?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Documentation: move sharedsubtrees.txt to filesystems/
[wrt350n-kernel.git] / fs / cifs / connect.c
blob65d0ba72e78f1e304af44941c74a4a1f9adb2a5d
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/kthread.h>
34 #include <linux/pagevec.h>
35 #include <linux/freezer.h>
36 #include <asm/uaccess.h>
37 #include <asm/processor.h>
38 #include "cifspdu.h"
39 #include "cifsglob.h"
40 #include "cifsproto.h"
41 #include "cifs_unicode.h"
42 #include "cifs_debug.h"
43 #include "cifs_fs_sb.h"
44 #include "ntlmssp.h"
45 #include "nterr.h"
46 #include "rfc1002pdu.h"
47 #include "cn_cifs.h"
48
49 #define CIFS_PORT 445
50 #define RFC1001_PORT 139
51
52 static DECLARE_COMPLETION(cifsd_complete);
53
54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
55 unsigned char *p24);
56
57 extern mempool_t *cifs_req_poolp;
58
59 struct smb_vol {
60 char *username;
61 char *password;
62 char *domainname;
63 char *UNC;
64 char *UNCip;
65 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
66 char *iocharset; /* local code page for mapping to and from Unicode */
67 char source_rfc1001_name[16]; /* netbios name of client */
68 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
69 uid_t linux_uid;
70 gid_t linux_gid;
71 mode_t file_mode;
72 mode_t dir_mode;
73 unsigned secFlg;
74 unsigned rw:1;
75 unsigned retry:1;
76 unsigned intr:1;
77 unsigned setuids:1;
78 unsigned override_uid:1;
79 unsigned override_gid:1;
80 unsigned noperm:1;
81 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
82 unsigned cifs_acl:1;
83 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
84 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
85 unsigned direct_io:1;
86 unsigned remap:1; /* set to remap seven reserved chars in filenames */
87 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
88 unsigned no_linux_ext:1;
89 unsigned sfu_emul:1;
90 unsigned nullauth:1; /* attempt to authenticate with null user */
91 unsigned nocase; /* request case insensitive filenames */
92 unsigned nobrl; /* disable sending byte range locks to srv */
93 unsigned int rsize;
94 unsigned int wsize;
95 unsigned int sockopt;
96 unsigned short int port;
97 char *prepath;
98 };
99
100 static int ipv4_connect(struct sockaddr_in *psin_server,
101 struct socket **csocket,
102 char *netb_name,
103 char *server_netb_name);
104 static int ipv6_connect(struct sockaddr_in6 *psin_server,
105 struct socket **csocket);
106
107
108 /*
109 * cifs tcp session reconnection
110 *
111 * mark tcp session as reconnecting so temporarily locked
112 * mark all smb sessions as reconnecting for tcp session
113 * reconnect tcp session
114 * wake up waiters on reconnection? - (not needed currently)
115 */
116
117 static int
118 cifs_reconnect(struct TCP_Server_Info *server)
119 {
120 int rc = 0;
121 struct list_head *tmp;
122 struct cifsSesInfo *ses;
123 struct cifsTconInfo *tcon;
124 struct mid_q_entry *mid_entry;
125
126 spin_lock(&GlobalMid_Lock);
127 if (kthread_should_stop()) {
128 /* the demux thread will exit normally
129 next time through the loop */
130 spin_unlock(&GlobalMid_Lock);
131 return rc;
132 } else
133 server->tcpStatus = CifsNeedReconnect;
134 spin_unlock(&GlobalMid_Lock);
135 server->maxBuf = 0;
136
137 cFYI(1, ("Reconnecting tcp session"));
138
139 /* before reconnecting the tcp session, mark the smb session (uid)
140 and the tid bad so they are not used until reconnected */
141 read_lock(&GlobalSMBSeslock);
142 list_for_each(tmp, &GlobalSMBSessionList) {
143 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
144 if (ses->server) {
145 if (ses->server == server) {
146 ses->status = CifsNeedReconnect;
147 ses->ipc_tid = 0;
148 }
149 }
150 /* else tcp and smb sessions need reconnection */
151 }
152 list_for_each(tmp, &GlobalTreeConnectionList) {
153 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
154 if ((tcon) && (tcon->ses) && (tcon->ses->server == server))
155 tcon->tidStatus = CifsNeedReconnect;
156 }
157 read_unlock(&GlobalSMBSeslock);
158 /* do not want to be sending data on a socket we are freeing */
159 down(&server->tcpSem);
160 if (server->ssocket) {
161 cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
162 server->ssocket->flags));
163 kernel_sock_shutdown(server->ssocket, SHUT_WR);
164 cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
165 server->ssocket->state,
166 server->ssocket->flags));
167 sock_release(server->ssocket);
168 server->ssocket = NULL;
169 }
170
171 spin_lock(&GlobalMid_Lock);
172 list_for_each(tmp, &server->pending_mid_q) {
173 mid_entry = list_entry(tmp, struct
174 mid_q_entry,
175 qhead);
176 if (mid_entry) {
177 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
178 /* Mark other intransit requests as needing
179 retry so we do not immediately mark the
180 session bad again (ie after we reconnect
181 below) as they timeout too */
182 mid_entry->midState = MID_RETRY_NEEDED;
183 }
184 }
185 }
186 spin_unlock(&GlobalMid_Lock);
187 up(&server->tcpSem);
188
189 while ((!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
190 try_to_freeze();
191 if (server->protocolType == IPV6) {
192 rc = ipv6_connect(&server->addr.sockAddr6,
193 &server->ssocket);
194 } else {
195 rc = ipv4_connect(&server->addr.sockAddr,
196 &server->ssocket,
197 server->workstation_RFC1001_name,
198 server->server_RFC1001_name);
199 }
200 if (rc) {
201 cFYI(1, ("reconnect error %d", rc));
202 msleep(3000);
203 } else {
204 atomic_inc(&tcpSesReconnectCount);
205 spin_lock(&GlobalMid_Lock);
206 if (!kthread_should_stop())
207 server->tcpStatus = CifsGood;
208 server->sequence_number = 0;
209 spin_unlock(&GlobalMid_Lock);
210 /* atomic_set(&server->inFlight,0);*/
211 wake_up(&server->response_q);
212 }
213 }
214 return rc;
215 }
216
217 /*
218 return codes:
219 0 not a transact2, or all data present
220 >0 transact2 with that much data missing
221 -EINVAL = invalid transact2
222
223 */
224 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
225 {
226 struct smb_t2_rsp *pSMBt;
227 int total_data_size;
228 int data_in_this_rsp;
229 int remaining;
230
231 if (pSMB->Command != SMB_COM_TRANSACTION2)
232 return 0;
233
234 /* check for plausible wct, bcc and t2 data and parm sizes */
235 /* check for parm and data offset going beyond end of smb */
236 if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
237 cFYI(1, ("invalid transact2 word count"));
238 return -EINVAL;
239 }
240
241 pSMBt = (struct smb_t2_rsp *)pSMB;
242
243 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
244 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
245
246 remaining = total_data_size - data_in_this_rsp;
247
248 if (remaining == 0)
249 return 0;
250 else if (remaining < 0) {
251 cFYI(1, ("total data %d smaller than data in frame %d",
252 total_data_size, data_in_this_rsp));
253 return -EINVAL;
254 } else {
255 cFYI(1, ("missing %d bytes from transact2, check next response",
256 remaining));
257 if (total_data_size > maxBufSize) {
258 cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
259 total_data_size, maxBufSize));
260 return -EINVAL;
261 }
262 return remaining;
263 }
264 }
265
266 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
267 {
268 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
269 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
270 int total_data_size;
271 int total_in_buf;
272 int remaining;
273 int total_in_buf2;
274 char *data_area_of_target;
275 char *data_area_of_buf2;
276 __u16 byte_count;
277
278 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
279
280 if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
281 cFYI(1, ("total data size of primary and secondary t2 differ"));
282 }
283
284 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
285
286 remaining = total_data_size - total_in_buf;
287
288 if (remaining < 0)
289 return -EINVAL;
290
291 if (remaining == 0) /* nothing to do, ignore */
292 return 0;
293
294 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
295 if (remaining < total_in_buf2) {
296 cFYI(1, ("transact2 2nd response contains too much data"));
297 }
298
299 /* find end of first SMB data area */
300 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
301 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
302 /* validate target area */
303
304 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
305 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
306
307 data_area_of_target += total_in_buf;
308
309 /* copy second buffer into end of first buffer */
310 memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
311 total_in_buf += total_in_buf2;
312 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
313 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
314 byte_count += total_in_buf2;
315 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
316
317 byte_count = pTargetSMB->smb_buf_length;
318 byte_count += total_in_buf2;
319
320 /* BB also add check that we are not beyond maximum buffer size */
321
322 pTargetSMB->smb_buf_length = byte_count;
323
324 if (remaining == total_in_buf2) {
325 cFYI(1, ("found the last secondary response"));
326 return 0; /* we are done */
327 } else /* more responses to go */
328 return 1;
329
330 }
331
332 static int
333 cifs_demultiplex_thread(struct TCP_Server_Info *server)
334 {
335 int length;
336 unsigned int pdu_length, total_read;
337 struct smb_hdr *smb_buffer = NULL;
338 struct smb_hdr *bigbuf = NULL;
339 struct smb_hdr *smallbuf = NULL;
340 struct msghdr smb_msg;
341 struct kvec iov;
342 struct socket *csocket = server->ssocket;
343 struct list_head *tmp;
344 struct cifsSesInfo *ses;
345 struct task_struct *task_to_wake = NULL;
346 struct mid_q_entry *mid_entry;
347 char temp;
348 int isLargeBuf = FALSE;
349 int isMultiRsp;
350 int reconnect;
351
352 current->flags |= PF_MEMALLOC;
353 server->tsk = current; /* save process info to wake at shutdown */
354 cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current)));
355 write_lock(&GlobalSMBSeslock);
356 atomic_inc(&tcpSesAllocCount);
357 length = tcpSesAllocCount.counter;
358 write_unlock(&GlobalSMBSeslock);
359 complete(&cifsd_complete);
360 if (length > 1)
361 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
362 GFP_KERNEL);
363
364 set_freezable();
365 while (!kthread_should_stop()) {
366 if (try_to_freeze())
367 continue;
368 if (bigbuf == NULL) {
369 bigbuf = cifs_buf_get();
370 if (!bigbuf) {
371 cERROR(1, ("No memory for large SMB response"));
372 msleep(3000);
373 /* retry will check if exiting */
374 continue;
375 }
376 } else if (isLargeBuf) {
377 /* we are reusing a dirty large buf, clear its start */
378 memset(bigbuf, 0, sizeof(struct smb_hdr));
379 }
380
381 if (smallbuf == NULL) {
382 smallbuf = cifs_small_buf_get();
383 if (!smallbuf) {
384 cERROR(1, ("No memory for SMB response"));
385 msleep(1000);
386 /* retry will check if exiting */
387 continue;
388 }
389 /* beginning of smb buffer is cleared in our buf_get */
390 } else /* if existing small buf clear beginning */
391 memset(smallbuf, 0, sizeof(struct smb_hdr));
392
393 isLargeBuf = FALSE;
394 isMultiRsp = FALSE;
395 smb_buffer = smallbuf;
396 iov.iov_base = smb_buffer;
397 iov.iov_len = 4;
398 smb_msg.msg_control = NULL;
399 smb_msg.msg_controllen = 0;
400 pdu_length = 4; /* enough to get RFC1001 header */
401 incomplete_rcv:
402 length =
403 kernel_recvmsg(csocket, &smb_msg,
404 &iov, 1, pdu_length, 0 /* BB other flags? */);
405
406 if (kthread_should_stop()) {
407 break;
408 } else if (server->tcpStatus == CifsNeedReconnect) {
409 cFYI(1, ("Reconnect after server stopped responding"));
410 cifs_reconnect(server);
411 cFYI(1, ("call to reconnect done"));
412 csocket = server->ssocket;
413 continue;
414 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
415 msleep(1); /* minimum sleep to prevent looping
416 allowing socket to clear and app threads to set
417 tcpStatus CifsNeedReconnect if server hung */
418 if (pdu_length < 4)
419 goto incomplete_rcv;
420 else
421 continue;
422 } else if (length <= 0) {
423 if (server->tcpStatus == CifsNew) {
424 cFYI(1, ("tcp session abend after SMBnegprot"));
425 /* some servers kill the TCP session rather than
426 returning an SMB negprot error, in which
427 case reconnecting here is not going to help,
428 and so simply return error to mount */
429 break;
430 }
431 if (!try_to_freeze() && (length == -EINTR)) {
432 cFYI(1, ("cifsd thread killed"));
433 break;
434 }
435 cFYI(1, ("Reconnect after unexpected peek error %d",
436 length));
437 cifs_reconnect(server);
438 csocket = server->ssocket;
439 wake_up(&server->response_q);
440 continue;
441 } else if (length < pdu_length) {
442 cFYI(1, ("requested %d bytes but only got %d bytes",
443 pdu_length, length));
444 pdu_length -= length;
445 msleep(1);
446 goto incomplete_rcv;
447 }
448
449 /* The right amount was read from socket - 4 bytes */
450 /* so we can now interpret the length field */
451
452 /* the first byte big endian of the length field,
453 is actually not part of the length but the type
454 with the most common, zero, as regular data */
455 temp = *((char *) smb_buffer);
456
457 /* Note that FC 1001 length is big endian on the wire,
458 but we convert it here so it is always manipulated
459 as host byte order */
460 pdu_length = ntohl(smb_buffer->smb_buf_length);
461 smb_buffer->smb_buf_length = pdu_length;
462
463 cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
464
465 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
466 continue;
467 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
468 cFYI(1, ("Good RFC 1002 session rsp"));
469 continue;
470 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
471 /* we get this from Windows 98 instead of
472 an error on SMB negprot response */
473 cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
474 pdu_length));
475 if (server->tcpStatus == CifsNew) {
476 /* if nack on negprot (rather than
477 ret of smb negprot error) reconnecting
478 not going to help, ret error to mount */
479 break;
480 } else {
481 /* give server a second to
482 clean up before reconnect attempt */
483 msleep(1000);
484 /* always try 445 first on reconnect
485 since we get NACK on some if we ever
486 connected to port 139 (the NACK is
487 since we do not begin with RFC1001
488 session initialize frame) */
489 server->addr.sockAddr.sin_port =
490 htons(CIFS_PORT);
491 cifs_reconnect(server);
492 csocket = server->ssocket;
493 wake_up(&server->response_q);
494 continue;
495 }
496 } else if (temp != (char) 0) {
497 cERROR(1, ("Unknown RFC 1002 frame"));
498 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
499 length);
500 cifs_reconnect(server);
501 csocket = server->ssocket;
502 continue;
503 }
504
505 /* else we have an SMB response */
506 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
507 (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
508 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
509 length, pdu_length+4));
510 cifs_reconnect(server);
511 csocket = server->ssocket;
512 wake_up(&server->response_q);
513 continue;
514 }
515
516 /* else length ok */
517 reconnect = 0;
518
519 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
520 isLargeBuf = TRUE;
521 memcpy(bigbuf, smallbuf, 4);
522 smb_buffer = bigbuf;
523 }
524 length = 0;
525 iov.iov_base = 4 + (char *)smb_buffer;
526 iov.iov_len = pdu_length;
527 for (total_read = 0; total_read < pdu_length;
528 total_read += length) {
529 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
530 pdu_length - total_read, 0);
531 if (kthread_should_stop() ||
532 (length == -EINTR)) {
533 /* then will exit */
534 reconnect = 2;
535 break;
536 } else if (server->tcpStatus == CifsNeedReconnect) {
537 cifs_reconnect(server);
538 csocket = server->ssocket;
539 /* Reconnect wakes up rspns q */
540 /* Now we will reread sock */
541 reconnect = 1;
542 break;
543 } else if ((length == -ERESTARTSYS) ||
544 (length == -EAGAIN)) {
545 msleep(1); /* minimum sleep to prevent looping,
546 allowing socket to clear and app
547 threads to set tcpStatus
548 CifsNeedReconnect if server hung*/
549 length = 0;
550 continue;
551 } else if (length <= 0) {
552 cERROR(1, ("Received no data, expecting %d",
553 pdu_length - total_read));
554 cifs_reconnect(server);
555 csocket = server->ssocket;
556 reconnect = 1;
557 break;
558 }
559 }
560 if (reconnect == 2)
561 break;
562 else if (reconnect == 1)
563 continue;
564
565 length += 4; /* account for rfc1002 hdr */
566
567
568 dump_smb(smb_buffer, length);
569 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
570 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
571 continue;
572 }
573
574
575 task_to_wake = NULL;
576 spin_lock(&GlobalMid_Lock);
577 list_for_each(tmp, &server->pending_mid_q) {
578 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
579
580 if ((mid_entry->mid == smb_buffer->Mid) &&
581 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
582 (mid_entry->command == smb_buffer->Command)) {
583 if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
584 /* We have a multipart transact2 resp */
585 isMultiRsp = TRUE;
586 if (mid_entry->resp_buf) {
587 /* merge response - fix up 1st*/
588 if (coalesce_t2(smb_buffer,
589 mid_entry->resp_buf)) {
590 mid_entry->multiRsp = 1;
591 break;
592 } else {
593 /* all parts received */
594 mid_entry->multiEnd = 1;
595 goto multi_t2_fnd;
596 }
597 } else {
598 if (!isLargeBuf) {
599 cERROR(1,("1st trans2 resp needs bigbuf"));
600 /* BB maybe we can fix this up, switch
601 to already allocated large buffer? */
602 } else {
603 /* Have first buffer */
604 mid_entry->resp_buf =
605 smb_buffer;
606 mid_entry->largeBuf = 1;
607 bigbuf = NULL;
608 }
609 }
610 break;
611 }
612 mid_entry->resp_buf = smb_buffer;
613 if (isLargeBuf)
614 mid_entry->largeBuf = 1;
615 else
616 mid_entry->largeBuf = 0;
617 multi_t2_fnd:
618 task_to_wake = mid_entry->tsk;
619 mid_entry->midState = MID_RESPONSE_RECEIVED;
620 #ifdef CONFIG_CIFS_STATS2
621 mid_entry->when_received = jiffies;
622 #endif
623 /* so we do not time out requests to server
624 which is still responding (since server could
625 be busy but not dead) */
626 server->lstrp = jiffies;
627 break;
628 }
629 }
630 spin_unlock(&GlobalMid_Lock);
631 if (task_to_wake) {
632 /* Was previous buf put in mpx struct for multi-rsp? */
633 if (!isMultiRsp) {
634 /* smb buffer will be freed by user thread */
635 if (isLargeBuf)
636 bigbuf = NULL;
637 else
638 smallbuf = NULL;
639 }
640 wake_up_process(task_to_wake);
641 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
642 && (isMultiRsp == FALSE)) {
643 cERROR(1, ("No task to wake, unknown frame received! "
644 "NumMids %d", midCount.counter));
645 cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
646 sizeof(struct smb_hdr));
647 #ifdef CONFIG_CIFS_DEBUG2
648 cifs_dump_detail(smb_buffer);
649 cifs_dump_mids(server);
650 #endif /* CIFS_DEBUG2 */
651
652 }
653 } /* end while !EXITING */
654
655 spin_lock(&GlobalMid_Lock);
656 server->tcpStatus = CifsExiting;
657 server->tsk = NULL;
658 /* check if we have blocked requests that need to free */
659 /* Note that cifs_max_pending is normally 50, but
660 can be set at module install time to as little as two */
661 if (atomic_read(&server->inFlight) >= cifs_max_pending)
662 atomic_set(&server->inFlight, cifs_max_pending - 1);
663 /* We do not want to set the max_pending too low or we
664 could end up with the counter going negative */
665 spin_unlock(&GlobalMid_Lock);
666 /* Although there should not be any requests blocked on
667 this queue it can not hurt to be paranoid and try to wake up requests
668 that may haven been blocked when more than 50 at time were on the wire
669 to the same server - they now will see the session is in exit state
670 and get out of SendReceive. */
671 wake_up_all(&server->request_q);
672 /* give those requests time to exit */
673 msleep(125);
674
675 if (server->ssocket) {
676 sock_release(csocket);
677 server->ssocket = NULL;
678 }
679 /* buffer usuallly freed in free_mid - need to free it here on exit */
680 cifs_buf_release(bigbuf);
681 if (smallbuf) /* no sense logging a debug message if NULL */
682 cifs_small_buf_release(smallbuf);
683
684 read_lock(&GlobalSMBSeslock);
685 if (list_empty(&server->pending_mid_q)) {
686 /* loop through server session structures attached to this and
687 mark them dead */
688 list_for_each(tmp, &GlobalSMBSessionList) {
689 ses =
690 list_entry(tmp, struct cifsSesInfo,
691 cifsSessionList);
692 if (ses->server == server) {
693 ses->status = CifsExiting;
694 ses->server = NULL;
695 }
696 }
697 read_unlock(&GlobalSMBSeslock);
698 } else {
699 /* although we can not zero the server struct pointer yet,
700 since there are active requests which may depnd on them,
701 mark the corresponding SMB sessions as exiting too */
702 list_for_each(tmp, &GlobalSMBSessionList) {
703 ses = list_entry(tmp, struct cifsSesInfo,
704 cifsSessionList);
705 if (ses->server == server)
706 ses->status = CifsExiting;
707 }
708
709 spin_lock(&GlobalMid_Lock);
710 list_for_each(tmp, &server->pending_mid_q) {
711 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
712 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
713 cFYI(1, ("Clearing Mid 0x%x - waking up ",
714 mid_entry->mid));
715 task_to_wake = mid_entry->tsk;
716 if (task_to_wake)
717 wake_up_process(task_to_wake);
718 }
719 }
720 spin_unlock(&GlobalMid_Lock);
721 read_unlock(&GlobalSMBSeslock);
722 /* 1/8th of sec is more than enough time for them to exit */
723 msleep(125);
724 }
725
726 if (!list_empty(&server->pending_mid_q)) {
727 /* mpx threads have not exited yet give them
728 at least the smb send timeout time for long ops */
729 /* due to delays on oplock break requests, we need
730 to wait at least 45 seconds before giving up
731 on a request getting a response and going ahead
732 and killing cifsd */
733 cFYI(1, ("Wait for exit from demultiplex thread"));
734 msleep(46000);
735 /* if threads still have not exited they are probably never
736 coming home not much else we can do but free the memory */
737 }
738
739 write_lock(&GlobalSMBSeslock);
740 atomic_dec(&tcpSesAllocCount);
741 length = tcpSesAllocCount.counter;
742
743 /* last chance to mark ses pointers invalid
744 if there are any pointing to this (e.g
745 if a crazy root user tried to kill cifsd
746 kernel thread explicitly this might happen) */
747 list_for_each(tmp, &GlobalSMBSessionList) {
748 ses = list_entry(tmp, struct cifsSesInfo,
749 cifsSessionList);
750 if (ses->server == server)
751 ses->server = NULL;
752 }
753 write_unlock(&GlobalSMBSeslock);
754
755 kfree(server->hostname);
756 kfree(server);
757 if (length > 0)
758 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
759 GFP_KERNEL);
760
761 return 0;
762 }
763
764 /* extract the host portion of the UNC string */
765 static char *
766 extract_hostname(const char *unc)
767 {
768 const char *src;
769 char *dst, *delim;
770 unsigned int len;
771
772 /* skip double chars at beginning of string */
773 /* BB: check validity of these bytes? */
774 src = unc + 2;
775
776 /* delimiter between hostname and sharename is always '\\' now */
777 delim = strchr(src, '\\');
778 if (!delim)
779 return ERR_PTR(-EINVAL);
780
781 len = delim - src;
782 dst = kmalloc((len + 1), GFP_KERNEL);
783 if (dst == NULL)
784 return ERR_PTR(-ENOMEM);
785
786 memcpy(dst, src, len);
787 dst[len] = '\0';
788
789 return dst;
790 }
791
792 static int
793 cifs_parse_mount_options(char *options, const char *devname,
794 struct smb_vol *vol)
795 {
796 char *value;
797 char *data;
798 unsigned int temp_len, i, j;
799 char separator[2];
800
801 separator[0] = ',';
802 separator[1] = 0;
803
804 if (Local_System_Name[0] != 0)
805 memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
806 else {
807 char *nodename = utsname()->nodename;
808 int n = strnlen(nodename, 15);
809 memset(vol->source_rfc1001_name, 0x20, 15);
810 for (i = 0; i < n; i++) {
811 /* does not have to be perfect mapping since field is
812 informational, only used for servers that do not support
813 port 445 and it can be overridden at mount time */
814 vol->source_rfc1001_name[i] = toupper(nodename[i]);
815 }
816 }
817 vol->source_rfc1001_name[15] = 0;
818 /* null target name indicates to use *SMBSERVR default called name
819 if we end up sending RFC1001 session initialize */
820 vol->target_rfc1001_name[0] = 0;
821 vol->linux_uid = current->uid; /* current->euid instead? */
822 vol->linux_gid = current->gid;
823 vol->dir_mode = S_IRWXUGO;
824 /* 2767 perms indicate mandatory locking support */
825 vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
826
827 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
828 vol->rw = TRUE;
829 /* default is always to request posix paths. */
830 vol->posix_paths = 1;
831
832 if (!options)
833 return 1;
834
835 if (strncmp(options, "sep=", 4) == 0) {
836 if (options[4] != 0) {
837 separator[0] = options[4];
838 options += 5;
839 } else {
840 cFYI(1, ("Null separator not allowed"));
841 }
842 }
843
844 while ((data = strsep(&options, separator)) != NULL) {
845 if (!*data)
846 continue;
847 if ((value = strchr(data, '=')) != NULL)
848 *value++ = '\0';
849
850 /* Have to parse this before we parse for "user" */
851 if (strnicmp(data, "user_xattr", 10) == 0) {
852 vol->no_xattr = 0;
853 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
854 vol->no_xattr = 1;
855 } else if (strnicmp(data, "user", 4) == 0) {
856 if (!value) {
857 printk(KERN_WARNING
858 "CIFS: invalid or missing username\n");
859 return 1; /* needs_arg; */
860 } else if (!*value) {
861 /* null user, ie anonymous, authentication */
862 vol->nullauth = 1;
863 }
864 if (strnlen(value, 200) < 200) {
865 vol->username = value;
866 } else {
867 printk(KERN_WARNING "CIFS: username too long\n");
868 return 1;
869 }
870 } else if (strnicmp(data, "pass", 4) == 0) {
871 if (!value) {
872 vol->password = NULL;
873 continue;
874 } else if (value[0] == 0) {
875 /* check if string begins with double comma
876 since that would mean the password really
877 does start with a comma, and would not
878 indicate an empty string */
879 if (value[1] != separator[0]) {
880 vol->password = NULL;
881 continue;
882 }
883 }
884 temp_len = strlen(value);
885 /* removed password length check, NTLM passwords
886 can be arbitrarily long */
887
888 /* if comma in password, the string will be
889 prematurely null terminated. Commas in password are
890 specified across the cifs mount interface by a double
891 comma ie ,, and a comma used as in other cases ie ','
892 as a parameter delimiter/separator is single and due
893 to the strsep above is temporarily zeroed. */
894
895 /* NB: password legally can have multiple commas and
896 the only illegal character in a password is null */
897
898 if ((value[temp_len] == 0) &&
899 (value[temp_len+1] == separator[0])) {
900 /* reinsert comma */
901 value[temp_len] = separator[0];
902 temp_len += 2; /* move after second comma */
903 while (value[temp_len] != 0) {
904 if (value[temp_len] == separator[0]) {
905 if (value[temp_len+1] ==
906 separator[0]) {
907 /* skip second comma */
908 temp_len++;
909 } else {
910 /* single comma indicating start
911 of next parm */
912 break;
913 }
914 }
915 temp_len++;
916 }
917 if (value[temp_len] == 0) {
918 options = NULL;
919 } else {
920 value[temp_len] = 0;
921 /* point option to start of next parm */
922 options = value + temp_len + 1;
923 }
924 /* go from value to value + temp_len condensing
925 double commas to singles. Note that this ends up
926 allocating a few bytes too many, which is ok */
927 vol->password = kzalloc(temp_len, GFP_KERNEL);
928 if (vol->password == NULL) {
929 printk(KERN_WARNING "CIFS: no memory "
930 "for password\n");
931 return 1;
932 }
933 for (i = 0, j = 0; i < temp_len; i++, j++) {
934 vol->password[j] = value[i];
935 if (value[i] == separator[0]
936 && value[i+1] == separator[0]) {
937 /* skip second comma */
938 i++;
939 }
940 }
941 vol->password[j] = 0;
942 } else {
943 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
944 if (vol->password == NULL) {
945 printk(KERN_WARNING "CIFS: no memory "
946 "for password\n");
947 return 1;
948 }
949 strcpy(vol->password, value);
950 }
951 } else if (strnicmp(data, "ip", 2) == 0) {
952 if (!value || !*value) {
953 vol->UNCip = NULL;
954 } else if (strnlen(value, 35) < 35) {
955 vol->UNCip = value;
956 } else {
957 printk(KERN_WARNING "CIFS: ip address "
958 "too long\n");
959 return 1;
960 }
961 } else if (strnicmp(data, "sec", 3) == 0) {
962 if (!value || !*value) {
963 cERROR(1, ("no security value specified"));
964 continue;
965 } else if (strnicmp(value, "krb5i", 5) == 0) {
966 vol->secFlg |= CIFSSEC_MAY_KRB5 |
967 CIFSSEC_MUST_SIGN;
968 } else if (strnicmp(value, "krb5p", 5) == 0) {
969 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
970 CIFSSEC_MAY_KRB5; */
971 cERROR(1, ("Krb5 cifs privacy not supported"));
972 return 1;
973 } else if (strnicmp(value, "krb5", 4) == 0) {
974 vol->secFlg |= CIFSSEC_MAY_KRB5;
975 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
976 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
977 CIFSSEC_MUST_SIGN;
978 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
979 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
980 } else if (strnicmp(value, "ntlmi", 5) == 0) {
981 vol->secFlg |= CIFSSEC_MAY_NTLM |
982 CIFSSEC_MUST_SIGN;
983 } else if (strnicmp(value, "ntlm", 4) == 0) {
984 /* ntlm is default so can be turned off too */
985 vol->secFlg |= CIFSSEC_MAY_NTLM;
986 } else if (strnicmp(value, "nontlm", 6) == 0) {
987 /* BB is there a better way to do this? */
988 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
989 #ifdef CONFIG_CIFS_WEAK_PW_HASH
990 } else if (strnicmp(value, "lanman", 6) == 0) {
991 vol->secFlg |= CIFSSEC_MAY_LANMAN;
992 #endif
993 } else if (strnicmp(value, "none", 4) == 0) {
994 vol->nullauth = 1;
995 } else {
996 cERROR(1, ("bad security option: %s", value));
997 return 1;
998 }
999 } else if ((strnicmp(data, "unc", 3) == 0)
1000 || (strnicmp(data, "target", 6) == 0)
1001 || (strnicmp(data, "path", 4) == 0)) {
1002 if (!value || !*value) {
1003 printk(KERN_WARNING "CIFS: invalid path to "
1004 "network resource\n");
1005 return 1; /* needs_arg; */
1006 }
1007 if ((temp_len = strnlen(value, 300)) < 300) {
1008 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1009 if (vol->UNC == NULL)
1010 return 1;
1011 strcpy(vol->UNC, value);
1012 if (strncmp(vol->UNC, "//", 2) == 0) {
1013 vol->UNC[0] = '\\';
1014 vol->UNC[1] = '\\';
1015 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1016 printk(KERN_WARNING
1017 "CIFS: UNC Path does not begin "
1018 "with // or \\\\ \n");
1019 return 1;
1020 }
1021 } else {
1022 printk(KERN_WARNING "CIFS: UNC name too long\n");
1023 return 1;
1024 }
1025 } else if ((strnicmp(data, "domain", 3) == 0)
1026 || (strnicmp(data, "workgroup", 5) == 0)) {
1027 if (!value || !*value) {
1028 printk(KERN_WARNING "CIFS: invalid domain name\n");
1029 return 1; /* needs_arg; */
1030 }
1031 /* BB are there cases in which a comma can be valid in
1032 a domain name and need special handling? */
1033 if (strnlen(value, 256) < 256) {
1034 vol->domainname = value;
1035 cFYI(1, ("Domain name set"));
1036 } else {
1037 printk(KERN_WARNING "CIFS: domain name too "
1038 "long\n");
1039 return 1;
1040 }
1041 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1042 if (!value || !*value) {
1043 printk(KERN_WARNING
1044 "CIFS: invalid path prefix\n");
1045 return 1; /* needs_argument */
1046 }
1047 if ((temp_len = strnlen(value, 1024)) < 1024) {
1048 if (value[0] != '/')
1049 temp_len++; /* missing leading slash */
1050 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1051 if (vol->prepath == NULL)
1052 return 1;
1053 if (value[0] != '/') {
1054 vol->prepath[0] = '/';
1055 strcpy(vol->prepath+1, value);
1056 } else
1057 strcpy(vol->prepath, value);
1058 cFYI(1, ("prefix path %s", vol->prepath));
1059 } else {
1060 printk(KERN_WARNING "CIFS: prefix too long\n");
1061 return 1;
1062 }
1063 } else if (strnicmp(data, "iocharset", 9) == 0) {
1064 if (!value || !*value) {
1065 printk(KERN_WARNING "CIFS: invalid iocharset "
1066 "specified\n");
1067 return 1; /* needs_arg; */
1068 }
1069 if (strnlen(value, 65) < 65) {
1070 if (strnicmp(value, "default", 7))
1071 vol->iocharset = value;
1072 /* if iocharset not set then load_nls_default
1073 is used by caller */
1074 cFYI(1, ("iocharset set to %s", value));
1075 } else {
1076 printk(KERN_WARNING "CIFS: iocharset name "
1077 "too long.\n");
1078 return 1;
1079 }
1080 } else if (strnicmp(data, "uid", 3) == 0) {
1081 if (value && *value) {
1082 vol->linux_uid =
1083 simple_strtoul(value, &value, 0);
1084 vol->override_uid = 1;
1085 }
1086 } else if (strnicmp(data, "gid", 3) == 0) {
1087 if (value && *value) {
1088 vol->linux_gid =
1089 simple_strtoul(value, &value, 0);
1090 vol->override_gid = 1;
1091 }
1092 } else if (strnicmp(data, "file_mode", 4) == 0) {
1093 if (value && *value) {
1094 vol->file_mode =
1095 simple_strtoul(value, &value, 0);
1096 }
1097 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1098 if (value && *value) {
1099 vol->dir_mode =
1100 simple_strtoul(value, &value, 0);
1101 }
1102 } else if (strnicmp(data, "dirmode", 4) == 0) {
1103 if (value && *value) {
1104 vol->dir_mode =
1105 simple_strtoul(value, &value, 0);
1106 }
1107 } else if (strnicmp(data, "port", 4) == 0) {
1108 if (value && *value) {
1109 vol->port =
1110 simple_strtoul(value, &value, 0);
1111 }
1112 } else if (strnicmp(data, "rsize", 5) == 0) {
1113 if (value && *value) {
1114 vol->rsize =
1115 simple_strtoul(value, &value, 0);
1116 }
1117 } else if (strnicmp(data, "wsize", 5) == 0) {
1118 if (value && *value) {
1119 vol->wsize =
1120 simple_strtoul(value, &value, 0);
1121 }
1122 } else if (strnicmp(data, "sockopt", 5) == 0) {
1123 if (value && *value) {
1124 vol->sockopt =
1125 simple_strtoul(value, &value, 0);
1126 }
1127 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1128 if (!value || !*value || (*value == ' ')) {
1129 cFYI(1, ("invalid (empty) netbiosname"));
1130 } else {
1131 memset(vol->source_rfc1001_name, 0x20, 15);
1132 for (i = 0; i < 15; i++) {
1133 /* BB are there cases in which a comma can be
1134 valid in this workstation netbios name (and need
1135 special handling)? */
1136
1137 /* We do not uppercase netbiosname for user */
1138 if (value[i] == 0)
1139 break;
1140 else
1141 vol->source_rfc1001_name[i] =
1142 value[i];
1143 }
1144 /* The string has 16th byte zero still from
1145 set at top of the function */
1146 if ((i == 15) && (value[i] != 0))
1147 printk(KERN_WARNING "CIFS: netbiosname"
1148 " longer than 15 truncated.\n");
1149 }
1150 } else if (strnicmp(data, "servern", 7) == 0) {
1151 /* servernetbiosname specified override *SMBSERVER */
1152 if (!value || !*value || (*value == ' ')) {
1153 cFYI(1, ("empty server netbiosname specified"));
1154 } else {
1155 /* last byte, type, is 0x20 for servr type */
1156 memset(vol->target_rfc1001_name, 0x20, 16);
1157
1158 for (i = 0; i < 15; i++) {
1159 /* BB are there cases in which a comma can be
1160 valid in this workstation netbios name
1161 (and need special handling)? */
1162
1163 /* user or mount helper must uppercase
1164 the netbiosname */
1165 if (value[i] == 0)
1166 break;
1167 else
1168 vol->target_rfc1001_name[i] =
1169 value[i];
1170 }
1171 /* The string has 16th byte zero still from
1172 set at top of the function */
1173 if ((i == 15) && (value[i] != 0))
1174 printk(KERN_WARNING "CIFS: server net"
1175 "biosname longer than 15 truncated.\n");
1176 }
1177 } else if (strnicmp(data, "credentials", 4) == 0) {
1178 /* ignore */
1179 } else if (strnicmp(data, "version", 3) == 0) {
1180 /* ignore */
1181 } else if (strnicmp(data, "guest", 5) == 0) {
1182 /* ignore */
1183 } else if (strnicmp(data, "rw", 2) == 0) {
1184 vol->rw = TRUE;
1185 } else if ((strnicmp(data, "suid", 4) == 0) ||
1186 (strnicmp(data, "nosuid", 6) == 0) ||
1187 (strnicmp(data, "exec", 4) == 0) ||
1188 (strnicmp(data, "noexec", 6) == 0) ||
1189 (strnicmp(data, "nodev", 5) == 0) ||
1190 (strnicmp(data, "noauto", 6) == 0) ||
1191 (strnicmp(data, "dev", 3) == 0)) {
1192 /* The mount tool or mount.cifs helper (if present)
1193 uses these opts to set flags, and the flags are read
1194 by the kernel vfs layer before we get here (ie
1195 before read super) so there is no point trying to
1196 parse these options again and set anything and it
1197 is ok to just ignore them */
1198 continue;
1199 } else if (strnicmp(data, "ro", 2) == 0) {
1200 vol->rw = FALSE;
1201 } else if (strnicmp(data, "hard", 4) == 0) {
1202 vol->retry = 1;
1203 } else if (strnicmp(data, "soft", 4) == 0) {
1204 vol->retry = 0;
1205 } else if (strnicmp(data, "perm", 4) == 0) {
1206 vol->noperm = 0;
1207 } else if (strnicmp(data, "noperm", 6) == 0) {
1208 vol->noperm = 1;
1209 } else if (strnicmp(data, "mapchars", 8) == 0) {
1210 vol->remap = 1;
1211 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1212 vol->remap = 0;
1213 } else if (strnicmp(data, "sfu", 3) == 0) {
1214 vol->sfu_emul = 1;
1215 } else if (strnicmp(data, "nosfu", 5) == 0) {
1216 vol->sfu_emul = 0;
1217 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1218 vol->posix_paths = 1;
1219 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1220 vol->posix_paths = 0;
1221 } else if (strnicmp(data, "nounix", 6) == 0) {
1222 vol->no_linux_ext = 1;
1223 } else if (strnicmp(data, "nolinux", 7) == 0) {
1224 vol->no_linux_ext = 1;
1225 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1226 (strnicmp(data, "ignorecase", 10) == 0)) {
1227 vol->nocase = 1;
1228 } else if (strnicmp(data, "brl", 3) == 0) {
1229 vol->nobrl = 0;
1230 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1231 (strnicmp(data, "nolock", 6) == 0)) {
1232 vol->nobrl = 1;
1233 /* turn off mandatory locking in mode
1234 if remote locking is turned off since the
1235 local vfs will do advisory */
1236 if (vol->file_mode ==
1237 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1238 vol->file_mode = S_IALLUGO;
1239 } else if (strnicmp(data, "setuids", 7) == 0) {
1240 vol->setuids = 1;
1241 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1242 vol->setuids = 0;
1243 } else if (strnicmp(data, "nohard", 6) == 0) {
1244 vol->retry = 0;
1245 } else if (strnicmp(data, "nosoft", 6) == 0) {
1246 vol->retry = 1;
1247 } else if (strnicmp(data, "nointr", 6) == 0) {
1248 vol->intr = 0;
1249 } else if (strnicmp(data, "intr", 4) == 0) {
1250 vol->intr = 1;
1251 } else if (strnicmp(data, "serverino", 7) == 0) {
1252 vol->server_ino = 1;
1253 } else if (strnicmp(data, "noserverino", 9) == 0) {
1254 vol->server_ino = 0;
1255 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1256 vol->cifs_acl = 1;
1257 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1258 vol->cifs_acl = 0;
1259 } else if (strnicmp(data, "acl", 3) == 0) {
1260 vol->no_psx_acl = 0;
1261 } else if (strnicmp(data, "noacl", 5) == 0) {
1262 vol->no_psx_acl = 1;
1263 } else if (strnicmp(data, "sign", 4) == 0) {
1264 vol->secFlg |= CIFSSEC_MUST_SIGN;
1265 /* } else if (strnicmp(data, "seal",4) == 0) {
1266 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1267 } else if (strnicmp(data, "direct", 6) == 0) {
1268 vol->direct_io = 1;
1269 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1270 vol->direct_io = 1;
1271 } else if (strnicmp(data, "in6_addr", 8) == 0) {
1272 if (!value || !*value) {
1273 vol->in6_addr = NULL;
1274 } else if (strnlen(value, 49) == 48) {
1275 vol->in6_addr = value;
1276 } else {
1277 printk(KERN_WARNING "CIFS: ip v6 address not "
1278 "48 characters long\n");
1279 return 1;
1280 }
1281 } else if (strnicmp(data, "noac", 4) == 0) {
1282 printk(KERN_WARNING "CIFS: Mount option noac not "
1283 "supported. Instead set "
1284 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1285 } else
1286 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1287 data);
1288 }
1289 if (vol->UNC == NULL) {
1290 if (devname == NULL) {
1291 printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1292 "target\n");
1293 return 1;
1294 }
1295 if ((temp_len = strnlen(devname, 300)) < 300) {
1296 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1297 if (vol->UNC == NULL)
1298 return 1;
1299 strcpy(vol->UNC, devname);
1300 if (strncmp(vol->UNC, "//", 2) == 0) {
1301 vol->UNC[0] = '\\';
1302 vol->UNC[1] = '\\';
1303 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1304 printk(KERN_WARNING "CIFS: UNC Path does not "
1305 "begin with // or \\\\ \n");
1306 return 1;
1307 }
1308 } else {
1309 printk(KERN_WARNING "CIFS: UNC name too long\n");
1310 return 1;
1311 }
1312 }
1313 if (vol->UNCip == NULL)
1314 vol->UNCip = &vol->UNC[2];
1315
1316 return 0;
1317 }
1318
1319 static struct cifsSesInfo *
1320 cifs_find_tcp_session(struct in_addr *target_ip_addr,
1321 struct in6_addr *target_ip6_addr,
1322 char *userName, struct TCP_Server_Info **psrvTcp)
1323 {
1324 struct list_head *tmp;
1325 struct cifsSesInfo *ses;
1326 *psrvTcp = NULL;
1327 read_lock(&GlobalSMBSeslock);
1328
1329 list_for_each(tmp, &GlobalSMBSessionList) {
1330 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1331 if (ses->server) {
1332 if ((target_ip_addr &&
1333 (ses->server->addr.sockAddr.sin_addr.s_addr
1334 == target_ip_addr->s_addr)) || (target_ip6_addr
1335 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1336 target_ip6_addr, sizeof(*target_ip6_addr)))) {
1337 /* BB lock server and tcp session and increment
1338 use count here?? */
1339
1340 /* found a match on the TCP session */
1341 *psrvTcp = ses->server;
1342
1343 /* BB check if reconnection needed */
1344 if (strncmp
1345 (ses->userName, userName,
1346 MAX_USERNAME_SIZE) == 0){
1347 read_unlock(&GlobalSMBSeslock);
1348 /* Found exact match on both TCP and
1349 SMB sessions */
1350 return ses;
1351 }
1352 }
1353 }
1354 /* else tcp and smb sessions need reconnection */
1355 }
1356 read_unlock(&GlobalSMBSeslock);
1357 return NULL;
1358 }
1359
1360 static struct cifsTconInfo *
1361 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1362 {
1363 struct list_head *tmp;
1364 struct cifsTconInfo *tcon;
1365
1366 read_lock(&GlobalSMBSeslock);
1367 list_for_each(tmp, &GlobalTreeConnectionList) {
1368 cFYI(1, ("Next tcon"));
1369 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1370 if (tcon->ses) {
1371 if (tcon->ses->server) {
1372 cFYI(1,
1373 ("old ip addr: %x == new ip %x ?",
1374 tcon->ses->server->addr.sockAddr.sin_addr.
1375 s_addr, new_target_ip_addr));
1376 if (tcon->ses->server->addr.sockAddr.sin_addr.
1377 s_addr == new_target_ip_addr) {
1378 /* BB lock tcon, server and tcp session and increment use count here? */
1379 /* found a match on the TCP session */
1380 /* BB check if reconnection needed */
1381 cFYI(1,
1382 ("IP match, old UNC: %s new: %s",
1383 tcon->treeName, uncName));
1384 if (strncmp
1385 (tcon->treeName, uncName,
1386 MAX_TREE_SIZE) == 0) {
1387 cFYI(1,
1388 ("and old usr: %s new: %s",
1389 tcon->treeName, uncName));
1390 if (strncmp
1391 (tcon->ses->userName,
1392 userName,
1393 MAX_USERNAME_SIZE) == 0) {
1394 read_unlock(&GlobalSMBSeslock);
1395 /* matched smb session
1396 (user name */
1397 return tcon;
1398 }
1399 }
1400 }
1401 }
1402 }
1403 }
1404 read_unlock(&GlobalSMBSeslock);
1405 return NULL;
1406 }
1407
1408 int
1409 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1410 const char *old_path, const struct nls_table *nls_codepage,
1411 int remap)
1412 {
1413 struct dfs_info3_param *referrals = NULL;
1414 unsigned int num_referrals;
1415 int rc = 0;
1416
1417 rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
1418 &num_referrals, &referrals, remap);
1419
1420 /* BB Add in code to: if valid refrl, if not ip address contact
1421 the helper that resolves tcp names, mount to it, try to
1422 tcon to it unmount it if fail */
1423
1424 kfree(referrals);
1425
1426 return rc;
1427 }
1428
1429 int
1430 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
1431 const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
1432 struct dfs_info3_param **preferrals, int remap)
1433 {
1434 char *temp_unc;
1435 int rc = 0;
1436 unsigned char *targetUNCs;
1437
1438 *pnum_referrals = 0;
1439 *preferrals = NULL;
1440
1441 if (pSesInfo->ipc_tid == 0) {
1442 temp_unc = kmalloc(2 /* for slashes */ +
1443 strnlen(pSesInfo->serverName,
1444 SERVER_NAME_LEN_WITH_NULL * 2)
1445 + 1 + 4 /* slash IPC$ */ + 2,
1446 GFP_KERNEL);
1447 if (temp_unc == NULL)
1448 return -ENOMEM;
1449 temp_unc[0] = '\\';
1450 temp_unc[1] = '\\';
1451 strcpy(temp_unc + 2, pSesInfo->serverName);
1452 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1453 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1454 cFYI(1,
1455 ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
1456 kfree(temp_unc);
1457 }
1458 if (rc == 0)
1459 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, &targetUNCs,
1460 pnum_referrals, nls_codepage, remap);
1461 /* BB map targetUNCs to dfs_info3 structures, here or
1462 in CIFSGetDFSRefer BB */
1463
1464 return rc;
1465 }
1466
1467 /* See RFC1001 section 14 on representation of Netbios names */
1468 static void rfc1002mangle(char *target, char *source, unsigned int length)
1469 {
1470 unsigned int i, j;
1471
1472 for (i = 0, j = 0; i < (length); i++) {
1473 /* mask a nibble at a time and encode */
1474 target[j] = 'A' + (0x0F & (source[i] >> 4));
1475 target[j+1] = 'A' + (0x0F & source[i]);
1476 j += 2;
1477 }
1478
1479 }
1480
1481
1482 static int
1483 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1484 char *netbios_name, char *target_name)
1485 {
1486 int rc = 0;
1487 int connected = 0;
1488 __be16 orig_port = 0;
1489
1490 if (*csocket == NULL) {
1491 rc = sock_create_kern(PF_INET, SOCK_STREAM,
1492 IPPROTO_TCP, csocket);
1493 if (rc < 0) {
1494 cERROR(1, ("Error %d creating socket", rc));
1495 *csocket = NULL;
1496 return rc;
1497 } else {
1498 /* BB other socket options to set KEEPALIVE, NODELAY? */
1499 cFYI(1, ("Socket created"));
1500 (*csocket)->sk->sk_allocation = GFP_NOFS;
1501 }
1502 }
1503
1504 psin_server->sin_family = AF_INET;
1505 if (psin_server->sin_port) { /* user overrode default port */
1506 rc = (*csocket)->ops->connect(*csocket,
1507 (struct sockaddr *) psin_server,
1508 sizeof(struct sockaddr_in), 0);
1509 if (rc >= 0)
1510 connected = 1;
1511 }
1512
1513 if (!connected) {
1514 /* save original port so we can retry user specified port
1515 later if fall back ports fail this time */
1516 orig_port = psin_server->sin_port;
1517
1518 /* do not retry on the same port we just failed on */
1519 if (psin_server->sin_port != htons(CIFS_PORT)) {
1520 psin_server->sin_port = htons(CIFS_PORT);
1521
1522 rc = (*csocket)->ops->connect(*csocket,
1523 (struct sockaddr *) psin_server,
1524 sizeof(struct sockaddr_in), 0);
1525 if (rc >= 0)
1526 connected = 1;
1527 }
1528 }
1529 if (!connected) {
1530 psin_server->sin_port = htons(RFC1001_PORT);
1531 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1532 psin_server,
1533 sizeof(struct sockaddr_in), 0);
1534 if (rc >= 0)
1535 connected = 1;
1536 }
1537
1538 /* give up here - unless we want to retry on different
1539 protocol families some day */
1540 if (!connected) {
1541 if (orig_port)
1542 psin_server->sin_port = orig_port;
1543 cFYI(1, ("Error %d connecting to server via ipv4", rc));
1544 sock_release(*csocket);
1545 *csocket = NULL;
1546 return rc;
1547 }
1548 /* Eventually check for other socket options to change from
1549 the default. sock_setsockopt not used because it expects
1550 user space buffer */
1551 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
1552 (*csocket)->sk->sk_sndbuf,
1553 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1554 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1555 /* make the bufsizes depend on wsize/rsize and max requests */
1556 if ((*csocket)->sk->sk_sndbuf < (200 * 1024))
1557 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1558 if ((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1559 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1560
1561 /* send RFC1001 sessinit */
1562 if (psin_server->sin_port == htons(RFC1001_PORT)) {
1563 /* some servers require RFC1001 sessinit before sending
1564 negprot - BB check reconnection in case where second
1565 sessinit is sent but no second negprot */
1566 struct rfc1002_session_packet *ses_init_buf;
1567 struct smb_hdr *smb_buf;
1568 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
1569 GFP_KERNEL);
1570 if (ses_init_buf) {
1571 ses_init_buf->trailer.session_req.called_len = 32;
1572 if (target_name && (target_name[0] != 0)) {
1573 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1574 target_name, 16);
1575 } else {
1576 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1577 DEFAULT_CIFS_CALLED_NAME, 16);
1578 }
1579
1580 ses_init_buf->trailer.session_req.calling_len = 32;
1581 /* calling name ends in null (byte 16) from old smb
1582 convention. */
1583 if (netbios_name && (netbios_name[0] != 0)) {
1584 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1585 netbios_name, 16);
1586 } else {
1587 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1588 "LINUX_CIFS_CLNT", 16);
1589 }
1590 ses_init_buf->trailer.session_req.scope1 = 0;
1591 ses_init_buf->trailer.session_req.scope2 = 0;
1592 smb_buf = (struct smb_hdr *)ses_init_buf;
1593 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1594 smb_buf->smb_buf_length = 0x81000044;
1595 rc = smb_send(*csocket, smb_buf, 0x44,
1596 (struct sockaddr *)psin_server);
1597 kfree(ses_init_buf);
1598 msleep(1); /* RFC1001 layer in at least one server
1599 requires very short break before negprot
1600 presumably because not expecting negprot
1601 to follow so fast. This is a simple
1602 solution that works without
1603 complicating the code and causes no
1604 significant slowing down on mount
1605 for everyone else */
1606 }
1607 /* else the negprot may still work without this
1608 even though malloc failed */
1609
1610 }
1611
1612 return rc;
1613 }
1614
1615 static int
1616 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1617 {
1618 int rc = 0;
1619 int connected = 0;
1620 __be16 orig_port = 0;
1621
1622 if (*csocket == NULL) {
1623 rc = sock_create_kern(PF_INET6, SOCK_STREAM,
1624 IPPROTO_TCP, csocket);
1625 if (rc < 0) {
1626 cERROR(1, ("Error %d creating ipv6 socket", rc));
1627 *csocket = NULL;
1628 return rc;
1629 } else {
1630 /* BB other socket options to set KEEPALIVE, NODELAY? */
1631 cFYI(1, ("ipv6 Socket created"));
1632 (*csocket)->sk->sk_allocation = GFP_NOFS;
1633 }
1634 }
1635
1636 psin_server->sin6_family = AF_INET6;
1637
1638 if (psin_server->sin6_port) { /* user overrode default port */
1639 rc = (*csocket)->ops->connect(*csocket,
1640 (struct sockaddr *) psin_server,
1641 sizeof(struct sockaddr_in6), 0);
1642 if (rc >= 0)
1643 connected = 1;
1644 }
1645
1646 if (!connected) {
1647 /* save original port so we can retry user specified port
1648 later if fall back ports fail this time */
1649
1650 orig_port = psin_server->sin6_port;
1651 /* do not retry on the same port we just failed on */
1652 if (psin_server->sin6_port != htons(CIFS_PORT)) {
1653 psin_server->sin6_port = htons(CIFS_PORT);
1654
1655 rc = (*csocket)->ops->connect(*csocket,
1656 (struct sockaddr *) psin_server,
1657 sizeof(struct sockaddr_in6), 0);
1658 if (rc >= 0)
1659 connected = 1;
1660 }
1661 }
1662 if (!connected) {
1663 psin_server->sin6_port = htons(RFC1001_PORT);
1664 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1665 psin_server, sizeof(struct sockaddr_in6), 0);
1666 if (rc >= 0)
1667 connected = 1;
1668 }
1669
1670 /* give up here - unless we want to retry on different
1671 protocol families some day */
1672 if (!connected) {
1673 if (orig_port)
1674 psin_server->sin6_port = orig_port;
1675 cFYI(1, ("Error %d connecting to server via ipv6", rc));
1676 sock_release(*csocket);
1677 *csocket = NULL;
1678 return rc;
1679 }
1680 /* Eventually check for other socket options to change from
1681 the default. sock_setsockopt not used because it expects
1682 user space buffer */
1683 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1684
1685 return rc;
1686 }
1687
1688 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
1689 struct super_block *sb, struct smb_vol *vol_info)
1690 {
1691 /* if we are reconnecting then should we check to see if
1692 * any requested capabilities changed locally e.g. via
1693 * remount but we can not do much about it here
1694 * if they have (even if we could detect it by the following)
1695 * Perhaps we could add a backpointer to array of sb from tcon
1696 * or if we change to make all sb to same share the same
1697 * sb as NFS - then we only have one backpointer to sb.
1698 * What if we wanted to mount the server share twice once with
1699 * and once without posixacls or posix paths? */
1700 __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1701
1702 if (vol_info && vol_info->no_linux_ext) {
1703 tcon->fsUnixInfo.Capability = 0;
1704 tcon->unix_ext = 0; /* Unix Extensions disabled */
1705 cFYI(1, ("Linux protocol extensions disabled"));
1706 return;
1707 } else if (vol_info)
1708 tcon->unix_ext = 1; /* Unix Extensions supported */
1709
1710 if (tcon->unix_ext == 0) {
1711 cFYI(1, ("Unix extensions disabled so not set on reconnect"));
1712 return;
1713 }
1714
1715 if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1716 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1717
1718 /* check for reconnect case in which we do not
1719 want to change the mount behavior if we can avoid it */
1720 if (vol_info == NULL) {
1721 /* turn off POSIX ACL and PATHNAMES if not set
1722 originally at mount time */
1723 if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1724 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1725 if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1726 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1727 }
1728
1729 cap &= CIFS_UNIX_CAP_MASK;
1730 if (vol_info && vol_info->no_psx_acl)
1731 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1732 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
1733 cFYI(1, ("negotiated posix acl support"));
1734 if (sb)
1735 sb->s_flags |= MS_POSIXACL;
1736 }
1737
1738 if (vol_info && vol_info->posix_paths == 0)
1739 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1740 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1741 cFYI(1, ("negotiate posix pathnames"));
1742 if (sb)
1743 CIFS_SB(sb)->mnt_cifs_flags |=
1744 CIFS_MOUNT_POSIX_PATHS;
1745 }
1746
1747 /* We might be setting the path sep back to a different
1748 form if we are reconnecting and the server switched its
1749 posix path capability for this share */
1750 if (sb && (CIFS_SB(sb)->prepathlen > 0))
1751 CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1752
1753 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
1754 if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
1755 CIFS_SB(sb)->rsize = 127 * 1024;
1756 #ifdef CONFIG_CIFS_DEBUG2
1757 cFYI(1, ("larger reads not supported by srv"));
1758 #endif
1759 }
1760 }
1761
1762
1763 cFYI(1, ("Negotiate caps 0x%x", (int)cap));
1764 #ifdef CONFIG_CIFS_DEBUG2
1765 if (cap & CIFS_UNIX_FCNTL_CAP)
1766 cFYI(1, ("FCNTL cap"));
1767 if (cap & CIFS_UNIX_EXTATTR_CAP)
1768 cFYI(1, ("EXTATTR cap"));
1769 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1770 cFYI(1, ("POSIX path cap"));
1771 if (cap & CIFS_UNIX_XATTR_CAP)
1772 cFYI(1, ("XATTR cap"));
1773 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
1774 cFYI(1, ("POSIX ACL cap"));
1775 if (cap & CIFS_UNIX_LARGE_READ_CAP)
1776 cFYI(1, ("very large read cap"));
1777 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
1778 cFYI(1, ("very large write cap"));
1779 #endif /* CIFS_DEBUG2 */
1780 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1781 if (vol_info == NULL) {
1782 cFYI(1, ("resetting capabilities failed"));
1783 } else
1784 cERROR(1, ("Negotiating Unix capabilities "
1785 "with the server failed. Consider "
1786 "mounting with the Unix Extensions\n"
1787 "disabled, if problems are found, "
1788 "by specifying the nounix mount "
1789 "option."));
1790
1791 }
1792 }
1793 }
1794
1795 int
1796 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1797 char *mount_data, const char *devname)
1798 {
1799 int rc = 0;
1800 int xid;
1801 int address_type = AF_INET;
1802 struct socket *csocket = NULL;
1803 struct sockaddr_in sin_server;
1804 struct sockaddr_in6 sin_server6;
1805 struct smb_vol volume_info;
1806 struct cifsSesInfo *pSesInfo = NULL;
1807 struct cifsSesInfo *existingCifsSes = NULL;
1808 struct cifsTconInfo *tcon = NULL;
1809 struct TCP_Server_Info *srvTcp = NULL;
1810
1811 xid = GetXid();
1812
1813 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1814
1815 memset(&volume_info, 0, sizeof(struct smb_vol));
1816 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1817 rc = -EINVAL;
1818 goto out;
1819 }
1820
1821 if (volume_info.nullauth) {
1822 cFYI(1, ("null user"));
1823 volume_info.username = "";
1824 } else if (volume_info.username) {
1825 /* BB fixme parse for domain name here */
1826 cFYI(1, ("Username: %s", volume_info.username));
1827 } else {
1828 cifserror("No username specified");
1829 /* In userspace mount helper we can get user name from alternate
1830 locations such as env variables and files on disk */
1831 rc = -EINVAL;
1832 goto out;
1833 }
1834
1835 if (volume_info.UNCip && volume_info.UNC) {
1836 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
1837 &sin_server.sin_addr.s_addr);
1838
1839 if (rc <= 0) {
1840 /* not ipv4 address, try ipv6 */
1841 rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
1842 &sin_server6.sin6_addr.in6_u);
1843 if (rc > 0)
1844 address_type = AF_INET6;
1845 } else {
1846 address_type = AF_INET;
1847 }
1848
1849 if (rc <= 0) {
1850 /* we failed translating address */
1851 rc = -EINVAL;
1852 goto out;
1853 }
1854
1855 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1856 /* success */
1857 rc = 0;
1858 } else if (volume_info.UNCip) {
1859 /* BB using ip addr as server name to connect to the
1860 DFS root below */
1861 cERROR(1, ("Connecting to DFS root not implemented yet"));
1862 rc = -EINVAL;
1863 goto out;
1864 } else /* which servers DFS root would we conect to */ {
1865 cERROR(1,
1866 ("CIFS mount error: No UNC path (e.g. -o "
1867 "unc=//192.168.1.100/public) specified"));
1868 rc = -EINVAL;
1869 goto out;
1870 }
1871
1872 /* this is needed for ASCII cp to Unicode converts */
1873 if (volume_info.iocharset == NULL) {
1874 cifs_sb->local_nls = load_nls_default();
1875 /* load_nls_default can not return null */
1876 } else {
1877 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1878 if (cifs_sb->local_nls == NULL) {
1879 cERROR(1, ("CIFS mount error: iocharset %s not found",
1880 volume_info.iocharset));
1881 rc = -ELIBACC;
1882 goto out;
1883 }
1884 }
1885
1886 if (address_type == AF_INET)
1887 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1888 NULL /* no ipv6 addr */,
1889 volume_info.username, &srvTcp);
1890 else if (address_type == AF_INET6) {
1891 cFYI(1, ("looking for ipv6 address"));
1892 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1893 &sin_server6.sin6_addr,
1894 volume_info.username, &srvTcp);
1895 } else {
1896 rc = -EINVAL;
1897 goto out;
1898 }
1899
1900 if (srvTcp) {
1901 cFYI(1, ("Existing tcp session with server found"));
1902 } else { /* create socket */
1903 if (volume_info.port)
1904 sin_server.sin_port = htons(volume_info.port);
1905 else
1906 sin_server.sin_port = 0;
1907 if (address_type == AF_INET6) {
1908 cFYI(1, ("attempting ipv6 connect"));
1909 /* BB should we allow ipv6 on port 139? */
1910 /* other OS never observed in Wild doing 139 with v6 */
1911 rc = ipv6_connect(&sin_server6, &csocket);
1912 } else
1913 rc = ipv4_connect(&sin_server, &csocket,
1914 volume_info.source_rfc1001_name,
1915 volume_info.target_rfc1001_name);
1916 if (rc < 0) {
1917 cERROR(1, ("Error connecting to IPv4 socket. "
1918 "Aborting operation"));
1919 if (csocket != NULL)
1920 sock_release(csocket);
1921 goto out;
1922 }
1923
1924 srvTcp = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1925 if (!srvTcp) {
1926 rc = -ENOMEM;
1927 sock_release(csocket);
1928 goto out;
1929 } else {
1930 memcpy(&srvTcp->addr.sockAddr, &sin_server,
1931 sizeof(struct sockaddr_in));
1932 atomic_set(&srvTcp->inFlight, 0);
1933 /* BB Add code for ipv6 case too */
1934 srvTcp->ssocket = csocket;
1935 srvTcp->protocolType = IPV4;
1936 srvTcp->hostname = extract_hostname(volume_info.UNC);
1937 if (IS_ERR(srvTcp->hostname)) {
1938 rc = PTR_ERR(srvTcp->hostname);
1939 sock_release(csocket);
1940 goto out;
1941 }
1942 init_waitqueue_head(&srvTcp->response_q);
1943 init_waitqueue_head(&srvTcp->request_q);
1944 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1945 /* at this point we are the only ones with the pointer
1946 to the struct since the kernel thread not created yet
1947 so no need to spinlock this init of tcpStatus */
1948 srvTcp->tcpStatus = CifsNew;
1949 init_MUTEX(&srvTcp->tcpSem);
1950 srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1951 if (IS_ERR(srvTcp->tsk)) {
1952 rc = PTR_ERR(srvTcp->tsk);
1953 cERROR(1, ("error %d create cifsd thread", rc));
1954 srvTcp->tsk = NULL;
1955 sock_release(csocket);
1956 kfree(srvTcp->hostname);
1957 goto out;
1958 }
1959 wait_for_completion(&cifsd_complete);
1960 rc = 0;
1961 memcpy(srvTcp->workstation_RFC1001_name,
1962 volume_info.source_rfc1001_name, 16);
1963 memcpy(srvTcp->server_RFC1001_name,
1964 volume_info.target_rfc1001_name, 16);
1965 srvTcp->sequence_number = 0;
1966 }
1967 }
1968
1969 if (existingCifsSes) {
1970 pSesInfo = existingCifsSes;
1971 cFYI(1, ("Existing smb sess found (status=%d)",
1972 pSesInfo->status));
1973 down(&pSesInfo->sesSem);
1974 if (pSesInfo->status == CifsNeedReconnect) {
1975 cFYI(1, ("Session needs reconnect"));
1976 rc = cifs_setup_session(xid, pSesInfo,
1977 cifs_sb->local_nls);
1978 }
1979 up(&pSesInfo->sesSem);
1980 } else if (!rc) {
1981 cFYI(1, ("Existing smb sess not found"));
1982 pSesInfo = sesInfoAlloc();
1983 if (pSesInfo == NULL)
1984 rc = -ENOMEM;
1985 else {
1986 pSesInfo->server = srvTcp;
1987 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1988 NIPQUAD(sin_server.sin_addr.s_addr));
1989 }
1990
1991 if (!rc) {
1992 /* volume_info.password freed at unmount */
1993 if (volume_info.password) {
1994 pSesInfo->password = volume_info.password;
1995 /* set to NULL to prevent freeing on exit */
1996 volume_info.password = NULL;
1997 }
1998 if (volume_info.username)
1999 strncpy(pSesInfo->userName,
2000 volume_info.username,
2001 MAX_USERNAME_SIZE);
2002 if (volume_info.domainname) {
2003 int len = strlen(volume_info.domainname);
2004 pSesInfo->domainName =
2005 kmalloc(len + 1, GFP_KERNEL);
2006 if (pSesInfo->domainName)
2007 strcpy(pSesInfo->domainName,
2008 volume_info.domainname);
2009 }
2010 pSesInfo->linux_uid = volume_info.linux_uid;
2011 pSesInfo->overrideSecFlg = volume_info.secFlg;
2012 down(&pSesInfo->sesSem);
2013 /* BB FIXME need to pass vol->secFlgs BB */
2014 rc = cifs_setup_session(xid, pSesInfo,
2015 cifs_sb->local_nls);
2016 up(&pSesInfo->sesSem);
2017 if (!rc)
2018 atomic_inc(&srvTcp->socketUseCount);
2019 }
2020 }
2021
2022 /* search for existing tcon to this server share */
2023 if (!rc) {
2024 if (volume_info.rsize > CIFSMaxBufSize) {
2025 cERROR(1, ("rsize %d too large, using MaxBufSize",
2026 volume_info.rsize));
2027 cifs_sb->rsize = CIFSMaxBufSize;
2028 } else if ((volume_info.rsize) &&
2029 (volume_info.rsize <= CIFSMaxBufSize))
2030 cifs_sb->rsize = volume_info.rsize;
2031 else /* default */
2032 cifs_sb->rsize = CIFSMaxBufSize;
2033
2034 if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2035 cERROR(1, ("wsize %d too large, using 4096 instead",
2036 volume_info.wsize));
2037 cifs_sb->wsize = 4096;
2038 } else if (volume_info.wsize)
2039 cifs_sb->wsize = volume_info.wsize;
2040 else
2041 cifs_sb->wsize =
2042 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2043 127*1024);
2044 /* old default of CIFSMaxBufSize was too small now
2045 that SMB Write2 can send multiple pages in kvec.
2046 RFC1001 does not describe what happens when frame
2047 bigger than 128K is sent so use that as max in
2048 conjunction with 52K kvec constraint on arch with 4K
2049 page size */
2050
2051 if (cifs_sb->rsize < 2048) {
2052 cifs_sb->rsize = 2048;
2053 /* Windows ME may prefer this */
2054 cFYI(1, ("readsize set to minimum: 2048"));
2055 }
2056 /* calculate prepath */
2057 cifs_sb->prepath = volume_info.prepath;
2058 if (cifs_sb->prepath) {
2059 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2060 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
2061 volume_info.prepath = NULL;
2062 } else
2063 cifs_sb->prepathlen = 0;
2064 cifs_sb->mnt_uid = volume_info.linux_uid;
2065 cifs_sb->mnt_gid = volume_info.linux_gid;
2066 cifs_sb->mnt_file_mode = volume_info.file_mode;
2067 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
2068 cFYI(1, ("file mode: 0x%x dir mode: 0x%x",
2069 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
2070
2071 if (volume_info.noperm)
2072 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2073 if (volume_info.setuids)
2074 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2075 if (volume_info.server_ino)
2076 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2077 if (volume_info.remap)
2078 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2079 if (volume_info.no_xattr)
2080 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2081 if (volume_info.sfu_emul)
2082 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2083 if (volume_info.nobrl)
2084 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2085 if (volume_info.cifs_acl)
2086 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2087 if (volume_info.override_uid)
2088 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2089 if (volume_info.override_gid)
2090 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2091 if (volume_info.direct_io) {
2092 cFYI(1, ("mounting share using direct i/o"));
2093 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2094 }
2095
2096 tcon =
2097 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
2098 volume_info.username);
2099 if (tcon) {
2100 cFYI(1, ("Found match on UNC path"));
2101 /* we can have only one retry value for a connection
2102 to a share so for resources mounted more than once
2103 to the same server share the last value passed in
2104 for the retry flag is used */
2105 tcon->retry = volume_info.retry;
2106 tcon->nocase = volume_info.nocase;
2107 } else {
2108 tcon = tconInfoAlloc();
2109 if (tcon == NULL)
2110 rc = -ENOMEM;
2111 else {
2112 /* check for null share name ie connecting to
2113 * dfs root */
2114
2115 /* BB check if this works for exactly length
2116 * three strings */
2117 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2118 && (strchr(volume_info.UNC + 3, '/') ==
2119 NULL)) {
2120 rc = connect_to_dfs_path(xid, pSesInfo,
2121 "", cifs_sb->local_nls,
2122 cifs_sb->mnt_cifs_flags &
2123 CIFS_MOUNT_MAP_SPECIAL_CHR);
2124 rc = -ENODEV;
2125 goto out;
2126 } else {
2127 /* BB Do we need to wrap sesSem around
2128 * this TCon call and Unix SetFS as
2129 * we do on SessSetup and reconnect? */
2130 rc = CIFSTCon(xid, pSesInfo,
2131 volume_info.UNC,
2132 tcon, cifs_sb->local_nls);
2133 cFYI(1, ("CIFS Tcon rc = %d", rc));
2134 }
2135 if (!rc) {
2136 atomic_inc(&pSesInfo->inUse);
2137 tcon->retry = volume_info.retry;
2138 tcon->nocase = volume_info.nocase;
2139 }
2140 }
2141 }
2142 }
2143 if (pSesInfo) {
2144 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2145 sb->s_maxbytes = (u64) 1 << 63;
2146 } else
2147 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2148 }
2149
2150 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2151 sb->s_time_gran = 100;
2152
2153 /* on error free sesinfo and tcon struct if needed */
2154 if (rc) {
2155 /* if session setup failed, use count is zero but
2156 we still need to free cifsd thread */
2157 if (atomic_read(&srvTcp->socketUseCount) == 0) {
2158 spin_lock(&GlobalMid_Lock);
2159 srvTcp->tcpStatus = CifsExiting;
2160 spin_unlock(&GlobalMid_Lock);
2161 if (srvTcp->tsk) {
2162 struct task_struct *tsk;
2163 /* If we could verify that kthread_stop would
2164 always wake up processes blocked in
2165 tcp in recv_mesg then we could remove the
2166 send_sig call */
2167 force_sig(SIGKILL, srvTcp->tsk);
2168 tsk = srvTcp->tsk;
2169 if (tsk)
2170 kthread_stop(tsk);
2171 }
2172 }
2173 /* If find_unc succeeded then rc == 0 so we can not end */
2174 if (tcon) /* up accidently freeing someone elses tcon struct */
2175 tconInfoFree(tcon);
2176 if (existingCifsSes == NULL) {
2177 if (pSesInfo) {
2178 if ((pSesInfo->server) &&
2179 (pSesInfo->status == CifsGood)) {
2180 int temp_rc;
2181 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2182 /* if the socketUseCount is now zero */
2183 if ((temp_rc == -ESHUTDOWN) &&
2184 (pSesInfo->server) &&
2185 (pSesInfo->server->tsk)) {
2186 struct task_struct *tsk;
2187 force_sig(SIGKILL,
2188 pSesInfo->server->tsk);
2189 tsk = pSesInfo->server->tsk;
2190 if (tsk)
2191 kthread_stop(tsk);
2192 }
2193 } else {
2194 cFYI(1, ("No session or bad tcon"));
2195 if ((pSesInfo->server) &&
2196 (pSesInfo->server->tsk)) {
2197 struct task_struct *tsk;
2198 force_sig(SIGKILL,
2199 pSesInfo->server->tsk);
2200 tsk = pSesInfo->server->tsk;
2201 if (tsk)
2202 kthread_stop(tsk);
2203 }
2204 }
2205 sesInfoFree(pSesInfo);
2206 /* pSesInfo = NULL; */
2207 }
2208 }
2209 } else {
2210 atomic_inc(&tcon->useCount);
2211 cifs_sb->tcon = tcon;
2212 tcon->ses = pSesInfo;
2213
2214 /* do not care if following two calls succeed - informational */
2215 if (!tcon->ipc) {
2216 CIFSSMBQFSDeviceInfo(xid, tcon);
2217 CIFSSMBQFSAttributeInfo(xid, tcon);
2218 }
2219
2220 /* tell server which Unix caps we support */
2221 if (tcon->ses->capabilities & CAP_UNIX)
2222 /* reset of caps checks mount to see if unix extensions
2223 disabled for just this mount */
2224 reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2225 else
2226 tcon->unix_ext = 0; /* server does not support them */
2227
2228 if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2229 cifs_sb->rsize = 1024 * 127;
2230 #ifdef CONFIG_CIFS_DEBUG2
2231 cFYI(1, ("no very large read support, rsize now 127K"));
2232 #endif
2233 }
2234 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2235 cifs_sb->wsize = min(cifs_sb->wsize,
2236 (tcon->ses->server->maxBuf -
2237 MAX_CIFS_HDR_SIZE));
2238 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2239 cifs_sb->rsize = min(cifs_sb->rsize,
2240 (tcon->ses->server->maxBuf -
2241 MAX_CIFS_HDR_SIZE));
2242 }
2243
2244 /* volume_info.password is freed above when existing session found
2245 (in which case it is not needed anymore) but when new sesion is created
2246 the password ptr is put in the new session structure (in which case the
2247 password will be freed at unmount time) */
2248 out:
2249 /* zero out password before freeing */
2250 if (volume_info.password != NULL) {
2251 memset(volume_info.password, 0, strlen(volume_info.password));
2252 kfree(volume_info.password);
2253 }
2254 kfree(volume_info.UNC);
2255 kfree(volume_info.prepath);
2256 FreeXid(xid);
2257 return rc;
2258 }
2259
2260 static int
2261 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2262 char session_key[CIFS_SESS_KEY_SIZE],
2263 const struct nls_table *nls_codepage)
2264 {
2265 struct smb_hdr *smb_buffer;
2266 struct smb_hdr *smb_buffer_response;
2267 SESSION_SETUP_ANDX *pSMB;
2268 SESSION_SETUP_ANDX *pSMBr;
2269 char *bcc_ptr;
2270 char *user;
2271 char *domain;
2272 int rc = 0;
2273 int remaining_words = 0;
2274 int bytes_returned = 0;
2275 int len;
2276 __u32 capabilities;
2277 __u16 count;
2278
2279 cFYI(1, ("In sesssetup"));
2280 if (ses == NULL)
2281 return -EINVAL;
2282 user = ses->userName;
2283 domain = ses->domainName;
2284 smb_buffer = cifs_buf_get();
2285 if (smb_buffer == NULL) {
2286 return -ENOMEM;
2287 }
2288 smb_buffer_response = smb_buffer;
2289 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2290
2291 /* send SMBsessionSetup here */
2292 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2293 NULL /* no tCon exists yet */ , 13 /* wct */ );
2294
2295 smb_buffer->Mid = GetNextMid(ses->server);
2296 pSMB->req_no_secext.AndXCommand = 0xFF;
2297 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2298 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2299
2300 if (ses->server->secMode &
2301 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2302 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2303
2304 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2305 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2306 if (ses->capabilities & CAP_UNICODE) {
2307 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2308 capabilities |= CAP_UNICODE;
2309 }
2310 if (ses->capabilities & CAP_STATUS32) {
2311 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2312 capabilities |= CAP_STATUS32;
2313 }
2314 if (ses->capabilities & CAP_DFS) {
2315 smb_buffer->Flags2 |= SMBFLG2_DFS;
2316 capabilities |= CAP_DFS;
2317 }
2318 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2319
2320 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2321 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2322
2323 pSMB->req_no_secext.CaseSensitivePasswordLength =
2324 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2325 bcc_ptr = pByteArea(smb_buffer);
2326 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2327 bcc_ptr += CIFS_SESS_KEY_SIZE;
2328 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2329 bcc_ptr += CIFS_SESS_KEY_SIZE;
2330
2331 if (ses->capabilities & CAP_UNICODE) {
2332 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2333 *bcc_ptr = 0;
2334 bcc_ptr++;
2335 }
2336 if (user == NULL)
2337 bytes_returned = 0; /* skip null user */
2338 else
2339 bytes_returned =
2340 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2341 nls_codepage);
2342 /* convert number of 16 bit words to bytes */
2343 bcc_ptr += 2 * bytes_returned;
2344 bcc_ptr += 2; /* trailing null */
2345 if (domain == NULL)
2346 bytes_returned =
2347 cifs_strtoUCS((__le16 *) bcc_ptr,
2348 "CIFS_LINUX_DOM", 32, nls_codepage);
2349 else
2350 bytes_returned =
2351 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2352 nls_codepage);
2353 bcc_ptr += 2 * bytes_returned;
2354 bcc_ptr += 2;
2355 bytes_returned =
2356 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2357 32, nls_codepage);
2358 bcc_ptr += 2 * bytes_returned;
2359 bytes_returned =
2360 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2361 32, nls_codepage);
2362 bcc_ptr += 2 * bytes_returned;
2363 bcc_ptr += 2;
2364 bytes_returned =
2365 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2366 64, nls_codepage);
2367 bcc_ptr += 2 * bytes_returned;
2368 bcc_ptr += 2;
2369 } else {
2370 if (user != NULL) {
2371 strncpy(bcc_ptr, user, 200);
2372 bcc_ptr += strnlen(user, 200);
2373 }
2374 *bcc_ptr = 0;
2375 bcc_ptr++;
2376 if (domain == NULL) {
2377 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2378 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2379 } else {
2380 strncpy(bcc_ptr, domain, 64);
2381 bcc_ptr += strnlen(domain, 64);
2382 *bcc_ptr = 0;
2383 bcc_ptr++;
2384 }
2385 strcpy(bcc_ptr, "Linux version ");
2386 bcc_ptr += strlen("Linux version ");
2387 strcpy(bcc_ptr, utsname()->release);
2388 bcc_ptr += strlen(utsname()->release) + 1;
2389 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2390 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2391 }
2392 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2393 smb_buffer->smb_buf_length += count;
2394 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2395
2396 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2397 &bytes_returned, CIFS_LONG_OP);
2398 if (rc) {
2399 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2400 } else if ((smb_buffer_response->WordCount == 3)
2401 || (smb_buffer_response->WordCount == 4)) {
2402 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2403 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2404 if (action & GUEST_LOGIN)
2405 cFYI(1, (" Guest login")); /* BB mark SesInfo struct? */
2406 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
2407 (little endian) */
2408 cFYI(1, ("UID = %d ", ses->Suid));
2409 /* response can have either 3 or 4 word count - Samba sends 3 */
2410 bcc_ptr = pByteArea(smb_buffer_response);
2411 if ((pSMBr->resp.hdr.WordCount == 3)
2412 || ((pSMBr->resp.hdr.WordCount == 4)
2413 && (blob_len < pSMBr->resp.ByteCount))) {
2414 if (pSMBr->resp.hdr.WordCount == 4)
2415 bcc_ptr += blob_len;
2416
2417 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2418 if ((long) (bcc_ptr) % 2) {
2419 remaining_words =
2420 (BCC(smb_buffer_response) - 1) / 2;
2421 /* Unicode strings must be word
2422 aligned */
2423 bcc_ptr++;
2424 } else {
2425 remaining_words =
2426 BCC(smb_buffer_response) / 2;
2427 }
2428 len =
2429 UniStrnlen((wchar_t *) bcc_ptr,
2430 remaining_words - 1);
2431 /* We look for obvious messed up bcc or strings in response so we do not go off
2432 the end since (at least) WIN2K and Windows XP have a major bug in not null
2433 terminating last Unicode string in response */
2434 if (ses->serverOS)
2435 kfree(ses->serverOS);
2436 ses->serverOS = kzalloc(2 * (len + 1),
2437 GFP_KERNEL);
2438 if (ses->serverOS == NULL)
2439 goto sesssetup_nomem;
2440 cifs_strfromUCS_le(ses->serverOS,
2441 (__le16 *)bcc_ptr,
2442 len, nls_codepage);
2443 bcc_ptr += 2 * (len + 1);
2444 remaining_words -= len + 1;
2445 ses->serverOS[2 * len] = 0;
2446 ses->serverOS[1 + (2 * len)] = 0;
2447 if (remaining_words > 0) {
2448 len = UniStrnlen((wchar_t *)bcc_ptr,
2449 remaining_words-1);
2450 kfree(ses->serverNOS);
2451 ses->serverNOS = kzalloc(2 * (len + 1),
2452 GFP_KERNEL);
2453 if (ses->serverNOS == NULL)
2454 goto sesssetup_nomem;
2455 cifs_strfromUCS_le(ses->serverNOS,
2456 (__le16 *)bcc_ptr,
2457 len, nls_codepage);
2458 bcc_ptr += 2 * (len + 1);
2459 ses->serverNOS[2 * len] = 0;
2460 ses->serverNOS[1 + (2 * len)] = 0;
2461 if (strncmp(ses->serverNOS,
2462 "NT LAN Manager 4", 16) == 0) {
2463 cFYI(1, ("NT4 server"));
2464 ses->flags |= CIFS_SES_NT4;
2465 }
2466 remaining_words -= len + 1;
2467 if (remaining_words > 0) {
2468 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2469 /* last string is not always null terminated
2470 (for e.g. for Windows XP & 2000) */
2471 if (ses->serverDomain)
2472 kfree(ses->serverDomain);
2473 ses->serverDomain =
2474 kzalloc(2*(len+1),
2475 GFP_KERNEL);
2476 if (ses->serverDomain == NULL)
2477 goto sesssetup_nomem;
2478 cifs_strfromUCS_le(ses->serverDomain,
2479 (__le16 *)bcc_ptr,
2480 len, nls_codepage);
2481 bcc_ptr += 2 * (len + 1);
2482 ses->serverDomain[2*len] = 0;
2483 ses->serverDomain[1+(2*len)] = 0;
2484 } else { /* else no more room so create
2485 dummy domain string */
2486 if (ses->serverDomain)
2487 kfree(ses->serverDomain);
2488 ses->serverDomain =
2489 kzalloc(2, GFP_KERNEL);
2490 }
2491 } else { /* no room so create dummy domain
2492 and NOS string */
2493
2494 /* if these kcallocs fail not much we
2495 can do, but better to not fail the
2496 sesssetup itself */
2497 kfree(ses->serverDomain);
2498 ses->serverDomain =
2499 kzalloc(2, GFP_KERNEL);
2500 kfree(ses->serverNOS);
2501 ses->serverNOS =
2502 kzalloc(2, GFP_KERNEL);
2503 }
2504 } else { /* ASCII */
2505 len = strnlen(bcc_ptr, 1024);
2506 if (((long) bcc_ptr + len) - (long)
2507 pByteArea(smb_buffer_response)
2508 <= BCC(smb_buffer_response)) {
2509 kfree(ses->serverOS);
2510 ses->serverOS = kzalloc(len + 1,
2511 GFP_KERNEL);
2512 if (ses->serverOS == NULL)
2513 goto sesssetup_nomem;
2514 strncpy(ses->serverOS, bcc_ptr, len);
2515
2516 bcc_ptr += len;
2517 /* null terminate the string */
2518 bcc_ptr[0] = 0;
2519 bcc_ptr++;
2520
2521 len = strnlen(bcc_ptr, 1024);
2522 kfree(ses->serverNOS);
2523 ses->serverNOS = kzalloc(len + 1,
2524 GFP_KERNEL);
2525 if (ses->serverNOS == NULL)
2526 goto sesssetup_nomem;
2527 strncpy(ses->serverNOS, bcc_ptr, len);
2528 bcc_ptr += len;
2529 bcc_ptr[0] = 0;
2530 bcc_ptr++;
2531
2532 len = strnlen(bcc_ptr, 1024);
2533 if (ses->serverDomain)
2534 kfree(ses->serverDomain);
2535 ses->serverDomain = kzalloc(len + 1,
2536 GFP_KERNEL);
2537 if (ses->serverDomain == NULL)
2538 goto sesssetup_nomem;
2539 strncpy(ses->serverDomain, bcc_ptr,
2540 len);
2541 bcc_ptr += len;
2542 bcc_ptr[0] = 0;
2543 bcc_ptr++;
2544 } else
2545 cFYI(1,
2546 ("Variable field of length %d "
2547 "extends beyond end of smb ",
2548 len));
2549 }
2550 } else {
2551 cERROR(1,
2552 (" Security Blob Length extends beyond "
2553 "end of SMB"));
2554 }
2555 } else {
2556 cERROR(1,
2557 (" Invalid Word count %d: ",
2558 smb_buffer_response->WordCount));
2559 rc = -EIO;
2560 }
2561 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2562 since that could make reconnection harder, and
2563 reconnection might be needed to free memory */
2564 cifs_buf_release(smb_buffer);
2565
2566 return rc;
2567 }
2568
2569 static int
2570 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2571 struct cifsSesInfo *ses, int *pNTLMv2_flag,
2572 const struct nls_table *nls_codepage)
2573 {
2574 struct smb_hdr *smb_buffer;
2575 struct smb_hdr *smb_buffer_response;
2576 SESSION_SETUP_ANDX *pSMB;
2577 SESSION_SETUP_ANDX *pSMBr;
2578 char *bcc_ptr;
2579 char *domain;
2580 int rc = 0;
2581 int remaining_words = 0;
2582 int bytes_returned = 0;
2583 int len;
2584 int SecurityBlobLength = sizeof(NEGOTIATE_MESSAGE);
2585 PNEGOTIATE_MESSAGE SecurityBlob;
2586 PCHALLENGE_MESSAGE SecurityBlob2;
2587 __u32 negotiate_flags, capabilities;
2588 __u16 count;
2589
2590 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2591 if (ses == NULL)
2592 return -EINVAL;
2593 domain = ses->domainName;
2594 *pNTLMv2_flag = FALSE;
2595 smb_buffer = cifs_buf_get();
2596 if (smb_buffer == NULL) {
2597 return -ENOMEM;
2598 }
2599 smb_buffer_response = smb_buffer;
2600 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2601 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2602
2603 /* send SMBsessionSetup here */
2604 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2605 NULL /* no tCon exists yet */ , 12 /* wct */ );
2606
2607 smb_buffer->Mid = GetNextMid(ses->server);
2608 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2609 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2610
2611 pSMB->req.AndXCommand = 0xFF;
2612 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2613 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2614
2615 if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2616 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2617
2618 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2619 CAP_EXTENDED_SECURITY;
2620 if (ses->capabilities & CAP_UNICODE) {
2621 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2622 capabilities |= CAP_UNICODE;
2623 }
2624 if (ses->capabilities & CAP_STATUS32) {
2625 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2626 capabilities |= CAP_STATUS32;
2627 }
2628 if (ses->capabilities & CAP_DFS) {
2629 smb_buffer->Flags2 |= SMBFLG2_DFS;
2630 capabilities |= CAP_DFS;
2631 }
2632 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2633
2634 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2635 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2636 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2637 SecurityBlob->MessageType = NtLmNegotiate;
2638 negotiate_flags =
2639 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2640 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2641 NTLMSSP_NEGOTIATE_56 |
2642 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2643 if (sign_CIFS_PDUs)
2644 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2645 /* if (ntlmv2_support)
2646 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2647 /* setup pointers to domain name and workstation name */
2648 bcc_ptr += SecurityBlobLength;
2649
2650 SecurityBlob->WorkstationName.Buffer = 0;
2651 SecurityBlob->WorkstationName.Length = 0;
2652 SecurityBlob->WorkstationName.MaximumLength = 0;
2653
2654 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2655 along with username on auth request (ie the response to challenge) */
2656 SecurityBlob->DomainName.Buffer = 0;
2657 SecurityBlob->DomainName.Length = 0;
2658 SecurityBlob->DomainName.MaximumLength = 0;
2659 if (ses->capabilities & CAP_UNICODE) {
2660 if ((long) bcc_ptr % 2) {
2661 *bcc_ptr = 0;
2662 bcc_ptr++;
2663 }
2664
2665 bytes_returned =
2666 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2667 32, nls_codepage);
2668 bcc_ptr += 2 * bytes_returned;
2669 bytes_returned =
2670 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2671 nls_codepage);
2672 bcc_ptr += 2 * bytes_returned;
2673 bcc_ptr += 2; /* null terminate Linux version */
2674 bytes_returned =
2675 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2676 64, nls_codepage);
2677 bcc_ptr += 2 * bytes_returned;
2678 *(bcc_ptr + 1) = 0;
2679 *(bcc_ptr + 2) = 0;
2680 bcc_ptr += 2; /* null terminate network opsys string */
2681 *(bcc_ptr + 1) = 0;
2682 *(bcc_ptr + 2) = 0;
2683 bcc_ptr += 2; /* null domain */
2684 } else { /* ASCII */
2685 strcpy(bcc_ptr, "Linux version ");
2686 bcc_ptr += strlen("Linux version ");
2687 strcpy(bcc_ptr, utsname()->release);
2688 bcc_ptr += strlen(utsname()->release) + 1;
2689 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2690 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2691 bcc_ptr++; /* empty domain field */
2692 *bcc_ptr = 0;
2693 }
2694 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2695 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2696 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2697 smb_buffer->smb_buf_length += count;
2698 pSMB->req.ByteCount = cpu_to_le16(count);
2699
2700 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2701 &bytes_returned, CIFS_LONG_OP);
2702
2703 if (smb_buffer_response->Status.CifsError ==
2704 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2705 rc = 0;
2706
2707 if (rc) {
2708 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2709 } else if ((smb_buffer_response->WordCount == 3)
2710 || (smb_buffer_response->WordCount == 4)) {
2711 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2712 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2713
2714 if (action & GUEST_LOGIN)
2715 cFYI(1, (" Guest login"));
2716 /* Do we want to set anything in SesInfo struct when guest login? */
2717
2718 bcc_ptr = pByteArea(smb_buffer_response);
2719 /* response can have either 3 or 4 word count - Samba sends 3 */
2720
2721 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2722 if (SecurityBlob2->MessageType != NtLmChallenge) {
2723 cFYI(1,
2724 ("Unexpected NTLMSSP message type received %d",
2725 SecurityBlob2->MessageType));
2726 } else if (ses) {
2727 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2728 cFYI(1, ("UID = %d", ses->Suid));
2729 if ((pSMBr->resp.hdr.WordCount == 3)
2730 || ((pSMBr->resp.hdr.WordCount == 4)
2731 && (blob_len <
2732 pSMBr->resp.ByteCount))) {
2733
2734 if (pSMBr->resp.hdr.WordCount == 4) {
2735 bcc_ptr += blob_len;
2736 cFYI(1, ("Security Blob Length %d",
2737 blob_len));
2738 }
2739
2740 cFYI(1, ("NTLMSSP Challenge rcvd"));
2741
2742 memcpy(ses->server->cryptKey,
2743 SecurityBlob2->Challenge,
2744 CIFS_CRYPTO_KEY_SIZE);
2745 if (SecurityBlob2->NegotiateFlags &
2746 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2747 *pNTLMv2_flag = TRUE;
2748
2749 if ((SecurityBlob2->NegotiateFlags &
2750 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2751 || (sign_CIFS_PDUs > 1))
2752 ses->server->secMode |=
2753 SECMODE_SIGN_REQUIRED;
2754 if ((SecurityBlob2->NegotiateFlags &
2755 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2756 ses->server->secMode |=
2757 SECMODE_SIGN_ENABLED;
2758
2759 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2760 if ((long) (bcc_ptr) % 2) {
2761 remaining_words =
2762 (BCC(smb_buffer_response)
2763 - 1) / 2;
2764 /* Must word align unicode strings */
2765 bcc_ptr++;
2766 } else {
2767 remaining_words =
2768 BCC
2769 (smb_buffer_response) / 2;
2770 }
2771 len =
2772 UniStrnlen((wchar_t *) bcc_ptr,
2773 remaining_words - 1);
2774 /* We look for obvious messed up bcc or strings in response so we do not go off
2775 the end since (at least) WIN2K and Windows XP have a major bug in not null
2776 terminating last Unicode string in response */
2777 if (ses->serverOS)
2778 kfree(ses->serverOS);
2779 ses->serverOS =
2780 kzalloc(2 * (len + 1), GFP_KERNEL);
2781 cifs_strfromUCS_le(ses->serverOS,
2782 (__le16 *)
2783 bcc_ptr, len,
2784 nls_codepage);
2785 bcc_ptr += 2 * (len + 1);
2786 remaining_words -= len + 1;
2787 ses->serverOS[2 * len] = 0;
2788 ses->serverOS[1 + (2 * len)] = 0;
2789 if (remaining_words > 0) {
2790 len = UniStrnlen((wchar_t *)
2791 bcc_ptr,
2792 remaining_words
2793 - 1);
2794 kfree(ses->serverNOS);
2795 ses->serverNOS =
2796 kzalloc(2 * (len + 1),
2797 GFP_KERNEL);
2798 cifs_strfromUCS_le(ses->
2799 serverNOS,
2800 (__le16 *)
2801 bcc_ptr,
2802 len,
2803 nls_codepage);
2804 bcc_ptr += 2 * (len + 1);
2805 ses->serverNOS[2 * len] = 0;
2806 ses->serverNOS[1 +
2807 (2 * len)] = 0;
2808 remaining_words -= len + 1;
2809 if (remaining_words > 0) {
2810 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2811 /* last string not always null terminated
2812 (for e.g. for Windows XP & 2000) */
2813 kfree(ses->serverDomain);
2814 ses->serverDomain =
2815 kzalloc(2 *
2816 (len +
2817 1),
2818 GFP_KERNEL);
2819 cifs_strfromUCS_le
2820 (ses->serverDomain,
2821 (__le16 *)bcc_ptr,
2822 len, nls_codepage);
2823 bcc_ptr +=
2824 2 * (len + 1);
2825 ses->serverDomain[2*len]
2826 = 0;
2827 ses->serverDomain
2828 [1 + (2 * len)]
2829 = 0;
2830 } /* else no more room so create dummy domain string */
2831 else {
2832 kfree(ses->serverDomain);
2833 ses->serverDomain =
2834 kzalloc(2,
2835 GFP_KERNEL);
2836 }
2837 } else { /* no room so create dummy domain and NOS string */
2838 kfree(ses->serverDomain);
2839 ses->serverDomain =
2840 kzalloc(2, GFP_KERNEL);
2841 kfree(ses->serverNOS);
2842 ses->serverNOS =
2843 kzalloc(2, GFP_KERNEL);
2844 }
2845 } else { /* ASCII */
2846 len = strnlen(bcc_ptr, 1024);
2847 if (((long) bcc_ptr + len) - (long)
2848 pByteArea(smb_buffer_response)
2849 <= BCC(smb_buffer_response)) {
2850 if (ses->serverOS)
2851 kfree(ses->serverOS);
2852 ses->serverOS =
2853 kzalloc(len + 1,
2854 GFP_KERNEL);
2855 strncpy(ses->serverOS,
2856 bcc_ptr, len);
2857
2858 bcc_ptr += len;
2859 bcc_ptr[0] = 0; /* null terminate string */
2860 bcc_ptr++;
2861
2862 len = strnlen(bcc_ptr, 1024);
2863 kfree(ses->serverNOS);
2864 ses->serverNOS =
2865 kzalloc(len + 1,
2866 GFP_KERNEL);
2867 strncpy(ses->serverNOS, bcc_ptr, len);
2868 bcc_ptr += len;
2869 bcc_ptr[0] = 0;
2870 bcc_ptr++;
2871
2872 len = strnlen(bcc_ptr, 1024);
2873 kfree(ses->serverDomain);
2874 ses->serverDomain =
2875 kzalloc(len + 1,
2876 GFP_KERNEL);
2877 strncpy(ses->serverDomain,
2878 bcc_ptr, len);
2879 bcc_ptr += len;
2880 bcc_ptr[0] = 0;
2881 bcc_ptr++;
2882 } else
2883 cFYI(1,
2884 ("field of length %d "
2885 "extends beyond end of smb",
2886 len));
2887 }
2888 } else {
2889 cERROR(1, ("Security Blob Length extends beyond"
2890 " end of SMB"));
2891 }
2892 } else {
2893 cERROR(1, ("No session structure passed in."));
2894 }
2895 } else {
2896 cERROR(1,
2897 (" Invalid Word count %d:",
2898 smb_buffer_response->WordCount));
2899 rc = -EIO;
2900 }
2901
2902 cifs_buf_release(smb_buffer);
2903
2904 return rc;
2905 }
2906 static int
2907 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2908 char *ntlm_session_key, int ntlmv2_flag,
2909 const struct nls_table *nls_codepage)
2910 {
2911 struct smb_hdr *smb_buffer;
2912 struct smb_hdr *smb_buffer_response;
2913 SESSION_SETUP_ANDX *pSMB;
2914 SESSION_SETUP_ANDX *pSMBr;
2915 char *bcc_ptr;
2916 char *user;
2917 char *domain;
2918 int rc = 0;
2919 int remaining_words = 0;
2920 int bytes_returned = 0;
2921 int len;
2922 int SecurityBlobLength = sizeof(AUTHENTICATE_MESSAGE);
2923 PAUTHENTICATE_MESSAGE SecurityBlob;
2924 __u32 negotiate_flags, capabilities;
2925 __u16 count;
2926
2927 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2928 if (ses == NULL)
2929 return -EINVAL;
2930 user = ses->userName;
2931 domain = ses->domainName;
2932 smb_buffer = cifs_buf_get();
2933 if (smb_buffer == NULL) {
2934 return -ENOMEM;
2935 }
2936 smb_buffer_response = smb_buffer;
2937 pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
2938 pSMBr = (SESSION_SETUP_ANDX *)smb_buffer_response;
2939
2940 /* send SMBsessionSetup here */
2941 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2942 NULL /* no tCon exists yet */ , 12 /* wct */ );
2943
2944 smb_buffer->Mid = GetNextMid(ses->server);
2945 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2946 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2947 pSMB->req.AndXCommand = 0xFF;
2948 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2949 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2950
2951 pSMB->req.hdr.Uid = ses->Suid;
2952
2953 if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2954 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2955
2956 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2957 CAP_EXTENDED_SECURITY;
2958 if (ses->capabilities & CAP_UNICODE) {
2959 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2960 capabilities |= CAP_UNICODE;
2961 }
2962 if (ses->capabilities & CAP_STATUS32) {
2963 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2964 capabilities |= CAP_STATUS32;
2965 }
2966 if (ses->capabilities & CAP_DFS) {
2967 smb_buffer->Flags2 |= SMBFLG2_DFS;
2968 capabilities |= CAP_DFS;
2969 }
2970 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2971
2972 bcc_ptr = (char *)&pSMB->req.SecurityBlob;
2973 SecurityBlob = (PAUTHENTICATE_MESSAGE)bcc_ptr;
2974 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2975 SecurityBlob->MessageType = NtLmAuthenticate;
2976 bcc_ptr += SecurityBlobLength;
2977 negotiate_flags = NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2978 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2979 0x80000000 | NTLMSSP_NEGOTIATE_128;
2980 if (sign_CIFS_PDUs)
2981 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2982 if (ntlmv2_flag)
2983 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2984
2985 /* setup pointers to domain name and workstation name */
2986
2987 SecurityBlob->WorkstationName.Buffer = 0;
2988 SecurityBlob->WorkstationName.Length = 0;
2989 SecurityBlob->WorkstationName.MaximumLength = 0;
2990 SecurityBlob->SessionKey.Length = 0;
2991 SecurityBlob->SessionKey.MaximumLength = 0;
2992 SecurityBlob->SessionKey.Buffer = 0;
2993
2994 SecurityBlob->LmChallengeResponse.Length = 0;
2995 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2996 SecurityBlob->LmChallengeResponse.Buffer = 0;
2997
2998 SecurityBlob->NtChallengeResponse.Length =
2999 cpu_to_le16(CIFS_SESS_KEY_SIZE);
3000 SecurityBlob->NtChallengeResponse.MaximumLength =
3001 cpu_to_le16(CIFS_SESS_KEY_SIZE);
3002 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
3003 SecurityBlob->NtChallengeResponse.Buffer =
3004 cpu_to_le32(SecurityBlobLength);
3005 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
3006 bcc_ptr += CIFS_SESS_KEY_SIZE;
3007
3008 if (ses->capabilities & CAP_UNICODE) {
3009 if (domain == NULL) {
3010 SecurityBlob->DomainName.Buffer = 0;
3011 SecurityBlob->DomainName.Length = 0;
3012 SecurityBlob->DomainName.MaximumLength = 0;
3013 } else {
3014 __u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
3015 nls_codepage);
3016 ln *= 2;
3017 SecurityBlob->DomainName.MaximumLength =
3018 cpu_to_le16(ln);
3019 SecurityBlob->DomainName.Buffer =
3020 cpu_to_le32(SecurityBlobLength);
3021 bcc_ptr += ln;
3022 SecurityBlobLength += ln;
3023 SecurityBlob->DomainName.Length = cpu_to_le16(ln);
3024 }
3025 if (user == NULL) {
3026 SecurityBlob->UserName.Buffer = 0;
3027 SecurityBlob->UserName.Length = 0;
3028 SecurityBlob->UserName.MaximumLength = 0;
3029 } else {
3030 __u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
3031 nls_codepage);
3032 ln *= 2;
3033 SecurityBlob->UserName.MaximumLength =
3034 cpu_to_le16(ln);
3035 SecurityBlob->UserName.Buffer =
3036 cpu_to_le32(SecurityBlobLength);
3037 bcc_ptr += ln;
3038 SecurityBlobLength += ln;
3039 SecurityBlob->UserName.Length = cpu_to_le16(ln);
3040 }
3041
3042 /* SecurityBlob->WorkstationName.Length =
3043 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
3044 SecurityBlob->WorkstationName.Length *= 2;
3045 SecurityBlob->WorkstationName.MaximumLength =
3046 cpu_to_le16(SecurityBlob->WorkstationName.Length);
3047 SecurityBlob->WorkstationName.Buffer =
3048 cpu_to_le32(SecurityBlobLength);
3049 bcc_ptr += SecurityBlob->WorkstationName.Length;
3050 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3051 SecurityBlob->WorkstationName.Length =
3052 cpu_to_le16(SecurityBlob->WorkstationName.Length); */
3053
3054 if ((long) bcc_ptr % 2) {
3055 *bcc_ptr = 0;
3056 bcc_ptr++;
3057 }
3058 bytes_returned =
3059 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
3060 32, nls_codepage);
3061 bcc_ptr += 2 * bytes_returned;
3062 bytes_returned =
3063 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
3064 nls_codepage);
3065 bcc_ptr += 2 * bytes_returned;
3066 bcc_ptr += 2; /* null term version string */
3067 bytes_returned =
3068 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
3069 64, nls_codepage);
3070 bcc_ptr += 2 * bytes_returned;
3071 *(bcc_ptr + 1) = 0;
3072 *(bcc_ptr + 2) = 0;
3073 bcc_ptr += 2; /* null terminate network opsys string */
3074 *(bcc_ptr + 1) = 0;
3075 *(bcc_ptr + 2) = 0;
3076 bcc_ptr += 2; /* null domain */
3077 } else { /* ASCII */
3078 if (domain == NULL) {
3079 SecurityBlob->DomainName.Buffer = 0;
3080 SecurityBlob->DomainName.Length = 0;
3081 SecurityBlob->DomainName.MaximumLength = 0;
3082 } else {
3083 __u16 ln;
3084 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
3085 strncpy(bcc_ptr, domain, 63);
3086 ln = strnlen(domain, 64);
3087 SecurityBlob->DomainName.MaximumLength =
3088 cpu_to_le16(ln);
3089 SecurityBlob->DomainName.Buffer =
3090 cpu_to_le32(SecurityBlobLength);
3091 bcc_ptr += ln;
3092 SecurityBlobLength += ln;
3093 SecurityBlob->DomainName.Length = cpu_to_le16(ln);
3094 }
3095 if (user == NULL) {
3096 SecurityBlob->UserName.Buffer = 0;
3097 SecurityBlob->UserName.Length = 0;
3098 SecurityBlob->UserName.MaximumLength = 0;
3099 } else {
3100 __u16 ln;
3101 strncpy(bcc_ptr, user, 63);
3102 ln = strnlen(user, 64);
3103 SecurityBlob->UserName.MaximumLength = cpu_to_le16(ln);
3104 SecurityBlob->UserName.Buffer =
3105 cpu_to_le32(SecurityBlobLength);
3106 bcc_ptr += ln;
3107 SecurityBlobLength += ln;
3108 SecurityBlob->UserName.Length = cpu_to_le16(ln);
3109 }
3110 /* BB fill in our workstation name if known BB */
3111
3112 strcpy(bcc_ptr, "Linux version ");
3113 bcc_ptr += strlen("Linux version ");
3114 strcpy(bcc_ptr, utsname()->release);
3115 bcc_ptr += strlen(utsname()->release) + 1;
3116 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
3117 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
3118 bcc_ptr++; /* null domain */
3119 *bcc_ptr = 0;
3120 }
3121 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
3122 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
3123 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
3124 smb_buffer->smb_buf_length += count;
3125 pSMB->req.ByteCount = cpu_to_le16(count);
3126
3127 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3128 &bytes_returned, CIFS_LONG_OP);
3129 if (rc) {
3130 /* rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
3131 } else if ((smb_buffer_response->WordCount == 3) ||
3132 (smb_buffer_response->WordCount == 4)) {
3133 __u16 action = le16_to_cpu(pSMBr->resp.Action);
3134 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
3135 if (action & GUEST_LOGIN)
3136 cFYI(1, (" Guest login")); /* BB Should we set anything
3137 in SesInfo struct ? */
3138 /* if (SecurityBlob2->MessageType != NtLm??) {
3139 cFYI("Unexpected message type on auth response is %d"));
3140 } */
3141
3142 if (ses) {
3143 cFYI(1,
3144 ("Check challenge UID %d vs auth response UID %d",
3145 ses->Suid, smb_buffer_response->Uid));
3146 /* UID left in wire format */
3147 ses->Suid = smb_buffer_response->Uid;
3148 bcc_ptr = pByteArea(smb_buffer_response);
3149 /* response can have either 3 or 4 word count - Samba sends 3 */
3150 if ((pSMBr->resp.hdr.WordCount == 3)
3151 || ((pSMBr->resp.hdr.WordCount == 4)
3152 && (blob_len <
3153 pSMBr->resp.ByteCount))) {
3154 if (pSMBr->resp.hdr.WordCount == 4) {
3155 bcc_ptr +=
3156 blob_len;
3157 cFYI(1,
3158 ("Security Blob Length %d ",
3159 blob_len));
3160 }
3161
3162 cFYI(1,
3163 ("NTLMSSP response to Authenticate "));
3164
3165 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3166 if ((long) (bcc_ptr) % 2) {
3167 remaining_words =
3168 (BCC(smb_buffer_response)
3169 - 1) / 2;
3170 bcc_ptr++; /* Unicode strings must be word aligned */
3171 } else {
3172 remaining_words = BCC(smb_buffer_response) / 2;
3173 }
3174 len = UniStrnlen((wchar_t *) bcc_ptr,
3175 remaining_words - 1);
3176 /* We look for obvious messed up bcc or strings in response so we do not go off
3177 the end since (at least) WIN2K and Windows XP have a major bug in not null
3178 terminating last Unicode string in response */
3179 if (ses->serverOS)
3180 kfree(ses->serverOS);
3181 ses->serverOS =
3182 kzalloc(2 * (len + 1), GFP_KERNEL);
3183 cifs_strfromUCS_le(ses->serverOS,
3184 (__le16 *)
3185 bcc_ptr, len,
3186 nls_codepage);
3187 bcc_ptr += 2 * (len + 1);
3188 remaining_words -= len + 1;
3189 ses->serverOS[2 * len] = 0;
3190 ses->serverOS[1 + (2 * len)] = 0;
3191 if (remaining_words > 0) {
3192 len = UniStrnlen((wchar_t *)
3193 bcc_ptr,
3194 remaining_words
3195 - 1);
3196 kfree(ses->serverNOS);
3197 ses->serverNOS =
3198 kzalloc(2 * (len + 1),
3199 GFP_KERNEL);
3200 cifs_strfromUCS_le(ses->
3201 serverNOS,
3202 (__le16 *)
3203 bcc_ptr,
3204 len,
3205 nls_codepage);
3206 bcc_ptr += 2 * (len + 1);
3207 ses->serverNOS[2 * len] = 0;
3208 ses->serverNOS[1+(2*len)] = 0;
3209 remaining_words -= len + 1;
3210 if (remaining_words > 0) {
3211 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3212 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3213 if (ses->serverDomain)
3214 kfree(ses->serverDomain);
3215 ses->serverDomain =
3216 kzalloc(2 *
3217 (len +
3218 1),
3219 GFP_KERNEL);
3220 cifs_strfromUCS_le
3221 (ses->
3222 serverDomain,
3223 (__le16 *)
3224 bcc_ptr, len,
3225 nls_codepage);
3226 bcc_ptr +=
3227 2 * (len + 1);
3228 ses->
3229 serverDomain[2
3230 * len]
3231 = 0;
3232 ses->
3233 serverDomain[1
3234 +
3235 (2
3236 *
3237 len)]
3238 = 0;
3239 } /* else no more room so create dummy domain string */
3240 else {
3241 if (ses->serverDomain)
3242 kfree(ses->serverDomain);
3243 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3244 }
3245 } else { /* no room so create dummy domain and NOS string */
3246 if (ses->serverDomain)
3247 kfree(ses->serverDomain);
3248 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3249 kfree(ses->serverNOS);
3250 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3251 }
3252 } else { /* ASCII */
3253 len = strnlen(bcc_ptr, 1024);
3254 if (((long) bcc_ptr + len) -
3255 (long) pByteArea(smb_buffer_response)
3256 <= BCC(smb_buffer_response)) {
3257 if (ses->serverOS)
3258 kfree(ses->serverOS);
3259 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
3260 strncpy(ses->serverOS,bcc_ptr, len);
3261
3262 bcc_ptr += len;
3263 bcc_ptr[0] = 0; /* null terminate the string */
3264 bcc_ptr++;
3265
3266 len = strnlen(bcc_ptr, 1024);
3267 kfree(ses->serverNOS);
3268 ses->serverNOS = kzalloc(len+1,
3269 GFP_KERNEL);
3270 strncpy(ses->serverNOS,
3271 bcc_ptr, len);
3272 bcc_ptr += len;
3273 bcc_ptr[0] = 0;
3274 bcc_ptr++;
3275
3276 len = strnlen(bcc_ptr, 1024);
3277 if (ses->serverDomain)
3278 kfree(ses->serverDomain);
3279 ses->serverDomain =
3280 kzalloc(len+1,
3281 GFP_KERNEL);
3282 strncpy(ses->serverDomain,
3283 bcc_ptr, len);
3284 bcc_ptr += len;
3285 bcc_ptr[0] = 0;
3286 bcc_ptr++;
3287 } else
3288 cFYI(1, ("field of length %d "
3289 "extends beyond end of smb ",
3290 len));
3291 }
3292 } else {
3293 cERROR(1, ("Security Blob extends beyond end "
3294 "of SMB"));
3295 }
3296 } else {
3297 cERROR(1, ("No session structure passed in."));
3298 }
3299 } else {
3300 cERROR(1, ("Invalid Word count %d: ",
3301 smb_buffer_response->WordCount));
3302 rc = -EIO;
3303 }
3304
3305 cifs_buf_release(smb_buffer);
3306
3307 return rc;
3308 }
3309
3310 int
3311 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3312 const char *tree, struct cifsTconInfo *tcon,
3313 const struct nls_table *nls_codepage)
3314 {
3315 struct smb_hdr *smb_buffer;
3316 struct smb_hdr *smb_buffer_response;
3317 TCONX_REQ *pSMB;
3318 TCONX_RSP *pSMBr;
3319 unsigned char *bcc_ptr;
3320 int rc = 0;
3321 int length;
3322 __u16 count;
3323
3324 if (ses == NULL)
3325 return -EIO;
3326
3327 smb_buffer = cifs_buf_get();
3328 if (smb_buffer == NULL) {
3329 return -ENOMEM;
3330 }
3331 smb_buffer_response = smb_buffer;
3332
3333 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3334 NULL /*no tid */ , 4 /*wct */ );
3335
3336 smb_buffer->Mid = GetNextMid(ses->server);
3337 smb_buffer->Uid = ses->Suid;
3338 pSMB = (TCONX_REQ *) smb_buffer;
3339 pSMBr = (TCONX_RSP *) smb_buffer_response;
3340
3341 pSMB->AndXCommand = 0xFF;
3342 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3343 bcc_ptr = &pSMB->Password[0];
3344 if ((ses->server->secMode) & SECMODE_USER) {
3345 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3346 *bcc_ptr = 0; /* password is null byte */
3347 bcc_ptr++; /* skip password */
3348 /* already aligned so no need to do it below */
3349 } else {
3350 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3351 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3352 specified as required (when that support is added to
3353 the vfs in the future) as only NTLM or the much
3354 weaker LANMAN (which we do not send by default) is accepted
3355 by Samba (not sure whether other servers allow
3356 NTLMv2 password here) */
3357 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3358 if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3359 (ses->server->secType == LANMAN))
3360 calc_lanman_hash(ses, bcc_ptr);
3361 else
3362 #endif /* CIFS_WEAK_PW_HASH */
3363 SMBNTencrypt(ses->password,
3364 ses->server->cryptKey,
3365 bcc_ptr);
3366
3367 bcc_ptr += CIFS_SESS_KEY_SIZE;
3368 if (ses->capabilities & CAP_UNICODE) {
3369 /* must align unicode strings */
3370 *bcc_ptr = 0; /* null byte password */
3371 bcc_ptr++;
3372 }
3373 }
3374
3375 if (ses->server->secMode &
3376 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3377 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3378
3379 if (ses->capabilities & CAP_STATUS32) {
3380 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3381 }
3382 if (ses->capabilities & CAP_DFS) {
3383 smb_buffer->Flags2 |= SMBFLG2_DFS;
3384 }
3385 if (ses->capabilities & CAP_UNICODE) {
3386 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3387 length =
3388 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3389 6 /* max utf8 char length in bytes */ *
3390 (/* server len*/ + 256 /* share len */), nls_codepage);
3391 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3392 bcc_ptr += 2; /* skip trailing null */
3393 } else { /* ASCII */
3394 strcpy(bcc_ptr, tree);
3395 bcc_ptr += strlen(tree) + 1;
3396 }
3397 strcpy(bcc_ptr, "?????");
3398 bcc_ptr += strlen("?????");
3399 bcc_ptr += 1;
3400 count = bcc_ptr - &pSMB->Password[0];
3401 pSMB->hdr.smb_buf_length += count;
3402 pSMB->ByteCount = cpu_to_le16(count);
3403
3404 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3405 CIFS_STD_OP);
3406
3407 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3408 /* above now done in SendReceive */
3409 if ((rc == 0) && (tcon != NULL)) {
3410 tcon->tidStatus = CifsGood;
3411 tcon->tid = smb_buffer_response->Tid;
3412 bcc_ptr = pByteArea(smb_buffer_response);
3413 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3414 /* skip service field (NB: this field is always ASCII) */
3415 if (length == 3) {
3416 if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3417 (bcc_ptr[2] == 'C')) {
3418 cFYI(1, ("IPC connection"));
3419 tcon->ipc = 1;
3420 }
3421 } else if (length == 2) {
3422 if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3423 /* the most common case */
3424 cFYI(1, ("disk share connection"));
3425 }
3426 }
3427 bcc_ptr += length + 1;
3428 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3429 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3430 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3431 if ((bcc_ptr + (2 * length)) -
3432 pByteArea(smb_buffer_response) <=
3433 BCC(smb_buffer_response)) {
3434 kfree(tcon->nativeFileSystem);
3435 tcon->nativeFileSystem =
3436 kzalloc(length + 2, GFP_KERNEL);
3437 if (tcon->nativeFileSystem)
3438 cifs_strfromUCS_le(
3439 tcon->nativeFileSystem,
3440 (__le16 *) bcc_ptr,
3441 length, nls_codepage);
3442 bcc_ptr += 2 * length;
3443 bcc_ptr[0] = 0; /* null terminate the string */
3444 bcc_ptr[1] = 0;
3445 bcc_ptr += 2;
3446 }
3447 /* else do not bother copying these information fields*/
3448 } else {
3449 length = strnlen(bcc_ptr, 1024);
3450 if ((bcc_ptr + length) -
3451 pByteArea(smb_buffer_response) <=
3452 BCC(smb_buffer_response)) {
3453 kfree(tcon->nativeFileSystem);
3454 tcon->nativeFileSystem =
3455 kzalloc(length + 1, GFP_KERNEL);
3456 if (tcon->nativeFileSystem)
3457 strncpy(tcon->nativeFileSystem, bcc_ptr,
3458 length);
3459 }
3460 /* else do not bother copying these information fields*/
3461 }
3462 if ((smb_buffer_response->WordCount == 3) ||
3463 (smb_buffer_response->WordCount == 7))
3464 /* field is in same location */
3465 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3466 else
3467 tcon->Flags = 0;
3468 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3469 } else if ((rc == 0) && tcon == NULL) {
3470 /* all we need to save for IPC$ connection */
3471 ses->ipc_tid = smb_buffer_response->Tid;
3472 }
3473
3474 cifs_buf_release(smb_buffer);
3475 return rc;
3476 }
3477
3478 int
3479 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3480 {
3481 int rc = 0;
3482 int xid;
3483 struct cifsSesInfo *ses = NULL;
3484 struct task_struct *cifsd_task;
3485 char *tmp;
3486
3487 xid = GetXid();
3488
3489 if (cifs_sb->tcon) {
3490 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3491 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3492 if (rc == -EBUSY) {
3493 FreeXid(xid);
3494 return 0;
3495 }
3496 tconInfoFree(cifs_sb->tcon);
3497 if ((ses) && (ses->server)) {
3498 /* save off task so we do not refer to ses later */
3499 cifsd_task = ses->server->tsk;
3500 cFYI(1, ("About to do SMBLogoff "));
3501 rc = CIFSSMBLogoff(xid, ses);
3502 if (rc == -EBUSY) {
3503 FreeXid(xid);
3504 return 0;
3505 } else if (rc == -ESHUTDOWN) {
3506 cFYI(1, ("Waking up socket by sending signal"));
3507 if (cifsd_task) {
3508 force_sig(SIGKILL, cifsd_task);
3509 kthread_stop(cifsd_task);
3510 }
3511 rc = 0;
3512 } /* else - we have an smb session
3513 left on this socket do not kill cifsd */
3514 } else
3515 cFYI(1, ("No session or bad tcon"));
3516 }
3517
3518 cifs_sb->tcon = NULL;
3519 tmp = cifs_sb->prepath;
3520 cifs_sb->prepathlen = 0;
3521 cifs_sb->prepath = NULL;
3522 kfree(tmp);
3523 if (ses)
3524 schedule_timeout_interruptible(msecs_to_jiffies(500));
3525 if (ses)
3526 sesInfoFree(ses);
3527
3528 FreeXid(xid);
3529 return rc;
3530 }
3531
3532 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3533 struct nls_table *nls_info)
3534 {
3535 int rc = 0;
3536 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3537 int ntlmv2_flag = FALSE;
3538 int first_time = 0;
3539
3540 /* what if server changes its buffer size after dropping the session? */
3541 if (pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3542 rc = CIFSSMBNegotiate(xid, pSesInfo);
3543 if (rc == -EAGAIN) /* retry only once on 1st time connection */ {
3544 rc = CIFSSMBNegotiate(xid, pSesInfo);
3545 if (rc == -EAGAIN)
3546 rc = -EHOSTDOWN;
3547 }
3548 if (rc == 0) {
3549 spin_lock(&GlobalMid_Lock);
3550 if (pSesInfo->server->tcpStatus != CifsExiting)
3551 pSesInfo->server->tcpStatus = CifsGood;
3552 else
3553 rc = -EHOSTDOWN;
3554 spin_unlock(&GlobalMid_Lock);
3555
3556 }
3557 first_time = 1;
3558 }
3559 if (!rc) {
3560 pSesInfo->flags = 0;
3561 pSesInfo->capabilities = pSesInfo->server->capabilities;
3562 if (linuxExtEnabled == 0)
3563 pSesInfo->capabilities &= (~CAP_UNIX);
3564 /* pSesInfo->sequence_number = 0;*/
3565 cFYI(1,
3566 ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3567 pSesInfo->server->secMode,
3568 pSesInfo->server->capabilities,
3569 pSesInfo->server->timeAdj));
3570 if (experimEnabled < 2)
3571 rc = CIFS_SessSetup(xid, pSesInfo,
3572 first_time, nls_info);
3573 else if (extended_security
3574 && (pSesInfo->capabilities
3575 & CAP_EXTENDED_SECURITY)
3576 && (pSesInfo->server->secType == NTLMSSP)) {
3577 rc = -EOPNOTSUPP;
3578 } else if (extended_security
3579 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3580 && (pSesInfo->server->secType == RawNTLMSSP)) {
3581 cFYI(1, ("NTLMSSP sesssetup"));
3582 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3583 pSesInfo,
3584 &ntlmv2_flag,
3585 nls_info);
3586 if (!rc) {
3587 if (ntlmv2_flag) {
3588 char *v2_response;
3589 cFYI(1, ("more secure NTLM ver2 hash"));
3590 if (CalcNTLMv2_partial_mac_key(pSesInfo,
3591 nls_info)) {
3592 rc = -ENOMEM;
3593 goto ss_err_exit;
3594 } else
3595 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3596 if (v2_response) {
3597 CalcNTLMv2_response(pSesInfo,
3598 v2_response);
3599 /* if (first_time)
3600 cifs_calculate_ntlmv2_mac_key(
3601 pSesInfo->server->mac_signing_key,
3602 response, ntlm_session_key,*/
3603 kfree(v2_response);
3604 /* BB Put dummy sig in SessSetup PDU? */
3605 } else {
3606 rc = -ENOMEM;
3607 goto ss_err_exit;
3608 }
3609
3610 } else {
3611 SMBNTencrypt(pSesInfo->password,
3612 pSesInfo->server->cryptKey,
3613 ntlm_session_key);
3614
3615 if (first_time)
3616 cifs_calculate_mac_key(
3617 &pSesInfo->server->mac_signing_key,
3618 ntlm_session_key,
3619 pSesInfo->password);
3620 }
3621 /* for better security the weaker lanman hash not sent
3622 in AuthSessSetup so we no longer calculate it */
3623
3624 rc = CIFSNTLMSSPAuthSessSetup(xid,
3625 pSesInfo,
3626 ntlm_session_key,
3627 ntlmv2_flag,
3628 nls_info);
3629 }
3630 } else { /* old style NTLM 0.12 session setup */
3631 SMBNTencrypt(pSesInfo->password,
3632 pSesInfo->server->cryptKey,
3633 ntlm_session_key);
3634
3635 if (first_time)
3636 cifs_calculate_mac_key(
3637 &pSesInfo->server->mac_signing_key,
3638 ntlm_session_key, pSesInfo->password);
3639
3640 rc = CIFSSessSetup(xid, pSesInfo,
3641 ntlm_session_key, nls_info);
3642 }
3643 if (rc) {
3644 cERROR(1, ("Send error in SessSetup = %d", rc));
3645 } else {
3646 cFYI(1, ("CIFS Session Established successfully"));
3647 pSesInfo->status = CifsGood;
3648 }
3649 }
3650 ss_err_exit:
3651 return rc;
3652 }
3653
WRT350N Kernel Patches