?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netfilter: Fix kernel panic with REDIRECT target.
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / fs / cifs / connect.c
blob4af3588c1a9615b39976bac9fadc3487a64025eb
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2007
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/kthread.h>
34 #include <linux/pagevec.h>
35 #include <linux/freezer.h>
36 #include <asm/uaccess.h>
37 #include <asm/processor.h>
38 #include "cifspdu.h"
39 #include "cifsglob.h"
40 #include "cifsproto.h"
41 #include "cifs_unicode.h"
42 #include "cifs_debug.h"
43 #include "cifs_fs_sb.h"
44 #include "ntlmssp.h"
45 #include "nterr.h"
46 #include "rfc1002pdu.h"
47 #include "cn_cifs.h"
48
49 #define CIFS_PORT 445
50 #define RFC1001_PORT 139
51
52 static DECLARE_COMPLETION(cifsd_complete);
53
54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
55 unsigned char *p24);
56
57 extern mempool_t *cifs_req_poolp;
58
59 struct smb_vol {
60 char *username;
61 char *password;
62 char *domainname;
63 char *UNC;
64 char *UNCip;
65 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
66 char *iocharset; /* local code page for mapping to and from Unicode */
67 char source_rfc1001_name[16]; /* netbios name of client */
68 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
69 uid_t linux_uid;
70 gid_t linux_gid;
71 mode_t file_mode;
72 mode_t dir_mode;
73 unsigned secFlg;
74 unsigned rw:1;
75 unsigned retry:1;
76 unsigned intr:1;
77 unsigned setuids:1;
78 unsigned override_uid:1;
79 unsigned override_gid:1;
80 unsigned noperm:1;
81 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
82 unsigned cifs_acl:1;
83 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
84 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
85 unsigned direct_io:1;
86 unsigned remap:1; /* set to remap seven reserved chars in filenames */
87 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
88 unsigned no_linux_ext:1;
89 unsigned sfu_emul:1;
90 unsigned nullauth:1; /* attempt to authenticate with null user */
91 unsigned nocase; /* request case insensitive filenames */
92 unsigned nobrl; /* disable sending byte range locks to srv */
93 unsigned int rsize;
94 unsigned int wsize;
95 unsigned int sockopt;
96 unsigned short int port;
97 char *prepath;
98 };
99
100 static int ipv4_connect(struct sockaddr_in *psin_server,
101 struct socket **csocket,
102 char *netb_name,
103 char *server_netb_name);
104 static int ipv6_connect(struct sockaddr_in6 *psin_server,
105 struct socket **csocket);
106
107
108 /*
109 * cifs tcp session reconnection
110 *
111 * mark tcp session as reconnecting so temporarily locked
112 * mark all smb sessions as reconnecting for tcp session
113 * reconnect tcp session
114 * wake up waiters on reconnection? - (not needed currently)
115 */
116
117 static int
118 cifs_reconnect(struct TCP_Server_Info *server)
119 {
120 int rc = 0;
121 struct list_head *tmp;
122 struct cifsSesInfo *ses;
123 struct cifsTconInfo *tcon;
124 struct mid_q_entry *mid_entry;
125
126 spin_lock(&GlobalMid_Lock);
127 if ( kthread_should_stop() ) {
128 /* the demux thread will exit normally
129 next time through the loop */
130 spin_unlock(&GlobalMid_Lock);
131 return rc;
132 } else
133 server->tcpStatus = CifsNeedReconnect;
134 spin_unlock(&GlobalMid_Lock);
135 server->maxBuf = 0;
136
137 cFYI(1, ("Reconnecting tcp session"));
138
139 /* before reconnecting the tcp session, mark the smb session (uid)
140 and the tid bad so they are not used until reconnected */
141 read_lock(&GlobalSMBSeslock);
142 list_for_each(tmp, &GlobalSMBSessionList) {
143 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
144 if (ses->server) {
145 if (ses->server == server) {
146 ses->status = CifsNeedReconnect;
147 ses->ipc_tid = 0;
148 }
149 }
150 /* else tcp and smb sessions need reconnection */
151 }
152 list_for_each(tmp, &GlobalTreeConnectionList) {
153 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
154 if ((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
155 tcon->tidStatus = CifsNeedReconnect;
156 }
157 }
158 read_unlock(&GlobalSMBSeslock);
159 /* do not want to be sending data on a socket we are freeing */
160 down(&server->tcpSem);
161 if (server->ssocket) {
162 cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
163 server->ssocket->flags));
164 server->ssocket->ops->shutdown(server->ssocket, SEND_SHUTDOWN);
165 cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
166 server->ssocket->state,
167 server->ssocket->flags));
168 sock_release(server->ssocket);
169 server->ssocket = NULL;
170 }
171
172 spin_lock(&GlobalMid_Lock);
173 list_for_each(tmp, &server->pending_mid_q) {
174 mid_entry = list_entry(tmp, struct
175 mid_q_entry,
176 qhead);
177 if (mid_entry) {
178 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
179 /* Mark other intransit requests as needing
180 retry so we do not immediately mark the
181 session bad again (ie after we reconnect
182 below) as they timeout too */
183 mid_entry->midState = MID_RETRY_NEEDED;
184 }
185 }
186 }
187 spin_unlock(&GlobalMid_Lock);
188 up(&server->tcpSem);
189
190 while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
191 try_to_freeze();
192 if (server->protocolType == IPV6) {
193 rc = ipv6_connect(&server->addr.sockAddr6,
194 &server->ssocket);
195 } else {
196 rc = ipv4_connect(&server->addr.sockAddr,
197 &server->ssocket,
198 server->workstation_RFC1001_name,
199 server->server_RFC1001_name);
200 }
201 if (rc) {
202 cFYI(1, ("reconnect error %d", rc));
203 msleep(3000);
204 } else {
205 atomic_inc(&tcpSesReconnectCount);
206 spin_lock(&GlobalMid_Lock);
207 if ( !kthread_should_stop() )
208 server->tcpStatus = CifsGood;
209 server->sequence_number = 0;
210 spin_unlock(&GlobalMid_Lock);
211 /* atomic_set(&server->inFlight,0);*/
212 wake_up(&server->response_q);
213 }
214 }
215 return rc;
216 }
217
218 /*
219 return codes:
220 0 not a transact2, or all data present
221 >0 transact2 with that much data missing
222 -EINVAL = invalid transact2
223
224 */
225 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
226 {
227 struct smb_t2_rsp *pSMBt;
228 int total_data_size;
229 int data_in_this_rsp;
230 int remaining;
231
232 if (pSMB->Command != SMB_COM_TRANSACTION2)
233 return 0;
234
235 /* check for plausible wct, bcc and t2 data and parm sizes */
236 /* check for parm and data offset going beyond end of smb */
237 if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
238 cFYI(1, ("invalid transact2 word count"));
239 return -EINVAL;
240 }
241
242 pSMBt = (struct smb_t2_rsp *)pSMB;
243
244 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
245 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
246
247 remaining = total_data_size - data_in_this_rsp;
248
249 if (remaining == 0)
250 return 0;
251 else if (remaining < 0) {
252 cFYI(1, ("total data %d smaller than data in frame %d",
253 total_data_size, data_in_this_rsp));
254 return -EINVAL;
255 } else {
256 cFYI(1, ("missing %d bytes from transact2, check next response",
257 remaining));
258 if (total_data_size > maxBufSize) {
259 cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
260 total_data_size, maxBufSize));
261 return -EINVAL;
262 }
263 return remaining;
264 }
265 }
266
267 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
268 {
269 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
270 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
271 int total_data_size;
272 int total_in_buf;
273 int remaining;
274 int total_in_buf2;
275 char *data_area_of_target;
276 char *data_area_of_buf2;
277 __u16 byte_count;
278
279 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
280
281 if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
282 cFYI(1, ("total data size of primary and secondary t2 differ"));
283 }
284
285 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
286
287 remaining = total_data_size - total_in_buf;
288
289 if (remaining < 0)
290 return -EINVAL;
291
292 if (remaining == 0) /* nothing to do, ignore */
293 return 0;
294
295 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
296 if (remaining < total_in_buf2) {
297 cFYI(1, ("transact2 2nd response contains too much data"));
298 }
299
300 /* find end of first SMB data area */
301 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
302 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
303 /* validate target area */
304
305 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
306 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
307
308 data_area_of_target += total_in_buf;
309
310 /* copy second buffer into end of first buffer */
311 memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
312 total_in_buf += total_in_buf2;
313 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
314 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
315 byte_count += total_in_buf2;
316 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
317
318 byte_count = pTargetSMB->smb_buf_length;
319 byte_count += total_in_buf2;
320
321 /* BB also add check that we are not beyond maximum buffer size */
322
323 pTargetSMB->smb_buf_length = byte_count;
324
325 if (remaining == total_in_buf2) {
326 cFYI(1, ("found the last secondary response"));
327 return 0; /* we are done */
328 } else /* more responses to go */
329 return 1;
330
331 }
332
333 static int
334 cifs_demultiplex_thread(struct TCP_Server_Info *server)
335 {
336 int length;
337 unsigned int pdu_length, total_read;
338 struct smb_hdr *smb_buffer = NULL;
339 struct smb_hdr *bigbuf = NULL;
340 struct smb_hdr *smallbuf = NULL;
341 struct msghdr smb_msg;
342 struct kvec iov;
343 struct socket *csocket = server->ssocket;
344 struct list_head *tmp;
345 struct cifsSesInfo *ses;
346 struct task_struct *task_to_wake = NULL;
347 struct mid_q_entry *mid_entry;
348 char temp;
349 int isLargeBuf = FALSE;
350 int isMultiRsp;
351 int reconnect;
352
353 current->flags |= PF_MEMALLOC;
354 server->tsk = current; /* save process info to wake at shutdown */
355 cFYI(1, ("Demultiplex PID: %d", current->pid));
356 write_lock(&GlobalSMBSeslock);
357 atomic_inc(&tcpSesAllocCount);
358 length = tcpSesAllocCount.counter;
359 write_unlock(&GlobalSMBSeslock);
360 complete(&cifsd_complete);
361 if (length > 1) {
362 mempool_resize(cifs_req_poolp,
363 length + cifs_min_rcv,
364 GFP_KERNEL);
365 }
366
367 set_freezable();
368 while (!kthread_should_stop()) {
369 if (try_to_freeze())
370 continue;
371 if (bigbuf == NULL) {
372 bigbuf = cifs_buf_get();
373 if (!bigbuf) {
374 cERROR(1, ("No memory for large SMB response"));
375 msleep(3000);
376 /* retry will check if exiting */
377 continue;
378 }
379 } else if (isLargeBuf) {
380 /* we are reusing a dirty large buf, clear its start */
381 memset(bigbuf, 0, sizeof (struct smb_hdr));
382 }
383
384 if (smallbuf == NULL) {
385 smallbuf = cifs_small_buf_get();
386 if (!smallbuf) {
387 cERROR(1, ("No memory for SMB response"));
388 msleep(1000);
389 /* retry will check if exiting */
390 continue;
391 }
392 /* beginning of smb buffer is cleared in our buf_get */
393 } else /* if existing small buf clear beginning */
394 memset(smallbuf, 0, sizeof (struct smb_hdr));
395
396 isLargeBuf = FALSE;
397 isMultiRsp = FALSE;
398 smb_buffer = smallbuf;
399 iov.iov_base = smb_buffer;
400 iov.iov_len = 4;
401 smb_msg.msg_control = NULL;
402 smb_msg.msg_controllen = 0;
403 length =
404 kernel_recvmsg(csocket, &smb_msg,
405 &iov, 1, 4, 0 /* BB see socket.h flags */);
406
407 if ( kthread_should_stop() ) {
408 break;
409 } else if (server->tcpStatus == CifsNeedReconnect) {
410 cFYI(1, ("Reconnect after server stopped responding"));
411 cifs_reconnect(server);
412 cFYI(1, ("call to reconnect done"));
413 csocket = server->ssocket;
414 continue;
415 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
416 msleep(1); /* minimum sleep to prevent looping
417 allowing socket to clear and app threads to set
418 tcpStatus CifsNeedReconnect if server hung */
419 continue;
420 } else if (length <= 0) {
421 if (server->tcpStatus == CifsNew) {
422 cFYI(1, ("tcp session abend after SMBnegprot"));
423 /* some servers kill the TCP session rather than
424 returning an SMB negprot error, in which
425 case reconnecting here is not going to help,
426 and so simply return error to mount */
427 break;
428 }
429 if (!try_to_freeze() && (length == -EINTR)) {
430 cFYI(1, ("cifsd thread killed"));
431 break;
432 }
433 cFYI(1, ("Reconnect after unexpected peek error %d",
434 length));
435 cifs_reconnect(server);
436 csocket = server->ssocket;
437 wake_up(&server->response_q);
438 continue;
439 } else if (length < 4) {
440 cFYI(1,
441 ("Frame under four bytes received (%d bytes long)",
442 length));
443 cifs_reconnect(server);
444 csocket = server->ssocket;
445 wake_up(&server->response_q);
446 continue;
447 }
448
449 /* The right amount was read from socket - 4 bytes */
450 /* so we can now interpret the length field */
451
452 /* the first byte big endian of the length field,
453 is actually not part of the length but the type
454 with the most common, zero, as regular data */
455 temp = *((char *) smb_buffer);
456
457 /* Note that FC 1001 length is big endian on the wire,
458 but we convert it here so it is always manipulated
459 as host byte order */
460 pdu_length = ntohl(smb_buffer->smb_buf_length);
461 smb_buffer->smb_buf_length = pdu_length;
462
463 cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
464
465 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
466 continue;
467 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
468 cFYI(1, ("Good RFC 1002 session rsp"));
469 continue;
470 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
471 /* we get this from Windows 98 instead of
472 an error on SMB negprot response */
473 cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
474 pdu_length));
475 if (server->tcpStatus == CifsNew) {
476 /* if nack on negprot (rather than
477 ret of smb negprot error) reconnecting
478 not going to help, ret error to mount */
479 break;
480 } else {
481 /* give server a second to
482 clean up before reconnect attempt */
483 msleep(1000);
484 /* always try 445 first on reconnect
485 since we get NACK on some if we ever
486 connected to port 139 (the NACK is
487 since we do not begin with RFC1001
488 session initialize frame) */
489 server->addr.sockAddr.sin_port =
490 htons(CIFS_PORT);
491 cifs_reconnect(server);
492 csocket = server->ssocket;
493 wake_up(&server->response_q);
494 continue;
495 }
496 } else if (temp != (char) 0) {
497 cERROR(1, ("Unknown RFC 1002 frame"));
498 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
499 length);
500 cifs_reconnect(server);
501 csocket = server->ssocket;
502 continue;
503 }
504
505 /* else we have an SMB response */
506 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
507 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
508 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
509 length, pdu_length+4));
510 cifs_reconnect(server);
511 csocket = server->ssocket;
512 wake_up(&server->response_q);
513 continue;
514 }
515
516 /* else length ok */
517 reconnect = 0;
518
519 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
520 isLargeBuf = TRUE;
521 memcpy(bigbuf, smallbuf, 4);
522 smb_buffer = bigbuf;
523 }
524 length = 0;
525 iov.iov_base = 4 + (char *)smb_buffer;
526 iov.iov_len = pdu_length;
527 for (total_read = 0; total_read < pdu_length;
528 total_read += length) {
529 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
530 pdu_length - total_read, 0);
531 if ( kthread_should_stop() ||
532 (length == -EINTR)) {
533 /* then will exit */
534 reconnect = 2;
535 break;
536 } else if (server->tcpStatus == CifsNeedReconnect) {
537 cifs_reconnect(server);
538 csocket = server->ssocket;
539 /* Reconnect wakes up rspns q */
540 /* Now we will reread sock */
541 reconnect = 1;
542 break;
543 } else if ((length == -ERESTARTSYS) ||
544 (length == -EAGAIN)) {
545 msleep(1); /* minimum sleep to prevent looping,
546 allowing socket to clear and app
547 threads to set tcpStatus
548 CifsNeedReconnect if server hung*/
549 continue;
550 } else if (length <= 0) {
551 cERROR(1, ("Received no data, expecting %d",
552 pdu_length - total_read));
553 cifs_reconnect(server);
554 csocket = server->ssocket;
555 reconnect = 1;
556 break;
557 }
558 }
559 if (reconnect == 2)
560 break;
561 else if (reconnect == 1)
562 continue;
563
564 length += 4; /* account for rfc1002 hdr */
565
566
567 dump_smb(smb_buffer, length);
568 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
569 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
570 continue;
571 }
572
573
574 task_to_wake = NULL;
575 spin_lock(&GlobalMid_Lock);
576 list_for_each(tmp, &server->pending_mid_q) {
577 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
578
579 if ((mid_entry->mid == smb_buffer->Mid) &&
580 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
581 (mid_entry->command == smb_buffer->Command)) {
582 if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
583 /* We have a multipart transact2 resp */
584 isMultiRsp = TRUE;
585 if (mid_entry->resp_buf) {
586 /* merge response - fix up 1st*/
587 if (coalesce_t2(smb_buffer,
588 mid_entry->resp_buf)) {
589 mid_entry->multiRsp = 1;
590 break;
591 } else {
592 /* all parts received */
593 mid_entry->multiEnd = 1;
594 goto multi_t2_fnd;
595 }
596 } else {
597 if (!isLargeBuf) {
598 cERROR(1,("1st trans2 resp needs bigbuf"));
599 /* BB maybe we can fix this up, switch
600 to already allocated large buffer? */
601 } else {
602 /* Have first buffer */
603 mid_entry->resp_buf =
604 smb_buffer;
605 mid_entry->largeBuf = 1;
606 bigbuf = NULL;
607 }
608 }
609 break;
610 }
611 mid_entry->resp_buf = smb_buffer;
612 if (isLargeBuf)
613 mid_entry->largeBuf = 1;
614 else
615 mid_entry->largeBuf = 0;
616 multi_t2_fnd:
617 task_to_wake = mid_entry->tsk;
618 mid_entry->midState = MID_RESPONSE_RECEIVED;
619 #ifdef CONFIG_CIFS_STATS2
620 mid_entry->when_received = jiffies;
621 #endif
622 /* so we do not time out requests to server
623 which is still responding (since server could
624 be busy but not dead) */
625 server->lstrp = jiffies;
626 break;
627 }
628 }
629 spin_unlock(&GlobalMid_Lock);
630 if (task_to_wake) {
631 /* Was previous buf put in mpx struct for multi-rsp? */
632 if (!isMultiRsp) {
633 /* smb buffer will be freed by user thread */
634 if (isLargeBuf) {
635 bigbuf = NULL;
636 } else
637 smallbuf = NULL;
638 }
639 wake_up_process(task_to_wake);
640 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
641 && (isMultiRsp == FALSE)) {
642 cERROR(1, ("No task to wake, unknown frame received! "
643 "NumMids %d", midCount.counter));
644 cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
645 sizeof(struct smb_hdr));
646 #ifdef CONFIG_CIFS_DEBUG2
647 cifs_dump_detail(smb_buffer);
648 cifs_dump_mids(server);
649 #endif /* CIFS_DEBUG2 */
650
651 }
652 } /* end while !EXITING */
653
654 spin_lock(&GlobalMid_Lock);
655 server->tcpStatus = CifsExiting;
656 server->tsk = NULL;
657 /* check if we have blocked requests that need to free */
658 /* Note that cifs_max_pending is normally 50, but
659 can be set at module install time to as little as two */
660 if (atomic_read(&server->inFlight) >= cifs_max_pending)
661 atomic_set(&server->inFlight, cifs_max_pending - 1);
662 /* We do not want to set the max_pending too low or we
663 could end up with the counter going negative */
664 spin_unlock(&GlobalMid_Lock);
665 /* Although there should not be any requests blocked on
666 this queue it can not hurt to be paranoid and try to wake up requests
667 that may haven been blocked when more than 50 at time were on the wire
668 to the same server - they now will see the session is in exit state
669 and get out of SendReceive. */
670 wake_up_all(&server->request_q);
671 /* give those requests time to exit */
672 msleep(125);
673
674 if (server->ssocket) {
675 sock_release(csocket);
676 server->ssocket = NULL;
677 }
678 /* buffer usuallly freed in free_mid - need to free it here on exit */
679 if (bigbuf != NULL)
680 cifs_buf_release(bigbuf);
681 if (smallbuf != NULL)
682 cifs_small_buf_release(smallbuf);
683
684 read_lock(&GlobalSMBSeslock);
685 if (list_empty(&server->pending_mid_q)) {
686 /* loop through server session structures attached to this and
687 mark them dead */
688 list_for_each(tmp, &GlobalSMBSessionList) {
689 ses =
690 list_entry(tmp, struct cifsSesInfo,
691 cifsSessionList);
692 if (ses->server == server) {
693 ses->status = CifsExiting;
694 ses->server = NULL;
695 }
696 }
697 read_unlock(&GlobalSMBSeslock);
698 } else {
699 /* although we can not zero the server struct pointer yet,
700 since there are active requests which may depnd on them,
701 mark the corresponding SMB sessions as exiting too */
702 list_for_each(tmp, &GlobalSMBSessionList) {
703 ses = list_entry(tmp, struct cifsSesInfo,
704 cifsSessionList);
705 if (ses->server == server) {
706 ses->status = CifsExiting;
707 }
708 }
709
710 spin_lock(&GlobalMid_Lock);
711 list_for_each(tmp, &server->pending_mid_q) {
712 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
713 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
714 cFYI(1, ("Clearing Mid 0x%x - waking up ",
715 mid_entry->mid));
716 task_to_wake = mid_entry->tsk;
717 if (task_to_wake) {
718 wake_up_process(task_to_wake);
719 }
720 }
721 }
722 spin_unlock(&GlobalMid_Lock);
723 read_unlock(&GlobalSMBSeslock);
724 /* 1/8th of sec is more than enough time for them to exit */
725 msleep(125);
726 }
727
728 if (!list_empty(&server->pending_mid_q)) {
729 /* mpx threads have not exited yet give them
730 at least the smb send timeout time for long ops */
731 /* due to delays on oplock break requests, we need
732 to wait at least 45 seconds before giving up
733 on a request getting a response and going ahead
734 and killing cifsd */
735 cFYI(1, ("Wait for exit from demultiplex thread"));
736 msleep(46000);
737 /* if threads still have not exited they are probably never
738 coming home not much else we can do but free the memory */
739 }
740
741 write_lock(&GlobalSMBSeslock);
742 atomic_dec(&tcpSesAllocCount);
743 length = tcpSesAllocCount.counter;
744
745 /* last chance to mark ses pointers invalid
746 if there are any pointing to this (e.g
747 if a crazy root user tried to kill cifsd
748 kernel thread explicitly this might happen) */
749 list_for_each(tmp, &GlobalSMBSessionList) {
750 ses = list_entry(tmp, struct cifsSesInfo,
751 cifsSessionList);
752 if (ses->server == server) {
753 ses->server = NULL;
754 }
755 }
756 write_unlock(&GlobalSMBSeslock);
757
758 kfree(server);
759 if (length > 0) {
760 mempool_resize(cifs_req_poolp,
761 length + cifs_min_rcv,
762 GFP_KERNEL);
763 }
764
765 return 0;
766 }
767
768 static int
769 cifs_parse_mount_options(char *options, const char *devname,
770 struct smb_vol *vol)
771 {
772 char *value;
773 char *data;
774 unsigned int temp_len, i, j;
775 char separator[2];
776
777 separator[0] = ',';
778 separator[1] = 0;
779
780 if (Local_System_Name[0] != 0)
781 memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
782 else {
783 char *nodename = utsname()->nodename;
784 int n = strnlen(nodename, 15);
785 memset(vol->source_rfc1001_name, 0x20, 15);
786 for (i = 0; i < n; i++) {
787 /* does not have to be perfect mapping since field is
788 informational, only used for servers that do not support
789 port 445 and it can be overridden at mount time */
790 vol->source_rfc1001_name[i] = toupper(nodename[i]);
791 }
792 }
793 vol->source_rfc1001_name[15] = 0;
794 /* null target name indicates to use *SMBSERVR default called name
795 if we end up sending RFC1001 session initialize */
796 vol->target_rfc1001_name[0] = 0;
797 vol->linux_uid = current->uid; /* current->euid instead? */
798 vol->linux_gid = current->gid;
799 vol->dir_mode = S_IRWXUGO;
800 /* 2767 perms indicate mandatory locking support */
801 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
802
803 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
804 vol->rw = TRUE;
805 /* default is always to request posix paths. */
806 vol->posix_paths = 1;
807
808 if (!options)
809 return 1;
810
811 if (strncmp(options, "sep=", 4) == 0) {
812 if (options[4] != 0) {
813 separator[0] = options[4];
814 options += 5;
815 } else {
816 cFYI(1, ("Null separator not allowed"));
817 }
818 }
819
820 while ((data = strsep(&options, separator)) != NULL) {
821 if (!*data)
822 continue;
823 if ((value = strchr(data, '=')) != NULL)
824 *value++ = '\0';
825
826 /* Have to parse this before we parse for "user" */
827 if (strnicmp(data, "user_xattr", 10) == 0) {
828 vol->no_xattr = 0;
829 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
830 vol->no_xattr = 1;
831 } else if (strnicmp(data, "user", 4) == 0) {
832 if (!value) {
833 printk(KERN_WARNING
834 "CIFS: invalid or missing username\n");
835 return 1; /* needs_arg; */
836 } else if (!*value) {
837 /* null user, ie anonymous, authentication */
838 vol->nullauth = 1;
839 }
840 if (strnlen(value, 200) < 200) {
841 vol->username = value;
842 } else {
843 printk(KERN_WARNING "CIFS: username too long\n");
844 return 1;
845 }
846 } else if (strnicmp(data, "pass", 4) == 0) {
847 if (!value) {
848 vol->password = NULL;
849 continue;
850 } else if (value[0] == 0) {
851 /* check if string begins with double comma
852 since that would mean the password really
853 does start with a comma, and would not
854 indicate an empty string */
855 if (value[1] != separator[0]) {
856 vol->password = NULL;
857 continue;
858 }
859 }
860 temp_len = strlen(value);
861 /* removed password length check, NTLM passwords
862 can be arbitrarily long */
863
864 /* if comma in password, the string will be
865 prematurely null terminated. Commas in password are
866 specified across the cifs mount interface by a double
867 comma ie ,, and a comma used as in other cases ie ','
868 as a parameter delimiter/separator is single and due
869 to the strsep above is temporarily zeroed. */
870
871 /* NB: password legally can have multiple commas and
872 the only illegal character in a password is null */
873
874 if ((value[temp_len] == 0) &&
875 (value[temp_len+1] == separator[0])) {
876 /* reinsert comma */
877 value[temp_len] = separator[0];
878 temp_len += 2; /* move after second comma */
879 while (value[temp_len] != 0) {
880 if (value[temp_len] == separator[0]) {
881 if (value[temp_len+1] ==
882 separator[0]) {
883 /* skip second comma */
884 temp_len++;
885 } else {
886 /* single comma indicating start
887 of next parm */
888 break;
889 }
890 }
891 temp_len++;
892 }
893 if (value[temp_len] == 0) {
894 options = NULL;
895 } else {
896 value[temp_len] = 0;
897 /* point option to start of next parm */
898 options = value + temp_len + 1;
899 }
900 /* go from value to value + temp_len condensing
901 double commas to singles. Note that this ends up
902 allocating a few bytes too many, which is ok */
903 vol->password = kzalloc(temp_len, GFP_KERNEL);
904 if (vol->password == NULL) {
905 printk(KERN_WARNING "CIFS: no memory "
906 "for password\n");
907 return 1;
908 }
909 for (i = 0, j = 0; i < temp_len; i++, j++) {
910 vol->password[j] = value[i];
911 if (value[i] == separator[0]
912 && value[i+1] == separator[0]) {
913 /* skip second comma */
914 i++;
915 }
916 }
917 vol->password[j] = 0;
918 } else {
919 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
920 if (vol->password == NULL) {
921 printk(KERN_WARNING "CIFS: no memory "
922 "for password\n");
923 return 1;
924 }
925 strcpy(vol->password, value);
926 }
927 } else if (strnicmp(data, "ip", 2) == 0) {
928 if (!value || !*value) {
929 vol->UNCip = NULL;
930 } else if (strnlen(value, 35) < 35) {
931 vol->UNCip = value;
932 } else {
933 printk(KERN_WARNING "CIFS: ip address "
934 "too long\n");
935 return 1;
936 }
937 } else if (strnicmp(data, "sec", 3) == 0) {
938 if (!value || !*value) {
939 cERROR(1, ("no security value specified"));
940 continue;
941 } else if (strnicmp(value, "krb5i", 5) == 0) {
942 vol->secFlg |= CIFSSEC_MAY_KRB5 |
943 CIFSSEC_MUST_SIGN;
944 } else if (strnicmp(value, "krb5p", 5) == 0) {
945 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
946 CIFSSEC_MAY_KRB5; */
947 cERROR(1, ("Krb5 cifs privacy not supported"));
948 return 1;
949 } else if (strnicmp(value, "krb5", 4) == 0) {
950 vol->secFlg |= CIFSSEC_MAY_KRB5;
951 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
952 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
953 CIFSSEC_MUST_SIGN;
954 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
955 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
956 } else if (strnicmp(value, "ntlmi", 5) == 0) {
957 vol->secFlg |= CIFSSEC_MAY_NTLM |
958 CIFSSEC_MUST_SIGN;
959 } else if (strnicmp(value, "ntlm", 4) == 0) {
960 /* ntlm is default so can be turned off too */
961 vol->secFlg |= CIFSSEC_MAY_NTLM;
962 } else if (strnicmp(value, "nontlm", 6) == 0) {
963 /* BB is there a better way to do this? */
964 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
965 #ifdef CONFIG_CIFS_WEAK_PW_HASH
966 } else if (strnicmp(value, "lanman", 6) == 0) {
967 vol->secFlg |= CIFSSEC_MAY_LANMAN;
968 #endif
969 } else if (strnicmp(value, "none", 4) == 0) {
970 vol->nullauth = 1;
971 } else {
972 cERROR(1, ("bad security option: %s", value));
973 return 1;
974 }
975 } else if ((strnicmp(data, "unc", 3) == 0)
976 || (strnicmp(data, "target", 6) == 0)
977 || (strnicmp(data, "path", 4) == 0)) {
978 if (!value || !*value) {
979 printk(KERN_WARNING "CIFS: invalid path to "
980 "network resource\n");
981 return 1; /* needs_arg; */
982 }
983 if ((temp_len = strnlen(value, 300)) < 300) {
984 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
985 if (vol->UNC == NULL)
986 return 1;
987 strcpy(vol->UNC, value);
988 if (strncmp(vol->UNC, "//", 2) == 0) {
989 vol->UNC[0] = '\\';
990 vol->UNC[1] = '\\';
991 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
992 printk(KERN_WARNING
993 "CIFS: UNC Path does not begin "
994 "with // or \\\\ \n");
995 return 1;
996 }
997 } else {
998 printk(KERN_WARNING "CIFS: UNC name too long\n");
999 return 1;
1000 }
1001 } else if ((strnicmp(data, "domain", 3) == 0)
1002 || (strnicmp(data, "workgroup", 5) == 0)) {
1003 if (!value || !*value) {
1004 printk(KERN_WARNING "CIFS: invalid domain name\n");
1005 return 1; /* needs_arg; */
1006 }
1007 /* BB are there cases in which a comma can be valid in
1008 a domain name and need special handling? */
1009 if (strnlen(value, 256) < 256) {
1010 vol->domainname = value;
1011 cFYI(1, ("Domain name set"));
1012 } else {
1013 printk(KERN_WARNING "CIFS: domain name too "
1014 "long\n");
1015 return 1;
1016 }
1017 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1018 if (!value || !*value) {
1019 printk(KERN_WARNING
1020 "CIFS: invalid path prefix\n");
1021 return 1; /* needs_argument */
1022 }
1023 if ((temp_len = strnlen(value, 1024)) < 1024) {
1024 if (value[0] != '/')
1025 temp_len++; /* missing leading slash */
1026 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1027 if (vol->prepath == NULL)
1028 return 1;
1029 if (value[0] != '/') {
1030 vol->prepath[0] = '/';
1031 strcpy(vol->prepath+1, value);
1032 } else
1033 strcpy(vol->prepath, value);
1034 cFYI(1, ("prefix path %s", vol->prepath));
1035 } else {
1036 printk(KERN_WARNING "CIFS: prefix too long\n");
1037 return 1;
1038 }
1039 } else if (strnicmp(data, "iocharset", 9) == 0) {
1040 if (!value || !*value) {
1041 printk(KERN_WARNING "CIFS: invalid iocharset "
1042 "specified\n");
1043 return 1; /* needs_arg; */
1044 }
1045 if (strnlen(value, 65) < 65) {
1046 if (strnicmp(value, "default", 7))
1047 vol->iocharset = value;
1048 /* if iocharset not set then load_nls_default
1049 is used by caller */
1050 cFYI(1, ("iocharset set to %s", value));
1051 } else {
1052 printk(KERN_WARNING "CIFS: iocharset name "
1053 "too long.\n");
1054 return 1;
1055 }
1056 } else if (strnicmp(data, "uid", 3) == 0) {
1057 if (value && *value) {
1058 vol->linux_uid =
1059 simple_strtoul(value, &value, 0);
1060 vol->override_uid = 1;
1061 }
1062 } else if (strnicmp(data, "gid", 3) == 0) {
1063 if (value && *value) {
1064 vol->linux_gid =
1065 simple_strtoul(value, &value, 0);
1066 vol->override_gid = 1;
1067 }
1068 } else if (strnicmp(data, "file_mode", 4) == 0) {
1069 if (value && *value) {
1070 vol->file_mode =
1071 simple_strtoul(value, &value, 0);
1072 }
1073 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1074 if (value && *value) {
1075 vol->dir_mode =
1076 simple_strtoul(value, &value, 0);
1077 }
1078 } else if (strnicmp(data, "dirmode", 4) == 0) {
1079 if (value && *value) {
1080 vol->dir_mode =
1081 simple_strtoul(value, &value, 0);
1082 }
1083 } else if (strnicmp(data, "port", 4) == 0) {
1084 if (value && *value) {
1085 vol->port =
1086 simple_strtoul(value, &value, 0);
1087 }
1088 } else if (strnicmp(data, "rsize", 5) == 0) {
1089 if (value && *value) {
1090 vol->rsize =
1091 simple_strtoul(value, &value, 0);
1092 }
1093 } else if (strnicmp(data, "wsize", 5) == 0) {
1094 if (value && *value) {
1095 vol->wsize =
1096 simple_strtoul(value, &value, 0);
1097 }
1098 } else if (strnicmp(data, "sockopt", 5) == 0) {
1099 if (value && *value) {
1100 vol->sockopt =
1101 simple_strtoul(value, &value, 0);
1102 }
1103 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1104 if (!value || !*value || (*value == ' ')) {
1105 cFYI(1, ("invalid (empty) netbiosname"));
1106 } else {
1107 memset(vol->source_rfc1001_name, 0x20, 15);
1108 for (i = 0; i < 15; i++) {
1109 /* BB are there cases in which a comma can be
1110 valid in this workstation netbios name (and need
1111 special handling)? */
1112
1113 /* We do not uppercase netbiosname for user */
1114 if (value[i] == 0)
1115 break;
1116 else
1117 vol->source_rfc1001_name[i] =
1118 value[i];
1119 }
1120 /* The string has 16th byte zero still from
1121 set at top of the function */
1122 if ((i == 15) && (value[i] != 0))
1123 printk(KERN_WARNING "CIFS: netbiosname"
1124 " longer than 15 truncated.\n");
1125 }
1126 } else if (strnicmp(data, "servern", 7) == 0) {
1127 /* servernetbiosname specified override *SMBSERVER */
1128 if (!value || !*value || (*value == ' ')) {
1129 cFYI(1, ("empty server netbiosname specified"));
1130 } else {
1131 /* last byte, type, is 0x20 for servr type */
1132 memset(vol->target_rfc1001_name, 0x20, 16);
1133
1134 for (i = 0; i < 15; i++) {
1135 /* BB are there cases in which a comma can be
1136 valid in this workstation netbios name
1137 (and need special handling)? */
1138
1139 /* user or mount helper must uppercase
1140 the netbiosname */
1141 if (value[i] == 0)
1142 break;
1143 else
1144 vol->target_rfc1001_name[i] =
1145 value[i];
1146 }
1147 /* The string has 16th byte zero still from
1148 set at top of the function */
1149 if ((i == 15) && (value[i] != 0))
1150 printk(KERN_WARNING "CIFS: server net"
1151 "biosname longer than 15 truncated.\n");
1152 }
1153 } else if (strnicmp(data, "credentials", 4) == 0) {
1154 /* ignore */
1155 } else if (strnicmp(data, "version", 3) == 0) {
1156 /* ignore */
1157 } else if (strnicmp(data, "guest", 5) == 0) {
1158 /* ignore */
1159 } else if (strnicmp(data, "rw", 2) == 0) {
1160 vol->rw = TRUE;
1161 } else if ((strnicmp(data, "suid", 4) == 0) ||
1162 (strnicmp(data, "nosuid", 6) == 0) ||
1163 (strnicmp(data, "exec", 4) == 0) ||
1164 (strnicmp(data, "noexec", 6) == 0) ||
1165 (strnicmp(data, "nodev", 5) == 0) ||
1166 (strnicmp(data, "noauto", 6) == 0) ||
1167 (strnicmp(data, "dev", 3) == 0)) {
1168 /* The mount tool or mount.cifs helper (if present)
1169 uses these opts to set flags, and the flags are read
1170 by the kernel vfs layer before we get here (ie
1171 before read super) so there is no point trying to
1172 parse these options again and set anything and it
1173 is ok to just ignore them */
1174 continue;
1175 } else if (strnicmp(data, "ro", 2) == 0) {
1176 vol->rw = FALSE;
1177 } else if (strnicmp(data, "hard", 4) == 0) {
1178 vol->retry = 1;
1179 } else if (strnicmp(data, "soft", 4) == 0) {
1180 vol->retry = 0;
1181 } else if (strnicmp(data, "perm", 4) == 0) {
1182 vol->noperm = 0;
1183 } else if (strnicmp(data, "noperm", 6) == 0) {
1184 vol->noperm = 1;
1185 } else if (strnicmp(data, "mapchars", 8) == 0) {
1186 vol->remap = 1;
1187 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1188 vol->remap = 0;
1189 } else if (strnicmp(data, "sfu", 3) == 0) {
1190 vol->sfu_emul = 1;
1191 } else if (strnicmp(data, "nosfu", 5) == 0) {
1192 vol->sfu_emul = 0;
1193 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1194 vol->posix_paths = 1;
1195 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1196 vol->posix_paths = 0;
1197 } else if (strnicmp(data, "nounix", 6) == 0) {
1198 vol->no_linux_ext = 1;
1199 } else if (strnicmp(data, "nolinux", 7) == 0) {
1200 vol->no_linux_ext = 1;
1201 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1202 (strnicmp(data, "ignorecase", 10) == 0)) {
1203 vol->nocase = 1;
1204 } else if (strnicmp(data, "brl", 3) == 0) {
1205 vol->nobrl = 0;
1206 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1207 (strnicmp(data, "nolock", 6) == 0)) {
1208 vol->nobrl = 1;
1209 /* turn off mandatory locking in mode
1210 if remote locking is turned off since the
1211 local vfs will do advisory */
1212 if (vol->file_mode ==
1213 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1214 vol->file_mode = S_IALLUGO;
1215 } else if (strnicmp(data, "setuids", 7) == 0) {
1216 vol->setuids = 1;
1217 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1218 vol->setuids = 0;
1219 } else if (strnicmp(data, "nohard", 6) == 0) {
1220 vol->retry = 0;
1221 } else if (strnicmp(data, "nosoft", 6) == 0) {
1222 vol->retry = 1;
1223 } else if (strnicmp(data, "nointr", 6) == 0) {
1224 vol->intr = 0;
1225 } else if (strnicmp(data, "intr", 4) == 0) {
1226 vol->intr = 1;
1227 } else if (strnicmp(data, "serverino", 7) == 0) {
1228 vol->server_ino = 1;
1229 } else if (strnicmp(data, "noserverino", 9) == 0) {
1230 vol->server_ino = 0;
1231 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1232 vol->cifs_acl = 1;
1233 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1234 vol->cifs_acl = 0;
1235 } else if (strnicmp(data, "acl", 3) == 0) {
1236 vol->no_psx_acl = 0;
1237 } else if (strnicmp(data, "noacl", 5) == 0) {
1238 vol->no_psx_acl = 1;
1239 } else if (strnicmp(data, "sign", 4) == 0) {
1240 vol->secFlg |= CIFSSEC_MUST_SIGN;
1241 /* } else if (strnicmp(data, "seal",4) == 0) {
1242 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1243 } else if (strnicmp(data, "direct", 6) == 0) {
1244 vol->direct_io = 1;
1245 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1246 vol->direct_io = 1;
1247 } else if (strnicmp(data, "in6_addr", 8) == 0) {
1248 if (!value || !*value) {
1249 vol->in6_addr = NULL;
1250 } else if (strnlen(value, 49) == 48) {
1251 vol->in6_addr = value;
1252 } else {
1253 printk(KERN_WARNING "CIFS: ip v6 address not "
1254 "48 characters long\n");
1255 return 1;
1256 }
1257 } else if (strnicmp(data, "noac", 4) == 0) {
1258 printk(KERN_WARNING "CIFS: Mount option noac not "
1259 "supported. Instead set "
1260 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1261 } else
1262 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1263 data);
1264 }
1265 if (vol->UNC == NULL) {
1266 if (devname == NULL) {
1267 printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1268 "target\n");
1269 return 1;
1270 }
1271 if ((temp_len = strnlen(devname, 300)) < 300) {
1272 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1273 if (vol->UNC == NULL)
1274 return 1;
1275 strcpy(vol->UNC, devname);
1276 if (strncmp(vol->UNC, "//", 2) == 0) {
1277 vol->UNC[0] = '\\';
1278 vol->UNC[1] = '\\';
1279 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1280 printk(KERN_WARNING "CIFS: UNC Path does not "
1281 "begin with // or \\\\ \n");
1282 return 1;
1283 }
1284 } else {
1285 printk(KERN_WARNING "CIFS: UNC name too long\n");
1286 return 1;
1287 }
1288 }
1289 if (vol->UNCip == NULL)
1290 vol->UNCip = &vol->UNC[2];
1291
1292 return 0;
1293 }
1294
1295 static struct cifsSesInfo *
1296 cifs_find_tcp_session(struct in_addr *target_ip_addr,
1297 struct in6_addr *target_ip6_addr,
1298 char *userName, struct TCP_Server_Info **psrvTcp)
1299 {
1300 struct list_head *tmp;
1301 struct cifsSesInfo *ses;
1302 *psrvTcp = NULL;
1303 read_lock(&GlobalSMBSeslock);
1304
1305 list_for_each(tmp, &GlobalSMBSessionList) {
1306 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1307 if (ses->server) {
1308 if ((target_ip_addr &&
1309 (ses->server->addr.sockAddr.sin_addr.s_addr
1310 == target_ip_addr->s_addr)) || (target_ip6_addr
1311 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1312 target_ip6_addr, sizeof(*target_ip6_addr)))) {
1313 /* BB lock server and tcp session and increment
1314 use count here?? */
1315
1316 /* found a match on the TCP session */
1317 *psrvTcp = ses->server;
1318
1319 /* BB check if reconnection needed */
1320 if (strncmp
1321 (ses->userName, userName,
1322 MAX_USERNAME_SIZE) == 0){
1323 read_unlock(&GlobalSMBSeslock);
1324 /* Found exact match on both TCP and
1325 SMB sessions */
1326 return ses;
1327 }
1328 }
1329 }
1330 /* else tcp and smb sessions need reconnection */
1331 }
1332 read_unlock(&GlobalSMBSeslock);
1333 return NULL;
1334 }
1335
1336 static struct cifsTconInfo *
1337 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1338 {
1339 struct list_head *tmp;
1340 struct cifsTconInfo *tcon;
1341
1342 read_lock(&GlobalSMBSeslock);
1343 list_for_each(tmp, &GlobalTreeConnectionList) {
1344 cFYI(1, ("Next tcon"));
1345 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1346 if (tcon->ses) {
1347 if (tcon->ses->server) {
1348 cFYI(1,
1349 ("old ip addr: %x == new ip %x ?",
1350 tcon->ses->server->addr.sockAddr.sin_addr.
1351 s_addr, new_target_ip_addr));
1352 if (tcon->ses->server->addr.sockAddr.sin_addr.
1353 s_addr == new_target_ip_addr) {
1354 /* BB lock tcon, server and tcp session and increment use count here? */
1355 /* found a match on the TCP session */
1356 /* BB check if reconnection needed */
1357 cFYI(1,
1358 ("IP match, old UNC: %s new: %s",
1359 tcon->treeName, uncName));
1360 if (strncmp
1361 (tcon->treeName, uncName,
1362 MAX_TREE_SIZE) == 0) {
1363 cFYI(1,
1364 ("and old usr: %s new: %s",
1365 tcon->treeName, uncName));
1366 if (strncmp
1367 (tcon->ses->userName,
1368 userName,
1369 MAX_USERNAME_SIZE) == 0) {
1370 read_unlock(&GlobalSMBSeslock);
1371 /* matched smb session
1372 (user name */
1373 return tcon;
1374 }
1375 }
1376 }
1377 }
1378 }
1379 }
1380 read_unlock(&GlobalSMBSeslock);
1381 return NULL;
1382 }
1383
1384 int
1385 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1386 const char *old_path, const struct nls_table *nls_codepage,
1387 int remap)
1388 {
1389 unsigned char *referrals = NULL;
1390 unsigned int num_referrals;
1391 int rc = 0;
1392
1393 rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
1394 &num_referrals, &referrals, remap);
1395
1396 /* BB Add in code to: if valid refrl, if not ip address contact
1397 the helper that resolves tcp names, mount to it, try to
1398 tcon to it unmount it if fail */
1399
1400 kfree(referrals);
1401
1402 return rc;
1403 }
1404
1405 int
1406 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
1407 const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
1408 unsigned char **preferrals, int remap)
1409 {
1410 char *temp_unc;
1411 int rc = 0;
1412
1413 *pnum_referrals = 0;
1414
1415 if (pSesInfo->ipc_tid == 0) {
1416 temp_unc = kmalloc(2 /* for slashes */ +
1417 strnlen(pSesInfo->serverName,
1418 SERVER_NAME_LEN_WITH_NULL * 2)
1419 + 1 + 4 /* slash IPC$ */ + 2,
1420 GFP_KERNEL);
1421 if (temp_unc == NULL)
1422 return -ENOMEM;
1423 temp_unc[0] = '\\';
1424 temp_unc[1] = '\\';
1425 strcpy(temp_unc + 2, pSesInfo->serverName);
1426 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1427 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1428 cFYI(1,
1429 ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
1430 kfree(temp_unc);
1431 }
1432 if (rc == 0)
1433 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1434 pnum_referrals, nls_codepage, remap);
1435
1436 return rc;
1437 }
1438
1439 /* See RFC1001 section 14 on representation of Netbios names */
1440 static void rfc1002mangle(char *target, char *source, unsigned int length)
1441 {
1442 unsigned int i, j;
1443
1444 for (i = 0, j = 0; i < (length); i++) {
1445 /* mask a nibble at a time and encode */
1446 target[j] = 'A' + (0x0F & (source[i] >> 4));
1447 target[j+1] = 'A' + (0x0F & source[i]);
1448 j += 2;
1449 }
1450
1451 }
1452
1453
1454 static int
1455 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1456 char *netbios_name, char *target_name)
1457 {
1458 int rc = 0;
1459 int connected = 0;
1460 __be16 orig_port = 0;
1461
1462 if (*csocket == NULL) {
1463 rc = sock_create_kern(PF_INET, SOCK_STREAM,
1464 IPPROTO_TCP, csocket);
1465 if (rc < 0) {
1466 cERROR(1, ("Error %d creating socket", rc));
1467 *csocket = NULL;
1468 return rc;
1469 } else {
1470 /* BB other socket options to set KEEPALIVE, NODELAY? */
1471 cFYI(1, ("Socket created"));
1472 (*csocket)->sk->sk_allocation = GFP_NOFS;
1473 }
1474 }
1475
1476 psin_server->sin_family = AF_INET;
1477 if (psin_server->sin_port) { /* user overrode default port */
1478 rc = (*csocket)->ops->connect(*csocket,
1479 (struct sockaddr *) psin_server,
1480 sizeof (struct sockaddr_in), 0);
1481 if (rc >= 0)
1482 connected = 1;
1483 }
1484
1485 if (!connected) {
1486 /* save original port so we can retry user specified port
1487 later if fall back ports fail this time */
1488 orig_port = psin_server->sin_port;
1489
1490 /* do not retry on the same port we just failed on */
1491 if (psin_server->sin_port != htons(CIFS_PORT)) {
1492 psin_server->sin_port = htons(CIFS_PORT);
1493
1494 rc = (*csocket)->ops->connect(*csocket,
1495 (struct sockaddr *) psin_server,
1496 sizeof (struct sockaddr_in), 0);
1497 if (rc >= 0)
1498 connected = 1;
1499 }
1500 }
1501 if (!connected) {
1502 psin_server->sin_port = htons(RFC1001_PORT);
1503 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1504 psin_server,
1505 sizeof (struct sockaddr_in), 0);
1506 if (rc >= 0)
1507 connected = 1;
1508 }
1509
1510 /* give up here - unless we want to retry on different
1511 protocol families some day */
1512 if (!connected) {
1513 if (orig_port)
1514 psin_server->sin_port = orig_port;
1515 cFYI(1, ("Error %d connecting to server via ipv4", rc));
1516 sock_release(*csocket);
1517 *csocket = NULL;
1518 return rc;
1519 }
1520 /* Eventually check for other socket options to change from
1521 the default. sock_setsockopt not used because it expects
1522 user space buffer */
1523 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
1524 (*csocket)->sk->sk_sndbuf,
1525 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1526 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1527 /* make the bufsizes depend on wsize/rsize and max requests */
1528 if ((*csocket)->sk->sk_sndbuf < (200 * 1024))
1529 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1530 if ((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1531 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1532
1533 /* send RFC1001 sessinit */
1534 if (psin_server->sin_port == htons(RFC1001_PORT)) {
1535 /* some servers require RFC1001 sessinit before sending
1536 negprot - BB check reconnection in case where second
1537 sessinit is sent but no second negprot */
1538 struct rfc1002_session_packet *ses_init_buf;
1539 struct smb_hdr *smb_buf;
1540 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
1541 GFP_KERNEL);
1542 if (ses_init_buf) {
1543 ses_init_buf->trailer.session_req.called_len = 32;
1544 if (target_name && (target_name[0] != 0)) {
1545 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1546 target_name, 16);
1547 } else {
1548 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1549 DEFAULT_CIFS_CALLED_NAME, 16);
1550 }
1551
1552 ses_init_buf->trailer.session_req.calling_len = 32;
1553 /* calling name ends in null (byte 16) from old smb
1554 convention. */
1555 if (netbios_name && (netbios_name[0] != 0)) {
1556 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1557 netbios_name, 16);
1558 } else {
1559 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1560 "LINUX_CIFS_CLNT", 16);
1561 }
1562 ses_init_buf->trailer.session_req.scope1 = 0;
1563 ses_init_buf->trailer.session_req.scope2 = 0;
1564 smb_buf = (struct smb_hdr *)ses_init_buf;
1565 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1566 smb_buf->smb_buf_length = 0x81000044;
1567 rc = smb_send(*csocket, smb_buf, 0x44,
1568 (struct sockaddr *)psin_server);
1569 kfree(ses_init_buf);
1570 msleep(1); /* RFC1001 layer in at least one server
1571 requires very short break before negprot
1572 presumably because not expecting negprot
1573 to follow so fast. This is a simple
1574 solution that works without
1575 complicating the code and causes no
1576 significant slowing down on mount
1577 for everyone else */
1578 }
1579 /* else the negprot may still work without this
1580 even though malloc failed */
1581
1582 }
1583
1584 return rc;
1585 }
1586
1587 static int
1588 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1589 {
1590 int rc = 0;
1591 int connected = 0;
1592 __be16 orig_port = 0;
1593
1594 if (*csocket == NULL) {
1595 rc = sock_create_kern(PF_INET6, SOCK_STREAM,
1596 IPPROTO_TCP, csocket);
1597 if (rc < 0) {
1598 cERROR(1, ("Error %d creating ipv6 socket", rc));
1599 *csocket = NULL;
1600 return rc;
1601 } else {
1602 /* BB other socket options to set KEEPALIVE, NODELAY? */
1603 cFYI(1, ("ipv6 Socket created"));
1604 (*csocket)->sk->sk_allocation = GFP_NOFS;
1605 }
1606 }
1607
1608 psin_server->sin6_family = AF_INET6;
1609
1610 if (psin_server->sin6_port) { /* user overrode default port */
1611 rc = (*csocket)->ops->connect(*csocket,
1612 (struct sockaddr *) psin_server,
1613 sizeof (struct sockaddr_in6), 0);
1614 if (rc >= 0)
1615 connected = 1;
1616 }
1617
1618 if (!connected) {
1619 /* save original port so we can retry user specified port
1620 later if fall back ports fail this time */
1621
1622 orig_port = psin_server->sin6_port;
1623 /* do not retry on the same port we just failed on */
1624 if (psin_server->sin6_port != htons(CIFS_PORT)) {
1625 psin_server->sin6_port = htons(CIFS_PORT);
1626
1627 rc = (*csocket)->ops->connect(*csocket,
1628 (struct sockaddr *) psin_server,
1629 sizeof (struct sockaddr_in6), 0);
1630 if (rc >= 0)
1631 connected = 1;
1632 }
1633 }
1634 if (!connected) {
1635 psin_server->sin6_port = htons(RFC1001_PORT);
1636 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1637 psin_server, sizeof (struct sockaddr_in6), 0);
1638 if (rc >= 0)
1639 connected = 1;
1640 }
1641
1642 /* give up here - unless we want to retry on different
1643 protocol families some day */
1644 if (!connected) {
1645 if (orig_port)
1646 psin_server->sin6_port = orig_port;
1647 cFYI(1, ("Error %d connecting to server via ipv6", rc));
1648 sock_release(*csocket);
1649 *csocket = NULL;
1650 return rc;
1651 }
1652 /* Eventually check for other socket options to change from
1653 the default. sock_setsockopt not used because it expects
1654 user space buffer */
1655 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1656
1657 return rc;
1658 }
1659
1660 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
1661 struct super_block *sb, struct smb_vol *vol_info)
1662 {
1663 /* if we are reconnecting then should we check to see if
1664 * any requested capabilities changed locally e.g. via
1665 * remount but we can not do much about it here
1666 * if they have (even if we could detect it by the following)
1667 * Perhaps we could add a backpointer to array of sb from tcon
1668 * or if we change to make all sb to same share the same
1669 * sb as NFS - then we only have one backpointer to sb.
1670 * What if we wanted to mount the server share twice once with
1671 * and once without posixacls or posix paths? */
1672 __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1673
1674 if (vol_info && vol_info->no_linux_ext) {
1675 tcon->fsUnixInfo.Capability = 0;
1676 tcon->unix_ext = 0; /* Unix Extensions disabled */
1677 cFYI(1, ("Linux protocol extensions disabled"));
1678 return;
1679 } else if (vol_info)
1680 tcon->unix_ext = 1; /* Unix Extensions supported */
1681
1682 if (tcon->unix_ext == 0) {
1683 cFYI(1, ("Unix extensions disabled so not set on reconnect"));
1684 return;
1685 }
1686
1687 if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1688 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1689
1690 /* check for reconnect case in which we do not
1691 want to change the mount behavior if we can avoid it */
1692 if (vol_info == NULL) {
1693 /* turn off POSIX ACL and PATHNAMES if not set
1694 originally at mount time */
1695 if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1696 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1697 if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1698 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1699 }
1700
1701 cap &= CIFS_UNIX_CAP_MASK;
1702 if (vol_info && vol_info->no_psx_acl)
1703 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1704 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
1705 cFYI(1, ("negotiated posix acl support"));
1706 if (sb)
1707 sb->s_flags |= MS_POSIXACL;
1708 }
1709
1710 if (vol_info && vol_info->posix_paths == 0)
1711 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1712 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1713 cFYI(1, ("negotiate posix pathnames"));
1714 if (sb)
1715 CIFS_SB(sb)->mnt_cifs_flags |=
1716 CIFS_MOUNT_POSIX_PATHS;
1717 }
1718
1719 /* We might be setting the path sep back to a different
1720 form if we are reconnecting and the server switched its
1721 posix path capability for this share */
1722 if (sb && (CIFS_SB(sb)->prepathlen > 0))
1723 CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1724
1725 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
1726 if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
1727 CIFS_SB(sb)->rsize = 127 * 1024;
1728 #ifdef CONFIG_CIFS_DEBUG2
1729 cFYI(1, ("larger reads not supported by srv"));
1730 #endif
1731 }
1732 }
1733
1734
1735 cFYI(1, ("Negotiate caps 0x%x", (int)cap));
1736 #ifdef CONFIG_CIFS_DEBUG2
1737 if (cap & CIFS_UNIX_FCNTL_CAP)
1738 cFYI(1, ("FCNTL cap"));
1739 if (cap & CIFS_UNIX_EXTATTR_CAP)
1740 cFYI(1, ("EXTATTR cap"));
1741 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1742 cFYI(1, ("POSIX path cap"));
1743 if (cap & CIFS_UNIX_XATTR_CAP)
1744 cFYI(1, ("XATTR cap"));
1745 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
1746 cFYI(1, ("POSIX ACL cap"));
1747 if (cap & CIFS_UNIX_LARGE_READ_CAP)
1748 cFYI(1, ("very large read cap"));
1749 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
1750 cFYI(1, ("very large write cap"));
1751 #endif /* CIFS_DEBUG2 */
1752 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1753 cFYI(1, ("setting capabilities failed"));
1754 }
1755 }
1756 }
1757
1758 int
1759 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1760 char *mount_data, const char *devname)
1761 {
1762 int rc = 0;
1763 int xid;
1764 int address_type = AF_INET;
1765 struct socket *csocket = NULL;
1766 struct sockaddr_in sin_server;
1767 struct sockaddr_in6 sin_server6;
1768 struct smb_vol volume_info;
1769 struct cifsSesInfo *pSesInfo = NULL;
1770 struct cifsSesInfo *existingCifsSes = NULL;
1771 struct cifsTconInfo *tcon = NULL;
1772 struct TCP_Server_Info *srvTcp = NULL;
1773
1774 xid = GetXid();
1775
1776 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1777
1778 memset(&volume_info, 0, sizeof(struct smb_vol));
1779 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1780 kfree(volume_info.UNC);
1781 kfree(volume_info.password);
1782 kfree(volume_info.prepath);
1783 FreeXid(xid);
1784 return -EINVAL;
1785 }
1786
1787 if (volume_info.nullauth) {
1788 cFYI(1, ("null user"));
1789 volume_info.username = NULL;
1790 } else if (volume_info.username) {
1791 /* BB fixme parse for domain name here */
1792 cFYI(1, ("Username: %s", volume_info.username));
1793 } else {
1794 cifserror("No username specified");
1795 /* In userspace mount helper we can get user name from alternate
1796 locations such as env variables and files on disk */
1797 kfree(volume_info.UNC);
1798 kfree(volume_info.password);
1799 kfree(volume_info.prepath);
1800 FreeXid(xid);
1801 return -EINVAL;
1802 }
1803
1804 if (volume_info.UNCip && volume_info.UNC) {
1805 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
1806 &sin_server.sin_addr.s_addr);
1807
1808 if (rc <= 0) {
1809 /* not ipv4 address, try ipv6 */
1810 rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
1811 &sin_server6.sin6_addr.in6_u);
1812 if (rc > 0)
1813 address_type = AF_INET6;
1814 } else {
1815 address_type = AF_INET;
1816 }
1817
1818 if (rc <= 0) {
1819 /* we failed translating address */
1820 kfree(volume_info.UNC);
1821 kfree(volume_info.password);
1822 kfree(volume_info.prepath);
1823 FreeXid(xid);
1824 return -EINVAL;
1825 }
1826
1827 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1828 /* success */
1829 rc = 0;
1830 } else if (volume_info.UNCip) {
1831 /* BB using ip addr as server name to connect to the
1832 DFS root below */
1833 cERROR(1, ("Connecting to DFS root not implemented yet"));
1834 kfree(volume_info.UNC);
1835 kfree(volume_info.password);
1836 kfree(volume_info.prepath);
1837 FreeXid(xid);
1838 return -EINVAL;
1839 } else /* which servers DFS root would we conect to */ {
1840 cERROR(1,
1841 ("CIFS mount error: No UNC path (e.g. -o "
1842 "unc=//192.168.1.100/public) specified"));
1843 kfree(volume_info.UNC);
1844 kfree(volume_info.password);
1845 kfree(volume_info.prepath);
1846 FreeXid(xid);
1847 return -EINVAL;
1848 }
1849
1850 /* this is needed for ASCII cp to Unicode converts */
1851 if (volume_info.iocharset == NULL) {
1852 cifs_sb->local_nls = load_nls_default();
1853 /* load_nls_default can not return null */
1854 } else {
1855 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1856 if (cifs_sb->local_nls == NULL) {
1857 cERROR(1, ("CIFS mount error: iocharset %s not found",
1858 volume_info.iocharset));
1859 kfree(volume_info.UNC);
1860 kfree(volume_info.password);
1861 kfree(volume_info.prepath);
1862 FreeXid(xid);
1863 return -ELIBACC;
1864 }
1865 }
1866
1867 if (address_type == AF_INET)
1868 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1869 NULL /* no ipv6 addr */,
1870 volume_info.username, &srvTcp);
1871 else if (address_type == AF_INET6) {
1872 cFYI(1, ("looking for ipv6 address"));
1873 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1874 &sin_server6.sin6_addr,
1875 volume_info.username, &srvTcp);
1876 } else {
1877 kfree(volume_info.UNC);
1878 kfree(volume_info.password);
1879 kfree(volume_info.prepath);
1880 FreeXid(xid);
1881 return -EINVAL;
1882 }
1883
1884 if (srvTcp) {
1885 cFYI(1, ("Existing tcp session with server found"));
1886 } else { /* create socket */
1887 if (volume_info.port)
1888 sin_server.sin_port = htons(volume_info.port);
1889 else
1890 sin_server.sin_port = 0;
1891 if (address_type == AF_INET6) {
1892 cFYI(1, ("attempting ipv6 connect"));
1893 /* BB should we allow ipv6 on port 139? */
1894 /* other OS never observed in Wild doing 139 with v6 */
1895 rc = ipv6_connect(&sin_server6, &csocket);
1896 } else
1897 rc = ipv4_connect(&sin_server, &csocket,
1898 volume_info.source_rfc1001_name,
1899 volume_info.target_rfc1001_name);
1900 if (rc < 0) {
1901 cERROR(1, ("Error connecting to IPv4 socket. "
1902 "Aborting operation"));
1903 if (csocket != NULL)
1904 sock_release(csocket);
1905 kfree(volume_info.UNC);
1906 kfree(volume_info.password);
1907 kfree(volume_info.prepath);
1908 FreeXid(xid);
1909 return rc;
1910 }
1911
1912 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1913 if (srvTcp == NULL) {
1914 rc = -ENOMEM;
1915 sock_release(csocket);
1916 kfree(volume_info.UNC);
1917 kfree(volume_info.password);
1918 kfree(volume_info.prepath);
1919 FreeXid(xid);
1920 return rc;
1921 } else {
1922 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1923 memcpy(&srvTcp->addr.sockAddr, &sin_server,
1924 sizeof (struct sockaddr_in));
1925 atomic_set(&srvTcp->inFlight, 0);
1926 /* BB Add code for ipv6 case too */
1927 srvTcp->ssocket = csocket;
1928 srvTcp->protocolType = IPV4;
1929 init_waitqueue_head(&srvTcp->response_q);
1930 init_waitqueue_head(&srvTcp->request_q);
1931 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1932 /* at this point we are the only ones with the pointer
1933 to the struct since the kernel thread not created yet
1934 so no need to spinlock this init of tcpStatus */
1935 srvTcp->tcpStatus = CifsNew;
1936 init_MUTEX(&srvTcp->tcpSem);
1937 srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1938 if ( IS_ERR(srvTcp->tsk) ) {
1939 rc = PTR_ERR(srvTcp->tsk);
1940 cERROR(1, ("error %d create cifsd thread", rc));
1941 srvTcp->tsk = NULL;
1942 sock_release(csocket);
1943 kfree(volume_info.UNC);
1944 kfree(volume_info.password);
1945 kfree(volume_info.prepath);
1946 FreeXid(xid);
1947 return rc;
1948 }
1949 wait_for_completion(&cifsd_complete);
1950 rc = 0;
1951 memcpy(srvTcp->workstation_RFC1001_name,
1952 volume_info.source_rfc1001_name, 16);
1953 memcpy(srvTcp->server_RFC1001_name,
1954 volume_info.target_rfc1001_name, 16);
1955 srvTcp->sequence_number = 0;
1956 }
1957 }
1958
1959 if (existingCifsSes) {
1960 pSesInfo = existingCifsSes;
1961 cFYI(1, ("Existing smb sess found"));
1962 kfree(volume_info.password);
1963 /* volume_info.UNC freed at end of function */
1964 } else if (!rc) {
1965 cFYI(1, ("Existing smb sess not found"));
1966 pSesInfo = sesInfoAlloc();
1967 if (pSesInfo == NULL)
1968 rc = -ENOMEM;
1969 else {
1970 pSesInfo->server = srvTcp;
1971 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1972 NIPQUAD(sin_server.sin_addr.s_addr));
1973 }
1974
1975 if (!rc) {
1976 /* volume_info.password freed at unmount */
1977 if (volume_info.password)
1978 pSesInfo->password = volume_info.password;
1979 if (volume_info.username)
1980 strncpy(pSesInfo->userName,
1981 volume_info.username,
1982 MAX_USERNAME_SIZE);
1983 if (volume_info.domainname) {
1984 int len = strlen(volume_info.domainname);
1985 pSesInfo->domainName =
1986 kmalloc(len + 1, GFP_KERNEL);
1987 if (pSesInfo->domainName)
1988 strcpy(pSesInfo->domainName,
1989 volume_info.domainname);
1990 }
1991 pSesInfo->linux_uid = volume_info.linux_uid;
1992 pSesInfo->overrideSecFlg = volume_info.secFlg;
1993 down(&pSesInfo->sesSem);
1994 /* BB FIXME need to pass vol->secFlgs BB */
1995 rc = cifs_setup_session(xid, pSesInfo,
1996 cifs_sb->local_nls);
1997 up(&pSesInfo->sesSem);
1998 if (!rc)
1999 atomic_inc(&srvTcp->socketUseCount);
2000 } else
2001 kfree(volume_info.password);
2002 }
2003
2004 /* search for existing tcon to this server share */
2005 if (!rc) {
2006 if (volume_info.rsize > CIFSMaxBufSize) {
2007 cERROR(1, ("rsize %d too large, using MaxBufSize",
2008 volume_info.rsize));
2009 cifs_sb->rsize = CIFSMaxBufSize;
2010 } else if ((volume_info.rsize) &&
2011 (volume_info.rsize <= CIFSMaxBufSize))
2012 cifs_sb->rsize = volume_info.rsize;
2013 else /* default */
2014 cifs_sb->rsize = CIFSMaxBufSize;
2015
2016 if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2017 cERROR(1, ("wsize %d too large, using 4096 instead",
2018 volume_info.wsize));
2019 cifs_sb->wsize = 4096;
2020 } else if (volume_info.wsize)
2021 cifs_sb->wsize = volume_info.wsize;
2022 else
2023 cifs_sb->wsize =
2024 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2025 127*1024);
2026 /* old default of CIFSMaxBufSize was too small now
2027 that SMB Write2 can send multiple pages in kvec.
2028 RFC1001 does not describe what happens when frame
2029 bigger than 128K is sent so use that as max in
2030 conjunction with 52K kvec constraint on arch with 4K
2031 page size */
2032
2033 if (cifs_sb->rsize < 2048) {
2034 cifs_sb->rsize = 2048;
2035 /* Windows ME may prefer this */
2036 cFYI(1, ("readsize set to minimum: 2048"));
2037 }
2038 /* calculate prepath */
2039 cifs_sb->prepath = volume_info.prepath;
2040 if (cifs_sb->prepath) {
2041 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2042 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
2043 volume_info.prepath = NULL;
2044 } else
2045 cifs_sb->prepathlen = 0;
2046 cifs_sb->mnt_uid = volume_info.linux_uid;
2047 cifs_sb->mnt_gid = volume_info.linux_gid;
2048 cifs_sb->mnt_file_mode = volume_info.file_mode;
2049 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
2050 cFYI(1, ("file mode: 0x%x dir mode: 0x%x",
2051 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
2052
2053 if (volume_info.noperm)
2054 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2055 if (volume_info.setuids)
2056 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2057 if (volume_info.server_ino)
2058 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2059 if (volume_info.remap)
2060 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2061 if (volume_info.no_xattr)
2062 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2063 if (volume_info.sfu_emul)
2064 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2065 if (volume_info.nobrl)
2066 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2067 if (volume_info.cifs_acl)
2068 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2069 if (volume_info.override_uid)
2070 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2071 if (volume_info.override_gid)
2072 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2073 if (volume_info.direct_io) {
2074 cFYI(1, ("mounting share using direct i/o"));
2075 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2076 }
2077
2078 tcon =
2079 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
2080 volume_info.username);
2081 if (tcon) {
2082 cFYI(1, ("Found match on UNC path"));
2083 /* we can have only one retry value for a connection
2084 to a share so for resources mounted more than once
2085 to the same server share the last value passed in
2086 for the retry flag is used */
2087 tcon->retry = volume_info.retry;
2088 tcon->nocase = volume_info.nocase;
2089 } else {
2090 tcon = tconInfoAlloc();
2091 if (tcon == NULL)
2092 rc = -ENOMEM;
2093 else {
2094 /* check for null share name ie connecting to
2095 * dfs root */
2096
2097 /* BB check if this works for exactly length
2098 * three strings */
2099 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2100 && (strchr(volume_info.UNC + 3, '/') ==
2101 NULL)) {
2102 rc = connect_to_dfs_path(xid, pSesInfo,
2103 "", cifs_sb->local_nls,
2104 cifs_sb->mnt_cifs_flags &
2105 CIFS_MOUNT_MAP_SPECIAL_CHR);
2106 kfree(volume_info.UNC);
2107 FreeXid(xid);
2108 return -ENODEV;
2109 } else {
2110 /* BB Do we need to wrap sesSem around
2111 * this TCon call and Unix SetFS as
2112 * we do on SessSetup and reconnect? */
2113 rc = CIFSTCon(xid, pSesInfo,
2114 volume_info.UNC,
2115 tcon, cifs_sb->local_nls);
2116 cFYI(1, ("CIFS Tcon rc = %d", rc));
2117 }
2118 if (!rc) {
2119 atomic_inc(&pSesInfo->inUse);
2120 tcon->retry = volume_info.retry;
2121 tcon->nocase = volume_info.nocase;
2122 }
2123 }
2124 }
2125 }
2126 if (pSesInfo) {
2127 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2128 sb->s_maxbytes = (u64) 1 << 63;
2129 } else
2130 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2131 }
2132
2133 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2134 sb->s_time_gran = 100;
2135
2136 /* on error free sesinfo and tcon struct if needed */
2137 if (rc) {
2138 /* if session setup failed, use count is zero but
2139 we still need to free cifsd thread */
2140 if (atomic_read(&srvTcp->socketUseCount) == 0) {
2141 spin_lock(&GlobalMid_Lock);
2142 srvTcp->tcpStatus = CifsExiting;
2143 spin_unlock(&GlobalMid_Lock);
2144 if (srvTcp->tsk) {
2145 struct task_struct *tsk;
2146 /* If we could verify that kthread_stop would
2147 always wake up processes blocked in
2148 tcp in recv_mesg then we could remove the
2149 send_sig call */
2150 force_sig(SIGKILL, srvTcp->tsk);
2151 tsk = srvTcp->tsk;
2152 if (tsk)
2153 kthread_stop(tsk);
2154 }
2155 }
2156 /* If find_unc succeeded then rc == 0 so we can not end */
2157 if (tcon) /* up accidently freeing someone elses tcon struct */
2158 tconInfoFree(tcon);
2159 if (existingCifsSes == NULL) {
2160 if (pSesInfo) {
2161 if ((pSesInfo->server) &&
2162 (pSesInfo->status == CifsGood)) {
2163 int temp_rc;
2164 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2165 /* if the socketUseCount is now zero */
2166 if ((temp_rc == -ESHUTDOWN) &&
2167 (pSesInfo->server) &&
2168 (pSesInfo->server->tsk)) {
2169 struct task_struct *tsk;
2170 force_sig(SIGKILL,
2171 pSesInfo->server->tsk);
2172 tsk = pSesInfo->server->tsk;
2173 if (tsk)
2174 kthread_stop(tsk);
2175 }
2176 } else
2177 cFYI(1, ("No session or bad tcon"));
2178 sesInfoFree(pSesInfo);
2179 /* pSesInfo = NULL; */
2180 }
2181 }
2182 } else {
2183 atomic_inc(&tcon->useCount);
2184 cifs_sb->tcon = tcon;
2185 tcon->ses = pSesInfo;
2186
2187 /* do not care if following two calls succeed - informational */
2188 CIFSSMBQFSDeviceInfo(xid, tcon);
2189 CIFSSMBQFSAttributeInfo(xid, tcon);
2190
2191 /* tell server which Unix caps we support */
2192 if (tcon->ses->capabilities & CAP_UNIX)
2193 /* reset of caps checks mount to see if unix extensions
2194 disabled for just this mount */
2195 reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2196 else
2197 tcon->unix_ext = 0; /* server does not support them */
2198
2199 if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2200 cifs_sb->rsize = 1024 * 127;
2201 #ifdef CONFIG_CIFS_DEBUG2
2202 cFYI(1, ("no very large read support, rsize now 127K"));
2203 #endif
2204 }
2205 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2206 cifs_sb->wsize = min(cifs_sb->wsize,
2207 (tcon->ses->server->maxBuf -
2208 MAX_CIFS_HDR_SIZE));
2209 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2210 cifs_sb->rsize = min(cifs_sb->rsize,
2211 (tcon->ses->server->maxBuf -
2212 MAX_CIFS_HDR_SIZE));
2213 }
2214
2215 /* volume_info.password is freed above when existing session found
2216 (in which case it is not needed anymore) but when new sesion is created
2217 the password ptr is put in the new session structure (in which case the
2218 password will be freed at unmount time) */
2219 kfree(volume_info.UNC);
2220 kfree(volume_info.prepath);
2221 FreeXid(xid);
2222 return rc;
2223 }
2224
2225 static int
2226 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2227 char session_key[CIFS_SESS_KEY_SIZE],
2228 const struct nls_table *nls_codepage)
2229 {
2230 struct smb_hdr *smb_buffer;
2231 struct smb_hdr *smb_buffer_response;
2232 SESSION_SETUP_ANDX *pSMB;
2233 SESSION_SETUP_ANDX *pSMBr;
2234 char *bcc_ptr;
2235 char *user;
2236 char *domain;
2237 int rc = 0;
2238 int remaining_words = 0;
2239 int bytes_returned = 0;
2240 int len;
2241 __u32 capabilities;
2242 __u16 count;
2243
2244 cFYI(1, ("In sesssetup"));
2245 if (ses == NULL)
2246 return -EINVAL;
2247 user = ses->userName;
2248 domain = ses->domainName;
2249 smb_buffer = cifs_buf_get();
2250 if (smb_buffer == NULL) {
2251 return -ENOMEM;
2252 }
2253 smb_buffer_response = smb_buffer;
2254 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2255
2256 /* send SMBsessionSetup here */
2257 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2258 NULL /* no tCon exists yet */ , 13 /* wct */ );
2259
2260 smb_buffer->Mid = GetNextMid(ses->server);
2261 pSMB->req_no_secext.AndXCommand = 0xFF;
2262 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2263 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2264
2265 if (ses->server->secMode &
2266 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2267 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2268
2269 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2270 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2271 if (ses->capabilities & CAP_UNICODE) {
2272 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2273 capabilities |= CAP_UNICODE;
2274 }
2275 if (ses->capabilities & CAP_STATUS32) {
2276 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2277 capabilities |= CAP_STATUS32;
2278 }
2279 if (ses->capabilities & CAP_DFS) {
2280 smb_buffer->Flags2 |= SMBFLG2_DFS;
2281 capabilities |= CAP_DFS;
2282 }
2283 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2284
2285 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2286 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2287
2288 pSMB->req_no_secext.CaseSensitivePasswordLength =
2289 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2290 bcc_ptr = pByteArea(smb_buffer);
2291 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2292 bcc_ptr += CIFS_SESS_KEY_SIZE;
2293 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2294 bcc_ptr += CIFS_SESS_KEY_SIZE;
2295
2296 if (ses->capabilities & CAP_UNICODE) {
2297 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2298 *bcc_ptr = 0;
2299 bcc_ptr++;
2300 }
2301 if (user == NULL)
2302 bytes_returned = 0; /* skip null user */
2303 else
2304 bytes_returned =
2305 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2306 nls_codepage);
2307 /* convert number of 16 bit words to bytes */
2308 bcc_ptr += 2 * bytes_returned;
2309 bcc_ptr += 2; /* trailing null */
2310 if (domain == NULL)
2311 bytes_returned =
2312 cifs_strtoUCS((__le16 *) bcc_ptr,
2313 "CIFS_LINUX_DOM", 32, nls_codepage);
2314 else
2315 bytes_returned =
2316 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2317 nls_codepage);
2318 bcc_ptr += 2 * bytes_returned;
2319 bcc_ptr += 2;
2320 bytes_returned =
2321 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2322 32, nls_codepage);
2323 bcc_ptr += 2 * bytes_returned;
2324 bytes_returned =
2325 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2326 32, nls_codepage);
2327 bcc_ptr += 2 * bytes_returned;
2328 bcc_ptr += 2;
2329 bytes_returned =
2330 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2331 64, nls_codepage);
2332 bcc_ptr += 2 * bytes_returned;
2333 bcc_ptr += 2;
2334 } else {
2335 if (user != NULL) {
2336 strncpy(bcc_ptr, user, 200);
2337 bcc_ptr += strnlen(user, 200);
2338 }
2339 *bcc_ptr = 0;
2340 bcc_ptr++;
2341 if (domain == NULL) {
2342 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2343 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2344 } else {
2345 strncpy(bcc_ptr, domain, 64);
2346 bcc_ptr += strnlen(domain, 64);
2347 *bcc_ptr = 0;
2348 bcc_ptr++;
2349 }
2350 strcpy(bcc_ptr, "Linux version ");
2351 bcc_ptr += strlen("Linux version ");
2352 strcpy(bcc_ptr, utsname()->release);
2353 bcc_ptr += strlen(utsname()->release) + 1;
2354 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2355 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2356 }
2357 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2358 smb_buffer->smb_buf_length += count;
2359 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2360
2361 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2362 &bytes_returned, 1);
2363 if (rc) {
2364 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2365 } else if ((smb_buffer_response->WordCount == 3)
2366 || (smb_buffer_response->WordCount == 4)) {
2367 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2368 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2369 if (action & GUEST_LOGIN)
2370 cFYI(1, (" Guest login")); /* BB mark SesInfo struct? */
2371 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
2372 (little endian) */
2373 cFYI(1, ("UID = %d ", ses->Suid));
2374 /* response can have either 3 or 4 word count - Samba sends 3 */
2375 bcc_ptr = pByteArea(smb_buffer_response);
2376 if ((pSMBr->resp.hdr.WordCount == 3)
2377 || ((pSMBr->resp.hdr.WordCount == 4)
2378 && (blob_len < pSMBr->resp.ByteCount))) {
2379 if (pSMBr->resp.hdr.WordCount == 4)
2380 bcc_ptr += blob_len;
2381
2382 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2383 if ((long) (bcc_ptr) % 2) {
2384 remaining_words =
2385 (BCC(smb_buffer_response) - 1) / 2;
2386 /* Unicode strings must be word
2387 aligned */
2388 bcc_ptr++;
2389 } else {
2390 remaining_words =
2391 BCC(smb_buffer_response) / 2;
2392 }
2393 len =
2394 UniStrnlen((wchar_t *) bcc_ptr,
2395 remaining_words - 1);
2396 /* We look for obvious messed up bcc or strings in response so we do not go off
2397 the end since (at least) WIN2K and Windows XP have a major bug in not null
2398 terminating last Unicode string in response */
2399 if (ses->serverOS)
2400 kfree(ses->serverOS);
2401 ses->serverOS = kzalloc(2 * (len + 1),
2402 GFP_KERNEL);
2403 if (ses->serverOS == NULL)
2404 goto sesssetup_nomem;
2405 cifs_strfromUCS_le(ses->serverOS,
2406 (__le16 *)bcc_ptr,
2407 len, nls_codepage);
2408 bcc_ptr += 2 * (len + 1);
2409 remaining_words -= len + 1;
2410 ses->serverOS[2 * len] = 0;
2411 ses->serverOS[1 + (2 * len)] = 0;
2412 if (remaining_words > 0) {
2413 len = UniStrnlen((wchar_t *)bcc_ptr,
2414 remaining_words-1);
2415 kfree(ses->serverNOS);
2416 ses->serverNOS = kzalloc(2 * (len + 1),
2417 GFP_KERNEL);
2418 if (ses->serverNOS == NULL)
2419 goto sesssetup_nomem;
2420 cifs_strfromUCS_le(ses->serverNOS,
2421 (__le16 *)bcc_ptr,
2422 len, nls_codepage);
2423 bcc_ptr += 2 * (len + 1);
2424 ses->serverNOS[2 * len] = 0;
2425 ses->serverNOS[1 + (2 * len)] = 0;
2426 if (strncmp(ses->serverNOS,
2427 "NT LAN Manager 4", 16) == 0) {
2428 cFYI(1, ("NT4 server"));
2429 ses->flags |= CIFS_SES_NT4;
2430 }
2431 remaining_words -= len + 1;
2432 if (remaining_words > 0) {
2433 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2434 /* last string is not always null terminated
2435 (for e.g. for Windows XP & 2000) */
2436 if (ses->serverDomain)
2437 kfree(ses->serverDomain);
2438 ses->serverDomain =
2439 kzalloc(2*(len+1),
2440 GFP_KERNEL);
2441 if (ses->serverDomain == NULL)
2442 goto sesssetup_nomem;
2443 cifs_strfromUCS_le(ses->serverDomain,
2444 (__le16 *)bcc_ptr,
2445 len, nls_codepage);
2446 bcc_ptr += 2 * (len + 1);
2447 ses->serverDomain[2*len] = 0;
2448 ses->serverDomain[1+(2*len)] = 0;
2449 } else { /* else no more room so create
2450 dummy domain string */
2451 if (ses->serverDomain)
2452 kfree(ses->serverDomain);
2453 ses->serverDomain =
2454 kzalloc(2, GFP_KERNEL);
2455 }
2456 } else { /* no room so create dummy domain
2457 and NOS string */
2458
2459 /* if these kcallocs fail not much we
2460 can do, but better to not fail the
2461 sesssetup itself */
2462 kfree(ses->serverDomain);
2463 ses->serverDomain =
2464 kzalloc(2, GFP_KERNEL);
2465 kfree(ses->serverNOS);
2466 ses->serverNOS =
2467 kzalloc(2, GFP_KERNEL);
2468 }
2469 } else { /* ASCII */
2470 len = strnlen(bcc_ptr, 1024);
2471 if (((long) bcc_ptr + len) - (long)
2472 pByteArea(smb_buffer_response)
2473 <= BCC(smb_buffer_response)) {
2474 kfree(ses->serverOS);
2475 ses->serverOS = kzalloc(len + 1,
2476 GFP_KERNEL);
2477 if (ses->serverOS == NULL)
2478 goto sesssetup_nomem;
2479 strncpy(ses->serverOS, bcc_ptr, len);
2480
2481 bcc_ptr += len;
2482 /* null terminate the string */
2483 bcc_ptr[0] = 0;
2484 bcc_ptr++;
2485
2486 len = strnlen(bcc_ptr, 1024);
2487 kfree(ses->serverNOS);
2488 ses->serverNOS = kzalloc(len + 1,
2489 GFP_KERNEL);
2490 if (ses->serverNOS == NULL)
2491 goto sesssetup_nomem;
2492 strncpy(ses->serverNOS, bcc_ptr, len);
2493 bcc_ptr += len;
2494 bcc_ptr[0] = 0;
2495 bcc_ptr++;
2496
2497 len = strnlen(bcc_ptr, 1024);
2498 if (ses->serverDomain)
2499 kfree(ses->serverDomain);
2500 ses->serverDomain = kzalloc(len + 1,
2501 GFP_KERNEL);
2502 if (ses->serverDomain == NULL)
2503 goto sesssetup_nomem;
2504 strncpy(ses->serverDomain, bcc_ptr,
2505 len);
2506 bcc_ptr += len;
2507 bcc_ptr[0] = 0;
2508 bcc_ptr++;
2509 } else
2510 cFYI(1,
2511 ("Variable field of length %d "
2512 "extends beyond end of smb ",
2513 len));
2514 }
2515 } else {
2516 cERROR(1,
2517 (" Security Blob Length extends beyond "
2518 "end of SMB"));
2519 }
2520 } else {
2521 cERROR(1,
2522 (" Invalid Word count %d: ",
2523 smb_buffer_response->WordCount));
2524 rc = -EIO;
2525 }
2526 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2527 since that could make reconnection harder, and
2528 reconnection might be needed to free memory */
2529 if (smb_buffer)
2530 cifs_buf_release(smb_buffer);
2531
2532 return rc;
2533 }
2534
2535 static int
2536 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2537 struct cifsSesInfo *ses, int *pNTLMv2_flag,
2538 const struct nls_table *nls_codepage)
2539 {
2540 struct smb_hdr *smb_buffer;
2541 struct smb_hdr *smb_buffer_response;
2542 SESSION_SETUP_ANDX *pSMB;
2543 SESSION_SETUP_ANDX *pSMBr;
2544 char *bcc_ptr;
2545 char *domain;
2546 int rc = 0;
2547 int remaining_words = 0;
2548 int bytes_returned = 0;
2549 int len;
2550 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2551 PNEGOTIATE_MESSAGE SecurityBlob;
2552 PCHALLENGE_MESSAGE SecurityBlob2;
2553 __u32 negotiate_flags, capabilities;
2554 __u16 count;
2555
2556 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2557 if (ses == NULL)
2558 return -EINVAL;
2559 domain = ses->domainName;
2560 *pNTLMv2_flag = FALSE;
2561 smb_buffer = cifs_buf_get();
2562 if (smb_buffer == NULL) {
2563 return -ENOMEM;
2564 }
2565 smb_buffer_response = smb_buffer;
2566 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2567 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2568
2569 /* send SMBsessionSetup here */
2570 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2571 NULL /* no tCon exists yet */ , 12 /* wct */ );
2572
2573 smb_buffer->Mid = GetNextMid(ses->server);
2574 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2575 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2576
2577 pSMB->req.AndXCommand = 0xFF;
2578 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2579 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2580
2581 if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2582 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2583
2584 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2585 CAP_EXTENDED_SECURITY;
2586 if (ses->capabilities & CAP_UNICODE) {
2587 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2588 capabilities |= CAP_UNICODE;
2589 }
2590 if (ses->capabilities & CAP_STATUS32) {
2591 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2592 capabilities |= CAP_STATUS32;
2593 }
2594 if (ses->capabilities & CAP_DFS) {
2595 smb_buffer->Flags2 |= SMBFLG2_DFS;
2596 capabilities |= CAP_DFS;
2597 }
2598 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2599
2600 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2601 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2602 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2603 SecurityBlob->MessageType = NtLmNegotiate;
2604 negotiate_flags =
2605 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2606 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2607 NTLMSSP_NEGOTIATE_56 |
2608 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2609 if (sign_CIFS_PDUs)
2610 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2611 /* if (ntlmv2_support)
2612 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2613 /* setup pointers to domain name and workstation name */
2614 bcc_ptr += SecurityBlobLength;
2615
2616 SecurityBlob->WorkstationName.Buffer = 0;
2617 SecurityBlob->WorkstationName.Length = 0;
2618 SecurityBlob->WorkstationName.MaximumLength = 0;
2619
2620 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2621 along with username on auth request (ie the response to challenge) */
2622 SecurityBlob->DomainName.Buffer = 0;
2623 SecurityBlob->DomainName.Length = 0;
2624 SecurityBlob->DomainName.MaximumLength = 0;
2625 if (ses->capabilities & CAP_UNICODE) {
2626 if ((long) bcc_ptr % 2) {
2627 *bcc_ptr = 0;
2628 bcc_ptr++;
2629 }
2630
2631 bytes_returned =
2632 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2633 32, nls_codepage);
2634 bcc_ptr += 2 * bytes_returned;
2635 bytes_returned =
2636 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2637 nls_codepage);
2638 bcc_ptr += 2 * bytes_returned;
2639 bcc_ptr += 2; /* null terminate Linux version */
2640 bytes_returned =
2641 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2642 64, nls_codepage);
2643 bcc_ptr += 2 * bytes_returned;
2644 *(bcc_ptr + 1) = 0;
2645 *(bcc_ptr + 2) = 0;
2646 bcc_ptr += 2; /* null terminate network opsys string */
2647 *(bcc_ptr + 1) = 0;
2648 *(bcc_ptr + 2) = 0;
2649 bcc_ptr += 2; /* null domain */
2650 } else { /* ASCII */
2651 strcpy(bcc_ptr, "Linux version ");
2652 bcc_ptr += strlen("Linux version ");
2653 strcpy(bcc_ptr, utsname()->release);
2654 bcc_ptr += strlen(utsname()->release) + 1;
2655 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2656 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2657 bcc_ptr++; /* empty domain field */
2658 *bcc_ptr = 0;
2659 }
2660 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2661 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2662 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2663 smb_buffer->smb_buf_length += count;
2664 pSMB->req.ByteCount = cpu_to_le16(count);
2665
2666 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2667 &bytes_returned, 1);
2668
2669 if (smb_buffer_response->Status.CifsError ==
2670 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2671 rc = 0;
2672
2673 if (rc) {
2674 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2675 } else if ((smb_buffer_response->WordCount == 3)
2676 || (smb_buffer_response->WordCount == 4)) {
2677 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2678 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2679
2680 if (action & GUEST_LOGIN)
2681 cFYI(1, (" Guest login"));
2682 /* Do we want to set anything in SesInfo struct when guest login? */
2683
2684 bcc_ptr = pByteArea(smb_buffer_response);
2685 /* response can have either 3 or 4 word count - Samba sends 3 */
2686
2687 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2688 if (SecurityBlob2->MessageType != NtLmChallenge) {
2689 cFYI(1,
2690 ("Unexpected NTLMSSP message type received %d",
2691 SecurityBlob2->MessageType));
2692 } else if (ses) {
2693 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2694 cFYI(1, ("UID = %d", ses->Suid));
2695 if ((pSMBr->resp.hdr.WordCount == 3)
2696 || ((pSMBr->resp.hdr.WordCount == 4)
2697 && (blob_len <
2698 pSMBr->resp.ByteCount))) {
2699
2700 if (pSMBr->resp.hdr.WordCount == 4) {
2701 bcc_ptr += blob_len;
2702 cFYI(1, ("Security Blob Length %d",
2703 blob_len));
2704 }
2705
2706 cFYI(1, ("NTLMSSP Challenge rcvd"));
2707
2708 memcpy(ses->server->cryptKey,
2709 SecurityBlob2->Challenge,
2710 CIFS_CRYPTO_KEY_SIZE);
2711 if (SecurityBlob2->NegotiateFlags &
2712 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2713 *pNTLMv2_flag = TRUE;
2714
2715 if ((SecurityBlob2->NegotiateFlags &
2716 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2717 || (sign_CIFS_PDUs > 1))
2718 ses->server->secMode |=
2719 SECMODE_SIGN_REQUIRED;
2720 if ((SecurityBlob2->NegotiateFlags &
2721 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2722 ses->server->secMode |=
2723 SECMODE_SIGN_ENABLED;
2724
2725 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2726 if ((long) (bcc_ptr) % 2) {
2727 remaining_words =
2728 (BCC(smb_buffer_response)
2729 - 1) / 2;
2730 /* Must word align unicode strings */
2731 bcc_ptr++;
2732 } else {
2733 remaining_words =
2734 BCC
2735 (smb_buffer_response) / 2;
2736 }
2737 len =
2738 UniStrnlen((wchar_t *) bcc_ptr,
2739 remaining_words - 1);
2740 /* We look for obvious messed up bcc or strings in response so we do not go off
2741 the end since (at least) WIN2K and Windows XP have a major bug in not null
2742 terminating last Unicode string in response */
2743 if (ses->serverOS)
2744 kfree(ses->serverOS);
2745 ses->serverOS =
2746 kzalloc(2 * (len + 1), GFP_KERNEL);
2747 cifs_strfromUCS_le(ses->serverOS,
2748 (__le16 *)
2749 bcc_ptr, len,
2750 nls_codepage);
2751 bcc_ptr += 2 * (len + 1);
2752 remaining_words -= len + 1;
2753 ses->serverOS[2 * len] = 0;
2754 ses->serverOS[1 + (2 * len)] = 0;
2755 if (remaining_words > 0) {
2756 len = UniStrnlen((wchar_t *)
2757 bcc_ptr,
2758 remaining_words
2759 - 1);
2760 kfree(ses->serverNOS);
2761 ses->serverNOS =
2762 kzalloc(2 * (len + 1),
2763 GFP_KERNEL);
2764 cifs_strfromUCS_le(ses->
2765 serverNOS,
2766 (__le16 *)
2767 bcc_ptr,
2768 len,
2769 nls_codepage);
2770 bcc_ptr += 2 * (len + 1);
2771 ses->serverNOS[2 * len] = 0;
2772 ses->serverNOS[1 +
2773 (2 * len)] = 0;
2774 remaining_words -= len + 1;
2775 if (remaining_words > 0) {
2776 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2777 /* last string not always null terminated
2778 (for e.g. for Windows XP & 2000) */
2779 kfree(ses->serverDomain);
2780 ses->serverDomain =
2781 kzalloc(2 *
2782 (len +
2783 1),
2784 GFP_KERNEL);
2785 cifs_strfromUCS_le
2786 (ses->serverDomain,
2787 (__le16 *)bcc_ptr,
2788 len, nls_codepage);
2789 bcc_ptr +=
2790 2 * (len + 1);
2791 ses->serverDomain[2*len]
2792 = 0;
2793 ses->serverDomain
2794 [1 + (2 * len)]
2795 = 0;
2796 } /* else no more room so create dummy domain string */
2797 else {
2798 kfree(ses->serverDomain);
2799 ses->serverDomain =
2800 kzalloc(2,
2801 GFP_KERNEL);
2802 }
2803 } else { /* no room so create dummy domain and NOS string */
2804 kfree(ses->serverDomain);
2805 ses->serverDomain =
2806 kzalloc(2, GFP_KERNEL);
2807 kfree(ses->serverNOS);
2808 ses->serverNOS =
2809 kzalloc(2, GFP_KERNEL);
2810 }
2811 } else { /* ASCII */
2812 len = strnlen(bcc_ptr, 1024);
2813 if (((long) bcc_ptr + len) - (long)
2814 pByteArea(smb_buffer_response)
2815 <= BCC(smb_buffer_response)) {
2816 if (ses->serverOS)
2817 kfree(ses->serverOS);
2818 ses->serverOS =
2819 kzalloc(len + 1,
2820 GFP_KERNEL);
2821 strncpy(ses->serverOS,
2822 bcc_ptr, len);
2823
2824 bcc_ptr += len;
2825 bcc_ptr[0] = 0; /* null terminate string */
2826 bcc_ptr++;
2827
2828 len = strnlen(bcc_ptr, 1024);
2829 kfree(ses->serverNOS);
2830 ses->serverNOS =
2831 kzalloc(len + 1,
2832 GFP_KERNEL);
2833 strncpy(ses->serverNOS, bcc_ptr, len);
2834 bcc_ptr += len;
2835 bcc_ptr[0] = 0;
2836 bcc_ptr++;
2837
2838 len = strnlen(bcc_ptr, 1024);
2839 kfree(ses->serverDomain);
2840 ses->serverDomain =
2841 kzalloc(len + 1,
2842 GFP_KERNEL);
2843 strncpy(ses->serverDomain,
2844 bcc_ptr, len);
2845 bcc_ptr += len;
2846 bcc_ptr[0] = 0;
2847 bcc_ptr++;
2848 } else
2849 cFYI(1,
2850 ("field of length %d "
2851 "extends beyond end of smb",
2852 len));
2853 }
2854 } else {
2855 cERROR(1, ("Security Blob Length extends beyond"
2856 " end of SMB"));
2857 }
2858 } else {
2859 cERROR(1, ("No session structure passed in."));
2860 }
2861 } else {
2862 cERROR(1,
2863 (" Invalid Word count %d:",
2864 smb_buffer_response->WordCount));
2865 rc = -EIO;
2866 }
2867
2868 if (smb_buffer)
2869 cifs_buf_release(smb_buffer);
2870
2871 return rc;
2872 }
2873 static int
2874 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2875 char *ntlm_session_key, int ntlmv2_flag,
2876 const struct nls_table *nls_codepage)
2877 {
2878 struct smb_hdr *smb_buffer;
2879 struct smb_hdr *smb_buffer_response;
2880 SESSION_SETUP_ANDX *pSMB;
2881 SESSION_SETUP_ANDX *pSMBr;
2882 char *bcc_ptr;
2883 char *user;
2884 char *domain;
2885 int rc = 0;
2886 int remaining_words = 0;
2887 int bytes_returned = 0;
2888 int len;
2889 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2890 PAUTHENTICATE_MESSAGE SecurityBlob;
2891 __u32 negotiate_flags, capabilities;
2892 __u16 count;
2893
2894 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2895 if (ses == NULL)
2896 return -EINVAL;
2897 user = ses->userName;
2898 domain = ses->domainName;
2899 smb_buffer = cifs_buf_get();
2900 if (smb_buffer == NULL) {
2901 return -ENOMEM;
2902 }
2903 smb_buffer_response = smb_buffer;
2904 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2905 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2906
2907 /* send SMBsessionSetup here */
2908 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2909 NULL /* no tCon exists yet */ , 12 /* wct */ );
2910
2911 smb_buffer->Mid = GetNextMid(ses->server);
2912 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2913 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2914 pSMB->req.AndXCommand = 0xFF;
2915 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2916 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2917
2918 pSMB->req.hdr.Uid = ses->Suid;
2919
2920 if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2921 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2922
2923 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2924 CAP_EXTENDED_SECURITY;
2925 if (ses->capabilities & CAP_UNICODE) {
2926 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2927 capabilities |= CAP_UNICODE;
2928 }
2929 if (ses->capabilities & CAP_STATUS32) {
2930 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2931 capabilities |= CAP_STATUS32;
2932 }
2933 if (ses->capabilities & CAP_DFS) {
2934 smb_buffer->Flags2 |= SMBFLG2_DFS;
2935 capabilities |= CAP_DFS;
2936 }
2937 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2938
2939 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2940 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2941 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2942 SecurityBlob->MessageType = NtLmAuthenticate;
2943 bcc_ptr += SecurityBlobLength;
2944 negotiate_flags =
2945 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2946 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2947 0x80000000 | NTLMSSP_NEGOTIATE_128;
2948 if (sign_CIFS_PDUs)
2949 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2950 if (ntlmv2_flag)
2951 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2952
2953 /* setup pointers to domain name and workstation name */
2954
2955 SecurityBlob->WorkstationName.Buffer = 0;
2956 SecurityBlob->WorkstationName.Length = 0;
2957 SecurityBlob->WorkstationName.MaximumLength = 0;
2958 SecurityBlob->SessionKey.Length = 0;
2959 SecurityBlob->SessionKey.MaximumLength = 0;
2960 SecurityBlob->SessionKey.Buffer = 0;
2961
2962 SecurityBlob->LmChallengeResponse.Length = 0;
2963 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2964 SecurityBlob->LmChallengeResponse.Buffer = 0;
2965
2966 SecurityBlob->NtChallengeResponse.Length =
2967 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2968 SecurityBlob->NtChallengeResponse.MaximumLength =
2969 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2970 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2971 SecurityBlob->NtChallengeResponse.Buffer =
2972 cpu_to_le32(SecurityBlobLength);
2973 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2974 bcc_ptr += CIFS_SESS_KEY_SIZE;
2975
2976 if (ses->capabilities & CAP_UNICODE) {
2977 if (domain == NULL) {
2978 SecurityBlob->DomainName.Buffer = 0;
2979 SecurityBlob->DomainName.Length = 0;
2980 SecurityBlob->DomainName.MaximumLength = 0;
2981 } else {
2982 __u16 len =
2983 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2984 nls_codepage);
2985 len *= 2;
2986 SecurityBlob->DomainName.MaximumLength =
2987 cpu_to_le16(len);
2988 SecurityBlob->DomainName.Buffer =
2989 cpu_to_le32(SecurityBlobLength);
2990 bcc_ptr += len;
2991 SecurityBlobLength += len;
2992 SecurityBlob->DomainName.Length =
2993 cpu_to_le16(len);
2994 }
2995 if (user == NULL) {
2996 SecurityBlob->UserName.Buffer = 0;
2997 SecurityBlob->UserName.Length = 0;
2998 SecurityBlob->UserName.MaximumLength = 0;
2999 } else {
3000 __u16 len =
3001 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
3002 nls_codepage);
3003 len *= 2;
3004 SecurityBlob->UserName.MaximumLength =
3005 cpu_to_le16(len);
3006 SecurityBlob->UserName.Buffer =
3007 cpu_to_le32(SecurityBlobLength);
3008 bcc_ptr += len;
3009 SecurityBlobLength += len;
3010 SecurityBlob->UserName.Length =
3011 cpu_to_le16(len);
3012 }
3013
3014 /* SecurityBlob->WorkstationName.Length =
3015 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
3016 SecurityBlob->WorkstationName.Length *= 2;
3017 SecurityBlob->WorkstationName.MaximumLength =
3018 cpu_to_le16(SecurityBlob->WorkstationName.Length);
3019 SecurityBlob->WorkstationName.Buffer =
3020 cpu_to_le32(SecurityBlobLength);
3021 bcc_ptr += SecurityBlob->WorkstationName.Length;
3022 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3023 SecurityBlob->WorkstationName.Length =
3024 cpu_to_le16(SecurityBlob->WorkstationName.Length); */
3025
3026 if ((long) bcc_ptr % 2) {
3027 *bcc_ptr = 0;
3028 bcc_ptr++;
3029 }
3030 bytes_returned =
3031 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
3032 32, nls_codepage);
3033 bcc_ptr += 2 * bytes_returned;
3034 bytes_returned =
3035 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
3036 nls_codepage);
3037 bcc_ptr += 2 * bytes_returned;
3038 bcc_ptr += 2; /* null term version string */
3039 bytes_returned =
3040 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
3041 64, nls_codepage);
3042 bcc_ptr += 2 * bytes_returned;
3043 *(bcc_ptr + 1) = 0;
3044 *(bcc_ptr + 2) = 0;
3045 bcc_ptr += 2; /* null terminate network opsys string */
3046 *(bcc_ptr + 1) = 0;
3047 *(bcc_ptr + 2) = 0;
3048 bcc_ptr += 2; /* null domain */
3049 } else { /* ASCII */
3050 if (domain == NULL) {
3051 SecurityBlob->DomainName.Buffer = 0;
3052 SecurityBlob->DomainName.Length = 0;
3053 SecurityBlob->DomainName.MaximumLength = 0;
3054 } else {
3055 __u16 len;
3056 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
3057 strncpy(bcc_ptr, domain, 63);
3058 len = strnlen(domain, 64);
3059 SecurityBlob->DomainName.MaximumLength =
3060 cpu_to_le16(len);
3061 SecurityBlob->DomainName.Buffer =
3062 cpu_to_le32(SecurityBlobLength);
3063 bcc_ptr += len;
3064 SecurityBlobLength += len;
3065 SecurityBlob->DomainName.Length = cpu_to_le16(len);
3066 }
3067 if (user == NULL) {
3068 SecurityBlob->UserName.Buffer = 0;
3069 SecurityBlob->UserName.Length = 0;
3070 SecurityBlob->UserName.MaximumLength = 0;
3071 } else {
3072 __u16 len;
3073 strncpy(bcc_ptr, user, 63);
3074 len = strnlen(user, 64);
3075 SecurityBlob->UserName.MaximumLength =
3076 cpu_to_le16(len);
3077 SecurityBlob->UserName.Buffer =
3078 cpu_to_le32(SecurityBlobLength);
3079 bcc_ptr += len;
3080 SecurityBlobLength += len;
3081 SecurityBlob->UserName.Length = cpu_to_le16(len);
3082 }
3083 /* BB fill in our workstation name if known BB */
3084
3085 strcpy(bcc_ptr, "Linux version ");
3086 bcc_ptr += strlen("Linux version ");
3087 strcpy(bcc_ptr, utsname()->release);
3088 bcc_ptr += strlen(utsname()->release) + 1;
3089 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
3090 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
3091 bcc_ptr++; /* null domain */
3092 *bcc_ptr = 0;
3093 }
3094 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
3095 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
3096 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
3097 smb_buffer->smb_buf_length += count;
3098 pSMB->req.ByteCount = cpu_to_le16(count);
3099
3100 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3101 &bytes_returned, 1);
3102 if (rc) {
3103 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
3104 } else if ((smb_buffer_response->WordCount == 3)
3105 || (smb_buffer_response->WordCount == 4)) {
3106 __u16 action = le16_to_cpu(pSMBr->resp.Action);
3107 __u16 blob_len =
3108 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
3109 if (action & GUEST_LOGIN)
3110 cFYI(1, (" Guest login")); /* BB Should we set anything
3111 in SesInfo struct ? */
3112 /* if (SecurityBlob2->MessageType != NtLm??) {
3113 cFYI("Unexpected message type on auth response is %d"));
3114 } */
3115
3116 if (ses) {
3117 cFYI(1,
3118 ("Check challenge UID %d vs auth response UID %d",
3119 ses->Suid, smb_buffer_response->Uid));
3120 /* UID left in wire format */
3121 ses->Suid = smb_buffer_response->Uid;
3122 bcc_ptr = pByteArea(smb_buffer_response);
3123 /* response can have either 3 or 4 word count - Samba sends 3 */
3124 if ((pSMBr->resp.hdr.WordCount == 3)
3125 || ((pSMBr->resp.hdr.WordCount == 4)
3126 && (blob_len <
3127 pSMBr->resp.ByteCount))) {
3128 if (pSMBr->resp.hdr.WordCount == 4) {
3129 bcc_ptr +=
3130 blob_len;
3131 cFYI(1,
3132 ("Security Blob Length %d ",
3133 blob_len));
3134 }
3135
3136 cFYI(1,
3137 ("NTLMSSP response to Authenticate "));
3138
3139 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3140 if ((long) (bcc_ptr) % 2) {
3141 remaining_words =
3142 (BCC(smb_buffer_response)
3143 - 1) / 2;
3144 bcc_ptr++; /* Unicode strings must be word aligned */
3145 } else {
3146 remaining_words = BCC(smb_buffer_response) / 2;
3147 }
3148 len =
3149 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3150 /* We look for obvious messed up bcc or strings in response so we do not go off
3151 the end since (at least) WIN2K and Windows XP have a major bug in not null
3152 terminating last Unicode string in response */
3153 if (ses->serverOS)
3154 kfree(ses->serverOS);
3155 ses->serverOS =
3156 kzalloc(2 * (len + 1), GFP_KERNEL);
3157 cifs_strfromUCS_le(ses->serverOS,
3158 (__le16 *)
3159 bcc_ptr, len,
3160 nls_codepage);
3161 bcc_ptr += 2 * (len + 1);
3162 remaining_words -= len + 1;
3163 ses->serverOS[2 * len] = 0;
3164 ses->serverOS[1 + (2 * len)] = 0;
3165 if (remaining_words > 0) {
3166 len = UniStrnlen((wchar_t *)
3167 bcc_ptr,
3168 remaining_words
3169 - 1);
3170 kfree(ses->serverNOS);
3171 ses->serverNOS =
3172 kzalloc(2 * (len + 1),
3173 GFP_KERNEL);
3174 cifs_strfromUCS_le(ses->
3175 serverNOS,
3176 (__le16 *)
3177 bcc_ptr,
3178 len,
3179 nls_codepage);
3180 bcc_ptr += 2 * (len + 1);
3181 ses->serverNOS[2 * len] = 0;
3182 ses->serverNOS[1+(2*len)] = 0;
3183 remaining_words -= len + 1;
3184 if (remaining_words > 0) {
3185 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3186 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3187 if (ses->serverDomain)
3188 kfree(ses->serverDomain);
3189 ses->serverDomain =
3190 kzalloc(2 *
3191 (len +
3192 1),
3193 GFP_KERNEL);
3194 cifs_strfromUCS_le
3195 (ses->
3196 serverDomain,
3197 (__le16 *)
3198 bcc_ptr, len,
3199 nls_codepage);
3200 bcc_ptr +=
3201 2 * (len + 1);
3202 ses->
3203 serverDomain[2
3204 * len]
3205 = 0;
3206 ses->
3207 serverDomain[1
3208 +
3209 (2
3210 *
3211 len)]
3212 = 0;
3213 } /* else no more room so create dummy domain string */
3214 else {
3215 if (ses->serverDomain)
3216 kfree(ses->serverDomain);
3217 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3218 }
3219 } else { /* no room so create dummy domain and NOS string */
3220 if (ses->serverDomain)
3221 kfree(ses->serverDomain);
3222 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3223 kfree(ses->serverNOS);
3224 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3225 }
3226 } else { /* ASCII */
3227 len = strnlen(bcc_ptr, 1024);
3228 if (((long) bcc_ptr + len) -
3229 (long) pByteArea(smb_buffer_response)
3230 <= BCC(smb_buffer_response)) {
3231 if (ses->serverOS)
3232 kfree(ses->serverOS);
3233 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3234 strncpy(ses->serverOS,bcc_ptr, len);
3235
3236 bcc_ptr += len;
3237 bcc_ptr[0] = 0; /* null terminate the string */
3238 bcc_ptr++;
3239
3240 len = strnlen(bcc_ptr, 1024);
3241 kfree(ses->serverNOS);
3242 ses->serverNOS = kzalloc(len+1,
3243 GFP_KERNEL);
3244 strncpy(ses->serverNOS,
3245 bcc_ptr, len);
3246 bcc_ptr += len;
3247 bcc_ptr[0] = 0;
3248 bcc_ptr++;
3249
3250 len = strnlen(bcc_ptr, 1024);
3251 if (ses->serverDomain)
3252 kfree(ses->serverDomain);
3253 ses->serverDomain =
3254 kzalloc(len+1,
3255 GFP_KERNEL);
3256 strncpy(ses->serverDomain,
3257 bcc_ptr, len);
3258 bcc_ptr += len;
3259 bcc_ptr[0] = 0;
3260 bcc_ptr++;
3261 } else
3262 cFYI(1,
3263 ("field of length %d "
3264 "extends beyond end of smb ",
3265 len));
3266 }
3267 } else {
3268 cERROR(1,
3269 (" Security Blob extends beyond end "
3270 "of SMB"));
3271 }
3272 } else {
3273 cERROR(1, ("No session structure passed in."));
3274 }
3275 } else {
3276 cERROR(1,
3277 (" Invalid Word count %d: ",
3278 smb_buffer_response->WordCount));
3279 rc = -EIO;
3280 }
3281
3282 if (smb_buffer)
3283 cifs_buf_release(smb_buffer);
3284
3285 return rc;
3286 }
3287
3288 int
3289 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3290 const char *tree, struct cifsTconInfo *tcon,
3291 const struct nls_table *nls_codepage)
3292 {
3293 struct smb_hdr *smb_buffer;
3294 struct smb_hdr *smb_buffer_response;
3295 TCONX_REQ *pSMB;
3296 TCONX_RSP *pSMBr;
3297 unsigned char *bcc_ptr;
3298 int rc = 0;
3299 int length;
3300 __u16 count;
3301
3302 if (ses == NULL)
3303 return -EIO;
3304
3305 smb_buffer = cifs_buf_get();
3306 if (smb_buffer == NULL) {
3307 return -ENOMEM;
3308 }
3309 smb_buffer_response = smb_buffer;
3310
3311 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3312 NULL /*no tid */ , 4 /*wct */ );
3313
3314 smb_buffer->Mid = GetNextMid(ses->server);
3315 smb_buffer->Uid = ses->Suid;
3316 pSMB = (TCONX_REQ *) smb_buffer;
3317 pSMBr = (TCONX_RSP *) smb_buffer_response;
3318
3319 pSMB->AndXCommand = 0xFF;
3320 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3321 bcc_ptr = &pSMB->Password[0];
3322 if ((ses->server->secMode) & SECMODE_USER) {
3323 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3324 *bcc_ptr = 0; /* password is null byte */
3325 bcc_ptr++; /* skip password */
3326 /* already aligned so no need to do it below */
3327 } else {
3328 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3329 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3330 specified as required (when that support is added to
3331 the vfs in the future) as only NTLM or the much
3332 weaker LANMAN (which we do not send by default) is accepted
3333 by Samba (not sure whether other servers allow
3334 NTLMv2 password here) */
3335 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3336 if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3337 (ses->server->secType == LANMAN))
3338 calc_lanman_hash(ses, bcc_ptr);
3339 else
3340 #endif /* CIFS_WEAK_PW_HASH */
3341 SMBNTencrypt(ses->password,
3342 ses->server->cryptKey,
3343 bcc_ptr);
3344
3345 bcc_ptr += CIFS_SESS_KEY_SIZE;
3346 if (ses->capabilities & CAP_UNICODE) {
3347 /* must align unicode strings */
3348 *bcc_ptr = 0; /* null byte password */
3349 bcc_ptr++;
3350 }
3351 }
3352
3353 if (ses->server->secMode &
3354 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3355 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3356
3357 if (ses->capabilities & CAP_STATUS32) {
3358 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3359 }
3360 if (ses->capabilities & CAP_DFS) {
3361 smb_buffer->Flags2 |= SMBFLG2_DFS;
3362 }
3363 if (ses->capabilities & CAP_UNICODE) {
3364 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3365 length =
3366 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3367 6 /* max utf8 char length in bytes */ *
3368 (/* server len*/ + 256 /* share len */), nls_codepage);
3369 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3370 bcc_ptr += 2; /* skip trailing null */
3371 } else { /* ASCII */
3372 strcpy(bcc_ptr, tree);
3373 bcc_ptr += strlen(tree) + 1;
3374 }
3375 strcpy(bcc_ptr, "?????");
3376 bcc_ptr += strlen("?????");
3377 bcc_ptr += 1;
3378 count = bcc_ptr - &pSMB->Password[0];
3379 pSMB->hdr.smb_buf_length += count;
3380 pSMB->ByteCount = cpu_to_le16(count);
3381
3382 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3383
3384 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3385 /* above now done in SendReceive */
3386 if ((rc == 0) && (tcon != NULL)) {
3387 tcon->tidStatus = CifsGood;
3388 tcon->tid = smb_buffer_response->Tid;
3389 bcc_ptr = pByteArea(smb_buffer_response);
3390 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3391 /* skip service field (NB: this field is always ASCII) */
3392 bcc_ptr += length + 1;
3393 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3394 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3395 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3396 if ((bcc_ptr + (2 * length)) -
3397 pByteArea(smb_buffer_response) <=
3398 BCC(smb_buffer_response)) {
3399 kfree(tcon->nativeFileSystem);
3400 tcon->nativeFileSystem =
3401 kzalloc(length + 2, GFP_KERNEL);
3402 cifs_strfromUCS_le(tcon->nativeFileSystem,
3403 (__le16 *) bcc_ptr,
3404 length, nls_codepage);
3405 bcc_ptr += 2 * length;
3406 bcc_ptr[0] = 0; /* null terminate the string */
3407 bcc_ptr[1] = 0;
3408 bcc_ptr += 2;
3409 }
3410 /* else do not bother copying these information fields*/
3411 } else {
3412 length = strnlen(bcc_ptr, 1024);
3413 if ((bcc_ptr + length) -
3414 pByteArea(smb_buffer_response) <=
3415 BCC(smb_buffer_response)) {
3416 kfree(tcon->nativeFileSystem);
3417 tcon->nativeFileSystem =
3418 kzalloc(length + 1, GFP_KERNEL);
3419 strncpy(tcon->nativeFileSystem, bcc_ptr,
3420 length);
3421 }
3422 /* else do not bother copying these information fields*/
3423 }
3424 if ((smb_buffer_response->WordCount == 3) ||
3425 (smb_buffer_response->WordCount == 7))
3426 /* field is in same location */
3427 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3428 else
3429 tcon->Flags = 0;
3430 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3431 } else if ((rc == 0) && tcon == NULL) {
3432 /* all we need to save for IPC$ connection */
3433 ses->ipc_tid = smb_buffer_response->Tid;
3434 }
3435
3436 if (smb_buffer)
3437 cifs_buf_release(smb_buffer);
3438 return rc;
3439 }
3440
3441 int
3442 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3443 {
3444 int rc = 0;
3445 int xid;
3446 struct cifsSesInfo *ses = NULL;
3447 struct task_struct *cifsd_task;
3448 char *tmp;
3449
3450 xid = GetXid();
3451
3452 if (cifs_sb->tcon) {
3453 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3454 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3455 if (rc == -EBUSY) {
3456 FreeXid(xid);
3457 return 0;
3458 }
3459 tconInfoFree(cifs_sb->tcon);
3460 if ((ses) && (ses->server)) {
3461 /* save off task so we do not refer to ses later */
3462 cifsd_task = ses->server->tsk;
3463 cFYI(1, ("About to do SMBLogoff "));
3464 rc = CIFSSMBLogoff(xid, ses);
3465 if (rc == -EBUSY) {
3466 FreeXid(xid);
3467 return 0;
3468 } else if (rc == -ESHUTDOWN) {
3469 cFYI(1, ("Waking up socket by sending signal"));
3470 if (cifsd_task) {
3471 force_sig(SIGKILL, cifsd_task);
3472 kthread_stop(cifsd_task);
3473 }
3474 rc = 0;
3475 } /* else - we have an smb session
3476 left on this socket do not kill cifsd */
3477 } else
3478 cFYI(1, ("No session or bad tcon"));
3479 }
3480
3481 cifs_sb->tcon = NULL;
3482 tmp = cifs_sb->prepath;
3483 cifs_sb->prepathlen = 0;
3484 cifs_sb->prepath = NULL;
3485 kfree(tmp);
3486 if (ses)
3487 schedule_timeout_interruptible(msecs_to_jiffies(500));
3488 if (ses)
3489 sesInfoFree(ses);
3490
3491 FreeXid(xid);
3492 return rc; /* BB check if we should always return zero here */
3493 }
3494
3495 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3496 struct nls_table *nls_info)
3497 {
3498 int rc = 0;
3499 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3500 int ntlmv2_flag = FALSE;
3501 int first_time = 0;
3502
3503 /* what if server changes its buffer size after dropping the session? */
3504 if (pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3505 rc = CIFSSMBNegotiate(xid, pSesInfo);
3506 if (rc == -EAGAIN) /* retry only once on 1st time connection */ {
3507 rc = CIFSSMBNegotiate(xid, pSesInfo);
3508 if (rc == -EAGAIN)
3509 rc = -EHOSTDOWN;
3510 }
3511 if (rc == 0) {
3512 spin_lock(&GlobalMid_Lock);
3513 if (pSesInfo->server->tcpStatus != CifsExiting)
3514 pSesInfo->server->tcpStatus = CifsGood;
3515 else
3516 rc = -EHOSTDOWN;
3517 spin_unlock(&GlobalMid_Lock);
3518
3519 }
3520 first_time = 1;
3521 }
3522 if (!rc) {
3523 pSesInfo->flags = 0;
3524 pSesInfo->capabilities = pSesInfo->server->capabilities;
3525 if (linuxExtEnabled == 0)
3526 pSesInfo->capabilities &= (~CAP_UNIX);
3527 /* pSesInfo->sequence_number = 0;*/
3528 cFYI(1,
3529 ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3530 pSesInfo->server->secMode,
3531 pSesInfo->server->capabilities,
3532 pSesInfo->server->timeAdj));
3533 if (experimEnabled < 2)
3534 rc = CIFS_SessSetup(xid, pSesInfo,
3535 first_time, nls_info);
3536 else if (extended_security
3537 && (pSesInfo->capabilities
3538 & CAP_EXTENDED_SECURITY)
3539 && (pSesInfo->server->secType == NTLMSSP)) {
3540 rc = -EOPNOTSUPP;
3541 } else if (extended_security
3542 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3543 && (pSesInfo->server->secType == RawNTLMSSP)) {
3544 cFYI(1, ("NTLMSSP sesssetup"));
3545 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3546 pSesInfo,
3547 &ntlmv2_flag,
3548 nls_info);
3549 if (!rc) {
3550 if (ntlmv2_flag) {
3551 char *v2_response;
3552 cFYI(1, ("more secure NTLM ver2 hash"));
3553 if (CalcNTLMv2_partial_mac_key(pSesInfo,
3554 nls_info)) {
3555 rc = -ENOMEM;
3556 goto ss_err_exit;
3557 } else
3558 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3559 if (v2_response) {
3560 CalcNTLMv2_response(pSesInfo,
3561 v2_response);
3562 /* if (first_time)
3563 cifs_calculate_ntlmv2_mac_key(
3564 pSesInfo->server->mac_signing_key,
3565 response, ntlm_session_key,*/
3566 kfree(v2_response);
3567 /* BB Put dummy sig in SessSetup PDU? */
3568 } else {
3569 rc = -ENOMEM;
3570 goto ss_err_exit;
3571 }
3572
3573 } else {
3574 SMBNTencrypt(pSesInfo->password,
3575 pSesInfo->server->cryptKey,
3576 ntlm_session_key);
3577
3578 if (first_time)
3579 cifs_calculate_mac_key(
3580 &pSesInfo->server->mac_signing_key,
3581 ntlm_session_key,
3582 pSesInfo->password);
3583 }
3584 /* for better security the weaker lanman hash not sent
3585 in AuthSessSetup so we no longer calculate it */
3586
3587 rc = CIFSNTLMSSPAuthSessSetup(xid,
3588 pSesInfo,
3589 ntlm_session_key,
3590 ntlmv2_flag,
3591 nls_info);
3592 }
3593 } else { /* old style NTLM 0.12 session setup */
3594 SMBNTencrypt(pSesInfo->password,
3595 pSesInfo->server->cryptKey,
3596 ntlm_session_key);
3597
3598 if (first_time)
3599 cifs_calculate_mac_key(
3600 &pSesInfo->server->mac_signing_key,
3601 ntlm_session_key, pSesInfo->password);
3602
3603 rc = CIFSSessSetup(xid, pSesInfo,
3604 ntlm_session_key, nls_info);
3605 }
3606 if (rc) {
3607 cERROR(1, ("Send error in SessSetup = %d", rc));
3608 } else {
3609 cFYI(1, ("CIFS Session Established successfully"));
3610 pSesInfo->status = CifsGood;
3611 }
3612 }
3613 ss_err_exit:
3614 return rc;
3615 }
3616
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree