?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Linux 2.6.21
[linux/fpc-iii.git] / fs / cifs / connect.c
blob20ba7dcc99599a20a3716bb7ddfd4b36d65454af
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2006
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/pagevec.h>
34 #include <linux/freezer.h>
35 #include <asm/uaccess.h>
36 #include <asm/processor.h>
37 #include "cifspdu.h"
38 #include "cifsglob.h"
39 #include "cifsproto.h"
40 #include "cifs_unicode.h"
41 #include "cifs_debug.h"
42 #include "cifs_fs_sb.h"
43 #include "ntlmssp.h"
44 #include "nterr.h"
45 #include "rfc1002pdu.h"
46 #include "cn_cifs.h"
47
48 #define CIFS_PORT 445
49 #define RFC1001_PORT 139
50
51 static DECLARE_COMPLETION(cifsd_complete);
52
53 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
54 unsigned char *p24);
55
56 extern mempool_t *cifs_req_poolp;
57
58 struct smb_vol {
59 char *username;
60 char *password;
61 char *domainname;
62 char *UNC;
63 char *UNCip;
64 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
65 char *iocharset; /* local code page for mapping to and from Unicode */
66 char source_rfc1001_name[16]; /* netbios name of client */
67 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
68 uid_t linux_uid;
69 gid_t linux_gid;
70 mode_t file_mode;
71 mode_t dir_mode;
72 unsigned secFlg;
73 unsigned rw:1;
74 unsigned retry:1;
75 unsigned intr:1;
76 unsigned setuids:1;
77 unsigned noperm:1;
78 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
79 unsigned cifs_acl:1;
80 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
81 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
82 unsigned direct_io:1;
83 unsigned remap:1; /* set to remap seven reserved chars in filenames */
84 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
85 unsigned sfu_emul:1;
86 unsigned nullauth:1; /* attempt to authenticate with null user */
87 unsigned nocase; /* request case insensitive filenames */
88 unsigned nobrl; /* disable sending byte range locks to srv */
89 unsigned int rsize;
90 unsigned int wsize;
91 unsigned int sockopt;
92 unsigned short int port;
93 char * prepath;
94 };
95
96 static int ipv4_connect(struct sockaddr_in *psin_server,
97 struct socket **csocket,
98 char * netb_name,
99 char * server_netb_name);
100 static int ipv6_connect(struct sockaddr_in6 *psin_server,
101 struct socket **csocket);
102
103
104 /*
105 * cifs tcp session reconnection
106 *
107 * mark tcp session as reconnecting so temporarily locked
108 * mark all smb sessions as reconnecting for tcp session
109 * reconnect tcp session
110 * wake up waiters on reconnection? - (not needed currently)
111 */
112
113 static int
114 cifs_reconnect(struct TCP_Server_Info *server)
115 {
116 int rc = 0;
117 struct list_head *tmp;
118 struct cifsSesInfo *ses;
119 struct cifsTconInfo *tcon;
120 struct mid_q_entry * mid_entry;
121
122 spin_lock(&GlobalMid_Lock);
123 if(server->tcpStatus == CifsExiting) {
124 /* the demux thread will exit normally
125 next time through the loop */
126 spin_unlock(&GlobalMid_Lock);
127 return rc;
128 } else
129 server->tcpStatus = CifsNeedReconnect;
130 spin_unlock(&GlobalMid_Lock);
131 server->maxBuf = 0;
132
133 cFYI(1, ("Reconnecting tcp session"));
134
135 /* before reconnecting the tcp session, mark the smb session (uid)
136 and the tid bad so they are not used until reconnected */
137 read_lock(&GlobalSMBSeslock);
138 list_for_each(tmp, &GlobalSMBSessionList) {
139 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
140 if (ses->server) {
141 if (ses->server == server) {
142 ses->status = CifsNeedReconnect;
143 ses->ipc_tid = 0;
144 }
145 }
146 /* else tcp and smb sessions need reconnection */
147 }
148 list_for_each(tmp, &GlobalTreeConnectionList) {
149 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
150 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
151 tcon->tidStatus = CifsNeedReconnect;
152 }
153 }
154 read_unlock(&GlobalSMBSeslock);
155 /* do not want to be sending data on a socket we are freeing */
156 down(&server->tcpSem);
157 if(server->ssocket) {
158 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
159 server->ssocket->flags));
160 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
161 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
162 server->ssocket->flags));
163 sock_release(server->ssocket);
164 server->ssocket = NULL;
165 }
166
167 spin_lock(&GlobalMid_Lock);
168 list_for_each(tmp, &server->pending_mid_q) {
169 mid_entry = list_entry(tmp, struct
170 mid_q_entry,
171 qhead);
172 if(mid_entry) {
173 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
174 /* Mark other intransit requests as needing
175 retry so we do not immediately mark the
176 session bad again (ie after we reconnect
177 below) as they timeout too */
178 mid_entry->midState = MID_RETRY_NEEDED;
179 }
180 }
181 }
182 spin_unlock(&GlobalMid_Lock);
183 up(&server->tcpSem);
184
185 while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
186 {
187 try_to_freeze();
188 if(server->protocolType == IPV6) {
189 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
190 } else {
191 rc = ipv4_connect(&server->addr.sockAddr,
192 &server->ssocket,
193 server->workstation_RFC1001_name,
194 server->server_RFC1001_name);
195 }
196 if(rc) {
197 cFYI(1,("reconnect error %d",rc));
198 msleep(3000);
199 } else {
200 atomic_inc(&tcpSesReconnectCount);
201 spin_lock(&GlobalMid_Lock);
202 if(server->tcpStatus != CifsExiting)
203 server->tcpStatus = CifsGood;
204 server->sequence_number = 0;
205 spin_unlock(&GlobalMid_Lock);
206 /* atomic_set(&server->inFlight,0);*/
207 wake_up(&server->response_q);
208 }
209 }
210 return rc;
211 }
212
213 /*
214 return codes:
215 0 not a transact2, or all data present
216 >0 transact2 with that much data missing
217 -EINVAL = invalid transact2
218
219 */
220 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
221 {
222 struct smb_t2_rsp * pSMBt;
223 int total_data_size;
224 int data_in_this_rsp;
225 int remaining;
226
227 if(pSMB->Command != SMB_COM_TRANSACTION2)
228 return 0;
229
230 /* check for plausible wct, bcc and t2 data and parm sizes */
231 /* check for parm and data offset going beyond end of smb */
232 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
233 cFYI(1,("invalid transact2 word count"));
234 return -EINVAL;
235 }
236
237 pSMBt = (struct smb_t2_rsp *)pSMB;
238
239 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
240 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
241
242 remaining = total_data_size - data_in_this_rsp;
243
244 if(remaining == 0)
245 return 0;
246 else if(remaining < 0) {
247 cFYI(1,("total data %d smaller than data in frame %d",
248 total_data_size, data_in_this_rsp));
249 return -EINVAL;
250 } else {
251 cFYI(1,("missing %d bytes from transact2, check next response",
252 remaining));
253 if(total_data_size > maxBufSize) {
254 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
255 total_data_size,maxBufSize));
256 return -EINVAL;
257 }
258 return remaining;
259 }
260 }
261
262 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
263 {
264 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
265 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
266 int total_data_size;
267 int total_in_buf;
268 int remaining;
269 int total_in_buf2;
270 char * data_area_of_target;
271 char * data_area_of_buf2;
272 __u16 byte_count;
273
274 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
275
276 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
277 cFYI(1,("total data sizes of primary and secondary t2 differ"));
278 }
279
280 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
281
282 remaining = total_data_size - total_in_buf;
283
284 if(remaining < 0)
285 return -EINVAL;
286
287 if(remaining == 0) /* nothing to do, ignore */
288 return 0;
289
290 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
291 if(remaining < total_in_buf2) {
292 cFYI(1,("transact2 2nd response contains too much data"));
293 }
294
295 /* find end of first SMB data area */
296 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
297 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
298 /* validate target area */
299
300 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
301 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
302
303 data_area_of_target += total_in_buf;
304
305 /* copy second buffer into end of first buffer */
306 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
307 total_in_buf += total_in_buf2;
308 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
309 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
310 byte_count += total_in_buf2;
311 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
312
313 byte_count = pTargetSMB->smb_buf_length;
314 byte_count += total_in_buf2;
315
316 /* BB also add check that we are not beyond maximum buffer size */
317
318 pTargetSMB->smb_buf_length = byte_count;
319
320 if(remaining == total_in_buf2) {
321 cFYI(1,("found the last secondary response"));
322 return 0; /* we are done */
323 } else /* more responses to go */
324 return 1;
325
326 }
327
328 static int
329 cifs_demultiplex_thread(struct TCP_Server_Info *server)
330 {
331 int length;
332 unsigned int pdu_length, total_read;
333 struct smb_hdr *smb_buffer = NULL;
334 struct smb_hdr *bigbuf = NULL;
335 struct smb_hdr *smallbuf = NULL;
336 struct msghdr smb_msg;
337 struct kvec iov;
338 struct socket *csocket = server->ssocket;
339 struct list_head *tmp;
340 struct cifsSesInfo *ses;
341 struct task_struct *task_to_wake = NULL;
342 struct mid_q_entry *mid_entry;
343 char temp;
344 int isLargeBuf = FALSE;
345 int isMultiRsp;
346 int reconnect;
347
348 daemonize("cifsd");
349 allow_signal(SIGKILL);
350 current->flags |= PF_MEMALLOC;
351 server->tsk = current; /* save process info to wake at shutdown */
352 cFYI(1, ("Demultiplex PID: %d", current->pid));
353 write_lock(&GlobalSMBSeslock);
354 atomic_inc(&tcpSesAllocCount);
355 length = tcpSesAllocCount.counter;
356 write_unlock(&GlobalSMBSeslock);
357 complete(&cifsd_complete);
358 if(length > 1) {
359 mempool_resize(cifs_req_poolp,
360 length + cifs_min_rcv,
361 GFP_KERNEL);
362 }
363
364 while (server->tcpStatus != CifsExiting) {
365 if (try_to_freeze())
366 continue;
367 if (bigbuf == NULL) {
368 bigbuf = cifs_buf_get();
369 if (!bigbuf) {
370 cERROR(1, ("No memory for large SMB response"));
371 msleep(3000);
372 /* retry will check if exiting */
373 continue;
374 }
375 } else if (isLargeBuf) {
376 /* we are reusing a dirty large buf, clear its start */
377 memset(bigbuf, 0, sizeof (struct smb_hdr));
378 }
379
380 if (smallbuf == NULL) {
381 smallbuf = cifs_small_buf_get();
382 if (!smallbuf) {
383 cERROR(1, ("No memory for SMB response"));
384 msleep(1000);
385 /* retry will check if exiting */
386 continue;
387 }
388 /* beginning of smb buffer is cleared in our buf_get */
389 } else /* if existing small buf clear beginning */
390 memset(smallbuf, 0, sizeof (struct smb_hdr));
391
392 isLargeBuf = FALSE;
393 isMultiRsp = FALSE;
394 smb_buffer = smallbuf;
395 iov.iov_base = smb_buffer;
396 iov.iov_len = 4;
397 smb_msg.msg_control = NULL;
398 smb_msg.msg_controllen = 0;
399 length =
400 kernel_recvmsg(csocket, &smb_msg,
401 &iov, 1, 4, 0 /* BB see socket.h flags */);
402
403 if (server->tcpStatus == CifsExiting) {
404 break;
405 } else if (server->tcpStatus == CifsNeedReconnect) {
406 cFYI(1, ("Reconnect after server stopped responding"));
407 cifs_reconnect(server);
408 cFYI(1, ("call to reconnect done"));
409 csocket = server->ssocket;
410 continue;
411 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
412 msleep(1); /* minimum sleep to prevent looping
413 allowing socket to clear and app threads to set
414 tcpStatus CifsNeedReconnect if server hung */
415 continue;
416 } else if (length <= 0) {
417 if (server->tcpStatus == CifsNew) {
418 cFYI(1, ("tcp session abend after SMBnegprot"));
419 /* some servers kill the TCP session rather than
420 returning an SMB negprot error, in which
421 case reconnecting here is not going to help,
422 and so simply return error to mount */
423 break;
424 }
425 if (!try_to_freeze() && (length == -EINTR)) {
426 cFYI(1,("cifsd thread killed"));
427 break;
428 }
429 cFYI(1,("Reconnect after unexpected peek error %d",
430 length));
431 cifs_reconnect(server);
432 csocket = server->ssocket;
433 wake_up(&server->response_q);
434 continue;
435 } else if (length < 4) {
436 cFYI(1,
437 ("Frame under four bytes received (%d bytes long)",
438 length));
439 cifs_reconnect(server);
440 csocket = server->ssocket;
441 wake_up(&server->response_q);
442 continue;
443 }
444
445 /* The right amount was read from socket - 4 bytes */
446 /* so we can now interpret the length field */
447
448 /* the first byte big endian of the length field,
449 is actually not part of the length but the type
450 with the most common, zero, as regular data */
451 temp = *((char *) smb_buffer);
452
453 /* Note that FC 1001 length is big endian on the wire,
454 but we convert it here so it is always manipulated
455 as host byte order */
456 pdu_length = ntohl(smb_buffer->smb_buf_length);
457 smb_buffer->smb_buf_length = pdu_length;
458
459 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
460
461 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
462 continue;
463 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
464 cFYI(1,("Good RFC 1002 session rsp"));
465 continue;
466 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
467 /* we get this from Windows 98 instead of
468 an error on SMB negprot response */
469 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
470 pdu_length));
471 if(server->tcpStatus == CifsNew) {
472 /* if nack on negprot (rather than
473 ret of smb negprot error) reconnecting
474 not going to help, ret error to mount */
475 break;
476 } else {
477 /* give server a second to
478 clean up before reconnect attempt */
479 msleep(1000);
480 /* always try 445 first on reconnect
481 since we get NACK on some if we ever
482 connected to port 139 (the NACK is
483 since we do not begin with RFC1001
484 session initialize frame) */
485 server->addr.sockAddr.sin_port =
486 htons(CIFS_PORT);
487 cifs_reconnect(server);
488 csocket = server->ssocket;
489 wake_up(&server->response_q);
490 continue;
491 }
492 } else if (temp != (char) 0) {
493 cERROR(1,("Unknown RFC 1002 frame"));
494 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
495 length);
496 cifs_reconnect(server);
497 csocket = server->ssocket;
498 continue;
499 }
500
501 /* else we have an SMB response */
502 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
503 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
504 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
505 length, pdu_length+4));
506 cifs_reconnect(server);
507 csocket = server->ssocket;
508 wake_up(&server->response_q);
509 continue;
510 }
511
512 /* else length ok */
513 reconnect = 0;
514
515 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
516 isLargeBuf = TRUE;
517 memcpy(bigbuf, smallbuf, 4);
518 smb_buffer = bigbuf;
519 }
520 length = 0;
521 iov.iov_base = 4 + (char *)smb_buffer;
522 iov.iov_len = pdu_length;
523 for (total_read = 0; total_read < pdu_length;
524 total_read += length) {
525 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
526 pdu_length - total_read, 0);
527 if((server->tcpStatus == CifsExiting) ||
528 (length == -EINTR)) {
529 /* then will exit */
530 reconnect = 2;
531 break;
532 } else if (server->tcpStatus == CifsNeedReconnect) {
533 cifs_reconnect(server);
534 csocket = server->ssocket;
535 /* Reconnect wakes up rspns q */
536 /* Now we will reread sock */
537 reconnect = 1;
538 break;
539 } else if ((length == -ERESTARTSYS) ||
540 (length == -EAGAIN)) {
541 msleep(1); /* minimum sleep to prevent looping,
542 allowing socket to clear and app
543 threads to set tcpStatus
544 CifsNeedReconnect if server hung*/
545 continue;
546 } else if (length <= 0) {
547 cERROR(1,("Received no data, expecting %d",
548 pdu_length - total_read));
549 cifs_reconnect(server);
550 csocket = server->ssocket;
551 reconnect = 1;
552 break;
553 }
554 }
555 if(reconnect == 2)
556 break;
557 else if(reconnect == 1)
558 continue;
559
560 length += 4; /* account for rfc1002 hdr */
561
562
563 dump_smb(smb_buffer, length);
564 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
565 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
566 continue;
567 }
568
569
570 task_to_wake = NULL;
571 spin_lock(&GlobalMid_Lock);
572 list_for_each(tmp, &server->pending_mid_q) {
573 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
574
575 if ((mid_entry->mid == smb_buffer->Mid) &&
576 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
577 (mid_entry->command == smb_buffer->Command)) {
578 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
579 /* We have a multipart transact2 resp */
580 isMultiRsp = TRUE;
581 if(mid_entry->resp_buf) {
582 /* merge response - fix up 1st*/
583 if(coalesce_t2(smb_buffer,
584 mid_entry->resp_buf)) {
585 mid_entry->multiRsp = 1;
586 break;
587 } else {
588 /* all parts received */
589 mid_entry->multiEnd = 1;
590 goto multi_t2_fnd;
591 }
592 } else {
593 if(!isLargeBuf) {
594 cERROR(1,("1st trans2 resp needs bigbuf"));
595 /* BB maybe we can fix this up, switch
596 to already allocated large buffer? */
597 } else {
598 /* Have first buffer */
599 mid_entry->resp_buf =
600 smb_buffer;
601 mid_entry->largeBuf = 1;
602 bigbuf = NULL;
603 }
604 }
605 break;
606 }
607 mid_entry->resp_buf = smb_buffer;
608 if(isLargeBuf)
609 mid_entry->largeBuf = 1;
610 else
611 mid_entry->largeBuf = 0;
612 multi_t2_fnd:
613 task_to_wake = mid_entry->tsk;
614 mid_entry->midState = MID_RESPONSE_RECEIVED;
615 #ifdef CONFIG_CIFS_STATS2
616 mid_entry->when_received = jiffies;
617 #endif
618 /* so we do not time out requests to server
619 which is still responding (since server could
620 be busy but not dead) */
621 server->lstrp = jiffies;
622 break;
623 }
624 }
625 spin_unlock(&GlobalMid_Lock);
626 if (task_to_wake) {
627 /* Was previous buf put in mpx struct for multi-rsp? */
628 if(!isMultiRsp) {
629 /* smb buffer will be freed by user thread */
630 if(isLargeBuf) {
631 bigbuf = NULL;
632 } else
633 smallbuf = NULL;
634 }
635 wake_up_process(task_to_wake);
636 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
637 && (isMultiRsp == FALSE)) {
638 cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
639 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
640 sizeof(struct smb_hdr));
641 #ifdef CONFIG_CIFS_DEBUG2
642 cifs_dump_detail(smb_buffer);
643 cifs_dump_mids(server);
644 #endif /* CIFS_DEBUG2 */
645
646 }
647 } /* end while !EXITING */
648
649 spin_lock(&GlobalMid_Lock);
650 server->tcpStatus = CifsExiting;
651 server->tsk = NULL;
652 /* check if we have blocked requests that need to free */
653 /* Note that cifs_max_pending is normally 50, but
654 can be set at module install time to as little as two */
655 if(atomic_read(&server->inFlight) >= cifs_max_pending)
656 atomic_set(&server->inFlight, cifs_max_pending - 1);
657 /* We do not want to set the max_pending too low or we
658 could end up with the counter going negative */
659 spin_unlock(&GlobalMid_Lock);
660 /* Although there should not be any requests blocked on
661 this queue it can not hurt to be paranoid and try to wake up requests
662 that may haven been blocked when more than 50 at time were on the wire
663 to the same server - they now will see the session is in exit state
664 and get out of SendReceive. */
665 wake_up_all(&server->request_q);
666 /* give those requests time to exit */
667 msleep(125);
668
669 if(server->ssocket) {
670 sock_release(csocket);
671 server->ssocket = NULL;
672 }
673 /* buffer usuallly freed in free_mid - need to free it here on exit */
674 if (bigbuf != NULL)
675 cifs_buf_release(bigbuf);
676 if (smallbuf != NULL)
677 cifs_small_buf_release(smallbuf);
678
679 read_lock(&GlobalSMBSeslock);
680 if (list_empty(&server->pending_mid_q)) {
681 /* loop through server session structures attached to this and
682 mark them dead */
683 list_for_each(tmp, &GlobalSMBSessionList) {
684 ses =
685 list_entry(tmp, struct cifsSesInfo,
686 cifsSessionList);
687 if (ses->server == server) {
688 ses->status = CifsExiting;
689 ses->server = NULL;
690 }
691 }
692 read_unlock(&GlobalSMBSeslock);
693 } else {
694 /* although we can not zero the server struct pointer yet,
695 since there are active requests which may depnd on them,
696 mark the corresponding SMB sessions as exiting too */
697 list_for_each(tmp, &GlobalSMBSessionList) {
698 ses = list_entry(tmp, struct cifsSesInfo,
699 cifsSessionList);
700 if (ses->server == server) {
701 ses->status = CifsExiting;
702 }
703 }
704
705 spin_lock(&GlobalMid_Lock);
706 list_for_each(tmp, &server->pending_mid_q) {
707 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
708 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
709 cFYI(1,
710 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
711 task_to_wake = mid_entry->tsk;
712 if(task_to_wake) {
713 wake_up_process(task_to_wake);
714 }
715 }
716 }
717 spin_unlock(&GlobalMid_Lock);
718 read_unlock(&GlobalSMBSeslock);
719 /* 1/8th of sec is more than enough time for them to exit */
720 msleep(125);
721 }
722
723 if (!list_empty(&server->pending_mid_q)) {
724 /* mpx threads have not exited yet give them
725 at least the smb send timeout time for long ops */
726 /* due to delays on oplock break requests, we need
727 to wait at least 45 seconds before giving up
728 on a request getting a response and going ahead
729 and killing cifsd */
730 cFYI(1, ("Wait for exit from demultiplex thread"));
731 msleep(46000);
732 /* if threads still have not exited they are probably never
733 coming home not much else we can do but free the memory */
734 }
735
736 write_lock(&GlobalSMBSeslock);
737 atomic_dec(&tcpSesAllocCount);
738 length = tcpSesAllocCount.counter;
739
740 /* last chance to mark ses pointers invalid
741 if there are any pointing to this (e.g
742 if a crazy root user tried to kill cifsd
743 kernel thread explicitly this might happen) */
744 list_for_each(tmp, &GlobalSMBSessionList) {
745 ses = list_entry(tmp, struct cifsSesInfo,
746 cifsSessionList);
747 if (ses->server == server) {
748 ses->server = NULL;
749 }
750 }
751 write_unlock(&GlobalSMBSeslock);
752
753 kfree(server);
754 if(length > 0) {
755 mempool_resize(cifs_req_poolp,
756 length + cifs_min_rcv,
757 GFP_KERNEL);
758 }
759
760 complete_and_exit(&cifsd_complete, 0);
761 return 0;
762 }
763
764 static int
765 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
766 {
767 char *value;
768 char *data;
769 unsigned int temp_len, i, j;
770 char separator[2];
771
772 separator[0] = ',';
773 separator[1] = 0;
774
775 if (Local_System_Name[0] != 0)
776 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
777 else {
778 char *nodename = utsname()->nodename;
779 int n = strnlen(nodename,15);
780 memset(vol->source_rfc1001_name,0x20,15);
781 for(i=0 ; i < n ; i++) {
782 /* does not have to be perfect mapping since field is
783 informational, only used for servers that do not support
784 port 445 and it can be overridden at mount time */
785 vol->source_rfc1001_name[i] = toupper(nodename[i]);
786 }
787 }
788 vol->source_rfc1001_name[15] = 0;
789 /* null target name indicates to use *SMBSERVR default called name
790 if we end up sending RFC1001 session initialize */
791 vol->target_rfc1001_name[0] = 0;
792 vol->linux_uid = current->uid; /* current->euid instead? */
793 vol->linux_gid = current->gid;
794 vol->dir_mode = S_IRWXUGO;
795 /* 2767 perms indicate mandatory locking support */
796 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
797
798 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
799 vol->rw = TRUE;
800 /* default is always to request posix paths. */
801 vol->posix_paths = 1;
802
803 if (!options)
804 return 1;
805
806 if(strncmp(options,"sep=",4) == 0) {
807 if(options[4] != 0) {
808 separator[0] = options[4];
809 options += 5;
810 } else {
811 cFYI(1,("Null separator not allowed"));
812 }
813 }
814
815 while ((data = strsep(&options, separator)) != NULL) {
816 if (!*data)
817 continue;
818 if ((value = strchr(data, '=')) != NULL)
819 *value++ = '\0';
820
821 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
822 vol->no_xattr = 0;
823 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
824 vol->no_xattr = 1;
825 } else if (strnicmp(data, "user", 4) == 0) {
826 if (!value) {
827 printk(KERN_WARNING
828 "CIFS: invalid or missing username\n");
829 return 1; /* needs_arg; */
830 } else if(!*value) {
831 /* null user, ie anonymous, authentication */
832 vol->nullauth = 1;
833 }
834 if (strnlen(value, 200) < 200) {
835 vol->username = value;
836 } else {
837 printk(KERN_WARNING "CIFS: username too long\n");
838 return 1;
839 }
840 } else if (strnicmp(data, "pass", 4) == 0) {
841 if (!value) {
842 vol->password = NULL;
843 continue;
844 } else if(value[0] == 0) {
845 /* check if string begins with double comma
846 since that would mean the password really
847 does start with a comma, and would not
848 indicate an empty string */
849 if(value[1] != separator[0]) {
850 vol->password = NULL;
851 continue;
852 }
853 }
854 temp_len = strlen(value);
855 /* removed password length check, NTLM passwords
856 can be arbitrarily long */
857
858 /* if comma in password, the string will be
859 prematurely null terminated. Commas in password are
860 specified across the cifs mount interface by a double
861 comma ie ,, and a comma used as in other cases ie ','
862 as a parameter delimiter/separator is single and due
863 to the strsep above is temporarily zeroed. */
864
865 /* NB: password legally can have multiple commas and
866 the only illegal character in a password is null */
867
868 if ((value[temp_len] == 0) &&
869 (value[temp_len+1] == separator[0])) {
870 /* reinsert comma */
871 value[temp_len] = separator[0];
872 temp_len+=2; /* move after the second comma */
873 while(value[temp_len] != 0) {
874 if (value[temp_len] == separator[0]) {
875 if (value[temp_len+1] ==
876 separator[0]) {
877 /* skip second comma */
878 temp_len++;
879 } else {
880 /* single comma indicating start
881 of next parm */
882 break;
883 }
884 }
885 temp_len++;
886 }
887 if(value[temp_len] == 0) {
888 options = NULL;
889 } else {
890 value[temp_len] = 0;
891 /* point option to start of next parm */
892 options = value + temp_len + 1;
893 }
894 /* go from value to value + temp_len condensing
895 double commas to singles. Note that this ends up
896 allocating a few bytes too many, which is ok */
897 vol->password = kzalloc(temp_len, GFP_KERNEL);
898 if(vol->password == NULL) {
899 printk("CIFS: no memory for pass\n");
900 return 1;
901 }
902 for(i=0,j=0;i<temp_len;i++,j++) {
903 vol->password[j] = value[i];
904 if(value[i] == separator[0]
905 && value[i+1] == separator[0]) {
906 /* skip second comma */
907 i++;
908 }
909 }
910 vol->password[j] = 0;
911 } else {
912 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
913 if(vol->password == NULL) {
914 printk("CIFS: no memory for pass\n");
915 return 1;
916 }
917 strcpy(vol->password, value);
918 }
919 } else if (strnicmp(data, "ip", 2) == 0) {
920 if (!value || !*value) {
921 vol->UNCip = NULL;
922 } else if (strnlen(value, 35) < 35) {
923 vol->UNCip = value;
924 } else {
925 printk(KERN_WARNING "CIFS: ip address too long\n");
926 return 1;
927 }
928 } else if (strnicmp(data, "sec", 3) == 0) {
929 if (!value || !*value) {
930 cERROR(1,("no security value specified"));
931 continue;
932 } else if (strnicmp(value, "krb5i", 5) == 0) {
933 vol->secFlg |= CIFSSEC_MAY_KRB5 |
934 CIFSSEC_MUST_SIGN;
935 } else if (strnicmp(value, "krb5p", 5) == 0) {
936 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
937 CIFSSEC_MAY_KRB5; */
938 cERROR(1,("Krb5 cifs privacy not supported"));
939 return 1;
940 } else if (strnicmp(value, "krb5", 4) == 0) {
941 vol->secFlg |= CIFSSEC_MAY_KRB5;
942 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
943 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
944 CIFSSEC_MUST_SIGN;
945 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
946 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
947 } else if (strnicmp(value, "ntlmi", 5) == 0) {
948 vol->secFlg |= CIFSSEC_MAY_NTLM |
949 CIFSSEC_MUST_SIGN;
950 } else if (strnicmp(value, "ntlm", 4) == 0) {
951 /* ntlm is default so can be turned off too */
952 vol->secFlg |= CIFSSEC_MAY_NTLM;
953 } else if (strnicmp(value, "nontlm", 6) == 0) {
954 /* BB is there a better way to do this? */
955 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
956 #ifdef CONFIG_CIFS_WEAK_PW_HASH
957 } else if (strnicmp(value, "lanman", 6) == 0) {
958 vol->secFlg |= CIFSSEC_MAY_LANMAN;
959 #endif
960 } else if (strnicmp(value, "none", 4) == 0) {
961 vol->nullauth = 1;
962 } else {
963 cERROR(1,("bad security option: %s", value));
964 return 1;
965 }
966 } else if ((strnicmp(data, "unc", 3) == 0)
967 || (strnicmp(data, "target", 6) == 0)
968 || (strnicmp(data, "path", 4) == 0)) {
969 if (!value || !*value) {
970 printk(KERN_WARNING
971 "CIFS: invalid path to network resource\n");
972 return 1; /* needs_arg; */
973 }
974 if ((temp_len = strnlen(value, 300)) < 300) {
975 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
976 if(vol->UNC == NULL)
977 return 1;
978 strcpy(vol->UNC,value);
979 if (strncmp(vol->UNC, "//", 2) == 0) {
980 vol->UNC[0] = '\\';
981 vol->UNC[1] = '\\';
982 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
983 printk(KERN_WARNING
984 "CIFS: UNC Path does not begin with // or \\\\ \n");
985 return 1;
986 }
987 } else {
988 printk(KERN_WARNING "CIFS: UNC name too long\n");
989 return 1;
990 }
991 } else if ((strnicmp(data, "domain", 3) == 0)
992 || (strnicmp(data, "workgroup", 5) == 0)) {
993 if (!value || !*value) {
994 printk(KERN_WARNING "CIFS: invalid domain name\n");
995 return 1; /* needs_arg; */
996 }
997 /* BB are there cases in which a comma can be valid in
998 a domain name and need special handling? */
999 if (strnlen(value, 256) < 256) {
1000 vol->domainname = value;
1001 cFYI(1, ("Domain name set"));
1002 } else {
1003 printk(KERN_WARNING "CIFS: domain name too long\n");
1004 return 1;
1005 }
1006 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1007 if (!value || !*value) {
1008 printk(KERN_WARNING
1009 "CIFS: invalid path prefix\n");
1010 return 1; /* needs_arg; */
1011 }
1012 if ((temp_len = strnlen(value, 1024)) < 1024) {
1013 if(value[0] != '/')
1014 temp_len++; /* missing leading slash */
1015 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1016 if(vol->prepath == NULL)
1017 return 1;
1018 if(value[0] != '/') {
1019 vol->prepath[0] = '/';
1020 strcpy(vol->prepath+1,value);
1021 } else
1022 strcpy(vol->prepath,value);
1023 cFYI(1,("prefix path %s",vol->prepath));
1024 } else {
1025 printk(KERN_WARNING "CIFS: prefix too long\n");
1026 return 1;
1027 }
1028 } else if (strnicmp(data, "iocharset", 9) == 0) {
1029 if (!value || !*value) {
1030 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1031 return 1; /* needs_arg; */
1032 }
1033 if (strnlen(value, 65) < 65) {
1034 if(strnicmp(value,"default",7))
1035 vol->iocharset = value;
1036 /* if iocharset not set load_nls_default used by caller */
1037 cFYI(1, ("iocharset set to %s",value));
1038 } else {
1039 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1040 return 1;
1041 }
1042 } else if (strnicmp(data, "uid", 3) == 0) {
1043 if (value && *value) {
1044 vol->linux_uid =
1045 simple_strtoul(value, &value, 0);
1046 }
1047 } else if (strnicmp(data, "gid", 3) == 0) {
1048 if (value && *value) {
1049 vol->linux_gid =
1050 simple_strtoul(value, &value, 0);
1051 }
1052 } else if (strnicmp(data, "file_mode", 4) == 0) {
1053 if (value && *value) {
1054 vol->file_mode =
1055 simple_strtoul(value, &value, 0);
1056 }
1057 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1058 if (value && *value) {
1059 vol->dir_mode =
1060 simple_strtoul(value, &value, 0);
1061 }
1062 } else if (strnicmp(data, "dirmode", 4) == 0) {
1063 if (value && *value) {
1064 vol->dir_mode =
1065 simple_strtoul(value, &value, 0);
1066 }
1067 } else if (strnicmp(data, "port", 4) == 0) {
1068 if (value && *value) {
1069 vol->port =
1070 simple_strtoul(value, &value, 0);
1071 }
1072 } else if (strnicmp(data, "rsize", 5) == 0) {
1073 if (value && *value) {
1074 vol->rsize =
1075 simple_strtoul(value, &value, 0);
1076 }
1077 } else if (strnicmp(data, "wsize", 5) == 0) {
1078 if (value && *value) {
1079 vol->wsize =
1080 simple_strtoul(value, &value, 0);
1081 }
1082 } else if (strnicmp(data, "sockopt", 5) == 0) {
1083 if (value && *value) {
1084 vol->sockopt =
1085 simple_strtoul(value, &value, 0);
1086 }
1087 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1088 if (!value || !*value || (*value == ' ')) {
1089 cFYI(1,("invalid (empty) netbiosname specified"));
1090 } else {
1091 memset(vol->source_rfc1001_name,0x20,15);
1092 for(i=0;i<15;i++) {
1093 /* BB are there cases in which a comma can be
1094 valid in this workstation netbios name (and need
1095 special handling)? */
1096
1097 /* We do not uppercase netbiosname for user */
1098 if (value[i]==0)
1099 break;
1100 else
1101 vol->source_rfc1001_name[i] = value[i];
1102 }
1103 /* The string has 16th byte zero still from
1104 set at top of the function */
1105 if((i==15) && (value[i] != 0))
1106 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1107 }
1108 } else if (strnicmp(data, "servern", 7) == 0) {
1109 /* servernetbiosname specified override *SMBSERVER */
1110 if (!value || !*value || (*value == ' ')) {
1111 cFYI(1,("empty server netbiosname specified"));
1112 } else {
1113 /* last byte, type, is 0x20 for servr type */
1114 memset(vol->target_rfc1001_name,0x20,16);
1115
1116 for(i=0;i<15;i++) {
1117 /* BB are there cases in which a comma can be
1118 valid in this workstation netbios name (and need
1119 special handling)? */
1120
1121 /* user or mount helper must uppercase netbiosname */
1122 if (value[i]==0)
1123 break;
1124 else
1125 vol->target_rfc1001_name[i] = value[i];
1126 }
1127 /* The string has 16th byte zero still from
1128 set at top of the function */
1129 if((i==15) && (value[i] != 0))
1130 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1131 }
1132 } else if (strnicmp(data, "credentials", 4) == 0) {
1133 /* ignore */
1134 } else if (strnicmp(data, "version", 3) == 0) {
1135 /* ignore */
1136 } else if (strnicmp(data, "guest",5) == 0) {
1137 /* ignore */
1138 } else if (strnicmp(data, "rw", 2) == 0) {
1139 vol->rw = TRUE;
1140 } else if ((strnicmp(data, "suid", 4) == 0) ||
1141 (strnicmp(data, "nosuid", 6) == 0) ||
1142 (strnicmp(data, "exec", 4) == 0) ||
1143 (strnicmp(data, "noexec", 6) == 0) ||
1144 (strnicmp(data, "nodev", 5) == 0) ||
1145 (strnicmp(data, "noauto", 6) == 0) ||
1146 (strnicmp(data, "dev", 3) == 0)) {
1147 /* The mount tool or mount.cifs helper (if present)
1148 uses these opts to set flags, and the flags are read
1149 by the kernel vfs layer before we get here (ie
1150 before read super) so there is no point trying to
1151 parse these options again and set anything and it
1152 is ok to just ignore them */
1153 continue;
1154 } else if (strnicmp(data, "ro", 2) == 0) {
1155 vol->rw = FALSE;
1156 } else if (strnicmp(data, "hard", 4) == 0) {
1157 vol->retry = 1;
1158 } else if (strnicmp(data, "soft", 4) == 0) {
1159 vol->retry = 0;
1160 } else if (strnicmp(data, "perm", 4) == 0) {
1161 vol->noperm = 0;
1162 } else if (strnicmp(data, "noperm", 6) == 0) {
1163 vol->noperm = 1;
1164 } else if (strnicmp(data, "mapchars", 8) == 0) {
1165 vol->remap = 1;
1166 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1167 vol->remap = 0;
1168 } else if (strnicmp(data, "sfu", 3) == 0) {
1169 vol->sfu_emul = 1;
1170 } else if (strnicmp(data, "nosfu", 5) == 0) {
1171 vol->sfu_emul = 0;
1172 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1173 vol->posix_paths = 1;
1174 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1175 vol->posix_paths = 0;
1176 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1177 (strnicmp(data, "ignorecase", 10) == 0)) {
1178 vol->nocase = 1;
1179 } else if (strnicmp(data, "brl", 3) == 0) {
1180 vol->nobrl = 0;
1181 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1182 (strnicmp(data, "nolock", 6) == 0)) {
1183 vol->nobrl = 1;
1184 /* turn off mandatory locking in mode
1185 if remote locking is turned off since the
1186 local vfs will do advisory */
1187 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1188 vol->file_mode = S_IALLUGO;
1189 } else if (strnicmp(data, "setuids", 7) == 0) {
1190 vol->setuids = 1;
1191 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1192 vol->setuids = 0;
1193 } else if (strnicmp(data, "nohard", 6) == 0) {
1194 vol->retry = 0;
1195 } else if (strnicmp(data, "nosoft", 6) == 0) {
1196 vol->retry = 1;
1197 } else if (strnicmp(data, "nointr", 6) == 0) {
1198 vol->intr = 0;
1199 } else if (strnicmp(data, "intr", 4) == 0) {
1200 vol->intr = 1;
1201 } else if (strnicmp(data, "serverino",7) == 0) {
1202 vol->server_ino = 1;
1203 } else if (strnicmp(data, "noserverino",9) == 0) {
1204 vol->server_ino = 0;
1205 } else if (strnicmp(data, "cifsacl",7) == 0) {
1206 vol->cifs_acl = 1;
1207 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1208 vol->cifs_acl = 0;
1209 } else if (strnicmp(data, "acl",3) == 0) {
1210 vol->no_psx_acl = 0;
1211 } else if (strnicmp(data, "noacl",5) == 0) {
1212 vol->no_psx_acl = 1;
1213 } else if (strnicmp(data, "sign",4) == 0) {
1214 vol->secFlg |= CIFSSEC_MUST_SIGN;
1215 /* } else if (strnicmp(data, "seal",4) == 0) {
1216 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1217 } else if (strnicmp(data, "direct",6) == 0) {
1218 vol->direct_io = 1;
1219 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1220 vol->direct_io = 1;
1221 } else if (strnicmp(data, "in6_addr",8) == 0) {
1222 if (!value || !*value) {
1223 vol->in6_addr = NULL;
1224 } else if (strnlen(value, 49) == 48) {
1225 vol->in6_addr = value;
1226 } else {
1227 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1228 return 1;
1229 }
1230 } else if (strnicmp(data, "noac", 4) == 0) {
1231 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1232 } else
1233 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1234 }
1235 if (vol->UNC == NULL) {
1236 if(devname == NULL) {
1237 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1238 return 1;
1239 }
1240 if ((temp_len = strnlen(devname, 300)) < 300) {
1241 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1242 if(vol->UNC == NULL)
1243 return 1;
1244 strcpy(vol->UNC,devname);
1245 if (strncmp(vol->UNC, "//", 2) == 0) {
1246 vol->UNC[0] = '\\';
1247 vol->UNC[1] = '\\';
1248 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1249 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1250 return 1;
1251 }
1252 } else {
1253 printk(KERN_WARNING "CIFS: UNC name too long\n");
1254 return 1;
1255 }
1256 }
1257 if(vol->UNCip == NULL)
1258 vol->UNCip = &vol->UNC[2];
1259
1260 return 0;
1261 }
1262
1263 static struct cifsSesInfo *
1264 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1265 struct in6_addr *target_ip6_addr,
1266 char *userName, struct TCP_Server_Info **psrvTcp)
1267 {
1268 struct list_head *tmp;
1269 struct cifsSesInfo *ses;
1270 *psrvTcp = NULL;
1271 read_lock(&GlobalSMBSeslock);
1272
1273 list_for_each(tmp, &GlobalSMBSessionList) {
1274 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1275 if (ses->server) {
1276 if((target_ip_addr &&
1277 (ses->server->addr.sockAddr.sin_addr.s_addr
1278 == target_ip_addr->s_addr)) || (target_ip6_addr
1279 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1280 target_ip6_addr,sizeof(*target_ip6_addr)))){
1281 /* BB lock server and tcp session and increment use count here?? */
1282 *psrvTcp = ses->server; /* found a match on the TCP session */
1283 /* BB check if reconnection needed */
1284 if (strncmp
1285 (ses->userName, userName,
1286 MAX_USERNAME_SIZE) == 0){
1287 read_unlock(&GlobalSMBSeslock);
1288 return ses; /* found exact match on both tcp and SMB sessions */
1289 }
1290 }
1291 }
1292 /* else tcp and smb sessions need reconnection */
1293 }
1294 read_unlock(&GlobalSMBSeslock);
1295 return NULL;
1296 }
1297
1298 static struct cifsTconInfo *
1299 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1300 {
1301 struct list_head *tmp;
1302 struct cifsTconInfo *tcon;
1303
1304 read_lock(&GlobalSMBSeslock);
1305 list_for_each(tmp, &GlobalTreeConnectionList) {
1306 cFYI(1, ("Next tcon"));
1307 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1308 if (tcon->ses) {
1309 if (tcon->ses->server) {
1310 cFYI(1,
1311 ("old ip addr: %x == new ip %x ?",
1312 tcon->ses->server->addr.sockAddr.sin_addr.
1313 s_addr, new_target_ip_addr));
1314 if (tcon->ses->server->addr.sockAddr.sin_addr.
1315 s_addr == new_target_ip_addr) {
1316 /* BB lock tcon, server and tcp session and increment use count here? */
1317 /* found a match on the TCP session */
1318 /* BB check if reconnection needed */
1319 cFYI(1,("IP match, old UNC: %s new: %s",
1320 tcon->treeName, uncName));
1321 if (strncmp
1322 (tcon->treeName, uncName,
1323 MAX_TREE_SIZE) == 0) {
1324 cFYI(1,
1325 ("and old usr: %s new: %s",
1326 tcon->treeName, uncName));
1327 if (strncmp
1328 (tcon->ses->userName,
1329 userName,
1330 MAX_USERNAME_SIZE) == 0) {
1331 read_unlock(&GlobalSMBSeslock);
1332 /* matched smb session
1333 (user name */
1334 return tcon;
1335 }
1336 }
1337 }
1338 }
1339 }
1340 }
1341 read_unlock(&GlobalSMBSeslock);
1342 return NULL;
1343 }
1344
1345 int
1346 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1347 const char *old_path, const struct nls_table *nls_codepage,
1348 int remap)
1349 {
1350 unsigned char *referrals = NULL;
1351 unsigned int num_referrals;
1352 int rc = 0;
1353
1354 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1355 &num_referrals, &referrals, remap);
1356
1357 /* BB Add in code to: if valid refrl, if not ip address contact
1358 the helper that resolves tcp names, mount to it, try to
1359 tcon to it unmount it if fail */
1360
1361 kfree(referrals);
1362
1363 return rc;
1364 }
1365
1366 int
1367 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1368 const char *old_path, const struct nls_table *nls_codepage,
1369 unsigned int *pnum_referrals,
1370 unsigned char ** preferrals, int remap)
1371 {
1372 char *temp_unc;
1373 int rc = 0;
1374
1375 *pnum_referrals = 0;
1376
1377 if (pSesInfo->ipc_tid == 0) {
1378 temp_unc = kmalloc(2 /* for slashes */ +
1379 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1380 + 1 + 4 /* slash IPC$ */ + 2,
1381 GFP_KERNEL);
1382 if (temp_unc == NULL)
1383 return -ENOMEM;
1384 temp_unc[0] = '\\';
1385 temp_unc[1] = '\\';
1386 strcpy(temp_unc + 2, pSesInfo->serverName);
1387 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1388 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1389 cFYI(1,
1390 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1391 kfree(temp_unc);
1392 }
1393 if (rc == 0)
1394 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1395 pnum_referrals, nls_codepage, remap);
1396
1397 return rc;
1398 }
1399
1400 /* See RFC1001 section 14 on representation of Netbios names */
1401 static void rfc1002mangle(char * target,char * source, unsigned int length)
1402 {
1403 unsigned int i,j;
1404
1405 for(i=0,j=0;i<(length);i++) {
1406 /* mask a nibble at a time and encode */
1407 target[j] = 'A' + (0x0F & (source[i] >> 4));
1408 target[j+1] = 'A' + (0x0F & source[i]);
1409 j+=2;
1410 }
1411
1412 }
1413
1414
1415 static int
1416 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1417 char * netbios_name, char * target_name)
1418 {
1419 int rc = 0;
1420 int connected = 0;
1421 __be16 orig_port = 0;
1422
1423 if(*csocket == NULL) {
1424 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1425 if (rc < 0) {
1426 cERROR(1, ("Error %d creating socket",rc));
1427 *csocket = NULL;
1428 return rc;
1429 } else {
1430 /* BB other socket options to set KEEPALIVE, NODELAY? */
1431 cFYI(1,("Socket created"));
1432 (*csocket)->sk->sk_allocation = GFP_NOFS;
1433 }
1434 }
1435
1436 psin_server->sin_family = AF_INET;
1437 if(psin_server->sin_port) { /* user overrode default port */
1438 rc = (*csocket)->ops->connect(*csocket,
1439 (struct sockaddr *) psin_server,
1440 sizeof (struct sockaddr_in),0);
1441 if (rc >= 0)
1442 connected = 1;
1443 }
1444
1445 if(!connected) {
1446 /* save original port so we can retry user specified port
1447 later if fall back ports fail this time */
1448 orig_port = psin_server->sin_port;
1449
1450 /* do not retry on the same port we just failed on */
1451 if(psin_server->sin_port != htons(CIFS_PORT)) {
1452 psin_server->sin_port = htons(CIFS_PORT);
1453
1454 rc = (*csocket)->ops->connect(*csocket,
1455 (struct sockaddr *) psin_server,
1456 sizeof (struct sockaddr_in),0);
1457 if (rc >= 0)
1458 connected = 1;
1459 }
1460 }
1461 if (!connected) {
1462 psin_server->sin_port = htons(RFC1001_PORT);
1463 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1464 psin_server, sizeof (struct sockaddr_in),0);
1465 if (rc >= 0)
1466 connected = 1;
1467 }
1468
1469 /* give up here - unless we want to retry on different
1470 protocol families some day */
1471 if (!connected) {
1472 if(orig_port)
1473 psin_server->sin_port = orig_port;
1474 cFYI(1,("Error %d connecting to server via ipv4",rc));
1475 sock_release(*csocket);
1476 *csocket = NULL;
1477 return rc;
1478 }
1479 /* Eventually check for other socket options to change from
1480 the default. sock_setsockopt not used because it expects
1481 user space buffer */
1482 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1483 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1484 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1485 /* make the bufsizes depend on wsize/rsize and max requests */
1486 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1487 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1488 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1489 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1490
1491 /* send RFC1001 sessinit */
1492 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1493 /* some servers require RFC1001 sessinit before sending
1494 negprot - BB check reconnection in case where second
1495 sessinit is sent but no second negprot */
1496 struct rfc1002_session_packet * ses_init_buf;
1497 struct smb_hdr * smb_buf;
1498 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1499 if(ses_init_buf) {
1500 ses_init_buf->trailer.session_req.called_len = 32;
1501 if(target_name && (target_name[0] != 0)) {
1502 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1503 target_name, 16);
1504 } else {
1505 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1506 DEFAULT_CIFS_CALLED_NAME,16);
1507 }
1508
1509 ses_init_buf->trailer.session_req.calling_len = 32;
1510 /* calling name ends in null (byte 16) from old smb
1511 convention. */
1512 if(netbios_name && (netbios_name[0] !=0)) {
1513 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1514 netbios_name,16);
1515 } else {
1516 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1517 "LINUX_CIFS_CLNT",16);
1518 }
1519 ses_init_buf->trailer.session_req.scope1 = 0;
1520 ses_init_buf->trailer.session_req.scope2 = 0;
1521 smb_buf = (struct smb_hdr *)ses_init_buf;
1522 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1523 smb_buf->smb_buf_length = 0x81000044;
1524 rc = smb_send(*csocket, smb_buf, 0x44,
1525 (struct sockaddr *)psin_server);
1526 kfree(ses_init_buf);
1527 msleep(1); /* RFC1001 layer in at least one server
1528 requires very short break before negprot
1529 presumably because not expecting negprot
1530 to follow so fast. This is a simple
1531 solution that works without
1532 complicating the code and causes no
1533 significant slowing down on mount
1534 for everyone else */
1535 }
1536 /* else the negprot may still work without this
1537 even though malloc failed */
1538
1539 }
1540
1541 return rc;
1542 }
1543
1544 static int
1545 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1546 {
1547 int rc = 0;
1548 int connected = 0;
1549 __be16 orig_port = 0;
1550
1551 if(*csocket == NULL) {
1552 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1553 if (rc < 0) {
1554 cERROR(1, ("Error %d creating ipv6 socket",rc));
1555 *csocket = NULL;
1556 return rc;
1557 } else {
1558 /* BB other socket options to set KEEPALIVE, NODELAY? */
1559 cFYI(1,("ipv6 Socket created"));
1560 (*csocket)->sk->sk_allocation = GFP_NOFS;
1561 }
1562 }
1563
1564 psin_server->sin6_family = AF_INET6;
1565
1566 if(psin_server->sin6_port) { /* user overrode default port */
1567 rc = (*csocket)->ops->connect(*csocket,
1568 (struct sockaddr *) psin_server,
1569 sizeof (struct sockaddr_in6),0);
1570 if (rc >= 0)
1571 connected = 1;
1572 }
1573
1574 if(!connected) {
1575 /* save original port so we can retry user specified port
1576 later if fall back ports fail this time */
1577
1578 orig_port = psin_server->sin6_port;
1579 /* do not retry on the same port we just failed on */
1580 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1581 psin_server->sin6_port = htons(CIFS_PORT);
1582
1583 rc = (*csocket)->ops->connect(*csocket,
1584 (struct sockaddr *) psin_server,
1585 sizeof (struct sockaddr_in6),0);
1586 if (rc >= 0)
1587 connected = 1;
1588 }
1589 }
1590 if (!connected) {
1591 psin_server->sin6_port = htons(RFC1001_PORT);
1592 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1593 psin_server, sizeof (struct sockaddr_in6),0);
1594 if (rc >= 0)
1595 connected = 1;
1596 }
1597
1598 /* give up here - unless we want to retry on different
1599 protocol families some day */
1600 if (!connected) {
1601 if(orig_port)
1602 psin_server->sin6_port = orig_port;
1603 cFYI(1,("Error %d connecting to server via ipv6",rc));
1604 sock_release(*csocket);
1605 *csocket = NULL;
1606 return rc;
1607 }
1608 /* Eventually check for other socket options to change from
1609 the default. sock_setsockopt not used because it expects
1610 user space buffer */
1611 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1612
1613 return rc;
1614 }
1615
1616 void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1617 struct super_block * sb, struct smb_vol * vol_info)
1618 {
1619 /* if we are reconnecting then should we check to see if
1620 * any requested capabilities changed locally e.g. via
1621 * remount but we can not do much about it here
1622 * if they have (even if we could detect it by the following)
1623 * Perhaps we could add a backpointer to array of sb from tcon
1624 * or if we change to make all sb to same share the same
1625 * sb as NFS - then we only have one backpointer to sb.
1626 * What if we wanted to mount the server share twice once with
1627 * and once without posixacls or posix paths? */
1628 __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1629
1630
1631 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1632 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1633
1634 /* check for reconnect case in which we do not
1635 want to change the mount behavior if we can avoid it */
1636 if(vol_info == NULL) {
1637 /* turn off POSIX ACL and PATHNAMES if not set
1638 originally at mount time */
1639 if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1640 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1641 if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1642 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1643
1644
1645
1646
1647 }
1648
1649 cap &= CIFS_UNIX_CAP_MASK;
1650 if(vol_info && vol_info->no_psx_acl)
1651 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1652 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1653 cFYI(1,("negotiated posix acl support"));
1654 if(sb)
1655 sb->s_flags |= MS_POSIXACL;
1656 }
1657
1658 if(vol_info && vol_info->posix_paths == 0)
1659 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1660 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1661 cFYI(1,("negotiate posix pathnames"));
1662 if(sb)
1663 CIFS_SB(sb)->mnt_cifs_flags |=
1664 CIFS_MOUNT_POSIX_PATHS;
1665 }
1666
1667 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1668 #ifdef CONFIG_CIFS_DEBUG2
1669 if(cap & CIFS_UNIX_FCNTL_CAP)
1670 cFYI(1,("FCNTL cap"));
1671 if(cap & CIFS_UNIX_EXTATTR_CAP)
1672 cFYI(1,("EXTATTR cap"));
1673 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1674 cFYI(1,("POSIX path cap"));
1675 if(cap & CIFS_UNIX_XATTR_CAP)
1676 cFYI(1,("XATTR cap"));
1677 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1678 cFYI(1,("POSIX ACL cap"));
1679 #endif /* CIFS_DEBUG2 */
1680 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1681 cFYI(1,("setting capabilities failed"));
1682 }
1683 }
1684 }
1685
1686 int
1687 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1688 char *mount_data, const char *devname)
1689 {
1690 int rc = 0;
1691 int xid;
1692 int address_type = AF_INET;
1693 struct socket *csocket = NULL;
1694 struct sockaddr_in sin_server;
1695 struct sockaddr_in6 sin_server6;
1696 struct smb_vol volume_info;
1697 struct cifsSesInfo *pSesInfo = NULL;
1698 struct cifsSesInfo *existingCifsSes = NULL;
1699 struct cifsTconInfo *tcon = NULL;
1700 struct TCP_Server_Info *srvTcp = NULL;
1701
1702 xid = GetXid();
1703
1704 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1705
1706 memset(&volume_info,0,sizeof(struct smb_vol));
1707 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1708 kfree(volume_info.UNC);
1709 kfree(volume_info.password);
1710 kfree(volume_info.prepath);
1711 FreeXid(xid);
1712 return -EINVAL;
1713 }
1714
1715 if (volume_info.username) {
1716 /* BB fixme parse for domain name here */
1717 cFYI(1, ("Username: %s ", volume_info.username));
1718
1719 } else if (volume_info.nullauth) {
1720 cFYI(1,("null user"));
1721 } else {
1722 cifserror("No username specified");
1723 /* In userspace mount helper we can get user name from alternate
1724 locations such as env variables and files on disk */
1725 kfree(volume_info.UNC);
1726 kfree(volume_info.password);
1727 kfree(volume_info.prepath);
1728 FreeXid(xid);
1729 return -EINVAL;
1730 }
1731
1732 if (volume_info.UNCip && volume_info.UNC) {
1733 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1734
1735 if(rc <= 0) {
1736 /* not ipv4 address, try ipv6 */
1737 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1738 if(rc > 0)
1739 address_type = AF_INET6;
1740 } else {
1741 address_type = AF_INET;
1742 }
1743
1744 if(rc <= 0) {
1745 /* we failed translating address */
1746 kfree(volume_info.UNC);
1747 kfree(volume_info.password);
1748 kfree(volume_info.prepath);
1749 FreeXid(xid);
1750 return -EINVAL;
1751 }
1752
1753 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1754 /* success */
1755 rc = 0;
1756 } else if (volume_info.UNCip){
1757 /* BB using ip addr as server name connect to the DFS root below */
1758 cERROR(1,("Connecting to DFS root not implemented yet"));
1759 kfree(volume_info.UNC);
1760 kfree(volume_info.password);
1761 kfree(volume_info.prepath);
1762 FreeXid(xid);
1763 return -EINVAL;
1764 } else /* which servers DFS root would we conect to */ {
1765 cERROR(1,
1766 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1767 kfree(volume_info.UNC);
1768 kfree(volume_info.password);
1769 kfree(volume_info.prepath);
1770 FreeXid(xid);
1771 return -EINVAL;
1772 }
1773
1774 /* this is needed for ASCII cp to Unicode converts */
1775 if(volume_info.iocharset == NULL) {
1776 cifs_sb->local_nls = load_nls_default();
1777 /* load_nls_default can not return null */
1778 } else {
1779 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1780 if(cifs_sb->local_nls == NULL) {
1781 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1782 kfree(volume_info.UNC);
1783 kfree(volume_info.password);
1784 kfree(volume_info.prepath);
1785 FreeXid(xid);
1786 return -ELIBACC;
1787 }
1788 }
1789
1790 if(address_type == AF_INET)
1791 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1792 NULL /* no ipv6 addr */,
1793 volume_info.username, &srvTcp);
1794 else if(address_type == AF_INET6)
1795 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1796 &sin_server6.sin6_addr,
1797 volume_info.username, &srvTcp);
1798 else {
1799 kfree(volume_info.UNC);
1800 kfree(volume_info.password);
1801 kfree(volume_info.prepath);
1802 FreeXid(xid);
1803 return -EINVAL;
1804 }
1805
1806
1807 if (srvTcp) {
1808 cFYI(1, ("Existing tcp session with server found"));
1809 } else { /* create socket */
1810 if(volume_info.port)
1811 sin_server.sin_port = htons(volume_info.port);
1812 else
1813 sin_server.sin_port = 0;
1814 rc = ipv4_connect(&sin_server,&csocket,
1815 volume_info.source_rfc1001_name,
1816 volume_info.target_rfc1001_name);
1817 if (rc < 0) {
1818 cERROR(1,
1819 ("Error connecting to IPv4 socket. Aborting operation"));
1820 if(csocket != NULL)
1821 sock_release(csocket);
1822 kfree(volume_info.UNC);
1823 kfree(volume_info.password);
1824 kfree(volume_info.prepath);
1825 FreeXid(xid);
1826 return rc;
1827 }
1828
1829 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1830 if (srvTcp == NULL) {
1831 rc = -ENOMEM;
1832 sock_release(csocket);
1833 kfree(volume_info.UNC);
1834 kfree(volume_info.password);
1835 kfree(volume_info.prepath);
1836 FreeXid(xid);
1837 return rc;
1838 } else {
1839 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1840 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1841 atomic_set(&srvTcp->inFlight,0);
1842 /* BB Add code for ipv6 case too */
1843 srvTcp->ssocket = csocket;
1844 srvTcp->protocolType = IPV4;
1845 init_waitqueue_head(&srvTcp->response_q);
1846 init_waitqueue_head(&srvTcp->request_q);
1847 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1848 /* at this point we are the only ones with the pointer
1849 to the struct since the kernel thread not created yet
1850 so no need to spinlock this init of tcpStatus */
1851 srvTcp->tcpStatus = CifsNew;
1852 init_MUTEX(&srvTcp->tcpSem);
1853 rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1854 CLONE_FS | CLONE_FILES | CLONE_VM);
1855 if(rc < 0) {
1856 rc = -ENOMEM;
1857 sock_release(csocket);
1858 kfree(volume_info.UNC);
1859 kfree(volume_info.password);
1860 kfree(volume_info.prepath);
1861 FreeXid(xid);
1862 return rc;
1863 }
1864 wait_for_completion(&cifsd_complete);
1865 rc = 0;
1866 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1867 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1868 srvTcp->sequence_number = 0;
1869 }
1870 }
1871
1872 if (existingCifsSes) {
1873 pSesInfo = existingCifsSes;
1874 cFYI(1, ("Existing smb sess found"));
1875 kfree(volume_info.password);
1876 /* volume_info.UNC freed at end of function */
1877 } else if (!rc) {
1878 cFYI(1, ("Existing smb sess not found"));
1879 pSesInfo = sesInfoAlloc();
1880 if (pSesInfo == NULL)
1881 rc = -ENOMEM;
1882 else {
1883 pSesInfo->server = srvTcp;
1884 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1885 NIPQUAD(sin_server.sin_addr.s_addr));
1886 }
1887
1888 if (!rc){
1889 /* volume_info.password freed at unmount */
1890 if (volume_info.password)
1891 pSesInfo->password = volume_info.password;
1892 if (volume_info.username)
1893 strncpy(pSesInfo->userName,
1894 volume_info.username,MAX_USERNAME_SIZE);
1895 if (volume_info.domainname) {
1896 int len = strlen(volume_info.domainname);
1897 pSesInfo->domainName =
1898 kmalloc(len + 1, GFP_KERNEL);
1899 if(pSesInfo->domainName)
1900 strcpy(pSesInfo->domainName,
1901 volume_info.domainname);
1902 }
1903 pSesInfo->linux_uid = volume_info.linux_uid;
1904 pSesInfo->overrideSecFlg = volume_info.secFlg;
1905 down(&pSesInfo->sesSem);
1906 /* BB FIXME need to pass vol->secFlgs BB */
1907 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1908 up(&pSesInfo->sesSem);
1909 if(!rc)
1910 atomic_inc(&srvTcp->socketUseCount);
1911 } else
1912 kfree(volume_info.password);
1913 }
1914
1915 /* search for existing tcon to this server share */
1916 if (!rc) {
1917 if(volume_info.rsize > CIFSMaxBufSize) {
1918 cERROR(1,("rsize %d too large, using MaxBufSize",
1919 volume_info.rsize));
1920 cifs_sb->rsize = CIFSMaxBufSize;
1921 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1922 cifs_sb->rsize = volume_info.rsize;
1923 else /* default */
1924 cifs_sb->rsize = CIFSMaxBufSize;
1925
1926 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1927 cERROR(1,("wsize %d too large using 4096 instead",
1928 volume_info.wsize));
1929 cifs_sb->wsize = 4096;
1930 } else if(volume_info.wsize)
1931 cifs_sb->wsize = volume_info.wsize;
1932 else
1933 cifs_sb->wsize =
1934 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1935 127*1024);
1936 /* old default of CIFSMaxBufSize was too small now
1937 that SMB Write2 can send multiple pages in kvec.
1938 RFC1001 does not describe what happens when frame
1939 bigger than 128K is sent so use that as max in
1940 conjunction with 52K kvec constraint on arch with 4K
1941 page size */
1942
1943 if(cifs_sb->rsize < 2048) {
1944 cifs_sb->rsize = 2048;
1945 /* Windows ME may prefer this */
1946 cFYI(1,("readsize set to minimum 2048"));
1947 }
1948 /* calculate prepath */
1949 cifs_sb->prepath = volume_info.prepath;
1950 if(cifs_sb->prepath) {
1951 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1952 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1953 volume_info.prepath = NULL;
1954 } else
1955 cifs_sb->prepathlen = 0;
1956 cifs_sb->mnt_uid = volume_info.linux_uid;
1957 cifs_sb->mnt_gid = volume_info.linux_gid;
1958 cifs_sb->mnt_file_mode = volume_info.file_mode;
1959 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1960 cFYI(1,("file mode: 0x%x dir mode: 0x%x",
1961 cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1962
1963 if(volume_info.noperm)
1964 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1965 if(volume_info.setuids)
1966 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1967 if(volume_info.server_ino)
1968 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1969 if(volume_info.remap)
1970 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1971 if(volume_info.no_xattr)
1972 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1973 if(volume_info.sfu_emul)
1974 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1975 if(volume_info.nobrl)
1976 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1977 if(volume_info.cifs_acl)
1978 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1979
1980 if(volume_info.direct_io) {
1981 cFYI(1,("mounting share using direct i/o"));
1982 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1983 }
1984
1985 tcon =
1986 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1987 volume_info.username);
1988 if (tcon) {
1989 cFYI(1, ("Found match on UNC path"));
1990 /* we can have only one retry value for a connection
1991 to a share so for resources mounted more than once
1992 to the same server share the last value passed in
1993 for the retry flag is used */
1994 tcon->retry = volume_info.retry;
1995 tcon->nocase = volume_info.nocase;
1996 } else {
1997 tcon = tconInfoAlloc();
1998 if (tcon == NULL)
1999 rc = -ENOMEM;
2000 else {
2001 /* check for null share name ie connecting to
2002 * dfs root */
2003
2004 /* BB check if this works for exactly length
2005 * three strings */
2006 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2007 && (strchr(volume_info.UNC + 3, '/') ==
2008 NULL)) {
2009 rc = connect_to_dfs_path(xid, pSesInfo,
2010 "", cifs_sb->local_nls,
2011 cifs_sb->mnt_cifs_flags &
2012 CIFS_MOUNT_MAP_SPECIAL_CHR);
2013 kfree(volume_info.UNC);
2014 FreeXid(xid);
2015 return -ENODEV;
2016 } else {
2017 /* BB Do we need to wrap sesSem around
2018 * this TCon call and Unix SetFS as
2019 * we do on SessSetup and reconnect? */
2020 rc = CIFSTCon(xid, pSesInfo,
2021 volume_info.UNC,
2022 tcon, cifs_sb->local_nls);
2023 cFYI(1, ("CIFS Tcon rc = %d", rc));
2024 }
2025 if (!rc) {
2026 atomic_inc(&pSesInfo->inUse);
2027 tcon->retry = volume_info.retry;
2028 tcon->nocase = volume_info.nocase;
2029 }
2030 }
2031 }
2032 }
2033 if(pSesInfo) {
2034 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2035 sb->s_maxbytes = (u64) 1 << 63;
2036 } else
2037 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2038 }
2039
2040 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2041 sb->s_time_gran = 100;
2042
2043 /* on error free sesinfo and tcon struct if needed */
2044 if (rc) {
2045 /* if session setup failed, use count is zero but
2046 we still need to free cifsd thread */
2047 if(atomic_read(&srvTcp->socketUseCount) == 0) {
2048 spin_lock(&GlobalMid_Lock);
2049 srvTcp->tcpStatus = CifsExiting;
2050 spin_unlock(&GlobalMid_Lock);
2051 if(srvTcp->tsk) {
2052 send_sig(SIGKILL,srvTcp->tsk,1);
2053 wait_for_completion(&cifsd_complete);
2054 }
2055 }
2056 /* If find_unc succeeded then rc == 0 so we can not end */
2057 if (tcon) /* up accidently freeing someone elses tcon struct */
2058 tconInfoFree(tcon);
2059 if (existingCifsSes == NULL) {
2060 if (pSesInfo) {
2061 if ((pSesInfo->server) &&
2062 (pSesInfo->status == CifsGood)) {
2063 int temp_rc;
2064 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2065 /* if the socketUseCount is now zero */
2066 if((temp_rc == -ESHUTDOWN) &&
2067 (pSesInfo->server->tsk)) {
2068 send_sig(SIGKILL,pSesInfo->server->tsk,1);
2069 wait_for_completion(&cifsd_complete);
2070 }
2071 } else
2072 cFYI(1, ("No session or bad tcon"));
2073 sesInfoFree(pSesInfo);
2074 /* pSesInfo = NULL; */
2075 }
2076 }
2077 } else {
2078 atomic_inc(&tcon->useCount);
2079 cifs_sb->tcon = tcon;
2080 tcon->ses = pSesInfo;
2081
2082 /* do not care if following two calls succeed - informational */
2083 CIFSSMBQFSDeviceInfo(xid, tcon);
2084 CIFSSMBQFSAttributeInfo(xid, tcon);
2085
2086 /* tell server which Unix caps we support */
2087 if (tcon->ses->capabilities & CAP_UNIX)
2088 reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2089
2090 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2091 cifs_sb->wsize = min(cifs_sb->wsize,
2092 (tcon->ses->server->maxBuf -
2093 MAX_CIFS_HDR_SIZE));
2094 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2095 cifs_sb->rsize = min(cifs_sb->rsize,
2096 (tcon->ses->server->maxBuf -
2097 MAX_CIFS_HDR_SIZE));
2098 }
2099
2100 /* volume_info.password is freed above when existing session found
2101 (in which case it is not needed anymore) but when new sesion is created
2102 the password ptr is put in the new session structure (in which case the
2103 password will be freed at unmount time) */
2104 kfree(volume_info.UNC);
2105 kfree(volume_info.prepath);
2106 FreeXid(xid);
2107 return rc;
2108 }
2109
2110 static int
2111 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2112 char session_key[CIFS_SESS_KEY_SIZE],
2113 const struct nls_table *nls_codepage)
2114 {
2115 struct smb_hdr *smb_buffer;
2116 struct smb_hdr *smb_buffer_response;
2117 SESSION_SETUP_ANDX *pSMB;
2118 SESSION_SETUP_ANDX *pSMBr;
2119 char *bcc_ptr;
2120 char *user;
2121 char *domain;
2122 int rc = 0;
2123 int remaining_words = 0;
2124 int bytes_returned = 0;
2125 int len;
2126 __u32 capabilities;
2127 __u16 count;
2128
2129 cFYI(1, ("In sesssetup"));
2130 if(ses == NULL)
2131 return -EINVAL;
2132 user = ses->userName;
2133 domain = ses->domainName;
2134 smb_buffer = cifs_buf_get();
2135 if (smb_buffer == NULL) {
2136 return -ENOMEM;
2137 }
2138 smb_buffer_response = smb_buffer;
2139 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2140
2141 /* send SMBsessionSetup here */
2142 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2143 NULL /* no tCon exists yet */ , 13 /* wct */ );
2144
2145 smb_buffer->Mid = GetNextMid(ses->server);
2146 pSMB->req_no_secext.AndXCommand = 0xFF;
2147 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2148 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2149
2150 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2151 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2152
2153 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2154 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2155 if (ses->capabilities & CAP_UNICODE) {
2156 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2157 capabilities |= CAP_UNICODE;
2158 }
2159 if (ses->capabilities & CAP_STATUS32) {
2160 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2161 capabilities |= CAP_STATUS32;
2162 }
2163 if (ses->capabilities & CAP_DFS) {
2164 smb_buffer->Flags2 |= SMBFLG2_DFS;
2165 capabilities |= CAP_DFS;
2166 }
2167 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2168
2169 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2170 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2171
2172 pSMB->req_no_secext.CaseSensitivePasswordLength =
2173 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2174 bcc_ptr = pByteArea(smb_buffer);
2175 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2176 bcc_ptr += CIFS_SESS_KEY_SIZE;
2177 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2178 bcc_ptr += CIFS_SESS_KEY_SIZE;
2179
2180 if (ses->capabilities & CAP_UNICODE) {
2181 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2182 *bcc_ptr = 0;
2183 bcc_ptr++;
2184 }
2185 if(user == NULL)
2186 bytes_returned = 0; /* skip null user */
2187 else
2188 bytes_returned =
2189 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2190 nls_codepage);
2191 /* convert number of 16 bit words to bytes */
2192 bcc_ptr += 2 * bytes_returned;
2193 bcc_ptr += 2; /* trailing null */
2194 if (domain == NULL)
2195 bytes_returned =
2196 cifs_strtoUCS((__le16 *) bcc_ptr,
2197 "CIFS_LINUX_DOM", 32, nls_codepage);
2198 else
2199 bytes_returned =
2200 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2201 nls_codepage);
2202 bcc_ptr += 2 * bytes_returned;
2203 bcc_ptr += 2;
2204 bytes_returned =
2205 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2206 32, nls_codepage);
2207 bcc_ptr += 2 * bytes_returned;
2208 bytes_returned =
2209 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2210 32, nls_codepage);
2211 bcc_ptr += 2 * bytes_returned;
2212 bcc_ptr += 2;
2213 bytes_returned =
2214 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2215 64, nls_codepage);
2216 bcc_ptr += 2 * bytes_returned;
2217 bcc_ptr += 2;
2218 } else {
2219 if(user != NULL) {
2220 strncpy(bcc_ptr, user, 200);
2221 bcc_ptr += strnlen(user, 200);
2222 }
2223 *bcc_ptr = 0;
2224 bcc_ptr++;
2225 if (domain == NULL) {
2226 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2227 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2228 } else {
2229 strncpy(bcc_ptr, domain, 64);
2230 bcc_ptr += strnlen(domain, 64);
2231 *bcc_ptr = 0;
2232 bcc_ptr++;
2233 }
2234 strcpy(bcc_ptr, "Linux version ");
2235 bcc_ptr += strlen("Linux version ");
2236 strcpy(bcc_ptr, utsname()->release);
2237 bcc_ptr += strlen(utsname()->release) + 1;
2238 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2239 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2240 }
2241 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2242 smb_buffer->smb_buf_length += count;
2243 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2244
2245 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2246 &bytes_returned, 1);
2247 if (rc) {
2248 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2249 } else if ((smb_buffer_response->WordCount == 3)
2250 || (smb_buffer_response->WordCount == 4)) {
2251 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2252 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2253 if (action & GUEST_LOGIN)
2254 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2255 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2256 cFYI(1, ("UID = %d ", ses->Suid));
2257 /* response can have either 3 or 4 word count - Samba sends 3 */
2258 bcc_ptr = pByteArea(smb_buffer_response);
2259 if ((pSMBr->resp.hdr.WordCount == 3)
2260 || ((pSMBr->resp.hdr.WordCount == 4)
2261 && (blob_len < pSMBr->resp.ByteCount))) {
2262 if (pSMBr->resp.hdr.WordCount == 4)
2263 bcc_ptr += blob_len;
2264
2265 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2266 if ((long) (bcc_ptr) % 2) {
2267 remaining_words =
2268 (BCC(smb_buffer_response) - 1) /2;
2269 bcc_ptr++; /* Unicode strings must be word aligned */
2270 } else {
2271 remaining_words =
2272 BCC(smb_buffer_response) / 2;
2273 }
2274 len =
2275 UniStrnlen((wchar_t *) bcc_ptr,
2276 remaining_words - 1);
2277 /* We look for obvious messed up bcc or strings in response so we do not go off
2278 the end since (at least) WIN2K and Windows XP have a major bug in not null
2279 terminating last Unicode string in response */
2280 if(ses->serverOS)
2281 kfree(ses->serverOS);
2282 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2283 if(ses->serverOS == NULL)
2284 goto sesssetup_nomem;
2285 cifs_strfromUCS_le(ses->serverOS,
2286 (__le16 *)bcc_ptr, len,nls_codepage);
2287 bcc_ptr += 2 * (len + 1);
2288 remaining_words -= len + 1;
2289 ses->serverOS[2 * len] = 0;
2290 ses->serverOS[1 + (2 * len)] = 0;
2291 if (remaining_words > 0) {
2292 len = UniStrnlen((wchar_t *)bcc_ptr,
2293 remaining_words-1);
2294 kfree(ses->serverNOS);
2295 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2296 if(ses->serverNOS == NULL)
2297 goto sesssetup_nomem;
2298 cifs_strfromUCS_le(ses->serverNOS,
2299 (__le16 *)bcc_ptr,len,nls_codepage);
2300 bcc_ptr += 2 * (len + 1);
2301 ses->serverNOS[2 * len] = 0;
2302 ses->serverNOS[1 + (2 * len)] = 0;
2303 if(strncmp(ses->serverNOS,
2304 "NT LAN Manager 4",16) == 0) {
2305 cFYI(1,("NT4 server"));
2306 ses->flags |= CIFS_SES_NT4;
2307 }
2308 remaining_words -= len + 1;
2309 if (remaining_words > 0) {
2310 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2311 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2312 if(ses->serverDomain)
2313 kfree(ses->serverDomain);
2314 ses->serverDomain =
2315 kzalloc(2*(len+1),GFP_KERNEL);
2316 if(ses->serverDomain == NULL)
2317 goto sesssetup_nomem;
2318 cifs_strfromUCS_le(ses->serverDomain,
2319 (__le16 *)bcc_ptr,len,nls_codepage);
2320 bcc_ptr += 2 * (len + 1);
2321 ses->serverDomain[2*len] = 0;
2322 ses->serverDomain[1+(2*len)] = 0;
2323 } /* else no more room so create dummy domain string */
2324 else {
2325 if(ses->serverDomain)
2326 kfree(ses->serverDomain);
2327 ses->serverDomain =
2328 kzalloc(2, GFP_KERNEL);
2329 }
2330 } else { /* no room so create dummy domain and NOS string */
2331 /* if these kcallocs fail not much we
2332 can do, but better to not fail the
2333 sesssetup itself */
2334 kfree(ses->serverDomain);
2335 ses->serverDomain =
2336 kzalloc(2, GFP_KERNEL);
2337 kfree(ses->serverNOS);
2338 ses->serverNOS =
2339 kzalloc(2, GFP_KERNEL);
2340 }
2341 } else { /* ASCII */
2342 len = strnlen(bcc_ptr, 1024);
2343 if (((long) bcc_ptr + len) - (long)
2344 pByteArea(smb_buffer_response)
2345 <= BCC(smb_buffer_response)) {
2346 kfree(ses->serverOS);
2347 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2348 if(ses->serverOS == NULL)
2349 goto sesssetup_nomem;
2350 strncpy(ses->serverOS,bcc_ptr, len);
2351
2352 bcc_ptr += len;
2353 bcc_ptr[0] = 0; /* null terminate the string */
2354 bcc_ptr++;
2355
2356 len = strnlen(bcc_ptr, 1024);
2357 kfree(ses->serverNOS);
2358 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2359 if(ses->serverNOS == NULL)
2360 goto sesssetup_nomem;
2361 strncpy(ses->serverNOS, bcc_ptr, len);
2362 bcc_ptr += len;
2363 bcc_ptr[0] = 0;
2364 bcc_ptr++;
2365
2366 len = strnlen(bcc_ptr, 1024);
2367 if(ses->serverDomain)
2368 kfree(ses->serverDomain);
2369 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2370 if(ses->serverDomain == NULL)
2371 goto sesssetup_nomem;
2372 strncpy(ses->serverDomain, bcc_ptr, len);
2373 bcc_ptr += len;
2374 bcc_ptr[0] = 0;
2375 bcc_ptr++;
2376 } else
2377 cFYI(1,
2378 ("Variable field of length %d extends beyond end of smb ",
2379 len));
2380 }
2381 } else {
2382 cERROR(1,
2383 (" Security Blob Length extends beyond end of SMB"));
2384 }
2385 } else {
2386 cERROR(1,
2387 (" Invalid Word count %d: ",
2388 smb_buffer_response->WordCount));
2389 rc = -EIO;
2390 }
2391 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2392 since that could make reconnection harder, and
2393 reconnection might be needed to free memory */
2394 if (smb_buffer)
2395 cifs_buf_release(smb_buffer);
2396
2397 return rc;
2398 }
2399
2400 static int
2401 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2402 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2403 const struct nls_table *nls_codepage)
2404 {
2405 struct smb_hdr *smb_buffer;
2406 struct smb_hdr *smb_buffer_response;
2407 SESSION_SETUP_ANDX *pSMB;
2408 SESSION_SETUP_ANDX *pSMBr;
2409 char *bcc_ptr;
2410 char *domain;
2411 int rc = 0;
2412 int remaining_words = 0;
2413 int bytes_returned = 0;
2414 int len;
2415 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2416 PNEGOTIATE_MESSAGE SecurityBlob;
2417 PCHALLENGE_MESSAGE SecurityBlob2;
2418 __u32 negotiate_flags, capabilities;
2419 __u16 count;
2420
2421 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2422 if(ses == NULL)
2423 return -EINVAL;
2424 domain = ses->domainName;
2425 *pNTLMv2_flag = FALSE;
2426 smb_buffer = cifs_buf_get();
2427 if (smb_buffer == NULL) {
2428 return -ENOMEM;
2429 }
2430 smb_buffer_response = smb_buffer;
2431 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2432 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2433
2434 /* send SMBsessionSetup here */
2435 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2436 NULL /* no tCon exists yet */ , 12 /* wct */ );
2437
2438 smb_buffer->Mid = GetNextMid(ses->server);
2439 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2440 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2441
2442 pSMB->req.AndXCommand = 0xFF;
2443 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2444 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2445
2446 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2447 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2448
2449 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2450 CAP_EXTENDED_SECURITY;
2451 if (ses->capabilities & CAP_UNICODE) {
2452 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2453 capabilities |= CAP_UNICODE;
2454 }
2455 if (ses->capabilities & CAP_STATUS32) {
2456 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2457 capabilities |= CAP_STATUS32;
2458 }
2459 if (ses->capabilities & CAP_DFS) {
2460 smb_buffer->Flags2 |= SMBFLG2_DFS;
2461 capabilities |= CAP_DFS;
2462 }
2463 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2464
2465 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2466 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2467 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2468 SecurityBlob->MessageType = NtLmNegotiate;
2469 negotiate_flags =
2470 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2471 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2472 NTLMSSP_NEGOTIATE_56 |
2473 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2474 if(sign_CIFS_PDUs)
2475 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2476 /* if(ntlmv2_support)
2477 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2478 /* setup pointers to domain name and workstation name */
2479 bcc_ptr += SecurityBlobLength;
2480
2481 SecurityBlob->WorkstationName.Buffer = 0;
2482 SecurityBlob->WorkstationName.Length = 0;
2483 SecurityBlob->WorkstationName.MaximumLength = 0;
2484
2485 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2486 along with username on auth request (ie the response to challenge) */
2487 SecurityBlob->DomainName.Buffer = 0;
2488 SecurityBlob->DomainName.Length = 0;
2489 SecurityBlob->DomainName.MaximumLength = 0;
2490 if (ses->capabilities & CAP_UNICODE) {
2491 if ((long) bcc_ptr % 2) {
2492 *bcc_ptr = 0;
2493 bcc_ptr++;
2494 }
2495
2496 bytes_returned =
2497 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2498 32, nls_codepage);
2499 bcc_ptr += 2 * bytes_returned;
2500 bytes_returned =
2501 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2502 nls_codepage);
2503 bcc_ptr += 2 * bytes_returned;
2504 bcc_ptr += 2; /* null terminate Linux version */
2505 bytes_returned =
2506 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2507 64, nls_codepage);
2508 bcc_ptr += 2 * bytes_returned;
2509 *(bcc_ptr + 1) = 0;
2510 *(bcc_ptr + 2) = 0;
2511 bcc_ptr += 2; /* null terminate network opsys string */
2512 *(bcc_ptr + 1) = 0;
2513 *(bcc_ptr + 2) = 0;
2514 bcc_ptr += 2; /* null domain */
2515 } else { /* ASCII */
2516 strcpy(bcc_ptr, "Linux version ");
2517 bcc_ptr += strlen("Linux version ");
2518 strcpy(bcc_ptr, utsname()->release);
2519 bcc_ptr += strlen(utsname()->release) + 1;
2520 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2521 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2522 bcc_ptr++; /* empty domain field */
2523 *bcc_ptr = 0;
2524 }
2525 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2526 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2527 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2528 smb_buffer->smb_buf_length += count;
2529 pSMB->req.ByteCount = cpu_to_le16(count);
2530
2531 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2532 &bytes_returned, 1);
2533
2534 if (smb_buffer_response->Status.CifsError ==
2535 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2536 rc = 0;
2537
2538 if (rc) {
2539 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2540 } else if ((smb_buffer_response->WordCount == 3)
2541 || (smb_buffer_response->WordCount == 4)) {
2542 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2543 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2544
2545 if (action & GUEST_LOGIN)
2546 cFYI(1, (" Guest login"));
2547 /* Do we want to set anything in SesInfo struct when guest login? */
2548
2549 bcc_ptr = pByteArea(smb_buffer_response);
2550 /* response can have either 3 or 4 word count - Samba sends 3 */
2551
2552 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2553 if (SecurityBlob2->MessageType != NtLmChallenge) {
2554 cFYI(1,
2555 ("Unexpected NTLMSSP message type received %d",
2556 SecurityBlob2->MessageType));
2557 } else if (ses) {
2558 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2559 cFYI(1, ("UID = %d", ses->Suid));
2560 if ((pSMBr->resp.hdr.WordCount == 3)
2561 || ((pSMBr->resp.hdr.WordCount == 4)
2562 && (blob_len <
2563 pSMBr->resp.ByteCount))) {
2564
2565 if (pSMBr->resp.hdr.WordCount == 4) {
2566 bcc_ptr += blob_len;
2567 cFYI(1, ("Security Blob Length %d",
2568 blob_len));
2569 }
2570
2571 cFYI(1, ("NTLMSSP Challenge rcvd"));
2572
2573 memcpy(ses->server->cryptKey,
2574 SecurityBlob2->Challenge,
2575 CIFS_CRYPTO_KEY_SIZE);
2576 if(SecurityBlob2->NegotiateFlags &
2577 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2578 *pNTLMv2_flag = TRUE;
2579
2580 if((SecurityBlob2->NegotiateFlags &
2581 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2582 || (sign_CIFS_PDUs > 1))
2583 ses->server->secMode |=
2584 SECMODE_SIGN_REQUIRED;
2585 if ((SecurityBlob2->NegotiateFlags &
2586 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2587 ses->server->secMode |=
2588 SECMODE_SIGN_ENABLED;
2589
2590 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2591 if ((long) (bcc_ptr) % 2) {
2592 remaining_words =
2593 (BCC(smb_buffer_response)
2594 - 1) / 2;
2595 bcc_ptr++; /* Unicode strings must be word aligned */
2596 } else {
2597 remaining_words =
2598 BCC
2599 (smb_buffer_response) / 2;
2600 }
2601 len =
2602 UniStrnlen((wchar_t *) bcc_ptr,
2603 remaining_words - 1);
2604 /* We look for obvious messed up bcc or strings in response so we do not go off
2605 the end since (at least) WIN2K and Windows XP have a major bug in not null
2606 terminating last Unicode string in response */
2607 if(ses->serverOS)
2608 kfree(ses->serverOS);
2609 ses->serverOS =
2610 kzalloc(2 * (len + 1), GFP_KERNEL);
2611 cifs_strfromUCS_le(ses->serverOS,
2612 (__le16 *)
2613 bcc_ptr, len,
2614 nls_codepage);
2615 bcc_ptr += 2 * (len + 1);
2616 remaining_words -= len + 1;
2617 ses->serverOS[2 * len] = 0;
2618 ses->serverOS[1 + (2 * len)] = 0;
2619 if (remaining_words > 0) {
2620 len = UniStrnlen((wchar_t *)
2621 bcc_ptr,
2622 remaining_words
2623 - 1);
2624 kfree(ses->serverNOS);
2625 ses->serverNOS =
2626 kzalloc(2 * (len + 1),
2627 GFP_KERNEL);
2628 cifs_strfromUCS_le(ses->
2629 serverNOS,
2630 (__le16 *)
2631 bcc_ptr,
2632 len,
2633 nls_codepage);
2634 bcc_ptr += 2 * (len + 1);
2635 ses->serverNOS[2 * len] = 0;
2636 ses->serverNOS[1 +
2637 (2 * len)] = 0;
2638 remaining_words -= len + 1;
2639 if (remaining_words > 0) {
2640 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2641 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2642 kfree(ses->serverDomain);
2643 ses->serverDomain =
2644 kzalloc(2 *
2645 (len +
2646 1),
2647 GFP_KERNEL);
2648 cifs_strfromUCS_le
2649 (ses->serverDomain,
2650 (__le16 *)bcc_ptr,
2651 len, nls_codepage);
2652 bcc_ptr +=
2653 2 * (len + 1);
2654 ses->serverDomain[2*len]
2655 = 0;
2656 ses->serverDomain
2657 [1 + (2 * len)]
2658 = 0;
2659 } /* else no more room so create dummy domain string */
2660 else {
2661 kfree(ses->serverDomain);
2662 ses->serverDomain =
2663 kzalloc(2,
2664 GFP_KERNEL);
2665 }
2666 } else { /* no room so create dummy domain and NOS string */
2667 kfree(ses->serverDomain);
2668 ses->serverDomain =
2669 kzalloc(2, GFP_KERNEL);
2670 kfree(ses->serverNOS);
2671 ses->serverNOS =
2672 kzalloc(2, GFP_KERNEL);
2673 }
2674 } else { /* ASCII */
2675 len = strnlen(bcc_ptr, 1024);
2676 if (((long) bcc_ptr + len) - (long)
2677 pByteArea(smb_buffer_response)
2678 <= BCC(smb_buffer_response)) {
2679 if(ses->serverOS)
2680 kfree(ses->serverOS);
2681 ses->serverOS =
2682 kzalloc(len + 1,
2683 GFP_KERNEL);
2684 strncpy(ses->serverOS,
2685 bcc_ptr, len);
2686
2687 bcc_ptr += len;
2688 bcc_ptr[0] = 0; /* null terminate string */
2689 bcc_ptr++;
2690
2691 len = strnlen(bcc_ptr, 1024);
2692 kfree(ses->serverNOS);
2693 ses->serverNOS =
2694 kzalloc(len + 1,
2695 GFP_KERNEL);
2696 strncpy(ses->serverNOS, bcc_ptr, len);
2697 bcc_ptr += len;
2698 bcc_ptr[0] = 0;
2699 bcc_ptr++;
2700
2701 len = strnlen(bcc_ptr, 1024);
2702 kfree(ses->serverDomain);
2703 ses->serverDomain =
2704 kzalloc(len + 1,
2705 GFP_KERNEL);
2706 strncpy(ses->serverDomain, bcc_ptr, len);
2707 bcc_ptr += len;
2708 bcc_ptr[0] = 0;
2709 bcc_ptr++;
2710 } else
2711 cFYI(1,
2712 ("Variable field of length %d extends beyond end of smb",
2713 len));
2714 }
2715 } else {
2716 cERROR(1,
2717 (" Security Blob Length extends beyond end of SMB"));
2718 }
2719 } else {
2720 cERROR(1, ("No session structure passed in."));
2721 }
2722 } else {
2723 cERROR(1,
2724 (" Invalid Word count %d:",
2725 smb_buffer_response->WordCount));
2726 rc = -EIO;
2727 }
2728
2729 if (smb_buffer)
2730 cifs_buf_release(smb_buffer);
2731
2732 return rc;
2733 }
2734 static int
2735 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2736 char *ntlm_session_key, int ntlmv2_flag,
2737 const struct nls_table *nls_codepage)
2738 {
2739 struct smb_hdr *smb_buffer;
2740 struct smb_hdr *smb_buffer_response;
2741 SESSION_SETUP_ANDX *pSMB;
2742 SESSION_SETUP_ANDX *pSMBr;
2743 char *bcc_ptr;
2744 char *user;
2745 char *domain;
2746 int rc = 0;
2747 int remaining_words = 0;
2748 int bytes_returned = 0;
2749 int len;
2750 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2751 PAUTHENTICATE_MESSAGE SecurityBlob;
2752 __u32 negotiate_flags, capabilities;
2753 __u16 count;
2754
2755 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2756 if(ses == NULL)
2757 return -EINVAL;
2758 user = ses->userName;
2759 domain = ses->domainName;
2760 smb_buffer = cifs_buf_get();
2761 if (smb_buffer == NULL) {
2762 return -ENOMEM;
2763 }
2764 smb_buffer_response = smb_buffer;
2765 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2766 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2767
2768 /* send SMBsessionSetup here */
2769 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2770 NULL /* no tCon exists yet */ , 12 /* wct */ );
2771
2772 smb_buffer->Mid = GetNextMid(ses->server);
2773 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2774 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2775 pSMB->req.AndXCommand = 0xFF;
2776 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2777 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2778
2779 pSMB->req.hdr.Uid = ses->Suid;
2780
2781 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2782 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2783
2784 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2785 CAP_EXTENDED_SECURITY;
2786 if (ses->capabilities & CAP_UNICODE) {
2787 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2788 capabilities |= CAP_UNICODE;
2789 }
2790 if (ses->capabilities & CAP_STATUS32) {
2791 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2792 capabilities |= CAP_STATUS32;
2793 }
2794 if (ses->capabilities & CAP_DFS) {
2795 smb_buffer->Flags2 |= SMBFLG2_DFS;
2796 capabilities |= CAP_DFS;
2797 }
2798 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2799
2800 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2801 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2802 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2803 SecurityBlob->MessageType = NtLmAuthenticate;
2804 bcc_ptr += SecurityBlobLength;
2805 negotiate_flags =
2806 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2807 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2808 0x80000000 | NTLMSSP_NEGOTIATE_128;
2809 if(sign_CIFS_PDUs)
2810 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2811 if(ntlmv2_flag)
2812 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2813
2814 /* setup pointers to domain name and workstation name */
2815
2816 SecurityBlob->WorkstationName.Buffer = 0;
2817 SecurityBlob->WorkstationName.Length = 0;
2818 SecurityBlob->WorkstationName.MaximumLength = 0;
2819 SecurityBlob->SessionKey.Length = 0;
2820 SecurityBlob->SessionKey.MaximumLength = 0;
2821 SecurityBlob->SessionKey.Buffer = 0;
2822
2823 SecurityBlob->LmChallengeResponse.Length = 0;
2824 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2825 SecurityBlob->LmChallengeResponse.Buffer = 0;
2826
2827 SecurityBlob->NtChallengeResponse.Length =
2828 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2829 SecurityBlob->NtChallengeResponse.MaximumLength =
2830 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2831 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2832 SecurityBlob->NtChallengeResponse.Buffer =
2833 cpu_to_le32(SecurityBlobLength);
2834 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2835 bcc_ptr += CIFS_SESS_KEY_SIZE;
2836
2837 if (ses->capabilities & CAP_UNICODE) {
2838 if (domain == NULL) {
2839 SecurityBlob->DomainName.Buffer = 0;
2840 SecurityBlob->DomainName.Length = 0;
2841 SecurityBlob->DomainName.MaximumLength = 0;
2842 } else {
2843 __u16 len =
2844 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2845 nls_codepage);
2846 len *= 2;
2847 SecurityBlob->DomainName.MaximumLength =
2848 cpu_to_le16(len);
2849 SecurityBlob->DomainName.Buffer =
2850 cpu_to_le32(SecurityBlobLength);
2851 bcc_ptr += len;
2852 SecurityBlobLength += len;
2853 SecurityBlob->DomainName.Length =
2854 cpu_to_le16(len);
2855 }
2856 if (user == NULL) {
2857 SecurityBlob->UserName.Buffer = 0;
2858 SecurityBlob->UserName.Length = 0;
2859 SecurityBlob->UserName.MaximumLength = 0;
2860 } else {
2861 __u16 len =
2862 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2863 nls_codepage);
2864 len *= 2;
2865 SecurityBlob->UserName.MaximumLength =
2866 cpu_to_le16(len);
2867 SecurityBlob->UserName.Buffer =
2868 cpu_to_le32(SecurityBlobLength);
2869 bcc_ptr += len;
2870 SecurityBlobLength += len;
2871 SecurityBlob->UserName.Length =
2872 cpu_to_le16(len);
2873 }
2874
2875 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2876 SecurityBlob->WorkstationName.Length *= 2;
2877 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2878 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2879 bcc_ptr += SecurityBlob->WorkstationName.Length;
2880 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2881 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2882
2883 if ((long) bcc_ptr % 2) {
2884 *bcc_ptr = 0;
2885 bcc_ptr++;
2886 }
2887 bytes_returned =
2888 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2889 32, nls_codepage);
2890 bcc_ptr += 2 * bytes_returned;
2891 bytes_returned =
2892 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2893 nls_codepage);
2894 bcc_ptr += 2 * bytes_returned;
2895 bcc_ptr += 2; /* null term version string */
2896 bytes_returned =
2897 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2898 64, nls_codepage);
2899 bcc_ptr += 2 * bytes_returned;
2900 *(bcc_ptr + 1) = 0;
2901 *(bcc_ptr + 2) = 0;
2902 bcc_ptr += 2; /* null terminate network opsys string */
2903 *(bcc_ptr + 1) = 0;
2904 *(bcc_ptr + 2) = 0;
2905 bcc_ptr += 2; /* null domain */
2906 } else { /* ASCII */
2907 if (domain == NULL) {
2908 SecurityBlob->DomainName.Buffer = 0;
2909 SecurityBlob->DomainName.Length = 0;
2910 SecurityBlob->DomainName.MaximumLength = 0;
2911 } else {
2912 __u16 len;
2913 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2914 strncpy(bcc_ptr, domain, 63);
2915 len = strnlen(domain, 64);
2916 SecurityBlob->DomainName.MaximumLength =
2917 cpu_to_le16(len);
2918 SecurityBlob->DomainName.Buffer =
2919 cpu_to_le32(SecurityBlobLength);
2920 bcc_ptr += len;
2921 SecurityBlobLength += len;
2922 SecurityBlob->DomainName.Length = cpu_to_le16(len);
2923 }
2924 if (user == NULL) {
2925 SecurityBlob->UserName.Buffer = 0;
2926 SecurityBlob->UserName.Length = 0;
2927 SecurityBlob->UserName.MaximumLength = 0;
2928 } else {
2929 __u16 len;
2930 strncpy(bcc_ptr, user, 63);
2931 len = strnlen(user, 64);
2932 SecurityBlob->UserName.MaximumLength =
2933 cpu_to_le16(len);
2934 SecurityBlob->UserName.Buffer =
2935 cpu_to_le32(SecurityBlobLength);
2936 bcc_ptr += len;
2937 SecurityBlobLength += len;
2938 SecurityBlob->UserName.Length = cpu_to_le16(len);
2939 }
2940 /* BB fill in our workstation name if known BB */
2941
2942 strcpy(bcc_ptr, "Linux version ");
2943 bcc_ptr += strlen("Linux version ");
2944 strcpy(bcc_ptr, utsname()->release);
2945 bcc_ptr += strlen(utsname()->release) + 1;
2946 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2947 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2948 bcc_ptr++; /* null domain */
2949 *bcc_ptr = 0;
2950 }
2951 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2952 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2953 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2954 smb_buffer->smb_buf_length += count;
2955 pSMB->req.ByteCount = cpu_to_le16(count);
2956
2957 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2958 &bytes_returned, 1);
2959 if (rc) {
2960 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2961 } else if ((smb_buffer_response->WordCount == 3)
2962 || (smb_buffer_response->WordCount == 4)) {
2963 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2964 __u16 blob_len =
2965 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2966 if (action & GUEST_LOGIN)
2967 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
2968 /* if(SecurityBlob2->MessageType != NtLm??){
2969 cFYI("Unexpected message type on auth response is %d "));
2970 } */
2971 if (ses) {
2972 cFYI(1,
2973 ("Does UID on challenge %d match auth response UID %d ",
2974 ses->Suid, smb_buffer_response->Uid));
2975 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2976 bcc_ptr = pByteArea(smb_buffer_response);
2977 /* response can have either 3 or 4 word count - Samba sends 3 */
2978 if ((pSMBr->resp.hdr.WordCount == 3)
2979 || ((pSMBr->resp.hdr.WordCount == 4)
2980 && (blob_len <
2981 pSMBr->resp.ByteCount))) {
2982 if (pSMBr->resp.hdr.WordCount == 4) {
2983 bcc_ptr +=
2984 blob_len;
2985 cFYI(1,
2986 ("Security Blob Length %d ",
2987 blob_len));
2988 }
2989
2990 cFYI(1,
2991 ("NTLMSSP response to Authenticate "));
2992
2993 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2994 if ((long) (bcc_ptr) % 2) {
2995 remaining_words =
2996 (BCC(smb_buffer_response)
2997 - 1) / 2;
2998 bcc_ptr++; /* Unicode strings must be word aligned */
2999 } else {
3000 remaining_words = BCC(smb_buffer_response) / 2;
3001 }
3002 len =
3003 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3004 /* We look for obvious messed up bcc or strings in response so we do not go off
3005 the end since (at least) WIN2K and Windows XP have a major bug in not null
3006 terminating last Unicode string in response */
3007 if(ses->serverOS)
3008 kfree(ses->serverOS);
3009 ses->serverOS =
3010 kzalloc(2 * (len + 1), GFP_KERNEL);
3011 cifs_strfromUCS_le(ses->serverOS,
3012 (__le16 *)
3013 bcc_ptr, len,
3014 nls_codepage);
3015 bcc_ptr += 2 * (len + 1);
3016 remaining_words -= len + 1;
3017 ses->serverOS[2 * len] = 0;
3018 ses->serverOS[1 + (2 * len)] = 0;
3019 if (remaining_words > 0) {
3020 len = UniStrnlen((wchar_t *)
3021 bcc_ptr,
3022 remaining_words
3023 - 1);
3024 kfree(ses->serverNOS);
3025 ses->serverNOS =
3026 kzalloc(2 * (len + 1),
3027 GFP_KERNEL);
3028 cifs_strfromUCS_le(ses->
3029 serverNOS,
3030 (__le16 *)
3031 bcc_ptr,
3032 len,
3033 nls_codepage);
3034 bcc_ptr += 2 * (len + 1);
3035 ses->serverNOS[2 * len] = 0;
3036 ses->serverNOS[1+(2*len)] = 0;
3037 remaining_words -= len + 1;
3038 if (remaining_words > 0) {
3039 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3040 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3041 if(ses->serverDomain)
3042 kfree(ses->serverDomain);
3043 ses->serverDomain =
3044 kzalloc(2 *
3045 (len +
3046 1),
3047 GFP_KERNEL);
3048 cifs_strfromUCS_le
3049 (ses->
3050 serverDomain,
3051 (__le16 *)
3052 bcc_ptr, len,
3053 nls_codepage);
3054 bcc_ptr +=
3055 2 * (len + 1);
3056 ses->
3057 serverDomain[2
3058 * len]
3059 = 0;
3060 ses->
3061 serverDomain[1
3062 +
3063 (2
3064 *
3065 len)]
3066 = 0;
3067 } /* else no more room so create dummy domain string */
3068 else {
3069 if(ses->serverDomain)
3070 kfree(ses->serverDomain);
3071 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3072 }
3073 } else { /* no room so create dummy domain and NOS string */
3074 if(ses->serverDomain)
3075 kfree(ses->serverDomain);
3076 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3077 kfree(ses->serverNOS);
3078 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3079 }
3080 } else { /* ASCII */
3081 len = strnlen(bcc_ptr, 1024);
3082 if (((long) bcc_ptr + len) -
3083 (long) pByteArea(smb_buffer_response)
3084 <= BCC(smb_buffer_response)) {
3085 if(ses->serverOS)
3086 kfree(ses->serverOS);
3087 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3088 strncpy(ses->serverOS,bcc_ptr, len);
3089
3090 bcc_ptr += len;
3091 bcc_ptr[0] = 0; /* null terminate the string */
3092 bcc_ptr++;
3093
3094 len = strnlen(bcc_ptr, 1024);
3095 kfree(ses->serverNOS);
3096 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3097 strncpy(ses->serverNOS, bcc_ptr, len);
3098 bcc_ptr += len;
3099 bcc_ptr[0] = 0;
3100 bcc_ptr++;
3101
3102 len = strnlen(bcc_ptr, 1024);
3103 if(ses->serverDomain)
3104 kfree(ses->serverDomain);
3105 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3106 strncpy(ses->serverDomain, bcc_ptr, len);
3107 bcc_ptr += len;
3108 bcc_ptr[0] = 0;
3109 bcc_ptr++;
3110 } else
3111 cFYI(1,
3112 ("Variable field of length %d extends beyond end of smb ",
3113 len));
3114 }
3115 } else {
3116 cERROR(1,
3117 (" Security Blob Length extends beyond end of SMB"));
3118 }
3119 } else {
3120 cERROR(1, ("No session structure passed in."));
3121 }
3122 } else {
3123 cERROR(1,
3124 (" Invalid Word count %d: ",
3125 smb_buffer_response->WordCount));
3126 rc = -EIO;
3127 }
3128
3129 if (smb_buffer)
3130 cifs_buf_release(smb_buffer);
3131
3132 return rc;
3133 }
3134
3135 int
3136 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3137 const char *tree, struct cifsTconInfo *tcon,
3138 const struct nls_table *nls_codepage)
3139 {
3140 struct smb_hdr *smb_buffer;
3141 struct smb_hdr *smb_buffer_response;
3142 TCONX_REQ *pSMB;
3143 TCONX_RSP *pSMBr;
3144 unsigned char *bcc_ptr;
3145 int rc = 0;
3146 int length;
3147 __u16 count;
3148
3149 if (ses == NULL)
3150 return -EIO;
3151
3152 smb_buffer = cifs_buf_get();
3153 if (smb_buffer == NULL) {
3154 return -ENOMEM;
3155 }
3156 smb_buffer_response = smb_buffer;
3157
3158 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3159 NULL /*no tid */ , 4 /*wct */ );
3160
3161 smb_buffer->Mid = GetNextMid(ses->server);
3162 smb_buffer->Uid = ses->Suid;
3163 pSMB = (TCONX_REQ *) smb_buffer;
3164 pSMBr = (TCONX_RSP *) smb_buffer_response;
3165
3166 pSMB->AndXCommand = 0xFF;
3167 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3168 bcc_ptr = &pSMB->Password[0];
3169 if((ses->server->secMode) & SECMODE_USER) {
3170 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3171 *bcc_ptr = 0; /* password is null byte */
3172 bcc_ptr++; /* skip password */
3173 /* already aligned so no need to do it below */
3174 } else {
3175 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3176 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3177 specified as required (when that support is added to
3178 the vfs in the future) as only NTLM or the much
3179 weaker LANMAN (which we do not send by default) is accepted
3180 by Samba (not sure whether other servers allow
3181 NTLMv2 password here) */
3182 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3183 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3184 (ses->server->secType == LANMAN))
3185 calc_lanman_hash(ses, bcc_ptr);
3186 else
3187 #endif /* CIFS_WEAK_PW_HASH */
3188 SMBNTencrypt(ses->password,
3189 ses->server->cryptKey,
3190 bcc_ptr);
3191
3192 bcc_ptr += CIFS_SESS_KEY_SIZE;
3193 if(ses->capabilities & CAP_UNICODE) {
3194 /* must align unicode strings */
3195 *bcc_ptr = 0; /* null byte password */
3196 bcc_ptr++;
3197 }
3198 }
3199
3200 if(ses->server->secMode &
3201 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3202 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3203
3204 if (ses->capabilities & CAP_STATUS32) {
3205 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3206 }
3207 if (ses->capabilities & CAP_DFS) {
3208 smb_buffer->Flags2 |= SMBFLG2_DFS;
3209 }
3210 if (ses->capabilities & CAP_UNICODE) {
3211 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3212 length =
3213 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3214 6 /* max utf8 char length in bytes */ *
3215 (/* server len*/ + 256 /* share len */), nls_codepage);
3216 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3217 bcc_ptr += 2; /* skip trailing null */
3218 } else { /* ASCII */
3219 strcpy(bcc_ptr, tree);
3220 bcc_ptr += strlen(tree) + 1;
3221 }
3222 strcpy(bcc_ptr, "?????");
3223 bcc_ptr += strlen("?????");
3224 bcc_ptr += 1;
3225 count = bcc_ptr - &pSMB->Password[0];
3226 pSMB->hdr.smb_buf_length += count;
3227 pSMB->ByteCount = cpu_to_le16(count);
3228
3229 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3230
3231 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3232 /* above now done in SendReceive */
3233 if ((rc == 0) && (tcon != NULL)) {
3234 tcon->tidStatus = CifsGood;
3235 tcon->tid = smb_buffer_response->Tid;
3236 bcc_ptr = pByteArea(smb_buffer_response);
3237 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3238 /* skip service field (NB: this field is always ASCII) */
3239 bcc_ptr += length + 1;
3240 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3241 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3242 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3243 if ((bcc_ptr + (2 * length)) -
3244 pByteArea(smb_buffer_response) <=
3245 BCC(smb_buffer_response)) {
3246 kfree(tcon->nativeFileSystem);
3247 tcon->nativeFileSystem =
3248 kzalloc(length + 2, GFP_KERNEL);
3249 cifs_strfromUCS_le(tcon->nativeFileSystem,
3250 (__le16 *) bcc_ptr,
3251 length, nls_codepage);
3252 bcc_ptr += 2 * length;
3253 bcc_ptr[0] = 0; /* null terminate the string */
3254 bcc_ptr[1] = 0;
3255 bcc_ptr += 2;
3256 }
3257 /* else do not bother copying these informational fields */
3258 } else {
3259 length = strnlen(bcc_ptr, 1024);
3260 if ((bcc_ptr + length) -
3261 pByteArea(smb_buffer_response) <=
3262 BCC(smb_buffer_response)) {
3263 kfree(tcon->nativeFileSystem);
3264 tcon->nativeFileSystem =
3265 kzalloc(length + 1, GFP_KERNEL);
3266 strncpy(tcon->nativeFileSystem, bcc_ptr,
3267 length);
3268 }
3269 /* else do not bother copying these informational fields */
3270 }
3271 if((smb_buffer_response->WordCount == 3) ||
3272 (smb_buffer_response->WordCount == 7))
3273 /* field is in same location */
3274 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3275 else
3276 tcon->Flags = 0;
3277 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3278 } else if ((rc == 0) && tcon == NULL) {
3279 /* all we need to save for IPC$ connection */
3280 ses->ipc_tid = smb_buffer_response->Tid;
3281 }
3282
3283 if (smb_buffer)
3284 cifs_buf_release(smb_buffer);
3285 return rc;
3286 }
3287
3288 int
3289 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3290 {
3291 int rc = 0;
3292 int xid;
3293 struct cifsSesInfo *ses = NULL;
3294 struct task_struct *cifsd_task;
3295 char * tmp;
3296
3297 xid = GetXid();
3298
3299 if (cifs_sb->tcon) {
3300 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3301 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3302 if (rc == -EBUSY) {
3303 FreeXid(xid);
3304 return 0;
3305 }
3306 tconInfoFree(cifs_sb->tcon);
3307 if ((ses) && (ses->server)) {
3308 /* save off task so we do not refer to ses later */
3309 cifsd_task = ses->server->tsk;
3310 cFYI(1, ("About to do SMBLogoff "));
3311 rc = CIFSSMBLogoff(xid, ses);
3312 if (rc == -EBUSY) {
3313 FreeXid(xid);
3314 return 0;
3315 } else if (rc == -ESHUTDOWN) {
3316 cFYI(1,("Waking up socket by sending it signal"));
3317 if(cifsd_task) {
3318 send_sig(SIGKILL,cifsd_task,1);
3319 wait_for_completion(&cifsd_complete);
3320 }
3321 rc = 0;
3322 } /* else - we have an smb session
3323 left on this socket do not kill cifsd */
3324 } else
3325 cFYI(1, ("No session or bad tcon"));
3326 }
3327
3328 cifs_sb->tcon = NULL;
3329 tmp = cifs_sb->prepath;
3330 cifs_sb->prepathlen = 0;
3331 cifs_sb->prepath = NULL;
3332 kfree(tmp);
3333 if (ses)
3334 schedule_timeout_interruptible(msecs_to_jiffies(500));
3335 if (ses)
3336 sesInfoFree(ses);
3337
3338 FreeXid(xid);
3339 return rc; /* BB check if we should always return zero here */
3340 }
3341
3342 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3343 struct nls_table * nls_info)
3344 {
3345 int rc = 0;
3346 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3347 int ntlmv2_flag = FALSE;
3348 int first_time = 0;
3349
3350 /* what if server changes its buffer size after dropping the session? */
3351 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3352 rc = CIFSSMBNegotiate(xid, pSesInfo);
3353 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3354 rc = CIFSSMBNegotiate(xid, pSesInfo);
3355 if(rc == -EAGAIN)
3356 rc = -EHOSTDOWN;
3357 }
3358 if(rc == 0) {
3359 spin_lock(&GlobalMid_Lock);
3360 if(pSesInfo->server->tcpStatus != CifsExiting)
3361 pSesInfo->server->tcpStatus = CifsGood;
3362 else
3363 rc = -EHOSTDOWN;
3364 spin_unlock(&GlobalMid_Lock);
3365
3366 }
3367 first_time = 1;
3368 }
3369 if (!rc) {
3370 pSesInfo->flags = 0;
3371 pSesInfo->capabilities = pSesInfo->server->capabilities;
3372 if(linuxExtEnabled == 0)
3373 pSesInfo->capabilities &= (~CAP_UNIX);
3374 /* pSesInfo->sequence_number = 0;*/
3375 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3376 pSesInfo->server->secMode,
3377 pSesInfo->server->capabilities,
3378 pSesInfo->server->timeAdj));
3379 if(experimEnabled < 2)
3380 rc = CIFS_SessSetup(xid, pSesInfo,
3381 first_time, nls_info);
3382 else if (extended_security
3383 && (pSesInfo->capabilities
3384 & CAP_EXTENDED_SECURITY)
3385 && (pSesInfo->server->secType == NTLMSSP)) {
3386 rc = -EOPNOTSUPP;
3387 } else if (extended_security
3388 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3389 && (pSesInfo->server->secType == RawNTLMSSP)) {
3390 cFYI(1, ("NTLMSSP sesssetup"));
3391 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3392 pSesInfo,
3393 &ntlmv2_flag,
3394 nls_info);
3395 if (!rc) {
3396 if(ntlmv2_flag) {
3397 char * v2_response;
3398 cFYI(1,("more secure NTLM ver2 hash"));
3399 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3400 nls_info)) {
3401 rc = -ENOMEM;
3402 goto ss_err_exit;
3403 } else
3404 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3405 if(v2_response) {
3406 CalcNTLMv2_response(pSesInfo,v2_response);
3407 /* if(first_time)
3408 cifs_calculate_ntlmv2_mac_key(
3409 pSesInfo->server->mac_signing_key,
3410 response, ntlm_session_key, */
3411 kfree(v2_response);
3412 /* BB Put dummy sig in SessSetup PDU? */
3413 } else {
3414 rc = -ENOMEM;
3415 goto ss_err_exit;
3416 }
3417
3418 } else {
3419 SMBNTencrypt(pSesInfo->password,
3420 pSesInfo->server->cryptKey,
3421 ntlm_session_key);
3422
3423 if(first_time)
3424 cifs_calculate_mac_key(
3425 pSesInfo->server->mac_signing_key,
3426 ntlm_session_key,
3427 pSesInfo->password);
3428 }
3429 /* for better security the weaker lanman hash not sent
3430 in AuthSessSetup so we no longer calculate it */
3431
3432 rc = CIFSNTLMSSPAuthSessSetup(xid,
3433 pSesInfo,
3434 ntlm_session_key,
3435 ntlmv2_flag,
3436 nls_info);
3437 }
3438 } else { /* old style NTLM 0.12 session setup */
3439 SMBNTencrypt(pSesInfo->password,
3440 pSesInfo->server->cryptKey,
3441 ntlm_session_key);
3442
3443 if(first_time)
3444 cifs_calculate_mac_key(
3445 pSesInfo->server->mac_signing_key,
3446 ntlm_session_key, pSesInfo->password);
3447
3448 rc = CIFSSessSetup(xid, pSesInfo,
3449 ntlm_session_key, nls_info);
3450 }
3451 if (rc) {
3452 cERROR(1,("Send error in SessSetup = %d",rc));
3453 } else {
3454 cFYI(1,("CIFS Session Established successfully"));
3455 pSesInfo->status = CifsGood;
3456 }
3457 }
3458 ss_err_exit:
3459 return rc;
3460 }
3461
Linux with added FPC-III support