 cFYI(1,
2283 ("Variable field of length %d extends beyond end of smb ",
2284 len));
2285 }
2286 } else {
2287 cERROR(1,
2288 (" Security Blob Length extends beyond end of SMB"));
2289 }
2290 } else {
2291 cERROR(1,
2292 (" Invalid Word count %d: ",
2293 smb_buffer_response->WordCount));
2294 rc = -EIO;
2295 }
2296 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2297 since that could make reconnection harder, and
2298 reconnection might be needed to free memory */
2299 if (smb_buffer)
2300 cifs_buf_release(smb_buffer);
2301
2302 return rc;
2303 }
2304
2305 static int
2306 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2307 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2308 const struct nls_table *nls_codepage)
2309 {
2310 struct smb_hdr *smb_buffer;
2311 struct smb_hdr *smb_buffer_response;
2312 SESSION_SETUP_ANDX *pSMB;
2313 SESSION_SETUP_ANDX *pSMBr;
2314 char *bcc_ptr;
2315 char *domain;
2316 int rc = 0;
2317 int remaining_words = 0;
2318 int bytes_returned = 0;
2319 int len;
2320 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2321 PNEGOTIATE_MESSAGE SecurityBlob;
2322 PCHALLENGE_MESSAGE SecurityBlob2;
2323 __u32 negotiate_flags, capabilities;
2324 __u16 count;
2325
2326 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2327 if(ses == NULL)
2328 return -EINVAL;
2329 domain = ses->domainName;
2330 *pNTLMv2_flag = FALSE;
2331 smb_buffer = cifs_buf_get();
2332 if (smb_buffer == NULL) {
2333 return -ENOMEM;
2334 }
2335 smb_buffer_response = smb_buffer;
2336 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2337 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2338
2339 /* send SMBsessionSetup here */
2340 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2341 NULL /* no tCon exists yet */ , 12 /* wct */ );
2342
2343 smb_buffer->Mid = GetNextMid(ses->server);
2344 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2345 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2346
2347 pSMB->req.AndXCommand = 0xFF;
2348 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2349 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2350
2351 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2352 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2353
2354 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2355 CAP_EXTENDED_SECURITY;
2356 if (ses->capabilities & CAP_UNICODE) {
2357 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2358 capabilities |= CAP_UNICODE;
2359 }
2360 if (ses->capabilities & CAP_STATUS32) {
2361 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2362 capabilities |= CAP_STATUS32;
2363 }
2364 if (ses->capabilities & CAP_DFS) {
2365 smb_buffer->Flags2 |= SMBFLG2_DFS;
2366 capabilities |= CAP_DFS;
2367 }
2368 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2369
2370 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2371 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2372 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2373 SecurityBlob->MessageType = NtLmNegotiate;
2374 negotiate_flags =
2375 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2376 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2377 NTLMSSP_NEGOTIATE_56 |
2378 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2379 if(sign_CIFS_PDUs)
2380 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2381 /* if(ntlmv2_support)
2382 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2383 /* setup pointers to domain name and workstation name */
2384 bcc_ptr += SecurityBlobLength;
2385
2386 SecurityBlob->WorkstationName.Buffer = 0;
2387 SecurityBlob->WorkstationName.Length = 0;
2388 SecurityBlob->WorkstationName.MaximumLength = 0;
2389
2390 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2391 along with username on auth request (ie the response to challenge) */
2392 SecurityBlob->DomainName.Buffer = 0;
2393 SecurityBlob->DomainName.Length = 0;
2394 SecurityBlob->DomainName.MaximumLength = 0;
2395 if (ses->capabilities & CAP_UNICODE) {
2396 if ((long) bcc_ptr % 2) {
2397 *bcc_ptr = 0;
2398 bcc_ptr++;
2399 }
2400
2401 bytes_returned =
2402 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2403 32, nls_codepage);
2404 bcc_ptr += 2 * bytes_returned;
2405 bytes_returned =
2406 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2407 nls_codepage);
2408 bcc_ptr += 2 * bytes_returned;
2409 bcc_ptr += 2; /* null terminate Linux version */
2410 bytes_returned =
2411 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2412 64, nls_codepage);
2413 bcc_ptr += 2 * bytes_returned;
2414 *(bcc_ptr + 1) = 0;
2415 *(bcc_ptr + 2) = 0;
2416 bcc_ptr += 2; /* null terminate network opsys string */
2417 *(bcc_ptr + 1) = 0;
2418 *(bcc_ptr + 2) = 0;
2419 bcc_ptr += 2; /* null domain */
2420 } else { /* ASCII */
2421 strcpy(bcc_ptr, "Linux version ");
2422 bcc_ptr += strlen("Linux version ");
2423 strcpy(bcc_ptr, system_utsname.release);
2424 bcc_ptr += strlen(system_utsname.release) + 1;
2425 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2426 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2427 bcc_ptr++; /* empty domain field */
2428 *bcc_ptr = 0;
2429 }
2430 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2431 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2432 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2433 smb_buffer->smb_buf_length += count;
2434 pSMB->req.ByteCount = cpu_to_le16(count);
2435
2436 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2437 &bytes_returned, 1);
2438
2439 if (smb_buffer_response->Status.CifsError ==
2440 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2441 rc = 0;
2442
2443 if (rc) {
2444 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2445 } else if ((smb_buffer_response->WordCount == 3)
2446 || (smb_buffer_response->WordCount == 4)) {
2447 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2448 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2449
2450 if (action & GUEST_LOGIN)
2451 cFYI(1, (" Guest login"));
2452 /* Do we want to set anything in SesInfo struct when guest login? */
2453
2454 bcc_ptr = pByteArea(smb_buffer_response);
2455 /* response can have either 3 or 4 word count - Samba sends 3 */
2456
2457 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2458 if (SecurityBlob2->MessageType != NtLmChallenge) {
2459 cFYI(1,
2460 ("Unexpected NTLMSSP message type received %d",
2461 SecurityBlob2->MessageType));
2462 } else if (ses) {
2463 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2464 cFYI(1, ("UID = %d", ses->Suid));
2465 if ((pSMBr->resp.hdr.WordCount == 3)
2466 || ((pSMBr->resp.hdr.WordCount == 4)
2467 && (blob_len <
2468 pSMBr->resp.ByteCount))) {
2469
2470 if (pSMBr->resp.hdr.WordCount == 4) {
2471 bcc_ptr += blob_len;
2472 cFYI(1, ("Security Blob Length %d",
2473 blob_len));
2474 }
2475
2476 cFYI(1, ("NTLMSSP Challenge rcvd"));
2477
2478 memcpy(ses->server->cryptKey,
2479 SecurityBlob2->Challenge,
2480 CIFS_CRYPTO_KEY_SIZE);
2481 if(SecurityBlob2->NegotiateFlags &
2482 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2483 *pNTLMv2_flag = TRUE;
2484
2485 if((SecurityBlob2->NegotiateFlags &
2486 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2487 || (sign_CIFS_PDUs > 1))
2488 ses->server->secMode |=
2489 SECMODE_SIGN_REQUIRED;
2490 if ((SecurityBlob2->NegotiateFlags &
2491 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2492 ses->server->secMode |=
2493 SECMODE_SIGN_ENABLED;
2494
2495 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2496 if ((long) (bcc_ptr) % 2) {
2497 remaining_words =
2498 (BCC(smb_buffer_response)
2499 - 1) / 2;
2500 bcc_ptr++; /* Unicode strings must be word aligned */
2501 } else {
2502 remaining_words =
2503 BCC
2504 (smb_buffer_response) / 2;
2505 }
2506 len =
2507 UniStrnlen((wchar_t *) bcc_ptr,
2508 remaining_words - 1);
2509 /* We look for obvious messed up bcc or strings in response so we do not go off
2510 the end since (at least) WIN2K and Windows XP have a major bug in not null
2511 terminating last Unicode string in response */
2512 if(ses->serverOS)
2513 kfree(ses->serverOS);
2514 ses->serverOS =
2515 kzalloc(2 * (len + 1), GFP_KERNEL);
2516 cifs_strfromUCS_le(ses->serverOS,
2517 (__le16 *)
2518 bcc_ptr, len,
2519 nls_codepage);
2520 bcc_ptr += 2 * (len + 1);
2521 remaining_words -= len + 1;
2522 ses->serverOS[2 * len] = 0;
2523 ses->serverOS[1 + (2 * len)] = 0;
2524 if (remaining_words > 0) {
2525 len = UniStrnlen((wchar_t *)
2526 bcc_ptr,
2527 remaining_words
2528 - 1);
2529 kfree(ses->serverNOS);
2530 ses->serverNOS =
2531 kzalloc(2 * (len + 1),
2532 GFP_KERNEL);
2533 cifs_strfromUCS_le(ses->
2534 serverNOS,
2535 (__le16 *)
2536 bcc_ptr,
2537 len,
2538 nls_codepage);
2539 bcc_ptr += 2 * (len + 1);
2540 ses->serverNOS[2 * len] = 0;
2541 ses->serverNOS[1 +
2542 (2 * len)] = 0;
2543 remaining_words -= len + 1;
2544 if (remaining_words > 0) {
2545 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2546 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2547 kfree(ses->serverDomain);
2548 ses->serverDomain =
2549 kzalloc(2 *
2550 (len +
2551 1),
2552 GFP_KERNEL);
2553 cifs_strfromUCS_le
2554 (ses->serverDomain,
2555 (__le16 *)bcc_ptr,
2556 len, nls_codepage);
2557 bcc_ptr +=
2558 2 * (len + 1);
2559 ses->serverDomain[2*len]
2560 = 0;
2561 ses->serverDomain
2562 [1 + (2 * len)]
2563 = 0;
2564 } /* else no more room so create dummy domain string */
2565 else {
2566 kfree(ses->serverDomain);
2567 ses->serverDomain =
2568 kzalloc(2,
2569 GFP_KERNEL);
2570 }
2571 } else { /* no room so create dummy domain and NOS string */
2572 kfree(ses->serverDomain);
2573 ses->serverDomain =
2574 kzalloc(2, GFP_KERNEL);
2575 kfree(ses->serverNOS);
2576 ses->serverNOS =
2577 kzalloc(2, GFP_KERNEL);
2578 }
2579 } else { /* ASCII */
2580 len = strnlen(bcc_ptr, 1024);
2581 if (((long) bcc_ptr + len) - (long)
2582 pByteArea(smb_buffer_response)
2583 <= BCC(smb_buffer_response)) {
2584 if(ses->serverOS)
2585 kfree(ses->serverOS);
2586 ses->serverOS =
2587 kzalloc(len + 1,
2588 GFP_KERNEL);
2589 strncpy(ses->serverOS,
2590 bcc_ptr, len);
2591
2592 bcc_ptr += len;
2593 bcc_ptr[0] = 0; /* null terminate string */
2594 bcc_ptr++;
2595
2596 len = strnlen(bcc_ptr, 1024);
2597 kfree(ses->serverNOS);
2598 ses->serverNOS =
2599 kzalloc(len + 1,
2600 GFP_KERNEL);
2601 strncpy(ses->serverNOS, bcc_ptr, len);
2602 bcc_ptr += len;
2603 bcc_ptr[0] = 0;
2604 bcc_ptr++;
2605
2606 len = strnlen(bcc_ptr, 1024);
2607 kfree(ses->serverDomain);
2608 ses->serverDomain =
2609 kzalloc(len + 1,
2610 GFP_KERNEL);
2611 strncpy(ses->serverDomain, bcc_ptr, len);
2612 bcc_ptr += len;
2613 bcc_ptr[0] = 0;
2614 bcc_ptr++;
2615 } else
2616 cFYI(1,
2617 ("Variable field of length %d extends beyond end of smb",
2618 len));
2619 }
2620 } else {
2621 cERROR(1,
2622 (" Security Blob Length extends beyond end of SMB"));
2623 }
2624 } else {
2625 cERROR(1, ("No session structure passed in."));
2626 }
2627 } else {
2628 cERROR(1,
2629 (" Invalid Word count %d:",
2630 smb_buffer_response->WordCount));
2631 rc = -EIO;
2632 }
2633
2634 if (smb_buffer)
2635 cifs_buf_release(smb_buffer);
2636
2637 return rc;
2638 }
2639 static int
2640 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2641 char *ntlm_session_key, int ntlmv2_flag,
2642 const struct nls_table *nls_codepage)
2643 {
2644 struct smb_hdr *smb_buffer;
2645 struct smb_hdr *smb_buffer_response;
2646 SESSION_SETUP_ANDX *pSMB;
2647 SESSION_SETUP_ANDX *pSMBr;
2648 char *bcc_ptr;
2649 char *user;
2650 char *domain;
2651 int rc = 0;
2652 int remaining_words = 0;
2653 int bytes_returned = 0;
2654 int len;
2655 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2656 PAUTHENTICATE_MESSAGE SecurityBlob;
2657 __u32 negotiate_flags, capabilities;
2658 __u16 count;
2659
2660 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2661 if(ses == NULL)
2662 return -EINVAL;
2663 user = ses->userName;
2664 domain = ses->domainName;
2665 smb_buffer = cifs_buf_get();
2666 if (smb_buffer == NULL) {
2667 return -ENOMEM;
2668 }
2669 smb_buffer_response = smb_buffer;
2670 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2671 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2672
2673 /* send SMBsessionSetup here */
2674 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2675 NULL /* no tCon exists yet */ , 12 /* wct */ );
2676
2677 smb_buffer->Mid = GetNextMid(ses->server);
2678 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2679 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2680 pSMB->req.AndXCommand = 0xFF;
2681 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2682 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2683
2684 pSMB->req.hdr.Uid = ses->Suid;
2685
2686 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2687 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2688
2689 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2690 CAP_EXTENDED_SECURITY;
2691 if (ses->capabilities & CAP_UNICODE) {
2692 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2693 capabilities |= CAP_UNICODE;
2694 }
2695 if (ses->capabilities & CAP_STATUS32) {
2696 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2697 capabilities |= CAP_STATUS32;
2698 }
2699 if (ses->capabilities & CAP_DFS) {
2700 smb_buffer->Flags2 |= SMBFLG2_DFS;
2701 capabilities |= CAP_DFS;
2702 }
2703 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2704
2705 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2706 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2707 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2708 SecurityBlob->MessageType = NtLmAuthenticate;
2709 bcc_ptr += SecurityBlobLength;
2710 negotiate_flags =
2711 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2712 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2713 0x80000000 | NTLMSSP_NEGOTIATE_128;
2714 if(sign_CIFS_PDUs)
2715 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2716 if(ntlmv2_flag)
2717 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2718
2719 /* setup pointers to domain name and workstation name */
2720
2721 SecurityBlob->WorkstationName.Buffer = 0;
2722 SecurityBlob->WorkstationName.Length = 0;
2723 SecurityBlob->WorkstationName.MaximumLength = 0;
2724 SecurityBlob->SessionKey.Length = 0;
2725 SecurityBlob->SessionKey.MaximumLength = 0;
2726 SecurityBlob->SessionKey.Buffer = 0;
2727
2728 SecurityBlob->LmChallengeResponse.Length = 0;
2729 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2730 SecurityBlob->LmChallengeResponse.Buffer = 0;
2731
2732 SecurityBlob->NtChallengeResponse.Length =
2733 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2734 SecurityBlob->NtChallengeResponse.MaximumLength =
2735 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2736 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2737 SecurityBlob->NtChallengeResponse.Buffer =
2738 cpu_to_le32(SecurityBlobLength);
2739 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2740 bcc_ptr += CIFS_SESS_KEY_SIZE;
2741
2742 if (ses->capabilities & CAP_UNICODE) {
2743 if (domain == NULL) {
2744 SecurityBlob->DomainName.Buffer = 0;
2745 SecurityBlob->DomainName.Length = 0;
2746 SecurityBlob->DomainName.MaximumLength = 0;
2747 } else {
2748 __u16 len =
2749 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2750 nls_codepage);
2751 len *= 2;
2752 SecurityBlob->DomainName.MaximumLength =
2753 cpu_to_le16(len);
2754 SecurityBlob->DomainName.Buffer =
2755 cpu_to_le32(SecurityBlobLength);
2756 bcc_ptr += len;
2757 SecurityBlobLength += len;
2758 SecurityBlob->DomainName.Length =
2759 cpu_to_le16(len);
2760 }
2761 if (user == NULL) {
2762 SecurityBlob->UserName.Buffer = 0;
2763 SecurityBlob->UserName.Length = 0;
2764 SecurityBlob->UserName.MaximumLength = 0;
2765 } else {
2766 __u16 len =
2767 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2768 nls_codepage);
2769 len *= 2;
2770 SecurityBlob->UserName.MaximumLength =
2771 cpu_to_le16(len);
2772 SecurityBlob->UserName.Buffer =
2773 cpu_to_le32(SecurityBlobLength);
2774 bcc_ptr += len;
2775 SecurityBlobLength += len;
2776 SecurityBlob->UserName.Length =
2777 cpu_to_le16(len);
2778 }
2779
2780 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2781 SecurityBlob->WorkstationName.Length *= 2;
2782 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2783 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2784 bcc_ptr += SecurityBlob->WorkstationName.Length;
2785 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2786 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2787
2788 if ((long) bcc_ptr % 2) {
2789 *bcc_ptr = 0;
2790 bcc_ptr++;
2791 }
2792 bytes_returned =
2793 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2794 32, nls_codepage);
2795 bcc_ptr += 2 * bytes_returned;
2796 bytes_returned =
2797 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2798 nls_codepage);
2799 bcc_ptr += 2 * bytes_returned;
2800 bcc_ptr += 2; /* null term version string */
2801 bytes_returned =
2802 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2803 64, nls_codepage);
2804 bcc_ptr += 2 * bytes_returned;
2805 *(bcc_ptr + 1) = 0;
2806 *(bcc_ptr + 2) = 0;
2807 bcc_ptr += 2; /* null terminate network opsys string */
2808 *(bcc_ptr + 1) = 0;
2809 *(bcc_ptr + 2) = 0;
2810 bcc_ptr += 2; /* null domain */
2811 } else { /* ASCII */
2812 if (domain == NULL) {
2813 SecurityBlob->DomainName.Buffer = 0;
2814 SecurityBlob->DomainName.Length = 0;
2815 SecurityBlob->DomainName.MaximumLength = 0;
2816 } else {
2817 __u16 len;
2818 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2819 strncpy(bcc_ptr, domain, 63);
2820 len = strnlen(domain, 64);
2821 SecurityBlob->DomainName.MaximumLength =
2822 cpu_to_le16(len);
2823 SecurityBlob->DomainName.Buffer =
2824 cpu_to_le32(SecurityBlobLength);
2825 bcc_ptr += len;
2826 SecurityBlobLength += len;
2827 SecurityBlob->DomainName.Length = cpu_to_le16(len);
2828 }
2829 if (user == NULL) {
2830 SecurityBlob->UserName.Buffer = 0;
2831 SecurityBlob->UserName.Length = 0;
2832 SecurityBlob->UserName.MaximumLength = 0;
2833 } else {
2834 __u16 len;
2835 strncpy(bcc_ptr, user, 63);
2836 len = strnlen(user, 64);
2837 SecurityBlob->UserName.MaximumLength =
2838 cpu_to_le16(len);
2839 SecurityBlob->UserName.Buffer =
2840 cpu_to_le32(SecurityBlobLength);
2841 bcc_ptr += len;
2842 SecurityBlobLength += len;
2843 SecurityBlob->UserName.Length = cpu_to_le16(len);
2844 }
2845 /* BB fill in our workstation name if known BB */
2846
2847 strcpy(bcc_ptr, "Linux version ");
2848 bcc_ptr += strlen("Linux version ");
2849 strcpy(bcc_ptr, system_utsname.release);
2850 bcc_ptr += strlen(system_utsname.release) + 1;
2851 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2852 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2853 bcc_ptr++; /* null domain */
2854 *bcc_ptr = 0;
2855 }
2856 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2857 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2858 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2859 smb_buffer->smb_buf_length += count;
2860 pSMB->req.ByteCount = cpu_to_le16(count);
2861
2862 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2863 &bytes_returned, 1);
2864 if (rc) {
2865 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2866 } else if ((smb_buffer_response->WordCount == 3)
2867 || (smb_buffer_response->WordCount == 4)) {
2868 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2869 __u16 blob_len =
2870 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2871 if (action & GUEST_LOGIN)
2872 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
2873 /* if(SecurityBlob2->MessageType != NtLm??){
2874 cFYI("Unexpected message type on auth response is %d "));
2875 } */
2876 if (ses) {
2877 cFYI(1,
2878 ("Does UID on challenge %d match auth response UID %d ",
2879 ses->Suid, smb_buffer_response->Uid));
2880 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2881 bcc_ptr = pByteArea(smb_buffer_response);
2882 /* response can have either 3 or 4 word count - Samba sends 3 */
2883 if ((pSMBr->resp.hdr.WordCount == 3)
2884 || ((pSMBr->resp.hdr.WordCount == 4)
2885 && (blob_len <
2886 pSMBr->resp.ByteCount))) {
2887 if (pSMBr->resp.hdr.WordCount == 4) {
2888 bcc_ptr +=
2889 blob_len;
2890 cFYI(1,
2891 ("Security Blob Length %d ",
2892 blob_len));
2893 }
2894
2895 cFYI(1,
2896 ("NTLMSSP response to Authenticate "));
2897
2898 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2899 if ((long) (bcc_ptr) % 2) {
2900 remaining_words =
2901 (BCC(smb_buffer_response)
2902 - 1) / 2;
2903 bcc_ptr++; /* Unicode strings must be word aligned */
2904 } else {
2905 remaining_words = BCC(smb_buffer_response) / 2;
2906 }
2907 len =
2908 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
2909 /* We look for obvious messed up bcc or strings in response so we do not go off
2910 the end since (at least) WIN2K and Windows XP have a major bug in not null
2911 terminating last Unicode string in response */
2912 if(ses->serverOS)
2913 kfree(ses->serverOS);
2914 ses->serverOS =
2915 kzalloc(2 * (len + 1), GFP_KERNEL);
2916 cifs_strfromUCS_le(ses->serverOS,
2917 (__le16 *)
2918 bcc_ptr, len,
2919 nls_codepage);
2920 bcc_ptr += 2 * (len + 1);
2921 remaining_words -= len + 1;
2922 ses->serverOS[2 * len] = 0;
2923 ses->serverOS[1 + (2 * len)] = 0;
2924 if (remaining_words > 0) {
2925 len = UniStrnlen((wchar_t *)
2926 bcc_ptr,
2927 remaining_words
2928 - 1);
2929 kfree(ses->serverNOS);
2930 ses->serverNOS =
2931 kzalloc(2 * (len + 1),
2932 GFP_KERNEL);
2933 cifs_strfromUCS_le(ses->
2934 serverNOS,
2935 (__le16 *)
2936 bcc_ptr,
2937 len,
2938 nls_codepage);
2939 bcc_ptr += 2 * (len + 1);
2940 ses->serverNOS[2 * len] = 0;
2941 ses->serverNOS[1+(2*len)] = 0;
2942 remaining_words -= len + 1;
2943 if (remaining_words > 0) {
2944 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2945 /* last string not always null terminated (e.g. for Windows XP & 2000) */
2946 if(ses->serverDomain)
2947 kfree(ses->serverDomain);
2948 ses->serverDomain =
2949 kzalloc(2 *
2950 (len +
2951 1),
2952 GFP_KERNEL);
2953 cifs_strfromUCS_le
2954 (ses->
2955 serverDomain,
2956 (__le16 *)
2957 bcc_ptr, len,
2958 nls_codepage);
2959 bcc_ptr +=
2960 2 * (len + 1);
2961 ses->
2962 serverDomain[2
2963 * len]
2964 = 0;
2965 ses->
2966 serverDomain[1
2967 +
2968 (2
2969 *
2970 len)]
2971 = 0;
2972 } /* else no more room so create dummy domain string */
2973 else {
2974 if(ses->serverDomain)
2975 kfree(ses->serverDomain);
2976 ses->serverDomain = kzalloc(2,GFP_KERNEL);
2977 }
2978 } else { /* no room so create dummy domain and NOS string */
2979 if(ses->serverDomain)
2980 kfree(ses->serverDomain);
2981 ses->serverDomain = kzalloc(2, GFP_KERNEL);
2982 kfree(ses->serverNOS);
2983 ses->serverNOS = kzalloc(2, GFP_KERNEL);
2984 }
2985 } else { /* ASCII */
2986 len = strnlen(bcc_ptr, 1024);
2987 if (((long) bcc_ptr + len) -
2988 (long) pByteArea(smb_buffer_response)
2989 <= BCC(smb_buffer_response)) {
2990 if(ses->serverOS)
2991 kfree(ses->serverOS);
2992 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2993 strncpy(ses->serverOS,bcc_ptr, len);
2994
2995 bcc_ptr += len;
2996 bcc_ptr[0] = 0; /* null terminate the string */
2997 bcc_ptr++;
2998
2999 len = strnlen(bcc_ptr, 1024);
3000 kfree(ses->serverNOS);
3001 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3002 strncpy(ses->serverNOS, bcc_ptr, len);
3003 bcc_ptr += len;
3004 bcc_ptr[0] = 0;
3005 bcc_ptr++;
3006
3007 len = strnlen(bcc_ptr, 1024);
3008 if(ses->serverDomain)
3009 kfree(ses->serverDomain);
3010 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3011 strncpy(ses->serverDomain, bcc_ptr, len);
3012 bcc_ptr += len;
3013 bcc_ptr[0] = 0;
3014 bcc_ptr++;
3015 } else
3016 cFYI(1,
3017 ("Variable field of length %d extends beyond end of smb ",
3018 len));
3019 }
3020 } else {
3021 cERROR(1,
3022 (" Security Blob Length extends beyond end of SMB"));
3023 }
3024 } else {
3025 cERROR(1, ("No session structure passed in."));
3026 }
3027 } else {
3028 cERROR(1,
3029 (" Invalid Word count %d: ",
3030 smb_buffer_response->WordCount));
3031 rc = -EIO;
3032 }
3033
3034 if (smb_buffer)
3035 cifs_buf_release(smb_buffer);
3036
3037 return rc;
3038 }
3039
3040 int
3041 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3042 const char *tree, struct cifsTconInfo *tcon,
3043 const struct nls_table *nls_codepage)
3044 {
3045 struct smb_hdr *smb_buffer;
3046 struct smb_hdr *smb_buffer_response;
3047 TCONX_REQ *pSMB;
3048 TCONX_RSP *pSMBr;
3049 unsigned char *bcc_ptr;
3050 int rc = 0;
3051 int length;
3052 __u16 count;
3053
3054 if (ses == NULL)
3055 return -EIO;
3056
3057 smb_buffer = cifs_buf_get();
3058 if (smb_buffer == NULL) {
3059 return -ENOMEM;
3060 }
3061 smb_buffer_response = smb_buffer;
3062
3063 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3064 NULL /*no tid */ , 4 /*wct */ );
3065
3066 smb_buffer->Mid = GetNextMid(ses->server);
3067 smb_buffer->Uid = ses->Suid;
3068 pSMB = (TCONX_REQ *) smb_buffer;
3069 pSMBr = (TCONX_RSP *) smb_buffer_response;
3070
3071 pSMB->AndXCommand = 0xFF;
3072 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3073 bcc_ptr = &pSMB->Password[0];
3074 if((ses->server->secMode) & SECMODE_USER) {
3075 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3076 *bcc_ptr = 0; /* password is null byte */
3077 bcc_ptr++; /* skip password */
3078 /* already aligned so no need to do it below */
3079 } else {
3080 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3081 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3082 specified as required (when that support is added to
3083 the vfs in the future) as only NTLM or the much
3084 weaker LANMAN (which we do not send by default) is accepted
3085 by Samba (not sure whether other servers allow
3086 NTLMv2 password here) */
3087 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3088 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3089 (ses->server->secType == LANMAN))
3090 calc_lanman_hash(ses, bcc_ptr);
3091 else
3092 #endif /* CIFS_WEAK_PW_HASH */
3093 SMBNTencrypt(ses->password,
3094 ses->server->cryptKey,
3095 bcc_ptr);
3096
3097 bcc_ptr += CIFS_SESS_KEY_SIZE;
3098 if(ses->capabilities & CAP_UNICODE) {
3099 /* must align unicode strings */
3100 *bcc_ptr = 0; /* null byte password */
3101 bcc_ptr++;
3102 }
3103 }
3104
3105 if(ses->server->secMode &
3106 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3107 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3108
3109 if (ses->capabilities & CAP_STATUS32) {
3110 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3111 }
3112 if (ses->capabilities & CAP_DFS) {
3113 smb_buffer->Flags2 |= SMBFLG2_DFS;
3114 }
3115 if (ses->capabilities & CAP_UNICODE) {
3116 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3117 length =
3118 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3119 6 /* max utf8 char length in bytes */ *
3120 (/* server len*/ + 256 /* share len */), nls_codepage);
3121 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3122 bcc_ptr += 2; /* skip trailing null */
3123 } else { /* ASCII */
3124 strcpy(bcc_ptr, tree);
3125 bcc_ptr += strlen(tree) + 1;
3126 }
3127 strcpy(bcc_ptr, "?????");
3128 bcc_ptr += strlen("?????");
3129 bcc_ptr += 1;
3130 count = bcc_ptr - &pSMB->Password[0];
3131 pSMB->hdr.smb_buf_length += count;
3132 pSMB->ByteCount = cpu_to_le16(count);
3133
3134 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3135
3136 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3137 /* above now done in SendReceive */
3138 if ((rc == 0) && (tcon != NULL)) {
3139 tcon->tidStatus = CifsGood;
3140 tcon->tid = smb_buffer_response->Tid;
3141 bcc_ptr = pByteArea(smb_buffer_response);
3142 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3143 /* skip service field (NB: this field is always ASCII) */
3144 bcc_ptr += length + 1;
3145 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3146 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3147 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3148 if ((bcc_ptr + (2 * length)) -
3149 pByteArea(smb_buffer_response) <=
3150 BCC(smb_buffer_response)) {
3151 kfree(tcon->nativeFileSystem);
3152 tcon->nativeFileSystem =
3153 kzalloc(length + 2, GFP_KERNEL);
3154 cifs_strfromUCS_le(tcon->nativeFileSystem,
3155 (__le16 *) bcc_ptr,
3156 length, nls_codepage);
3157 bcc_ptr += 2 * length;
3158 bcc_ptr[0] = 0; /* null terminate the string */
3159 bcc_ptr[1] = 0;
3160 bcc_ptr += 2;
3161 }
3162 /* else do not bother copying these informational fields */
3163 } else {
3164 length = strnlen(bcc_ptr, 1024);
3165 if ((bcc_ptr + length) -
3166 pByteArea(smb_buffer_response) <=
3167 BCC(smb_buffer_response)) {
3168 kfree(tcon->nativeFileSystem);
3169 tcon->nativeFileSystem =
3170 kzalloc(length + 1, GFP_KERNEL);
3171 strncpy(tcon->nativeFileSystem, bcc_ptr,
3172 length);
3173 }
3174 /* else do not bother copying these informational fields */
3175 }
3176 if(smb_buffer_response->WordCount == 3)
3177 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3178 else
3179 tcon->Flags = 0;
3180 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3181 } else if ((rc == 0) && tcon == NULL) {
3182 /* all we need to save for IPC$ connection */
3183 ses->ipc_tid = smb_buffer_response->Tid;
3184 }
3185
3186 if (smb_buffer)
3187 cifs_buf_release(smb_buffer);
3188 return rc;
3189 }
3190
3191 int
3192 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3193 {
3194 int rc = 0;
3195 int xid;
3196 struct cifsSesInfo *ses = NULL;
3197 struct task_struct *cifsd_task;
3198
3199 xid = GetXid();
3200
3201 if (cifs_sb->tcon) {
3202 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3203 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3204 if (rc == -EBUSY) {
3205 FreeXid(xid);
3206 return 0;
3207 }
3208 tconInfoFree(cifs_sb->tcon);
3209 if ((ses) && (ses->server)) {
3210 /* save off task so we do not refer to ses later */
3211 cifsd_task = ses->server->tsk;
3212 cFYI(1, ("About to do SMBLogoff "));
3213 rc = CIFSSMBLogoff(xid, ses);
3214 if (rc == -EBUSY) {
3215 FreeXid(xid);
3216 return 0;
3217 } else if (rc == -ESHUTDOWN) {
3218 cFYI(1,("Waking up socket by sending it signal"));
3219 if(cifsd_task) {
3220 send_sig(SIGKILL,cifsd_task,1);
3221 wait_for_completion(&cifsd_complete);
3222 }
3223 rc = 0;
3224 } /* else - we have an smb session
3225 left on this socket do not kill cifsd */
3226 } else
3227 cFYI(1, ("No session or bad tcon"));
3228 }
3229
3230 cifs_sb->tcon = NULL;
3231 if (ses)
3232 schedule_timeout_interruptible(msecs_to_jiffies(500));
3233 if (ses)
3234 sesInfoFree(ses);
3235
3236 FreeXid(xid);
3237 return rc; /* BB check if we should always return zero here */
3238 }
3239
3240 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3241 struct nls_table * nls_info)
3242 {
3243 int rc = 0;
3244 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3245 int ntlmv2_flag = FALSE;
3246 int first_time = 0;
3247
3248 /* what if server changes its buffer size after dropping the session? */
3249 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3250 rc = CIFSSMBNegotiate(xid, pSesInfo);
3251 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3252 rc = CIFSSMBNegotiate(xid, pSesInfo);
3253 if(rc == -EAGAIN)
3254 rc = -EHOSTDOWN;
3255 }
3256 if(rc == 0) {
3257 spin_lock(&GlobalMid_Lock);
3258 if(pSesInfo->server->tcpStatus != CifsExiting)
3259 pSesInfo->server->tcpStatus = CifsGood;
3260 else
3261 rc = -EHOSTDOWN;
3262 spin_unlock(&GlobalMid_Lock);
3263
3264 }
3265 first_time = 1;
3266 }
3267 if (!rc) {
3268 pSesInfo->capabilities = pSesInfo->server->capabilities;
3269 if(linuxExtEnabled == 0)
3270 pSesInfo->capabilities &= (~CAP_UNIX);
3271 /* pSesInfo->sequence_number = 0;*/
3272 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x Time Zone: %d",
3273 pSesInfo->server->secMode,
3274 pSesInfo->server->capabilities,
3275 pSesInfo->server->timeZone));
3276 if(experimEnabled < 2)
3277 rc = CIFS_SessSetup(xid, pSesInfo,
3278 first_time, nls_info);
3279 else if (extended_security
3280 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3281 && (pSesInfo->server->secType == NTLMSSP)) {
3282 rc = -EOPNOTSUPP;
3283 } else if (extended_security
3284 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3285 && (pSesInfo->server->secType == RawNTLMSSP)) {
3286 cFYI(1, ("NTLMSSP sesssetup"));
3287 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3288 pSesInfo,
3289 &ntlmv2_flag,
3290 nls_info);
3291 if (!rc) {
3292 if(ntlmv2_flag) {
3293 char * v2_response;
3294 cFYI(1,("Can use more secure NTLM version 2 password hash"));
3295 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3296 nls_info)) {
3297 rc = -ENOMEM;
3298 goto ss_err_exit;
3299 } else
3300 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3301 if(v2_response) {
3302 CalcNTLMv2_response(pSesInfo,v2_response);
3303 /* if(first_time)
3304 cifs_calculate_ntlmv2_mac_key(
3305 pSesInfo->server->mac_signing_key,
3306 response, ntlm_session_key, */
3307 kfree(v2_response);
3308 /* BB Put dummy sig in SessSetup PDU? */
3309 } else {
3310 rc = -ENOMEM;
3311 goto ss_err_exit;
3312 }
3313
3314 } else {
3315 SMBNTencrypt(pSesInfo->password,
3316 pSesInfo->server->cryptKey,
3317 ntlm_session_key);
3318
3319 if(first_time)
3320 cifs_calculate_mac_key(
3321 pSesInfo->server->mac_signing_key,
3322 ntlm_session_key,
3323 pSesInfo->password);
3324 }
3325 /* for better security the weaker lanman hash not sent
3326 in AuthSessSetup so we no longer calculate it */
3327
3328 rc = CIFSNTLMSSPAuthSessSetup(xid,
3329 pSesInfo,
3330 ntlm_session_key,
3331 ntlmv2_flag,
3332 nls_info);
3333 }
3334 } else { /* old style NTLM 0.12 session setup */
3335 SMBNTencrypt(pSesInfo->password,
3336 pSesInfo->server->cryptKey,
3337 ntlm_session_key);
3338
3339 if(first_time)
3340 cifs_calculate_mac_key(
3341 pSesInfo->server->mac_signing_key,
3342 ntlm_session_key, pSesInfo->password);
3343
3344 rc = CIFSSessSetup(xid, pSesInfo,
3345 ntlm_session_key, nls_info);
3346 }
3347 if (rc) {
3348 cERROR(1,("Send error in SessSetup = %d",rc));
3349 } else {
3350 cFYI(1,("CIFS Session Established successfully"));
3351 pSesInfo->status = CifsGood;
3352 }
3353 }
3354 ss_err_exit:
3355 return rc;
3356 }
3357
Linux with added FPC-III support