?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[XFS] Get rid of old 5.3/6.1 v1 log items. Cleanup patch sent in by Eric
[wrt350n-kernel.git] / fs / cifs / connect.c
blob2caca06b4bae214327c3fccc7a046f6a0269ac37
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2006
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/pagevec.h>
34 #include <linux/freezer.h>
35 #include <asm/uaccess.h>
36 #include <asm/processor.h>
37 #include "cifspdu.h"
38 #include "cifsglob.h"
39 #include "cifsproto.h"
40 #include "cifs_unicode.h"
41 #include "cifs_debug.h"
42 #include "cifs_fs_sb.h"
43 #include "ntlmssp.h"
44 #include "nterr.h"
45 #include "rfc1002pdu.h"
46 #include "cn_cifs.h"
47
48 #define CIFS_PORT 445
49 #define RFC1001_PORT 139
50
51 static DECLARE_COMPLETION(cifsd_complete);
52
53 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
54 unsigned char *p24);
55
56 extern mempool_t *cifs_req_poolp;
57
58 struct smb_vol {
59 char *username;
60 char *password;
61 char *domainname;
62 char *UNC;
63 char *UNCip;
64 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
65 char *iocharset; /* local code page for mapping to and from Unicode */
66 char source_rfc1001_name[16]; /* netbios name of client */
67 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
68 uid_t linux_uid;
69 gid_t linux_gid;
70 mode_t file_mode;
71 mode_t dir_mode;
72 unsigned secFlg;
73 unsigned rw:1;
74 unsigned retry:1;
75 unsigned intr:1;
76 unsigned setuids:1;
77 unsigned noperm:1;
78 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
79 unsigned cifs_acl:1;
80 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
81 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
82 unsigned direct_io:1;
83 unsigned remap:1; /* set to remap seven reserved chars in filenames */
84 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
85 unsigned sfu_emul:1;
86 unsigned nullauth:1; /* attempt to authenticate with null user */
87 unsigned nocase; /* request case insensitive filenames */
88 unsigned nobrl; /* disable sending byte range locks to srv */
89 unsigned int rsize;
90 unsigned int wsize;
91 unsigned int sockopt;
92 unsigned short int port;
93 char * prepath;
94 };
95
96 static int ipv4_connect(struct sockaddr_in *psin_server,
97 struct socket **csocket,
98 char * netb_name,
99 char * server_netb_name);
100 static int ipv6_connect(struct sockaddr_in6 *psin_server,
101 struct socket **csocket);
102
103
104 /*
105 * cifs tcp session reconnection
106 *
107 * mark tcp session as reconnecting so temporarily locked
108 * mark all smb sessions as reconnecting for tcp session
109 * reconnect tcp session
110 * wake up waiters on reconnection? - (not needed currently)
111 */
112
113 static int
114 cifs_reconnect(struct TCP_Server_Info *server)
115 {
116 int rc = 0;
117 struct list_head *tmp;
118 struct cifsSesInfo *ses;
119 struct cifsTconInfo *tcon;
120 struct mid_q_entry * mid_entry;
121
122 spin_lock(&GlobalMid_Lock);
123 if(server->tcpStatus == CifsExiting) {
124 /* the demux thread will exit normally
125 next time through the loop */
126 spin_unlock(&GlobalMid_Lock);
127 return rc;
128 } else
129 server->tcpStatus = CifsNeedReconnect;
130 spin_unlock(&GlobalMid_Lock);
131 server->maxBuf = 0;
132
133 cFYI(1, ("Reconnecting tcp session"));
134
135 /* before reconnecting the tcp session, mark the smb session (uid)
136 and the tid bad so they are not used until reconnected */
137 read_lock(&GlobalSMBSeslock);
138 list_for_each(tmp, &GlobalSMBSessionList) {
139 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
140 if (ses->server) {
141 if (ses->server == server) {
142 ses->status = CifsNeedReconnect;
143 ses->ipc_tid = 0;
144 }
145 }
146 /* else tcp and smb sessions need reconnection */
147 }
148 list_for_each(tmp, &GlobalTreeConnectionList) {
149 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
150 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
151 tcon->tidStatus = CifsNeedReconnect;
152 }
153 }
154 read_unlock(&GlobalSMBSeslock);
155 /* do not want to be sending data on a socket we are freeing */
156 down(&server->tcpSem);
157 if(server->ssocket) {
158 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
159 server->ssocket->flags));
160 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
161 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
162 server->ssocket->flags));
163 sock_release(server->ssocket);
164 server->ssocket = NULL;
165 }
166
167 spin_lock(&GlobalMid_Lock);
168 list_for_each(tmp, &server->pending_mid_q) {
169 mid_entry = list_entry(tmp, struct
170 mid_q_entry,
171 qhead);
172 if(mid_entry) {
173 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
174 /* Mark other intransit requests as needing
175 retry so we do not immediately mark the
176 session bad again (ie after we reconnect
177 below) as they timeout too */
178 mid_entry->midState = MID_RETRY_NEEDED;
179 }
180 }
181 }
182 spin_unlock(&GlobalMid_Lock);
183 up(&server->tcpSem);
184
185 while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
186 {
187 try_to_freeze();
188 if(server->protocolType == IPV6) {
189 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
190 } else {
191 rc = ipv4_connect(&server->addr.sockAddr,
192 &server->ssocket,
193 server->workstation_RFC1001_name,
194 server->server_RFC1001_name);
195 }
196 if(rc) {
197 cFYI(1,("reconnect error %d",rc));
198 msleep(3000);
199 } else {
200 atomic_inc(&tcpSesReconnectCount);
201 spin_lock(&GlobalMid_Lock);
202 if(server->tcpStatus != CifsExiting)
203 server->tcpStatus = CifsGood;
204 server->sequence_number = 0;
205 spin_unlock(&GlobalMid_Lock);
206 /* atomic_set(&server->inFlight,0);*/
207 wake_up(&server->response_q);
208 }
209 }
210 return rc;
211 }
212
213 /*
214 return codes:
215 0 not a transact2, or all data present
216 >0 transact2 with that much data missing
217 -EINVAL = invalid transact2
218
219 */
220 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
221 {
222 struct smb_t2_rsp * pSMBt;
223 int total_data_size;
224 int data_in_this_rsp;
225 int remaining;
226
227 if(pSMB->Command != SMB_COM_TRANSACTION2)
228 return 0;
229
230 /* check for plausible wct, bcc and t2 data and parm sizes */
231 /* check for parm and data offset going beyond end of smb */
232 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
233 cFYI(1,("invalid transact2 word count"));
234 return -EINVAL;
235 }
236
237 pSMBt = (struct smb_t2_rsp *)pSMB;
238
239 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
240 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
241
242 remaining = total_data_size - data_in_this_rsp;
243
244 if(remaining == 0)
245 return 0;
246 else if(remaining < 0) {
247 cFYI(1,("total data %d smaller than data in frame %d",
248 total_data_size, data_in_this_rsp));
249 return -EINVAL;
250 } else {
251 cFYI(1,("missing %d bytes from transact2, check next response",
252 remaining));
253 if(total_data_size > maxBufSize) {
254 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
255 total_data_size,maxBufSize));
256 return -EINVAL;
257 }
258 return remaining;
259 }
260 }
261
262 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
263 {
264 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
265 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
266 int total_data_size;
267 int total_in_buf;
268 int remaining;
269 int total_in_buf2;
270 char * data_area_of_target;
271 char * data_area_of_buf2;
272 __u16 byte_count;
273
274 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
275
276 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
277 cFYI(1,("total data sizes of primary and secondary t2 differ"));
278 }
279
280 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
281
282 remaining = total_data_size - total_in_buf;
283
284 if(remaining < 0)
285 return -EINVAL;
286
287 if(remaining == 0) /* nothing to do, ignore */
288 return 0;
289
290 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
291 if(remaining < total_in_buf2) {
292 cFYI(1,("transact2 2nd response contains too much data"));
293 }
294
295 /* find end of first SMB data area */
296 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
297 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
298 /* validate target area */
299
300 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
301 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
302
303 data_area_of_target += total_in_buf;
304
305 /* copy second buffer into end of first buffer */
306 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
307 total_in_buf += total_in_buf2;
308 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
309 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
310 byte_count += total_in_buf2;
311 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
312
313 byte_count = pTargetSMB->smb_buf_length;
314 byte_count += total_in_buf2;
315
316 /* BB also add check that we are not beyond maximum buffer size */
317
318 pTargetSMB->smb_buf_length = byte_count;
319
320 if(remaining == total_in_buf2) {
321 cFYI(1,("found the last secondary response"));
322 return 0; /* we are done */
323 } else /* more responses to go */
324 return 1;
325
326 }
327
328 static int
329 cifs_demultiplex_thread(struct TCP_Server_Info *server)
330 {
331 int length;
332 unsigned int pdu_length, total_read;
333 struct smb_hdr *smb_buffer = NULL;
334 struct smb_hdr *bigbuf = NULL;
335 struct smb_hdr *smallbuf = NULL;
336 struct msghdr smb_msg;
337 struct kvec iov;
338 struct socket *csocket = server->ssocket;
339 struct list_head *tmp;
340 struct cifsSesInfo *ses;
341 struct task_struct *task_to_wake = NULL;
342 struct mid_q_entry *mid_entry;
343 char temp;
344 int isLargeBuf = FALSE;
345 int isMultiRsp;
346 int reconnect;
347
348 daemonize("cifsd");
349 allow_signal(SIGKILL);
350 current->flags |= PF_MEMALLOC;
351 server->tsk = current; /* save process info to wake at shutdown */
352 cFYI(1, ("Demultiplex PID: %d", current->pid));
353 write_lock(&GlobalSMBSeslock);
354 atomic_inc(&tcpSesAllocCount);
355 length = tcpSesAllocCount.counter;
356 write_unlock(&GlobalSMBSeslock);
357 complete(&cifsd_complete);
358 if(length > 1) {
359 mempool_resize(cifs_req_poolp,
360 length + cifs_min_rcv,
361 GFP_KERNEL);
362 }
363
364 while (server->tcpStatus != CifsExiting) {
365 if (try_to_freeze())
366 continue;
367 if (bigbuf == NULL) {
368 bigbuf = cifs_buf_get();
369 if (!bigbuf) {
370 cERROR(1, ("No memory for large SMB response"));
371 msleep(3000);
372 /* retry will check if exiting */
373 continue;
374 }
375 } else if (isLargeBuf) {
376 /* we are reusing a dirty large buf, clear its start */
377 memset(bigbuf, 0, sizeof (struct smb_hdr));
378 }
379
380 if (smallbuf == NULL) {
381 smallbuf = cifs_small_buf_get();
382 if (!smallbuf) {
383 cERROR(1, ("No memory for SMB response"));
384 msleep(1000);
385 /* retry will check if exiting */
386 continue;
387 }
388 /* beginning of smb buffer is cleared in our buf_get */
389 } else /* if existing small buf clear beginning */
390 memset(smallbuf, 0, sizeof (struct smb_hdr));
391
392 isLargeBuf = FALSE;
393 isMultiRsp = FALSE;
394 smb_buffer = smallbuf;
395 iov.iov_base = smb_buffer;
396 iov.iov_len = 4;
397 smb_msg.msg_control = NULL;
398 smb_msg.msg_controllen = 0;
399 length =
400 kernel_recvmsg(csocket, &smb_msg,
401 &iov, 1, 4, 0 /* BB see socket.h flags */);
402
403 if (server->tcpStatus == CifsExiting) {
404 break;
405 } else if (server->tcpStatus == CifsNeedReconnect) {
406 cFYI(1, ("Reconnect after server stopped responding"));
407 cifs_reconnect(server);
408 cFYI(1, ("call to reconnect done"));
409 csocket = server->ssocket;
410 continue;
411 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
412 msleep(1); /* minimum sleep to prevent looping
413 allowing socket to clear and app threads to set
414 tcpStatus CifsNeedReconnect if server hung */
415 continue;
416 } else if (length <= 0) {
417 if (server->tcpStatus == CifsNew) {
418 cFYI(1, ("tcp session abend after SMBnegprot"));
419 /* some servers kill the TCP session rather than
420 returning an SMB negprot error, in which
421 case reconnecting here is not going to help,
422 and so simply return error to mount */
423 break;
424 }
425 if (!try_to_freeze() && (length == -EINTR)) {
426 cFYI(1,("cifsd thread killed"));
427 break;
428 }
429 cFYI(1,("Reconnect after unexpected peek error %d",
430 length));
431 cifs_reconnect(server);
432 csocket = server->ssocket;
433 wake_up(&server->response_q);
434 continue;
435 } else if (length < 4) {
436 cFYI(1,
437 ("Frame under four bytes received (%d bytes long)",
438 length));
439 cifs_reconnect(server);
440 csocket = server->ssocket;
441 wake_up(&server->response_q);
442 continue;
443 }
444
445 /* The right amount was read from socket - 4 bytes */
446 /* so we can now interpret the length field */
447
448 /* the first byte big endian of the length field,
449 is actually not part of the length but the type
450 with the most common, zero, as regular data */
451 temp = *((char *) smb_buffer);
452
453 /* Note that FC 1001 length is big endian on the wire,
454 but we convert it here so it is always manipulated
455 as host byte order */
456 pdu_length = ntohl(smb_buffer->smb_buf_length);
457 smb_buffer->smb_buf_length = pdu_length;
458
459 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
460
461 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
462 continue;
463 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
464 cFYI(1,("Good RFC 1002 session rsp"));
465 continue;
466 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
467 /* we get this from Windows 98 instead of
468 an error on SMB negprot response */
469 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
470 pdu_length));
471 if(server->tcpStatus == CifsNew) {
472 /* if nack on negprot (rather than
473 ret of smb negprot error) reconnecting
474 not going to help, ret error to mount */
475 break;
476 } else {
477 /* give server a second to
478 clean up before reconnect attempt */
479 msleep(1000);
480 /* always try 445 first on reconnect
481 since we get NACK on some if we ever
482 connected to port 139 (the NACK is
483 since we do not begin with RFC1001
484 session initialize frame) */
485 server->addr.sockAddr.sin_port =
486 htons(CIFS_PORT);
487 cifs_reconnect(server);
488 csocket = server->ssocket;
489 wake_up(&server->response_q);
490 continue;
491 }
492 } else if (temp != (char) 0) {
493 cERROR(1,("Unknown RFC 1002 frame"));
494 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
495 length);
496 cifs_reconnect(server);
497 csocket = server->ssocket;
498 continue;
499 }
500
501 /* else we have an SMB response */
502 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
503 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
504 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
505 length, pdu_length+4));
506 cifs_reconnect(server);
507 csocket = server->ssocket;
508 wake_up(&server->response_q);
509 continue;
510 }
511
512 /* else length ok */
513 reconnect = 0;
514
515 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
516 isLargeBuf = TRUE;
517 memcpy(bigbuf, smallbuf, 4);
518 smb_buffer = bigbuf;
519 }
520 length = 0;
521 iov.iov_base = 4 + (char *)smb_buffer;
522 iov.iov_len = pdu_length;
523 for (total_read = 0; total_read < pdu_length;
524 total_read += length) {
525 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
526 pdu_length - total_read, 0);
527 if((server->tcpStatus == CifsExiting) ||
528 (length == -EINTR)) {
529 /* then will exit */
530 reconnect = 2;
531 break;
532 } else if (server->tcpStatus == CifsNeedReconnect) {
533 cifs_reconnect(server);
534 csocket = server->ssocket;
535 /* Reconnect wakes up rspns q */
536 /* Now we will reread sock */
537 reconnect = 1;
538 break;
539 } else if ((length == -ERESTARTSYS) ||
540 (length == -EAGAIN)) {
541 msleep(1); /* minimum sleep to prevent looping,
542 allowing socket to clear and app
543 threads to set tcpStatus
544 CifsNeedReconnect if server hung*/
545 continue;
546 } else if (length <= 0) {
547 cERROR(1,("Received no data, expecting %d",
548 pdu_length - total_read));
549 cifs_reconnect(server);
550 csocket = server->ssocket;
551 reconnect = 1;
552 break;
553 }
554 }
555 if(reconnect == 2)
556 break;
557 else if(reconnect == 1)
558 continue;
559
560 length += 4; /* account for rfc1002 hdr */
561
562
563 dump_smb(smb_buffer, length);
564 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
565 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
566 continue;
567 }
568
569
570 task_to_wake = NULL;
571 spin_lock(&GlobalMid_Lock);
572 list_for_each(tmp, &server->pending_mid_q) {
573 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
574
575 if ((mid_entry->mid == smb_buffer->Mid) &&
576 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
577 (mid_entry->command == smb_buffer->Command)) {
578 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
579 /* We have a multipart transact2 resp */
580 isMultiRsp = TRUE;
581 if(mid_entry->resp_buf) {
582 /* merge response - fix up 1st*/
583 if(coalesce_t2(smb_buffer,
584 mid_entry->resp_buf)) {
585 mid_entry->multiRsp = 1;
586 break;
587 } else {
588 /* all parts received */
589 mid_entry->multiEnd = 1;
590 goto multi_t2_fnd;
591 }
592 } else {
593 if(!isLargeBuf) {
594 cERROR(1,("1st trans2 resp needs bigbuf"));
595 /* BB maybe we can fix this up, switch
596 to already allocated large buffer? */
597 } else {
598 /* Have first buffer */
599 mid_entry->resp_buf =
600 smb_buffer;
601 mid_entry->largeBuf = 1;
602 bigbuf = NULL;
603 }
604 }
605 break;
606 }
607 mid_entry->resp_buf = smb_buffer;
608 if(isLargeBuf)
609 mid_entry->largeBuf = 1;
610 else
611 mid_entry->largeBuf = 0;
612 multi_t2_fnd:
613 task_to_wake = mid_entry->tsk;
614 mid_entry->midState = MID_RESPONSE_RECEIVED;
615 #ifdef CONFIG_CIFS_STATS2
616 mid_entry->when_received = jiffies;
617 #endif
618 /* so we do not time out requests to server
619 which is still responding (since server could
620 be busy but not dead) */
621 server->lstrp = jiffies;
622 break;
623 }
624 }
625 spin_unlock(&GlobalMid_Lock);
626 if (task_to_wake) {
627 /* Was previous buf put in mpx struct for multi-rsp? */
628 if(!isMultiRsp) {
629 /* smb buffer will be freed by user thread */
630 if(isLargeBuf) {
631 bigbuf = NULL;
632 } else
633 smallbuf = NULL;
634 }
635 wake_up_process(task_to_wake);
636 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
637 && (isMultiRsp == FALSE)) {
638 cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
639 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
640 sizeof(struct smb_hdr));
641 #ifdef CONFIG_CIFS_DEBUG2
642 cifs_dump_detail(smb_buffer);
643 cifs_dump_mids(server);
644 #endif /* CIFS_DEBUG2 */
645
646 }
647 } /* end while !EXITING */
648
649 spin_lock(&GlobalMid_Lock);
650 server->tcpStatus = CifsExiting;
651 server->tsk = NULL;
652 /* check if we have blocked requests that need to free */
653 /* Note that cifs_max_pending is normally 50, but
654 can be set at module install time to as little as two */
655 if(atomic_read(&server->inFlight) >= cifs_max_pending)
656 atomic_set(&server->inFlight, cifs_max_pending - 1);
657 /* We do not want to set the max_pending too low or we
658 could end up with the counter going negative */
659 spin_unlock(&GlobalMid_Lock);
660 /* Although there should not be any requests blocked on
661 this queue it can not hurt to be paranoid and try to wake up requests
662 that may haven been blocked when more than 50 at time were on the wire
663 to the same server - they now will see the session is in exit state
664 and get out of SendReceive. */
665 wake_up_all(&server->request_q);
666 /* give those requests time to exit */
667 msleep(125);
668
669 if(server->ssocket) {
670 sock_release(csocket);
671 server->ssocket = NULL;
672 }
673 /* buffer usuallly freed in free_mid - need to free it here on exit */
674 if (bigbuf != NULL)
675 cifs_buf_release(bigbuf);
676 if (smallbuf != NULL)
677 cifs_small_buf_release(smallbuf);
678
679 read_lock(&GlobalSMBSeslock);
680 if (list_empty(&server->pending_mid_q)) {
681 /* loop through server session structures attached to this and
682 mark them dead */
683 list_for_each(tmp, &GlobalSMBSessionList) {
684 ses =
685 list_entry(tmp, struct cifsSesInfo,
686 cifsSessionList);
687 if (ses->server == server) {
688 ses->status = CifsExiting;
689 ses->server = NULL;
690 }
691 }
692 read_unlock(&GlobalSMBSeslock);
693 } else {
694 /* although we can not zero the server struct pointer yet,
695 since there are active requests which may depnd on them,
696 mark the corresponding SMB sessions as exiting too */
697 list_for_each(tmp, &GlobalSMBSessionList) {
698 ses = list_entry(tmp, struct cifsSesInfo,
699 cifsSessionList);
700 if (ses->server == server) {
701 ses->status = CifsExiting;
702 }
703 }
704
705 spin_lock(&GlobalMid_Lock);
706 list_for_each(tmp, &server->pending_mid_q) {
707 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
708 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
709 cFYI(1,
710 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
711 task_to_wake = mid_entry->tsk;
712 if(task_to_wake) {
713 wake_up_process(task_to_wake);
714 }
715 }
716 }
717 spin_unlock(&GlobalMid_Lock);
718 read_unlock(&GlobalSMBSeslock);
719 /* 1/8th of sec is more than enough time for them to exit */
720 msleep(125);
721 }
722
723 if (!list_empty(&server->pending_mid_q)) {
724 /* mpx threads have not exited yet give them
725 at least the smb send timeout time for long ops */
726 /* due to delays on oplock break requests, we need
727 to wait at least 45 seconds before giving up
728 on a request getting a response and going ahead
729 and killing cifsd */
730 cFYI(1, ("Wait for exit from demultiplex thread"));
731 msleep(46000);
732 /* if threads still have not exited they are probably never
733 coming home not much else we can do but free the memory */
734 }
735
736 write_lock(&GlobalSMBSeslock);
737 atomic_dec(&tcpSesAllocCount);
738 length = tcpSesAllocCount.counter;
739
740 /* last chance to mark ses pointers invalid
741 if there are any pointing to this (e.g
742 if a crazy root user tried to kill cifsd
743 kernel thread explicitly this might happen) */
744 list_for_each(tmp, &GlobalSMBSessionList) {
745 ses = list_entry(tmp, struct cifsSesInfo,
746 cifsSessionList);
747 if (ses->server == server) {
748 ses->server = NULL;
749 }
750 }
751 write_unlock(&GlobalSMBSeslock);
752
753 kfree(server);
754 if(length > 0) {
755 mempool_resize(cifs_req_poolp,
756 length + cifs_min_rcv,
757 GFP_KERNEL);
758 }
759
760 complete_and_exit(&cifsd_complete, 0);
761 return 0;
762 }
763
764 static int
765 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
766 {
767 char *value;
768 char *data;
769 unsigned int temp_len, i, j;
770 char separator[2];
771
772 separator[0] = ',';
773 separator[1] = 0;
774
775 if (Local_System_Name[0] != 0)
776 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
777 else {
778 char *nodename = utsname()->nodename;
779 int n = strnlen(nodename,15);
780 memset(vol->source_rfc1001_name,0x20,15);
781 for(i=0 ; i < n ; i++) {
782 /* does not have to be perfect mapping since field is
783 informational, only used for servers that do not support
784 port 445 and it can be overridden at mount time */
785 vol->source_rfc1001_name[i] = toupper(nodename[i]);
786 }
787 }
788 vol->source_rfc1001_name[15] = 0;
789 /* null target name indicates to use *SMBSERVR default called name
790 if we end up sending RFC1001 session initialize */
791 vol->target_rfc1001_name[0] = 0;
792 vol->linux_uid = current->uid; /* current->euid instead? */
793 vol->linux_gid = current->gid;
794 vol->dir_mode = S_IRWXUGO;
795 /* 2767 perms indicate mandatory locking support */
796 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
797
798 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
799 vol->rw = TRUE;
800 /* default is always to request posix paths. */
801 vol->posix_paths = 1;
802
803 if (!options)
804 return 1;
805
806 if(strncmp(options,"sep=",4) == 0) {
807 if(options[4] != 0) {
808 separator[0] = options[4];
809 options += 5;
810 } else {
811 cFYI(1,("Null separator not allowed"));
812 }
813 }
814
815 while ((data = strsep(&options, separator)) != NULL) {
816 if (!*data)
817 continue;
818 if ((value = strchr(data, '=')) != NULL)
819 *value++ = '\0';
820
821 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
822 vol->no_xattr = 0;
823 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
824 vol->no_xattr = 1;
825 } else if (strnicmp(data, "user", 4) == 0) {
826 if (!value) {
827 printk(KERN_WARNING
828 "CIFS: invalid or missing username\n");
829 return 1; /* needs_arg; */
830 } else if(!*value) {
831 /* null user, ie anonymous, authentication */
832 vol->nullauth = 1;
833 }
834 if (strnlen(value, 200) < 200) {
835 vol->username = value;
836 } else {
837 printk(KERN_WARNING "CIFS: username too long\n");
838 return 1;
839 }
840 } else if (strnicmp(data, "pass", 4) == 0) {
841 if (!value) {
842 vol->password = NULL;
843 continue;
844 } else if(value[0] == 0) {
845 /* check if string begins with double comma
846 since that would mean the password really
847 does start with a comma, and would not
848 indicate an empty string */
849 if(value[1] != separator[0]) {
850 vol->password = NULL;
851 continue;
852 }
853 }
854 temp_len = strlen(value);
855 /* removed password length check, NTLM passwords
856 can be arbitrarily long */
857
858 /* if comma in password, the string will be
859 prematurely null terminated. Commas in password are
860 specified across the cifs mount interface by a double
861 comma ie ,, and a comma used as in other cases ie ','
862 as a parameter delimiter/separator is single and due
863 to the strsep above is temporarily zeroed. */
864
865 /* NB: password legally can have multiple commas and
866 the only illegal character in a password is null */
867
868 if ((value[temp_len] == 0) &&
869 (value[temp_len+1] == separator[0])) {
870 /* reinsert comma */
871 value[temp_len] = separator[0];
872 temp_len+=2; /* move after the second comma */
873 while(value[temp_len] != 0) {
874 if (value[temp_len] == separator[0]) {
875 if (value[temp_len+1] ==
876 separator[0]) {
877 /* skip second comma */
878 temp_len++;
879 } else {
880 /* single comma indicating start
881 of next parm */
882 break;
883 }
884 }
885 temp_len++;
886 }
887 if(value[temp_len] == 0) {
888 options = NULL;
889 } else {
890 value[temp_len] = 0;
891 /* point option to start of next parm */
892 options = value + temp_len + 1;
893 }
894 /* go from value to value + temp_len condensing
895 double commas to singles. Note that this ends up
896 allocating a few bytes too many, which is ok */
897 vol->password = kzalloc(temp_len, GFP_KERNEL);
898 if(vol->password == NULL) {
899 printk("CIFS: no memory for pass\n");
900 return 1;
901 }
902 for(i=0,j=0;i<temp_len;i++,j++) {
903 vol->password[j] = value[i];
904 if(value[i] == separator[0]
905 && value[i+1] == separator[0]) {
906 /* skip second comma */
907 i++;
908 }
909 }
910 vol->password[j] = 0;
911 } else {
912 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
913 if(vol->password == NULL) {
914 printk("CIFS: no memory for pass\n");
915 return 1;
916 }
917 strcpy(vol->password, value);
918 }
919 } else if (strnicmp(data, "ip", 2) == 0) {
920 if (!value || !*value) {
921 vol->UNCip = NULL;
922 } else if (strnlen(value, 35) < 35) {
923 vol->UNCip = value;
924 } else {
925 printk(KERN_WARNING "CIFS: ip address too long\n");
926 return 1;
927 }
928 } else if (strnicmp(data, "sec", 3) == 0) {
929 if (!value || !*value) {
930 cERROR(1,("no security value specified"));
931 continue;
932 } else if (strnicmp(value, "krb5i", 5) == 0) {
933 vol->secFlg |= CIFSSEC_MAY_KRB5 |
934 CIFSSEC_MUST_SIGN;
935 } else if (strnicmp(value, "krb5p", 5) == 0) {
936 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
937 CIFSSEC_MAY_KRB5; */
938 cERROR(1,("Krb5 cifs privacy not supported"));
939 return 1;
940 } else if (strnicmp(value, "krb5", 4) == 0) {
941 vol->secFlg |= CIFSSEC_MAY_KRB5;
942 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
943 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
944 CIFSSEC_MUST_SIGN;
945 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
946 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
947 } else if (strnicmp(value, "ntlmi", 5) == 0) {
948 vol->secFlg |= CIFSSEC_MAY_NTLM |
949 CIFSSEC_MUST_SIGN;
950 } else if (strnicmp(value, "ntlm", 4) == 0) {
951 /* ntlm is default so can be turned off too */
952 vol->secFlg |= CIFSSEC_MAY_NTLM;
953 } else if (strnicmp(value, "nontlm", 6) == 0) {
954 /* BB is there a better way to do this? */
955 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
956 #ifdef CONFIG_CIFS_WEAK_PW_HASH
957 } else if (strnicmp(value, "lanman", 6) == 0) {
958 vol->secFlg |= CIFSSEC_MAY_LANMAN;
959 #endif
960 } else if (strnicmp(value, "none", 4) == 0) {
961 vol->nullauth = 1;
962 } else {
963 cERROR(1,("bad security option: %s", value));
964 return 1;
965 }
966 } else if ((strnicmp(data, "unc", 3) == 0)
967 || (strnicmp(data, "target", 6) == 0)
968 || (strnicmp(data, "path", 4) == 0)) {
969 if (!value || !*value) {
970 printk(KERN_WARNING
971 "CIFS: invalid path to network resource\n");
972 return 1; /* needs_arg; */
973 }
974 if ((temp_len = strnlen(value, 300)) < 300) {
975 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
976 if(vol->UNC == NULL)
977 return 1;
978 strcpy(vol->UNC,value);
979 if (strncmp(vol->UNC, "//", 2) == 0) {
980 vol->UNC[0] = '\\';
981 vol->UNC[1] = '\\';
982 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
983 printk(KERN_WARNING
984 "CIFS: UNC Path does not begin with // or \\\\ \n");
985 return 1;
986 }
987 } else {
988 printk(KERN_WARNING "CIFS: UNC name too long\n");
989 return 1;
990 }
991 } else if ((strnicmp(data, "domain", 3) == 0)
992 || (strnicmp(data, "workgroup", 5) == 0)) {
993 if (!value || !*value) {
994 printk(KERN_WARNING "CIFS: invalid domain name\n");
995 return 1; /* needs_arg; */
996 }
997 /* BB are there cases in which a comma can be valid in
998 a domain name and need special handling? */
999 if (strnlen(value, 256) < 256) {
1000 vol->domainname = value;
1001 cFYI(1, ("Domain name set"));
1002 } else {
1003 printk(KERN_WARNING "CIFS: domain name too long\n");
1004 return 1;
1005 }
1006 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1007 if (!value || !*value) {
1008 printk(KERN_WARNING
1009 "CIFS: invalid path prefix\n");
1010 return 1; /* needs_arg; */
1011 }
1012 if ((temp_len = strnlen(value, 1024)) < 1024) {
1013 if(value[0] != '/')
1014 temp_len++; /* missing leading slash */
1015 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1016 if(vol->prepath == NULL)
1017 return 1;
1018 if(value[0] != '/') {
1019 vol->prepath[0] = '/';
1020 strcpy(vol->prepath+1,value);
1021 } else
1022 strcpy(vol->prepath,value);
1023 cFYI(1,("prefix path %s",vol->prepath));
1024 } else {
1025 printk(KERN_WARNING "CIFS: prefix too long\n");
1026 return 1;
1027 }
1028 } else if (strnicmp(data, "iocharset", 9) == 0) {
1029 if (!value || !*value) {
1030 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1031 return 1; /* needs_arg; */
1032 }
1033 if (strnlen(value, 65) < 65) {
1034 if(strnicmp(value,"default",7))
1035 vol->iocharset = value;
1036 /* if iocharset not set load_nls_default used by caller */
1037 cFYI(1, ("iocharset set to %s",value));
1038 } else {
1039 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1040 return 1;
1041 }
1042 } else if (strnicmp(data, "uid", 3) == 0) {
1043 if (value && *value) {
1044 vol->linux_uid =
1045 simple_strtoul(value, &value, 0);
1046 }
1047 } else if (strnicmp(data, "gid", 3) == 0) {
1048 if (value && *value) {
1049 vol->linux_gid =
1050 simple_strtoul(value, &value, 0);
1051 }
1052 } else if (strnicmp(data, "file_mode", 4) == 0) {
1053 if (value && *value) {
1054 vol->file_mode =
1055 simple_strtoul(value, &value, 0);
1056 }
1057 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1058 if (value && *value) {
1059 vol->dir_mode =
1060 simple_strtoul(value, &value, 0);
1061 }
1062 } else if (strnicmp(data, "dirmode", 4) == 0) {
1063 if (value && *value) {
1064 vol->dir_mode =
1065 simple_strtoul(value, &value, 0);
1066 }
1067 } else if (strnicmp(data, "port", 4) == 0) {
1068 if (value && *value) {
1069 vol->port =
1070 simple_strtoul(value, &value, 0);
1071 }
1072 } else if (strnicmp(data, "rsize", 5) == 0) {
1073 if (value && *value) {
1074 vol->rsize =
1075 simple_strtoul(value, &value, 0);
1076 }
1077 } else if (strnicmp(data, "wsize", 5) == 0) {
1078 if (value && *value) {
1079 vol->wsize =
1080 simple_strtoul(value, &value, 0);
1081 }
1082 } else if (strnicmp(data, "sockopt", 5) == 0) {
1083 if (value && *value) {
1084 vol->sockopt =
1085 simple_strtoul(value, &value, 0);
1086 }
1087 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1088 if (!value || !*value || (*value == ' ')) {
1089 cFYI(1,("invalid (empty) netbiosname specified"));
1090 } else {
1091 memset(vol->source_rfc1001_name,0x20,15);
1092 for(i=0;i<15;i++) {
1093 /* BB are there cases in which a comma can be
1094 valid in this workstation netbios name (and need
1095 special handling)? */
1096
1097 /* We do not uppercase netbiosname for user */
1098 if (value[i]==0)
1099 break;
1100 else
1101 vol->source_rfc1001_name[i] = value[i];
1102 }
1103 /* The string has 16th byte zero still from
1104 set at top of the function */
1105 if((i==15) && (value[i] != 0))
1106 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1107 }
1108 } else if (strnicmp(data, "servern", 7) == 0) {
1109 /* servernetbiosname specified override *SMBSERVER */
1110 if (!value || !*value || (*value == ' ')) {
1111 cFYI(1,("empty server netbiosname specified"));
1112 } else {
1113 /* last byte, type, is 0x20 for servr type */
1114 memset(vol->target_rfc1001_name,0x20,16);
1115
1116 for(i=0;i<15;i++) {
1117 /* BB are there cases in which a comma can be
1118 valid in this workstation netbios name (and need
1119 special handling)? */
1120
1121 /* user or mount helper must uppercase netbiosname */
1122 if (value[i]==0)
1123 break;
1124 else
1125 vol->target_rfc1001_name[i] = value[i];
1126 }
1127 /* The string has 16th byte zero still from
1128 set at top of the function */
1129 if((i==15) && (value[i] != 0))
1130 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1131 }
1132 } else if (strnicmp(data, "credentials", 4) == 0) {
1133 /* ignore */
1134 } else if (strnicmp(data, "version", 3) == 0) {
1135 /* ignore */
1136 } else if (strnicmp(data, "guest",5) == 0) {
1137 /* ignore */
1138 } else if (strnicmp(data, "rw", 2) == 0) {
1139 vol->rw = TRUE;
1140 } else if ((strnicmp(data, "suid", 4) == 0) ||
1141 (strnicmp(data, "nosuid", 6) == 0) ||
1142 (strnicmp(data, "exec", 4) == 0) ||
1143 (strnicmp(data, "noexec", 6) == 0) ||
1144 (strnicmp(data, "nodev", 5) == 0) ||
1145 (strnicmp(data, "noauto", 6) == 0) ||
1146 (strnicmp(data, "dev", 3) == 0)) {
1147 /* The mount tool or mount.cifs helper (if present)
1148 uses these opts to set flags, and the flags are read
1149 by the kernel vfs layer before we get here (ie
1150 before read super) so there is no point trying to
1151 parse these options again and set anything and it
1152 is ok to just ignore them */
1153 continue;
1154 } else if (strnicmp(data, "ro", 2) == 0) {
1155 vol->rw = FALSE;
1156 } else if (strnicmp(data, "hard", 4) == 0) {
1157 vol->retry = 1;
1158 } else if (strnicmp(data, "soft", 4) == 0) {
1159 vol->retry = 0;
1160 } else if (strnicmp(data, "perm", 4) == 0) {
1161 vol->noperm = 0;
1162 } else if (strnicmp(data, "noperm", 6) == 0) {
1163 vol->noperm = 1;
1164 } else if (strnicmp(data, "mapchars", 8) == 0) {
1165 vol->remap = 1;
1166 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1167 vol->remap = 0;
1168 } else if (strnicmp(data, "sfu", 3) == 0) {
1169 vol->sfu_emul = 1;
1170 } else if (strnicmp(data, "nosfu", 5) == 0) {
1171 vol->sfu_emul = 0;
1172 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1173 vol->posix_paths = 1;
1174 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1175 vol->posix_paths = 0;
1176 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1177 (strnicmp(data, "ignorecase", 10) == 0)) {
1178 vol->nocase = 1;
1179 } else if (strnicmp(data, "brl", 3) == 0) {
1180 vol->nobrl = 0;
1181 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1182 (strnicmp(data, "nolock", 6) == 0)) {
1183 vol->nobrl = 1;
1184 /* turn off mandatory locking in mode
1185 if remote locking is turned off since the
1186 local vfs will do advisory */
1187 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1188 vol->file_mode = S_IALLUGO;
1189 } else if (strnicmp(data, "setuids", 7) == 0) {
1190 vol->setuids = 1;
1191 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1192 vol->setuids = 0;
1193 } else if (strnicmp(data, "nohard", 6) == 0) {
1194 vol->retry = 0;
1195 } else if (strnicmp(data, "nosoft", 6) == 0) {
1196 vol->retry = 1;
1197 } else if (strnicmp(data, "nointr", 6) == 0) {
1198 vol->intr = 0;
1199 } else if (strnicmp(data, "intr", 4) == 0) {
1200 vol->intr = 1;
1201 } else if (strnicmp(data, "serverino",7) == 0) {
1202 vol->server_ino = 1;
1203 } else if (strnicmp(data, "noserverino",9) == 0) {
1204 vol->server_ino = 0;
1205 } else if (strnicmp(data, "cifsacl",7) == 0) {
1206 vol->cifs_acl = 1;
1207 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1208 vol->cifs_acl = 0;
1209 } else if (strnicmp(data, "acl",3) == 0) {
1210 vol->no_psx_acl = 0;
1211 } else if (strnicmp(data, "noacl",5) == 0) {
1212 vol->no_psx_acl = 1;
1213 } else if (strnicmp(data, "sign",4) == 0) {
1214 vol->secFlg |= CIFSSEC_MUST_SIGN;
1215 /* } else if (strnicmp(data, "seal",4) == 0) {
1216 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1217 } else if (strnicmp(data, "direct",6) == 0) {
1218 vol->direct_io = 1;
1219 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1220 vol->direct_io = 1;
1221 } else if (strnicmp(data, "in6_addr",8) == 0) {
1222 if (!value || !*value) {
1223 vol->in6_addr = NULL;
1224 } else if (strnlen(value, 49) == 48) {
1225 vol->in6_addr = value;
1226 } else {
1227 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1228 return 1;
1229 }
1230 } else if (strnicmp(data, "noac", 4) == 0) {
1231 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1232 } else
1233 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1234 }
1235 if (vol->UNC == NULL) {
1236 if(devname == NULL) {
1237 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1238 return 1;
1239 }
1240 if ((temp_len = strnlen(devname, 300)) < 300) {
1241 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1242 if(vol->UNC == NULL)
1243 return 1;
1244 strcpy(vol->UNC,devname);
1245 if (strncmp(vol->UNC, "//", 2) == 0) {
1246 vol->UNC[0] = '\\';
1247 vol->UNC[1] = '\\';
1248 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1249 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1250 return 1;
1251 }
1252 } else {
1253 printk(KERN_WARNING "CIFS: UNC name too long\n");
1254 return 1;
1255 }
1256 }
1257 if(vol->UNCip == NULL)
1258 vol->UNCip = &vol->UNC[2];
1259
1260 return 0;
1261 }
1262
1263 static struct cifsSesInfo *
1264 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1265 struct in6_addr *target_ip6_addr,
1266 char *userName, struct TCP_Server_Info **psrvTcp)
1267 {
1268 struct list_head *tmp;
1269 struct cifsSesInfo *ses;
1270 *psrvTcp = NULL;
1271 read_lock(&GlobalSMBSeslock);
1272
1273 list_for_each(tmp, &GlobalSMBSessionList) {
1274 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1275 if (ses->server) {
1276 if((target_ip_addr &&
1277 (ses->server->addr.sockAddr.sin_addr.s_addr
1278 == target_ip_addr->s_addr)) || (target_ip6_addr
1279 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1280 target_ip6_addr,sizeof(*target_ip6_addr)))){
1281 /* BB lock server and tcp session and increment use count here?? */
1282 *psrvTcp = ses->server; /* found a match on the TCP session */
1283 /* BB check if reconnection needed */
1284 if (strncmp
1285 (ses->userName, userName,
1286 MAX_USERNAME_SIZE) == 0){
1287 read_unlock(&GlobalSMBSeslock);
1288 return ses; /* found exact match on both tcp and SMB sessions */
1289 }
1290 }
1291 }
1292 /* else tcp and smb sessions need reconnection */
1293 }
1294 read_unlock(&GlobalSMBSeslock);
1295 return NULL;
1296 }
1297
1298 static struct cifsTconInfo *
1299 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1300 {
1301 struct list_head *tmp;
1302 struct cifsTconInfo *tcon;
1303
1304 read_lock(&GlobalSMBSeslock);
1305 list_for_each(tmp, &GlobalTreeConnectionList) {
1306 cFYI(1, ("Next tcon"));
1307 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1308 if (tcon->ses) {
1309 if (tcon->ses->server) {
1310 cFYI(1,
1311 ("old ip addr: %x == new ip %x ?",
1312 tcon->ses->server->addr.sockAddr.sin_addr.
1313 s_addr, new_target_ip_addr));
1314 if (tcon->ses->server->addr.sockAddr.sin_addr.
1315 s_addr == new_target_ip_addr) {
1316 /* BB lock tcon, server and tcp session and increment use count here? */
1317 /* found a match on the TCP session */
1318 /* BB check if reconnection needed */
1319 cFYI(1,("IP match, old UNC: %s new: %s",
1320 tcon->treeName, uncName));
1321 if (strncmp
1322 (tcon->treeName, uncName,
1323 MAX_TREE_SIZE) == 0) {
1324 cFYI(1,
1325 ("and old usr: %s new: %s",
1326 tcon->treeName, uncName));
1327 if (strncmp
1328 (tcon->ses->userName,
1329 userName,
1330 MAX_USERNAME_SIZE) == 0) {
1331 read_unlock(&GlobalSMBSeslock);
1332 /* matched smb session
1333 (user name */
1334 return tcon;
1335 }
1336 }
1337 }
1338 }
1339 }
1340 }
1341 read_unlock(&GlobalSMBSeslock);
1342 return NULL;
1343 }
1344
1345 int
1346 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1347 const char *old_path, const struct nls_table *nls_codepage,
1348 int remap)
1349 {
1350 unsigned char *referrals = NULL;
1351 unsigned int num_referrals;
1352 int rc = 0;
1353
1354 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1355 &num_referrals, &referrals, remap);
1356
1357 /* BB Add in code to: if valid refrl, if not ip address contact
1358 the helper that resolves tcp names, mount to it, try to
1359 tcon to it unmount it if fail */
1360
1361 kfree(referrals);
1362
1363 return rc;
1364 }
1365
1366 int
1367 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1368 const char *old_path, const struct nls_table *nls_codepage,
1369 unsigned int *pnum_referrals,
1370 unsigned char ** preferrals, int remap)
1371 {
1372 char *temp_unc;
1373 int rc = 0;
1374
1375 *pnum_referrals = 0;
1376
1377 if (pSesInfo->ipc_tid == 0) {
1378 temp_unc = kmalloc(2 /* for slashes */ +
1379 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1380 + 1 + 4 /* slash IPC$ */ + 2,
1381 GFP_KERNEL);
1382 if (temp_unc == NULL)
1383 return -ENOMEM;
1384 temp_unc[0] = '\\';
1385 temp_unc[1] = '\\';
1386 strcpy(temp_unc + 2, pSesInfo->serverName);
1387 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1388 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1389 cFYI(1,
1390 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1391 kfree(temp_unc);
1392 }
1393 if (rc == 0)
1394 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1395 pnum_referrals, nls_codepage, remap);
1396
1397 return rc;
1398 }
1399
1400 /* See RFC1001 section 14 on representation of Netbios names */
1401 static void rfc1002mangle(char * target,char * source, unsigned int length)
1402 {
1403 unsigned int i,j;
1404
1405 for(i=0,j=0;i<(length);i++) {
1406 /* mask a nibble at a time and encode */
1407 target[j] = 'A' + (0x0F & (source[i] >> 4));
1408 target[j+1] = 'A' + (0x0F & source[i]);
1409 j+=2;
1410 }
1411
1412 }
1413
1414
1415 static int
1416 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1417 char * netbios_name, char * target_name)
1418 {
1419 int rc = 0;
1420 int connected = 0;
1421 __be16 orig_port = 0;
1422
1423 if(*csocket == NULL) {
1424 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1425 if (rc < 0) {
1426 cERROR(1, ("Error %d creating socket",rc));
1427 *csocket = NULL;
1428 return rc;
1429 } else {
1430 /* BB other socket options to set KEEPALIVE, NODELAY? */
1431 cFYI(1,("Socket created"));
1432 (*csocket)->sk->sk_allocation = GFP_NOFS;
1433 }
1434 }
1435
1436 psin_server->sin_family = AF_INET;
1437 if(psin_server->sin_port) { /* user overrode default port */
1438 rc = (*csocket)->ops->connect(*csocket,
1439 (struct sockaddr *) psin_server,
1440 sizeof (struct sockaddr_in),0);
1441 if (rc >= 0)
1442 connected = 1;
1443 }
1444
1445 if(!connected) {
1446 /* save original port so we can retry user specified port
1447 later if fall back ports fail this time */
1448 orig_port = psin_server->sin_port;
1449
1450 /* do not retry on the same port we just failed on */
1451 if(psin_server->sin_port != htons(CIFS_PORT)) {
1452 psin_server->sin_port = htons(CIFS_PORT);
1453
1454 rc = (*csocket)->ops->connect(*csocket,
1455 (struct sockaddr *) psin_server,
1456 sizeof (struct sockaddr_in),0);
1457 if (rc >= 0)
1458 connected = 1;
1459 }
1460 }
1461 if (!connected) {
1462 psin_server->sin_port = htons(RFC1001_PORT);
1463 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1464 psin_server, sizeof (struct sockaddr_in),0);
1465 if (rc >= 0)
1466 connected = 1;
1467 }
1468
1469 /* give up here - unless we want to retry on different
1470 protocol families some day */
1471 if (!connected) {
1472 if(orig_port)
1473 psin_server->sin_port = orig_port;
1474 cFYI(1,("Error %d connecting to server via ipv4",rc));
1475 sock_release(*csocket);
1476 *csocket = NULL;
1477 return rc;
1478 }
1479 /* Eventually check for other socket options to change from
1480 the default. sock_setsockopt not used because it expects
1481 user space buffer */
1482 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1483 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1484 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1485 /* make the bufsizes depend on wsize/rsize and max requests */
1486 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1487 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1488 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1489 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1490
1491 /* send RFC1001 sessinit */
1492 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1493 /* some servers require RFC1001 sessinit before sending
1494 negprot - BB check reconnection in case where second
1495 sessinit is sent but no second negprot */
1496 struct rfc1002_session_packet * ses_init_buf;
1497 struct smb_hdr * smb_buf;
1498 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1499 if(ses_init_buf) {
1500 ses_init_buf->trailer.session_req.called_len = 32;
1501 if(target_name && (target_name[0] != 0)) {
1502 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1503 target_name, 16);
1504 } else {
1505 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1506 DEFAULT_CIFS_CALLED_NAME,16);
1507 }
1508
1509 ses_init_buf->trailer.session_req.calling_len = 32;
1510 /* calling name ends in null (byte 16) from old smb
1511 convention. */
1512 if(netbios_name && (netbios_name[0] !=0)) {
1513 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1514 netbios_name,16);
1515 } else {
1516 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1517 "LINUX_CIFS_CLNT",16);
1518 }
1519 ses_init_buf->trailer.session_req.scope1 = 0;
1520 ses_init_buf->trailer.session_req.scope2 = 0;
1521 smb_buf = (struct smb_hdr *)ses_init_buf;
1522 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1523 smb_buf->smb_buf_length = 0x81000044;
1524 rc = smb_send(*csocket, smb_buf, 0x44,
1525 (struct sockaddr *)psin_server);
1526 kfree(ses_init_buf);
1527 msleep(1); /* RFC1001 layer in at least one server
1528 requires very short break before negprot
1529 presumably because not expecting negprot
1530 to follow so fast. This is a simple
1531 solution that works without
1532 complicating the code and causes no
1533 significant slowing down on mount
1534 for everyone else */
1535 }
1536 /* else the negprot may still work without this
1537 even though malloc failed */
1538
1539 }
1540
1541 return rc;
1542 }
1543
1544 static int
1545 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1546 {
1547 int rc = 0;
1548 int connected = 0;
1549 __be16 orig_port = 0;
1550
1551 if(*csocket == NULL) {
1552 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1553 if (rc < 0) {
1554 cERROR(1, ("Error %d creating ipv6 socket",rc));
1555 *csocket = NULL;
1556 return rc;
1557 } else {
1558 /* BB other socket options to set KEEPALIVE, NODELAY? */
1559 cFYI(1,("ipv6 Socket created"));
1560 (*csocket)->sk->sk_allocation = GFP_NOFS;
1561 }
1562 }
1563
1564 psin_server->sin6_family = AF_INET6;
1565
1566 if(psin_server->sin6_port) { /* user overrode default port */
1567 rc = (*csocket)->ops->connect(*csocket,
1568 (struct sockaddr *) psin_server,
1569 sizeof (struct sockaddr_in6),0);
1570 if (rc >= 0)
1571 connected = 1;
1572 }
1573
1574 if(!connected) {
1575 /* save original port so we can retry user specified port
1576 later if fall back ports fail this time */
1577
1578 orig_port = psin_server->sin6_port;
1579 /* do not retry on the same port we just failed on */
1580 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1581 psin_server->sin6_port = htons(CIFS_PORT);
1582
1583 rc = (*csocket)->ops->connect(*csocket,
1584 (struct sockaddr *) psin_server,
1585 sizeof (struct sockaddr_in6),0);
1586 if (rc >= 0)
1587 connected = 1;
1588 }
1589 }
1590 if (!connected) {
1591 psin_server->sin6_port = htons(RFC1001_PORT);
1592 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1593 psin_server, sizeof (struct sockaddr_in6),0);
1594 if (rc >= 0)
1595 connected = 1;
1596 }
1597
1598 /* give up here - unless we want to retry on different
1599 protocol families some day */
1600 if (!connected) {
1601 if(orig_port)
1602 psin_server->sin6_port = orig_port;
1603 cFYI(1,("Error %d connecting to server via ipv6",rc));
1604 sock_release(*csocket);
1605 *csocket = NULL;
1606 return rc;
1607 }
1608 /* Eventually check for other socket options to change from
1609 the default. sock_setsockopt not used because it expects
1610 user space buffer */
1611 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1612
1613 return rc;
1614 }
1615
1616 int
1617 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1618 char *mount_data, const char *devname)
1619 {
1620 int rc = 0;
1621 int xid;
1622 int address_type = AF_INET;
1623 struct socket *csocket = NULL;
1624 struct sockaddr_in sin_server;
1625 struct sockaddr_in6 sin_server6;
1626 struct smb_vol volume_info;
1627 struct cifsSesInfo *pSesInfo = NULL;
1628 struct cifsSesInfo *existingCifsSes = NULL;
1629 struct cifsTconInfo *tcon = NULL;
1630 struct TCP_Server_Info *srvTcp = NULL;
1631
1632 xid = GetXid();
1633
1634 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1635
1636 memset(&volume_info,0,sizeof(struct smb_vol));
1637 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1638 kfree(volume_info.UNC);
1639 kfree(volume_info.password);
1640 kfree(volume_info.prepath);
1641 FreeXid(xid);
1642 return -EINVAL;
1643 }
1644
1645 if (volume_info.username) {
1646 /* BB fixme parse for domain name here */
1647 cFYI(1, ("Username: %s ", volume_info.username));
1648
1649 } else if (volume_info.nullauth) {
1650 cFYI(1,("null user"));
1651 } else {
1652 cifserror("No username specified");
1653 /* In userspace mount helper we can get user name from alternate
1654 locations such as env variables and files on disk */
1655 kfree(volume_info.UNC);
1656 kfree(volume_info.password);
1657 kfree(volume_info.prepath);
1658 FreeXid(xid);
1659 return -EINVAL;
1660 }
1661
1662 if (volume_info.UNCip && volume_info.UNC) {
1663 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1664
1665 if(rc <= 0) {
1666 /* not ipv4 address, try ipv6 */
1667 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1668 if(rc > 0)
1669 address_type = AF_INET6;
1670 } else {
1671 address_type = AF_INET;
1672 }
1673
1674 if(rc <= 0) {
1675 /* we failed translating address */
1676 kfree(volume_info.UNC);
1677 kfree(volume_info.password);
1678 kfree(volume_info.prepath);
1679 FreeXid(xid);
1680 return -EINVAL;
1681 }
1682
1683 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1684 /* success */
1685 rc = 0;
1686 } else if (volume_info.UNCip){
1687 /* BB using ip addr as server name connect to the DFS root below */
1688 cERROR(1,("Connecting to DFS root not implemented yet"));
1689 kfree(volume_info.UNC);
1690 kfree(volume_info.password);
1691 kfree(volume_info.prepath);
1692 FreeXid(xid);
1693 return -EINVAL;
1694 } else /* which servers DFS root would we conect to */ {
1695 cERROR(1,
1696 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1697 kfree(volume_info.UNC);
1698 kfree(volume_info.password);
1699 kfree(volume_info.prepath);
1700 FreeXid(xid);
1701 return -EINVAL;
1702 }
1703
1704 /* this is needed for ASCII cp to Unicode converts */
1705 if(volume_info.iocharset == NULL) {
1706 cifs_sb->local_nls = load_nls_default();
1707 /* load_nls_default can not return null */
1708 } else {
1709 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1710 if(cifs_sb->local_nls == NULL) {
1711 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1712 kfree(volume_info.UNC);
1713 kfree(volume_info.password);
1714 kfree(volume_info.prepath);
1715 FreeXid(xid);
1716 return -ELIBACC;
1717 }
1718 }
1719
1720 if(address_type == AF_INET)
1721 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1722 NULL /* no ipv6 addr */,
1723 volume_info.username, &srvTcp);
1724 else if(address_type == AF_INET6)
1725 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1726 &sin_server6.sin6_addr,
1727 volume_info.username, &srvTcp);
1728 else {
1729 kfree(volume_info.UNC);
1730 kfree(volume_info.password);
1731 kfree(volume_info.prepath);
1732 FreeXid(xid);
1733 return -EINVAL;
1734 }
1735
1736
1737 if (srvTcp) {
1738 cFYI(1, ("Existing tcp session with server found"));
1739 } else { /* create socket */
1740 if(volume_info.port)
1741 sin_server.sin_port = htons(volume_info.port);
1742 else
1743 sin_server.sin_port = 0;
1744 rc = ipv4_connect(&sin_server,&csocket,
1745 volume_info.source_rfc1001_name,
1746 volume_info.target_rfc1001_name);
1747 if (rc < 0) {
1748 cERROR(1,
1749 ("Error connecting to IPv4 socket. Aborting operation"));
1750 if(csocket != NULL)
1751 sock_release(csocket);
1752 kfree(volume_info.UNC);
1753 kfree(volume_info.password);
1754 kfree(volume_info.prepath);
1755 FreeXid(xid);
1756 return rc;
1757 }
1758
1759 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1760 if (srvTcp == NULL) {
1761 rc = -ENOMEM;
1762 sock_release(csocket);
1763 kfree(volume_info.UNC);
1764 kfree(volume_info.password);
1765 kfree(volume_info.prepath);
1766 FreeXid(xid);
1767 return rc;
1768 } else {
1769 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1770 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1771 atomic_set(&srvTcp->inFlight,0);
1772 /* BB Add code for ipv6 case too */
1773 srvTcp->ssocket = csocket;
1774 srvTcp->protocolType = IPV4;
1775 init_waitqueue_head(&srvTcp->response_q);
1776 init_waitqueue_head(&srvTcp->request_q);
1777 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1778 /* at this point we are the only ones with the pointer
1779 to the struct since the kernel thread not created yet
1780 so no need to spinlock this init of tcpStatus */
1781 srvTcp->tcpStatus = CifsNew;
1782 init_MUTEX(&srvTcp->tcpSem);
1783 rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1784 CLONE_FS | CLONE_FILES | CLONE_VM);
1785 if(rc < 0) {
1786 rc = -ENOMEM;
1787 sock_release(csocket);
1788 kfree(volume_info.UNC);
1789 kfree(volume_info.password);
1790 kfree(volume_info.prepath);
1791 FreeXid(xid);
1792 return rc;
1793 }
1794 wait_for_completion(&cifsd_complete);
1795 rc = 0;
1796 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1797 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1798 srvTcp->sequence_number = 0;
1799 }
1800 }
1801
1802 if (existingCifsSes) {
1803 pSesInfo = existingCifsSes;
1804 cFYI(1, ("Existing smb sess found"));
1805 kfree(volume_info.password);
1806 /* volume_info.UNC freed at end of function */
1807 } else if (!rc) {
1808 cFYI(1, ("Existing smb sess not found"));
1809 pSesInfo = sesInfoAlloc();
1810 if (pSesInfo == NULL)
1811 rc = -ENOMEM;
1812 else {
1813 pSesInfo->server = srvTcp;
1814 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1815 NIPQUAD(sin_server.sin_addr.s_addr));
1816 }
1817
1818 if (!rc){
1819 /* volume_info.password freed at unmount */
1820 if (volume_info.password)
1821 pSesInfo->password = volume_info.password;
1822 if (volume_info.username)
1823 strncpy(pSesInfo->userName,
1824 volume_info.username,MAX_USERNAME_SIZE);
1825 if (volume_info.domainname) {
1826 int len = strlen(volume_info.domainname);
1827 pSesInfo->domainName =
1828 kmalloc(len + 1, GFP_KERNEL);
1829 if(pSesInfo->domainName)
1830 strcpy(pSesInfo->domainName,
1831 volume_info.domainname);
1832 }
1833 pSesInfo->linux_uid = volume_info.linux_uid;
1834 pSesInfo->overrideSecFlg = volume_info.secFlg;
1835 down(&pSesInfo->sesSem);
1836 /* BB FIXME need to pass vol->secFlgs BB */
1837 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1838 up(&pSesInfo->sesSem);
1839 if(!rc)
1840 atomic_inc(&srvTcp->socketUseCount);
1841 } else
1842 kfree(volume_info.password);
1843 }
1844
1845 /* search for existing tcon to this server share */
1846 if (!rc) {
1847 if(volume_info.rsize > CIFSMaxBufSize) {
1848 cERROR(1,("rsize %d too large, using MaxBufSize",
1849 volume_info.rsize));
1850 cifs_sb->rsize = CIFSMaxBufSize;
1851 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1852 cifs_sb->rsize = volume_info.rsize;
1853 else /* default */
1854 cifs_sb->rsize = CIFSMaxBufSize;
1855
1856 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1857 cERROR(1,("wsize %d too large using 4096 instead",
1858 volume_info.wsize));
1859 cifs_sb->wsize = 4096;
1860 } else if(volume_info.wsize)
1861 cifs_sb->wsize = volume_info.wsize;
1862 else
1863 cifs_sb->wsize =
1864 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1865 127*1024);
1866 /* old default of CIFSMaxBufSize was too small now
1867 that SMB Write2 can send multiple pages in kvec.
1868 RFC1001 does not describe what happens when frame
1869 bigger than 128K is sent so use that as max in
1870 conjunction with 52K kvec constraint on arch with 4K
1871 page size */
1872
1873 if(cifs_sb->rsize < 2048) {
1874 cifs_sb->rsize = 2048;
1875 /* Windows ME may prefer this */
1876 cFYI(1,("readsize set to minimum 2048"));
1877 }
1878 /* calculate prepath */
1879 cifs_sb->prepath = volume_info.prepath;
1880 if(cifs_sb->prepath) {
1881 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1882 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1883 volume_info.prepath = NULL;
1884 } else
1885 cifs_sb->prepathlen = 0;
1886 cifs_sb->mnt_uid = volume_info.linux_uid;
1887 cifs_sb->mnt_gid = volume_info.linux_gid;
1888 cifs_sb->mnt_file_mode = volume_info.file_mode;
1889 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1890 cFYI(1,("file mode: 0x%x dir mode: 0x%x",
1891 cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1892
1893 if(volume_info.noperm)
1894 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1895 if(volume_info.setuids)
1896 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1897 if(volume_info.server_ino)
1898 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1899 if(volume_info.remap)
1900 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1901 if(volume_info.no_xattr)
1902 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1903 if(volume_info.sfu_emul)
1904 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1905 if(volume_info.nobrl)
1906 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1907 if(volume_info.cifs_acl)
1908 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1909
1910 if(volume_info.direct_io) {
1911 cFYI(1,("mounting share using direct i/o"));
1912 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1913 }
1914
1915 tcon =
1916 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1917 volume_info.username);
1918 if (tcon) {
1919 cFYI(1, ("Found match on UNC path"));
1920 /* we can have only one retry value for a connection
1921 to a share so for resources mounted more than once
1922 to the same server share the last value passed in
1923 for the retry flag is used */
1924 tcon->retry = volume_info.retry;
1925 tcon->nocase = volume_info.nocase;
1926 } else {
1927 tcon = tconInfoAlloc();
1928 if (tcon == NULL)
1929 rc = -ENOMEM;
1930 else {
1931 /* check for null share name ie connect to dfs root */
1932
1933 /* BB check if this works for exactly length three strings */
1934 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
1935 && (strchr(volume_info.UNC + 3, '/') ==
1936 NULL)) {
1937 rc = connect_to_dfs_path(xid, pSesInfo,
1938 "", cifs_sb->local_nls,
1939 cifs_sb->mnt_cifs_flags &
1940 CIFS_MOUNT_MAP_SPECIAL_CHR);
1941 kfree(volume_info.UNC);
1942 FreeXid(xid);
1943 return -ENODEV;
1944 } else {
1945 rc = CIFSTCon(xid, pSesInfo,
1946 volume_info.UNC,
1947 tcon, cifs_sb->local_nls);
1948 cFYI(1, ("CIFS Tcon rc = %d", rc));
1949 }
1950 if (!rc) {
1951 atomic_inc(&pSesInfo->inUse);
1952 tcon->retry = volume_info.retry;
1953 tcon->nocase = volume_info.nocase;
1954 }
1955 }
1956 }
1957 }
1958 if(pSesInfo) {
1959 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
1960 sb->s_maxbytes = (u64) 1 << 63;
1961 } else
1962 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
1963 }
1964
1965 sb->s_time_gran = 100;
1966
1967 /* on error free sesinfo and tcon struct if needed */
1968 if (rc) {
1969 /* if session setup failed, use count is zero but
1970 we still need to free cifsd thread */
1971 if(atomic_read(&srvTcp->socketUseCount) == 0) {
1972 spin_lock(&GlobalMid_Lock);
1973 srvTcp->tcpStatus = CifsExiting;
1974 spin_unlock(&GlobalMid_Lock);
1975 if(srvTcp->tsk) {
1976 send_sig(SIGKILL,srvTcp->tsk,1);
1977 wait_for_completion(&cifsd_complete);
1978 }
1979 }
1980 /* If find_unc succeeded then rc == 0 so we can not end */
1981 if (tcon) /* up accidently freeing someone elses tcon struct */
1982 tconInfoFree(tcon);
1983 if (existingCifsSes == NULL) {
1984 if (pSesInfo) {
1985 if ((pSesInfo->server) &&
1986 (pSesInfo->status == CifsGood)) {
1987 int temp_rc;
1988 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
1989 /* if the socketUseCount is now zero */
1990 if((temp_rc == -ESHUTDOWN) &&
1991 (pSesInfo->server->tsk)) {
1992 send_sig(SIGKILL,pSesInfo->server->tsk,1);
1993 wait_for_completion(&cifsd_complete);
1994 }
1995 } else
1996 cFYI(1, ("No session or bad tcon"));
1997 sesInfoFree(pSesInfo);
1998 /* pSesInfo = NULL; */
1999 }
2000 }
2001 } else {
2002 atomic_inc(&tcon->useCount);
2003 cifs_sb->tcon = tcon;
2004 tcon->ses = pSesInfo;
2005
2006 /* do not care if following two calls succeed - informational */
2007 CIFSSMBQFSDeviceInfo(xid, tcon);
2008 CIFSSMBQFSAttributeInfo(xid, tcon);
2009
2010 if (tcon->ses->capabilities & CAP_UNIX) {
2011 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
2012 __u64 cap =
2013 le64_to_cpu(tcon->fsUnixInfo.Capability);
2014 cap &= CIFS_UNIX_CAP_MASK;
2015 if(volume_info.no_psx_acl)
2016 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2017 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
2018 cFYI(1,("negotiated posix acl support"));
2019 sb->s_flags |= MS_POSIXACL;
2020 }
2021
2022 if(volume_info.posix_paths == 0)
2023 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2024 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2025 cFYI(1,("negotiate posix pathnames"));
2026 cifs_sb->mnt_cifs_flags |=
2027 CIFS_MOUNT_POSIX_PATHS;
2028 }
2029
2030 cFYI(1,("Negotiate caps 0x%x",(int)cap));
2031 #ifdef CONFIG_CIFS_DEBUG2
2032 if(cap & CIFS_UNIX_FCNTL_CAP)
2033 cFYI(1,("FCNTL cap"));
2034 if(cap & CIFS_UNIX_EXTATTR_CAP)
2035 cFYI(1,("EXTATTR cap"));
2036 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2037 cFYI(1,("POSIX path cap"));
2038 if(cap & CIFS_UNIX_XATTR_CAP)
2039 cFYI(1,("XATTR cap"));
2040 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
2041 cFYI(1,("POSIX ACL cap"));
2042 #endif /* CIFS_DEBUG2 */
2043 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2044 cFYI(1,("setting capabilities failed"));
2045 }
2046 }
2047 }
2048 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2049 cifs_sb->wsize = min(cifs_sb->wsize,
2050 (tcon->ses->server->maxBuf -
2051 MAX_CIFS_HDR_SIZE));
2052 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2053 cifs_sb->rsize = min(cifs_sb->rsize,
2054 (tcon->ses->server->maxBuf -
2055 MAX_CIFS_HDR_SIZE));
2056 }
2057
2058 /* volume_info.password is freed above when existing session found
2059 (in which case it is not needed anymore) but when new sesion is created
2060 the password ptr is put in the new session structure (in which case the
2061 password will be freed at unmount time) */
2062 kfree(volume_info.UNC);
2063 kfree(volume_info.prepath);
2064 FreeXid(xid);
2065 return rc;
2066 }
2067
2068 static int
2069 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2070 char session_key[CIFS_SESS_KEY_SIZE],
2071 const struct nls_table *nls_codepage)
2072 {
2073 struct smb_hdr *smb_buffer;
2074 struct smb_hdr *smb_buffer_response;
2075 SESSION_SETUP_ANDX *pSMB;
2076 SESSION_SETUP_ANDX *pSMBr;
2077 char *bcc_ptr;
2078 char *user;
2079 char *domain;
2080 int rc = 0;
2081 int remaining_words = 0;
2082 int bytes_returned = 0;
2083 int len;
2084 __u32 capabilities;
2085 __u16 count;
2086
2087 cFYI(1, ("In sesssetup"));
2088 if(ses == NULL)
2089 return -EINVAL;
2090 user = ses->userName;
2091 domain = ses->domainName;
2092 smb_buffer = cifs_buf_get();
2093 if (smb_buffer == NULL) {
2094 return -ENOMEM;
2095 }
2096 smb_buffer_response = smb_buffer;
2097 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2098
2099 /* send SMBsessionSetup here */
2100 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2101 NULL /* no tCon exists yet */ , 13 /* wct */ );
2102
2103 smb_buffer->Mid = GetNextMid(ses->server);
2104 pSMB->req_no_secext.AndXCommand = 0xFF;
2105 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2106 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2107
2108 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2109 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2110
2111 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2112 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2113 if (ses->capabilities & CAP_UNICODE) {
2114 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2115 capabilities |= CAP_UNICODE;
2116 }
2117 if (ses->capabilities & CAP_STATUS32) {
2118 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2119 capabilities |= CAP_STATUS32;
2120 }
2121 if (ses->capabilities & CAP_DFS) {
2122 smb_buffer->Flags2 |= SMBFLG2_DFS;
2123 capabilities |= CAP_DFS;
2124 }
2125 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2126
2127 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2128 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2129
2130 pSMB->req_no_secext.CaseSensitivePasswordLength =
2131 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2132 bcc_ptr = pByteArea(smb_buffer);
2133 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2134 bcc_ptr += CIFS_SESS_KEY_SIZE;
2135 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2136 bcc_ptr += CIFS_SESS_KEY_SIZE;
2137
2138 if (ses->capabilities & CAP_UNICODE) {
2139 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2140 *bcc_ptr = 0;
2141 bcc_ptr++;
2142 }
2143 if(user == NULL)
2144 bytes_returned = 0; /* skip null user */
2145 else
2146 bytes_returned =
2147 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2148 nls_codepage);
2149 /* convert number of 16 bit words to bytes */
2150 bcc_ptr += 2 * bytes_returned;
2151 bcc_ptr += 2; /* trailing null */
2152 if (domain == NULL)
2153 bytes_returned =
2154 cifs_strtoUCS((__le16 *) bcc_ptr,
2155 "CIFS_LINUX_DOM", 32, nls_codepage);
2156 else
2157 bytes_returned =
2158 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2159 nls_codepage);
2160 bcc_ptr += 2 * bytes_returned;
2161 bcc_ptr += 2;
2162 bytes_returned =
2163 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2164 32, nls_codepage);
2165 bcc_ptr += 2 * bytes_returned;
2166 bytes_returned =
2167 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2168 32, nls_codepage);
2169 bcc_ptr += 2 * bytes_returned;
2170 bcc_ptr += 2;
2171 bytes_returned =
2172 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2173 64, nls_codepage);
2174 bcc_ptr += 2 * bytes_returned;
2175 bcc_ptr += 2;
2176 } else {
2177 if(user != NULL) {
2178 strncpy(bcc_ptr, user, 200);
2179 bcc_ptr += strnlen(user, 200);
2180 }
2181 *bcc_ptr = 0;
2182 bcc_ptr++;
2183 if (domain == NULL) {
2184 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2185 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2186 } else {
2187 strncpy(bcc_ptr, domain, 64);
2188 bcc_ptr += strnlen(domain, 64);
2189 *bcc_ptr = 0;
2190 bcc_ptr++;
2191 }
2192 strcpy(bcc_ptr, "Linux version ");
2193 bcc_ptr += strlen("Linux version ");
2194 strcpy(bcc_ptr, utsname()->release);
2195 bcc_ptr += strlen(utsname()->release) + 1;
2196 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2197 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2198 }
2199 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2200 smb_buffer->smb_buf_length += count;
2201 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2202
2203 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2204 &bytes_returned, 1);
2205 if (rc) {
2206 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2207 } else if ((smb_buffer_response->WordCount == 3)
2208 || (smb_buffer_response->WordCount == 4)) {
2209 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2210 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2211 if (action & GUEST_LOGIN)
2212 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2213 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2214 cFYI(1, ("UID = %d ", ses->Suid));
2215 /* response can have either 3 or 4 word count - Samba sends 3 */
2216 bcc_ptr = pByteArea(smb_buffer_response);
2217 if ((pSMBr->resp.hdr.WordCount == 3)
2218 || ((pSMBr->resp.hdr.WordCount == 4)
2219 && (blob_len < pSMBr->resp.ByteCount))) {
2220 if (pSMBr->resp.hdr.WordCount == 4)
2221 bcc_ptr += blob_len;
2222
2223 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2224 if ((long) (bcc_ptr) % 2) {
2225 remaining_words =
2226 (BCC(smb_buffer_response) - 1) /2;
2227 bcc_ptr++; /* Unicode strings must be word aligned */
2228 } else {
2229 remaining_words =
2230 BCC(smb_buffer_response) / 2;
2231 }
2232 len =
2233 UniStrnlen((wchar_t *) bcc_ptr,
2234 remaining_words - 1);
2235 /* We look for obvious messed up bcc or strings in response so we do not go off
2236 the end since (at least) WIN2K and Windows XP have a major bug in not null
2237 terminating last Unicode string in response */
2238 if(ses->serverOS)
2239 kfree(ses->serverOS);
2240 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2241 if(ses->serverOS == NULL)
2242 goto sesssetup_nomem;
2243 cifs_strfromUCS_le(ses->serverOS,
2244 (__le16 *)bcc_ptr, len,nls_codepage);
2245 bcc_ptr += 2 * (len + 1);
2246 remaining_words -= len + 1;
2247 ses->serverOS[2 * len] = 0;
2248 ses->serverOS[1 + (2 * len)] = 0;
2249 if (remaining_words > 0) {
2250 len = UniStrnlen((wchar_t *)bcc_ptr,
2251 remaining_words-1);
2252 kfree(ses->serverNOS);
2253 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2254 if(ses->serverNOS == NULL)
2255 goto sesssetup_nomem;
2256 cifs_strfromUCS_le(ses->serverNOS,
2257 (__le16 *)bcc_ptr,len,nls_codepage);
2258 bcc_ptr += 2 * (len + 1);
2259 ses->serverNOS[2 * len] = 0;
2260 ses->serverNOS[1 + (2 * len)] = 0;
2261 if(strncmp(ses->serverNOS,
2262 "NT LAN Manager 4",16) == 0) {
2263 cFYI(1,("NT4 server"));
2264 ses->flags |= CIFS_SES_NT4;
2265 }
2266 remaining_words -= len + 1;
2267 if (remaining_words > 0) {
2268 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2269 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2270 if(ses->serverDomain)
2271 kfree(ses->serverDomain);
2272 ses->serverDomain =
2273 kzalloc(2*(len+1),GFP_KERNEL);
2274 if(ses->serverDomain == NULL)
2275 goto sesssetup_nomem;
2276 cifs_strfromUCS_le(ses->serverDomain,
2277 (__le16 *)bcc_ptr,len,nls_codepage);
2278 bcc_ptr += 2 * (len + 1);
2279 ses->serverDomain[2*len] = 0;
2280 ses->serverDomain[1+(2*len)] = 0;
2281 } /* else no more room so create dummy domain string */
2282 else {
2283 if(ses->serverDomain)
2284 kfree(ses->serverDomain);
2285 ses->serverDomain =
2286 kzalloc(2, GFP_KERNEL);
2287 }
2288 } else { /* no room so create dummy domain and NOS string */
2289 /* if these kcallocs fail not much we
2290 can do, but better to not fail the
2291 sesssetup itself */
2292 kfree(ses->serverDomain);
2293 ses->serverDomain =
2294 kzalloc(2, GFP_KERNEL);
2295 kfree(ses->serverNOS);
2296 ses->serverNOS =
2297 kzalloc(2, GFP_KERNEL);
2298 }
2299 } else { /* ASCII */
2300 len = strnlen(bcc_ptr, 1024);
2301 if (((long) bcc_ptr + len) - (long)
2302 pByteArea(smb_buffer_response)
2303 <= BCC(smb_buffer_response)) {
2304 kfree(ses->serverOS);
2305 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2306 if(ses->serverOS == NULL)
2307 goto sesssetup_nomem;
2308 strncpy(ses->serverOS,bcc_ptr, len);
2309
2310 bcc_ptr += len;
2311 bcc_ptr[0] = 0; /* null terminate the string */
2312 bcc_ptr++;
2313
2314 len = strnlen(bcc_ptr, 1024);
2315 kfree(ses->serverNOS);
2316 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2317 if(ses->serverNOS == NULL)
2318 goto sesssetup_nomem;
2319 strncpy(ses->serverNOS, bcc_ptr, len);
2320 bcc_ptr += len;
2321 bcc_ptr[0] = 0;
2322 bcc_ptr++;
2323
2324 len = strnlen(bcc_ptr, 1024);
2325 if(ses->serverDomain)
2326 kfree(ses->serverDomain);
2327 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2328 if(ses->serverDomain == NULL)
2329 goto sesssetup_nomem;
2330 strncpy(ses->serverDomain, bcc_ptr, len);
2331 bcc_ptr += len;
2332 bcc_ptr[0] = 0;
2333 bcc_ptr++;
2334 } else
2335 cFYI(1,
2336 ("Variable field of length %d extends beyond end of smb ",
2337 len));
2338 }
2339 } else {
2340 cERROR(1,
2341 (" Security Blob Length extends beyond end of SMB"));
2342 }
2343 } else {
2344 cERROR(1,
2345 (" Invalid Word count %d: ",
2346 smb_buffer_response->WordCount));
2347 rc = -EIO;
2348 }
2349 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2350 since that could make reconnection harder, and
2351 reconnection might be needed to free memory */
2352 if (smb_buffer)
2353 cifs_buf_release(smb_buffer);
2354
2355 return rc;
2356 }
2357
2358 static int
2359 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2360 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2361 const struct nls_table *nls_codepage)
2362 {
2363 struct smb_hdr *smb_buffer;
2364 struct smb_hdr *smb_buffer_response;
2365 SESSION_SETUP_ANDX *pSMB;
2366 SESSION_SETUP_ANDX *pSMBr;
2367 char *bcc_ptr;
2368 char *domain;
2369 int rc = 0;
2370 int remaining_words = 0;
2371 int bytes_returned = 0;
2372 int len;
2373 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2374 PNEGOTIATE_MESSAGE SecurityBlob;
2375 PCHALLENGE_MESSAGE SecurityBlob2;
2376 __u32 negotiate_flags, capabilities;
2377 __u16 count;
2378
2379 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2380 if(ses == NULL)
2381 return -EINVAL;
2382 domain = ses->domainName;
2383 *pNTLMv2_flag = FALSE;
2384 smb_buffer = cifs_buf_get();
2385 if (smb_buffer == NULL) {
2386 return -ENOMEM;
2387 }
2388 smb_buffer_response = smb_buffer;
2389 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2390 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2391
2392 /* send SMBsessionSetup here */
2393 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2394 NULL /* no tCon exists yet */ , 12 /* wct */ );
2395
2396 smb_buffer->Mid = GetNextMid(ses->server);
2397 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2398 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2399
2400 pSMB->req.AndXCommand = 0xFF;
2401 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2402 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2403
2404 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2405 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2406
2407 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2408 CAP_EXTENDED_SECURITY;
2409 if (ses->capabilities & CAP_UNICODE) {
2410 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2411 capabilities |= CAP_UNICODE;
2412 }
2413 if (ses->capabilities & CAP_STATUS32) {
2414 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2415 capabilities |= CAP_STATUS32;
2416 }
2417 if (ses->capabilities & CAP_DFS) {
2418 smb_buffer->Flags2 |= SMBFLG2_DFS;
2419 capabilities |= CAP_DFS;
2420 }
2421 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2422
2423 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2424 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2425 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2426 SecurityBlob->MessageType = NtLmNegotiate;
2427 negotiate_flags =
2428 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2429 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2430 NTLMSSP_NEGOTIATE_56 |
2431 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2432 if(sign_CIFS_PDUs)
2433 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2434 /* if(ntlmv2_support)
2435 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2436 /* setup pointers to domain name and workstation name */
2437 bcc_ptr += SecurityBlobLength;
2438
2439 SecurityBlob->WorkstationName.Buffer = 0;
2440 SecurityBlob->WorkstationName.Length = 0;
2441 SecurityBlob->WorkstationName.MaximumLength = 0;
2442
2443 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2444 along with username on auth request (ie the response to challenge) */
2445 SecurityBlob->DomainName.Buffer = 0;
2446 SecurityBlob->DomainName.Length = 0;
2447 SecurityBlob->DomainName.MaximumLength = 0;
2448 if (ses->capabilities & CAP_UNICODE) {
2449 if ((long) bcc_ptr % 2) {
2450 *bcc_ptr = 0;
2451 bcc_ptr++;
2452 }
2453
2454 bytes_returned =
2455 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2456 32, nls_codepage);
2457 bcc_ptr += 2 * bytes_returned;
2458 bytes_returned =
2459 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2460 nls_codepage);
2461 bcc_ptr += 2 * bytes_returned;
2462 bcc_ptr += 2; /* null terminate Linux version */
2463 bytes_returned =
2464 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2465 64, nls_codepage);
2466 bcc_ptr += 2 * bytes_returned;
2467 *(bcc_ptr + 1) = 0;
2468 *(bcc_ptr + 2) = 0;
2469 bcc_ptr += 2; /* null terminate network opsys string */
2470 *(bcc_ptr + 1) = 0;
2471 *(bcc_ptr + 2) = 0;
2472 bcc_ptr += 2; /* null domain */
2473 } else { /* ASCII */
2474 strcpy(bcc_ptr, "Linux version ");
2475 bcc_ptr += strlen("Linux version ");
2476 strcpy(bcc_ptr, utsname()->release);
2477 bcc_ptr += strlen(utsname()->release) + 1;
2478 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2479 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2480 bcc_ptr++; /* empty domain field */
2481 *bcc_ptr = 0;
2482 }
2483 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2484 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2485 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2486 smb_buffer->smb_buf_length += count;
2487 pSMB->req.ByteCount = cpu_to_le16(count);
2488
2489 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2490 &bytes_returned, 1);
2491
2492 if (smb_buffer_response->Status.CifsError ==
2493 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2494 rc = 0;
2495
2496 if (rc) {
2497 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2498 } else if ((smb_buffer_response->WordCount == 3)
2499 || (smb_buffer_response->WordCount == 4)) {
2500 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2501 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2502
2503 if (action & GUEST_LOGIN)
2504 cFYI(1, (" Guest login"));
2505 /* Do we want to set anything in SesInfo struct when guest login? */
2506
2507 bcc_ptr = pByteArea(smb_buffer_response);
2508 /* response can have either 3 or 4 word count - Samba sends 3 */
2509
2510 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2511 if (SecurityBlob2->MessageType != NtLmChallenge) {
2512 cFYI(1,
2513 ("Unexpected NTLMSSP message type received %d",
2514 SecurityBlob2->MessageType));
2515 } else if (ses) {
2516 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2517 cFYI(1, ("UID = %d", ses->Suid));
2518 if ((pSMBr->resp.hdr.WordCount == 3)
2519 || ((pSMBr->resp.hdr.WordCount == 4)
2520 && (blob_len <
2521 pSMBr->resp.ByteCount))) {
2522
2523 if (pSMBr->resp.hdr.WordCount == 4) {
2524 bcc_ptr += blob_len;
2525 cFYI(1, ("Security Blob Length %d",
2526 blob_len));
2527 }
2528
2529 cFYI(1, ("NTLMSSP Challenge rcvd"));
2530
2531 memcpy(ses->server->cryptKey,
2532 SecurityBlob2->Challenge,
2533 CIFS_CRYPTO_KEY_SIZE);
2534 if(SecurityBlob2->NegotiateFlags &
2535 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2536 *pNTLMv2_flag = TRUE;
2537
2538 if((SecurityBlob2->NegotiateFlags &
2539 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2540 || (sign_CIFS_PDUs > 1))
2541 ses->server->secMode |=
2542 SECMODE_SIGN_REQUIRED;
2543 if ((SecurityBlob2->NegotiateFlags &
2544 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2545 ses->server->secMode |=
2546 SECMODE_SIGN_ENABLED;
2547
2548 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2549 if ((long) (bcc_ptr) % 2) {
2550 remaining_words =
2551 (BCC(smb_buffer_response)
2552 - 1) / 2;
2553 bcc_ptr++; /* Unicode strings must be word aligned */
2554 } else {
2555 remaining_words =
2556 BCC
2557 (smb_buffer_response) / 2;
2558 }
2559 len =
2560 UniStrnlen((wchar_t *) bcc_ptr,
2561 remaining_words - 1);
2562 /* We look for obvious messed up bcc or strings in response so we do not go off
2563 the end since (at least) WIN2K and Windows XP have a major bug in not null
2564 terminating last Unicode string in response */
2565 if(ses->serverOS)
2566 kfree(ses->serverOS);
2567 ses->serverOS =
2568 kzalloc(2 * (len + 1), GFP_KERNEL);
2569 cifs_strfromUCS_le(ses->serverOS,
2570 (__le16 *)
2571 bcc_ptr, len,
2572 nls_codepage);
2573 bcc_ptr += 2 * (len + 1);
2574 remaining_words -= len + 1;
2575 ses->serverOS[2 * len] = 0;
2576 ses->serverOS[1 + (2 * len)] = 0;
2577 if (remaining_words > 0) {
2578 len = UniStrnlen((wchar_t *)
2579 bcc_ptr,
2580 remaining_words
2581 - 1);
2582 kfree(ses->serverNOS);
2583 ses->serverNOS =
2584 kzalloc(2 * (len + 1),
2585 GFP_KERNEL);
2586 cifs_strfromUCS_le(ses->
2587 serverNOS,
2588 (__le16 *)
2589 bcc_ptr,
2590 len,
2591 nls_codepage);
2592 bcc_ptr += 2 * (len + 1);
2593 ses->serverNOS[2 * len] = 0;
2594 ses->serverNOS[1 +
2595 (2 * len)] = 0;
2596 remaining_words -= len + 1;
2597 if (remaining_words > 0) {
2598 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2599 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2600 kfree(ses->serverDomain);
2601 ses->serverDomain =
2602 kzalloc(2 *
2603 (len +
2604 1),
2605 GFP_KERNEL);
2606 cifs_strfromUCS_le
2607 (ses->serverDomain,
2608 (__le16 *)bcc_ptr,
2609 len, nls_codepage);
2610 bcc_ptr +=
2611 2 * (len + 1);
2612 ses->serverDomain[2*len]
2613 = 0;
2614 ses->serverDomain
2615 [1 + (2 * len)]
2616 = 0;
2617 } /* else no more room so create dummy domain string */
2618 else {
2619 kfree(ses->serverDomain);
2620 ses->serverDomain =
2621 kzalloc(2,
2622 GFP_KERNEL);
2623 }
2624 } else { /* no room so create dummy domain and NOS string */
2625 kfree(ses->serverDomain);
2626 ses->serverDomain =
2627 kzalloc(2, GFP_KERNEL);
2628 kfree(ses->serverNOS);
2629 ses->serverNOS =
2630 kzalloc(2, GFP_KERNEL);
2631 }
2632 } else { /* ASCII */
2633 len = strnlen(bcc_ptr, 1024);
2634 if (((long) bcc_ptr + len) - (long)
2635 pByteArea(smb_buffer_response)
2636 <= BCC(smb_buffer_response)) {
2637 if(ses->serverOS)
2638 kfree(ses->serverOS);
2639 ses->serverOS =
2640 kzalloc(len + 1,
2641 GFP_KERNEL);
2642 strncpy(ses->serverOS,
2643 bcc_ptr, len);
2644
2645 bcc_ptr += len;
2646 bcc_ptr[0] = 0; /* null terminate string */
2647 bcc_ptr++;
2648
2649 len = strnlen(bcc_ptr, 1024);
2650 kfree(ses->serverNOS);
2651 ses->serverNOS =
2652 kzalloc(len + 1,
2653 GFP_KERNEL);
2654 strncpy(ses->serverNOS, bcc_ptr, len);
2655 bcc_ptr += len;
2656 bcc_ptr[0] = 0;
2657 bcc_ptr++;
2658
2659 len = strnlen(bcc_ptr, 1024);
2660 kfree(ses->serverDomain);
2661 ses->serverDomain =
2662 kzalloc(len + 1,
2663 GFP_KERNEL);
2664 strncpy(ses->serverDomain, bcc_ptr, len);
2665 bcc_ptr += len;
2666 bcc_ptr[0] = 0;
2667 bcc_ptr++;
2668 } else
2669 cFYI(1,
2670 ("Variable field of length %d extends beyond end of smb",
2671 len));
2672 }
2673 } else {
2674 cERROR(1,
2675 (" Security Blob Length extends beyond end of SMB"));
2676 }
2677 } else {
2678 cERROR(1, ("No session structure passed in."));
2679 }
2680 } else {
2681 cERROR(1,
2682 (" Invalid Word count %d:",
2683 smb_buffer_response->WordCount));
2684 rc = -EIO;
2685 }
2686
2687 if (smb_buffer)
2688 cifs_buf_release(smb_buffer);
2689
2690 return rc;
2691 }
2692 static int
2693 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2694 char *ntlm_session_key, int ntlmv2_flag,
2695 const struct nls_table *nls_codepage)
2696 {
2697 struct smb_hdr *smb_buffer;
2698 struct smb_hdr *smb_buffer_response;
2699 SESSION_SETUP_ANDX *pSMB;
2700 SESSION_SETUP_ANDX *pSMBr;
2701 char *bcc_ptr;
2702 char *user;
2703 char *domain;
2704 int rc = 0;
2705 int remaining_words = 0;
2706 int bytes_returned = 0;
2707 int len;
2708 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2709 PAUTHENTICATE_MESSAGE SecurityBlob;
2710 __u32 negotiate_flags, capabilities;
2711 __u16 count;
2712
2713 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2714 if(ses == NULL)
2715 return -EINVAL;
2716 user = ses->userName;
2717 domain = ses->domainName;
2718 smb_buffer = cifs_buf_get();
2719 if (smb_buffer == NULL) {
2720 return -ENOMEM;
2721 }
2722 smb_buffer_response = smb_buffer;
2723 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2724 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2725
2726 /* send SMBsessionSetup here */
2727 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2728 NULL /* no tCon exists yet */ , 12 /* wct */ );
2729
2730 smb_buffer->Mid = GetNextMid(ses->server);
2731 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2732 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2733 pSMB->req.AndXCommand = 0xFF;
2734 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2735 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2736
2737 pSMB->req.hdr.Uid = ses->Suid;
2738
2739 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2740 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2741
2742 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2743 CAP_EXTENDED_SECURITY;
2744 if (ses->capabilities & CAP_UNICODE) {
2745 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2746 capabilities |= CAP_UNICODE;
2747 }
2748 if (ses->capabilities & CAP_STATUS32) {
2749 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2750 capabilities |= CAP_STATUS32;
2751 }
2752 if (ses->capabilities & CAP_DFS) {
2753 smb_buffer->Flags2 |= SMBFLG2_DFS;
2754 capabilities |= CAP_DFS;
2755 }
2756 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2757
2758 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2759 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2760 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2761 SecurityBlob->MessageType = NtLmAuthenticate;
2762 bcc_ptr += SecurityBlobLength;
2763 negotiate_flags =
2764 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2765 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2766 0x80000000 | NTLMSSP_NEGOTIATE_128;
2767 if(sign_CIFS_PDUs)
2768 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2769 if(ntlmv2_flag)
2770 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2771
2772 /* setup pointers to domain name and workstation name */
2773
2774 SecurityBlob->WorkstationName.Buffer = 0;
2775 SecurityBlob->WorkstationName.Length = 0;
2776 SecurityBlob->WorkstationName.MaximumLength = 0;
2777 SecurityBlob->SessionKey.Length = 0;
2778 SecurityBlob->SessionKey.MaximumLength = 0;
2779 SecurityBlob->SessionKey.Buffer = 0;
2780
2781 SecurityBlob->LmChallengeResponse.Length = 0;
2782 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2783 SecurityBlob->LmChallengeResponse.Buffer = 0;
2784
2785 SecurityBlob->NtChallengeResponse.Length =
2786 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2787 SecurityBlob->NtChallengeResponse.MaximumLength =
2788 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2789 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2790 SecurityBlob->NtChallengeResponse.Buffer =
2791 cpu_to_le32(SecurityBlobLength);
2792 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2793 bcc_ptr += CIFS_SESS_KEY_SIZE;
2794
2795 if (ses->capabilities & CAP_UNICODE) {
2796 if (domain == NULL) {
2797 SecurityBlob->DomainName.Buffer = 0;
2798 SecurityBlob->DomainName.Length = 0;
2799 SecurityBlob->DomainName.MaximumLength = 0;
2800 } else {
2801 __u16 len =
2802 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2803 nls_codepage);
2804 len *= 2;
2805 SecurityBlob->DomainName.MaximumLength =
2806 cpu_to_le16(len);
2807 SecurityBlob->DomainName.Buffer =
2808 cpu_to_le32(SecurityBlobLength);
2809 bcc_ptr += len;
2810 SecurityBlobLength += len;
2811 SecurityBlob->DomainName.Length =
2812 cpu_to_le16(len);
2813 }
2814 if (user == NULL) {
2815 SecurityBlob->UserName.Buffer = 0;
2816 SecurityBlob->UserName.Length = 0;
2817 SecurityBlob->UserName.MaximumLength = 0;
2818 } else {
2819 __u16 len =
2820 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2821 nls_codepage);
2822 len *= 2;
2823 SecurityBlob->UserName.MaximumLength =
2824 cpu_to_le16(len);
2825 SecurityBlob->UserName.Buffer =
2826 cpu_to_le32(SecurityBlobLength);
2827 bcc_ptr += len;
2828 SecurityBlobLength += len;
2829 SecurityBlob->UserName.Length =
2830 cpu_to_le16(len);
2831 }
2832
2833 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2834 SecurityBlob->WorkstationName.Length *= 2;
2835 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2836 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2837 bcc_ptr += SecurityBlob->WorkstationName.Length;
2838 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2839 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2840
2841 if ((long) bcc_ptr % 2) {
2842 *bcc_ptr = 0;
2843 bcc_ptr++;
2844 }
2845 bytes_returned =
2846 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2847 32, nls_codepage);
2848 bcc_ptr += 2 * bytes_returned;
2849 bytes_returned =
2850 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2851 nls_codepage);
2852 bcc_ptr += 2 * bytes_returned;
2853 bcc_ptr += 2; /* null term version string */
2854 bytes_returned =
2855 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2856 64, nls_codepage);
2857 bcc_ptr += 2 * bytes_returned;
2858 *(bcc_ptr + 1) = 0;
2859 *(bcc_ptr + 2) = 0;
2860 bcc_ptr += 2; /* null terminate network opsys string */
2861 *(bcc_ptr + 1) = 0;
2862 *(bcc_ptr + 2) = 0;
2863 bcc_ptr += 2; /* null domain */
2864 } else { /* ASCII */
2865 if (domain == NULL) {
2866 SecurityBlob->DomainName.Buffer = 0;
2867 SecurityBlob->DomainName.Length = 0;
2868 SecurityBlob->DomainName.MaximumLength = 0;
2869 } else {
2870 __u16 len;
2871 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2872 strncpy(bcc_ptr, domain, 63);
2873 len = strnlen(domain, 64);
2874 SecurityBlob->DomainName.MaximumLength =
2875 cpu_to_le16(len);
2876 SecurityBlob->DomainName.Buffer =
2877 cpu_to_le32(SecurityBlobLength);
2878 bcc_ptr += len;
2879 SecurityBlobLength += len;
2880 SecurityBlob->DomainName.Length = cpu_to_le16(len);
2881 }
2882 if (user == NULL) {
2883 SecurityBlob->UserName.Buffer = 0;
2884 SecurityBlob->UserName.Length = 0;
2885 SecurityBlob->UserName.MaximumLength = 0;
2886 } else {
2887 __u16 len;
2888 strncpy(bcc_ptr, user, 63);
2889 len = strnlen(user, 64);
2890 SecurityBlob->UserName.MaximumLength =
2891 cpu_to_le16(len);
2892 SecurityBlob->UserName.Buffer =
2893 cpu_to_le32(SecurityBlobLength);
2894 bcc_ptr += len;
2895 SecurityBlobLength += len;
2896 SecurityBlob->UserName.Length = cpu_to_le16(len);
2897 }
2898 /* BB fill in our workstation name if known BB */
2899
2900 strcpy(bcc_ptr, "Linux version ");
2901 bcc_ptr += strlen("Linux version ");
2902 strcpy(bcc_ptr, utsname()->release);
2903 bcc_ptr += strlen(utsname()->release) + 1;
2904 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2905 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2906 bcc_ptr++; /* null domain */
2907 *bcc_ptr = 0;
2908 }
2909 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2910 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2911 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2912 smb_buffer->smb_buf_length += count;
2913 pSMB->req.ByteCount = cpu_to_le16(count);
2914
2915 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2916 &bytes_returned, 1);
2917 if (rc) {
2918 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2919 } else if ((smb_buffer_response->WordCount == 3)
2920 || (smb_buffer_response->WordCount == 4)) {
2921 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2922 __u16 blob_len =
2923 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2924 if (action & GUEST_LOGIN)
2925 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
2926 /* if(SecurityBlob2->MessageType != NtLm??){
2927 cFYI("Unexpected message type on auth response is %d "));
2928 } */
2929 if (ses) {
2930 cFYI(1,
2931 ("Does UID on challenge %d match auth response UID %d ",
2932 ses->Suid, smb_buffer_response->Uid));
2933 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2934 bcc_ptr = pByteArea(smb_buffer_response);
2935 /* response can have either 3 or 4 word count - Samba sends 3 */
2936 if ((pSMBr->resp.hdr.WordCount == 3)
2937 || ((pSMBr->resp.hdr.WordCount == 4)
2938 && (blob_len <
2939 pSMBr->resp.ByteCount))) {
2940 if (pSMBr->resp.hdr.WordCount == 4) {
2941 bcc_ptr +=
2942 blob_len;
2943 cFYI(1,
2944 ("Security Blob Length %d ",
2945 blob_len));
2946 }
2947
2948 cFYI(1,
2949 ("NTLMSSP response to Authenticate "));
2950
2951 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2952 if ((long) (bcc_ptr) % 2) {
2953 remaining_words =
2954 (BCC(smb_buffer_response)
2955 - 1) / 2;
2956 bcc_ptr++; /* Unicode strings must be word aligned */
2957 } else {
2958 remaining_words = BCC(smb_buffer_response) / 2;
2959 }
2960 len =
2961 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
2962 /* We look for obvious messed up bcc or strings in response so we do not go off
2963 the end since (at least) WIN2K and Windows XP have a major bug in not null
2964 terminating last Unicode string in response */
2965 if(ses->serverOS)
2966 kfree(ses->serverOS);
2967 ses->serverOS =
2968 kzalloc(2 * (len + 1), GFP_KERNEL);
2969 cifs_strfromUCS_le(ses->serverOS,
2970 (__le16 *)
2971 bcc_ptr, len,
2972 nls_codepage);
2973 bcc_ptr += 2 * (len + 1);
2974 remaining_words -= len + 1;
2975 ses->serverOS[2 * len] = 0;
2976 ses->serverOS[1 + (2 * len)] = 0;
2977 if (remaining_words > 0) {
2978 len = UniStrnlen((wchar_t *)
2979 bcc_ptr,
2980 remaining_words
2981 - 1);
2982 kfree(ses->serverNOS);
2983 ses->serverNOS =
2984 kzalloc(2 * (len + 1),
2985 GFP_KERNEL);
2986 cifs_strfromUCS_le(ses->
2987 serverNOS,
2988 (__le16 *)
2989 bcc_ptr,
2990 len,
2991 nls_codepage);
2992 bcc_ptr += 2 * (len + 1);
2993 ses->serverNOS[2 * len] = 0;
2994 ses->serverNOS[1+(2*len)] = 0;
2995 remaining_words -= len + 1;
2996 if (remaining_words > 0) {
2997 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2998 /* last string not always null terminated (e.g. for Windows XP & 2000) */
2999 if(ses->serverDomain)
3000 kfree(ses->serverDomain);
3001 ses->serverDomain =
3002 kzalloc(2 *
3003 (len +
3004 1),
3005 GFP_KERNEL);
3006 cifs_strfromUCS_le
3007 (ses->
3008 serverDomain,
3009 (__le16 *)
3010 bcc_ptr, len,
3011 nls_codepage);
3012 bcc_ptr +=
3013 2 * (len + 1);
3014 ses->
3015 serverDomain[2
3016 * len]
3017 = 0;
3018 ses->
3019 serverDomain[1
3020 +
3021 (2
3022 *
3023 len)]
3024 = 0;
3025 } /* else no more room so create dummy domain string */
3026 else {
3027 if(ses->serverDomain)
3028 kfree(ses->serverDomain);
3029 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3030 }
3031 } else { /* no room so create dummy domain and NOS string */
3032 if(ses->serverDomain)
3033 kfree(ses->serverDomain);
3034 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3035 kfree(ses->serverNOS);
3036 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3037 }
3038 } else { /* ASCII */
3039 len = strnlen(bcc_ptr, 1024);
3040 if (((long) bcc_ptr + len) -
3041 (long) pByteArea(smb_buffer_response)
3042 <= BCC(smb_buffer_response)) {
3043 if(ses->serverOS)
3044 kfree(ses->serverOS);
3045 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3046 strncpy(ses->serverOS,bcc_ptr, len);
3047
3048 bcc_ptr += len;
3049 bcc_ptr[0] = 0; /* null terminate the string */
3050 bcc_ptr++;
3051
3052 len = strnlen(bcc_ptr, 1024);
3053 kfree(ses->serverNOS);
3054 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3055 strncpy(ses->serverNOS, bcc_ptr, len);
3056 bcc_ptr += len;
3057 bcc_ptr[0] = 0;
3058 bcc_ptr++;
3059
3060 len = strnlen(bcc_ptr, 1024);
3061 if(ses->serverDomain)
3062 kfree(ses->serverDomain);
3063 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3064 strncpy(ses->serverDomain, bcc_ptr, len);
3065 bcc_ptr += len;
3066 bcc_ptr[0] = 0;
3067 bcc_ptr++;
3068 } else
3069 cFYI(1,
3070 ("Variable field of length %d extends beyond end of smb ",
3071 len));
3072 }
3073 } else {
3074 cERROR(1,
3075 (" Security Blob Length extends beyond end of SMB"));
3076 }
3077 } else {
3078 cERROR(1, ("No session structure passed in."));
3079 }
3080 } else {
3081 cERROR(1,
3082 (" Invalid Word count %d: ",
3083 smb_buffer_response->WordCount));
3084 rc = -EIO;
3085 }
3086
3087 if (smb_buffer)
3088 cifs_buf_release(smb_buffer);
3089
3090 return rc;
3091 }
3092
3093 int
3094 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3095 const char *tree, struct cifsTconInfo *tcon,
3096 const struct nls_table *nls_codepage)
3097 {
3098 struct smb_hdr *smb_buffer;
3099 struct smb_hdr *smb_buffer_response;
3100 TCONX_REQ *pSMB;
3101 TCONX_RSP *pSMBr;
3102 unsigned char *bcc_ptr;
3103 int rc = 0;
3104 int length;
3105 __u16 count;
3106
3107 if (ses == NULL)
3108 return -EIO;
3109
3110 smb_buffer = cifs_buf_get();
3111 if (smb_buffer == NULL) {
3112 return -ENOMEM;
3113 }
3114 smb_buffer_response = smb_buffer;
3115
3116 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3117 NULL /*no tid */ , 4 /*wct */ );
3118
3119 smb_buffer->Mid = GetNextMid(ses->server);
3120 smb_buffer->Uid = ses->Suid;
3121 pSMB = (TCONX_REQ *) smb_buffer;
3122 pSMBr = (TCONX_RSP *) smb_buffer_response;
3123
3124 pSMB->AndXCommand = 0xFF;
3125 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3126 bcc_ptr = &pSMB->Password[0];
3127 if((ses->server->secMode) & SECMODE_USER) {
3128 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3129 *bcc_ptr = 0; /* password is null byte */
3130 bcc_ptr++; /* skip password */
3131 /* already aligned so no need to do it below */
3132 } else {
3133 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3134 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3135 specified as required (when that support is added to
3136 the vfs in the future) as only NTLM or the much
3137 weaker LANMAN (which we do not send by default) is accepted
3138 by Samba (not sure whether other servers allow
3139 NTLMv2 password here) */
3140 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3141 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3142 (ses->server->secType == LANMAN))
3143 calc_lanman_hash(ses, bcc_ptr);
3144 else
3145 #endif /* CIFS_WEAK_PW_HASH */
3146 SMBNTencrypt(ses->password,
3147 ses->server->cryptKey,
3148 bcc_ptr);
3149
3150 bcc_ptr += CIFS_SESS_KEY_SIZE;
3151 if(ses->capabilities & CAP_UNICODE) {
3152 /* must align unicode strings */
3153 *bcc_ptr = 0; /* null byte password */
3154 bcc_ptr++;
3155 }
3156 }
3157
3158 if(ses->server->secMode &
3159 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3160 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3161
3162 if (ses->capabilities & CAP_STATUS32) {
3163 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3164 }
3165 if (ses->capabilities & CAP_DFS) {
3166 smb_buffer->Flags2 |= SMBFLG2_DFS;
3167 }
3168 if (ses->capabilities & CAP_UNICODE) {
3169 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3170 length =
3171 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3172 6 /* max utf8 char length in bytes */ *
3173 (/* server len*/ + 256 /* share len */), nls_codepage);
3174 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3175 bcc_ptr += 2; /* skip trailing null */
3176 } else { /* ASCII */
3177 strcpy(bcc_ptr, tree);
3178 bcc_ptr += strlen(tree) + 1;
3179 }
3180 strcpy(bcc_ptr, "?????");
3181 bcc_ptr += strlen("?????");
3182 bcc_ptr += 1;
3183 count = bcc_ptr - &pSMB->Password[0];
3184 pSMB->hdr.smb_buf_length += count;
3185 pSMB->ByteCount = cpu_to_le16(count);
3186
3187 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3188
3189 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3190 /* above now done in SendReceive */
3191 if ((rc == 0) && (tcon != NULL)) {
3192 tcon->tidStatus = CifsGood;
3193 tcon->tid = smb_buffer_response->Tid;
3194 bcc_ptr = pByteArea(smb_buffer_response);
3195 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3196 /* skip service field (NB: this field is always ASCII) */
3197 bcc_ptr += length + 1;
3198 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3199 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3200 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3201 if ((bcc_ptr + (2 * length)) -
3202 pByteArea(smb_buffer_response) <=
3203 BCC(smb_buffer_response)) {
3204 kfree(tcon->nativeFileSystem);
3205 tcon->nativeFileSystem =
3206 kzalloc(length + 2, GFP_KERNEL);
3207 cifs_strfromUCS_le(tcon->nativeFileSystem,
3208 (__le16 *) bcc_ptr,
3209 length, nls_codepage);
3210 bcc_ptr += 2 * length;
3211 bcc_ptr[0] = 0; /* null terminate the string */
3212 bcc_ptr[1] = 0;
3213 bcc_ptr += 2;
3214 }
3215 /* else do not bother copying these informational fields */
3216 } else {
3217 length = strnlen(bcc_ptr, 1024);
3218 if ((bcc_ptr + length) -
3219 pByteArea(smb_buffer_response) <=
3220 BCC(smb_buffer_response)) {
3221 kfree(tcon->nativeFileSystem);
3222 tcon->nativeFileSystem =
3223 kzalloc(length + 1, GFP_KERNEL);
3224 strncpy(tcon->nativeFileSystem, bcc_ptr,
3225 length);
3226 }
3227 /* else do not bother copying these informational fields */
3228 }
3229 if((smb_buffer_response->WordCount == 3) ||
3230 (smb_buffer_response->WordCount == 7))
3231 /* field is in same location */
3232 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3233 else
3234 tcon->Flags = 0;
3235 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3236 } else if ((rc == 0) && tcon == NULL) {
3237 /* all we need to save for IPC$ connection */
3238 ses->ipc_tid = smb_buffer_response->Tid;
3239 }
3240
3241 if (smb_buffer)
3242 cifs_buf_release(smb_buffer);
3243 return rc;
3244 }
3245
3246 int
3247 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3248 {
3249 int rc = 0;
3250 int xid;
3251 struct cifsSesInfo *ses = NULL;
3252 struct task_struct *cifsd_task;
3253 char * tmp;
3254
3255 xid = GetXid();
3256
3257 if (cifs_sb->tcon) {
3258 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3259 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3260 if (rc == -EBUSY) {
3261 FreeXid(xid);
3262 return 0;
3263 }
3264 tconInfoFree(cifs_sb->tcon);
3265 if ((ses) && (ses->server)) {
3266 /* save off task so we do not refer to ses later */
3267 cifsd_task = ses->server->tsk;
3268 cFYI(1, ("About to do SMBLogoff "));
3269 rc = CIFSSMBLogoff(xid, ses);
3270 if (rc == -EBUSY) {
3271 FreeXid(xid);
3272 return 0;
3273 } else if (rc == -ESHUTDOWN) {
3274 cFYI(1,("Waking up socket by sending it signal"));
3275 if(cifsd_task) {
3276 send_sig(SIGKILL,cifsd_task,1);
3277 wait_for_completion(&cifsd_complete);
3278 }
3279 rc = 0;
3280 } /* else - we have an smb session
3281 left on this socket do not kill cifsd */
3282 } else
3283 cFYI(1, ("No session or bad tcon"));
3284 }
3285
3286 cifs_sb->tcon = NULL;
3287 tmp = cifs_sb->prepath;
3288 cifs_sb->prepathlen = 0;
3289 cifs_sb->prepath = NULL;
3290 kfree(tmp);
3291 if (ses)
3292 schedule_timeout_interruptible(msecs_to_jiffies(500));
3293 if (ses)
3294 sesInfoFree(ses);
3295
3296 FreeXid(xid);
3297 return rc; /* BB check if we should always return zero here */
3298 }
3299
3300 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3301 struct nls_table * nls_info)
3302 {
3303 int rc = 0;
3304 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3305 int ntlmv2_flag = FALSE;
3306 int first_time = 0;
3307
3308 /* what if server changes its buffer size after dropping the session? */
3309 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3310 rc = CIFSSMBNegotiate(xid, pSesInfo);
3311 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3312 rc = CIFSSMBNegotiate(xid, pSesInfo);
3313 if(rc == -EAGAIN)
3314 rc = -EHOSTDOWN;
3315 }
3316 if(rc == 0) {
3317 spin_lock(&GlobalMid_Lock);
3318 if(pSesInfo->server->tcpStatus != CifsExiting)
3319 pSesInfo->server->tcpStatus = CifsGood;
3320 else
3321 rc = -EHOSTDOWN;
3322 spin_unlock(&GlobalMid_Lock);
3323
3324 }
3325 first_time = 1;
3326 }
3327 if (!rc) {
3328 pSesInfo->flags = 0;
3329 pSesInfo->capabilities = pSesInfo->server->capabilities;
3330 if(linuxExtEnabled == 0)
3331 pSesInfo->capabilities &= (~CAP_UNIX);
3332 /* pSesInfo->sequence_number = 0;*/
3333 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3334 pSesInfo->server->secMode,
3335 pSesInfo->server->capabilities,
3336 pSesInfo->server->timeAdj));
3337 if(experimEnabled < 2)
3338 rc = CIFS_SessSetup(xid, pSesInfo,
3339 first_time, nls_info);
3340 else if (extended_security
3341 && (pSesInfo->capabilities
3342 & CAP_EXTENDED_SECURITY)
3343 && (pSesInfo->server->secType == NTLMSSP)) {
3344 rc = -EOPNOTSUPP;
3345 } else if (extended_security
3346 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3347 && (pSesInfo->server->secType == RawNTLMSSP)) {
3348 cFYI(1, ("NTLMSSP sesssetup"));
3349 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3350 pSesInfo,
3351 &ntlmv2_flag,
3352 nls_info);
3353 if (!rc) {
3354 if(ntlmv2_flag) {
3355 char * v2_response;
3356 cFYI(1,("more secure NTLM ver2 hash"));
3357 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3358 nls_info)) {
3359 rc = -ENOMEM;
3360 goto ss_err_exit;
3361 } else
3362 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3363 if(v2_response) {
3364 CalcNTLMv2_response(pSesInfo,v2_response);
3365 /* if(first_time)
3366 cifs_calculate_ntlmv2_mac_key(
3367 pSesInfo->server->mac_signing_key,
3368 response, ntlm_session_key, */
3369 kfree(v2_response);
3370 /* BB Put dummy sig in SessSetup PDU? */
3371 } else {
3372 rc = -ENOMEM;
3373 goto ss_err_exit;
3374 }
3375
3376 } else {
3377 SMBNTencrypt(pSesInfo->password,
3378 pSesInfo->server->cryptKey,
3379 ntlm_session_key);
3380
3381 if(first_time)
3382 cifs_calculate_mac_key(
3383 pSesInfo->server->mac_signing_key,
3384 ntlm_session_key,
3385 pSesInfo->password);
3386 }
3387 /* for better security the weaker lanman hash not sent
3388 in AuthSessSetup so we no longer calculate it */
3389
3390 rc = CIFSNTLMSSPAuthSessSetup(xid,
3391 pSesInfo,
3392 ntlm_session_key,
3393 ntlmv2_flag,
3394 nls_info);
3395 }
3396 } else { /* old style NTLM 0.12 session setup */
3397 SMBNTencrypt(pSesInfo->password,
3398 pSesInfo->server->cryptKey,
3399 ntlm_session_key);
3400
3401 if(first_time)
3402 cifs_calculate_mac_key(
3403 pSesInfo->server->mac_signing_key,
3404 ntlm_session_key, pSesInfo->password);
3405
3406 rc = CIFSSessSetup(xid, pSesInfo,
3407 ntlm_session_key, nls_info);
3408 }
3409 if (rc) {
3410 cERROR(1,("Send error in SessSetup = %d",rc));
3411 } else {
3412 cFYI(1,("CIFS Session Established successfully"));
3413 pSesInfo->status = CifsGood;
3414 }
3415 }
3416 ss_err_exit:
3417 return rc;
3418 }
3419
WRT350N Kernel Patches