?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[CIFS] Missing flags2 for DFS
[linux-2.6.22.y-op.git] / fs / cifs / connect.c
blob1d17691086c2d6a6024441d96d729948cec4ebe9
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2006
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/pagevec.h>
34 #include <asm/uaccess.h>
35 #include <asm/processor.h>
36 #include "cifspdu.h"
37 #include "cifsglob.h"
38 #include "cifsproto.h"
39 #include "cifs_unicode.h"
40 #include "cifs_debug.h"
41 #include "cifs_fs_sb.h"
42 #include "ntlmssp.h"
43 #include "nterr.h"
44 #include "rfc1002pdu.h"
45 #include "cn_cifs.h"
46
47 #define CIFS_PORT 445
48 #define RFC1001_PORT 139
49
50 static DECLARE_COMPLETION(cifsd_complete);
51
52 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
53 unsigned char *p24);
54
55 extern mempool_t *cifs_req_poolp;
56
57 struct smb_vol {
58 char *username;
59 char *password;
60 char *domainname;
61 char *UNC;
62 char *UNCip;
63 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
64 char *iocharset; /* local code page for mapping to and from Unicode */
65 char source_rfc1001_name[16]; /* netbios name of client */
66 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
67 uid_t linux_uid;
68 gid_t linux_gid;
69 mode_t file_mode;
70 mode_t dir_mode;
71 unsigned secFlg;
72 unsigned rw:1;
73 unsigned retry:1;
74 unsigned intr:1;
75 unsigned setuids:1;
76 unsigned noperm:1;
77 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
78 unsigned cifs_acl:1;
79 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
80 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
81 unsigned direct_io:1;
82 unsigned remap:1; /* set to remap seven reserved chars in filenames */
83 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
84 unsigned sfu_emul:1;
85 unsigned nullauth:1; /* attempt to authenticate with null user */
86 unsigned nocase; /* request case insensitive filenames */
87 unsigned nobrl; /* disable sending byte range locks to srv */
88 unsigned int rsize;
89 unsigned int wsize;
90 unsigned int sockopt;
91 unsigned short int port;
92 char * prepath;
93 };
94
95 static int ipv4_connect(struct sockaddr_in *psin_server,
96 struct socket **csocket,
97 char * netb_name,
98 char * server_netb_name);
99 static int ipv6_connect(struct sockaddr_in6 *psin_server,
100 struct socket **csocket);
101
102
103 /*
104 * cifs tcp session reconnection
105 *
106 * mark tcp session as reconnecting so temporarily locked
107 * mark all smb sessions as reconnecting for tcp session
108 * reconnect tcp session
109 * wake up waiters on reconnection? - (not needed currently)
110 */
111
112 static int
113 cifs_reconnect(struct TCP_Server_Info *server)
114 {
115 int rc = 0;
116 struct list_head *tmp;
117 struct cifsSesInfo *ses;
118 struct cifsTconInfo *tcon;
119 struct mid_q_entry * mid_entry;
120
121 spin_lock(&GlobalMid_Lock);
122 if(server->tcpStatus == CifsExiting) {
123 /* the demux thread will exit normally
124 next time through the loop */
125 spin_unlock(&GlobalMid_Lock);
126 return rc;
127 } else
128 server->tcpStatus = CifsNeedReconnect;
129 spin_unlock(&GlobalMid_Lock);
130 server->maxBuf = 0;
131
132 cFYI(1, ("Reconnecting tcp session"));
133
134 /* before reconnecting the tcp session, mark the smb session (uid)
135 and the tid bad so they are not used until reconnected */
136 read_lock(&GlobalSMBSeslock);
137 list_for_each(tmp, &GlobalSMBSessionList) {
138 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
139 if (ses->server) {
140 if (ses->server == server) {
141 ses->status = CifsNeedReconnect;
142 ses->ipc_tid = 0;
143 }
144 }
145 /* else tcp and smb sessions need reconnection */
146 }
147 list_for_each(tmp, &GlobalTreeConnectionList) {
148 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
149 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
150 tcon->tidStatus = CifsNeedReconnect;
151 }
152 }
153 read_unlock(&GlobalSMBSeslock);
154 /* do not want to be sending data on a socket we are freeing */
155 down(&server->tcpSem);
156 if(server->ssocket) {
157 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
158 server->ssocket->flags));
159 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
160 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
161 server->ssocket->flags));
162 sock_release(server->ssocket);
163 server->ssocket = NULL;
164 }
165
166 spin_lock(&GlobalMid_Lock);
167 list_for_each(tmp, &server->pending_mid_q) {
168 mid_entry = list_entry(tmp, struct
169 mid_q_entry,
170 qhead);
171 if(mid_entry) {
172 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
173 /* Mark other intransit requests as needing
174 retry so we do not immediately mark the
175 session bad again (ie after we reconnect
176 below) as they timeout too */
177 mid_entry->midState = MID_RETRY_NEEDED;
178 }
179 }
180 }
181 spin_unlock(&GlobalMid_Lock);
182 up(&server->tcpSem);
183
184 while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
185 {
186 try_to_freeze();
187 if(server->protocolType == IPV6) {
188 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
189 } else {
190 rc = ipv4_connect(&server->addr.sockAddr,
191 &server->ssocket,
192 server->workstation_RFC1001_name,
193 server->server_RFC1001_name);
194 }
195 if(rc) {
196 cFYI(1,("reconnect error %d",rc));
197 msleep(3000);
198 } else {
199 atomic_inc(&tcpSesReconnectCount);
200 spin_lock(&GlobalMid_Lock);
201 if(server->tcpStatus != CifsExiting)
202 server->tcpStatus = CifsGood;
203 server->sequence_number = 0;
204 spin_unlock(&GlobalMid_Lock);
205 /* atomic_set(&server->inFlight,0);*/
206 wake_up(&server->response_q);
207 }
208 }
209 return rc;
210 }
211
212 /*
213 return codes:
214 0 not a transact2, or all data present
215 >0 transact2 with that much data missing
216 -EINVAL = invalid transact2
217
218 */
219 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
220 {
221 struct smb_t2_rsp * pSMBt;
222 int total_data_size;
223 int data_in_this_rsp;
224 int remaining;
225
226 if(pSMB->Command != SMB_COM_TRANSACTION2)
227 return 0;
228
229 /* check for plausible wct, bcc and t2 data and parm sizes */
230 /* check for parm and data offset going beyond end of smb */
231 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
232 cFYI(1,("invalid transact2 word count"));
233 return -EINVAL;
234 }
235
236 pSMBt = (struct smb_t2_rsp *)pSMB;
237
238 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
239 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
240
241 remaining = total_data_size - data_in_this_rsp;
242
243 if(remaining == 0)
244 return 0;
245 else if(remaining < 0) {
246 cFYI(1,("total data %d smaller than data in frame %d",
247 total_data_size, data_in_this_rsp));
248 return -EINVAL;
249 } else {
250 cFYI(1,("missing %d bytes from transact2, check next response",
251 remaining));
252 if(total_data_size > maxBufSize) {
253 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
254 total_data_size,maxBufSize));
255 return -EINVAL;
256 }
257 return remaining;
258 }
259 }
260
261 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
262 {
263 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
264 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
265 int total_data_size;
266 int total_in_buf;
267 int remaining;
268 int total_in_buf2;
269 char * data_area_of_target;
270 char * data_area_of_buf2;
271 __u16 byte_count;
272
273 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
274
275 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
276 cFYI(1,("total data sizes of primary and secondary t2 differ"));
277 }
278
279 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
280
281 remaining = total_data_size - total_in_buf;
282
283 if(remaining < 0)
284 return -EINVAL;
285
286 if(remaining == 0) /* nothing to do, ignore */
287 return 0;
288
289 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
290 if(remaining < total_in_buf2) {
291 cFYI(1,("transact2 2nd response contains too much data"));
292 }
293
294 /* find end of first SMB data area */
295 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
296 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
297 /* validate target area */
298
299 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
300 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
301
302 data_area_of_target += total_in_buf;
303
304 /* copy second buffer into end of first buffer */
305 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
306 total_in_buf += total_in_buf2;
307 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
308 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
309 byte_count += total_in_buf2;
310 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
311
312 byte_count = pTargetSMB->smb_buf_length;
313 byte_count += total_in_buf2;
314
315 /* BB also add check that we are not beyond maximum buffer size */
316
317 pTargetSMB->smb_buf_length = byte_count;
318
319 if(remaining == total_in_buf2) {
320 cFYI(1,("found the last secondary response"));
321 return 0; /* we are done */
322 } else /* more responses to go */
323 return 1;
324
325 }
326
327 static int
328 cifs_demultiplex_thread(struct TCP_Server_Info *server)
329 {
330 int length;
331 unsigned int pdu_length, total_read;
332 struct smb_hdr *smb_buffer = NULL;
333 struct smb_hdr *bigbuf = NULL;
334 struct smb_hdr *smallbuf = NULL;
335 struct msghdr smb_msg;
336 struct kvec iov;
337 struct socket *csocket = server->ssocket;
338 struct list_head *tmp;
339 struct cifsSesInfo *ses;
340 struct task_struct *task_to_wake = NULL;
341 struct mid_q_entry *mid_entry;
342 char temp;
343 int isLargeBuf = FALSE;
344 int isMultiRsp;
345 int reconnect;
346
347 daemonize("cifsd");
348 allow_signal(SIGKILL);
349 current->flags |= PF_MEMALLOC;
350 server->tsk = current; /* save process info to wake at shutdown */
351 cFYI(1, ("Demultiplex PID: %d", current->pid));
352 write_lock(&GlobalSMBSeslock);
353 atomic_inc(&tcpSesAllocCount);
354 length = tcpSesAllocCount.counter;
355 write_unlock(&GlobalSMBSeslock);
356 complete(&cifsd_complete);
357 if(length > 1) {
358 mempool_resize(cifs_req_poolp,
359 length + cifs_min_rcv,
360 GFP_KERNEL);
361 }
362
363 while (server->tcpStatus != CifsExiting) {
364 if (try_to_freeze())
365 continue;
366 if (bigbuf == NULL) {
367 bigbuf = cifs_buf_get();
368 if (!bigbuf) {
369 cERROR(1, ("No memory for large SMB response"));
370 msleep(3000);
371 /* retry will check if exiting */
372 continue;
373 }
374 } else if (isLargeBuf) {
375 /* we are reusing a dirty large buf, clear its start */
376 memset(bigbuf, 0, sizeof (struct smb_hdr));
377 }
378
379 if (smallbuf == NULL) {
380 smallbuf = cifs_small_buf_get();
381 if (!smallbuf) {
382 cERROR(1, ("No memory for SMB response"));
383 msleep(1000);
384 /* retry will check if exiting */
385 continue;
386 }
387 /* beginning of smb buffer is cleared in our buf_get */
388 } else /* if existing small buf clear beginning */
389 memset(smallbuf, 0, sizeof (struct smb_hdr));
390
391 isLargeBuf = FALSE;
392 isMultiRsp = FALSE;
393 smb_buffer = smallbuf;
394 iov.iov_base = smb_buffer;
395 iov.iov_len = 4;
396 smb_msg.msg_control = NULL;
397 smb_msg.msg_controllen = 0;
398 length =
399 kernel_recvmsg(csocket, &smb_msg,
400 &iov, 1, 4, 0 /* BB see socket.h flags */);
401
402 if (server->tcpStatus == CifsExiting) {
403 break;
404 } else if (server->tcpStatus == CifsNeedReconnect) {
405 cFYI(1, ("Reconnect after server stopped responding"));
406 cifs_reconnect(server);
407 cFYI(1, ("call to reconnect done"));
408 csocket = server->ssocket;
409 continue;
410 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
411 msleep(1); /* minimum sleep to prevent looping
412 allowing socket to clear and app threads to set
413 tcpStatus CifsNeedReconnect if server hung */
414 continue;
415 } else if (length <= 0) {
416 if (server->tcpStatus == CifsNew) {
417 cFYI(1, ("tcp session abend after SMBnegprot"));
418 /* some servers kill the TCP session rather than
419 returning an SMB negprot error, in which
420 case reconnecting here is not going to help,
421 and so simply return error to mount */
422 break;
423 }
424 if (!try_to_freeze() && (length == -EINTR)) {
425 cFYI(1,("cifsd thread killed"));
426 break;
427 }
428 cFYI(1,("Reconnect after unexpected peek error %d",
429 length));
430 cifs_reconnect(server);
431 csocket = server->ssocket;
432 wake_up(&server->response_q);
433 continue;
434 } else if (length < 4) {
435 cFYI(1,
436 ("Frame under four bytes received (%d bytes long)",
437 length));
438 cifs_reconnect(server);
439 csocket = server->ssocket;
440 wake_up(&server->response_q);
441 continue;
442 }
443
444 /* The right amount was read from socket - 4 bytes */
445 /* so we can now interpret the length field */
446
447 /* the first byte big endian of the length field,
448 is actually not part of the length but the type
449 with the most common, zero, as regular data */
450 temp = *((char *) smb_buffer);
451
452 /* Note that FC 1001 length is big endian on the wire,
453 but we convert it here so it is always manipulated
454 as host byte order */
455 pdu_length = ntohl(smb_buffer->smb_buf_length);
456 smb_buffer->smb_buf_length = pdu_length;
457
458 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
459
460 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
461 continue;
462 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
463 cFYI(1,("Good RFC 1002 session rsp"));
464 continue;
465 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
466 /* we get this from Windows 98 instead of
467 an error on SMB negprot response */
468 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
469 pdu_length));
470 if(server->tcpStatus == CifsNew) {
471 /* if nack on negprot (rather than
472 ret of smb negprot error) reconnecting
473 not going to help, ret error to mount */
474 break;
475 } else {
476 /* give server a second to
477 clean up before reconnect attempt */
478 msleep(1000);
479 /* always try 445 first on reconnect
480 since we get NACK on some if we ever
481 connected to port 139 (the NACK is
482 since we do not begin with RFC1001
483 session initialize frame) */
484 server->addr.sockAddr.sin_port =
485 htons(CIFS_PORT);
486 cifs_reconnect(server);
487 csocket = server->ssocket;
488 wake_up(&server->response_q);
489 continue;
490 }
491 } else if (temp != (char) 0) {
492 cERROR(1,("Unknown RFC 1002 frame"));
493 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
494 length);
495 cifs_reconnect(server);
496 csocket = server->ssocket;
497 continue;
498 }
499
500 /* else we have an SMB response */
501 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
502 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
503 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
504 length, pdu_length+4));
505 cifs_reconnect(server);
506 csocket = server->ssocket;
507 wake_up(&server->response_q);
508 continue;
509 }
510
511 /* else length ok */
512 reconnect = 0;
513
514 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
515 isLargeBuf = TRUE;
516 memcpy(bigbuf, smallbuf, 4);
517 smb_buffer = bigbuf;
518 }
519 length = 0;
520 iov.iov_base = 4 + (char *)smb_buffer;
521 iov.iov_len = pdu_length;
522 for (total_read = 0; total_read < pdu_length;
523 total_read += length) {
524 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
525 pdu_length - total_read, 0);
526 if((server->tcpStatus == CifsExiting) ||
527 (length == -EINTR)) {
528 /* then will exit */
529 reconnect = 2;
530 break;
531 } else if (server->tcpStatus == CifsNeedReconnect) {
532 cifs_reconnect(server);
533 csocket = server->ssocket;
534 /* Reconnect wakes up rspns q */
535 /* Now we will reread sock */
536 reconnect = 1;
537 break;
538 } else if ((length == -ERESTARTSYS) ||
539 (length == -EAGAIN)) {
540 msleep(1); /* minimum sleep to prevent looping,
541 allowing socket to clear and app
542 threads to set tcpStatus
543 CifsNeedReconnect if server hung*/
544 continue;
545 } else if (length <= 0) {
546 cERROR(1,("Received no data, expecting %d",
547 pdu_length - total_read));
548 cifs_reconnect(server);
549 csocket = server->ssocket;
550 reconnect = 1;
551 break;
552 }
553 }
554 if(reconnect == 2)
555 break;
556 else if(reconnect == 1)
557 continue;
558
559 length += 4; /* account for rfc1002 hdr */
560
561
562 dump_smb(smb_buffer, length);
563 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
564 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
565 continue;
566 }
567
568
569 task_to_wake = NULL;
570 spin_lock(&GlobalMid_Lock);
571 list_for_each(tmp, &server->pending_mid_q) {
572 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
573
574 if ((mid_entry->mid == smb_buffer->Mid) &&
575 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
576 (mid_entry->command == smb_buffer->Command)) {
577 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
578 /* We have a multipart transact2 resp */
579 isMultiRsp = TRUE;
580 if(mid_entry->resp_buf) {
581 /* merge response - fix up 1st*/
582 if(coalesce_t2(smb_buffer,
583 mid_entry->resp_buf)) {
584 mid_entry->multiRsp = 1;
585 break;
586 } else {
587 /* all parts received */
588 mid_entry->multiEnd = 1;
589 goto multi_t2_fnd;
590 }
591 } else {
592 if(!isLargeBuf) {
593 cERROR(1,("1st trans2 resp needs bigbuf"));
594 /* BB maybe we can fix this up, switch
595 to already allocated large buffer? */
596 } else {
597 /* Have first buffer */
598 mid_entry->resp_buf =
599 smb_buffer;
600 mid_entry->largeBuf = 1;
601 bigbuf = NULL;
602 }
603 }
604 break;
605 }
606 mid_entry->resp_buf = smb_buffer;
607 if(isLargeBuf)
608 mid_entry->largeBuf = 1;
609 else
610 mid_entry->largeBuf = 0;
611 multi_t2_fnd:
612 task_to_wake = mid_entry->tsk;
613 mid_entry->midState = MID_RESPONSE_RECEIVED;
614 #ifdef CONFIG_CIFS_STATS2
615 mid_entry->when_received = jiffies;
616 #endif
617 /* so we do not time out requests to server
618 which is still responding (since server could
619 be busy but not dead) */
620 server->lstrp = jiffies;
621 break;
622 }
623 }
624 spin_unlock(&GlobalMid_Lock);
625 if (task_to_wake) {
626 /* Was previous buf put in mpx struct for multi-rsp? */
627 if(!isMultiRsp) {
628 /* smb buffer will be freed by user thread */
629 if(isLargeBuf) {
630 bigbuf = NULL;
631 } else
632 smallbuf = NULL;
633 }
634 wake_up_process(task_to_wake);
635 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
636 && (isMultiRsp == FALSE)) {
637 cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
638 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
639 sizeof(struct smb_hdr));
640 #ifdef CONFIG_CIFS_DEBUG2
641 cifs_dump_detail(smb_buffer);
642 cifs_dump_mids(server);
643 #endif /* CIFS_DEBUG2 */
644
645 }
646 } /* end while !EXITING */
647
648 spin_lock(&GlobalMid_Lock);
649 server->tcpStatus = CifsExiting;
650 server->tsk = NULL;
651 /* check if we have blocked requests that need to free */
652 /* Note that cifs_max_pending is normally 50, but
653 can be set at module install time to as little as two */
654 if(atomic_read(&server->inFlight) >= cifs_max_pending)
655 atomic_set(&server->inFlight, cifs_max_pending - 1);
656 /* We do not want to set the max_pending too low or we
657 could end up with the counter going negative */
658 spin_unlock(&GlobalMid_Lock);
659 /* Although there should not be any requests blocked on
660 this queue it can not hurt to be paranoid and try to wake up requests
661 that may haven been blocked when more than 50 at time were on the wire
662 to the same server - they now will see the session is in exit state
663 and get out of SendReceive. */
664 wake_up_all(&server->request_q);
665 /* give those requests time to exit */
666 msleep(125);
667
668 if(server->ssocket) {
669 sock_release(csocket);
670 server->ssocket = NULL;
671 }
672 /* buffer usuallly freed in free_mid - need to free it here on exit */
673 if (bigbuf != NULL)
674 cifs_buf_release(bigbuf);
675 if (smallbuf != NULL)
676 cifs_small_buf_release(smallbuf);
677
678 read_lock(&GlobalSMBSeslock);
679 if (list_empty(&server->pending_mid_q)) {
680 /* loop through server session structures attached to this and
681 mark them dead */
682 list_for_each(tmp, &GlobalSMBSessionList) {
683 ses =
684 list_entry(tmp, struct cifsSesInfo,
685 cifsSessionList);
686 if (ses->server == server) {
687 ses->status = CifsExiting;
688 ses->server = NULL;
689 }
690 }
691 read_unlock(&GlobalSMBSeslock);
692 } else {
693 /* although we can not zero the server struct pointer yet,
694 since there are active requests which may depnd on them,
695 mark the corresponding SMB sessions as exiting too */
696 list_for_each(tmp, &GlobalSMBSessionList) {
697 ses = list_entry(tmp, struct cifsSesInfo,
698 cifsSessionList);
699 if (ses->server == server) {
700 ses->status = CifsExiting;
701 }
702 }
703
704 spin_lock(&GlobalMid_Lock);
705 list_for_each(tmp, &server->pending_mid_q) {
706 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
707 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
708 cFYI(1,
709 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
710 task_to_wake = mid_entry->tsk;
711 if(task_to_wake) {
712 wake_up_process(task_to_wake);
713 }
714 }
715 }
716 spin_unlock(&GlobalMid_Lock);
717 read_unlock(&GlobalSMBSeslock);
718 /* 1/8th of sec is more than enough time for them to exit */
719 msleep(125);
720 }
721
722 if (!list_empty(&server->pending_mid_q)) {
723 /* mpx threads have not exited yet give them
724 at least the smb send timeout time for long ops */
725 /* due to delays on oplock break requests, we need
726 to wait at least 45 seconds before giving up
727 on a request getting a response and going ahead
728 and killing cifsd */
729 cFYI(1, ("Wait for exit from demultiplex thread"));
730 msleep(46000);
731 /* if threads still have not exited they are probably never
732 coming home not much else we can do but free the memory */
733 }
734
735 write_lock(&GlobalSMBSeslock);
736 atomic_dec(&tcpSesAllocCount);
737 length = tcpSesAllocCount.counter;
738
739 /* last chance to mark ses pointers invalid
740 if there are any pointing to this (e.g
741 if a crazy root user tried to kill cifsd
742 kernel thread explicitly this might happen) */
743 list_for_each(tmp, &GlobalSMBSessionList) {
744 ses = list_entry(tmp, struct cifsSesInfo,
745 cifsSessionList);
746 if (ses->server == server) {
747 ses->server = NULL;
748 }
749 }
750 write_unlock(&GlobalSMBSeslock);
751
752 kfree(server);
753 if(length > 0) {
754 mempool_resize(cifs_req_poolp,
755 length + cifs_min_rcv,
756 GFP_KERNEL);
757 }
758
759 complete_and_exit(&cifsd_complete, 0);
760 return 0;
761 }
762
763 static int
764 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
765 {
766 char *value;
767 char *data;
768 unsigned int temp_len, i, j;
769 char separator[2];
770
771 separator[0] = ',';
772 separator[1] = 0;
773
774 if(Local_System_Name[0] != 0)
775 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
776 else {
777 memset(vol->source_rfc1001_name,0x20,15);
778 for(i=0;i < strnlen(system_utsname.nodename,15);i++) {
779 /* does not have to be perfect mapping since field is
780 informational, only used for servers that do not support
781 port 445 and it can be overridden at mount time */
782 vol->source_rfc1001_name[i] =
783 toupper(system_utsname.nodename[i]);
784 }
785 }
786 vol->source_rfc1001_name[15] = 0;
787 /* null target name indicates to use *SMBSERVR default called name
788 if we end up sending RFC1001 session initialize */
789 vol->target_rfc1001_name[0] = 0;
790 vol->linux_uid = current->uid; /* current->euid instead? */
791 vol->linux_gid = current->gid;
792 vol->dir_mode = S_IRWXUGO;
793 /* 2767 perms indicate mandatory locking support */
794 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
795
796 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
797 vol->rw = TRUE;
798 /* default is always to request posix paths. */
799 vol->posix_paths = 1;
800
801 if (!options)
802 return 1;
803
804 if(strncmp(options,"sep=",4) == 0) {
805 if(options[4] != 0) {
806 separator[0] = options[4];
807 options += 5;
808 } else {
809 cFYI(1,("Null separator not allowed"));
810 }
811 }
812
813 while ((data = strsep(&options, separator)) != NULL) {
814 if (!*data)
815 continue;
816 if ((value = strchr(data, '=')) != NULL)
817 *value++ = '\0';
818
819 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
820 vol->no_xattr = 0;
821 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
822 vol->no_xattr = 1;
823 } else if (strnicmp(data, "user", 4) == 0) {
824 if (!value || !*value) {
825 printk(KERN_WARNING
826 "CIFS: invalid or missing username\n");
827 return 1; /* needs_arg; */
828 }
829 if (strnlen(value, 200) < 200) {
830 vol->username = value;
831 } else {
832 printk(KERN_WARNING "CIFS: username too long\n");
833 return 1;
834 }
835 } else if (strnicmp(data, "pass", 4) == 0) {
836 if (!value) {
837 vol->password = NULL;
838 continue;
839 } else if(value[0] == 0) {
840 /* check if string begins with double comma
841 since that would mean the password really
842 does start with a comma, and would not
843 indicate an empty string */
844 if(value[1] != separator[0]) {
845 vol->password = NULL;
846 continue;
847 }
848 }
849 temp_len = strlen(value);
850 /* removed password length check, NTLM passwords
851 can be arbitrarily long */
852
853 /* if comma in password, the string will be
854 prematurely null terminated. Commas in password are
855 specified across the cifs mount interface by a double
856 comma ie ,, and a comma used as in other cases ie ','
857 as a parameter delimiter/separator is single and due
858 to the strsep above is temporarily zeroed. */
859
860 /* NB: password legally can have multiple commas and
861 the only illegal character in a password is null */
862
863 if ((value[temp_len] == 0) &&
864 (value[temp_len+1] == separator[0])) {
865 /* reinsert comma */
866 value[temp_len] = separator[0];
867 temp_len+=2; /* move after the second comma */
868 while(value[temp_len] != 0) {
869 if (value[temp_len] == separator[0]) {
870 if (value[temp_len+1] ==
871 separator[0]) {
872 /* skip second comma */
873 temp_len++;
874 } else {
875 /* single comma indicating start
876 of next parm */
877 break;
878 }
879 }
880 temp_len++;
881 }
882 if(value[temp_len] == 0) {
883 options = NULL;
884 } else {
885 value[temp_len] = 0;
886 /* point option to start of next parm */
887 options = value + temp_len + 1;
888 }
889 /* go from value to value + temp_len condensing
890 double commas to singles. Note that this ends up
891 allocating a few bytes too many, which is ok */
892 vol->password = kzalloc(temp_len, GFP_KERNEL);
893 if(vol->password == NULL) {
894 printk("CIFS: no memory for pass\n");
895 return 1;
896 }
897 for(i=0,j=0;i<temp_len;i++,j++) {
898 vol->password[j] = value[i];
899 if(value[i] == separator[0]
900 && value[i+1] == separator[0]) {
901 /* skip second comma */
902 i++;
903 }
904 }
905 vol->password[j] = 0;
906 } else {
907 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
908 if(vol->password == NULL) {
909 printk("CIFS: no memory for pass\n");
910 return 1;
911 }
912 strcpy(vol->password, value);
913 }
914 } else if (strnicmp(data, "ip", 2) == 0) {
915 if (!value || !*value) {
916 vol->UNCip = NULL;
917 } else if (strnlen(value, 35) < 35) {
918 vol->UNCip = value;
919 } else {
920 printk(KERN_WARNING "CIFS: ip address too long\n");
921 return 1;
922 }
923 } else if (strnicmp(data, "sec", 3) == 0) {
924 if (!value || !*value) {
925 cERROR(1,("no security value specified"));
926 continue;
927 } else if (strnicmp(value, "krb5i", 5) == 0) {
928 vol->secFlg |= CIFSSEC_MAY_KRB5 |
929 CIFSSEC_MUST_SIGN;
930 } else if (strnicmp(value, "krb5p", 5) == 0) {
931 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
932 CIFSSEC_MAY_KRB5; */
933 cERROR(1,("Krb5 cifs privacy not supported"));
934 return 1;
935 } else if (strnicmp(value, "krb5", 4) == 0) {
936 vol->secFlg |= CIFSSEC_MAY_KRB5;
937 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
938 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
939 CIFSSEC_MUST_SIGN;
940 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
941 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
942 } else if (strnicmp(value, "ntlmi", 5) == 0) {
943 vol->secFlg |= CIFSSEC_MAY_NTLM |
944 CIFSSEC_MUST_SIGN;
945 } else if (strnicmp(value, "ntlm", 4) == 0) {
946 /* ntlm is default so can be turned off too */
947 vol->secFlg |= CIFSSEC_MAY_NTLM;
948 } else if (strnicmp(value, "nontlm", 6) == 0) {
949 /* BB is there a better way to do this? */
950 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
951 #ifdef CONFIG_CIFS_WEAK_PW_HASH
952 } else if (strnicmp(value, "lanman", 6) == 0) {
953 vol->secFlg |= CIFSSEC_MAY_LANMAN;
954 #endif
955 } else if (strnicmp(value, "none", 4) == 0) {
956 vol->nullauth = 1;
957 } else {
958 cERROR(1,("bad security option: %s", value));
959 return 1;
960 }
961 } else if ((strnicmp(data, "unc", 3) == 0)
962 || (strnicmp(data, "target", 6) == 0)
963 || (strnicmp(data, "path", 4) == 0)) {
964 if (!value || !*value) {
965 printk(KERN_WARNING
966 "CIFS: invalid path to network resource\n");
967 return 1; /* needs_arg; */
968 }
969 if ((temp_len = strnlen(value, 300)) < 300) {
970 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
971 if(vol->UNC == NULL)
972 return 1;
973 strcpy(vol->UNC,value);
974 if (strncmp(vol->UNC, "//", 2) == 0) {
975 vol->UNC[0] = '\\';
976 vol->UNC[1] = '\\';
977 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
978 printk(KERN_WARNING
979 "CIFS: UNC Path does not begin with // or \\\\ \n");
980 return 1;
981 }
982 } else {
983 printk(KERN_WARNING "CIFS: UNC name too long\n");
984 return 1;
985 }
986 } else if ((strnicmp(data, "domain", 3) == 0)
987 || (strnicmp(data, "workgroup", 5) == 0)) {
988 if (!value || !*value) {
989 printk(KERN_WARNING "CIFS: invalid domain name\n");
990 return 1; /* needs_arg; */
991 }
992 /* BB are there cases in which a comma can be valid in
993 a domain name and need special handling? */
994 if (strnlen(value, 256) < 256) {
995 vol->domainname = value;
996 cFYI(1, ("Domain name set"));
997 } else {
998 printk(KERN_WARNING "CIFS: domain name too long\n");
999 return 1;
1000 }
1001 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1002 if (!value || !*value) {
1003 printk(KERN_WARNING
1004 "CIFS: invalid path prefix\n");
1005 return 1; /* needs_arg; */
1006 }
1007 if ((temp_len = strnlen(value, 1024)) < 1024) {
1008 if(value[0] != '/')
1009 temp_len++; /* missing leading slash */
1010 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1011 if(vol->prepath == NULL)
1012 return 1;
1013 if(value[0] != '/') {
1014 vol->prepath[0] = '/';
1015 strcpy(vol->prepath+1,value);
1016 } else
1017 strcpy(vol->prepath,value);
1018 cFYI(1,("prefix path %s",vol->prepath));
1019 } else {
1020 printk(KERN_WARNING "CIFS: prefix too long\n");
1021 return 1;
1022 }
1023 } else if (strnicmp(data, "iocharset", 9) == 0) {
1024 if (!value || !*value) {
1025 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1026 return 1; /* needs_arg; */
1027 }
1028 if (strnlen(value, 65) < 65) {
1029 if(strnicmp(value,"default",7))
1030 vol->iocharset = value;
1031 /* if iocharset not set load_nls_default used by caller */
1032 cFYI(1, ("iocharset set to %s",value));
1033 } else {
1034 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1035 return 1;
1036 }
1037 } else if (strnicmp(data, "uid", 3) == 0) {
1038 if (value && *value) {
1039 vol->linux_uid =
1040 simple_strtoul(value, &value, 0);
1041 }
1042 } else if (strnicmp(data, "gid", 3) == 0) {
1043 if (value && *value) {
1044 vol->linux_gid =
1045 simple_strtoul(value, &value, 0);
1046 }
1047 } else if (strnicmp(data, "file_mode", 4) == 0) {
1048 if (value && *value) {
1049 vol->file_mode =
1050 simple_strtoul(value, &value, 0);
1051 }
1052 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1053 if (value && *value) {
1054 vol->dir_mode =
1055 simple_strtoul(value, &value, 0);
1056 }
1057 } else if (strnicmp(data, "dirmode", 4) == 0) {
1058 if (value && *value) {
1059 vol->dir_mode =
1060 simple_strtoul(value, &value, 0);
1061 }
1062 } else if (strnicmp(data, "port", 4) == 0) {
1063 if (value && *value) {
1064 vol->port =
1065 simple_strtoul(value, &value, 0);
1066 }
1067 } else if (strnicmp(data, "rsize", 5) == 0) {
1068 if (value && *value) {
1069 vol->rsize =
1070 simple_strtoul(value, &value, 0);
1071 }
1072 } else if (strnicmp(data, "wsize", 5) == 0) {
1073 if (value && *value) {
1074 vol->wsize =
1075 simple_strtoul(value, &value, 0);
1076 }
1077 } else if (strnicmp(data, "sockopt", 5) == 0) {
1078 if (value && *value) {
1079 vol->sockopt =
1080 simple_strtoul(value, &value, 0);
1081 }
1082 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1083 if (!value || !*value || (*value == ' ')) {
1084 cFYI(1,("invalid (empty) netbiosname specified"));
1085 } else {
1086 memset(vol->source_rfc1001_name,0x20,15);
1087 for(i=0;i<15;i++) {
1088 /* BB are there cases in which a comma can be
1089 valid in this workstation netbios name (and need
1090 special handling)? */
1091
1092 /* We do not uppercase netbiosname for user */
1093 if (value[i]==0)
1094 break;
1095 else
1096 vol->source_rfc1001_name[i] = value[i];
1097 }
1098 /* The string has 16th byte zero still from
1099 set at top of the function */
1100 if((i==15) && (value[i] != 0))
1101 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1102 }
1103 } else if (strnicmp(data, "servern", 7) == 0) {
1104 /* servernetbiosname specified override *SMBSERVER */
1105 if (!value || !*value || (*value == ' ')) {
1106 cFYI(1,("empty server netbiosname specified"));
1107 } else {
1108 /* last byte, type, is 0x20 for servr type */
1109 memset(vol->target_rfc1001_name,0x20,16);
1110
1111 for(i=0;i<15;i++) {
1112 /* BB are there cases in which a comma can be
1113 valid in this workstation netbios name (and need
1114 special handling)? */
1115
1116 /* user or mount helper must uppercase netbiosname */
1117 if (value[i]==0)
1118 break;
1119 else
1120 vol->target_rfc1001_name[i] = value[i];
1121 }
1122 /* The string has 16th byte zero still from
1123 set at top of the function */
1124 if((i==15) && (value[i] != 0))
1125 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1126 }
1127 } else if (strnicmp(data, "credentials", 4) == 0) {
1128 /* ignore */
1129 } else if (strnicmp(data, "version", 3) == 0) {
1130 /* ignore */
1131 } else if (strnicmp(data, "guest",5) == 0) {
1132 /* ignore */
1133 } else if (strnicmp(data, "rw", 2) == 0) {
1134 vol->rw = TRUE;
1135 } else if ((strnicmp(data, "suid", 4) == 0) ||
1136 (strnicmp(data, "nosuid", 6) == 0) ||
1137 (strnicmp(data, "exec", 4) == 0) ||
1138 (strnicmp(data, "noexec", 6) == 0) ||
1139 (strnicmp(data, "nodev", 5) == 0) ||
1140 (strnicmp(data, "noauto", 6) == 0) ||
1141 (strnicmp(data, "dev", 3) == 0)) {
1142 /* The mount tool or mount.cifs helper (if present)
1143 uses these opts to set flags, and the flags are read
1144 by the kernel vfs layer before we get here (ie
1145 before read super) so there is no point trying to
1146 parse these options again and set anything and it
1147 is ok to just ignore them */
1148 continue;
1149 } else if (strnicmp(data, "ro", 2) == 0) {
1150 vol->rw = FALSE;
1151 } else if (strnicmp(data, "hard", 4) == 0) {
1152 vol->retry = 1;
1153 } else if (strnicmp(data, "soft", 4) == 0) {
1154 vol->retry = 0;
1155 } else if (strnicmp(data, "perm", 4) == 0) {
1156 vol->noperm = 0;
1157 } else if (strnicmp(data, "noperm", 6) == 0) {
1158 vol->noperm = 1;
1159 } else if (strnicmp(data, "mapchars", 8) == 0) {
1160 vol->remap = 1;
1161 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1162 vol->remap = 0;
1163 } else if (strnicmp(data, "sfu", 3) == 0) {
1164 vol->sfu_emul = 1;
1165 } else if (strnicmp(data, "nosfu", 5) == 0) {
1166 vol->sfu_emul = 0;
1167 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1168 vol->posix_paths = 1;
1169 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1170 vol->posix_paths = 0;
1171 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1172 (strnicmp(data, "ignorecase", 10) == 0)) {
1173 vol->nocase = 1;
1174 } else if (strnicmp(data, "brl", 3) == 0) {
1175 vol->nobrl = 0;
1176 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1177 (strnicmp(data, "nolock", 6) == 0)) {
1178 vol->nobrl = 1;
1179 /* turn off mandatory locking in mode
1180 if remote locking is turned off since the
1181 local vfs will do advisory */
1182 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1183 vol->file_mode = S_IALLUGO;
1184 } else if (strnicmp(data, "setuids", 7) == 0) {
1185 vol->setuids = 1;
1186 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1187 vol->setuids = 0;
1188 } else if (strnicmp(data, "nohard", 6) == 0) {
1189 vol->retry = 0;
1190 } else if (strnicmp(data, "nosoft", 6) == 0) {
1191 vol->retry = 1;
1192 } else if (strnicmp(data, "nointr", 6) == 0) {
1193 vol->intr = 0;
1194 } else if (strnicmp(data, "intr", 4) == 0) {
1195 vol->intr = 1;
1196 } else if (strnicmp(data, "serverino",7) == 0) {
1197 vol->server_ino = 1;
1198 } else if (strnicmp(data, "noserverino",9) == 0) {
1199 vol->server_ino = 0;
1200 } else if (strnicmp(data, "cifsacl",7) == 0) {
1201 vol->cifs_acl = 1;
1202 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1203 vol->cifs_acl = 0;
1204 } else if (strnicmp(data, "acl",3) == 0) {
1205 vol->no_psx_acl = 0;
1206 } else if (strnicmp(data, "noacl",5) == 0) {
1207 vol->no_psx_acl = 1;
1208 } else if (strnicmp(data, "sign",4) == 0) {
1209 vol->secFlg |= CIFSSEC_MUST_SIGN;
1210 /* } else if (strnicmp(data, "seal",4) == 0) {
1211 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1212 } else if (strnicmp(data, "direct",6) == 0) {
1213 vol->direct_io = 1;
1214 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1215 vol->direct_io = 1;
1216 } else if (strnicmp(data, "in6_addr",8) == 0) {
1217 if (!value || !*value) {
1218 vol->in6_addr = NULL;
1219 } else if (strnlen(value, 49) == 48) {
1220 vol->in6_addr = value;
1221 } else {
1222 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1223 return 1;
1224 }
1225 } else if (strnicmp(data, "noac", 4) == 0) {
1226 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1227 } else
1228 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1229 }
1230 if (vol->UNC == NULL) {
1231 if(devname == NULL) {
1232 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1233 return 1;
1234 }
1235 if ((temp_len = strnlen(devname, 300)) < 300) {
1236 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1237 if(vol->UNC == NULL)
1238 return 1;
1239 strcpy(vol->UNC,devname);
1240 if (strncmp(vol->UNC, "//", 2) == 0) {
1241 vol->UNC[0] = '\\';
1242 vol->UNC[1] = '\\';
1243 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1244 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1245 return 1;
1246 }
1247 } else {
1248 printk(KERN_WARNING "CIFS: UNC name too long\n");
1249 return 1;
1250 }
1251 }
1252 if(vol->UNCip == NULL)
1253 vol->UNCip = &vol->UNC[2];
1254
1255 return 0;
1256 }
1257
1258 static struct cifsSesInfo *
1259 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1260 struct in6_addr *target_ip6_addr,
1261 char *userName, struct TCP_Server_Info **psrvTcp)
1262 {
1263 struct list_head *tmp;
1264 struct cifsSesInfo *ses;
1265 *psrvTcp = NULL;
1266 read_lock(&GlobalSMBSeslock);
1267
1268 list_for_each(tmp, &GlobalSMBSessionList) {
1269 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1270 if (ses->server) {
1271 if((target_ip_addr &&
1272 (ses->server->addr.sockAddr.sin_addr.s_addr
1273 == target_ip_addr->s_addr)) || (target_ip6_addr
1274 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1275 target_ip6_addr,sizeof(*target_ip6_addr)))){
1276 /* BB lock server and tcp session and increment use count here?? */
1277 *psrvTcp = ses->server; /* found a match on the TCP session */
1278 /* BB check if reconnection needed */
1279 if (strncmp
1280 (ses->userName, userName,
1281 MAX_USERNAME_SIZE) == 0){
1282 read_unlock(&GlobalSMBSeslock);
1283 return ses; /* found exact match on both tcp and SMB sessions */
1284 }
1285 }
1286 }
1287 /* else tcp and smb sessions need reconnection */
1288 }
1289 read_unlock(&GlobalSMBSeslock);
1290 return NULL;
1291 }
1292
1293 static struct cifsTconInfo *
1294 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1295 {
1296 struct list_head *tmp;
1297 struct cifsTconInfo *tcon;
1298
1299 read_lock(&GlobalSMBSeslock);
1300 list_for_each(tmp, &GlobalTreeConnectionList) {
1301 cFYI(1, ("Next tcon"));
1302 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1303 if (tcon->ses) {
1304 if (tcon->ses->server) {
1305 cFYI(1,
1306 ("old ip addr: %x == new ip %x ?",
1307 tcon->ses->server->addr.sockAddr.sin_addr.
1308 s_addr, new_target_ip_addr));
1309 if (tcon->ses->server->addr.sockAddr.sin_addr.
1310 s_addr == new_target_ip_addr) {
1311 /* BB lock tcon, server and tcp session and increment use count here? */
1312 /* found a match on the TCP session */
1313 /* BB check if reconnection needed */
1314 cFYI(1,("IP match, old UNC: %s new: %s",
1315 tcon->treeName, uncName));
1316 if (strncmp
1317 (tcon->treeName, uncName,
1318 MAX_TREE_SIZE) == 0) {
1319 cFYI(1,
1320 ("and old usr: %s new: %s",
1321 tcon->treeName, uncName));
1322 if (strncmp
1323 (tcon->ses->userName,
1324 userName,
1325 MAX_USERNAME_SIZE) == 0) {
1326 read_unlock(&GlobalSMBSeslock);
1327 /* matched smb session
1328 (user name */
1329 return tcon;
1330 }
1331 }
1332 }
1333 }
1334 }
1335 }
1336 read_unlock(&GlobalSMBSeslock);
1337 return NULL;
1338 }
1339
1340 int
1341 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1342 const char *old_path, const struct nls_table *nls_codepage,
1343 int remap)
1344 {
1345 unsigned char *referrals = NULL;
1346 unsigned int num_referrals;
1347 int rc = 0;
1348
1349 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1350 &num_referrals, &referrals, remap);
1351
1352 /* BB Add in code to: if valid refrl, if not ip address contact
1353 the helper that resolves tcp names, mount to it, try to
1354 tcon to it unmount it if fail */
1355
1356 kfree(referrals);
1357
1358 return rc;
1359 }
1360
1361 int
1362 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1363 const char *old_path, const struct nls_table *nls_codepage,
1364 unsigned int *pnum_referrals,
1365 unsigned char ** preferrals, int remap)
1366 {
1367 char *temp_unc;
1368 int rc = 0;
1369
1370 *pnum_referrals = 0;
1371
1372 if (pSesInfo->ipc_tid == 0) {
1373 temp_unc = kmalloc(2 /* for slashes */ +
1374 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1375 + 1 + 4 /* slash IPC$ */ + 2,
1376 GFP_KERNEL);
1377 if (temp_unc == NULL)
1378 return -ENOMEM;
1379 temp_unc[0] = '\\';
1380 temp_unc[1] = '\\';
1381 strcpy(temp_unc + 2, pSesInfo->serverName);
1382 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1383 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1384 cFYI(1,
1385 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1386 kfree(temp_unc);
1387 }
1388 if (rc == 0)
1389 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1390 pnum_referrals, nls_codepage, remap);
1391
1392 return rc;
1393 }
1394
1395 /* See RFC1001 section 14 on representation of Netbios names */
1396 static void rfc1002mangle(char * target,char * source, unsigned int length)
1397 {
1398 unsigned int i,j;
1399
1400 for(i=0,j=0;i<(length);i++) {
1401 /* mask a nibble at a time and encode */
1402 target[j] = 'A' + (0x0F & (source[i] >> 4));
1403 target[j+1] = 'A' + (0x0F & source[i]);
1404 j+=2;
1405 }
1406
1407 }
1408
1409
1410 static int
1411 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1412 char * netbios_name, char * target_name)
1413 {
1414 int rc = 0;
1415 int connected = 0;
1416 __be16 orig_port = 0;
1417
1418 if(*csocket == NULL) {
1419 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1420 if (rc < 0) {
1421 cERROR(1, ("Error %d creating socket",rc));
1422 *csocket = NULL;
1423 return rc;
1424 } else {
1425 /* BB other socket options to set KEEPALIVE, NODELAY? */
1426 cFYI(1,("Socket created"));
1427 (*csocket)->sk->sk_allocation = GFP_NOFS;
1428 }
1429 }
1430
1431 psin_server->sin_family = AF_INET;
1432 if(psin_server->sin_port) { /* user overrode default port */
1433 rc = (*csocket)->ops->connect(*csocket,
1434 (struct sockaddr *) psin_server,
1435 sizeof (struct sockaddr_in),0);
1436 if (rc >= 0)
1437 connected = 1;
1438 }
1439
1440 if(!connected) {
1441 /* save original port so we can retry user specified port
1442 later if fall back ports fail this time */
1443 orig_port = psin_server->sin_port;
1444
1445 /* do not retry on the same port we just failed on */
1446 if(psin_server->sin_port != htons(CIFS_PORT)) {
1447 psin_server->sin_port = htons(CIFS_PORT);
1448
1449 rc = (*csocket)->ops->connect(*csocket,
1450 (struct sockaddr *) psin_server,
1451 sizeof (struct sockaddr_in),0);
1452 if (rc >= 0)
1453 connected = 1;
1454 }
1455 }
1456 if (!connected) {
1457 psin_server->sin_port = htons(RFC1001_PORT);
1458 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1459 psin_server, sizeof (struct sockaddr_in),0);
1460 if (rc >= 0)
1461 connected = 1;
1462 }
1463
1464 /* give up here - unless we want to retry on different
1465 protocol families some day */
1466 if (!connected) {
1467 if(orig_port)
1468 psin_server->sin_port = orig_port;
1469 cFYI(1,("Error %d connecting to server via ipv4",rc));
1470 sock_release(*csocket);
1471 *csocket = NULL;
1472 return rc;
1473 }
1474 /* Eventually check for other socket options to change from
1475 the default. sock_setsockopt not used because it expects
1476 user space buffer */
1477 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1478 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1479 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1480 /* make the bufsizes depend on wsize/rsize and max requests */
1481 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1482 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1483 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1484 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1485
1486 /* send RFC1001 sessinit */
1487 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1488 /* some servers require RFC1001 sessinit before sending
1489 negprot - BB check reconnection in case where second
1490 sessinit is sent but no second negprot */
1491 struct rfc1002_session_packet * ses_init_buf;
1492 struct smb_hdr * smb_buf;
1493 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1494 if(ses_init_buf) {
1495 ses_init_buf->trailer.session_req.called_len = 32;
1496 if(target_name && (target_name[0] != 0)) {
1497 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1498 target_name, 16);
1499 } else {
1500 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1501 DEFAULT_CIFS_CALLED_NAME,16);
1502 }
1503
1504 ses_init_buf->trailer.session_req.calling_len = 32;
1505 /* calling name ends in null (byte 16) from old smb
1506 convention. */
1507 if(netbios_name && (netbios_name[0] !=0)) {
1508 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1509 netbios_name,16);
1510 } else {
1511 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1512 "LINUX_CIFS_CLNT",16);
1513 }
1514 ses_init_buf->trailer.session_req.scope1 = 0;
1515 ses_init_buf->trailer.session_req.scope2 = 0;
1516 smb_buf = (struct smb_hdr *)ses_init_buf;
1517 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1518 smb_buf->smb_buf_length = 0x81000044;
1519 rc = smb_send(*csocket, smb_buf, 0x44,
1520 (struct sockaddr *)psin_server);
1521 kfree(ses_init_buf);
1522 msleep(1); /* RFC1001 layer in at least one server
1523 requires very short break before negprot
1524 presumably because not expecting negprot
1525 to follow so fast. This is a simple
1526 solution that works without
1527 complicating the code and causes no
1528 significant slowing down on mount
1529 for everyone else */
1530 }
1531 /* else the negprot may still work without this
1532 even though malloc failed */
1533
1534 }
1535
1536 return rc;
1537 }
1538
1539 static int
1540 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1541 {
1542 int rc = 0;
1543 int connected = 0;
1544 __be16 orig_port = 0;
1545
1546 if(*csocket == NULL) {
1547 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1548 if (rc < 0) {
1549 cERROR(1, ("Error %d creating ipv6 socket",rc));
1550 *csocket = NULL;
1551 return rc;
1552 } else {
1553 /* BB other socket options to set KEEPALIVE, NODELAY? */
1554 cFYI(1,("ipv6 Socket created"));
1555 (*csocket)->sk->sk_allocation = GFP_NOFS;
1556 }
1557 }
1558
1559 psin_server->sin6_family = AF_INET6;
1560
1561 if(psin_server->sin6_port) { /* user overrode default port */
1562 rc = (*csocket)->ops->connect(*csocket,
1563 (struct sockaddr *) psin_server,
1564 sizeof (struct sockaddr_in6),0);
1565 if (rc >= 0)
1566 connected = 1;
1567 }
1568
1569 if(!connected) {
1570 /* save original port so we can retry user specified port
1571 later if fall back ports fail this time */
1572
1573 orig_port = psin_server->sin6_port;
1574 /* do not retry on the same port we just failed on */
1575 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1576 psin_server->sin6_port = htons(CIFS_PORT);
1577
1578 rc = (*csocket)->ops->connect(*csocket,
1579 (struct sockaddr *) psin_server,
1580 sizeof (struct sockaddr_in6),0);
1581 if (rc >= 0)
1582 connected = 1;
1583 }
1584 }
1585 if (!connected) {
1586 psin_server->sin6_port = htons(RFC1001_PORT);
1587 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1588 psin_server, sizeof (struct sockaddr_in6),0);
1589 if (rc >= 0)
1590 connected = 1;
1591 }
1592
1593 /* give up here - unless we want to retry on different
1594 protocol families some day */
1595 if (!connected) {
1596 if(orig_port)
1597 psin_server->sin6_port = orig_port;
1598 cFYI(1,("Error %d connecting to server via ipv6",rc));
1599 sock_release(*csocket);
1600 *csocket = NULL;
1601 return rc;
1602 }
1603 /* Eventually check for other socket options to change from
1604 the default. sock_setsockopt not used because it expects
1605 user space buffer */
1606 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1607
1608 return rc;
1609 }
1610
1611 int
1612 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1613 char *mount_data, const char *devname)
1614 {
1615 int rc = 0;
1616 int xid;
1617 int address_type = AF_INET;
1618 struct socket *csocket = NULL;
1619 struct sockaddr_in sin_server;
1620 struct sockaddr_in6 sin_server6;
1621 struct smb_vol volume_info;
1622 struct cifsSesInfo *pSesInfo = NULL;
1623 struct cifsSesInfo *existingCifsSes = NULL;
1624 struct cifsTconInfo *tcon = NULL;
1625 struct TCP_Server_Info *srvTcp = NULL;
1626
1627 xid = GetXid();
1628
1629 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1630
1631 memset(&volume_info,0,sizeof(struct smb_vol));
1632 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1633 kfree(volume_info.UNC);
1634 kfree(volume_info.password);
1635 kfree(volume_info.prepath);
1636 FreeXid(xid);
1637 return -EINVAL;
1638 }
1639
1640 if (volume_info.username) {
1641 /* BB fixme parse for domain name here */
1642 cFYI(1, ("Username: %s ", volume_info.username));
1643
1644 } else {
1645 cifserror("No username specified");
1646 /* In userspace mount helper we can get user name from alternate
1647 locations such as env variables and files on disk */
1648 kfree(volume_info.UNC);
1649 kfree(volume_info.password);
1650 kfree(volume_info.prepath);
1651 FreeXid(xid);
1652 return -EINVAL;
1653 }
1654
1655 if (volume_info.UNCip && volume_info.UNC) {
1656 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1657
1658 if(rc <= 0) {
1659 /* not ipv4 address, try ipv6 */
1660 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1661 if(rc > 0)
1662 address_type = AF_INET6;
1663 } else {
1664 address_type = AF_INET;
1665 }
1666
1667 if(rc <= 0) {
1668 /* we failed translating address */
1669 kfree(volume_info.UNC);
1670 kfree(volume_info.password);
1671 kfree(volume_info.prepath);
1672 FreeXid(xid);
1673 return -EINVAL;
1674 }
1675
1676 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1677 /* success */
1678 rc = 0;
1679 } else if (volume_info.UNCip){
1680 /* BB using ip addr as server name connect to the DFS root below */
1681 cERROR(1,("Connecting to DFS root not implemented yet"));
1682 kfree(volume_info.UNC);
1683 kfree(volume_info.password);
1684 kfree(volume_info.prepath);
1685 FreeXid(xid);
1686 return -EINVAL;
1687 } else /* which servers DFS root would we conect to */ {
1688 cERROR(1,
1689 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1690 kfree(volume_info.UNC);
1691 kfree(volume_info.password);
1692 kfree(volume_info.prepath);
1693 FreeXid(xid);
1694 return -EINVAL;
1695 }
1696
1697 /* this is needed for ASCII cp to Unicode converts */
1698 if(volume_info.iocharset == NULL) {
1699 cifs_sb->local_nls = load_nls_default();
1700 /* load_nls_default can not return null */
1701 } else {
1702 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1703 if(cifs_sb->local_nls == NULL) {
1704 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1705 kfree(volume_info.UNC);
1706 kfree(volume_info.password);
1707 kfree(volume_info.prepath);
1708 FreeXid(xid);
1709 return -ELIBACC;
1710 }
1711 }
1712
1713 if(address_type == AF_INET)
1714 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1715 NULL /* no ipv6 addr */,
1716 volume_info.username, &srvTcp);
1717 else if(address_type == AF_INET6)
1718 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1719 &sin_server6.sin6_addr,
1720 volume_info.username, &srvTcp);
1721 else {
1722 kfree(volume_info.UNC);
1723 kfree(volume_info.password);
1724 kfree(volume_info.prepath);
1725 FreeXid(xid);
1726 return -EINVAL;
1727 }
1728
1729
1730 if (srvTcp) {
1731 cFYI(1, ("Existing tcp session with server found"));
1732 } else { /* create socket */
1733 if(volume_info.port)
1734 sin_server.sin_port = htons(volume_info.port);
1735 else
1736 sin_server.sin_port = 0;
1737 rc = ipv4_connect(&sin_server,&csocket,
1738 volume_info.source_rfc1001_name,
1739 volume_info.target_rfc1001_name);
1740 if (rc < 0) {
1741 cERROR(1,
1742 ("Error connecting to IPv4 socket. Aborting operation"));
1743 if(csocket != NULL)
1744 sock_release(csocket);
1745 kfree(volume_info.UNC);
1746 kfree(volume_info.password);
1747 kfree(volume_info.prepath);
1748 FreeXid(xid);
1749 return rc;
1750 }
1751
1752 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1753 if (srvTcp == NULL) {
1754 rc = -ENOMEM;
1755 sock_release(csocket);
1756 kfree(volume_info.UNC);
1757 kfree(volume_info.password);
1758 kfree(volume_info.prepath);
1759 FreeXid(xid);
1760 return rc;
1761 } else {
1762 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1763 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1764 atomic_set(&srvTcp->inFlight,0);
1765 /* BB Add code for ipv6 case too */
1766 srvTcp->ssocket = csocket;
1767 srvTcp->protocolType = IPV4;
1768 init_waitqueue_head(&srvTcp->response_q);
1769 init_waitqueue_head(&srvTcp->request_q);
1770 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1771 /* at this point we are the only ones with the pointer
1772 to the struct since the kernel thread not created yet
1773 so no need to spinlock this init of tcpStatus */
1774 srvTcp->tcpStatus = CifsNew;
1775 init_MUTEX(&srvTcp->tcpSem);
1776 rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1777 CLONE_FS | CLONE_FILES | CLONE_VM);
1778 if(rc < 0) {
1779 rc = -ENOMEM;
1780 sock_release(csocket);
1781 kfree(volume_info.UNC);
1782 kfree(volume_info.password);
1783 kfree(volume_info.prepath);
1784 FreeXid(xid);
1785 return rc;
1786 }
1787 wait_for_completion(&cifsd_complete);
1788 rc = 0;
1789 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1790 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1791 srvTcp->sequence_number = 0;
1792 }
1793 }
1794
1795 if (existingCifsSes) {
1796 pSesInfo = existingCifsSes;
1797 cFYI(1, ("Existing smb sess found"));
1798 kfree(volume_info.password);
1799 /* volume_info.UNC freed at end of function */
1800 } else if (!rc) {
1801 cFYI(1, ("Existing smb sess not found"));
1802 pSesInfo = sesInfoAlloc();
1803 if (pSesInfo == NULL)
1804 rc = -ENOMEM;
1805 else {
1806 pSesInfo->server = srvTcp;
1807 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1808 NIPQUAD(sin_server.sin_addr.s_addr));
1809 }
1810
1811 if (!rc){
1812 /* volume_info.password freed at unmount */
1813 if (volume_info.password)
1814 pSesInfo->password = volume_info.password;
1815 if (volume_info.username)
1816 strncpy(pSesInfo->userName,
1817 volume_info.username,MAX_USERNAME_SIZE);
1818 if (volume_info.domainname) {
1819 int len = strlen(volume_info.domainname);
1820 pSesInfo->domainName =
1821 kmalloc(len + 1, GFP_KERNEL);
1822 if(pSesInfo->domainName)
1823 strcpy(pSesInfo->domainName,
1824 volume_info.domainname);
1825 }
1826 pSesInfo->linux_uid = volume_info.linux_uid;
1827 pSesInfo->overrideSecFlg = volume_info.secFlg;
1828 down(&pSesInfo->sesSem);
1829 /* BB FIXME need to pass vol->secFlgs BB */
1830 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1831 up(&pSesInfo->sesSem);
1832 if(!rc)
1833 atomic_inc(&srvTcp->socketUseCount);
1834 } else
1835 kfree(volume_info.password);
1836 }
1837
1838 /* search for existing tcon to this server share */
1839 if (!rc) {
1840 if(volume_info.rsize > CIFSMaxBufSize) {
1841 cERROR(1,("rsize %d too large, using MaxBufSize",
1842 volume_info.rsize));
1843 cifs_sb->rsize = CIFSMaxBufSize;
1844 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1845 cifs_sb->rsize = volume_info.rsize;
1846 else /* default */
1847 cifs_sb->rsize = CIFSMaxBufSize;
1848
1849 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1850 cERROR(1,("wsize %d too large using 4096 instead",
1851 volume_info.wsize));
1852 cifs_sb->wsize = 4096;
1853 } else if(volume_info.wsize)
1854 cifs_sb->wsize = volume_info.wsize;
1855 else
1856 cifs_sb->wsize =
1857 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1858 127*1024);
1859 /* old default of CIFSMaxBufSize was too small now
1860 that SMB Write2 can send multiple pages in kvec.
1861 RFC1001 does not describe what happens when frame
1862 bigger than 128K is sent so use that as max in
1863 conjunction with 52K kvec constraint on arch with 4K
1864 page size */
1865
1866 if(cifs_sb->rsize < 2048) {
1867 cifs_sb->rsize = 2048;
1868 /* Windows ME may prefer this */
1869 cFYI(1,("readsize set to minimum 2048"));
1870 }
1871 /* calculate prepath */
1872 cifs_sb->prepath = volume_info.prepath;
1873 if(cifs_sb->prepath) {
1874 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1875 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1876 volume_info.prepath = NULL;
1877 } else
1878 cifs_sb->prepathlen = 0;
1879 cifs_sb->mnt_uid = volume_info.linux_uid;
1880 cifs_sb->mnt_gid = volume_info.linux_gid;
1881 cifs_sb->mnt_file_mode = volume_info.file_mode;
1882 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1883 cFYI(1,("file mode: 0x%x dir mode: 0x%x",
1884 cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1885
1886 if(volume_info.noperm)
1887 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1888 if(volume_info.setuids)
1889 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1890 if(volume_info.server_ino)
1891 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1892 if(volume_info.remap)
1893 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1894 if(volume_info.no_xattr)
1895 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1896 if(volume_info.sfu_emul)
1897 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1898 if(volume_info.nobrl)
1899 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1900 if(volume_info.cifs_acl)
1901 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1902
1903 if(volume_info.direct_io) {
1904 cFYI(1,("mounting share using direct i/o"));
1905 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1906 }
1907
1908 tcon =
1909 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1910 volume_info.username);
1911 if (tcon) {
1912 cFYI(1, ("Found match on UNC path"));
1913 /* we can have only one retry value for a connection
1914 to a share so for resources mounted more than once
1915 to the same server share the last value passed in
1916 for the retry flag is used */
1917 tcon->retry = volume_info.retry;
1918 tcon->nocase = volume_info.nocase;
1919 } else {
1920 tcon = tconInfoAlloc();
1921 if (tcon == NULL)
1922 rc = -ENOMEM;
1923 else {
1924 /* check for null share name ie connect to dfs root */
1925
1926 /* BB check if this works for exactly length three strings */
1927 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
1928 && (strchr(volume_info.UNC + 3, '/') ==
1929 NULL)) {
1930 rc = connect_to_dfs_path(xid, pSesInfo,
1931 "", cifs_sb->local_nls,
1932 cifs_sb->mnt_cifs_flags &
1933 CIFS_MOUNT_MAP_SPECIAL_CHR);
1934 kfree(volume_info.UNC);
1935 FreeXid(xid);
1936 return -ENODEV;
1937 } else {
1938 rc = CIFSTCon(xid, pSesInfo,
1939 volume_info.UNC,
1940 tcon, cifs_sb->local_nls);
1941 cFYI(1, ("CIFS Tcon rc = %d", rc));
1942 }
1943 if (!rc) {
1944 atomic_inc(&pSesInfo->inUse);
1945 tcon->retry = volume_info.retry;
1946 tcon->nocase = volume_info.nocase;
1947 }
1948 }
1949 }
1950 }
1951 if(pSesInfo) {
1952 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
1953 sb->s_maxbytes = (u64) 1 << 63;
1954 } else
1955 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
1956 }
1957
1958 sb->s_time_gran = 100;
1959
1960 /* on error free sesinfo and tcon struct if needed */
1961 if (rc) {
1962 /* if session setup failed, use count is zero but
1963 we still need to free cifsd thread */
1964 if(atomic_read(&srvTcp->socketUseCount) == 0) {
1965 spin_lock(&GlobalMid_Lock);
1966 srvTcp->tcpStatus = CifsExiting;
1967 spin_unlock(&GlobalMid_Lock);
1968 if(srvTcp->tsk) {
1969 send_sig(SIGKILL,srvTcp->tsk,1);
1970 wait_for_completion(&cifsd_complete);
1971 }
1972 }
1973 /* If find_unc succeeded then rc == 0 so we can not end */
1974 if (tcon) /* up accidently freeing someone elses tcon struct */
1975 tconInfoFree(tcon);
1976 if (existingCifsSes == NULL) {
1977 if (pSesInfo) {
1978 if ((pSesInfo->server) &&
1979 (pSesInfo->status == CifsGood)) {
1980 int temp_rc;
1981 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
1982 /* if the socketUseCount is now zero */
1983 if((temp_rc == -ESHUTDOWN) &&
1984 (pSesInfo->server->tsk)) {
1985 send_sig(SIGKILL,pSesInfo->server->tsk,1);
1986 wait_for_completion(&cifsd_complete);
1987 }
1988 } else
1989 cFYI(1, ("No session or bad tcon"));
1990 sesInfoFree(pSesInfo);
1991 /* pSesInfo = NULL; */
1992 }
1993 }
1994 } else {
1995 atomic_inc(&tcon->useCount);
1996 cifs_sb->tcon = tcon;
1997 tcon->ses = pSesInfo;
1998
1999 /* do not care if following two calls succeed - informational */
2000 CIFSSMBQFSDeviceInfo(xid, tcon);
2001 CIFSSMBQFSAttributeInfo(xid, tcon);
2002
2003 if (tcon->ses->capabilities & CAP_UNIX) {
2004 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
2005 __u64 cap =
2006 le64_to_cpu(tcon->fsUnixInfo.Capability);
2007 cap &= CIFS_UNIX_CAP_MASK;
2008 if(volume_info.no_psx_acl)
2009 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2010 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
2011 cFYI(1,("negotiated posix acl support"));
2012 sb->s_flags |= MS_POSIXACL;
2013 }
2014
2015 if(volume_info.posix_paths == 0)
2016 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2017 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2018 cFYI(1,("negotiate posix pathnames"));
2019 cifs_sb->mnt_cifs_flags |=
2020 CIFS_MOUNT_POSIX_PATHS;
2021 }
2022
2023 cFYI(1,("Negotiate caps 0x%x",(int)cap));
2024 #ifdef CONFIG_CIFS_DEBUG2
2025 if(cap & CIFS_UNIX_FCNTL_CAP)
2026 cFYI(1,("FCNTL cap"));
2027 if(cap & CIFS_UNIX_EXTATTR_CAP)
2028 cFYI(1,("EXTATTR cap"));
2029 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2030 cFYI(1,("POSIX path cap"));
2031 if(cap & CIFS_UNIX_XATTR_CAP)
2032 cFYI(1,("XATTR cap"));
2033 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
2034 cFYI(1,("POSIX ACL cap"));
2035 #endif /* CIFS_DEBUG2 */
2036 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2037 cFYI(1,("setting capabilities failed"));
2038 }
2039 }
2040 }
2041 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2042 cifs_sb->wsize = min(cifs_sb->wsize,
2043 (tcon->ses->server->maxBuf -
2044 MAX_CIFS_HDR_SIZE));
2045 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2046 cifs_sb->rsize = min(cifs_sb->rsize,
2047 (tcon->ses->server->maxBuf -
2048 MAX_CIFS_HDR_SIZE));
2049 }
2050
2051 /* volume_info.password is freed above when existing session found
2052 (in which case it is not needed anymore) but when new sesion is created
2053 the password ptr is put in the new session structure (in which case the
2054 password will be freed at unmount time) */
2055 kfree(volume_info.UNC);
2056 kfree(volume_info.prepath);
2057 FreeXid(xid);
2058 return rc;
2059 }
2060
2061 static int
2062 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2063 char session_key[CIFS_SESS_KEY_SIZE],
2064 const struct nls_table *nls_codepage)
2065 {
2066 struct smb_hdr *smb_buffer;
2067 struct smb_hdr *smb_buffer_response;
2068 SESSION_SETUP_ANDX *pSMB;
2069 SESSION_SETUP_ANDX *pSMBr;
2070 char *bcc_ptr;
2071 char *user;
2072 char *domain;
2073 int rc = 0;
2074 int remaining_words = 0;
2075 int bytes_returned = 0;
2076 int len;
2077 __u32 capabilities;
2078 __u16 count;
2079
2080 cFYI(1, ("In sesssetup"));
2081 if(ses == NULL)
2082 return -EINVAL;
2083 user = ses->userName;
2084 domain = ses->domainName;
2085 smb_buffer = cifs_buf_get();
2086 if (smb_buffer == NULL) {
2087 return -ENOMEM;
2088 }
2089 smb_buffer_response = smb_buffer;
2090 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2091
2092 /* send SMBsessionSetup here */
2093 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2094 NULL /* no tCon exists yet */ , 13 /* wct */ );
2095
2096 smb_buffer->Mid = GetNextMid(ses->server);
2097 pSMB->req_no_secext.AndXCommand = 0xFF;
2098 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2099 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2100
2101 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2102 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2103
2104 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2105 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2106 if (ses->capabilities & CAP_UNICODE) {
2107 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2108 capabilities |= CAP_UNICODE;
2109 }
2110 if (ses->capabilities & CAP_STATUS32) {
2111 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2112 capabilities |= CAP_STATUS32;
2113 }
2114 if (ses->capabilities & CAP_DFS) {
2115 smb_buffer->Flags2 |= SMBFLG2_DFS;
2116 capabilities |= CAP_DFS;
2117 }
2118 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2119
2120 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2121 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2122
2123 pSMB->req_no_secext.CaseSensitivePasswordLength =
2124 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2125 bcc_ptr = pByteArea(smb_buffer);
2126 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2127 bcc_ptr += CIFS_SESS_KEY_SIZE;
2128 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2129 bcc_ptr += CIFS_SESS_KEY_SIZE;
2130
2131 if (ses->capabilities & CAP_UNICODE) {
2132 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2133 *bcc_ptr = 0;
2134 bcc_ptr++;
2135 }
2136 if(user == NULL)
2137 bytes_returned = 0; /* skip null user */
2138 else
2139 bytes_returned =
2140 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2141 nls_codepage);
2142 /* convert number of 16 bit words to bytes */
2143 bcc_ptr += 2 * bytes_returned;
2144 bcc_ptr += 2; /* trailing null */
2145 if (domain == NULL)
2146 bytes_returned =
2147 cifs_strtoUCS((__le16 *) bcc_ptr,
2148 "CIFS_LINUX_DOM", 32, nls_codepage);
2149 else
2150 bytes_returned =
2151 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2152 nls_codepage);
2153 bcc_ptr += 2 * bytes_returned;
2154 bcc_ptr += 2;
2155 bytes_returned =
2156 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2157 32, nls_codepage);
2158 bcc_ptr += 2 * bytes_returned;
2159 bytes_returned =
2160 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release,
2161 32, nls_codepage);
2162 bcc_ptr += 2 * bytes_returned;
2163 bcc_ptr += 2;
2164 bytes_returned =
2165 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2166 64, nls_codepage);
2167 bcc_ptr += 2 * bytes_returned;
2168 bcc_ptr += 2;
2169 } else {
2170 if(user != NULL) {
2171 strncpy(bcc_ptr, user, 200);
2172 bcc_ptr += strnlen(user, 200);
2173 }
2174 *bcc_ptr = 0;
2175 bcc_ptr++;
2176 if (domain == NULL) {
2177 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2178 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2179 } else {
2180 strncpy(bcc_ptr, domain, 64);
2181 bcc_ptr += strnlen(domain, 64);
2182 *bcc_ptr = 0;
2183 bcc_ptr++;
2184 }
2185 strcpy(bcc_ptr, "Linux version ");
2186 bcc_ptr += strlen("Linux version ");
2187 strcpy(bcc_ptr, system_utsname.release);
2188 bcc_ptr += strlen(system_utsname.release) + 1;
2189 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2190 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2191 }
2192 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2193 smb_buffer->smb_buf_length += count;
2194 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2195
2196 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2197 &bytes_returned, 1);
2198 if (rc) {
2199 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2200 } else if ((smb_buffer_response->WordCount == 3)
2201 || (smb_buffer_response->WordCount == 4)) {
2202 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2203 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2204 if (action & GUEST_LOGIN)
2205 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2206 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2207 cFYI(1, ("UID = %d ", ses->Suid));
2208 /* response can have either 3 or 4 word count - Samba sends 3 */
2209 bcc_ptr = pByteArea(smb_buffer_response);
2210 if ((pSMBr->resp.hdr.WordCount == 3)
2211 || ((pSMBr->resp.hdr.WordCount == 4)
2212 && (blob_len < pSMBr->resp.ByteCount))) {
2213 if (pSMBr->resp.hdr.WordCount == 4)
2214 bcc_ptr += blob_len;
2215
2216 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2217 if ((long) (bcc_ptr) % 2) {
2218 remaining_words =
2219 (BCC(smb_buffer_response) - 1) /2;
2220 bcc_ptr++; /* Unicode strings must be word aligned */
2221 } else {
2222 remaining_words =
2223 BCC(smb_buffer_response) / 2;
2224 }
2225 len =
2226 UniStrnlen((wchar_t *) bcc_ptr,
2227 remaining_words - 1);
2228 /* We look for obvious messed up bcc or strings in response so we do not go off
2229 the end since (at least) WIN2K and Windows XP have a major bug in not null
2230 terminating last Unicode string in response */
2231 if(ses->serverOS)
2232 kfree(ses->serverOS);
2233 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2234 if(ses->serverOS == NULL)
2235 goto sesssetup_nomem;
2236 cifs_strfromUCS_le(ses->serverOS,
2237 (__le16 *)bcc_ptr, len,nls_codepage);
2238 bcc_ptr += 2 * (len + 1);
2239 remaining_words -= len + 1;
2240 ses->serverOS[2 * len] = 0;
2241 ses->serverOS[1 + (2 * len)] = 0;
2242 if (remaining_words > 0) {
2243 len = UniStrnlen((wchar_t *)bcc_ptr,
2244 remaining_words-1);
2245 kfree(ses->serverNOS);
2246 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2247 if(ses->serverNOS == NULL)
2248 goto sesssetup_nomem;
2249 cifs_strfromUCS_le(ses->serverNOS,
2250 (__le16 *)bcc_ptr,len,nls_codepage);
2251 bcc_ptr += 2 * (len + 1);
2252 ses->serverNOS[2 * len] = 0;
2253 ses->serverNOS[1 + (2 * len)] = 0;
2254 if(strncmp(ses->serverNOS,
2255 "NT LAN Manager 4",16) == 0) {
2256 cFYI(1,("NT4 server"));
2257 ses->flags |= CIFS_SES_NT4;
2258 }
2259 remaining_words -= len + 1;
2260 if (remaining_words > 0) {
2261 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2262 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2263 if(ses->serverDomain)
2264 kfree(ses->serverDomain);
2265 ses->serverDomain =
2266 kzalloc(2*(len+1),GFP_KERNEL);
2267 if(ses->serverDomain == NULL)
2268 goto sesssetup_nomem;
2269 cifs_strfromUCS_le(ses->serverDomain,
2270 (__le16 *)bcc_ptr,len,nls_codepage);
2271 bcc_ptr += 2 * (len + 1);
2272 ses->serverDomain[2*len] = 0;
2273 ses->serverDomain[1+(2*len)] = 0;
2274 } /* else no more room so create dummy domain string */
2275 else {
2276 if(ses->serverDomain)
2277 kfree(ses->serverDomain);
2278 ses->serverDomain =
2279 kzalloc(2, GFP_KERNEL);
2280 }
2281 } else { /* no room so create dummy domain and NOS string */
2282 /* if these kcallocs fail not much we
2283 can do, but better to not fail the
2284 sesssetup itself */
2285 kfree(ses->serverDomain);
2286 ses->serverDomain =
2287 kzalloc(2, GFP_KERNEL);
2288 kfree(ses->serverNOS);
2289 ses->serverNOS =
2290 kzalloc(2, GFP_KERNEL);
2291 }
2292 } else { /* ASCII */
2293 len = strnlen(bcc_ptr, 1024);
2294 if (((long) bcc_ptr + len) - (long)
2295 pByteArea(smb_buffer_response)
2296 <= BCC(smb_buffer_response)) {
2297 kfree(ses->serverOS);
2298 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2299 if(ses->serverOS == NULL)
2300 goto sesssetup_nomem;
2301 strncpy(ses->serverOS,bcc_ptr, len);
2302
2303 bcc_ptr += len;
2304 bcc_ptr[0] = 0; /* null terminate the string */
2305 bcc_ptr++;
2306
2307 len = strnlen(bcc_ptr, 1024);
2308 kfree(ses->serverNOS);
2309 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2310 if(ses->serverNOS == NULL)
2311 goto sesssetup_nomem;
2312 strncpy(ses->serverNOS, bcc_ptr, len);
2313 bcc_ptr += len;
2314 bcc_ptr[0] = 0;
2315 bcc_ptr++;
2316
2317 len = strnlen(bcc_ptr, 1024);
2318 if(ses->serverDomain)
2319 kfree(ses->serverDomain);
2320 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2321 if(ses->serverDomain == NULL)
2322 goto sesssetup_nomem;
2323 strncpy(ses->serverDomain, bcc_ptr, len);
2324 bcc_ptr += len;
2325 bcc_ptr[0] = 0;
2326 bcc_ptr++;
2327 } else
2328 cFYI(1,
2329 ("Variable field of length %d extends beyond end of smb ",
2330 len));
2331 }
2332 } else {
2333 cERROR(1,
2334 (" Security Blob Length extends beyond end of SMB"));
2335 }
2336 } else {
2337 cERROR(1,
2338 (" Invalid Word count %d: ",
2339 smb_buffer_response->WordCount));
2340 rc = -EIO;
2341 }
2342 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2343 since that could make reconnection harder, and
2344 reconnection might be needed to free memory */
2345 if (smb_buffer)
2346 cifs_buf_release(smb_buffer);
2347
2348 return rc;
2349 }
2350
2351 static int
2352 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2353 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2354 const struct nls_table *nls_codepage)
2355 {
2356 struct smb_hdr *smb_buffer;
2357 struct smb_hdr *smb_buffer_response;
2358 SESSION_SETUP_ANDX *pSMB;
2359 SESSION_SETUP_ANDX *pSMBr;
2360 char *bcc_ptr;
2361 char *domain;
2362 int rc = 0;
2363 int remaining_words = 0;
2364 int bytes_returned = 0;
2365 int len;
2366 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2367 PNEGOTIATE_MESSAGE SecurityBlob;
2368 PCHALLENGE_MESSAGE SecurityBlob2;
2369 __u32 negotiate_flags, capabilities;
2370 __u16 count;
2371
2372 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2373 if(ses == NULL)
2374 return -EINVAL;
2375 domain = ses->domainName;
2376 *pNTLMv2_flag = FALSE;
2377 smb_buffer = cifs_buf_get();
2378 if (smb_buffer == NULL) {
2379 return -ENOMEM;
2380 }
2381 smb_buffer_response = smb_buffer;
2382 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2383 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2384
2385 /* send SMBsessionSetup here */
2386 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2387 NULL /* no tCon exists yet */ , 12 /* wct */ );
2388
2389 smb_buffer->Mid = GetNextMid(ses->server);
2390 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2391 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2392
2393 pSMB->req.AndXCommand = 0xFF;
2394 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2395 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2396
2397 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2398 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2399
2400 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2401 CAP_EXTENDED_SECURITY;
2402 if (ses->capabilities & CAP_UNICODE) {
2403 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2404 capabilities |= CAP_UNICODE;
2405 }
2406 if (ses->capabilities & CAP_STATUS32) {
2407 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2408 capabilities |= CAP_STATUS32;
2409 }
2410 if (ses->capabilities & CAP_DFS) {
2411 smb_buffer->Flags2 |= SMBFLG2_DFS;
2412 capabilities |= CAP_DFS;
2413 }
2414 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2415
2416 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2417 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2418 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2419 SecurityBlob->MessageType = NtLmNegotiate;
2420 negotiate_flags =
2421 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2422 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2423 NTLMSSP_NEGOTIATE_56 |
2424 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2425 if(sign_CIFS_PDUs)
2426 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2427 /* if(ntlmv2_support)
2428 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2429 /* setup pointers to domain name and workstation name */
2430 bcc_ptr += SecurityBlobLength;
2431
2432 SecurityBlob->WorkstationName.Buffer = 0;
2433 SecurityBlob->WorkstationName.Length = 0;
2434 SecurityBlob->WorkstationName.MaximumLength = 0;
2435
2436 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2437 along with username on auth request (ie the response to challenge) */
2438 SecurityBlob->DomainName.Buffer = 0;
2439 SecurityBlob->DomainName.Length = 0;
2440 SecurityBlob->DomainName.MaximumLength = 0;
2441 if (ses->capabilities & CAP_UNICODE) {
2442 if ((long) bcc_ptr % 2) {
2443 *bcc_ptr = 0;
2444 bcc_ptr++;
2445 }
2446
2447 bytes_returned =
2448 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2449 32, nls_codepage);
2450 bcc_ptr += 2 * bytes_returned;
2451 bytes_returned =
2452 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2453 nls_codepage);
2454 bcc_ptr += 2 * bytes_returned;
2455 bcc_ptr += 2; /* null terminate Linux version */
2456 bytes_returned =
2457 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2458 64, nls_codepage);
2459 bcc_ptr += 2 * bytes_returned;
2460 *(bcc_ptr + 1) = 0;
2461 *(bcc_ptr + 2) = 0;
2462 bcc_ptr += 2; /* null terminate network opsys string */
2463 *(bcc_ptr + 1) = 0;
2464 *(bcc_ptr + 2) = 0;
2465 bcc_ptr += 2; /* null domain */
2466 } else { /* ASCII */
2467 strcpy(bcc_ptr, "Linux version ");
2468 bcc_ptr += strlen("Linux version ");
2469 strcpy(bcc_ptr, system_utsname.release);
2470 bcc_ptr += strlen(system_utsname.release) + 1;
2471 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2472 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2473 bcc_ptr++; /* empty domain field */
2474 *bcc_ptr = 0;
2475 }
2476 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2477 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2478 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2479 smb_buffer->smb_buf_length += count;
2480 pSMB->req.ByteCount = cpu_to_le16(count);
2481
2482 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2483 &bytes_returned, 1);
2484
2485 if (smb_buffer_response->Status.CifsError ==
2486 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2487 rc = 0;
2488
2489 if (rc) {
2490 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2491 } else if ((smb_buffer_response->WordCount == 3)
2492 || (smb_buffer_response->WordCount == 4)) {
2493 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2494 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2495
2496 if (action & GUEST_LOGIN)
2497 cFYI(1, (" Guest login"));
2498 /* Do we want to set anything in SesInfo struct when guest login? */
2499
2500 bcc_ptr = pByteArea(smb_buffer_response);
2501 /* response can have either 3 or 4 word count - Samba sends 3 */
2502
2503 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2504 if (SecurityBlob2->MessageType != NtLmChallenge) {
2505 cFYI(1,
2506 ("Unexpected NTLMSSP message type received %d",
2507 SecurityBlob2->MessageType));
2508 } else if (ses) {
2509 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2510 cFYI(1, ("UID = %d", ses->Suid));
2511 if ((pSMBr->resp.hdr.WordCount == 3)
2512 || ((pSMBr->resp.hdr.WordCount == 4)
2513 && (blob_len <
2514 pSMBr->resp.ByteCount))) {
2515
2516 if (pSMBr->resp.hdr.WordCount == 4) {
2517 bcc_ptr += blob_len;
2518 cFYI(1, ("Security Blob Length %d",
2519 blob_len));
2520 }
2521
2522 cFYI(1, ("NTLMSSP Challenge rcvd"));
2523
2524 memcpy(ses->server->cryptKey,
2525 SecurityBlob2->Challenge,
2526 CIFS_CRYPTO_KEY_SIZE);
2527 if(SecurityBlob2->NegotiateFlags &
2528 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2529 *pNTLMv2_flag = TRUE;
2530
2531 if((SecurityBlob2->NegotiateFlags &
2532 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2533 || (sign_CIFS_PDUs > 1))
2534 ses->server->secMode |=
2535 SECMODE_SIGN_REQUIRED;
2536 if ((SecurityBlob2->NegotiateFlags &
2537 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2538 ses->server->secMode |=
2539 SECMODE_SIGN_ENABLED;
2540
2541 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2542 if ((long) (bcc_ptr) % 2) {
2543 remaining_words =
2544 (BCC(smb_buffer_response)
2545 - 1) / 2;
2546 bcc_ptr++; /* Unicode strings must be word aligned */
2547 } else {
2548 remaining_words =
2549 BCC
2550 (smb_buffer_response) / 2;
2551 }
2552 len =
2553 UniStrnlen((wchar_t *) bcc_ptr,
2554 remaining_words - 1);
2555 /* We look for obvious messed up bcc or strings in response so we do not go off
2556 the end since (at least) WIN2K and Windows XP have a major bug in not null
2557 terminating last Unicode string in response */
2558 if(ses->serverOS)
2559 kfree(ses->serverOS);
2560 ses->serverOS =
2561 kzalloc(2 * (len + 1), GFP_KERNEL);
2562 cifs_strfromUCS_le(ses->serverOS,
2563 (__le16 *)
2564 bcc_ptr, len,
2565 nls_codepage);
2566 bcc_ptr += 2 * (len + 1);
2567 remaining_words -= len + 1;
2568 ses->serverOS[2 * len] = 0;
2569 ses->serverOS[1 + (2 * len)] = 0;
2570 if (remaining_words > 0) {
2571 len = UniStrnlen((wchar_t *)
2572 bcc_ptr,
2573 remaining_words
2574 - 1);
2575 kfree(ses->serverNOS);
2576 ses->serverNOS =
2577 kzalloc(2 * (len + 1),
2578 GFP_KERNEL);
2579 cifs_strfromUCS_le(ses->
2580 serverNOS,
2581 (__le16 *)
2582 bcc_ptr,
2583 len,
2584 nls_codepage);
2585 bcc_ptr += 2 * (len + 1);
2586 ses->serverNOS[2 * len] = 0;
2587 ses->serverNOS[1 +
2588 (2 * len)] = 0;
2589 remaining_words -= len + 1;
2590 if (remaining_words > 0) {
2591 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2592 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2593 kfree(ses->serverDomain);
2594 ses->serverDomain =
2595 kzalloc(2 *
2596 (len +
2597 1),
2598 GFP_KERNEL);
2599 cifs_strfromUCS_le
2600 (ses->serverDomain,
2601 (__le16 *)bcc_ptr,
2602 len, nls_codepage);
2603 bcc_ptr +=
2604 2 * (len + 1);
2605 ses->serverDomain[2*len]
2606 = 0;
2607 ses->serverDomain
2608 [1 + (2 * len)]
2609 = 0;
2610 } /* else no more room so create dummy domain string */
2611 else {
2612 kfree(ses->serverDomain);
2613 ses->serverDomain =
2614 kzalloc(2,
2615 GFP_KERNEL);
2616 }
2617 } else { /* no room so create dummy domain and NOS string */
2618 kfree(ses->serverDomain);
2619 ses->serverDomain =
2620 kzalloc(2, GFP_KERNEL);
2621 kfree(ses->serverNOS);
2622 ses->serverNOS =
2623 kzalloc(2, GFP_KERNEL);
2624 }
2625 } else { /* ASCII */
2626 len = strnlen(bcc_ptr, 1024);
2627 if (((long) bcc_ptr + len) - (long)
2628 pByteArea(smb_buffer_response)
2629 <= BCC(smb_buffer_response)) {
2630 if(ses->serverOS)
2631 kfree(ses->serverOS);
2632 ses->serverOS =
2633 kzalloc(len + 1,
2634 GFP_KERNEL);
2635 strncpy(ses->serverOS,
2636 bcc_ptr, len);
2637
2638 bcc_ptr += len;
2639 bcc_ptr[0] = 0; /* null terminate string */
2640 bcc_ptr++;
2641
2642 len = strnlen(bcc_ptr, 1024);
2643 kfree(ses->serverNOS);
2644 ses->serverNOS =
2645 kzalloc(len + 1,
2646 GFP_KERNEL);
2647 strncpy(ses->serverNOS, bcc_ptr, len);
2648 bcc_ptr += len;
2649 bcc_ptr[0] = 0;
2650 bcc_ptr++;
2651
2652 len = strnlen(bcc_ptr, 1024);
2653 kfree(ses->serverDomain);
2654 ses->serverDomain =
2655 kzalloc(len + 1,
2656 GFP_KERNEL);
2657 strncpy(ses->serverDomain, bcc_ptr, len);
2658 bcc_ptr += len;
2659 bcc_ptr[0] = 0;
2660 bcc_ptr++;
2661 } else
2662 cFYI(1,
2663 ("Variable field of length %d extends beyond end of smb",
2664 len));
2665 }
2666 } else {
2667 cERROR(1,
2668 (" Security Blob Length extends beyond end of SMB"));
2669 }
2670 } else {
2671 cERROR(1, ("No session structure passed in."));
2672 }
2673 } else {
2674 cERROR(1,
2675 (" Invalid Word count %d:",
2676 smb_buffer_response->WordCount));
2677 rc = -EIO;
2678 }
2679
2680 if (smb_buffer)
2681 cifs_buf_release(smb_buffer);
2682
2683 return rc;
2684 }
2685 static int
2686 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2687 char *ntlm_session_key, int ntlmv2_flag,
2688 const struct nls_table *nls_codepage)
2689 {
2690 struct smb_hdr *smb_buffer;
2691 struct smb_hdr *smb_buffer_response;
2692 SESSION_SETUP_ANDX *pSMB;
2693 SESSION_SETUP_ANDX *pSMBr;
2694 char *bcc_ptr;
2695 char *user;
2696 char *domain;
2697 int rc = 0;
2698 int remaining_words = 0;
2699 int bytes_returned = 0;
2700 int len;
2701 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2702 PAUTHENTICATE_MESSAGE SecurityBlob;
2703 __u32 negotiate_flags, capabilities;
2704 __u16 count;
2705
2706 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2707 if(ses == NULL)
2708 return -EINVAL;
2709 user = ses->userName;
2710 domain = ses->domainName;
2711 smb_buffer = cifs_buf_get();
2712 if (smb_buffer == NULL) {
2713 return -ENOMEM;
2714 }
2715 smb_buffer_response = smb_buffer;
2716 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2717 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2718
2719 /* send SMBsessionSetup here */
2720 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2721 NULL /* no tCon exists yet */ , 12 /* wct */ );
2722
2723 smb_buffer->Mid = GetNextMid(ses->server);
2724 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2725 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2726 pSMB->req.AndXCommand = 0xFF;
2727 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2728 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2729
2730 pSMB->req.hdr.Uid = ses->Suid;
2731
2732 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2733 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2734
2735 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2736 CAP_EXTENDED_SECURITY;
2737 if (ses->capabilities & CAP_UNICODE) {
2738 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2739 capabilities |= CAP_UNICODE;
2740 }
2741 if (ses->capabilities & CAP_STATUS32) {
2742 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2743 capabilities |= CAP_STATUS32;
2744 }
2745 if (ses->capabilities & CAP_DFS) {
2746 smb_buffer->Flags2 |= SMBFLG2_DFS;
2747 capabilities |= CAP_DFS;
2748 }
2749 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2750
2751 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2752 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2753 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2754 SecurityBlob->MessageType = NtLmAuthenticate;
2755 bcc_ptr += SecurityBlobLength;
2756 negotiate_flags =
2757 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2758 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2759 0x80000000 | NTLMSSP_NEGOTIATE_128;
2760 if(sign_CIFS_PDUs)
2761 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2762 if(ntlmv2_flag)
2763 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2764
2765 /* setup pointers to domain name and workstation name */
2766
2767 SecurityBlob->WorkstationName.Buffer = 0;
2768 SecurityBlob->WorkstationName.Length = 0;
2769 SecurityBlob->WorkstationName.MaximumLength = 0;
2770 SecurityBlob->SessionKey.Length = 0;
2771 SecurityBlob->SessionKey.MaximumLength = 0;
2772 SecurityBlob->SessionKey.Buffer = 0;
2773
2774 SecurityBlob->LmChallengeResponse.Length = 0;
2775 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2776 SecurityBlob->LmChallengeResponse.Buffer = 0;
2777
2778 SecurityBlob->NtChallengeResponse.Length =
2779 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2780 SecurityBlob->NtChallengeResponse.MaximumLength =
2781 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2782 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2783 SecurityBlob->NtChallengeResponse.Buffer =
2784 cpu_to_le32(SecurityBlobLength);
2785 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2786 bcc_ptr += CIFS_SESS_KEY_SIZE;
2787
2788 if (ses->capabilities & CAP_UNICODE) {
2789 if (domain == NULL) {
2790 SecurityBlob->DomainName.Buffer = 0;
2791 SecurityBlob->DomainName.Length = 0;
2792 SecurityBlob->DomainName.MaximumLength = 0;
2793 } else {
2794 __u16 len =
2795 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2796 nls_codepage);
2797 len *= 2;
2798 SecurityBlob->DomainName.MaximumLength =
2799 cpu_to_le16(len);
2800 SecurityBlob->DomainName.Buffer =
2801 cpu_to_le32(SecurityBlobLength);
2802 bcc_ptr += len;
2803 SecurityBlobLength += len;
2804 SecurityBlob->DomainName.Length =
2805 cpu_to_le16(len);
2806 }
2807 if (user == NULL) {
2808 SecurityBlob->UserName.Buffer = 0;
2809 SecurityBlob->UserName.Length = 0;
2810 SecurityBlob->UserName.MaximumLength = 0;
2811 } else {
2812 __u16 len =
2813 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2814 nls_codepage);
2815 len *= 2;
2816 SecurityBlob->UserName.MaximumLength =
2817 cpu_to_le16(len);
2818 SecurityBlob->UserName.Buffer =
2819 cpu_to_le32(SecurityBlobLength);
2820 bcc_ptr += len;
2821 SecurityBlobLength += len;
2822 SecurityBlob->UserName.Length =
2823 cpu_to_le16(len);
2824 }
2825
2826 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2827 SecurityBlob->WorkstationName.Length *= 2;
2828 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2829 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2830 bcc_ptr += SecurityBlob->WorkstationName.Length;
2831 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2832 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2833
2834 if ((long) bcc_ptr % 2) {
2835 *bcc_ptr = 0;
2836 bcc_ptr++;
2837 }
2838 bytes_returned =
2839 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2840 32, nls_codepage);
2841 bcc_ptr += 2 * bytes_returned;
2842 bytes_returned =
2843 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2844 nls_codepage);
2845 bcc_ptr += 2 * bytes_returned;
2846 bcc_ptr += 2; /* null term version string */
2847 bytes_returned =
2848 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2849 64, nls_codepage);
2850 bcc_ptr += 2 * bytes_returned;
2851 *(bcc_ptr + 1) = 0;
2852 *(bcc_ptr + 2) = 0;
2853 bcc_ptr += 2; /* null terminate network opsys string */
2854 *(bcc_ptr + 1) = 0;
2855 *(bcc_ptr + 2) = 0;
2856 bcc_ptr += 2; /* null domain */
2857 } else { /* ASCII */
2858 if (domain == NULL) {
2859 SecurityBlob->DomainName.Buffer = 0;
2860 SecurityBlob->DomainName.Length = 0;
2861 SecurityBlob->DomainName.MaximumLength = 0;
2862 } else {
2863 __u16 len;
2864 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2865 strncpy(bcc_ptr, domain, 63);
2866 len = strnlen(domain, 64);
2867 SecurityBlob->DomainName.MaximumLength =
2868 cpu_to_le16(len);
2869 SecurityBlob->DomainName.Buffer =
2870 cpu_to_le32(SecurityBlobLength);
2871 bcc_ptr += len;
2872 SecurityBlobLength += len;
2873 SecurityBlob->DomainName.Length = cpu_to_le16(len);
2874 }
2875 if (user == NULL) {
2876 SecurityBlob->UserName.Buffer = 0;
2877 SecurityBlob->UserName.Length = 0;
2878 SecurityBlob->UserName.MaximumLength = 0;
2879 } else {
2880 __u16 len;
2881 strncpy(bcc_ptr, user, 63);
2882 len = strnlen(user, 64);
2883 SecurityBlob->UserName.MaximumLength =
2884 cpu_to_le16(len);
2885 SecurityBlob->UserName.Buffer =
2886 cpu_to_le32(SecurityBlobLength);
2887 bcc_ptr += len;
2888 SecurityBlobLength += len;
2889 SecurityBlob->UserName.Length = cpu_to_le16(len);
2890 }
2891 /* BB fill in our workstation name if known BB */
2892
2893 strcpy(bcc_ptr, "Linux version ");
2894 bcc_ptr += strlen("Linux version ");
2895 strcpy(bcc_ptr, system_utsname.release);
2896 bcc_ptr += strlen(system_utsname.release) + 1;
2897 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2898 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2899 bcc_ptr++; /* null domain */
2900 *bcc_ptr = 0;
2901 }
2902 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2903 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2904 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2905 smb_buffer->smb_buf_length += count;
2906 pSMB->req.ByteCount = cpu_to_le16(count);
2907
2908 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2909 &bytes_returned, 1);
2910 if (rc) {
2911 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2912 } else if ((smb_buffer_response->WordCount == 3)
2913 || (smb_buffer_response->WordCount == 4)) {
2914 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2915 __u16 blob_len =
2916 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2917 if (action & GUEST_LOGIN)
2918 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
2919 /* if(SecurityBlob2->MessageType != NtLm??){
2920 cFYI("Unexpected message type on auth response is %d "));
2921 } */
2922 if (ses) {
2923 cFYI(1,
2924 ("Does UID on challenge %d match auth response UID %d ",
2925 ses->Suid, smb_buffer_response->Uid));
2926 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2927 bcc_ptr = pByteArea(smb_buffer_response);
2928 /* response can have either 3 or 4 word count - Samba sends 3 */
2929 if ((pSMBr->resp.hdr.WordCount == 3)
2930 || ((pSMBr->resp.hdr.WordCount == 4)
2931 && (blob_len <
2932 pSMBr->resp.ByteCount))) {
2933 if (pSMBr->resp.hdr.WordCount == 4) {
2934 bcc_ptr +=
2935 blob_len;
2936 cFYI(1,
2937 ("Security Blob Length %d ",
2938 blob_len));
2939 }
2940
2941 cFYI(1,
2942 ("NTLMSSP response to Authenticate "));
2943
2944 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2945 if ((long) (bcc_ptr) % 2) {
2946 remaining_words =
2947 (BCC(smb_buffer_response)
2948 - 1) / 2;
2949 bcc_ptr++; /* Unicode strings must be word aligned */
2950 } else {
2951 remaining_words = BCC(smb_buffer_response) / 2;
2952 }
2953 len =
2954 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
2955 /* We look for obvious messed up bcc or strings in response so we do not go off
2956 the end since (at least) WIN2K and Windows XP have a major bug in not null
2957 terminating last Unicode string in response */
2958 if(ses->serverOS)
2959 kfree(ses->serverOS);
2960 ses->serverOS =
2961 kzalloc(2 * (len + 1), GFP_KERNEL);
2962 cifs_strfromUCS_le(ses->serverOS,
2963 (__le16 *)
2964 bcc_ptr, len,
2965 nls_codepage);
2966 bcc_ptr += 2 * (len + 1);
2967 remaining_words -= len + 1;
2968 ses->serverOS[2 * len] = 0;
2969 ses->serverOS[1 + (2 * len)] = 0;
2970 if (remaining_words > 0) {
2971 len = UniStrnlen((wchar_t *)
2972 bcc_ptr,
2973 remaining_words
2974 - 1);
2975 kfree(ses->serverNOS);
2976 ses->serverNOS =
2977 kzalloc(2 * (len + 1),
2978 GFP_KERNEL);
2979 cifs_strfromUCS_le(ses->
2980 serverNOS,
2981 (__le16 *)
2982 bcc_ptr,
2983 len,
2984 nls_codepage);
2985 bcc_ptr += 2 * (len + 1);
2986 ses->serverNOS[2 * len] = 0;
2987 ses->serverNOS[1+(2*len)] = 0;
2988 remaining_words -= len + 1;
2989 if (remaining_words > 0) {
2990 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2991 /* last string not always null terminated (e.g. for Windows XP & 2000) */
2992 if(ses->serverDomain)
2993 kfree(ses->serverDomain);
2994 ses->serverDomain =
2995 kzalloc(2 *
2996 (len +
2997 1),
2998 GFP_KERNEL);
2999 cifs_strfromUCS_le
3000 (ses->
3001 serverDomain,
3002 (__le16 *)
3003 bcc_ptr, len,
3004 nls_codepage);
3005 bcc_ptr +=
3006 2 * (len + 1);
3007 ses->
3008 serverDomain[2
3009 * len]
3010 = 0;
3011 ses->
3012 serverDomain[1
3013 +
3014 (2
3015 *
3016 len)]
3017 = 0;
3018 } /* else no more room so create dummy domain string */
3019 else {
3020 if(ses->serverDomain)
3021 kfree(ses->serverDomain);
3022 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3023 }
3024 } else { /* no room so create dummy domain and NOS string */
3025 if(ses->serverDomain)
3026 kfree(ses->serverDomain);
3027 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3028 kfree(ses->serverNOS);
3029 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3030 }
3031 } else { /* ASCII */
3032 len = strnlen(bcc_ptr, 1024);
3033 if (((long) bcc_ptr + len) -
3034 (long) pByteArea(smb_buffer_response)
3035 <= BCC(smb_buffer_response)) {
3036 if(ses->serverOS)
3037 kfree(ses->serverOS);
3038 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3039 strncpy(ses->serverOS,bcc_ptr, len);
3040
3041 bcc_ptr += len;
3042 bcc_ptr[0] = 0; /* null terminate the string */
3043 bcc_ptr++;
3044
3045 len = strnlen(bcc_ptr, 1024);
3046 kfree(ses->serverNOS);
3047 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3048 strncpy(ses->serverNOS, bcc_ptr, len);
3049 bcc_ptr += len;
3050 bcc_ptr[0] = 0;
3051 bcc_ptr++;
3052
3053 len = strnlen(bcc_ptr, 1024);
3054 if(ses->serverDomain)
3055 kfree(ses->serverDomain);
3056 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3057 strncpy(ses->serverDomain, bcc_ptr, len);
3058 bcc_ptr += len;
3059 bcc_ptr[0] = 0;
3060 bcc_ptr++;
3061 } else
3062 cFYI(1,
3063 ("Variable field of length %d extends beyond end of smb ",
3064 len));
3065 }
3066 } else {
3067 cERROR(1,
3068 (" Security Blob Length extends beyond end of SMB"));
3069 }
3070 } else {
3071 cERROR(1, ("No session structure passed in."));
3072 }
3073 } else {
3074 cERROR(1,
3075 (" Invalid Word count %d: ",
3076 smb_buffer_response->WordCount));
3077 rc = -EIO;
3078 }
3079
3080 if (smb_buffer)
3081 cifs_buf_release(smb_buffer);
3082
3083 return rc;
3084 }
3085
3086 int
3087 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3088 const char *tree, struct cifsTconInfo *tcon,
3089 const struct nls_table *nls_codepage)
3090 {
3091 struct smb_hdr *smb_buffer;
3092 struct smb_hdr *smb_buffer_response;
3093 TCONX_REQ *pSMB;
3094 TCONX_RSP *pSMBr;
3095 unsigned char *bcc_ptr;
3096 int rc = 0;
3097 int length;
3098 __u16 count;
3099
3100 if (ses == NULL)
3101 return -EIO;
3102
3103 smb_buffer = cifs_buf_get();
3104 if (smb_buffer == NULL) {
3105 return -ENOMEM;
3106 }
3107 smb_buffer_response = smb_buffer;
3108
3109 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3110 NULL /*no tid */ , 4 /*wct */ );
3111
3112 smb_buffer->Mid = GetNextMid(ses->server);
3113 smb_buffer->Uid = ses->Suid;
3114 pSMB = (TCONX_REQ *) smb_buffer;
3115 pSMBr = (TCONX_RSP *) smb_buffer_response;
3116
3117 pSMB->AndXCommand = 0xFF;
3118 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3119 bcc_ptr = &pSMB->Password[0];
3120 if((ses->server->secMode) & SECMODE_USER) {
3121 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3122 *bcc_ptr = 0; /* password is null byte */
3123 bcc_ptr++; /* skip password */
3124 /* already aligned so no need to do it below */
3125 } else {
3126 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3127 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3128 specified as required (when that support is added to
3129 the vfs in the future) as only NTLM or the much
3130 weaker LANMAN (which we do not send by default) is accepted
3131 by Samba (not sure whether other servers allow
3132 NTLMv2 password here) */
3133 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3134 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3135 (ses->server->secType == LANMAN))
3136 calc_lanman_hash(ses, bcc_ptr);
3137 else
3138 #endif /* CIFS_WEAK_PW_HASH */
3139 SMBNTencrypt(ses->password,
3140 ses->server->cryptKey,
3141 bcc_ptr);
3142
3143 bcc_ptr += CIFS_SESS_KEY_SIZE;
3144 if(ses->capabilities & CAP_UNICODE) {
3145 /* must align unicode strings */
3146 *bcc_ptr = 0; /* null byte password */
3147 bcc_ptr++;
3148 }
3149 }
3150
3151 if(ses->server->secMode &
3152 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3153 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3154
3155 if (ses->capabilities & CAP_STATUS32) {
3156 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3157 }
3158 if (ses->capabilities & CAP_DFS) {
3159 smb_buffer->Flags2 |= SMBFLG2_DFS;
3160 }
3161 if (ses->capabilities & CAP_UNICODE) {
3162 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3163 length =
3164 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3165 6 /* max utf8 char length in bytes */ *
3166 (/* server len*/ + 256 /* share len */), nls_codepage);
3167 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3168 bcc_ptr += 2; /* skip trailing null */
3169 } else { /* ASCII */
3170 strcpy(bcc_ptr, tree);
3171 bcc_ptr += strlen(tree) + 1;
3172 }
3173 strcpy(bcc_ptr, "?????");
3174 bcc_ptr += strlen("?????");
3175 bcc_ptr += 1;
3176 count = bcc_ptr - &pSMB->Password[0];
3177 pSMB->hdr.smb_buf_length += count;
3178 pSMB->ByteCount = cpu_to_le16(count);
3179
3180 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3181
3182 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3183 /* above now done in SendReceive */
3184 if ((rc == 0) && (tcon != NULL)) {
3185 tcon->tidStatus = CifsGood;
3186 tcon->tid = smb_buffer_response->Tid;
3187 bcc_ptr = pByteArea(smb_buffer_response);
3188 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3189 /* skip service field (NB: this field is always ASCII) */
3190 bcc_ptr += length + 1;
3191 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3192 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3193 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3194 if ((bcc_ptr + (2 * length)) -
3195 pByteArea(smb_buffer_response) <=
3196 BCC(smb_buffer_response)) {
3197 kfree(tcon->nativeFileSystem);
3198 tcon->nativeFileSystem =
3199 kzalloc(length + 2, GFP_KERNEL);
3200 cifs_strfromUCS_le(tcon->nativeFileSystem,
3201 (__le16 *) bcc_ptr,
3202 length, nls_codepage);
3203 bcc_ptr += 2 * length;
3204 bcc_ptr[0] = 0; /* null terminate the string */
3205 bcc_ptr[1] = 0;
3206 bcc_ptr += 2;
3207 }
3208 /* else do not bother copying these informational fields */
3209 } else {
3210 length = strnlen(bcc_ptr, 1024);
3211 if ((bcc_ptr + length) -
3212 pByteArea(smb_buffer_response) <=
3213 BCC(smb_buffer_response)) {
3214 kfree(tcon->nativeFileSystem);
3215 tcon->nativeFileSystem =
3216 kzalloc(length + 1, GFP_KERNEL);
3217 strncpy(tcon->nativeFileSystem, bcc_ptr,
3218 length);
3219 }
3220 /* else do not bother copying these informational fields */
3221 }
3222 if((smb_buffer_response->WordCount == 3) ||
3223 (smb_buffer_response->WordCount == 7))
3224 /* field is in same location */
3225 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3226 else
3227 tcon->Flags = 0;
3228 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3229 } else if ((rc == 0) && tcon == NULL) {
3230 /* all we need to save for IPC$ connection */
3231 ses->ipc_tid = smb_buffer_response->Tid;
3232 }
3233
3234 if (smb_buffer)
3235 cifs_buf_release(smb_buffer);
3236 return rc;
3237 }
3238
3239 int
3240 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3241 {
3242 int rc = 0;
3243 int xid;
3244 struct cifsSesInfo *ses = NULL;
3245 struct task_struct *cifsd_task;
3246 char * tmp;
3247
3248 xid = GetXid();
3249
3250 if (cifs_sb->tcon) {
3251 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3252 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3253 if (rc == -EBUSY) {
3254 FreeXid(xid);
3255 return 0;
3256 }
3257 tconInfoFree(cifs_sb->tcon);
3258 if ((ses) && (ses->server)) {
3259 /* save off task so we do not refer to ses later */
3260 cifsd_task = ses->server->tsk;
3261 cFYI(1, ("About to do SMBLogoff "));
3262 rc = CIFSSMBLogoff(xid, ses);
3263 if (rc == -EBUSY) {
3264 FreeXid(xid);
3265 return 0;
3266 } else if (rc == -ESHUTDOWN) {
3267 cFYI(1,("Waking up socket by sending it signal"));
3268 if(cifsd_task) {
3269 send_sig(SIGKILL,cifsd_task,1);
3270 wait_for_completion(&cifsd_complete);
3271 }
3272 rc = 0;
3273 } /* else - we have an smb session
3274 left on this socket do not kill cifsd */
3275 } else
3276 cFYI(1, ("No session or bad tcon"));
3277 }
3278
3279 cifs_sb->tcon = NULL;
3280 tmp = cifs_sb->prepath;
3281 cifs_sb->prepathlen = 0;
3282 cifs_sb->prepath = NULL;
3283 kfree(tmp);
3284 if (ses)
3285 schedule_timeout_interruptible(msecs_to_jiffies(500));
3286 if (ses)
3287 sesInfoFree(ses);
3288
3289 FreeXid(xid);
3290 return rc; /* BB check if we should always return zero here */
3291 }
3292
3293 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3294 struct nls_table * nls_info)
3295 {
3296 int rc = 0;
3297 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3298 int ntlmv2_flag = FALSE;
3299 int first_time = 0;
3300
3301 /* what if server changes its buffer size after dropping the session? */
3302 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3303 rc = CIFSSMBNegotiate(xid, pSesInfo);
3304 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3305 rc = CIFSSMBNegotiate(xid, pSesInfo);
3306 if(rc == -EAGAIN)
3307 rc = -EHOSTDOWN;
3308 }
3309 if(rc == 0) {
3310 spin_lock(&GlobalMid_Lock);
3311 if(pSesInfo->server->tcpStatus != CifsExiting)
3312 pSesInfo->server->tcpStatus = CifsGood;
3313 else
3314 rc = -EHOSTDOWN;
3315 spin_unlock(&GlobalMid_Lock);
3316
3317 }
3318 first_time = 1;
3319 }
3320 if (!rc) {
3321 pSesInfo->flags = 0;
3322 pSesInfo->capabilities = pSesInfo->server->capabilities;
3323 if(linuxExtEnabled == 0)
3324 pSesInfo->capabilities &= (~CAP_UNIX);
3325 /* pSesInfo->sequence_number = 0;*/
3326 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3327 pSesInfo->server->secMode,
3328 pSesInfo->server->capabilities,
3329 pSesInfo->server->timeAdj));
3330 if(experimEnabled < 2)
3331 rc = CIFS_SessSetup(xid, pSesInfo,
3332 first_time, nls_info);
3333 else if (extended_security
3334 && (pSesInfo->capabilities
3335 & CAP_EXTENDED_SECURITY)
3336 && (pSesInfo->server->secType == NTLMSSP)) {
3337 rc = -EOPNOTSUPP;
3338 } else if (extended_security
3339 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3340 && (pSesInfo->server->secType == RawNTLMSSP)) {
3341 cFYI(1, ("NTLMSSP sesssetup"));
3342 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3343 pSesInfo,
3344 &ntlmv2_flag,
3345 nls_info);
3346 if (!rc) {
3347 if(ntlmv2_flag) {
3348 char * v2_response;
3349 cFYI(1,("more secure NTLM ver2 hash"));
3350 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3351 nls_info)) {
3352 rc = -ENOMEM;
3353 goto ss_err_exit;
3354 } else
3355 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3356 if(v2_response) {
3357 CalcNTLMv2_response(pSesInfo,v2_response);
3358 /* if(first_time)
3359 cifs_calculate_ntlmv2_mac_key(
3360 pSesInfo->server->mac_signing_key,
3361 response, ntlm_session_key, */
3362 kfree(v2_response);
3363 /* BB Put dummy sig in SessSetup PDU? */
3364 } else {
3365 rc = -ENOMEM;
3366 goto ss_err_exit;
3367 }
3368
3369 } else {
3370 SMBNTencrypt(pSesInfo->password,
3371 pSesInfo->server->cryptKey,
3372 ntlm_session_key);
3373
3374 if(first_time)
3375 cifs_calculate_mac_key(
3376 pSesInfo->server->mac_signing_key,
3377 ntlm_session_key,
3378 pSesInfo->password);
3379 }
3380 /* for better security the weaker lanman hash not sent
3381 in AuthSessSetup so we no longer calculate it */
3382
3383 rc = CIFSNTLMSSPAuthSessSetup(xid,
3384 pSesInfo,
3385 ntlm_session_key,
3386 ntlmv2_flag,
3387 nls_info);
3388 }
3389 } else { /* old style NTLM 0.12 session setup */
3390 SMBNTencrypt(pSesInfo->password,
3391 pSesInfo->server->cryptKey,
3392 ntlm_session_key);
3393
3394 if(first_time)
3395 cifs_calculate_mac_key(
3396 pSesInfo->server->mac_signing_key,
3397 ntlm_session_key, pSesInfo->password);
3398
3399 rc = CIFSSessSetup(xid, pSesInfo,
3400 ntlm_session_key, nls_info);
3401 }
3402 if (rc) {
3403 cERROR(1,("Send error in SessSetup = %d",rc));
3404 } else {
3405 cFYI(1,("CIFS Session Established successfully"));
3406 pSesInfo->status = CifsGood;
3407 }
3408 }
3409 ss_err_exit:
3410 return rc;
3411 }
3412
linux v2.6.22.y-op