?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
x86: check range in reserve_early()
[linux-2.6/mini2440.git] / fs / cifs / connect.c
blob2209be94305132f375b1082193bdcf7280c312d8
1 /*
2 * fs/cifs/connect.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21 #include <linux/fs.h>
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/kthread.h>
34 #include <linux/pagevec.h>
35 #include <linux/freezer.h>
36 #include <asm/uaccess.h>
37 #include <asm/processor.h>
38 #include "cifspdu.h"
39 #include "cifsglob.h"
40 #include "cifsproto.h"
41 #include "cifs_unicode.h"
42 #include "cifs_debug.h"
43 #include "cifs_fs_sb.h"
44 #include "ntlmssp.h"
45 #include "nterr.h"
46 #include "rfc1002pdu.h"
47 #include "cn_cifs.h"
48
49 #define CIFS_PORT 445
50 #define RFC1001_PORT 139
51
52 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
53 unsigned char *p24);
54
55 extern mempool_t *cifs_req_poolp;
56
57 struct smb_vol {
58 char *username;
59 char *password;
60 char *domainname;
61 char *UNC;
62 char *UNCip;
63 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
64 char *iocharset; /* local code page for mapping to and from Unicode */
65 char source_rfc1001_name[16]; /* netbios name of client */
66 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
67 uid_t linux_uid;
68 gid_t linux_gid;
69 mode_t file_mode;
70 mode_t dir_mode;
71 unsigned secFlg;
72 bool rw:1;
73 bool retry:1;
74 bool intr:1;
75 bool setuids:1;
76 bool override_uid:1;
77 bool override_gid:1;
78 bool dynperm:1;
79 bool noperm:1;
80 bool no_psx_acl:1; /* set if posix acl support should be disabled */
81 bool cifs_acl:1;
82 bool no_xattr:1; /* set if xattr (EA) support should be disabled*/
83 bool server_ino:1; /* use inode numbers from server ie UniqueId */
84 bool direct_io:1;
85 bool remap:1; /* set to remap seven reserved chars in filenames */
86 bool posix_paths:1; /* unset to not ask for posix pathnames. */
87 bool no_linux_ext:1;
88 bool sfu_emul:1;
89 bool nullauth:1; /* attempt to authenticate with null user */
90 bool nocase:1; /* request case insensitive filenames */
91 bool nobrl:1; /* disable sending byte range locks to srv */
92 bool mand_lock:1; /* send mandatory not posix byte range lock reqs */
93 bool seal:1; /* request transport encryption on share */
94 bool nodfs:1; /* Do not request DFS, even if available */
95 bool local_lease:1; /* check leases only on local system, not remote */
96 bool noblocksnd:1;
97 bool noautotune:1;
98 unsigned int rsize;
99 unsigned int wsize;
100 unsigned int sockopt;
101 unsigned short int port;
102 char *prepath;
103 };
104
105 static int ipv4_connect(struct TCP_Server_Info *server);
106 static int ipv6_connect(struct TCP_Server_Info *server);
107
108 /*
109 * cifs tcp session reconnection
110 *
111 * mark tcp session as reconnecting so temporarily locked
112 * mark all smb sessions as reconnecting for tcp session
113 * reconnect tcp session
114 * wake up waiters on reconnection? - (not needed currently)
115 */
116 static int
117 cifs_reconnect(struct TCP_Server_Info *server)
118 {
119 int rc = 0;
120 struct list_head *tmp, *tmp2;
121 struct cifsSesInfo *ses;
122 struct cifsTconInfo *tcon;
123 struct mid_q_entry *mid_entry;
124
125 spin_lock(&GlobalMid_Lock);
126 if (server->tcpStatus == CifsExiting) {
127 /* the demux thread will exit normally
128 next time through the loop */
129 spin_unlock(&GlobalMid_Lock);
130 return rc;
131 } else
132 server->tcpStatus = CifsNeedReconnect;
133 spin_unlock(&GlobalMid_Lock);
134 server->maxBuf = 0;
135
136 cFYI(1, ("Reconnecting tcp session"));
137
138 /* before reconnecting the tcp session, mark the smb session (uid)
139 and the tid bad so they are not used until reconnected */
140 read_lock(&cifs_tcp_ses_lock);
141 list_for_each(tmp, &server->smb_ses_list) {
142 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
143 ses->need_reconnect = true;
144 ses->ipc_tid = 0;
145 list_for_each(tmp2, &ses->tcon_list) {
146 tcon = list_entry(tmp2, struct cifsTconInfo, tcon_list);
147 tcon->need_reconnect = true;
148 }
149 }
150 read_unlock(&cifs_tcp_ses_lock);
151 /* do not want to be sending data on a socket we are freeing */
152 mutex_lock(&server->srv_mutex);
153 if (server->ssocket) {
154 cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
155 server->ssocket->flags));
156 kernel_sock_shutdown(server->ssocket, SHUT_WR);
157 cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
158 server->ssocket->state,
159 server->ssocket->flags));
160 sock_release(server->ssocket);
161 server->ssocket = NULL;
162 }
163
164 spin_lock(&GlobalMid_Lock);
165 list_for_each(tmp, &server->pending_mid_q) {
166 mid_entry = list_entry(tmp, struct
167 mid_q_entry,
168 qhead);
169 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
170 /* Mark other intransit requests as needing
171 retry so we do not immediately mark the
172 session bad again (ie after we reconnect
173 below) as they timeout too */
174 mid_entry->midState = MID_RETRY_NEEDED;
175 }
176 }
177 spin_unlock(&GlobalMid_Lock);
178 mutex_unlock(&server->srv_mutex);
179
180 while ((server->tcpStatus != CifsExiting) &&
181 (server->tcpStatus != CifsGood)) {
182 try_to_freeze();
183 if (server->addr.sockAddr6.sin6_family == AF_INET6)
184 rc = ipv6_connect(server);
185 else
186 rc = ipv4_connect(server);
187 if (rc) {
188 cFYI(1, ("reconnect error %d", rc));
189 msleep(3000);
190 } else {
191 atomic_inc(&tcpSesReconnectCount);
192 spin_lock(&GlobalMid_Lock);
193 if (server->tcpStatus != CifsExiting)
194 server->tcpStatus = CifsGood;
195 server->sequence_number = 0;
196 spin_unlock(&GlobalMid_Lock);
197 /* atomic_set(&server->inFlight,0);*/
198 wake_up(&server->response_q);
199 }
200 }
201 return rc;
202 }
203
204 /*
205 return codes:
206 0 not a transact2, or all data present
207 >0 transact2 with that much data missing
208 -EINVAL = invalid transact2
209
210 */
211 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
212 {
213 struct smb_t2_rsp *pSMBt;
214 int total_data_size;
215 int data_in_this_rsp;
216 int remaining;
217
218 if (pSMB->Command != SMB_COM_TRANSACTION2)
219 return 0;
220
221 /* check for plausible wct, bcc and t2 data and parm sizes */
222 /* check for parm and data offset going beyond end of smb */
223 if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
224 cFYI(1, ("invalid transact2 word count"));
225 return -EINVAL;
226 }
227
228 pSMBt = (struct smb_t2_rsp *)pSMB;
229
230 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
231 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
232
233 remaining = total_data_size - data_in_this_rsp;
234
235 if (remaining == 0)
236 return 0;
237 else if (remaining < 0) {
238 cFYI(1, ("total data %d smaller than data in frame %d",
239 total_data_size, data_in_this_rsp));
240 return -EINVAL;
241 } else {
242 cFYI(1, ("missing %d bytes from transact2, check next response",
243 remaining));
244 if (total_data_size > maxBufSize) {
245 cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
246 total_data_size, maxBufSize));
247 return -EINVAL;
248 }
249 return remaining;
250 }
251 }
252
253 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
254 {
255 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
256 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
257 int total_data_size;
258 int total_in_buf;
259 int remaining;
260 int total_in_buf2;
261 char *data_area_of_target;
262 char *data_area_of_buf2;
263 __u16 byte_count;
264
265 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
266
267 if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
268 cFYI(1, ("total data size of primary and secondary t2 differ"));
269 }
270
271 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
272
273 remaining = total_data_size - total_in_buf;
274
275 if (remaining < 0)
276 return -EINVAL;
277
278 if (remaining == 0) /* nothing to do, ignore */
279 return 0;
280
281 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
282 if (remaining < total_in_buf2) {
283 cFYI(1, ("transact2 2nd response contains too much data"));
284 }
285
286 /* find end of first SMB data area */
287 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
288 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
289 /* validate target area */
290
291 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
292 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
293
294 data_area_of_target += total_in_buf;
295
296 /* copy second buffer into end of first buffer */
297 memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
298 total_in_buf += total_in_buf2;
299 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
300 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
301 byte_count += total_in_buf2;
302 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
303
304 byte_count = pTargetSMB->smb_buf_length;
305 byte_count += total_in_buf2;
306
307 /* BB also add check that we are not beyond maximum buffer size */
308
309 pTargetSMB->smb_buf_length = byte_count;
310
311 if (remaining == total_in_buf2) {
312 cFYI(1, ("found the last secondary response"));
313 return 0; /* we are done */
314 } else /* more responses to go */
315 return 1;
316
317 }
318
319 static int
320 cifs_demultiplex_thread(struct TCP_Server_Info *server)
321 {
322 int length;
323 unsigned int pdu_length, total_read;
324 struct smb_hdr *smb_buffer = NULL;
325 struct smb_hdr *bigbuf = NULL;
326 struct smb_hdr *smallbuf = NULL;
327 struct msghdr smb_msg;
328 struct kvec iov;
329 struct socket *csocket = server->ssocket;
330 struct list_head *tmp;
331 struct cifsSesInfo *ses;
332 struct task_struct *task_to_wake = NULL;
333 struct mid_q_entry *mid_entry;
334 char temp;
335 bool isLargeBuf = false;
336 bool isMultiRsp;
337 int reconnect;
338
339 current->flags |= PF_MEMALLOC;
340 cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current)));
341
342 length = atomic_inc_return(&tcpSesAllocCount);
343 if (length > 1)
344 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
345 GFP_KERNEL);
346
347 set_freezable();
348 while (server->tcpStatus != CifsExiting) {
349 if (try_to_freeze())
350 continue;
351 if (bigbuf == NULL) {
352 bigbuf = cifs_buf_get();
353 if (!bigbuf) {
354 cERROR(1, ("No memory for large SMB response"));
355 msleep(3000);
356 /* retry will check if exiting */
357 continue;
358 }
359 } else if (isLargeBuf) {
360 /* we are reusing a dirty large buf, clear its start */
361 memset(bigbuf, 0, sizeof(struct smb_hdr));
362 }
363
364 if (smallbuf == NULL) {
365 smallbuf = cifs_small_buf_get();
366 if (!smallbuf) {
367 cERROR(1, ("No memory for SMB response"));
368 msleep(1000);
369 /* retry will check if exiting */
370 continue;
371 }
372 /* beginning of smb buffer is cleared in our buf_get */
373 } else /* if existing small buf clear beginning */
374 memset(smallbuf, 0, sizeof(struct smb_hdr));
375
376 isLargeBuf = false;
377 isMultiRsp = false;
378 smb_buffer = smallbuf;
379 iov.iov_base = smb_buffer;
380 iov.iov_len = 4;
381 smb_msg.msg_control = NULL;
382 smb_msg.msg_controllen = 0;
383 pdu_length = 4; /* enough to get RFC1001 header */
384 incomplete_rcv:
385 length =
386 kernel_recvmsg(csocket, &smb_msg,
387 &iov, 1, pdu_length, 0 /* BB other flags? */);
388
389 if (server->tcpStatus == CifsExiting) {
390 break;
391 } else if (server->tcpStatus == CifsNeedReconnect) {
392 cFYI(1, ("Reconnect after server stopped responding"));
393 cifs_reconnect(server);
394 cFYI(1, ("call to reconnect done"));
395 csocket = server->ssocket;
396 continue;
397 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
398 msleep(1); /* minimum sleep to prevent looping
399 allowing socket to clear and app threads to set
400 tcpStatus CifsNeedReconnect if server hung */
401 if (pdu_length < 4) {
402 iov.iov_base = (4 - pdu_length) +
403 (char *)smb_buffer;
404 iov.iov_len = pdu_length;
405 smb_msg.msg_control = NULL;
406 smb_msg.msg_controllen = 0;
407 goto incomplete_rcv;
408 } else
409 continue;
410 } else if (length <= 0) {
411 if (server->tcpStatus == CifsNew) {
412 cFYI(1, ("tcp session abend after SMBnegprot"));
413 /* some servers kill the TCP session rather than
414 returning an SMB negprot error, in which
415 case reconnecting here is not going to help,
416 and so simply return error to mount */
417 break;
418 }
419 if (!try_to_freeze() && (length == -EINTR)) {
420 cFYI(1, ("cifsd thread killed"));
421 break;
422 }
423 cFYI(1, ("Reconnect after unexpected peek error %d",
424 length));
425 cifs_reconnect(server);
426 csocket = server->ssocket;
427 wake_up(&server->response_q);
428 continue;
429 } else if (length < pdu_length) {
430 cFYI(1, ("requested %d bytes but only got %d bytes",
431 pdu_length, length));
432 pdu_length -= length;
433 msleep(1);
434 goto incomplete_rcv;
435 }
436
437 /* The right amount was read from socket - 4 bytes */
438 /* so we can now interpret the length field */
439
440 /* the first byte big endian of the length field,
441 is actually not part of the length but the type
442 with the most common, zero, as regular data */
443 temp = *((char *) smb_buffer);
444
445 /* Note that FC 1001 length is big endian on the wire,
446 but we convert it here so it is always manipulated
447 as host byte order */
448 pdu_length = be32_to_cpu((__force __be32)smb_buffer->smb_buf_length);
449 smb_buffer->smb_buf_length = pdu_length;
450
451 cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
452
453 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
454 continue;
455 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
456 cFYI(1, ("Good RFC 1002 session rsp"));
457 continue;
458 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
459 /* we get this from Windows 98 instead of
460 an error on SMB negprot response */
461 cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
462 pdu_length));
463 if (server->tcpStatus == CifsNew) {
464 /* if nack on negprot (rather than
465 ret of smb negprot error) reconnecting
466 not going to help, ret error to mount */
467 break;
468 } else {
469 /* give server a second to
470 clean up before reconnect attempt */
471 msleep(1000);
472 /* always try 445 first on reconnect
473 since we get NACK on some if we ever
474 connected to port 139 (the NACK is
475 since we do not begin with RFC1001
476 session initialize frame) */
477 server->addr.sockAddr.sin_port =
478 htons(CIFS_PORT);
479 cifs_reconnect(server);
480 csocket = server->ssocket;
481 wake_up(&server->response_q);
482 continue;
483 }
484 } else if (temp != (char) 0) {
485 cERROR(1, ("Unknown RFC 1002 frame"));
486 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
487 length);
488 cifs_reconnect(server);
489 csocket = server->ssocket;
490 continue;
491 }
492
493 /* else we have an SMB response */
494 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
495 (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
496 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
497 length, pdu_length+4));
498 cifs_reconnect(server);
499 csocket = server->ssocket;
500 wake_up(&server->response_q);
501 continue;
502 }
503
504 /* else length ok */
505 reconnect = 0;
506
507 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
508 isLargeBuf = true;
509 memcpy(bigbuf, smallbuf, 4);
510 smb_buffer = bigbuf;
511 }
512 length = 0;
513 iov.iov_base = 4 + (char *)smb_buffer;
514 iov.iov_len = pdu_length;
515 for (total_read = 0; total_read < pdu_length;
516 total_read += length) {
517 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
518 pdu_length - total_read, 0);
519 if ((server->tcpStatus == CifsExiting) ||
520 (length == -EINTR)) {
521 /* then will exit */
522 reconnect = 2;
523 break;
524 } else if (server->tcpStatus == CifsNeedReconnect) {
525 cifs_reconnect(server);
526 csocket = server->ssocket;
527 /* Reconnect wakes up rspns q */
528 /* Now we will reread sock */
529 reconnect = 1;
530 break;
531 } else if ((length == -ERESTARTSYS) ||
532 (length == -EAGAIN)) {
533 msleep(1); /* minimum sleep to prevent looping,
534 allowing socket to clear and app
535 threads to set tcpStatus
536 CifsNeedReconnect if server hung*/
537 length = 0;
538 continue;
539 } else if (length <= 0) {
540 cERROR(1, ("Received no data, expecting %d",
541 pdu_length - total_read));
542 cifs_reconnect(server);
543 csocket = server->ssocket;
544 reconnect = 1;
545 break;
546 }
547 }
548 if (reconnect == 2)
549 break;
550 else if (reconnect == 1)
551 continue;
552
553 length += 4; /* account for rfc1002 hdr */
554
555
556 dump_smb(smb_buffer, length);
557 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
558 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
559 continue;
560 }
561
562
563 task_to_wake = NULL;
564 spin_lock(&GlobalMid_Lock);
565 list_for_each(tmp, &server->pending_mid_q) {
566 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
567
568 if ((mid_entry->mid == smb_buffer->Mid) &&
569 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
570 (mid_entry->command == smb_buffer->Command)) {
571 if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
572 /* We have a multipart transact2 resp */
573 isMultiRsp = true;
574 if (mid_entry->resp_buf) {
575 /* merge response - fix up 1st*/
576 if (coalesce_t2(smb_buffer,
577 mid_entry->resp_buf)) {
578 mid_entry->multiRsp =
579 true;
580 break;
581 } else {
582 /* all parts received */
583 mid_entry->multiEnd =
584 true;
585 goto multi_t2_fnd;
586 }
587 } else {
588 if (!isLargeBuf) {
589 cERROR(1,("1st trans2 resp needs bigbuf"));
590 /* BB maybe we can fix this up, switch
591 to already allocated large buffer? */
592 } else {
593 /* Have first buffer */
594 mid_entry->resp_buf =
595 smb_buffer;
596 mid_entry->largeBuf =
597 true;
598 bigbuf = NULL;
599 }
600 }
601 break;
602 }
603 mid_entry->resp_buf = smb_buffer;
604 mid_entry->largeBuf = isLargeBuf;
605 multi_t2_fnd:
606 task_to_wake = mid_entry->tsk;
607 mid_entry->midState = MID_RESPONSE_RECEIVED;
608 #ifdef CONFIG_CIFS_STATS2
609 mid_entry->when_received = jiffies;
610 #endif
611 /* so we do not time out requests to server
612 which is still responding (since server could
613 be busy but not dead) */
614 server->lstrp = jiffies;
615 break;
616 }
617 }
618 spin_unlock(&GlobalMid_Lock);
619 if (task_to_wake) {
620 /* Was previous buf put in mpx struct for multi-rsp? */
621 if (!isMultiRsp) {
622 /* smb buffer will be freed by user thread */
623 if (isLargeBuf)
624 bigbuf = NULL;
625 else
626 smallbuf = NULL;
627 }
628 wake_up_process(task_to_wake);
629 } else if (!is_valid_oplock_break(smb_buffer, server) &&
630 !isMultiRsp) {
631 cERROR(1, ("No task to wake, unknown frame received! "
632 "NumMids %d", midCount.counter));
633 cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
634 sizeof(struct smb_hdr));
635 #ifdef CONFIG_CIFS_DEBUG2
636 cifs_dump_detail(smb_buffer);
637 cifs_dump_mids(server);
638 #endif /* CIFS_DEBUG2 */
639
640 }
641 } /* end while !EXITING */
642
643 /* take it off the list, if it's not already */
644 write_lock(&cifs_tcp_ses_lock);
645 list_del_init(&server->tcp_ses_list);
646 write_unlock(&cifs_tcp_ses_lock);
647
648 spin_lock(&GlobalMid_Lock);
649 server->tcpStatus = CifsExiting;
650 spin_unlock(&GlobalMid_Lock);
651 wake_up_all(&server->response_q);
652
653 /* check if we have blocked requests that need to free */
654 /* Note that cifs_max_pending is normally 50, but
655 can be set at module install time to as little as two */
656 spin_lock(&GlobalMid_Lock);
657 if (atomic_read(&server->inFlight) >= cifs_max_pending)
658 atomic_set(&server->inFlight, cifs_max_pending - 1);
659 /* We do not want to set the max_pending too low or we
660 could end up with the counter going negative */
661 spin_unlock(&GlobalMid_Lock);
662 /* Although there should not be any requests blocked on
663 this queue it can not hurt to be paranoid and try to wake up requests
664 that may haven been blocked when more than 50 at time were on the wire
665 to the same server - they now will see the session is in exit state
666 and get out of SendReceive. */
667 wake_up_all(&server->request_q);
668 /* give those requests time to exit */
669 msleep(125);
670
671 if (server->ssocket) {
672 sock_release(csocket);
673 server->ssocket = NULL;
674 }
675 /* buffer usuallly freed in free_mid - need to free it here on exit */
676 cifs_buf_release(bigbuf);
677 if (smallbuf) /* no sense logging a debug message if NULL */
678 cifs_small_buf_release(smallbuf);
679
680 /*
681 * BB: we shouldn't have to do any of this. It shouldn't be
682 * possible to exit from the thread with active SMB sessions
683 */
684 read_lock(&cifs_tcp_ses_lock);
685 if (list_empty(&server->pending_mid_q)) {
686 /* loop through server session structures attached to this and
687 mark them dead */
688 list_for_each(tmp, &server->smb_ses_list) {
689 ses = list_entry(tmp, struct cifsSesInfo,
690 smb_ses_list);
691 ses->status = CifsExiting;
692 ses->server = NULL;
693 }
694 read_unlock(&cifs_tcp_ses_lock);
695 } else {
696 /* although we can not zero the server struct pointer yet,
697 since there are active requests which may depnd on them,
698 mark the corresponding SMB sessions as exiting too */
699 list_for_each(tmp, &server->smb_ses_list) {
700 ses = list_entry(tmp, struct cifsSesInfo,
701 smb_ses_list);
702 ses->status = CifsExiting;
703 }
704
705 spin_lock(&GlobalMid_Lock);
706 list_for_each(tmp, &server->pending_mid_q) {
707 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
708 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
709 cFYI(1, ("Clearing Mid 0x%x - waking up ",
710 mid_entry->mid));
711 task_to_wake = mid_entry->tsk;
712 if (task_to_wake)
713 wake_up_process(task_to_wake);
714 }
715 }
716 spin_unlock(&GlobalMid_Lock);
717 read_unlock(&cifs_tcp_ses_lock);
718 /* 1/8th of sec is more than enough time for them to exit */
719 msleep(125);
720 }
721
722 if (!list_empty(&server->pending_mid_q)) {
723 /* mpx threads have not exited yet give them
724 at least the smb send timeout time for long ops */
725 /* due to delays on oplock break requests, we need
726 to wait at least 45 seconds before giving up
727 on a request getting a response and going ahead
728 and killing cifsd */
729 cFYI(1, ("Wait for exit from demultiplex thread"));
730 msleep(46000);
731 /* if threads still have not exited they are probably never
732 coming home not much else we can do but free the memory */
733 }
734
735 /* last chance to mark ses pointers invalid
736 if there are any pointing to this (e.g
737 if a crazy root user tried to kill cifsd
738 kernel thread explicitly this might happen) */
739 /* BB: This shouldn't be necessary, see above */
740 read_lock(&cifs_tcp_ses_lock);
741 list_for_each(tmp, &server->smb_ses_list) {
742 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
743 ses->server = NULL;
744 }
745 read_unlock(&cifs_tcp_ses_lock);
746
747 kfree(server->hostname);
748 task_to_wake = xchg(&server->tsk, NULL);
749 kfree(server);
750
751 length = atomic_dec_return(&tcpSesAllocCount);
752 if (length > 0)
753 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
754 GFP_KERNEL);
755
756 /* if server->tsk was NULL then wait for a signal before exiting */
757 if (!task_to_wake) {
758 set_current_state(TASK_INTERRUPTIBLE);
759 while (!signal_pending(current)) {
760 schedule();
761 set_current_state(TASK_INTERRUPTIBLE);
762 }
763 set_current_state(TASK_RUNNING);
764 }
765
766 module_put_and_exit(0);
767 }
768
769 /* extract the host portion of the UNC string */
770 static char *
771 extract_hostname(const char *unc)
772 {
773 const char *src;
774 char *dst, *delim;
775 unsigned int len;
776
777 /* skip double chars at beginning of string */
778 /* BB: check validity of these bytes? */
779 src = unc + 2;
780
781 /* delimiter between hostname and sharename is always '\\' now */
782 delim = strchr(src, '\\');
783 if (!delim)
784 return ERR_PTR(-EINVAL);
785
786 len = delim - src;
787 dst = kmalloc((len + 1), GFP_KERNEL);
788 if (dst == NULL)
789 return ERR_PTR(-ENOMEM);
790
791 memcpy(dst, src, len);
792 dst[len] = '\0';
793
794 return dst;
795 }
796
797 static int
798 cifs_parse_mount_options(char *options, const char *devname,
799 struct smb_vol *vol)
800 {
801 char *value;
802 char *data;
803 unsigned int temp_len, i, j;
804 char separator[2];
805
806 separator[0] = ',';
807 separator[1] = 0;
808
809 if (Local_System_Name[0] != 0)
810 memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
811 else {
812 char *nodename = utsname()->nodename;
813 int n = strnlen(nodename, 15);
814 memset(vol->source_rfc1001_name, 0x20, 15);
815 for (i = 0; i < n; i++) {
816 /* does not have to be perfect mapping since field is
817 informational, only used for servers that do not support
818 port 445 and it can be overridden at mount time */
819 vol->source_rfc1001_name[i] = toupper(nodename[i]);
820 }
821 }
822 vol->source_rfc1001_name[15] = 0;
823 /* null target name indicates to use *SMBSERVR default called name
824 if we end up sending RFC1001 session initialize */
825 vol->target_rfc1001_name[0] = 0;
826 vol->linux_uid = current_uid(); /* use current_euid() instead? */
827 vol->linux_gid = current_gid();
828 vol->dir_mode = S_IRWXUGO;
829 /* 2767 perms indicate mandatory locking support */
830 vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
831
832 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
833 vol->rw = true;
834 /* default is always to request posix paths. */
835 vol->posix_paths = 1;
836
837 if (!options)
838 return 1;
839
840 if (strncmp(options, "sep=", 4) == 0) {
841 if (options[4] != 0) {
842 separator[0] = options[4];
843 options += 5;
844 } else {
845 cFYI(1, ("Null separator not allowed"));
846 }
847 }
848
849 while ((data = strsep(&options, separator)) != NULL) {
850 if (!*data)
851 continue;
852 if ((value = strchr(data, '=')) != NULL)
853 *value++ = '\0';
854
855 /* Have to parse this before we parse for "user" */
856 if (strnicmp(data, "user_xattr", 10) == 0) {
857 vol->no_xattr = 0;
858 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
859 vol->no_xattr = 1;
860 } else if (strnicmp(data, "user", 4) == 0) {
861 if (!value) {
862 printk(KERN_WARNING
863 "CIFS: invalid or missing username\n");
864 return 1; /* needs_arg; */
865 } else if (!*value) {
866 /* null user, ie anonymous, authentication */
867 vol->nullauth = 1;
868 }
869 if (strnlen(value, 200) < 200) {
870 vol->username = value;
871 } else {
872 printk(KERN_WARNING "CIFS: username too long\n");
873 return 1;
874 }
875 } else if (strnicmp(data, "pass", 4) == 0) {
876 if (!value) {
877 vol->password = NULL;
878 continue;
879 } else if (value[0] == 0) {
880 /* check if string begins with double comma
881 since that would mean the password really
882 does start with a comma, and would not
883 indicate an empty string */
884 if (value[1] != separator[0]) {
885 vol->password = NULL;
886 continue;
887 }
888 }
889 temp_len = strlen(value);
890 /* removed password length check, NTLM passwords
891 can be arbitrarily long */
892
893 /* if comma in password, the string will be
894 prematurely null terminated. Commas in password are
895 specified across the cifs mount interface by a double
896 comma ie ,, and a comma used as in other cases ie ','
897 as a parameter delimiter/separator is single and due
898 to the strsep above is temporarily zeroed. */
899
900 /* NB: password legally can have multiple commas and
901 the only illegal character in a password is null */
902
903 if ((value[temp_len] == 0) &&
904 (value[temp_len+1] == separator[0])) {
905 /* reinsert comma */
906 value[temp_len] = separator[0];
907 temp_len += 2; /* move after second comma */
908 while (value[temp_len] != 0) {
909 if (value[temp_len] == separator[0]) {
910 if (value[temp_len+1] ==
911 separator[0]) {
912 /* skip second comma */
913 temp_len++;
914 } else {
915 /* single comma indicating start
916 of next parm */
917 break;
918 }
919 }
920 temp_len++;
921 }
922 if (value[temp_len] == 0) {
923 options = NULL;
924 } else {
925 value[temp_len] = 0;
926 /* point option to start of next parm */
927 options = value + temp_len + 1;
928 }
929 /* go from value to value + temp_len condensing
930 double commas to singles. Note that this ends up
931 allocating a few bytes too many, which is ok */
932 vol->password = kzalloc(temp_len, GFP_KERNEL);
933 if (vol->password == NULL) {
934 printk(KERN_WARNING "CIFS: no memory "
935 "for password\n");
936 return 1;
937 }
938 for (i = 0, j = 0; i < temp_len; i++, j++) {
939 vol->password[j] = value[i];
940 if (value[i] == separator[0]
941 && value[i+1] == separator[0]) {
942 /* skip second comma */
943 i++;
944 }
945 }
946 vol->password[j] = 0;
947 } else {
948 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
949 if (vol->password == NULL) {
950 printk(KERN_WARNING "CIFS: no memory "
951 "for password\n");
952 return 1;
953 }
954 strcpy(vol->password, value);
955 }
956 } else if (strnicmp(data, "ip", 2) == 0) {
957 if (!value || !*value) {
958 vol->UNCip = NULL;
959 } else if (strnlen(value, 35) < 35) {
960 vol->UNCip = value;
961 } else {
962 printk(KERN_WARNING "CIFS: ip address "
963 "too long\n");
964 return 1;
965 }
966 } else if (strnicmp(data, "sec", 3) == 0) {
967 if (!value || !*value) {
968 cERROR(1, ("no security value specified"));
969 continue;
970 } else if (strnicmp(value, "krb5i", 5) == 0) {
971 vol->secFlg |= CIFSSEC_MAY_KRB5 |
972 CIFSSEC_MUST_SIGN;
973 } else if (strnicmp(value, "krb5p", 5) == 0) {
974 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
975 CIFSSEC_MAY_KRB5; */
976 cERROR(1, ("Krb5 cifs privacy not supported"));
977 return 1;
978 } else if (strnicmp(value, "krb5", 4) == 0) {
979 vol->secFlg |= CIFSSEC_MAY_KRB5;
980 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
981 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
982 CIFSSEC_MUST_SIGN;
983 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
984 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
985 } else if (strnicmp(value, "ntlmi", 5) == 0) {
986 vol->secFlg |= CIFSSEC_MAY_NTLM |
987 CIFSSEC_MUST_SIGN;
988 } else if (strnicmp(value, "ntlm", 4) == 0) {
989 /* ntlm is default so can be turned off too */
990 vol->secFlg |= CIFSSEC_MAY_NTLM;
991 } else if (strnicmp(value, "nontlm", 6) == 0) {
992 /* BB is there a better way to do this? */
993 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
994 #ifdef CONFIG_CIFS_WEAK_PW_HASH
995 } else if (strnicmp(value, "lanman", 6) == 0) {
996 vol->secFlg |= CIFSSEC_MAY_LANMAN;
997 #endif
998 } else if (strnicmp(value, "none", 4) == 0) {
999 vol->nullauth = 1;
1000 } else {
1001 cERROR(1, ("bad security option: %s", value));
1002 return 1;
1003 }
1004 } else if ((strnicmp(data, "unc", 3) == 0)
1005 || (strnicmp(data, "target", 6) == 0)
1006 || (strnicmp(data, "path", 4) == 0)) {
1007 if (!value || !*value) {
1008 printk(KERN_WARNING "CIFS: invalid path to "
1009 "network resource\n");
1010 return 1; /* needs_arg; */
1011 }
1012 if ((temp_len = strnlen(value, 300)) < 300) {
1013 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1014 if (vol->UNC == NULL)
1015 return 1;
1016 strcpy(vol->UNC, value);
1017 if (strncmp(vol->UNC, "//", 2) == 0) {
1018 vol->UNC[0] = '\\';
1019 vol->UNC[1] = '\\';
1020 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1021 printk(KERN_WARNING
1022 "CIFS: UNC Path does not begin "
1023 "with // or \\\\ \n");
1024 return 1;
1025 }
1026 } else {
1027 printk(KERN_WARNING "CIFS: UNC name too long\n");
1028 return 1;
1029 }
1030 } else if ((strnicmp(data, "domain", 3) == 0)
1031 || (strnicmp(data, "workgroup", 5) == 0)) {
1032 if (!value || !*value) {
1033 printk(KERN_WARNING "CIFS: invalid domain name\n");
1034 return 1; /* needs_arg; */
1035 }
1036 /* BB are there cases in which a comma can be valid in
1037 a domain name and need special handling? */
1038 if (strnlen(value, 256) < 256) {
1039 vol->domainname = value;
1040 cFYI(1, ("Domain name set"));
1041 } else {
1042 printk(KERN_WARNING "CIFS: domain name too "
1043 "long\n");
1044 return 1;
1045 }
1046 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1047 if (!value || !*value) {
1048 printk(KERN_WARNING
1049 "CIFS: invalid path prefix\n");
1050 return 1; /* needs_argument */
1051 }
1052 if ((temp_len = strnlen(value, 1024)) < 1024) {
1053 if (value[0] != '/')
1054 temp_len++; /* missing leading slash */
1055 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1056 if (vol->prepath == NULL)
1057 return 1;
1058 if (value[0] != '/') {
1059 vol->prepath[0] = '/';
1060 strcpy(vol->prepath+1, value);
1061 } else
1062 strcpy(vol->prepath, value);
1063 cFYI(1, ("prefix path %s", vol->prepath));
1064 } else {
1065 printk(KERN_WARNING "CIFS: prefix too long\n");
1066 return 1;
1067 }
1068 } else if (strnicmp(data, "iocharset", 9) == 0) {
1069 if (!value || !*value) {
1070 printk(KERN_WARNING "CIFS: invalid iocharset "
1071 "specified\n");
1072 return 1; /* needs_arg; */
1073 }
1074 if (strnlen(value, 65) < 65) {
1075 if (strnicmp(value, "default", 7))
1076 vol->iocharset = value;
1077 /* if iocharset not set then load_nls_default
1078 is used by caller */
1079 cFYI(1, ("iocharset set to %s", value));
1080 } else {
1081 printk(KERN_WARNING "CIFS: iocharset name "
1082 "too long.\n");
1083 return 1;
1084 }
1085 } else if (strnicmp(data, "uid", 3) == 0) {
1086 if (value && *value) {
1087 vol->linux_uid =
1088 simple_strtoul(value, &value, 0);
1089 vol->override_uid = 1;
1090 }
1091 } else if (strnicmp(data, "gid", 3) == 0) {
1092 if (value && *value) {
1093 vol->linux_gid =
1094 simple_strtoul(value, &value, 0);
1095 vol->override_gid = 1;
1096 }
1097 } else if (strnicmp(data, "file_mode", 4) == 0) {
1098 if (value && *value) {
1099 vol->file_mode =
1100 simple_strtoul(value, &value, 0);
1101 }
1102 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1103 if (value && *value) {
1104 vol->dir_mode =
1105 simple_strtoul(value, &value, 0);
1106 }
1107 } else if (strnicmp(data, "dirmode", 4) == 0) {
1108 if (value && *value) {
1109 vol->dir_mode =
1110 simple_strtoul(value, &value, 0);
1111 }
1112 } else if (strnicmp(data, "port", 4) == 0) {
1113 if (value && *value) {
1114 vol->port =
1115 simple_strtoul(value, &value, 0);
1116 }
1117 } else if (strnicmp(data, "rsize", 5) == 0) {
1118 if (value && *value) {
1119 vol->rsize =
1120 simple_strtoul(value, &value, 0);
1121 }
1122 } else if (strnicmp(data, "wsize", 5) == 0) {
1123 if (value && *value) {
1124 vol->wsize =
1125 simple_strtoul(value, &value, 0);
1126 }
1127 } else if (strnicmp(data, "sockopt", 5) == 0) {
1128 if (value && *value) {
1129 vol->sockopt =
1130 simple_strtoul(value, &value, 0);
1131 }
1132 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1133 if (!value || !*value || (*value == ' ')) {
1134 cFYI(1, ("invalid (empty) netbiosname"));
1135 } else {
1136 memset(vol->source_rfc1001_name, 0x20, 15);
1137 for (i = 0; i < 15; i++) {
1138 /* BB are there cases in which a comma can be
1139 valid in this workstation netbios name (and need
1140 special handling)? */
1141
1142 /* We do not uppercase netbiosname for user */
1143 if (value[i] == 0)
1144 break;
1145 else
1146 vol->source_rfc1001_name[i] =
1147 value[i];
1148 }
1149 /* The string has 16th byte zero still from
1150 set at top of the function */
1151 if ((i == 15) && (value[i] != 0))
1152 printk(KERN_WARNING "CIFS: netbiosname"
1153 " longer than 15 truncated.\n");
1154 }
1155 } else if (strnicmp(data, "servern", 7) == 0) {
1156 /* servernetbiosname specified override *SMBSERVER */
1157 if (!value || !*value || (*value == ' ')) {
1158 cFYI(1, ("empty server netbiosname specified"));
1159 } else {
1160 /* last byte, type, is 0x20 for servr type */
1161 memset(vol->target_rfc1001_name, 0x20, 16);
1162
1163 for (i = 0; i < 15; i++) {
1164 /* BB are there cases in which a comma can be
1165 valid in this workstation netbios name
1166 (and need special handling)? */
1167
1168 /* user or mount helper must uppercase
1169 the netbiosname */
1170 if (value[i] == 0)
1171 break;
1172 else
1173 vol->target_rfc1001_name[i] =
1174 value[i];
1175 }
1176 /* The string has 16th byte zero still from
1177 set at top of the function */
1178 if ((i == 15) && (value[i] != 0))
1179 printk(KERN_WARNING "CIFS: server net"
1180 "biosname longer than 15 truncated.\n");
1181 }
1182 } else if (strnicmp(data, "credentials", 4) == 0) {
1183 /* ignore */
1184 } else if (strnicmp(data, "version", 3) == 0) {
1185 /* ignore */
1186 } else if (strnicmp(data, "guest", 5) == 0) {
1187 /* ignore */
1188 } else if (strnicmp(data, "rw", 2) == 0) {
1189 vol->rw = true;
1190 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1191 vol->noblocksnd = 1;
1192 } else if (strnicmp(data, "noautotune", 10) == 0) {
1193 vol->noautotune = 1;
1194 } else if ((strnicmp(data, "suid", 4) == 0) ||
1195 (strnicmp(data, "nosuid", 6) == 0) ||
1196 (strnicmp(data, "exec", 4) == 0) ||
1197 (strnicmp(data, "noexec", 6) == 0) ||
1198 (strnicmp(data, "nodev", 5) == 0) ||
1199 (strnicmp(data, "noauto", 6) == 0) ||
1200 (strnicmp(data, "dev", 3) == 0)) {
1201 /* The mount tool or mount.cifs helper (if present)
1202 uses these opts to set flags, and the flags are read
1203 by the kernel vfs layer before we get here (ie
1204 before read super) so there is no point trying to
1205 parse these options again and set anything and it
1206 is ok to just ignore them */
1207 continue;
1208 } else if (strnicmp(data, "ro", 2) == 0) {
1209 vol->rw = false;
1210 } else if (strnicmp(data, "hard", 4) == 0) {
1211 vol->retry = 1;
1212 } else if (strnicmp(data, "soft", 4) == 0) {
1213 vol->retry = 0;
1214 } else if (strnicmp(data, "perm", 4) == 0) {
1215 vol->noperm = 0;
1216 } else if (strnicmp(data, "noperm", 6) == 0) {
1217 vol->noperm = 1;
1218 } else if (strnicmp(data, "mapchars", 8) == 0) {
1219 vol->remap = 1;
1220 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1221 vol->remap = 0;
1222 } else if (strnicmp(data, "sfu", 3) == 0) {
1223 vol->sfu_emul = 1;
1224 } else if (strnicmp(data, "nosfu", 5) == 0) {
1225 vol->sfu_emul = 0;
1226 } else if (strnicmp(data, "nodfs", 5) == 0) {
1227 vol->nodfs = 1;
1228 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1229 vol->posix_paths = 1;
1230 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1231 vol->posix_paths = 0;
1232 } else if (strnicmp(data, "nounix", 6) == 0) {
1233 vol->no_linux_ext = 1;
1234 } else if (strnicmp(data, "nolinux", 7) == 0) {
1235 vol->no_linux_ext = 1;
1236 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1237 (strnicmp(data, "ignorecase", 10) == 0)) {
1238 vol->nocase = 1;
1239 } else if (strnicmp(data, "brl", 3) == 0) {
1240 vol->nobrl = 0;
1241 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1242 (strnicmp(data, "nolock", 6) == 0)) {
1243 vol->nobrl = 1;
1244 /* turn off mandatory locking in mode
1245 if remote locking is turned off since the
1246 local vfs will do advisory */
1247 if (vol->file_mode ==
1248 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1249 vol->file_mode = S_IALLUGO;
1250 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1251 /* will take the shorter form "forcemand" as well */
1252 /* This mount option will force use of mandatory
1253 (DOS/Windows style) byte range locks, instead of
1254 using posix advisory byte range locks, even if the
1255 Unix extensions are available and posix locks would
1256 be supported otherwise. If Unix extensions are not
1257 negotiated this has no effect since mandatory locks
1258 would be used (mandatory locks is all that those
1259 those servers support) */
1260 vol->mand_lock = 1;
1261 } else if (strnicmp(data, "setuids", 7) == 0) {
1262 vol->setuids = 1;
1263 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1264 vol->setuids = 0;
1265 } else if (strnicmp(data, "dynperm", 7) == 0) {
1266 vol->dynperm = true;
1267 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1268 vol->dynperm = false;
1269 } else if (strnicmp(data, "nohard", 6) == 0) {
1270 vol->retry = 0;
1271 } else if (strnicmp(data, "nosoft", 6) == 0) {
1272 vol->retry = 1;
1273 } else if (strnicmp(data, "nointr", 6) == 0) {
1274 vol->intr = 0;
1275 } else if (strnicmp(data, "intr", 4) == 0) {
1276 vol->intr = 1;
1277 } else if (strnicmp(data, "serverino", 7) == 0) {
1278 vol->server_ino = 1;
1279 } else if (strnicmp(data, "noserverino", 9) == 0) {
1280 vol->server_ino = 0;
1281 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1282 vol->cifs_acl = 1;
1283 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1284 vol->cifs_acl = 0;
1285 } else if (strnicmp(data, "acl", 3) == 0) {
1286 vol->no_psx_acl = 0;
1287 } else if (strnicmp(data, "noacl", 5) == 0) {
1288 vol->no_psx_acl = 1;
1289 #ifdef CONFIG_CIFS_EXPERIMENTAL
1290 } else if (strnicmp(data, "locallease", 6) == 0) {
1291 vol->local_lease = 1;
1292 #endif
1293 } else if (strnicmp(data, "sign", 4) == 0) {
1294 vol->secFlg |= CIFSSEC_MUST_SIGN;
1295 } else if (strnicmp(data, "seal", 4) == 0) {
1296 /* we do not do the following in secFlags because seal
1297 is a per tree connection (mount) not a per socket
1298 or per-smb connection option in the protocol */
1299 /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1300 vol->seal = 1;
1301 } else if (strnicmp(data, "direct", 6) == 0) {
1302 vol->direct_io = 1;
1303 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1304 vol->direct_io = 1;
1305 } else if (strnicmp(data, "in6_addr", 8) == 0) {
1306 if (!value || !*value) {
1307 vol->in6_addr = NULL;
1308 } else if (strnlen(value, 49) == 48) {
1309 vol->in6_addr = value;
1310 } else {
1311 printk(KERN_WARNING "CIFS: ip v6 address not "
1312 "48 characters long\n");
1313 return 1;
1314 }
1315 } else if (strnicmp(data, "noac", 4) == 0) {
1316 printk(KERN_WARNING "CIFS: Mount option noac not "
1317 "supported. Instead set "
1318 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1319 } else
1320 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1321 data);
1322 }
1323 if (vol->UNC == NULL) {
1324 if (devname == NULL) {
1325 printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1326 "target\n");
1327 return 1;
1328 }
1329 if ((temp_len = strnlen(devname, 300)) < 300) {
1330 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1331 if (vol->UNC == NULL)
1332 return 1;
1333 strcpy(vol->UNC, devname);
1334 if (strncmp(vol->UNC, "//", 2) == 0) {
1335 vol->UNC[0] = '\\';
1336 vol->UNC[1] = '\\';
1337 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1338 printk(KERN_WARNING "CIFS: UNC Path does not "
1339 "begin with // or \\\\ \n");
1340 return 1;
1341 }
1342 value = strpbrk(vol->UNC+2, "/\\");
1343 if (value)
1344 *value = '\\';
1345 } else {
1346 printk(KERN_WARNING "CIFS: UNC name too long\n");
1347 return 1;
1348 }
1349 }
1350 if (vol->UNCip == NULL)
1351 vol->UNCip = &vol->UNC[2];
1352
1353 return 0;
1354 }
1355
1356 static struct TCP_Server_Info *
1357 cifs_find_tcp_session(struct sockaddr_storage *addr)
1358 {
1359 struct list_head *tmp;
1360 struct TCP_Server_Info *server;
1361 struct sockaddr_in *addr4 = (struct sockaddr_in *) addr;
1362 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *) addr;
1363
1364 write_lock(&cifs_tcp_ses_lock);
1365 list_for_each(tmp, &cifs_tcp_ses_list) {
1366 server = list_entry(tmp, struct TCP_Server_Info,
1367 tcp_ses_list);
1368 /*
1369 * the demux thread can exit on its own while still in CifsNew
1370 * so don't accept any sockets in that state. Since the
1371 * tcpStatus never changes back to CifsNew it's safe to check
1372 * for this without a lock.
1373 */
1374 if (server->tcpStatus == CifsNew)
1375 continue;
1376
1377 if (addr->ss_family == AF_INET &&
1378 (addr4->sin_addr.s_addr !=
1379 server->addr.sockAddr.sin_addr.s_addr))
1380 continue;
1381 else if (addr->ss_family == AF_INET6 &&
1382 memcmp(&server->addr.sockAddr6.sin6_addr,
1383 &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
1384 continue;
1385
1386 ++server->srv_count;
1387 write_unlock(&cifs_tcp_ses_lock);
1388 cFYI(1, ("Existing tcp session with server found"));
1389 return server;
1390 }
1391 write_unlock(&cifs_tcp_ses_lock);
1392 return NULL;
1393 }
1394
1395 static void
1396 cifs_put_tcp_session(struct TCP_Server_Info *server)
1397 {
1398 struct task_struct *task;
1399
1400 write_lock(&cifs_tcp_ses_lock);
1401 if (--server->srv_count > 0) {
1402 write_unlock(&cifs_tcp_ses_lock);
1403 return;
1404 }
1405
1406 list_del_init(&server->tcp_ses_list);
1407 write_unlock(&cifs_tcp_ses_lock);
1408
1409 spin_lock(&GlobalMid_Lock);
1410 server->tcpStatus = CifsExiting;
1411 spin_unlock(&GlobalMid_Lock);
1412
1413 task = xchg(&server->tsk, NULL);
1414 if (task)
1415 force_sig(SIGKILL, task);
1416 }
1417
1418 static struct TCP_Server_Info *
1419 cifs_get_tcp_session(struct smb_vol *volume_info)
1420 {
1421 struct TCP_Server_Info *tcp_ses = NULL;
1422 struct sockaddr_storage addr;
1423 struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1424 struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1425 int rc;
1426
1427 memset(&addr, 0, sizeof(struct sockaddr_storage));
1428
1429 if (volume_info->UNCip && volume_info->UNC) {
1430 rc = cifs_inet_pton(AF_INET, volume_info->UNCip,
1431 &sin_server->sin_addr.s_addr);
1432
1433 if (rc <= 0) {
1434 /* not ipv4 address, try ipv6 */
1435 rc = cifs_inet_pton(AF_INET6, volume_info->UNCip,
1436 &sin_server6->sin6_addr.in6_u);
1437 if (rc > 0)
1438 addr.ss_family = AF_INET6;
1439 } else {
1440 addr.ss_family = AF_INET;
1441 }
1442
1443 if (rc <= 0) {
1444 /* we failed translating address */
1445 rc = -EINVAL;
1446 goto out_err;
1447 }
1448
1449 cFYI(1, ("UNC: %s ip: %s", volume_info->UNC,
1450 volume_info->UNCip));
1451 } else if (volume_info->UNCip) {
1452 /* BB using ip addr as tcp_ses name to connect to the
1453 DFS root below */
1454 cERROR(1, ("Connecting to DFS root not implemented yet"));
1455 rc = -EINVAL;
1456 goto out_err;
1457 } else /* which tcp_sess DFS root would we conect to */ {
1458 cERROR(1,
1459 ("CIFS mount error: No UNC path (e.g. -o "
1460 "unc=//192.168.1.100/public) specified"));
1461 rc = -EINVAL;
1462 goto out_err;
1463 }
1464
1465 /* see if we already have a matching tcp_ses */
1466 tcp_ses = cifs_find_tcp_session(&addr);
1467 if (tcp_ses)
1468 return tcp_ses;
1469
1470 tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1471 if (!tcp_ses) {
1472 rc = -ENOMEM;
1473 goto out_err;
1474 }
1475
1476 tcp_ses->hostname = extract_hostname(volume_info->UNC);
1477 if (IS_ERR(tcp_ses->hostname)) {
1478 rc = PTR_ERR(tcp_ses->hostname);
1479 goto out_err;
1480 }
1481
1482 tcp_ses->noblocksnd = volume_info->noblocksnd;
1483 tcp_ses->noautotune = volume_info->noautotune;
1484 atomic_set(&tcp_ses->inFlight, 0);
1485 init_waitqueue_head(&tcp_ses->response_q);
1486 init_waitqueue_head(&tcp_ses->request_q);
1487 INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1488 mutex_init(&tcp_ses->srv_mutex);
1489 memcpy(tcp_ses->workstation_RFC1001_name,
1490 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1491 memcpy(tcp_ses->server_RFC1001_name,
1492 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1493 tcp_ses->sequence_number = 0;
1494 INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1495 INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1496
1497 /*
1498 * at this point we are the only ones with the pointer
1499 * to the struct since the kernel thread not created yet
1500 * no need to spinlock this init of tcpStatus or srv_count
1501 */
1502 tcp_ses->tcpStatus = CifsNew;
1503 ++tcp_ses->srv_count;
1504
1505 if (addr.ss_family == AF_INET6) {
1506 cFYI(1, ("attempting ipv6 connect"));
1507 /* BB should we allow ipv6 on port 139? */
1508 /* other OS never observed in Wild doing 139 with v6 */
1509 memcpy(&tcp_ses->addr.sockAddr6, sin_server6,
1510 sizeof(struct sockaddr_in6));
1511 sin_server6->sin6_port = htons(volume_info->port);
1512 rc = ipv6_connect(tcp_ses);
1513 } else {
1514 memcpy(&tcp_ses->addr.sockAddr, sin_server,
1515 sizeof(struct sockaddr_in));
1516 sin_server->sin_port = htons(volume_info->port);
1517 rc = ipv4_connect(tcp_ses);
1518 }
1519 if (rc < 0) {
1520 cERROR(1, ("Error connecting to socket. Aborting operation"));
1521 goto out_err;
1522 }
1523
1524 /*
1525 * since we're in a cifs function already, we know that
1526 * this will succeed. No need for try_module_get().
1527 */
1528 __module_get(THIS_MODULE);
1529 tcp_ses->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread,
1530 tcp_ses, "cifsd");
1531 if (IS_ERR(tcp_ses->tsk)) {
1532 rc = PTR_ERR(tcp_ses->tsk);
1533 cERROR(1, ("error %d create cifsd thread", rc));
1534 module_put(THIS_MODULE);
1535 goto out_err;
1536 }
1537
1538 /* thread spawned, put it on the list */
1539 write_lock(&cifs_tcp_ses_lock);
1540 list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1541 write_unlock(&cifs_tcp_ses_lock);
1542
1543 return tcp_ses;
1544
1545 out_err:
1546 if (tcp_ses) {
1547 kfree(tcp_ses->hostname);
1548 if (tcp_ses->ssocket)
1549 sock_release(tcp_ses->ssocket);
1550 kfree(tcp_ses);
1551 }
1552 return ERR_PTR(rc);
1553 }
1554
1555 static struct cifsSesInfo *
1556 cifs_find_smb_ses(struct TCP_Server_Info *server, char *username)
1557 {
1558 struct list_head *tmp;
1559 struct cifsSesInfo *ses;
1560
1561 write_lock(&cifs_tcp_ses_lock);
1562 list_for_each(tmp, &server->smb_ses_list) {
1563 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
1564 if (strncmp(ses->userName, username, MAX_USERNAME_SIZE))
1565 continue;
1566
1567 ++ses->ses_count;
1568 write_unlock(&cifs_tcp_ses_lock);
1569 return ses;
1570 }
1571 write_unlock(&cifs_tcp_ses_lock);
1572 return NULL;
1573 }
1574
1575 static void
1576 cifs_put_smb_ses(struct cifsSesInfo *ses)
1577 {
1578 int xid;
1579 struct TCP_Server_Info *server = ses->server;
1580
1581 write_lock(&cifs_tcp_ses_lock);
1582 if (--ses->ses_count > 0) {
1583 write_unlock(&cifs_tcp_ses_lock);
1584 return;
1585 }
1586
1587 list_del_init(&ses->smb_ses_list);
1588 write_unlock(&cifs_tcp_ses_lock);
1589
1590 if (ses->status == CifsGood) {
1591 xid = GetXid();
1592 CIFSSMBLogoff(xid, ses);
1593 _FreeXid(xid);
1594 }
1595 sesInfoFree(ses);
1596 cifs_put_tcp_session(server);
1597 }
1598
1599 static struct cifsTconInfo *
1600 cifs_find_tcon(struct cifsSesInfo *ses, const char *unc)
1601 {
1602 struct list_head *tmp;
1603 struct cifsTconInfo *tcon;
1604
1605 write_lock(&cifs_tcp_ses_lock);
1606 list_for_each(tmp, &ses->tcon_list) {
1607 tcon = list_entry(tmp, struct cifsTconInfo, tcon_list);
1608 if (tcon->tidStatus == CifsExiting)
1609 continue;
1610 if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
1611 continue;
1612
1613 ++tcon->tc_count;
1614 write_unlock(&cifs_tcp_ses_lock);
1615 return tcon;
1616 }
1617 write_unlock(&cifs_tcp_ses_lock);
1618 return NULL;
1619 }
1620
1621 static void
1622 cifs_put_tcon(struct cifsTconInfo *tcon)
1623 {
1624 int xid;
1625 struct cifsSesInfo *ses = tcon->ses;
1626
1627 write_lock(&cifs_tcp_ses_lock);
1628 if (--tcon->tc_count > 0) {
1629 write_unlock(&cifs_tcp_ses_lock);
1630 return;
1631 }
1632
1633 list_del_init(&tcon->tcon_list);
1634 write_unlock(&cifs_tcp_ses_lock);
1635
1636 xid = GetXid();
1637 CIFSSMBTDis(xid, tcon);
1638 _FreeXid(xid);
1639
1640 DeleteTconOplockQEntries(tcon);
1641 tconInfoFree(tcon);
1642 cifs_put_smb_ses(ses);
1643 }
1644
1645 int
1646 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
1647 const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
1648 struct dfs_info3_param **preferrals, int remap)
1649 {
1650 char *temp_unc;
1651 int rc = 0;
1652
1653 *pnum_referrals = 0;
1654 *preferrals = NULL;
1655
1656 if (pSesInfo->ipc_tid == 0) {
1657 temp_unc = kmalloc(2 /* for slashes */ +
1658 strnlen(pSesInfo->serverName,
1659 SERVER_NAME_LEN_WITH_NULL * 2)
1660 + 1 + 4 /* slash IPC$ */ + 2,
1661 GFP_KERNEL);
1662 if (temp_unc == NULL)
1663 return -ENOMEM;
1664 temp_unc[0] = '\\';
1665 temp_unc[1] = '\\';
1666 strcpy(temp_unc + 2, pSesInfo->serverName);
1667 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1668 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1669 cFYI(1,
1670 ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
1671 kfree(temp_unc);
1672 }
1673 if (rc == 0)
1674 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1675 pnum_referrals, nls_codepage, remap);
1676 /* BB map targetUNCs to dfs_info3 structures, here or
1677 in CIFSGetDFSRefer BB */
1678
1679 return rc;
1680 }
1681
1682 #ifdef CONFIG_DEBUG_LOCK_ALLOC
1683 static struct lock_class_key cifs_key[2];
1684 static struct lock_class_key cifs_slock_key[2];
1685
1686 static inline void
1687 cifs_reclassify_socket4(struct socket *sock)
1688 {
1689 struct sock *sk = sock->sk;
1690 BUG_ON(sock_owned_by_user(sk));
1691 sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
1692 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
1693 }
1694
1695 static inline void
1696 cifs_reclassify_socket6(struct socket *sock)
1697 {
1698 struct sock *sk = sock->sk;
1699 BUG_ON(sock_owned_by_user(sk));
1700 sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
1701 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
1702 }
1703 #else
1704 static inline void
1705 cifs_reclassify_socket4(struct socket *sock)
1706 {
1707 }
1708
1709 static inline void
1710 cifs_reclassify_socket6(struct socket *sock)
1711 {
1712 }
1713 #endif
1714
1715 /* See RFC1001 section 14 on representation of Netbios names */
1716 static void rfc1002mangle(char *target, char *source, unsigned int length)
1717 {
1718 unsigned int i, j;
1719
1720 for (i = 0, j = 0; i < (length); i++) {
1721 /* mask a nibble at a time and encode */
1722 target[j] = 'A' + (0x0F & (source[i] >> 4));
1723 target[j+1] = 'A' + (0x0F & source[i]);
1724 j += 2;
1725 }
1726
1727 }
1728
1729
1730 static int
1731 ipv4_connect(struct TCP_Server_Info *server)
1732 {
1733 int rc = 0;
1734 bool connected = false;
1735 __be16 orig_port = 0;
1736 struct socket *socket = server->ssocket;
1737
1738 if (socket == NULL) {
1739 rc = sock_create_kern(PF_INET, SOCK_STREAM,
1740 IPPROTO_TCP, &socket);
1741 if (rc < 0) {
1742 cERROR(1, ("Error %d creating socket", rc));
1743 return rc;
1744 }
1745
1746 /* BB other socket options to set KEEPALIVE, NODELAY? */
1747 cFYI(1, ("Socket created"));
1748 server->ssocket = socket;
1749 socket->sk->sk_allocation = GFP_NOFS;
1750 cifs_reclassify_socket4(socket);
1751 }
1752
1753 /* user overrode default port */
1754 if (server->addr.sockAddr.sin_port) {
1755 rc = socket->ops->connect(socket, (struct sockaddr *)
1756 &server->addr.sockAddr,
1757 sizeof(struct sockaddr_in), 0);
1758 if (rc >= 0)
1759 connected = true;
1760 }
1761
1762 if (!connected) {
1763 /* save original port so we can retry user specified port
1764 later if fall back ports fail this time */
1765 orig_port = server->addr.sockAddr.sin_port;
1766
1767 /* do not retry on the same port we just failed on */
1768 if (server->addr.sockAddr.sin_port != htons(CIFS_PORT)) {
1769 server->addr.sockAddr.sin_port = htons(CIFS_PORT);
1770 rc = socket->ops->connect(socket,
1771 (struct sockaddr *)
1772 &server->addr.sockAddr,
1773 sizeof(struct sockaddr_in), 0);
1774 if (rc >= 0)
1775 connected = true;
1776 }
1777 }
1778 if (!connected) {
1779 server->addr.sockAddr.sin_port = htons(RFC1001_PORT);
1780 rc = socket->ops->connect(socket, (struct sockaddr *)
1781 &server->addr.sockAddr,
1782 sizeof(struct sockaddr_in), 0);
1783 if (rc >= 0)
1784 connected = true;
1785 }
1786
1787 /* give up here - unless we want to retry on different
1788 protocol families some day */
1789 if (!connected) {
1790 if (orig_port)
1791 server->addr.sockAddr.sin_port = orig_port;
1792 cFYI(1, ("Error %d connecting to server via ipv4", rc));
1793 sock_release(socket);
1794 server->ssocket = NULL;
1795 return rc;
1796 }
1797
1798
1799 /*
1800 * Eventually check for other socket options to change from
1801 * the default. sock_setsockopt not used because it expects
1802 * user space buffer
1803 */
1804 socket->sk->sk_rcvtimeo = 7 * HZ;
1805 socket->sk->sk_sndtimeo = 5 * HZ;
1806
1807 /* make the bufsizes depend on wsize/rsize and max requests */
1808 if (server->noautotune) {
1809 if (socket->sk->sk_sndbuf < (200 * 1024))
1810 socket->sk->sk_sndbuf = 200 * 1024;
1811 if (socket->sk->sk_rcvbuf < (140 * 1024))
1812 socket->sk->sk_rcvbuf = 140 * 1024;
1813 }
1814
1815 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
1816 socket->sk->sk_sndbuf,
1817 socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo));
1818
1819 /* send RFC1001 sessinit */
1820 if (server->addr.sockAddr.sin_port == htons(RFC1001_PORT)) {
1821 /* some servers require RFC1001 sessinit before sending
1822 negprot - BB check reconnection in case where second
1823 sessinit is sent but no second negprot */
1824 struct rfc1002_session_packet *ses_init_buf;
1825 struct smb_hdr *smb_buf;
1826 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
1827 GFP_KERNEL);
1828 if (ses_init_buf) {
1829 ses_init_buf->trailer.session_req.called_len = 32;
1830 if (server->server_RFC1001_name &&
1831 server->server_RFC1001_name[0] != 0)
1832 rfc1002mangle(ses_init_buf->trailer.
1833 session_req.called_name,
1834 server->server_RFC1001_name,
1835 RFC1001_NAME_LEN_WITH_NULL);
1836 else
1837 rfc1002mangle(ses_init_buf->trailer.
1838 session_req.called_name,
1839 DEFAULT_CIFS_CALLED_NAME,
1840 RFC1001_NAME_LEN_WITH_NULL);
1841
1842 ses_init_buf->trailer.session_req.calling_len = 32;
1843
1844 /* calling name ends in null (byte 16) from old smb
1845 convention. */
1846 if (server->workstation_RFC1001_name &&
1847 server->workstation_RFC1001_name[0] != 0)
1848 rfc1002mangle(ses_init_buf->trailer.
1849 session_req.calling_name,
1850 server->workstation_RFC1001_name,
1851 RFC1001_NAME_LEN_WITH_NULL);
1852 else
1853 rfc1002mangle(ses_init_buf->trailer.
1854 session_req.calling_name,
1855 "LINUX_CIFS_CLNT",
1856 RFC1001_NAME_LEN_WITH_NULL);
1857
1858 ses_init_buf->trailer.session_req.scope1 = 0;
1859 ses_init_buf->trailer.session_req.scope2 = 0;
1860 smb_buf = (struct smb_hdr *)ses_init_buf;
1861 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1862 smb_buf->smb_buf_length = 0x81000044;
1863 rc = smb_send(server, smb_buf, 0x44);
1864 kfree(ses_init_buf);
1865 msleep(1); /* RFC1001 layer in at least one server
1866 requires very short break before negprot
1867 presumably because not expecting negprot
1868 to follow so fast. This is a simple
1869 solution that works without
1870 complicating the code and causes no
1871 significant slowing down on mount
1872 for everyone else */
1873 }
1874 /* else the negprot may still work without this
1875 even though malloc failed */
1876
1877 }
1878
1879 return rc;
1880 }
1881
1882 static int
1883 ipv6_connect(struct TCP_Server_Info *server)
1884 {
1885 int rc = 0;
1886 bool connected = false;
1887 __be16 orig_port = 0;
1888 struct socket *socket = server->ssocket;
1889
1890 if (socket == NULL) {
1891 rc = sock_create_kern(PF_INET6, SOCK_STREAM,
1892 IPPROTO_TCP, &socket);
1893 if (rc < 0) {
1894 cERROR(1, ("Error %d creating ipv6 socket", rc));
1895 socket = NULL;
1896 return rc;
1897 }
1898
1899 /* BB other socket options to set KEEPALIVE, NODELAY? */
1900 cFYI(1, ("ipv6 Socket created"));
1901 server->ssocket = socket;
1902 socket->sk->sk_allocation = GFP_NOFS;
1903 cifs_reclassify_socket6(socket);
1904 }
1905
1906 /* user overrode default port */
1907 if (server->addr.sockAddr6.sin6_port) {
1908 rc = socket->ops->connect(socket,
1909 (struct sockaddr *) &server->addr.sockAddr6,
1910 sizeof(struct sockaddr_in6), 0);
1911 if (rc >= 0)
1912 connected = true;
1913 }
1914
1915 if (!connected) {
1916 /* save original port so we can retry user specified port
1917 later if fall back ports fail this time */
1918
1919 orig_port = server->addr.sockAddr6.sin6_port;
1920 /* do not retry on the same port we just failed on */
1921 if (server->addr.sockAddr6.sin6_port != htons(CIFS_PORT)) {
1922 server->addr.sockAddr6.sin6_port = htons(CIFS_PORT);
1923 rc = socket->ops->connect(socket, (struct sockaddr *)
1924 &server->addr.sockAddr6,
1925 sizeof(struct sockaddr_in6), 0);
1926 if (rc >= 0)
1927 connected = true;
1928 }
1929 }
1930 if (!connected) {
1931 server->addr.sockAddr6.sin6_port = htons(RFC1001_PORT);
1932 rc = socket->ops->connect(socket, (struct sockaddr *)
1933 &server->addr.sockAddr6,
1934 sizeof(struct sockaddr_in6), 0);
1935 if (rc >= 0)
1936 connected = true;
1937 }
1938
1939 /* give up here - unless we want to retry on different
1940 protocol families some day */
1941 if (!connected) {
1942 if (orig_port)
1943 server->addr.sockAddr6.sin6_port = orig_port;
1944 cFYI(1, ("Error %d connecting to server via ipv6", rc));
1945 sock_release(socket);
1946 server->ssocket = NULL;
1947 return rc;
1948 }
1949
1950 /*
1951 * Eventually check for other socket options to change from
1952 * the default. sock_setsockopt not used because it expects
1953 * user space buffer
1954 */
1955 socket->sk->sk_rcvtimeo = 7 * HZ;
1956 socket->sk->sk_sndtimeo = 5 * HZ;
1957 server->ssocket = socket;
1958
1959 return rc;
1960 }
1961
1962 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
1963 struct super_block *sb, struct smb_vol *vol_info)
1964 {
1965 /* if we are reconnecting then should we check to see if
1966 * any requested capabilities changed locally e.g. via
1967 * remount but we can not do much about it here
1968 * if they have (even if we could detect it by the following)
1969 * Perhaps we could add a backpointer to array of sb from tcon
1970 * or if we change to make all sb to same share the same
1971 * sb as NFS - then we only have one backpointer to sb.
1972 * What if we wanted to mount the server share twice once with
1973 * and once without posixacls or posix paths? */
1974 __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1975
1976 if (vol_info && vol_info->no_linux_ext) {
1977 tcon->fsUnixInfo.Capability = 0;
1978 tcon->unix_ext = 0; /* Unix Extensions disabled */
1979 cFYI(1, ("Linux protocol extensions disabled"));
1980 return;
1981 } else if (vol_info)
1982 tcon->unix_ext = 1; /* Unix Extensions supported */
1983
1984 if (tcon->unix_ext == 0) {
1985 cFYI(1, ("Unix extensions disabled so not set on reconnect"));
1986 return;
1987 }
1988
1989 if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1990 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1991
1992 /* check for reconnect case in which we do not
1993 want to change the mount behavior if we can avoid it */
1994 if (vol_info == NULL) {
1995 /* turn off POSIX ACL and PATHNAMES if not set
1996 originally at mount time */
1997 if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1998 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1999 if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2000 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2001 cERROR(1, ("POSIXPATH support change"));
2002 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2003 } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2004 cERROR(1, ("possible reconnect error"));
2005 cERROR(1,
2006 ("server disabled POSIX path support"));
2007 }
2008 }
2009
2010 cap &= CIFS_UNIX_CAP_MASK;
2011 if (vol_info && vol_info->no_psx_acl)
2012 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2013 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2014 cFYI(1, ("negotiated posix acl support"));
2015 if (sb)
2016 sb->s_flags |= MS_POSIXACL;
2017 }
2018
2019 if (vol_info && vol_info->posix_paths == 0)
2020 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2021 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2022 cFYI(1, ("negotiate posix pathnames"));
2023 if (sb)
2024 CIFS_SB(sb)->mnt_cifs_flags |=
2025 CIFS_MOUNT_POSIX_PATHS;
2026 }
2027
2028 /* We might be setting the path sep back to a different
2029 form if we are reconnecting and the server switched its
2030 posix path capability for this share */
2031 if (sb && (CIFS_SB(sb)->prepathlen > 0))
2032 CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
2033
2034 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
2035 if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
2036 CIFS_SB(sb)->rsize = 127 * 1024;
2037 cFYI(DBG2,
2038 ("larger reads not supported by srv"));
2039 }
2040 }
2041
2042
2043 cFYI(1, ("Negotiate caps 0x%x", (int)cap));
2044 #ifdef CONFIG_CIFS_DEBUG2
2045 if (cap & CIFS_UNIX_FCNTL_CAP)
2046 cFYI(1, ("FCNTL cap"));
2047 if (cap & CIFS_UNIX_EXTATTR_CAP)
2048 cFYI(1, ("EXTATTR cap"));
2049 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2050 cFYI(1, ("POSIX path cap"));
2051 if (cap & CIFS_UNIX_XATTR_CAP)
2052 cFYI(1, ("XATTR cap"));
2053 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2054 cFYI(1, ("POSIX ACL cap"));
2055 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2056 cFYI(1, ("very large read cap"));
2057 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2058 cFYI(1, ("very large write cap"));
2059 #endif /* CIFS_DEBUG2 */
2060 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2061 if (vol_info == NULL) {
2062 cFYI(1, ("resetting capabilities failed"));
2063 } else
2064 cERROR(1, ("Negotiating Unix capabilities "
2065 "with the server failed. Consider "
2066 "mounting with the Unix Extensions\n"
2067 "disabled, if problems are found, "
2068 "by specifying the nounix mount "
2069 "option."));
2070
2071 }
2072 }
2073 }
2074
2075 static void
2076 convert_delimiter(char *path, char delim)
2077 {
2078 int i;
2079 char old_delim;
2080
2081 if (path == NULL)
2082 return;
2083
2084 if (delim == '/')
2085 old_delim = '\\';
2086 else
2087 old_delim = '/';
2088
2089 for (i = 0; path[i] != '\0'; i++) {
2090 if (path[i] == old_delim)
2091 path[i] = delim;
2092 }
2093 }
2094
2095 static void setup_cifs_sb(struct smb_vol *pvolume_info,
2096 struct cifs_sb_info *cifs_sb)
2097 {
2098 if (pvolume_info->rsize > CIFSMaxBufSize) {
2099 cERROR(1, ("rsize %d too large, using MaxBufSize",
2100 pvolume_info->rsize));
2101 cifs_sb->rsize = CIFSMaxBufSize;
2102 } else if ((pvolume_info->rsize) &&
2103 (pvolume_info->rsize <= CIFSMaxBufSize))
2104 cifs_sb->rsize = pvolume_info->rsize;
2105 else /* default */
2106 cifs_sb->rsize = CIFSMaxBufSize;
2107
2108 if (pvolume_info->wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2109 cERROR(1, ("wsize %d too large, using 4096 instead",
2110 pvolume_info->wsize));
2111 cifs_sb->wsize = 4096;
2112 } else if (pvolume_info->wsize)
2113 cifs_sb->wsize = pvolume_info->wsize;
2114 else
2115 cifs_sb->wsize = min_t(const int,
2116 PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2117 127*1024);
2118 /* old default of CIFSMaxBufSize was too small now
2119 that SMB Write2 can send multiple pages in kvec.
2120 RFC1001 does not describe what happens when frame
2121 bigger than 128K is sent so use that as max in
2122 conjunction with 52K kvec constraint on arch with 4K
2123 page size */
2124
2125 if (cifs_sb->rsize < 2048) {
2126 cifs_sb->rsize = 2048;
2127 /* Windows ME may prefer this */
2128 cFYI(1, ("readsize set to minimum: 2048"));
2129 }
2130 /* calculate prepath */
2131 cifs_sb->prepath = pvolume_info->prepath;
2132 if (cifs_sb->prepath) {
2133 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2134 /* we can not convert the / to \ in the path
2135 separators in the prefixpath yet because we do not
2136 know (until reset_cifs_unix_caps is called later)
2137 whether POSIX PATH CAP is available. We normalize
2138 the / to \ after reset_cifs_unix_caps is called */
2139 pvolume_info->prepath = NULL;
2140 } else
2141 cifs_sb->prepathlen = 0;
2142 cifs_sb->mnt_uid = pvolume_info->linux_uid;
2143 cifs_sb->mnt_gid = pvolume_info->linux_gid;
2144 cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2145 cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2146 cFYI(1, ("file mode: 0x%x dir mode: 0x%x",
2147 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
2148
2149 if (pvolume_info->noperm)
2150 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2151 if (pvolume_info->setuids)
2152 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2153 if (pvolume_info->server_ino)
2154 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2155 if (pvolume_info->remap)
2156 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2157 if (pvolume_info->no_xattr)
2158 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2159 if (pvolume_info->sfu_emul)
2160 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2161 if (pvolume_info->nobrl)
2162 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2163 if (pvolume_info->mand_lock)
2164 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2165 if (pvolume_info->cifs_acl)
2166 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2167 if (pvolume_info->override_uid)
2168 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2169 if (pvolume_info->override_gid)
2170 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2171 if (pvolume_info->dynperm)
2172 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2173 if (pvolume_info->direct_io) {
2174 cFYI(1, ("mounting share using direct i/o"));
2175 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2176 }
2177
2178 if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2179 cERROR(1, ("mount option dynperm ignored if cifsacl "
2180 "mount option supported"));
2181 }
2182
2183 int
2184 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
2185 char *mount_data, const char *devname)
2186 {
2187 int rc = 0;
2188 int xid;
2189 struct smb_vol *volume_info;
2190 struct cifsSesInfo *pSesInfo = NULL;
2191 struct cifsTconInfo *tcon = NULL;
2192 struct TCP_Server_Info *srvTcp = NULL;
2193
2194 xid = GetXid();
2195
2196 volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
2197 if (!volume_info) {
2198 rc = -ENOMEM;
2199 goto out;
2200 }
2201
2202 if (cifs_parse_mount_options(mount_data, devname, volume_info)) {
2203 rc = -EINVAL;
2204 goto out;
2205 }
2206
2207 if (volume_info->nullauth) {
2208 cFYI(1, ("null user"));
2209 volume_info->username = "";
2210 } else if (volume_info->username) {
2211 /* BB fixme parse for domain name here */
2212 cFYI(1, ("Username: %s", volume_info->username));
2213 } else {
2214 cifserror("No username specified");
2215 /* In userspace mount helper we can get user name from alternate
2216 locations such as env variables and files on disk */
2217 rc = -EINVAL;
2218 goto out;
2219 }
2220
2221
2222 /* this is needed for ASCII cp to Unicode converts */
2223 if (volume_info->iocharset == NULL) {
2224 cifs_sb->local_nls = load_nls_default();
2225 /* load_nls_default can not return null */
2226 } else {
2227 cifs_sb->local_nls = load_nls(volume_info->iocharset);
2228 if (cifs_sb->local_nls == NULL) {
2229 cERROR(1, ("CIFS mount error: iocharset %s not found",
2230 volume_info->iocharset));
2231 rc = -ELIBACC;
2232 goto out;
2233 }
2234 }
2235
2236 /* get a reference to a tcp session */
2237 srvTcp = cifs_get_tcp_session(volume_info);
2238 if (IS_ERR(srvTcp)) {
2239 rc = PTR_ERR(srvTcp);
2240 goto out;
2241 }
2242
2243 pSesInfo = cifs_find_smb_ses(srvTcp, volume_info->username);
2244 if (pSesInfo) {
2245 cFYI(1, ("Existing smb sess found (status=%d)",
2246 pSesInfo->status));
2247 /*
2248 * The existing SMB session already has a reference to srvTcp,
2249 * so we can put back the extra one we got before
2250 */
2251 cifs_put_tcp_session(srvTcp);
2252
2253 down(&pSesInfo->sesSem);
2254 if (pSesInfo->need_reconnect) {
2255 cFYI(1, ("Session needs reconnect"));
2256 rc = cifs_setup_session(xid, pSesInfo,
2257 cifs_sb->local_nls);
2258 }
2259 up(&pSesInfo->sesSem);
2260 } else if (!rc) {
2261 cFYI(1, ("Existing smb sess not found"));
2262 pSesInfo = sesInfoAlloc();
2263 if (pSesInfo == NULL) {
2264 rc = -ENOMEM;
2265 goto mount_fail_check;
2266 }
2267
2268 /* new SMB session uses our srvTcp ref */
2269 pSesInfo->server = srvTcp;
2270 if (srvTcp->addr.sockAddr6.sin6_family == AF_INET6)
2271 sprintf(pSesInfo->serverName, "%pI6",
2272 &srvTcp->addr.sockAddr6.sin6_addr);
2273 else
2274 sprintf(pSesInfo->serverName, "%pI4",
2275 &srvTcp->addr.sockAddr.sin_addr.s_addr);
2276
2277 write_lock(&cifs_tcp_ses_lock);
2278 list_add(&pSesInfo->smb_ses_list, &srvTcp->smb_ses_list);
2279 write_unlock(&cifs_tcp_ses_lock);
2280
2281 /* volume_info->password freed at unmount */
2282 if (volume_info->password) {
2283 pSesInfo->password = kstrdup(volume_info->password,
2284 GFP_KERNEL);
2285 if (!pSesInfo->password) {
2286 rc = -ENOMEM;
2287 goto mount_fail_check;
2288 }
2289 }
2290 if (volume_info->username)
2291 strncpy(pSesInfo->userName, volume_info->username,
2292 MAX_USERNAME_SIZE);
2293 if (volume_info->domainname) {
2294 int len = strlen(volume_info->domainname);
2295 pSesInfo->domainName = kmalloc(len + 1, GFP_KERNEL);
2296 if (pSesInfo->domainName)
2297 strcpy(pSesInfo->domainName,
2298 volume_info->domainname);
2299 }
2300 pSesInfo->linux_uid = volume_info->linux_uid;
2301 pSesInfo->overrideSecFlg = volume_info->secFlg;
2302 down(&pSesInfo->sesSem);
2303
2304 /* BB FIXME need to pass vol->secFlgs BB */
2305 rc = cifs_setup_session(xid, pSesInfo,
2306 cifs_sb->local_nls);
2307 up(&pSesInfo->sesSem);
2308 }
2309
2310 /* search for existing tcon to this server share */
2311 if (!rc) {
2312 setup_cifs_sb(volume_info, cifs_sb);
2313
2314 tcon = cifs_find_tcon(pSesInfo, volume_info->UNC);
2315 if (tcon) {
2316 cFYI(1, ("Found match on UNC path"));
2317 /* existing tcon already has a reference */
2318 cifs_put_smb_ses(pSesInfo);
2319 if (tcon->seal != volume_info->seal)
2320 cERROR(1, ("transport encryption setting "
2321 "conflicts with existing tid"));
2322 } else {
2323 tcon = tconInfoAlloc();
2324 if (tcon == NULL) {
2325 rc = -ENOMEM;
2326 goto mount_fail_check;
2327 }
2328
2329 tcon->ses = pSesInfo;
2330 if (volume_info->password) {
2331 tcon->password = kstrdup(volume_info->password,
2332 GFP_KERNEL);
2333 if (!tcon->password) {
2334 rc = -ENOMEM;
2335 goto mount_fail_check;
2336 }
2337 }
2338
2339 /* check for null share name ie connect to dfs root */
2340 if ((strchr(volume_info->UNC + 3, '\\') == NULL)
2341 && (strchr(volume_info->UNC + 3, '/') == NULL)) {
2342 /* rc = connect_to_dfs_path(...) */
2343 cFYI(1, ("DFS root not supported"));
2344 rc = -ENODEV;
2345 goto mount_fail_check;
2346 } else {
2347 /* BB Do we need to wrap sesSem around
2348 * this TCon call and Unix SetFS as
2349 * we do on SessSetup and reconnect? */
2350 rc = CIFSTCon(xid, pSesInfo, volume_info->UNC,
2351 tcon, cifs_sb->local_nls);
2352 cFYI(1, ("CIFS Tcon rc = %d", rc));
2353 if (volume_info->nodfs) {
2354 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2355 cFYI(1, ("DFS disabled (%d)",
2356 tcon->Flags));
2357 }
2358 }
2359 if (rc)
2360 goto mount_fail_check;
2361 tcon->seal = volume_info->seal;
2362 write_lock(&cifs_tcp_ses_lock);
2363 list_add(&tcon->tcon_list, &pSesInfo->tcon_list);
2364 write_unlock(&cifs_tcp_ses_lock);
2365 }
2366
2367 /* we can have only one retry value for a connection
2368 to a share so for resources mounted more than once
2369 to the same server share the last value passed in
2370 for the retry flag is used */
2371 tcon->retry = volume_info->retry;
2372 tcon->nocase = volume_info->nocase;
2373 tcon->local_lease = volume_info->local_lease;
2374 }
2375 if (pSesInfo) {
2376 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2377 sb->s_maxbytes = (u64) 1 << 63;
2378 } else
2379 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2380 }
2381
2382 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2383 sb->s_time_gran = 100;
2384
2385 mount_fail_check:
2386 /* on error free sesinfo and tcon struct if needed */
2387 if (rc) {
2388 /* If find_unc succeeded then rc == 0 so we can not end */
2389 /* up accidently freeing someone elses tcon struct */
2390 if (tcon)
2391 cifs_put_tcon(tcon);
2392 else if (pSesInfo)
2393 cifs_put_smb_ses(pSesInfo);
2394 else
2395 cifs_put_tcp_session(srvTcp);
2396 goto out;
2397 }
2398 cifs_sb->tcon = tcon;
2399
2400 /* do not care if following two calls succeed - informational */
2401 if (!tcon->ipc) {
2402 CIFSSMBQFSDeviceInfo(xid, tcon);
2403 CIFSSMBQFSAttributeInfo(xid, tcon);
2404 }
2405
2406 /* tell server which Unix caps we support */
2407 if (tcon->ses->capabilities & CAP_UNIX)
2408 /* reset of caps checks mount to see if unix extensions
2409 disabled for just this mount */
2410 reset_cifs_unix_caps(xid, tcon, sb, volume_info);
2411 else
2412 tcon->unix_ext = 0; /* server does not support them */
2413
2414 /* convert forward to back slashes in prepath here if needed */
2415 if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2416 convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
2417
2418 if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2419 cifs_sb->rsize = 1024 * 127;
2420 cFYI(DBG2, ("no very large read support, rsize now 127K"));
2421 }
2422 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2423 cifs_sb->wsize = min(cifs_sb->wsize,
2424 (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2425 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2426 cifs_sb->rsize = min(cifs_sb->rsize,
2427 (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2428
2429 /* volume_info->password is freed above when existing session found
2430 (in which case it is not needed anymore) but when new sesion is created
2431 the password ptr is put in the new session structure (in which case the
2432 password will be freed at unmount time) */
2433 out:
2434 /* zero out password before freeing */
2435 if (volume_info) {
2436 if (volume_info->password != NULL) {
2437 memset(volume_info->password, 0,
2438 strlen(volume_info->password));
2439 kfree(volume_info->password);
2440 }
2441 kfree(volume_info->UNC);
2442 kfree(volume_info->prepath);
2443 kfree(volume_info);
2444 }
2445 FreeXid(xid);
2446 return rc;
2447 }
2448
2449 static int
2450 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2451 char session_key[CIFS_SESS_KEY_SIZE],
2452 const struct nls_table *nls_codepage)
2453 {
2454 struct smb_hdr *smb_buffer;
2455 struct smb_hdr *smb_buffer_response;
2456 SESSION_SETUP_ANDX *pSMB;
2457 SESSION_SETUP_ANDX *pSMBr;
2458 char *bcc_ptr;
2459 char *user;
2460 char *domain;
2461 int rc = 0;
2462 int remaining_words = 0;
2463 int bytes_returned = 0;
2464 int len;
2465 __u32 capabilities;
2466 __u16 count;
2467
2468 cFYI(1, ("In sesssetup"));
2469 if (ses == NULL)
2470 return -EINVAL;
2471 user = ses->userName;
2472 domain = ses->domainName;
2473 smb_buffer = cifs_buf_get();
2474
2475 if (smb_buffer == NULL)
2476 return -ENOMEM;
2477
2478 smb_buffer_response = smb_buffer;
2479 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2480
2481 /* send SMBsessionSetup here */
2482 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2483 NULL /* no tCon exists yet */ , 13 /* wct */ );
2484
2485 smb_buffer->Mid = GetNextMid(ses->server);
2486 pSMB->req_no_secext.AndXCommand = 0xFF;
2487 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2488 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2489
2490 if (ses->server->secMode &
2491 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2492 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2493
2494 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2495 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2496 if (ses->capabilities & CAP_UNICODE) {
2497 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2498 capabilities |= CAP_UNICODE;
2499 }
2500 if (ses->capabilities & CAP_STATUS32) {
2501 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2502 capabilities |= CAP_STATUS32;
2503 }
2504 if (ses->capabilities & CAP_DFS) {
2505 smb_buffer->Flags2 |= SMBFLG2_DFS;
2506 capabilities |= CAP_DFS;
2507 }
2508 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2509
2510 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2511 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2512
2513 pSMB->req_no_secext.CaseSensitivePasswordLength =
2514 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2515 bcc_ptr = pByteArea(smb_buffer);
2516 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2517 bcc_ptr += CIFS_SESS_KEY_SIZE;
2518 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2519 bcc_ptr += CIFS_SESS_KEY_SIZE;
2520
2521 if (ses->capabilities & CAP_UNICODE) {
2522 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2523 *bcc_ptr = 0;
2524 bcc_ptr++;
2525 }
2526 if (user == NULL)
2527 bytes_returned = 0; /* skip null user */
2528 else
2529 bytes_returned =
2530 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2531 nls_codepage);
2532 /* convert number of 16 bit words to bytes */
2533 bcc_ptr += 2 * bytes_returned;
2534 bcc_ptr += 2; /* trailing null */
2535 if (domain == NULL)
2536 bytes_returned =
2537 cifs_strtoUCS((__le16 *) bcc_ptr,
2538 "CIFS_LINUX_DOM", 32, nls_codepage);
2539 else
2540 bytes_returned =
2541 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2542 nls_codepage);
2543 bcc_ptr += 2 * bytes_returned;
2544 bcc_ptr += 2;
2545 bytes_returned =
2546 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2547 32, nls_codepage);
2548 bcc_ptr += 2 * bytes_returned;
2549 bytes_returned =
2550 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2551 32, nls_codepage);
2552 bcc_ptr += 2 * bytes_returned;
2553 bcc_ptr += 2;
2554 bytes_returned =
2555 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2556 64, nls_codepage);
2557 bcc_ptr += 2 * bytes_returned;
2558 bcc_ptr += 2;
2559 } else {
2560 if (user != NULL) {
2561 strncpy(bcc_ptr, user, 200);
2562 bcc_ptr += strnlen(user, 200);
2563 }
2564 *bcc_ptr = 0;
2565 bcc_ptr++;
2566 if (domain == NULL) {
2567 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2568 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2569 } else {
2570 strncpy(bcc_ptr, domain, 64);
2571 bcc_ptr += strnlen(domain, 64);
2572 *bcc_ptr = 0;
2573 bcc_ptr++;
2574 }
2575 strcpy(bcc_ptr, "Linux version ");
2576 bcc_ptr += strlen("Linux version ");
2577 strcpy(bcc_ptr, utsname()->release);
2578 bcc_ptr += strlen(utsname()->release) + 1;
2579 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2580 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2581 }
2582 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2583 smb_buffer->smb_buf_length += count;
2584 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2585
2586 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2587 &bytes_returned, CIFS_LONG_OP);
2588 if (rc) {
2589 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2590 } else if ((smb_buffer_response->WordCount == 3)
2591 || (smb_buffer_response->WordCount == 4)) {
2592 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2593 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2594 if (action & GUEST_LOGIN)
2595 cFYI(1, ("Guest login")); /* BB mark SesInfo struct? */
2596 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
2597 (little endian) */
2598 cFYI(1, ("UID = %d ", ses->Suid));
2599 /* response can have either 3 or 4 word count - Samba sends 3 */
2600 bcc_ptr = pByteArea(smb_buffer_response);
2601 if ((pSMBr->resp.hdr.WordCount == 3)
2602 || ((pSMBr->resp.hdr.WordCount == 4)
2603 && (blob_len < pSMBr->resp.ByteCount))) {
2604 if (pSMBr->resp.hdr.WordCount == 4)
2605 bcc_ptr += blob_len;
2606
2607 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2608 if ((long) (bcc_ptr) % 2) {
2609 remaining_words =
2610 (BCC(smb_buffer_response) - 1) / 2;
2611 /* Unicode strings must be word
2612 aligned */
2613 bcc_ptr++;
2614 } else {
2615 remaining_words =
2616 BCC(smb_buffer_response) / 2;
2617 }
2618 len =
2619 UniStrnlen((wchar_t *) bcc_ptr,
2620 remaining_words - 1);
2621 /* We look for obvious messed up bcc or strings in response so we do not go off
2622 the end since (at least) WIN2K and Windows XP have a major bug in not null
2623 terminating last Unicode string in response */
2624 if (ses->serverOS)
2625 kfree(ses->serverOS);
2626 ses->serverOS = kzalloc(2 * (len + 1),
2627 GFP_KERNEL);
2628 if (ses->serverOS == NULL)
2629 goto sesssetup_nomem;
2630 cifs_strfromUCS_le(ses->serverOS,
2631 (__le16 *)bcc_ptr,
2632 len, nls_codepage);
2633 bcc_ptr += 2 * (len + 1);
2634 remaining_words -= len + 1;
2635 ses->serverOS[2 * len] = 0;
2636 ses->serverOS[1 + (2 * len)] = 0;
2637 if (remaining_words > 0) {
2638 len = UniStrnlen((wchar_t *)bcc_ptr,
2639 remaining_words-1);
2640 kfree(ses->serverNOS);
2641 ses->serverNOS = kzalloc(2 * (len + 1),
2642 GFP_KERNEL);
2643 if (ses->serverNOS == NULL)
2644 goto sesssetup_nomem;
2645 cifs_strfromUCS_le(ses->serverNOS,
2646 (__le16 *)bcc_ptr,
2647 len, nls_codepage);
2648 bcc_ptr += 2 * (len + 1);
2649 ses->serverNOS[2 * len] = 0;
2650 ses->serverNOS[1 + (2 * len)] = 0;
2651 if (strncmp(ses->serverNOS,
2652 "NT LAN Manager 4", 16) == 0) {
2653 cFYI(1, ("NT4 server"));
2654 ses->flags |= CIFS_SES_NT4;
2655 }
2656 remaining_words -= len + 1;
2657 if (remaining_words > 0) {
2658 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2659 /* last string is not always null terminated
2660 (for e.g. for Windows XP & 2000) */
2661 if (ses->serverDomain)
2662 kfree(ses->serverDomain);
2663 ses->serverDomain =
2664 kzalloc(2*(len+1),
2665 GFP_KERNEL);
2666 if (ses->serverDomain == NULL)
2667 goto sesssetup_nomem;
2668 cifs_strfromUCS_le(ses->serverDomain,
2669 (__le16 *)bcc_ptr,
2670 len, nls_codepage);
2671 bcc_ptr += 2 * (len + 1);
2672 ses->serverDomain[2*len] = 0;
2673 ses->serverDomain[1+(2*len)] = 0;
2674 } else { /* else no more room so create
2675 dummy domain string */
2676 if (ses->serverDomain)
2677 kfree(ses->serverDomain);
2678 ses->serverDomain =
2679 kzalloc(2, GFP_KERNEL);
2680 }
2681 } else { /* no room so create dummy domain
2682 and NOS string */
2683
2684 /* if these kcallocs fail not much we
2685 can do, but better to not fail the
2686 sesssetup itself */
2687 kfree(ses->serverDomain);
2688 ses->serverDomain =
2689 kzalloc(2, GFP_KERNEL);
2690 kfree(ses->serverNOS);
2691 ses->serverNOS =
2692 kzalloc(2, GFP_KERNEL);
2693 }
2694 } else { /* ASCII */
2695 len = strnlen(bcc_ptr, 1024);
2696 if (((long) bcc_ptr + len) - (long)
2697 pByteArea(smb_buffer_response)
2698 <= BCC(smb_buffer_response)) {
2699 kfree(ses->serverOS);
2700 ses->serverOS = kzalloc(len + 1,
2701 GFP_KERNEL);
2702 if (ses->serverOS == NULL)
2703 goto sesssetup_nomem;
2704 strncpy(ses->serverOS, bcc_ptr, len);
2705
2706 bcc_ptr += len;
2707 /* null terminate the string */
2708 bcc_ptr[0] = 0;
2709 bcc_ptr++;
2710
2711 len = strnlen(bcc_ptr, 1024);
2712 kfree(ses->serverNOS);
2713 ses->serverNOS = kzalloc(len + 1,
2714 GFP_KERNEL);
2715 if (ses->serverNOS == NULL)
2716 goto sesssetup_nomem;
2717 strncpy(ses->serverNOS, bcc_ptr, len);
2718 bcc_ptr += len;
2719 bcc_ptr[0] = 0;
2720 bcc_ptr++;
2721
2722 len = strnlen(bcc_ptr, 1024);
2723 if (ses->serverDomain)
2724 kfree(ses->serverDomain);
2725 ses->serverDomain = kzalloc(len + 1,
2726 GFP_KERNEL);
2727 if (ses->serverDomain == NULL)
2728 goto sesssetup_nomem;
2729 strncpy(ses->serverDomain, bcc_ptr,
2730 len);
2731 bcc_ptr += len;
2732 bcc_ptr[0] = 0;
2733 bcc_ptr++;
2734 } else
2735 cFYI(1,
2736 ("Variable field of length %d "
2737 "extends beyond end of smb ",
2738 len));
2739 }
2740 } else {
2741 cERROR(1, ("Security Blob Length extends beyond "
2742 "end of SMB"));
2743 }
2744 } else {
2745 cERROR(1, ("Invalid Word count %d: ",
2746 smb_buffer_response->WordCount));
2747 rc = -EIO;
2748 }
2749 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2750 since that could make reconnection harder, and
2751 reconnection might be needed to free memory */
2752 cifs_buf_release(smb_buffer);
2753
2754 return rc;
2755 }
2756
2757 static int
2758 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2759 struct cifsSesInfo *ses, bool *pNTLMv2_flag,
2760 const struct nls_table *nls_codepage)
2761 {
2762 struct smb_hdr *smb_buffer;
2763 struct smb_hdr *smb_buffer_response;
2764 SESSION_SETUP_ANDX *pSMB;
2765 SESSION_SETUP_ANDX *pSMBr;
2766 char *bcc_ptr;
2767 char *domain;
2768 int rc = 0;
2769 int remaining_words = 0;
2770 int bytes_returned = 0;
2771 int len;
2772 int SecurityBlobLength = sizeof(NEGOTIATE_MESSAGE);
2773 PNEGOTIATE_MESSAGE SecurityBlob;
2774 PCHALLENGE_MESSAGE SecurityBlob2;
2775 __u32 negotiate_flags, capabilities;
2776 __u16 count;
2777
2778 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2779 if (ses == NULL)
2780 return -EINVAL;
2781 domain = ses->domainName;
2782 *pNTLMv2_flag = false;
2783 smb_buffer = cifs_buf_get();
2784 if (smb_buffer == NULL) {
2785 return -ENOMEM;
2786 }
2787 smb_buffer_response = smb_buffer;
2788 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2789 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2790
2791 /* send SMBsessionSetup here */
2792 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2793 NULL /* no tCon exists yet */ , 12 /* wct */ );
2794
2795 smb_buffer->Mid = GetNextMid(ses->server);
2796 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2797 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2798
2799 pSMB->req.AndXCommand = 0xFF;
2800 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2801 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2802
2803 if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2804 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2805
2806 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2807 CAP_EXTENDED_SECURITY;
2808 if (ses->capabilities & CAP_UNICODE) {
2809 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2810 capabilities |= CAP_UNICODE;
2811 }
2812 if (ses->capabilities & CAP_STATUS32) {
2813 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2814 capabilities |= CAP_STATUS32;
2815 }
2816 if (ses->capabilities & CAP_DFS) {
2817 smb_buffer->Flags2 |= SMBFLG2_DFS;
2818 capabilities |= CAP_DFS;
2819 }
2820 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2821
2822 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2823 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2824 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2825 SecurityBlob->MessageType = NtLmNegotiate;
2826 negotiate_flags =
2827 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2828 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2829 NTLMSSP_NEGOTIATE_56 |
2830 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2831 if (sign_CIFS_PDUs)
2832 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2833 /* if (ntlmv2_support)
2834 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2835 /* setup pointers to domain name and workstation name */
2836 bcc_ptr += SecurityBlobLength;
2837
2838 SecurityBlob->WorkstationName.Buffer = 0;
2839 SecurityBlob->WorkstationName.Length = 0;
2840 SecurityBlob->WorkstationName.MaximumLength = 0;
2841
2842 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2843 along with username on auth request (ie the response to challenge) */
2844 SecurityBlob->DomainName.Buffer = 0;
2845 SecurityBlob->DomainName.Length = 0;
2846 SecurityBlob->DomainName.MaximumLength = 0;
2847 if (ses->capabilities & CAP_UNICODE) {
2848 if ((long) bcc_ptr % 2) {
2849 *bcc_ptr = 0;
2850 bcc_ptr++;
2851 }
2852
2853 bytes_returned =
2854 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2855 32, nls_codepage);
2856 bcc_ptr += 2 * bytes_returned;
2857 bytes_returned =
2858 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2859 nls_codepage);
2860 bcc_ptr += 2 * bytes_returned;
2861 bcc_ptr += 2; /* null terminate Linux version */
2862 bytes_returned =
2863 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2864 64, nls_codepage);
2865 bcc_ptr += 2 * bytes_returned;
2866 *(bcc_ptr + 1) = 0;
2867 *(bcc_ptr + 2) = 0;
2868 bcc_ptr += 2; /* null terminate network opsys string */
2869 *(bcc_ptr + 1) = 0;
2870 *(bcc_ptr + 2) = 0;
2871 bcc_ptr += 2; /* null domain */
2872 } else { /* ASCII */
2873 strcpy(bcc_ptr, "Linux version ");
2874 bcc_ptr += strlen("Linux version ");
2875 strcpy(bcc_ptr, utsname()->release);
2876 bcc_ptr += strlen(utsname()->release) + 1;
2877 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2878 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2879 bcc_ptr++; /* empty domain field */
2880 *bcc_ptr = 0;
2881 }
2882 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2883 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2884 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2885 smb_buffer->smb_buf_length += count;
2886 pSMB->req.ByteCount = cpu_to_le16(count);
2887
2888 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2889 &bytes_returned, CIFS_LONG_OP);
2890
2891 if (smb_buffer_response->Status.CifsError ==
2892 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2893 rc = 0;
2894
2895 if (rc) {
2896 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2897 } else if ((smb_buffer_response->WordCount == 3)
2898 || (smb_buffer_response->WordCount == 4)) {
2899 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2900 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2901
2902 if (action & GUEST_LOGIN)
2903 cFYI(1, ("Guest login"));
2904 /* Do we want to set anything in SesInfo struct when guest login? */
2905
2906 bcc_ptr = pByteArea(smb_buffer_response);
2907 /* response can have either 3 or 4 word count - Samba sends 3 */
2908
2909 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2910 if (SecurityBlob2->MessageType != NtLmChallenge) {
2911 cFYI(1, ("Unexpected NTLMSSP message type received %d",
2912 SecurityBlob2->MessageType));
2913 } else if (ses) {
2914 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2915 cFYI(1, ("UID = %d", ses->Suid));
2916 if ((pSMBr->resp.hdr.WordCount == 3)
2917 || ((pSMBr->resp.hdr.WordCount == 4)
2918 && (blob_len <
2919 pSMBr->resp.ByteCount))) {
2920
2921 if (pSMBr->resp.hdr.WordCount == 4) {
2922 bcc_ptr += blob_len;
2923 cFYI(1, ("Security Blob Length %d",
2924 blob_len));
2925 }
2926
2927 cFYI(1, ("NTLMSSP Challenge rcvd"));
2928
2929 memcpy(ses->server->cryptKey,
2930 SecurityBlob2->Challenge,
2931 CIFS_CRYPTO_KEY_SIZE);
2932 if (SecurityBlob2->NegotiateFlags &
2933 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2934 *pNTLMv2_flag = true;
2935
2936 if ((SecurityBlob2->NegotiateFlags &
2937 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2938 || (sign_CIFS_PDUs > 1))
2939 ses->server->secMode |=
2940 SECMODE_SIGN_REQUIRED;
2941 if ((SecurityBlob2->NegotiateFlags &
2942 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2943 ses->server->secMode |=
2944 SECMODE_SIGN_ENABLED;
2945
2946 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2947 if ((long) (bcc_ptr) % 2) {
2948 remaining_words =
2949 (BCC(smb_buffer_response)
2950 - 1) / 2;
2951 /* Must word align unicode strings */
2952 bcc_ptr++;
2953 } else {
2954 remaining_words =
2955 BCC
2956 (smb_buffer_response) / 2;
2957 }
2958 len =
2959 UniStrnlen((wchar_t *) bcc_ptr,
2960 remaining_words - 1);
2961 /* We look for obvious messed up bcc or strings in response so we do not go off
2962 the end since (at least) WIN2K and Windows XP have a major bug in not null
2963 terminating last Unicode string in response */
2964 if (ses->serverOS)
2965 kfree(ses->serverOS);
2966 ses->serverOS =
2967 kzalloc(2 * (len + 1), GFP_KERNEL);
2968 cifs_strfromUCS_le(ses->serverOS,
2969 (__le16 *)
2970 bcc_ptr, len,
2971 nls_codepage);
2972 bcc_ptr += 2 * (len + 1);
2973 remaining_words -= len + 1;
2974 ses->serverOS[2 * len] = 0;
2975 ses->serverOS[1 + (2 * len)] = 0;
2976 if (remaining_words > 0) {
2977 len = UniStrnlen((wchar_t *)
2978 bcc_ptr,
2979 remaining_words
2980 - 1);
2981 kfree(ses->serverNOS);
2982 ses->serverNOS =
2983 kzalloc(2 * (len + 1),
2984 GFP_KERNEL);
2985 cifs_strfromUCS_le(ses->
2986 serverNOS,
2987 (__le16 *)
2988 bcc_ptr,
2989 len,
2990 nls_codepage);
2991 bcc_ptr += 2 * (len + 1);
2992 ses->serverNOS[2 * len] = 0;
2993 ses->serverNOS[1 +
2994 (2 * len)] = 0;
2995 remaining_words -= len + 1;
2996 if (remaining_words > 0) {
2997 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2998 /* last string not always null terminated
2999 (for e.g. for Windows XP & 2000) */
3000 kfree(ses->serverDomain);
3001 ses->serverDomain =
3002 kzalloc(2 *
3003 (len +
3004 1),
3005 GFP_KERNEL);
3006 cifs_strfromUCS_le
3007 (ses->serverDomain,
3008 (__le16 *)bcc_ptr,
3009 len, nls_codepage);
3010 bcc_ptr +=
3011 2 * (len + 1);
3012 ses->serverDomain[2*len]
3013 = 0;
3014 ses->serverDomain
3015 [1 + (2 * len)]
3016 = 0;
3017 } /* else no more room so create dummy domain string */
3018 else {
3019 kfree(ses->serverDomain);
3020 ses->serverDomain =
3021 kzalloc(2,
3022 GFP_KERNEL);
3023 }
3024 } else { /* no room so create dummy domain and NOS string */
3025 kfree(ses->serverDomain);
3026 ses->serverDomain =
3027 kzalloc(2, GFP_KERNEL);
3028 kfree(ses->serverNOS);
3029 ses->serverNOS =
3030 kzalloc(2, GFP_KERNEL);
3031 }
3032 } else { /* ASCII */
3033 len = strnlen(bcc_ptr, 1024);
3034 if (((long) bcc_ptr + len) - (long)
3035 pByteArea(smb_buffer_response)
3036 <= BCC(smb_buffer_response)) {
3037 if (ses->serverOS)
3038 kfree(ses->serverOS);
3039 ses->serverOS =
3040 kzalloc(len + 1,
3041 GFP_KERNEL);
3042 strncpy(ses->serverOS,
3043 bcc_ptr, len);
3044
3045 bcc_ptr += len;
3046 bcc_ptr[0] = 0; /* null terminate string */
3047 bcc_ptr++;
3048
3049 len = strnlen(bcc_ptr, 1024);
3050 kfree(ses->serverNOS);
3051 ses->serverNOS =
3052 kzalloc(len + 1,
3053 GFP_KERNEL);
3054 strncpy(ses->serverNOS, bcc_ptr, len);
3055 bcc_ptr += len;
3056 bcc_ptr[0] = 0;
3057 bcc_ptr++;
3058
3059 len = strnlen(bcc_ptr, 1024);
3060 kfree(ses->serverDomain);
3061 ses->serverDomain =
3062 kzalloc(len + 1,
3063 GFP_KERNEL);
3064 strncpy(ses->serverDomain,
3065 bcc_ptr, len);
3066 bcc_ptr += len;
3067 bcc_ptr[0] = 0;
3068 bcc_ptr++;
3069 } else
3070 cFYI(1,
3071 ("field of length %d "
3072 "extends beyond end of smb",
3073 len));
3074 }
3075 } else {
3076 cERROR(1, ("Security Blob Length extends beyond"
3077 " end of SMB"));
3078 }
3079 } else {
3080 cERROR(1, ("No session structure passed in."));
3081 }
3082 } else {
3083 cERROR(1, ("Invalid Word count %d:",
3084 smb_buffer_response->WordCount));
3085 rc = -EIO;
3086 }
3087
3088 cifs_buf_release(smb_buffer);
3089
3090 return rc;
3091 }
3092 static int
3093 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
3094 char *ntlm_session_key, bool ntlmv2_flag,
3095 const struct nls_table *nls_codepage)
3096 {
3097 struct smb_hdr *smb_buffer;
3098 struct smb_hdr *smb_buffer_response;
3099 SESSION_SETUP_ANDX *pSMB;
3100 SESSION_SETUP_ANDX *pSMBr;
3101 char *bcc_ptr;
3102 char *user;
3103 char *domain;
3104 int rc = 0;
3105 int remaining_words = 0;
3106 int bytes_returned = 0;
3107 int len;
3108 int SecurityBlobLength = sizeof(AUTHENTICATE_MESSAGE);
3109 PAUTHENTICATE_MESSAGE SecurityBlob;
3110 __u32 negotiate_flags, capabilities;
3111 __u16 count;
3112
3113 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
3114 if (ses == NULL)
3115 return -EINVAL;
3116 user = ses->userName;
3117 domain = ses->domainName;
3118 smb_buffer = cifs_buf_get();
3119 if (smb_buffer == NULL) {
3120 return -ENOMEM;
3121 }
3122 smb_buffer_response = smb_buffer;
3123 pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
3124 pSMBr = (SESSION_SETUP_ANDX *)smb_buffer_response;
3125
3126 /* send SMBsessionSetup here */
3127 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
3128 NULL /* no tCon exists yet */ , 12 /* wct */ );
3129
3130 smb_buffer->Mid = GetNextMid(ses->server);
3131 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
3132 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
3133 pSMB->req.AndXCommand = 0xFF;
3134 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
3135 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
3136
3137 pSMB->req.hdr.Uid = ses->Suid;
3138
3139 if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3140 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3141
3142 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
3143 CAP_EXTENDED_SECURITY;
3144 if (ses->capabilities & CAP_UNICODE) {
3145 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3146 capabilities |= CAP_UNICODE;
3147 }
3148 if (ses->capabilities & CAP_STATUS32) {
3149 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3150 capabilities |= CAP_STATUS32;
3151 }
3152 if (ses->capabilities & CAP_DFS) {
3153 smb_buffer->Flags2 |= SMBFLG2_DFS;
3154 capabilities |= CAP_DFS;
3155 }
3156 pSMB->req.Capabilities = cpu_to_le32(capabilities);
3157
3158 bcc_ptr = (char *)&pSMB->req.SecurityBlob;
3159 SecurityBlob = (PAUTHENTICATE_MESSAGE)bcc_ptr;
3160 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
3161 SecurityBlob->MessageType = NtLmAuthenticate;
3162 bcc_ptr += SecurityBlobLength;
3163 negotiate_flags = NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
3164 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
3165 0x80000000 | NTLMSSP_NEGOTIATE_128;
3166 if (sign_CIFS_PDUs)
3167 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
3168 if (ntlmv2_flag)
3169 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
3170
3171 /* setup pointers to domain name and workstation name */
3172
3173 SecurityBlob->WorkstationName.Buffer = 0;
3174 SecurityBlob->WorkstationName.Length = 0;
3175 SecurityBlob->WorkstationName.MaximumLength = 0;
3176 SecurityBlob->SessionKey.Length = 0;
3177 SecurityBlob->SessionKey.MaximumLength = 0;
3178 SecurityBlob->SessionKey.Buffer = 0;
3179
3180 SecurityBlob->LmChallengeResponse.Length = 0;
3181 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
3182 SecurityBlob->LmChallengeResponse.Buffer = 0;
3183
3184 SecurityBlob->NtChallengeResponse.Length =
3185 cpu_to_le16(CIFS_SESS_KEY_SIZE);
3186 SecurityBlob->NtChallengeResponse.MaximumLength =
3187 cpu_to_le16(CIFS_SESS_KEY_SIZE);
3188 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
3189 SecurityBlob->NtChallengeResponse.Buffer =
3190 cpu_to_le32(SecurityBlobLength);
3191 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
3192 bcc_ptr += CIFS_SESS_KEY_SIZE;
3193
3194 if (ses->capabilities & CAP_UNICODE) {
3195 if (domain == NULL) {
3196 SecurityBlob->DomainName.Buffer = 0;
3197 SecurityBlob->DomainName.Length = 0;
3198 SecurityBlob->DomainName.MaximumLength = 0;
3199 } else {
3200 __u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
3201 nls_codepage);
3202 ln *= 2;
3203 SecurityBlob->DomainName.MaximumLength =
3204 cpu_to_le16(ln);
3205 SecurityBlob->DomainName.Buffer =
3206 cpu_to_le32(SecurityBlobLength);
3207 bcc_ptr += ln;
3208 SecurityBlobLength += ln;
3209 SecurityBlob->DomainName.Length = cpu_to_le16(ln);
3210 }
3211 if (user == NULL) {
3212 SecurityBlob->UserName.Buffer = 0;
3213 SecurityBlob->UserName.Length = 0;
3214 SecurityBlob->UserName.MaximumLength = 0;
3215 } else {
3216 __u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
3217 nls_codepage);
3218 ln *= 2;
3219 SecurityBlob->UserName.MaximumLength =
3220 cpu_to_le16(ln);
3221 SecurityBlob->UserName.Buffer =
3222 cpu_to_le32(SecurityBlobLength);
3223 bcc_ptr += ln;
3224 SecurityBlobLength += ln;
3225 SecurityBlob->UserName.Length = cpu_to_le16(ln);
3226 }
3227
3228 /* SecurityBlob->WorkstationName.Length =
3229 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
3230 SecurityBlob->WorkstationName.Length *= 2;
3231 SecurityBlob->WorkstationName.MaximumLength =
3232 cpu_to_le16(SecurityBlob->WorkstationName.Length);
3233 SecurityBlob->WorkstationName.Buffer =
3234 cpu_to_le32(SecurityBlobLength);
3235 bcc_ptr += SecurityBlob->WorkstationName.Length;
3236 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3237 SecurityBlob->WorkstationName.Length =
3238 cpu_to_le16(SecurityBlob->WorkstationName.Length); */
3239
3240 if ((long) bcc_ptr % 2) {
3241 *bcc_ptr = 0;
3242 bcc_ptr++;
3243 }
3244 bytes_returned =
3245 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
3246 32, nls_codepage);
3247 bcc_ptr += 2 * bytes_returned;
3248 bytes_returned =
3249 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
3250 nls_codepage);
3251 bcc_ptr += 2 * bytes_returned;
3252 bcc_ptr += 2; /* null term version string */
3253 bytes_returned =
3254 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
3255 64, nls_codepage);
3256 bcc_ptr += 2 * bytes_returned;
3257 *(bcc_ptr + 1) = 0;
3258 *(bcc_ptr + 2) = 0;
3259 bcc_ptr += 2; /* null terminate network opsys string */
3260 *(bcc_ptr + 1) = 0;
3261 *(bcc_ptr + 2) = 0;
3262 bcc_ptr += 2; /* null domain */
3263 } else { /* ASCII */
3264 if (domain == NULL) {
3265 SecurityBlob->DomainName.Buffer = 0;
3266 SecurityBlob->DomainName.Length = 0;
3267 SecurityBlob->DomainName.MaximumLength = 0;
3268 } else {
3269 __u16 ln;
3270 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
3271 strncpy(bcc_ptr, domain, 63);
3272 ln = strnlen(domain, 64);
3273 SecurityBlob->DomainName.MaximumLength =
3274 cpu_to_le16(ln);
3275 SecurityBlob->DomainName.Buffer =
3276 cpu_to_le32(SecurityBlobLength);
3277 bcc_ptr += ln;
3278 SecurityBlobLength += ln;
3279 SecurityBlob->DomainName.Length = cpu_to_le16(ln);
3280 }
3281 if (user == NULL) {
3282 SecurityBlob->UserName.Buffer = 0;
3283 SecurityBlob->UserName.Length = 0;
3284 SecurityBlob->UserName.MaximumLength = 0;
3285 } else {
3286 __u16 ln;
3287 strncpy(bcc_ptr, user, 63);
3288 ln = strnlen(user, 64);
3289 SecurityBlob->UserName.MaximumLength = cpu_to_le16(ln);
3290 SecurityBlob->UserName.Buffer =
3291 cpu_to_le32(SecurityBlobLength);
3292 bcc_ptr += ln;
3293 SecurityBlobLength += ln;
3294 SecurityBlob->UserName.Length = cpu_to_le16(ln);
3295 }
3296 /* BB fill in our workstation name if known BB */
3297
3298 strcpy(bcc_ptr, "Linux version ");
3299 bcc_ptr += strlen("Linux version ");
3300 strcpy(bcc_ptr, utsname()->release);
3301 bcc_ptr += strlen(utsname()->release) + 1;
3302 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
3303 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
3304 bcc_ptr++; /* null domain */
3305 *bcc_ptr = 0;
3306 }
3307 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
3308 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
3309 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
3310 smb_buffer->smb_buf_length += count;
3311 pSMB->req.ByteCount = cpu_to_le16(count);
3312
3313 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3314 &bytes_returned, CIFS_LONG_OP);
3315 if (rc) {
3316 /* rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
3317 } else if ((smb_buffer_response->WordCount == 3) ||
3318 (smb_buffer_response->WordCount == 4)) {
3319 __u16 action = le16_to_cpu(pSMBr->resp.Action);
3320 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
3321 if (action & GUEST_LOGIN)
3322 cFYI(1, ("Guest login")); /* BB Should we set anything
3323 in SesInfo struct ? */
3324 /* if (SecurityBlob2->MessageType != NtLm??) {
3325 cFYI("Unexpected message type on auth response is %d"));
3326 } */
3327
3328 if (ses) {
3329 cFYI(1,
3330 ("Check challenge UID %d vs auth response UID %d",
3331 ses->Suid, smb_buffer_response->Uid));
3332 /* UID left in wire format */
3333 ses->Suid = smb_buffer_response->Uid;
3334 bcc_ptr = pByteArea(smb_buffer_response);
3335 /* response can have either 3 or 4 word count - Samba sends 3 */
3336 if ((pSMBr->resp.hdr.WordCount == 3)
3337 || ((pSMBr->resp.hdr.WordCount == 4)
3338 && (blob_len <
3339 pSMBr->resp.ByteCount))) {
3340 if (pSMBr->resp.hdr.WordCount == 4) {
3341 bcc_ptr +=
3342 blob_len;
3343 cFYI(1,
3344 ("Security Blob Length %d ",
3345 blob_len));
3346 }
3347
3348 cFYI(1,
3349 ("NTLMSSP response to Authenticate "));
3350
3351 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3352 if ((long) (bcc_ptr) % 2) {
3353 remaining_words =
3354 (BCC(smb_buffer_response)
3355 - 1) / 2;
3356 bcc_ptr++; /* Unicode strings must be word aligned */
3357 } else {
3358 remaining_words = BCC(smb_buffer_response) / 2;
3359 }
3360 len = UniStrnlen((wchar_t *) bcc_ptr,
3361 remaining_words - 1);
3362 /* We look for obvious messed up bcc or strings in response so we do not go off
3363 the end since (at least) WIN2K and Windows XP have a major bug in not null
3364 terminating last Unicode string in response */
3365 if (ses->serverOS)
3366 kfree(ses->serverOS);
3367 ses->serverOS =
3368 kzalloc(2 * (len + 1), GFP_KERNEL);
3369 cifs_strfromUCS_le(ses->serverOS,
3370 (__le16 *)
3371 bcc_ptr, len,
3372 nls_codepage);
3373 bcc_ptr += 2 * (len + 1);
3374 remaining_words -= len + 1;
3375 ses->serverOS[2 * len] = 0;
3376 ses->serverOS[1 + (2 * len)] = 0;
3377 if (remaining_words > 0) {
3378 len = UniStrnlen((wchar_t *)
3379 bcc_ptr,
3380 remaining_words
3381 - 1);
3382 kfree(ses->serverNOS);
3383 ses->serverNOS =
3384 kzalloc(2 * (len + 1),
3385 GFP_KERNEL);
3386 cifs_strfromUCS_le(ses->
3387 serverNOS,
3388 (__le16 *)
3389 bcc_ptr,
3390 len,
3391 nls_codepage);
3392 bcc_ptr += 2 * (len + 1);
3393 ses->serverNOS[2 * len] = 0;
3394 ses->serverNOS[1+(2*len)] = 0;
3395 remaining_words -= len + 1;
3396 if (remaining_words > 0) {
3397 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3398 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3399 if (ses->serverDomain)
3400 kfree(ses->serverDomain);
3401 ses->serverDomain =
3402 kzalloc(2 *
3403 (len +
3404 1),
3405 GFP_KERNEL);
3406 cifs_strfromUCS_le
3407 (ses->
3408 serverDomain,
3409 (__le16 *)
3410 bcc_ptr, len,
3411 nls_codepage);
3412 bcc_ptr +=
3413 2 * (len + 1);
3414 ses->
3415 serverDomain[2
3416 * len]
3417 = 0;
3418 ses->
3419 serverDomain[1
3420 +
3421 (2
3422 *
3423 len)]
3424 = 0;
3425 } /* else no more room so create dummy domain string */
3426 else {
3427 if (ses->serverDomain)
3428 kfree(ses->serverDomain);
3429 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3430 }
3431 } else { /* no room so create dummy domain and NOS string */
3432 if (ses->serverDomain)
3433 kfree(ses->serverDomain);
3434 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3435 kfree(ses->serverNOS);
3436 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3437 }
3438 } else { /* ASCII */
3439 len = strnlen(bcc_ptr, 1024);
3440 if (((long) bcc_ptr + len) -
3441 (long) pByteArea(smb_buffer_response)
3442 <= BCC(smb_buffer_response)) {
3443 if (ses->serverOS)
3444 kfree(ses->serverOS);
3445 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
3446 strncpy(ses->serverOS,bcc_ptr, len);
3447
3448 bcc_ptr += len;
3449 bcc_ptr[0] = 0; /* null terminate the string */
3450 bcc_ptr++;
3451
3452 len = strnlen(bcc_ptr, 1024);
3453 kfree(ses->serverNOS);
3454 ses->serverNOS = kzalloc(len+1,
3455 GFP_KERNEL);
3456 strncpy(ses->serverNOS,
3457 bcc_ptr, len);
3458 bcc_ptr += len;
3459 bcc_ptr[0] = 0;
3460 bcc_ptr++;
3461
3462 len = strnlen(bcc_ptr, 1024);
3463 if (ses->serverDomain)
3464 kfree(ses->serverDomain);
3465 ses->serverDomain =
3466 kzalloc(len+1,
3467 GFP_KERNEL);
3468 strncpy(ses->serverDomain,
3469 bcc_ptr, len);
3470 bcc_ptr += len;
3471 bcc_ptr[0] = 0;
3472 bcc_ptr++;
3473 } else
3474 cFYI(1, ("field of length %d "
3475 "extends beyond end of smb ",
3476 len));
3477 }
3478 } else {
3479 cERROR(1, ("Security Blob extends beyond end "
3480 "of SMB"));
3481 }
3482 } else {
3483 cERROR(1, ("No session structure passed in."));
3484 }
3485 } else {
3486 cERROR(1, ("Invalid Word count %d: ",
3487 smb_buffer_response->WordCount));
3488 rc = -EIO;
3489 }
3490
3491 cifs_buf_release(smb_buffer);
3492
3493 return rc;
3494 }
3495
3496 int
3497 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3498 const char *tree, struct cifsTconInfo *tcon,
3499 const struct nls_table *nls_codepage)
3500 {
3501 struct smb_hdr *smb_buffer;
3502 struct smb_hdr *smb_buffer_response;
3503 TCONX_REQ *pSMB;
3504 TCONX_RSP *pSMBr;
3505 unsigned char *bcc_ptr;
3506 int rc = 0;
3507 int length;
3508 __u16 count;
3509
3510 if (ses == NULL)
3511 return -EIO;
3512
3513 smb_buffer = cifs_buf_get();
3514 if (smb_buffer == NULL) {
3515 return -ENOMEM;
3516 }
3517 smb_buffer_response = smb_buffer;
3518
3519 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3520 NULL /*no tid */ , 4 /*wct */ );
3521
3522 smb_buffer->Mid = GetNextMid(ses->server);
3523 smb_buffer->Uid = ses->Suid;
3524 pSMB = (TCONX_REQ *) smb_buffer;
3525 pSMBr = (TCONX_RSP *) smb_buffer_response;
3526
3527 pSMB->AndXCommand = 0xFF;
3528 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3529 bcc_ptr = &pSMB->Password[0];
3530 if ((ses->server->secMode) & SECMODE_USER) {
3531 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3532 *bcc_ptr = 0; /* password is null byte */
3533 bcc_ptr++; /* skip password */
3534 /* already aligned so no need to do it below */
3535 } else {
3536 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3537 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3538 specified as required (when that support is added to
3539 the vfs in the future) as only NTLM or the much
3540 weaker LANMAN (which we do not send by default) is accepted
3541 by Samba (not sure whether other servers allow
3542 NTLMv2 password here) */
3543 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3544 if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3545 (ses->server->secType == LANMAN))
3546 calc_lanman_hash(tcon->password, ses->server->cryptKey,
3547 ses->server->secMode &
3548 SECMODE_PW_ENCRYPT ? true : false,
3549 bcc_ptr);
3550 else
3551 #endif /* CIFS_WEAK_PW_HASH */
3552 SMBNTencrypt(tcon->password, ses->server->cryptKey,
3553 bcc_ptr);
3554
3555 bcc_ptr += CIFS_SESS_KEY_SIZE;
3556 if (ses->capabilities & CAP_UNICODE) {
3557 /* must align unicode strings */
3558 *bcc_ptr = 0; /* null byte password */
3559 bcc_ptr++;
3560 }
3561 }
3562
3563 if (ses->server->secMode &
3564 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3565 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3566
3567 if (ses->capabilities & CAP_STATUS32) {
3568 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3569 }
3570 if (ses->capabilities & CAP_DFS) {
3571 smb_buffer->Flags2 |= SMBFLG2_DFS;
3572 }
3573 if (ses->capabilities & CAP_UNICODE) {
3574 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3575 length =
3576 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3577 6 /* max utf8 char length in bytes */ *
3578 (/* server len*/ + 256 /* share len */), nls_codepage);
3579 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3580 bcc_ptr += 2; /* skip trailing null */
3581 } else { /* ASCII */
3582 strcpy(bcc_ptr, tree);
3583 bcc_ptr += strlen(tree) + 1;
3584 }
3585 strcpy(bcc_ptr, "?????");
3586 bcc_ptr += strlen("?????");
3587 bcc_ptr += 1;
3588 count = bcc_ptr - &pSMB->Password[0];
3589 pSMB->hdr.smb_buf_length += count;
3590 pSMB->ByteCount = cpu_to_le16(count);
3591
3592 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3593 CIFS_STD_OP);
3594
3595 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3596 /* above now done in SendReceive */
3597 if ((rc == 0) && (tcon != NULL)) {
3598 tcon->tidStatus = CifsGood;
3599 tcon->need_reconnect = false;
3600 tcon->tid = smb_buffer_response->Tid;
3601 bcc_ptr = pByteArea(smb_buffer_response);
3602 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3603 /* skip service field (NB: this field is always ASCII) */
3604 if (length == 3) {
3605 if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3606 (bcc_ptr[2] == 'C')) {
3607 cFYI(1, ("IPC connection"));
3608 tcon->ipc = 1;
3609 }
3610 } else if (length == 2) {
3611 if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3612 /* the most common case */
3613 cFYI(1, ("disk share connection"));
3614 }
3615 }
3616 bcc_ptr += length + 1;
3617 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3618 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3619 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3620 if ((bcc_ptr + (2 * length)) -
3621 pByteArea(smb_buffer_response) <=
3622 BCC(smb_buffer_response)) {
3623 kfree(tcon->nativeFileSystem);
3624 tcon->nativeFileSystem =
3625 kzalloc(length + 2, GFP_KERNEL);
3626 if (tcon->nativeFileSystem)
3627 cifs_strfromUCS_le(
3628 tcon->nativeFileSystem,
3629 (__le16 *) bcc_ptr,
3630 length, nls_codepage);
3631 bcc_ptr += 2 * length;
3632 bcc_ptr[0] = 0; /* null terminate the string */
3633 bcc_ptr[1] = 0;
3634 bcc_ptr += 2;
3635 }
3636 /* else do not bother copying these information fields*/
3637 } else {
3638 length = strnlen(bcc_ptr, 1024);
3639 if ((bcc_ptr + length) -
3640 pByteArea(smb_buffer_response) <=
3641 BCC(smb_buffer_response)) {
3642 kfree(tcon->nativeFileSystem);
3643 tcon->nativeFileSystem =
3644 kzalloc(length + 1, GFP_KERNEL);
3645 if (tcon->nativeFileSystem)
3646 strncpy(tcon->nativeFileSystem, bcc_ptr,
3647 length);
3648 }
3649 /* else do not bother copying these information fields*/
3650 }
3651 if ((smb_buffer_response->WordCount == 3) ||
3652 (smb_buffer_response->WordCount == 7))
3653 /* field is in same location */
3654 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3655 else
3656 tcon->Flags = 0;
3657 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3658 } else if ((rc == 0) && tcon == NULL) {
3659 /* all we need to save for IPC$ connection */
3660 ses->ipc_tid = smb_buffer_response->Tid;
3661 }
3662
3663 cifs_buf_release(smb_buffer);
3664 return rc;
3665 }
3666
3667 int
3668 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3669 {
3670 int rc = 0;
3671 char *tmp;
3672
3673 if (cifs_sb->tcon)
3674 cifs_put_tcon(cifs_sb->tcon);
3675
3676 cifs_sb->tcon = NULL;
3677 tmp = cifs_sb->prepath;
3678 cifs_sb->prepathlen = 0;
3679 cifs_sb->prepath = NULL;
3680 kfree(tmp);
3681
3682 return rc;
3683 }
3684
3685 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3686 struct nls_table *nls_info)
3687 {
3688 int rc = 0;
3689 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3690 bool ntlmv2_flag = false;
3691 int first_time = 0;
3692 struct TCP_Server_Info *server = pSesInfo->server;
3693
3694 /* what if server changes its buffer size after dropping the session? */
3695 if (server->maxBuf == 0) /* no need to send on reconnect */ {
3696 rc = CIFSSMBNegotiate(xid, pSesInfo);
3697 if (rc == -EAGAIN) {
3698 /* retry only once on 1st time connection */
3699 rc = CIFSSMBNegotiate(xid, pSesInfo);
3700 if (rc == -EAGAIN)
3701 rc = -EHOSTDOWN;
3702 }
3703 if (rc == 0) {
3704 spin_lock(&GlobalMid_Lock);
3705 if (server->tcpStatus != CifsExiting)
3706 server->tcpStatus = CifsGood;
3707 else
3708 rc = -EHOSTDOWN;
3709 spin_unlock(&GlobalMid_Lock);
3710
3711 }
3712 first_time = 1;
3713 }
3714
3715 if (rc)
3716 goto ss_err_exit;
3717
3718 pSesInfo->flags = 0;
3719 pSesInfo->capabilities = server->capabilities;
3720 if (linuxExtEnabled == 0)
3721 pSesInfo->capabilities &= (~CAP_UNIX);
3722 /* pSesInfo->sequence_number = 0;*/
3723 cFYI(1, ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3724 server->secMode, server->capabilities, server->timeAdj));
3725
3726 if (experimEnabled < 2)
3727 rc = CIFS_SessSetup(xid, pSesInfo, first_time, nls_info);
3728 else if (extended_security
3729 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3730 && (server->secType == NTLMSSP)) {
3731 rc = -EOPNOTSUPP;
3732 } else if (extended_security
3733 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3734 && (server->secType == RawNTLMSSP)) {
3735 cFYI(1, ("NTLMSSP sesssetup"));
3736 rc = CIFSNTLMSSPNegotiateSessSetup(xid, pSesInfo, &ntlmv2_flag,
3737 nls_info);
3738 if (!rc) {
3739 if (ntlmv2_flag) {
3740 char *v2_response;
3741 cFYI(1, ("more secure NTLM ver2 hash"));
3742 if (CalcNTLMv2_partial_mac_key(pSesInfo,
3743 nls_info)) {
3744 rc = -ENOMEM;
3745 goto ss_err_exit;
3746 } else
3747 v2_response = kmalloc(16 + 64 /* blob*/,
3748 GFP_KERNEL);
3749 if (v2_response) {
3750 CalcNTLMv2_response(pSesInfo,
3751 v2_response);
3752 /* if (first_time)
3753 cifs_calculate_ntlmv2_mac_key */
3754 kfree(v2_response);
3755 /* BB Put dummy sig in SessSetup PDU? */
3756 } else {
3757 rc = -ENOMEM;
3758 goto ss_err_exit;
3759 }
3760
3761 } else {
3762 SMBNTencrypt(pSesInfo->password,
3763 server->cryptKey,
3764 ntlm_session_key);
3765
3766 if (first_time)
3767 cifs_calculate_mac_key(
3768 &server->mac_signing_key,
3769 ntlm_session_key,
3770 pSesInfo->password);
3771 }
3772 /* for better security the weaker lanman hash not sent
3773 in AuthSessSetup so we no longer calculate it */
3774
3775 rc = CIFSNTLMSSPAuthSessSetup(xid, pSesInfo,
3776 ntlm_session_key,
3777 ntlmv2_flag,
3778 nls_info);
3779 }
3780 } else { /* old style NTLM 0.12 session setup */
3781 SMBNTencrypt(pSesInfo->password, server->cryptKey,
3782 ntlm_session_key);
3783
3784 if (first_time)
3785 cifs_calculate_mac_key(&server->mac_signing_key,
3786 ntlm_session_key,
3787 pSesInfo->password);
3788
3789 rc = CIFSSessSetup(xid, pSesInfo, ntlm_session_key, nls_info);
3790 }
3791 if (rc) {
3792 cERROR(1, ("Send error in SessSetup = %d", rc));
3793 } else {
3794 cFYI(1, ("CIFS Session Established successfully"));
3795 spin_lock(&GlobalMid_Lock);
3796 pSesInfo->status = CifsGood;
3797 pSesInfo->need_reconnect = false;
3798 spin_unlock(&GlobalMid_Lock);
3799 }
3800
3801 ss_err_exit:
3802 return rc;
3803 }
3804
Support for the Chinese Samsung S3C2440 based development boards