connect.c 107.4 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 *   fs/cifs/connect.c
 *
4
 *   Copyright (C) International Business Machines  Corp., 2002,2007
L
Linus Torvalds 已提交
5 6 7 8 9 10 11 12 13 14 15 16 17 18
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   This library is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published
 *   by the Free Software Foundation; either version 2.1 of the License, or
 *   (at your option) any later version.
 *
 *   This library is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
 *   along with this library; if not, write to the Free Software
S
Steve French 已提交
19
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
L
Linus Torvalds 已提交
20 21 22 23 24 25 26 27 28 29 30
 */
#include <linux/fs.h>
#include <linux/net.h>
#include <linux/string.h>
#include <linux/list.h>
#include <linux/wait.h>
#include <linux/ipv6.h>
#include <linux/pagemap.h>
#include <linux/ctype.h>
#include <linux/utsname.h>
#include <linux/mempool.h>
31
#include <linux/delay.h>
32
#include <linux/completion.h>
33
#include <linux/kthread.h>
34
#include <linux/pagevec.h>
35
#include <linux/freezer.h>
L
Linus Torvalds 已提交
36 37 38 39 40 41 42 43 44 45 46
#include <asm/uaccess.h>
#include <asm/processor.h>
#include "cifspdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "cifs_unicode.h"
#include "cifs_debug.h"
#include "cifs_fs_sb.h"
#include "ntlmssp.h"
#include "nterr.h"
#include "rfc1002pdu.h"
47
#include "cn_cifs.h"
L
Linus Torvalds 已提交
48 49 50 51

#define CIFS_PORT 445
#define RFC1001_PORT 139

52 53
static DECLARE_COMPLETION(cifsd_complete);

L
Linus Torvalds 已提交
54 55 56 57 58 59 60 61 62 63 64 65 66 67
extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
			 unsigned char *p24);

extern mempool_t *cifs_req_poolp;

struct smb_vol {
	char *username;
	char *password;
	char *domainname;
	char *UNC;
	char *UNCip;
	char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
	char *iocharset;  /* local code page for mapping to and from Unicode */
	char source_rfc1001_name[16]; /* netbios name of client */
68
	char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
L
Linus Torvalds 已提交
69 70 71 72
	uid_t linux_uid;
	gid_t linux_gid;
	mode_t file_mode;
	mode_t dir_mode;
73
	unsigned secFlg;
L
Linus Torvalds 已提交
74 75 76 77
	unsigned rw:1;
	unsigned retry:1;
	unsigned intr:1;
	unsigned setuids:1;
78 79
	unsigned override_uid:1;
	unsigned override_gid:1;
L
Linus Torvalds 已提交
80 81
	unsigned noperm:1;
	unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
82
	unsigned cifs_acl:1;
L
Linus Torvalds 已提交
83 84 85
	unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
	unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
	unsigned direct_io:1;
86
	unsigned remap:1;   /* set to remap seven reserved chars in filenames */
87
	unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
88
	unsigned no_linux_ext:1;
89
	unsigned sfu_emul:1;
90
	unsigned nullauth:1; /* attempt to authenticate with null user */
91 92
	unsigned nocase;     /* request case insensitive filenames */
	unsigned nobrl;      /* disable sending byte range locks to srv */
L
Linus Torvalds 已提交
93 94 95 96
	unsigned int rsize;
	unsigned int wsize;
	unsigned int sockopt;
	unsigned short int port;
S
Steve French 已提交
97
	char *prepath;
L
Linus Torvalds 已提交
98 99
};

S
Steve French 已提交
100
static int ipv4_connect(struct sockaddr_in *psin_server,
L
Linus Torvalds 已提交
101
			struct socket **csocket,
S
Steve French 已提交
102 103 104
			char *netb_name,
			char *server_netb_name);
static int ipv6_connect(struct sockaddr_in6 *psin_server,
L
Linus Torvalds 已提交
105 106 107
			struct socket **csocket);


S
Steve French 已提交
108
	/*
L
Linus Torvalds 已提交
109
	 * cifs tcp session reconnection
S
Steve French 已提交
110
	 *
L
Linus Torvalds 已提交
111 112 113 114 115 116
	 * mark tcp session as reconnecting so temporarily locked
	 * mark all smb sessions as reconnecting for tcp session
	 * reconnect tcp session
	 * wake up waiters on reconnection? - (not needed currently)
	 */

117
static int
L
Linus Torvalds 已提交
118 119 120 121 122 123
cifs_reconnect(struct TCP_Server_Info *server)
{
	int rc = 0;
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	struct cifsTconInfo *tcon;
S
Steve French 已提交
124
	struct mid_q_entry *mid_entry;
125

L
Linus Torvalds 已提交
126
	spin_lock(&GlobalMid_Lock);
127
	if (kthread_should_stop()) {
S
Steve French 已提交
128
		/* the demux thread will exit normally
L
Linus Torvalds 已提交
129 130 131 132 133 134 135 136
		next time through the loop */
		spin_unlock(&GlobalMid_Lock);
		return rc;
	} else
		server->tcpStatus = CifsNeedReconnect;
	spin_unlock(&GlobalMid_Lock);
	server->maxBuf = 0;

137
	cFYI(1, ("Reconnecting tcp session"));
L
Linus Torvalds 已提交
138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153

	/* before reconnecting the tcp session, mark the smb session (uid)
		and the tid bad so they are not used until reconnected */
	read_lock(&GlobalSMBSeslock);
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
		if (ses->server) {
			if (ses->server == server) {
				ses->status = CifsNeedReconnect;
				ses->ipc_tid = 0;
			}
		}
		/* else tcp and smb sessions need reconnection */
	}
	list_for_each(tmp, &GlobalTreeConnectionList) {
		tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
154
		if ((tcon) && (tcon->ses) && (tcon->ses->server == server))
L
Linus Torvalds 已提交
155 156 157 158
			tcon->tidStatus = CifsNeedReconnect;
	}
	read_unlock(&GlobalSMBSeslock);
	/* do not want to be sending data on a socket we are freeing */
S
Steve French 已提交
159 160
	down(&server->tcpSem);
	if (server->ssocket) {
S
Steve French 已提交
161
		cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
L
Linus Torvalds 已提交
162
			server->ssocket->flags));
163
		kernel_sock_shutdown(server->ssocket, SHUT_WR);
S
Steve French 已提交
164
		cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
S
Steve French 已提交
165
			server->ssocket->state,
L
Linus Torvalds 已提交
166 167 168 169 170 171 172 173 174 175
			server->ssocket->flags));
		sock_release(server->ssocket);
		server->ssocket = NULL;
	}

	spin_lock(&GlobalMid_Lock);
	list_for_each(tmp, &server->pending_mid_q) {
		mid_entry = list_entry(tmp, struct
					mid_q_entry,
					qhead);
S
Steve French 已提交
176 177
		if (mid_entry) {
			if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
178 179 180 181
				/* Mark other intransit requests as needing
				   retry so we do not immediately mark the
				   session bad again (ie after we reconnect
				   below) as they timeout too */
L
Linus Torvalds 已提交
182 183 184 185 186
				mid_entry->midState = MID_RETRY_NEEDED;
			}
		}
	}
	spin_unlock(&GlobalMid_Lock);
S
Steve French 已提交
187
	up(&server->tcpSem);
L
Linus Torvalds 已提交
188

189
	while ((!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
190
		try_to_freeze();
S
Steve French 已提交
191 192 193
		if (server->protocolType == IPV6) {
			rc = ipv6_connect(&server->addr.sockAddr6,
					  &server->ssocket);
L
Linus Torvalds 已提交
194
		} else {
S
Steve French 已提交
195
			rc = ipv4_connect(&server->addr.sockAddr,
L
Linus Torvalds 已提交
196
					&server->ssocket,
197 198
					server->workstation_RFC1001_name,
					server->server_RFC1001_name);
L
Linus Torvalds 已提交
199
		}
S
Steve French 已提交
200 201
		if (rc) {
			cFYI(1, ("reconnect error %d", rc));
202
			msleep(3000);
L
Linus Torvalds 已提交
203 204 205
		} else {
			atomic_inc(&tcpSesReconnectCount);
			spin_lock(&GlobalMid_Lock);
206
			if (!kthread_should_stop())
L
Linus Torvalds 已提交
207
				server->tcpStatus = CifsGood;
208
			server->sequence_number = 0;
S
Steve French 已提交
209
			spin_unlock(&GlobalMid_Lock);
L
Linus Torvalds 已提交
210 211 212 213 214 215 216
	/*		atomic_set(&server->inFlight,0);*/
			wake_up(&server->response_q);
		}
	}
	return rc;
}

S
Steve French 已提交
217
/*
218 219 220 221 222 223
	return codes:
		0 	not a transact2, or all data present
		>0 	transact2 with that much data missing
		-EINVAL = invalid transact2

 */
S
Steve French 已提交
224
static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
225
{
S
Steve French 已提交
226 227
	struct smb_t2_rsp *pSMBt;
	int total_data_size;
228 229 230
	int data_in_this_rsp;
	int remaining;

S
Steve French 已提交
231
	if (pSMB->Command != SMB_COM_TRANSACTION2)
232 233
		return 0;

S
Steve French 已提交
234 235 236
	/* check for plausible wct, bcc and t2 data and parm sizes */
	/* check for parm and data offset going beyond end of smb */
	if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
S
Steve French 已提交
237
		cFYI(1, ("invalid transact2 word count"));
238 239 240 241 242 243 244 245 246 247
		return -EINVAL;
	}

	pSMBt = (struct smb_t2_rsp *)pSMB;

	total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
	data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);

	remaining = total_data_size - data_in_this_rsp;

S
Steve French 已提交
248
	if (remaining == 0)
249
		return 0;
S
Steve French 已提交
250
	else if (remaining < 0) {
S
Steve French 已提交
251
		cFYI(1, ("total data %d smaller than data in frame %d",
252 253 254
			total_data_size, data_in_this_rsp));
		return -EINVAL;
	} else {
S
Steve French 已提交
255
		cFYI(1, ("missing %d bytes from transact2, check next response",
256
			remaining));
S
Steve French 已提交
257 258 259 260
		if (total_data_size > maxBufSize) {
			cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
				total_data_size, maxBufSize));
			return -EINVAL;
261 262 263 264 265
		}
		return remaining;
	}
}

S
Steve French 已提交
266
static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
267 268 269 270 271 272 273
{
	struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
	struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
	int total_data_size;
	int total_in_buf;
	int remaining;
	int total_in_buf2;
S
Steve French 已提交
274 275
	char *data_area_of_target;
	char *data_area_of_buf2;
276 277 278 279
	__u16 byte_count;

	total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);

S
Steve French 已提交
280
	if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
281
		cFYI(1, ("total data size of primary and secondary t2 differ"));
282 283 284 285 286
	}

	total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);

	remaining = total_data_size - total_in_buf;
287

S
Steve French 已提交
288
	if (remaining < 0)
289 290
		return -EINVAL;

S
Steve French 已提交
291
	if (remaining == 0) /* nothing to do, ignore */
292
		return 0;
293

294
	total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
S
Steve French 已提交
295
	if (remaining < total_in_buf2) {
S
Steve French 已提交
296
		cFYI(1, ("transact2 2nd response contains too much data"));
297 298 299
	}

	/* find end of first SMB data area */
S
Steve French 已提交
300
	data_area_of_target = (char *)&pSMBt->hdr.Protocol +
301 302 303 304
				le16_to_cpu(pSMBt->t2_rsp.DataOffset);
	/* validate target area */

	data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
S
Steve French 已提交
305
					le16_to_cpu(pSMB2->t2_rsp.DataOffset);
306 307 308 309

	data_area_of_target += total_in_buf;

	/* copy second buffer into end of first buffer */
S
Steve French 已提交
310
	memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
311 312 313 314 315 316
	total_in_buf += total_in_buf2;
	pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
	byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
	byte_count += total_in_buf2;
	BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);

317
	byte_count = pTargetSMB->smb_buf_length;
318 319 320
	byte_count += total_in_buf2;

	/* BB also add check that we are not beyond maximum buffer size */
321

322
	pTargetSMB->smb_buf_length = byte_count;
323

S
Steve French 已提交
324
	if (remaining == total_in_buf2) {
S
Steve French 已提交
325
		cFYI(1, ("found the last secondary response"));
326 327 328 329 330 331
		return 0; /* we are done */
	} else /* more responses to go */
		return 1;

}

L
Linus Torvalds 已提交
332 333 334 335 336 337
static int
cifs_demultiplex_thread(struct TCP_Server_Info *server)
{
	int length;
	unsigned int pdu_length, total_read;
	struct smb_hdr *smb_buffer = NULL;
338 339
	struct smb_hdr *bigbuf = NULL;
	struct smb_hdr *smallbuf = NULL;
L
Linus Torvalds 已提交
340 341 342 343 344 345 346
	struct msghdr smb_msg;
	struct kvec iov;
	struct socket *csocket = server->ssocket;
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	struct task_struct *task_to_wake = NULL;
	struct mid_q_entry *mid_entry;
347
	char temp;
348
	int isLargeBuf = FALSE;
349 350
	int isMultiRsp;
	int reconnect;
L
Linus Torvalds 已提交
351 352 353

	current->flags |= PF_MEMALLOC;
	server->tsk = current;	/* save process info to wake at shutdown */
354
	cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current)));
S
Steve French 已提交
355
	write_lock(&GlobalSMBSeslock);
L
Linus Torvalds 已提交
356 357 358
	atomic_inc(&tcpSesAllocCount);
	length = tcpSesAllocCount.counter;
	write_unlock(&GlobalSMBSeslock);
359
	complete(&cifsd_complete);
360 361 362
	if (length  > 1)
		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
				GFP_KERNEL);
L
Linus Torvalds 已提交
363

364
	set_freezable();
365
	while (!kthread_should_stop()) {
366 367
		if (try_to_freeze())
			continue;
368 369
		if (bigbuf == NULL) {
			bigbuf = cifs_buf_get();
370 371
			if (!bigbuf) {
				cERROR(1, ("No memory for large SMB response"));
372 373 374 375
				msleep(3000);
				/* retry will check if exiting */
				continue;
			}
376 377
		} else if (isLargeBuf) {
			/* we are reusing a dirty large buf, clear its start */
378
			memset(bigbuf, 0, sizeof(struct smb_hdr));
L
Linus Torvalds 已提交
379
		}
380 381 382

		if (smallbuf == NULL) {
			smallbuf = cifs_small_buf_get();
383 384
			if (!smallbuf) {
				cERROR(1, ("No memory for SMB response"));
385 386 387 388 389 390
				msleep(1000);
				/* retry will check if exiting */
				continue;
			}
			/* beginning of smb buffer is cleared in our buf_get */
		} else /* if existing small buf clear beginning */
391
			memset(smallbuf, 0, sizeof(struct smb_hdr));
392 393

		isLargeBuf = FALSE;
394
		isMultiRsp = FALSE;
395
		smb_buffer = smallbuf;
L
Linus Torvalds 已提交
396 397 398 399
		iov.iov_base = smb_buffer;
		iov.iov_len = 4;
		smb_msg.msg_control = NULL;
		smb_msg.msg_controllen = 0;
400 401
		pdu_length = 4; /* enough to get RFC1001 header */
incomplete_rcv:
L
Linus Torvalds 已提交
402 403
		length =
		    kernel_recvmsg(csocket, &smb_msg,
404
				&iov, 1, pdu_length, 0 /* BB other flags? */);
L
Linus Torvalds 已提交
405

406
		if (kthread_should_stop()) {
L
Linus Torvalds 已提交
407 408
			break;
		} else if (server->tcpStatus == CifsNeedReconnect) {
409
			cFYI(1, ("Reconnect after server stopped responding"));
L
Linus Torvalds 已提交
410
			cifs_reconnect(server);
411
			cFYI(1, ("call to reconnect done"));
L
Linus Torvalds 已提交
412 413 414
			csocket = server->ssocket;
			continue;
		} else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
415
			msleep(1); /* minimum sleep to prevent looping
L
Linus Torvalds 已提交
416 417
				allowing socket to clear and app threads to set
				tcpStatus CifsNeedReconnect if server hung */
418 419 420 421
			if (pdu_length < 4)
				goto incomplete_rcv;
			else
				continue;
L
Linus Torvalds 已提交
422
		} else if (length <= 0) {
423 424
			if (server->tcpStatus == CifsNew) {
				cFYI(1, ("tcp session abend after SMBnegprot"));
425 426 427 428
				/* some servers kill the TCP session rather than
				   returning an SMB negprot error, in which
				   case reconnecting here is not going to help,
				   and so simply return error to mount */
L
Linus Torvalds 已提交
429 430
				break;
			}
431
			if (!try_to_freeze() && (length == -EINTR)) {
S
Steve French 已提交
432
				cFYI(1, ("cifsd thread killed"));
L
Linus Torvalds 已提交
433 434
				break;
			}
S
Steve French 已提交
435
			cFYI(1, ("Reconnect after unexpected peek error %d",
436
				length));
L
Linus Torvalds 已提交
437 438 439 440
			cifs_reconnect(server);
			csocket = server->ssocket;
			wake_up(&server->response_q);
			continue;
441
		} else if (length < 4) {
442
			cFYI(1, ("less than four bytes received (%d bytes)",
443
			      length));
444 445 446
			pdu_length -= length;
			msleep(1);
			goto incomplete_rcv;
447
		}
L
Linus Torvalds 已提交
448

449 450
		/* The right amount was read from socket - 4 bytes */
		/* so we can now interpret the length field */
451

452 453 454 455
		/* the first byte big endian of the length field,
		is actually not part of the length but the type
		with the most common, zero, as regular data */
		temp = *((char *) smb_buffer);
456

S
Steve French 已提交
457
		/* Note that FC 1001 length is big endian on the wire,
458 459
		but we convert it here so it is always manipulated
		as host byte order */
460
		pdu_length = ntohl(smb_buffer->smb_buf_length);
461 462
		smb_buffer->smb_buf_length = pdu_length;

S
Steve French 已提交
463
		cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
464

465
		if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
S
Steve French 已提交
466
			continue;
467
		} else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
S
Steve French 已提交
468
			cFYI(1, ("Good RFC 1002 session rsp"));
469
			continue;
470
		} else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
S
Steve French 已提交
471
			/* we get this from Windows 98 instead of
472
			   an error on SMB negprot response */
S
Steve French 已提交
473
			cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
474
				pdu_length));
S
Steve French 已提交
475 476
			if (server->tcpStatus == CifsNew) {
				/* if nack on negprot (rather than
477 478 479 480 481 482 483 484 485
				ret of smb negprot error) reconnecting
				not going to help, ret error to mount */
				break;
			} else {
				/* give server a second to
				clean up before reconnect attempt */
				msleep(1000);
				/* always try 445 first on reconnect
				since we get NACK on some if we ever
S
Steve French 已提交
486
				connected to port 139 (the NACK is
487 488
				since we do not begin with RFC1001
				session initialize frame) */
S
Steve French 已提交
489
				server->addr.sockAddr.sin_port =
490
					htons(CIFS_PORT);
L
Linus Torvalds 已提交
491 492
				cifs_reconnect(server);
				csocket = server->ssocket;
493
				wake_up(&server->response_q);
L
Linus Torvalds 已提交
494
				continue;
495
			}
496
		} else if (temp != (char) 0) {
S
Steve French 已提交
497
			cERROR(1, ("Unknown RFC 1002 frame"));
498 499
			cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
				      length);
500 501 502
			cifs_reconnect(server);
			csocket = server->ssocket;
			continue;
503 504 505
		}

		/* else we have an SMB response */
S
Steve French 已提交
506
		if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
507
			    (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
508
			cERROR(1, ("Invalid size SMB length %d pdu_length %d",
509
					length, pdu_length+4));
510 511 512 513
			cifs_reconnect(server);
			csocket = server->ssocket;
			wake_up(&server->response_q);
			continue;
S
Steve French 已提交
514
		}
515 516 517 518

		/* else length ok */
		reconnect = 0;

S
Steve French 已提交
519
		if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
520 521 522 523 524 525 526
			isLargeBuf = TRUE;
			memcpy(bigbuf, smallbuf, 4);
			smb_buffer = bigbuf;
		}
		length = 0;
		iov.iov_base = 4 + (char *)smb_buffer;
		iov.iov_len = pdu_length;
S
Steve French 已提交
527
		for (total_read = 0; total_read < pdu_length;
528 529 530
		     total_read += length) {
			length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
						pdu_length - total_read, 0);
531
			if (kthread_should_stop() ||
532 533 534 535 536
			    (length == -EINTR)) {
				/* then will exit */
				reconnect = 2;
				break;
			} else if (server->tcpStatus == CifsNeedReconnect) {
537 538
				cifs_reconnect(server);
				csocket = server->ssocket;
S
Steve French 已提交
539
				/* Reconnect wakes up rspns q */
540 541 542
				/* Now we will reread sock */
				reconnect = 1;
				break;
S
Steve French 已提交
543
			} else if ((length == -ERESTARTSYS) ||
544 545
				   (length == -EAGAIN)) {
				msleep(1); /* minimum sleep to prevent looping,
S
Steve French 已提交
546
					      allowing socket to clear and app
547 548
					      threads to set tcpStatus
					      CifsNeedReconnect if server hung*/
549
				length = 0;
550
				continue;
551
			} else if (length <= 0) {
S
Steve French 已提交
552
				cERROR(1, ("Received no data, expecting %d",
553 554 555 556 557
					      pdu_length - total_read));
				cifs_reconnect(server);
				csocket = server->ssocket;
				reconnect = 1;
				break;
558
			}
559
		}
S
Steve French 已提交
560
		if (reconnect == 2)
561
			break;
S
Steve French 已提交
562
		else if (reconnect == 1)
563
			continue;
L
Linus Torvalds 已提交
564

565
		length += 4; /* account for rfc1002 hdr */
566

567

568
		dump_smb(smb_buffer, length);
569
		if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
570
			cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
571 572
			continue;
		}
L
Linus Torvalds 已提交
573

574 575 576 577 578 579

		task_to_wake = NULL;
		spin_lock(&GlobalMid_Lock);
		list_for_each(tmp, &server->pending_mid_q) {
			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);

580
			if ((mid_entry->mid == smb_buffer->Mid) &&
581 582
			    (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
			    (mid_entry->command == smb_buffer->Command)) {
S
Steve French 已提交
583
				if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
584
					/* We have a multipart transact2 resp */
585
					isMultiRsp = TRUE;
S
Steve French 已提交
586
					if (mid_entry->resp_buf) {
587
						/* merge response - fix up 1st*/
588
						if (coalesce_t2(smb_buffer,
589
							mid_entry->resp_buf)) {
590
							mid_entry->multiRsp = 1;
591 592 593
							break;
						} else {
							/* all parts received */
594
							mid_entry->multiEnd = 1;
595
							goto multi_t2_fnd;
596 597
						}
					} else {
S
Steve French 已提交
598
						if (!isLargeBuf) {
599 600
							cERROR(1,("1st trans2 resp needs bigbuf"));
					/* BB maybe we can fix this up,  switch
601
					   to already allocated large buffer? */
602
						} else {
603
							/* Have first buffer */
604 605 606 607 608 609 610
							mid_entry->resp_buf =
								 smb_buffer;
							mid_entry->largeBuf = 1;
							bigbuf = NULL;
						}
					}
					break;
611
				}
612
				mid_entry->resp_buf = smb_buffer;
S
Steve French 已提交
613
				if (isLargeBuf)
614
					mid_entry->largeBuf = 1;
615
				else
616 617 618 619
					mid_entry->largeBuf = 0;
multi_t2_fnd:
				task_to_wake = mid_entry->tsk;
				mid_entry->midState = MID_RESPONSE_RECEIVED;
S
Steve French 已提交
620 621 622
#ifdef CONFIG_CIFS_STATS2
				mid_entry->when_received = jiffies;
#endif
623 624 625 626
				/* so we do not time out requests to  server
				which is still responding (since server could
				be busy but not dead) */
				server->lstrp = jiffies;
627
				break;
628
			}
L
Linus Torvalds 已提交
629
		}
630 631
		spin_unlock(&GlobalMid_Lock);
		if (task_to_wake) {
632
			/* Was previous buf put in mpx struct for multi-rsp? */
S
Steve French 已提交
633
			if (!isMultiRsp) {
634
				/* smb buffer will be freed by user thread */
635
				if (isLargeBuf)
636
					bigbuf = NULL;
637
				else
638 639
					smallbuf = NULL;
			}
640
			wake_up_process(task_to_wake);
641
		} else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
642 643 644 645
		    && (isMultiRsp == FALSE)) {
			cERROR(1, ("No task to wake, unknown frame received! "
				   "NumMids %d", midCount.counter));
			cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
646
				      sizeof(struct smb_hdr));
647 648 649 650
#ifdef CONFIG_CIFS_DEBUG2
			cifs_dump_detail(smb_buffer);
			cifs_dump_mids(server);
#endif /* CIFS_DEBUG2 */
651

652 653 654
		}
	} /* end while !EXITING */

L
Linus Torvalds 已提交
655 656 657
	spin_lock(&GlobalMid_Lock);
	server->tcpStatus = CifsExiting;
	server->tsk = NULL;
658 659 660
	/* check if we have blocked requests that need to free */
	/* Note that cifs_max_pending is normally 50, but
	can be set at module install time to as little as two */
S
Steve French 已提交
661
	if (atomic_read(&server->inFlight) >= cifs_max_pending)
662 663 664
		atomic_set(&server->inFlight, cifs_max_pending - 1);
	/* We do not want to set the max_pending too low or we
	could end up with the counter going negative */
L
Linus Torvalds 已提交
665
	spin_unlock(&GlobalMid_Lock);
666
	/* Although there should not be any requests blocked on
L
Linus Torvalds 已提交
667
	this queue it can not hurt to be paranoid and try to wake up requests
668
	that may haven been blocked when more than 50 at time were on the wire
L
Linus Torvalds 已提交
669 670 671 672
	to the same server - they now will see the session is in exit state
	and get out of SendReceive.  */
	wake_up_all(&server->request_q);
	/* give those requests time to exit */
673
	msleep(125);
674

S
Steve French 已提交
675
	if (server->ssocket) {
L
Linus Torvalds 已提交
676 677 678
		sock_release(csocket);
		server->ssocket = NULL;
	}
679
	/* buffer usuallly freed in free_mid - need to free it here on exit */
680 681
	cifs_buf_release(bigbuf);
	if (smallbuf) /* no sense logging a debug message if NULL */
682
		cifs_small_buf_release(smallbuf);
L
Linus Torvalds 已提交
683 684 685

	read_lock(&GlobalSMBSeslock);
	if (list_empty(&server->pending_mid_q)) {
686 687
		/* loop through server session structures attached to this and
		    mark them dead */
L
Linus Torvalds 已提交
688 689 690 691 692 693 694 695 696 697 698
		list_for_each(tmp, &GlobalSMBSessionList) {
			ses =
			    list_entry(tmp, struct cifsSesInfo,
				       cifsSessionList);
			if (ses->server == server) {
				ses->status = CifsExiting;
				ses->server = NULL;
			}
		}
		read_unlock(&GlobalSMBSeslock);
	} else {
699 700 701 702 703 704
		/* although we can not zero the server struct pointer yet,
		since there are active requests which may depnd on them,
		mark the corresponding SMB sessions as exiting too */
		list_for_each(tmp, &GlobalSMBSessionList) {
			ses = list_entry(tmp, struct cifsSesInfo,
					 cifsSessionList);
705
			if (ses->server == server)
706 707 708
				ses->status = CifsExiting;
		}

L
Linus Torvalds 已提交
709 710 711 712
		spin_lock(&GlobalMid_Lock);
		list_for_each(tmp, &server->pending_mid_q) {
		mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
			if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
713 714
				cFYI(1, ("Clearing Mid 0x%x - waking up ",
					 mid_entry->mid));
L
Linus Torvalds 已提交
715
				task_to_wake = mid_entry->tsk;
716
				if (task_to_wake)
L
Linus Torvalds 已提交
717 718 719 720 721 722
					wake_up_process(task_to_wake);
			}
		}
		spin_unlock(&GlobalMid_Lock);
		read_unlock(&GlobalSMBSeslock);
		/* 1/8th of sec is more than enough time for them to exit */
723
		msleep(125);
L
Linus Torvalds 已提交
724 725
	}

726
	if (!list_empty(&server->pending_mid_q)) {
727
		/* mpx threads have not exited yet give them
L
Linus Torvalds 已提交
728
		at least the smb send timeout time for long ops */
729 730 731 732
		/* due to delays on oplock break requests, we need
		to wait at least 45 seconds before giving up
		on a request getting a response and going ahead
		and killing cifsd */
L
Linus Torvalds 已提交
733
		cFYI(1, ("Wait for exit from demultiplex thread"));
734
		msleep(46000);
L
Linus Torvalds 已提交
735 736 737 738 739 740 741
		/* if threads still have not exited they are probably never
		coming home not much else we can do but free the memory */
	}

	write_lock(&GlobalSMBSeslock);
	atomic_dec(&tcpSesAllocCount);
	length = tcpSesAllocCount.counter;
742 743 744

	/* last chance to mark ses pointers invalid
	if there are any pointing to this (e.g
745
	if a crazy root user tried to kill cifsd
746 747 748 749
	kernel thread explicitly this might happen) */
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo,
				cifsSessionList);
750
		if (ses->server == server)
751 752
			ses->server = NULL;
	}
L
Linus Torvalds 已提交
753
	write_unlock(&GlobalSMBSeslock);
754

755
	kfree(server->hostname);
756
	kfree(server);
757 758 759
	if (length  > 0)
		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
				GFP_KERNEL);
760

L
Linus Torvalds 已提交
761 762 763
	return 0;
}

764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791
/* extract the host portion of the UNC string */
static char *
extract_hostname(const char *unc)
{
	const char *src;
	char *dst, *delim;
	unsigned int len;

	/* skip double chars at beginning of string */
	/* BB: check validity of these bytes? */
	src = unc + 2;

	/* delimiter between hostname and sharename is always '\\' now */
	delim = strchr(src, '\\');
	if (!delim)
		return ERR_PTR(-EINVAL);

	len = delim - src;
	dst = kmalloc((len + 1), GFP_KERNEL);
	if (dst == NULL)
		return ERR_PTR(-ENOMEM);

	memcpy(dst, src, len);
	dst[len] = '\0';

	return dst;
}

L
Linus Torvalds 已提交
792
static int
793 794
cifs_parse_mount_options(char *options, const char *devname,
			 struct smb_vol *vol)
L
Linus Torvalds 已提交
795 796 797 798 799 800 801
{
	char *value;
	char *data;
	unsigned int  temp_len, i, j;
	char separator[2];

	separator[0] = ',';
802
	separator[1] = 0;
L
Linus Torvalds 已提交
803

804
	if (Local_System_Name[0] != 0)
805
		memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
806
	else {
807
		char *nodename = utsname()->nodename;
808 809 810
		int n = strnlen(nodename, 15);
		memset(vol->source_rfc1001_name, 0x20, 15);
		for (i = 0; i < n; i++) {
811 812 813
			/* does not have to be perfect mapping since field is
			informational, only used for servers that do not support
			port 445 and it can be overridden at mount time */
814
			vol->source_rfc1001_name[i] = toupper(nodename[i]);
815
		}
L
Linus Torvalds 已提交
816 817
	}
	vol->source_rfc1001_name[15] = 0;
818 819 820
	/* null target name indicates to use *SMBSERVR default called name
	   if we end up sending RFC1001 session initialize */
	vol->target_rfc1001_name[0] = 0;
L
Linus Torvalds 已提交
821 822 823 824
	vol->linux_uid = current->uid;	/* current->euid instead? */
	vol->linux_gid = current->gid;
	vol->dir_mode = S_IRWXUGO;
	/* 2767 perms indicate mandatory locking support */
825
	vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
L
Linus Torvalds 已提交
826 827 828

	/* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
	vol->rw = TRUE;
829 830 831
	/* default is always to request posix paths. */
	vol->posix_paths = 1;

L
Linus Torvalds 已提交
832 833 834
	if (!options)
		return 1;

835
	if (strncmp(options, "sep=", 4) == 0) {
S
Steve French 已提交
836
		if (options[4] != 0) {
L
Linus Torvalds 已提交
837 838 839
			separator[0] = options[4];
			options += 5;
		} else {
S
Steve French 已提交
840
			cFYI(1, ("Null separator not allowed"));
L
Linus Torvalds 已提交
841 842
		}
	}
843

L
Linus Torvalds 已提交
844 845 846 847 848 849
	while ((data = strsep(&options, separator)) != NULL) {
		if (!*data)
			continue;
		if ((value = strchr(data, '=')) != NULL)
			*value++ = '\0';

850 851
		/* Have to parse this before we parse for "user" */
		if (strnicmp(data, "user_xattr", 10) == 0) {
L
Linus Torvalds 已提交
852
			vol->no_xattr = 0;
853
		} else if (strnicmp(data, "nouser_xattr", 12) == 0) {
L
Linus Torvalds 已提交
854 855
			vol->no_xattr = 1;
		} else if (strnicmp(data, "user", 4) == 0) {
S
Steve French 已提交
856
			if (!value) {
L
Linus Torvalds 已提交
857 858 859
				printk(KERN_WARNING
				       "CIFS: invalid or missing username\n");
				return 1;	/* needs_arg; */
S
Steve French 已提交
860
			} else if (!*value) {
S
Steve French 已提交
861 862
				/* null user, ie anonymous, authentication */
				vol->nullauth = 1;
L
Linus Torvalds 已提交
863 864 865 866 867 868 869 870 871 872 873
			}
			if (strnlen(value, 200) < 200) {
				vol->username = value;
			} else {
				printk(KERN_WARNING "CIFS: username too long\n");
				return 1;
			}
		} else if (strnicmp(data, "pass", 4) == 0) {
			if (!value) {
				vol->password = NULL;
				continue;
S
Steve French 已提交
874
			} else if (value[0] == 0) {
L
Linus Torvalds 已提交
875 876 877 878
				/* check if string begins with double comma
				   since that would mean the password really
				   does start with a comma, and would not
				   indicate an empty string */
S
Steve French 已提交
879
				if (value[1] != separator[0]) {
L
Linus Torvalds 已提交
880 881 882 883 884 885 886 887
					vol->password = NULL;
					continue;
				}
			}
			temp_len = strlen(value);
			/* removed password length check, NTLM passwords
				can be arbitrarily long */

888
			/* if comma in password, the string will be
L
Linus Torvalds 已提交
889 890 891 892 893 894 895 896 897
			prematurely null terminated.  Commas in password are
			specified across the cifs mount interface by a double
			comma ie ,, and a comma used as in other cases ie ','
			as a parameter delimiter/separator is single and due
			to the strsep above is temporarily zeroed. */

			/* NB: password legally can have multiple commas and
			the only illegal character in a password is null */

898
			if ((value[temp_len] == 0) &&
899
			    (value[temp_len+1] == separator[0])) {
L
Linus Torvalds 已提交
900 901
				/* reinsert comma */
				value[temp_len] = separator[0];
902 903
				temp_len += 2;  /* move after second comma */
				while (value[temp_len] != 0)  {
L
Linus Torvalds 已提交
904
					if (value[temp_len] == separator[0]) {
905
						if (value[temp_len+1] ==
906 907 908
						     separator[0]) {
						/* skip second comma */
							temp_len++;
909
						} else {
L
Linus Torvalds 已提交
910 911 912 913 914 915 916
						/* single comma indicating start
							 of next parm */
							break;
						}
					}
					temp_len++;
				}
S
Steve French 已提交
917
				if (value[temp_len] == 0) {
L
Linus Torvalds 已提交
918 919 920 921 922 923
					options = NULL;
				} else {
					value[temp_len] = 0;
					/* point option to start of next parm */
					options = value + temp_len + 1;
				}
924
				/* go from value to value + temp_len condensing
L
Linus Torvalds 已提交
925 926
				double commas to singles. Note that this ends up
				allocating a few bytes too many, which is ok */
927
				vol->password = kzalloc(temp_len, GFP_KERNEL);
S
Steve French 已提交
928
				if (vol->password == NULL) {
929 930
					printk(KERN_WARNING "CIFS: no memory "
							    "for password\n");
931 932
					return 1;
				}
933
				for (i = 0, j = 0; i < temp_len; i++, j++) {
L
Linus Torvalds 已提交
934
					vol->password[j] = value[i];
S
Steve French 已提交
935
					if (value[i] == separator[0]
936
						&& value[i+1] == separator[0]) {
L
Linus Torvalds 已提交
937 938 939 940 941 942
						/* skip second comma */
						i++;
					}
				}
				vol->password[j] = 0;
			} else {
943
				vol->password = kzalloc(temp_len+1, GFP_KERNEL);
S
Steve French 已提交
944
				if (vol->password == NULL) {
945 946
					printk(KERN_WARNING "CIFS: no memory "
							    "for password\n");
947 948
					return 1;
				}
L
Linus Torvalds 已提交
949 950 951 952 953 954 955 956
				strcpy(vol->password, value);
			}
		} else if (strnicmp(data, "ip", 2) == 0) {
			if (!value || !*value) {
				vol->UNCip = NULL;
			} else if (strnlen(value, 35) < 35) {
				vol->UNCip = value;
			} else {
957 958
				printk(KERN_WARNING "CIFS: ip address "
						    "too long\n");
L
Linus Torvalds 已提交
959 960
				return 1;
			}
961 962 963 964 965 966
		} else if (strnicmp(data, "sec", 3) == 0) {
			if (!value || !*value) {
				cERROR(1, ("no security value specified"));
				continue;
			} else if (strnicmp(value, "krb5i", 5) == 0) {
				vol->secFlg |= CIFSSEC_MAY_KRB5 |
967
					CIFSSEC_MUST_SIGN;
968
			} else if (strnicmp(value, "krb5p", 5) == 0) {
969 970 971
				/* vol->secFlg |= CIFSSEC_MUST_SEAL |
					CIFSSEC_MAY_KRB5; */
				cERROR(1, ("Krb5 cifs privacy not supported"));
972 973
				return 1;
			} else if (strnicmp(value, "krb5", 4) == 0) {
974
				vol->secFlg |= CIFSSEC_MAY_KRB5;
975
			} else if (strnicmp(value, "ntlmv2i", 7) == 0) {
976
				vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
977
					CIFSSEC_MUST_SIGN;
978
			} else if (strnicmp(value, "ntlmv2", 6) == 0) {
979
				vol->secFlg |= CIFSSEC_MAY_NTLMV2;
980
			} else if (strnicmp(value, "ntlmi", 5) == 0) {
981
				vol->secFlg |= CIFSSEC_MAY_NTLM |
982
					CIFSSEC_MUST_SIGN;
983 984
			} else if (strnicmp(value, "ntlm", 4) == 0) {
				/* ntlm is default so can be turned off too */
985
				vol->secFlg |= CIFSSEC_MAY_NTLM;
986
			} else if (strnicmp(value, "nontlm", 6) == 0) {
987
				/* BB is there a better way to do this? */
988
				vol->secFlg |= CIFSSEC_MAY_NTLMV2;
989 990
#ifdef CONFIG_CIFS_WEAK_PW_HASH
			} else if (strnicmp(value, "lanman", 6) == 0) {
991
				vol->secFlg |= CIFSSEC_MAY_LANMAN;
992
#endif
993
			} else if (strnicmp(value, "none", 4) == 0) {
994
				vol->nullauth = 1;
995 996 997 998
			} else {
				cERROR(1, ("bad security option: %s", value));
				return 1;
			}
L
Linus Torvalds 已提交
999 1000 1001 1002
		} else if ((strnicmp(data, "unc", 3) == 0)
			   || (strnicmp(data, "target", 6) == 0)
			   || (strnicmp(data, "path", 4) == 0)) {
			if (!value || !*value) {
1003 1004
				printk(KERN_WARNING "CIFS: invalid path to "
						    "network resource\n");
L
Linus Torvalds 已提交
1005 1006 1007
				return 1;	/* needs_arg; */
			}
			if ((temp_len = strnlen(value, 300)) < 300) {
1008
				vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1009
				if (vol->UNC == NULL)
L
Linus Torvalds 已提交
1010
					return 1;
1011
				strcpy(vol->UNC, value);
L
Linus Torvalds 已提交
1012 1013 1014
				if (strncmp(vol->UNC, "//", 2) == 0) {
					vol->UNC[0] = '\\';
					vol->UNC[1] = '\\';
1015
				} else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
L
Linus Torvalds 已提交
1016
					printk(KERN_WARNING
1017 1018
					       "CIFS: UNC Path does not begin "
					       "with // or \\\\ \n");
L
Linus Torvalds 已提交
1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
					return 1;
				}
			} else {
				printk(KERN_WARNING "CIFS: UNC name too long\n");
				return 1;
			}
		} else if ((strnicmp(data, "domain", 3) == 0)
			   || (strnicmp(data, "workgroup", 5) == 0)) {
			if (!value || !*value) {
				printk(KERN_WARNING "CIFS: invalid domain name\n");
				return 1;	/* needs_arg; */
			}
			/* BB are there cases in which a comma can be valid in
			a domain name and need special handling? */
1033
			if (strnlen(value, 256) < 256) {
L
Linus Torvalds 已提交
1034 1035 1036
				vol->domainname = value;
				cFYI(1, ("Domain name set"));
			} else {
1037 1038
				printk(KERN_WARNING "CIFS: domain name too "
						    "long\n");
L
Linus Torvalds 已提交
1039 1040
				return 1;
			}
1041 1042 1043 1044 1045 1046 1047
		} else if (strnicmp(data, "prefixpath", 10) == 0) {
			if (!value || !*value) {
				printk(KERN_WARNING
					"CIFS: invalid path prefix\n");
				return 1;       /* needs_argument */
			}
			if ((temp_len = strnlen(value, 1024)) < 1024) {
1048
				if (value[0] != '/')
1049
					temp_len++;  /* missing leading slash */
1050 1051 1052
				vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
				if (vol->prepath == NULL)
					return 1;
1053
				if (value[0] != '/') {
1054
					vol->prepath[0] = '/';
1055
					strcpy(vol->prepath+1, value);
1056
				} else
1057 1058 1059 1060 1061 1062
					strcpy(vol->prepath, value);
				cFYI(1, ("prefix path %s", vol->prepath));
			} else {
				printk(KERN_WARNING "CIFS: prefix too long\n");
				return 1;
			}
L
Linus Torvalds 已提交
1063 1064
		} else if (strnicmp(data, "iocharset", 9) == 0) {
			if (!value || !*value) {
1065 1066
				printk(KERN_WARNING "CIFS: invalid iocharset "
						    "specified\n");
L
Linus Torvalds 已提交
1067 1068 1069
				return 1;	/* needs_arg; */
			}
			if (strnlen(value, 65) < 65) {
1070
				if (strnicmp(value, "default", 7))
L
Linus Torvalds 已提交
1071
					vol->iocharset = value;
1072 1073 1074
				/* if iocharset not set then load_nls_default
				   is used by caller */
				cFYI(1, ("iocharset set to %s", value));
L
Linus Torvalds 已提交
1075
			} else {
1076 1077
				printk(KERN_WARNING "CIFS: iocharset name "
						    "too long.\n");
L
Linus Torvalds 已提交
1078 1079 1080 1081 1082 1083
				return 1;
			}
		} else if (strnicmp(data, "uid", 3) == 0) {
			if (value && *value) {
				vol->linux_uid =
					simple_strtoul(value, &value, 0);
1084
				vol->override_uid = 1;
L
Linus Torvalds 已提交
1085 1086 1087 1088 1089
			}
		} else if (strnicmp(data, "gid", 3) == 0) {
			if (value && *value) {
				vol->linux_gid =
					simple_strtoul(value, &value, 0);
1090
				vol->override_gid = 1;
L
Linus Torvalds 已提交
1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128
			}
		} else if (strnicmp(data, "file_mode", 4) == 0) {
			if (value && *value) {
				vol->file_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "dir_mode", 4) == 0) {
			if (value && *value) {
				vol->dir_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "dirmode", 4) == 0) {
			if (value && *value) {
				vol->dir_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "port", 4) == 0) {
			if (value && *value) {
				vol->port =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "rsize", 5) == 0) {
			if (value && *value) {
				vol->rsize =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "wsize", 5) == 0) {
			if (value && *value) {
				vol->wsize =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "sockopt", 5) == 0) {
			if (value && *value) {
				vol->sockopt =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "netbiosname", 4) == 0) {
			if (!value || !*value || (*value == ' ')) {
1129
				cFYI(1, ("invalid (empty) netbiosname"));
L
Linus Torvalds 已提交
1130
			} else {
1131 1132 1133
				memset(vol->source_rfc1001_name, 0x20, 15);
				for (i = 0; i < 15; i++) {
				/* BB are there cases in which a comma can be
L
Linus Torvalds 已提交
1134 1135 1136 1137
				valid in this workstation netbios name (and need
				special handling)? */

				/* We do not uppercase netbiosname for user */
1138
					if (value[i] == 0)
L
Linus Torvalds 已提交
1139
						break;
1140 1141 1142
					else
						vol->source_rfc1001_name[i] =
								value[i];
L
Linus Torvalds 已提交
1143 1144 1145
				}
				/* The string has 16th byte zero still from
				set at top of the function  */
1146 1147 1148
				if ((i == 15) && (value[i] != 0))
					printk(KERN_WARNING "CIFS: netbiosname"
						" longer than 15 truncated.\n");
1149 1150 1151 1152
			}
		} else if (strnicmp(data, "servern", 7) == 0) {
			/* servernetbiosname specified override *SMBSERVER */
			if (!value || !*value || (*value == ' ')) {
S
Steve French 已提交
1153
				cFYI(1, ("empty server netbiosname specified"));
1154 1155
			} else {
				/* last byte, type, is 0x20 for servr type */
1156
				memset(vol->target_rfc1001_name, 0x20, 16);
1157

1158
				for (i = 0; i < 15; i++) {
1159
				/* BB are there cases in which a comma can be
1160 1161
				   valid in this workstation netbios name
				   (and need special handling)? */
1162

1163 1164 1165
				/* user or mount helper must uppercase
				   the netbiosname */
					if (value[i] == 0)
1166 1167
						break;
					else
1168 1169
						vol->target_rfc1001_name[i] =
								value[i];
1170 1171 1172
				}
				/* The string has 16th byte zero still from
				   set at top of the function  */
1173 1174 1175
				if ((i == 15) && (value[i] != 0))
					printk(KERN_WARNING "CIFS: server net"
					"biosname longer than 15 truncated.\n");
L
Linus Torvalds 已提交
1176 1177 1178 1179 1180
			}
		} else if (strnicmp(data, "credentials", 4) == 0) {
			/* ignore */
		} else if (strnicmp(data, "version", 3) == 0) {
			/* ignore */
1181
		} else if (strnicmp(data, "guest", 5) == 0) {
L
Linus Torvalds 已提交
1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192
			/* ignore */
		} else if (strnicmp(data, "rw", 2) == 0) {
			vol->rw = TRUE;
		} else if ((strnicmp(data, "suid", 4) == 0) ||
				   (strnicmp(data, "nosuid", 6) == 0) ||
				   (strnicmp(data, "exec", 4) == 0) ||
				   (strnicmp(data, "noexec", 6) == 0) ||
				   (strnicmp(data, "nodev", 5) == 0) ||
				   (strnicmp(data, "noauto", 6) == 0) ||
				   (strnicmp(data, "dev", 3) == 0)) {
			/*  The mount tool or mount.cifs helper (if present)
1193 1194 1195 1196 1197
			    uses these opts to set flags, and the flags are read
			    by the kernel vfs layer before we get here (ie
			    before read super) so there is no point trying to
			    parse these options again and set anything and it
			    is ok to just ignore them */
L
Linus Torvalds 已提交
1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208
			continue;
		} else if (strnicmp(data, "ro", 2) == 0) {
			vol->rw = FALSE;
		} else if (strnicmp(data, "hard", 4) == 0) {
			vol->retry = 1;
		} else if (strnicmp(data, "soft", 4) == 0) {
			vol->retry = 0;
		} else if (strnicmp(data, "perm", 4) == 0) {
			vol->noperm = 0;
		} else if (strnicmp(data, "noperm", 6) == 0) {
			vol->noperm = 1;
1209 1210 1211 1212
		} else if (strnicmp(data, "mapchars", 8) == 0) {
			vol->remap = 1;
		} else if (strnicmp(data, "nomapchars", 10) == 0) {
			vol->remap = 0;
1213 1214 1215 1216
		} else if (strnicmp(data, "sfu", 3) == 0) {
			vol->sfu_emul = 1;
		} else if (strnicmp(data, "nosfu", 5) == 0) {
			vol->sfu_emul = 0;
1217 1218 1219 1220
		} else if (strnicmp(data, "posixpaths", 10) == 0) {
			vol->posix_paths = 1;
		} else if (strnicmp(data, "noposixpaths", 12) == 0) {
			vol->posix_paths = 0;
1221 1222 1223 1224
		} else if (strnicmp(data, "nounix", 6) == 0) {
			vol->no_linux_ext = 1;
		} else if (strnicmp(data, "nolinux", 7) == 0) {
			vol->no_linux_ext = 1;
1225
		} else if ((strnicmp(data, "nocase", 6) == 0) ||
1226
			   (strnicmp(data, "ignorecase", 10)  == 0)) {
1227
			vol->nocase = 1;
1228 1229
		} else if (strnicmp(data, "brl", 3) == 0) {
			vol->nobrl =  0;
1230
		} else if ((strnicmp(data, "nobrl", 5) == 0) ||
1231
			   (strnicmp(data, "nolock", 6) == 0)) {
1232
			vol->nobrl =  1;
1233 1234 1235
			/* turn off mandatory locking in mode
			if remote locking is turned off since the
			local vfs will do advisory */
1236 1237
			if (vol->file_mode ==
				(S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1238
				vol->file_mode = S_IALLUGO;
L
Linus Torvalds 已提交
1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250
		} else if (strnicmp(data, "setuids", 7) == 0) {
			vol->setuids = 1;
		} else if (strnicmp(data, "nosetuids", 9) == 0) {
			vol->setuids = 0;
		} else if (strnicmp(data, "nohard", 6) == 0) {
			vol->retry = 0;
		} else if (strnicmp(data, "nosoft", 6) == 0) {
			vol->retry = 1;
		} else if (strnicmp(data, "nointr", 6) == 0) {
			vol->intr = 0;
		} else if (strnicmp(data, "intr", 4) == 0) {
			vol->intr = 1;
1251
		} else if (strnicmp(data, "serverino", 7) == 0) {
L
Linus Torvalds 已提交
1252
			vol->server_ino = 1;
1253
		} else if (strnicmp(data, "noserverino", 9) == 0) {
L
Linus Torvalds 已提交
1254
			vol->server_ino = 0;
1255
		} else if (strnicmp(data, "cifsacl", 7) == 0) {
1256 1257 1258
			vol->cifs_acl = 1;
		} else if (strnicmp(data, "nocifsacl", 9) == 0) {
			vol->cifs_acl = 0;
1259
		} else if (strnicmp(data, "acl", 3) == 0) {
L
Linus Torvalds 已提交
1260
			vol->no_psx_acl = 0;
1261
		} else if (strnicmp(data, "noacl", 5) == 0) {
L
Linus Torvalds 已提交
1262
			vol->no_psx_acl = 1;
1263
		} else if (strnicmp(data, "sign", 4) == 0) {
1264 1265 1266
			vol->secFlg |= CIFSSEC_MUST_SIGN;
/*		} else if (strnicmp(data, "seal",4) == 0) {
			vol->secFlg |= CIFSSEC_MUST_SEAL; */
1267
		} else if (strnicmp(data, "direct", 6) == 0) {
L
Linus Torvalds 已提交
1268
			vol->direct_io = 1;
1269
		} else if (strnicmp(data, "forcedirectio", 13) == 0) {
L
Linus Torvalds 已提交
1270
			vol->direct_io = 1;
1271
		} else if (strnicmp(data, "in6_addr", 8) == 0) {
L
Linus Torvalds 已提交
1272 1273 1274 1275 1276
			if (!value || !*value) {
				vol->in6_addr = NULL;
			} else if (strnlen(value, 49) == 48) {
				vol->in6_addr = value;
			} else {
1277 1278
				printk(KERN_WARNING "CIFS: ip v6 address not "
						    "48 characters long\n");
L
Linus Torvalds 已提交
1279 1280 1281
				return 1;
			}
		} else if (strnicmp(data, "noac", 4) == 0) {
1282 1283 1284
			printk(KERN_WARNING "CIFS: Mount option noac not "
				"supported. Instead set "
				"/proc/fs/cifs/LookupCacheEnabled to 0\n");
L
Linus Torvalds 已提交
1285
		} else
1286 1287
			printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
						data);
L
Linus Torvalds 已提交
1288 1289
	}
	if (vol->UNC == NULL) {
1290
		if (devname == NULL) {
1291 1292
			printk(KERN_WARNING "CIFS: Missing UNC name for mount "
						"target\n");
L
Linus Torvalds 已提交
1293 1294 1295
			return 1;
		}
		if ((temp_len = strnlen(devname, 300)) < 300) {
1296
			vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1297
			if (vol->UNC == NULL)
L
Linus Torvalds 已提交
1298
				return 1;
1299
			strcpy(vol->UNC, devname);
L
Linus Torvalds 已提交
1300 1301 1302 1303
			if (strncmp(vol->UNC, "//", 2) == 0) {
				vol->UNC[0] = '\\';
				vol->UNC[1] = '\\';
			} else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1304 1305
				printk(KERN_WARNING "CIFS: UNC Path does not "
						    "begin with // or \\\\ \n");
L
Linus Torvalds 已提交
1306 1307 1308 1309 1310 1311 1312
				return 1;
			}
		} else {
			printk(KERN_WARNING "CIFS: UNC name too long\n");
			return 1;
		}
	}
S
Steve French 已提交
1313
	if (vol->UNCip == NULL)
L
Linus Torvalds 已提交
1314 1315 1316 1317 1318 1319
		vol->UNCip = &vol->UNC[2];

	return 0;
}

static struct cifsSesInfo *
1320
cifs_find_tcp_session(struct in_addr *target_ip_addr,
L
Linus Torvalds 已提交
1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331
		struct in6_addr *target_ip6_addr,
		 char *userName, struct TCP_Server_Info **psrvTcp)
{
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	*psrvTcp = NULL;
	read_lock(&GlobalSMBSeslock);

	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
		if (ses->server) {
1332
			if ((target_ip_addr &&
L
Linus Torvalds 已提交
1333 1334 1335
				(ses->server->addr.sockAddr.sin_addr.s_addr
				  == target_ip_addr->s_addr)) || (target_ip6_addr
				&& memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1336 1337 1338 1339 1340 1341 1342
					target_ip6_addr, sizeof(*target_ip6_addr)))) {
				/* BB lock server and tcp session and increment
				      use count here?? */

				/* found a match on the TCP session */
				*psrvTcp = ses->server;

L
Linus Torvalds 已提交
1343 1344 1345 1346 1347
				/* BB check if reconnection needed */
				if (strncmp
				    (ses->userName, userName,
				     MAX_USERNAME_SIZE) == 0){
					read_unlock(&GlobalSMBSeslock);
1348 1349 1350
					/* Found exact match on both TCP and
					   SMB sessions */
					return ses;
L
Linus Torvalds 已提交
1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367
				}
			}
		}
		/* else tcp and smb sessions need reconnection */
	}
	read_unlock(&GlobalSMBSeslock);
	return NULL;
}

static struct cifsTconInfo *
find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
{
	struct list_head *tmp;
	struct cifsTconInfo *tcon;

	read_lock(&GlobalSMBSeslock);
	list_for_each(tmp, &GlobalTreeConnectionList) {
1368
		cFYI(1, ("Next tcon"));
L
Linus Torvalds 已提交
1369 1370 1371 1372
		tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
		if (tcon->ses) {
			if (tcon->ses->server) {
				cFYI(1,
1373
				     ("old ip addr: %x == new ip %x ?",
L
Linus Torvalds 已提交
1374 1375 1376 1377
				      tcon->ses->server->addr.sockAddr.sin_addr.
				      s_addr, new_target_ip_addr));
				if (tcon->ses->server->addr.sockAddr.sin_addr.
				    s_addr == new_target_ip_addr) {
1378
	/* BB lock tcon, server and tcp session and increment use count here? */
L
Linus Torvalds 已提交
1379 1380
					/* found a match on the TCP session */
					/* BB check if reconnection needed */
1381 1382
					cFYI(1,
					      ("IP match, old UNC: %s new: %s",
L
Linus Torvalds 已提交
1383 1384 1385 1386 1387
					      tcon->treeName, uncName));
					if (strncmp
					    (tcon->treeName, uncName,
					     MAX_TREE_SIZE) == 0) {
						cFYI(1,
1388
						     ("and old usr: %s new: %s",
L
Linus Torvalds 已提交
1389 1390 1391 1392 1393 1394
						      tcon->treeName, uncName));
						if (strncmp
						    (tcon->ses->userName,
						     userName,
						     MAX_USERNAME_SIZE) == 0) {
							read_unlock(&GlobalSMBSeslock);
1395 1396 1397
							/* matched smb session
							(user name */
							return tcon;
L
Linus Torvalds 已提交
1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409
						}
					}
				}
			}
		}
	}
	read_unlock(&GlobalSMBSeslock);
	return NULL;
}

int
connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1410 1411
		    const char *old_path, const struct nls_table *nls_codepage,
		    int remap)
L
Linus Torvalds 已提交
1412 1413 1414 1415 1416
{
	unsigned char *referrals = NULL;
	unsigned int num_referrals;
	int rc = 0;

1417
	rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
1418
			&num_referrals, &referrals, remap);
L
Linus Torvalds 已提交
1419 1420

	/* BB Add in code to: if valid refrl, if not ip address contact
1421
		the helper that resolves tcp names, mount to it, try to
L
Linus Torvalds 已提交
1422 1423
		tcon to it unmount it if fail */

J
Jesper Juhl 已提交
1424
	kfree(referrals);
L
Linus Torvalds 已提交
1425 1426 1427 1428 1429

	return rc;
}

int
1430 1431 1432
get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
	     const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
	     unsigned char **preferrals, int remap)
L
Linus Torvalds 已提交
1433 1434 1435 1436 1437 1438 1439 1440
{
	char *temp_unc;
	int rc = 0;

	*pnum_referrals = 0;

	if (pSesInfo->ipc_tid == 0) {
		temp_unc = kmalloc(2 /* for slashes */ +
1441 1442
			strnlen(pSesInfo->serverName,
				SERVER_NAME_LEN_WITH_NULL * 2)
L
Linus Torvalds 已提交
1443 1444 1445 1446 1447 1448 1449 1450 1451 1452
				 + 1 + 4 /* slash IPC$ */  + 2,
				GFP_KERNEL);
		if (temp_unc == NULL)
			return -ENOMEM;
		temp_unc[0] = '\\';
		temp_unc[1] = '\\';
		strcpy(temp_unc + 2, pSesInfo->serverName);
		strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
		rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
		cFYI(1,
1453
		     ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
L
Linus Torvalds 已提交
1454 1455 1456 1457
		kfree(temp_unc);
	}
	if (rc == 0)
		rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1458
				     pnum_referrals, nls_codepage, remap);
L
Linus Torvalds 已提交
1459 1460 1461 1462 1463

	return rc;
}

/* See RFC1001 section 14 on representation of Netbios names */
1464
static void rfc1002mangle(char *target, char *source, unsigned int length)
L
Linus Torvalds 已提交
1465
{
1466
	unsigned int i, j;
L
Linus Torvalds 已提交
1467

1468
	for (i = 0, j = 0; i < (length); i++) {
L
Linus Torvalds 已提交
1469 1470 1471
		/* mask a nibble at a time and encode */
		target[j] = 'A' + (0x0F & (source[i] >> 4));
		target[j+1] = 'A' + (0x0F & source[i]);
1472
		j += 2;
L
Linus Torvalds 已提交
1473 1474 1475 1476 1477 1478
	}

}


static int
1479 1480
ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
	     char *netbios_name, char *target_name)
L
Linus Torvalds 已提交
1481 1482 1483 1484 1485
{
	int rc = 0;
	int connected = 0;
	__be16 orig_port = 0;

S
Steve French 已提交
1486
	if (*csocket == NULL) {
1487 1488
		rc = sock_create_kern(PF_INET, SOCK_STREAM,
				      IPPROTO_TCP, csocket);
L
Linus Torvalds 已提交
1489
		if (rc < 0) {
1490
			cERROR(1, ("Error %d creating socket", rc));
L
Linus Torvalds 已提交
1491 1492 1493 1494
			*csocket = NULL;
			return rc;
		} else {
		/* BB other socket options to set KEEPALIVE, NODELAY? */
S
Steve French 已提交
1495
			cFYI(1, ("Socket created"));
1496
			(*csocket)->sk->sk_allocation = GFP_NOFS;
L
Linus Torvalds 已提交
1497 1498 1499 1500
		}
	}

	psin_server->sin_family = AF_INET;
S
Steve French 已提交
1501
	if (psin_server->sin_port) { /* user overrode default port */
L
Linus Torvalds 已提交
1502 1503
		rc = (*csocket)->ops->connect(*csocket,
				(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1504
				sizeof(struct sockaddr_in), 0);
L
Linus Torvalds 已提交
1505 1506
		if (rc >= 0)
			connected = 1;
1507
	}
L
Linus Torvalds 已提交
1508

S
Steve French 已提交
1509
	if (!connected) {
1510
		/* save original port so we can retry user specified port
L
Linus Torvalds 已提交
1511 1512 1513 1514
			later if fall back ports fail this time  */
		orig_port = psin_server->sin_port;

		/* do not retry on the same port we just failed on */
S
Steve French 已提交
1515
		if (psin_server->sin_port != htons(CIFS_PORT)) {
L
Linus Torvalds 已提交
1516 1517 1518 1519
			psin_server->sin_port = htons(CIFS_PORT);

			rc = (*csocket)->ops->connect(*csocket,
					(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1520
					sizeof(struct sockaddr_in), 0);
L
Linus Torvalds 已提交
1521 1522 1523 1524 1525 1526 1527
			if (rc >= 0)
				connected = 1;
		}
	}
	if (!connected) {
		psin_server->sin_port = htons(RFC1001_PORT);
		rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1528
					      psin_server,
C
Cyrill Gorcunov 已提交
1529
					      sizeof(struct sockaddr_in), 0);
1530
		if (rc >= 0)
L
Linus Torvalds 已提交
1531 1532 1533 1534 1535 1536
			connected = 1;
	}

	/* give up here - unless we want to retry on different
		protocol families some day */
	if (!connected) {
S
Steve French 已提交
1537
		if (orig_port)
L
Linus Torvalds 已提交
1538
			psin_server->sin_port = orig_port;
1539
		cFYI(1, ("Error %d connecting to server via ipv4", rc));
L
Linus Torvalds 已提交
1540 1541 1542 1543
		sock_release(*csocket);
		*csocket = NULL;
		return rc;
	}
1544 1545
	/* Eventually check for other socket options to change from
		the default. sock_setsockopt not used because it expects
L
Linus Torvalds 已提交
1546
		user space buffer */
1547 1548
	 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
		 (*csocket)->sk->sk_sndbuf,
1549
		 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
L
Linus Torvalds 已提交
1550
	(*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1551
	/* make the bufsizes depend on wsize/rsize and max requests */
S
Steve French 已提交
1552
	if ((*csocket)->sk->sk_sndbuf < (200 * 1024))
1553
		(*csocket)->sk->sk_sndbuf = 200 * 1024;
S
Steve French 已提交
1554
	if ((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1555
		(*csocket)->sk->sk_rcvbuf = 140 * 1024;
L
Linus Torvalds 已提交
1556 1557

	/* send RFC1001 sessinit */
S
Steve French 已提交
1558
	if (psin_server->sin_port == htons(RFC1001_PORT)) {
L
Linus Torvalds 已提交
1559
		/* some servers require RFC1001 sessinit before sending
1560
		negprot - BB check reconnection in case where second
L
Linus Torvalds 已提交
1561
		sessinit is sent but no second negprot */
1562 1563 1564 1565
		struct rfc1002_session_packet *ses_init_buf;
		struct smb_hdr *smb_buf;
		ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
				       GFP_KERNEL);
S
Steve French 已提交
1566
		if (ses_init_buf) {
L
Linus Torvalds 已提交
1567
			ses_init_buf->trailer.session_req.called_len = 32;
S
Steve French 已提交
1568
			if (target_name && (target_name[0] != 0)) {
1569 1570 1571 1572
				rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
					target_name, 16);
			} else {
				rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1573
					DEFAULT_CIFS_CALLED_NAME, 16);
1574 1575
			}

L
Linus Torvalds 已提交
1576 1577 1578
			ses_init_buf->trailer.session_req.calling_len = 32;
			/* calling name ends in null (byte 16) from old smb
			convention. */
1579
			if (netbios_name && (netbios_name[0] != 0)) {
L
Linus Torvalds 已提交
1580
				rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1581
					netbios_name, 16);
L
Linus Torvalds 已提交
1582 1583
			} else {
				rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1584
					"LINUX_CIFS_CLNT", 16);
L
Linus Torvalds 已提交
1585 1586 1587 1588 1589 1590 1591 1592 1593
			}
			ses_init_buf->trailer.session_req.scope1 = 0;
			ses_init_buf->trailer.session_req.scope2 = 0;
			smb_buf = (struct smb_hdr *)ses_init_buf;
			/* sizeof RFC1002_SESSION_REQUEST with no scope */
			smb_buf->smb_buf_length = 0x81000044;
			rc = smb_send(*csocket, smb_buf, 0x44,
				(struct sockaddr *)psin_server);
			kfree(ses_init_buf);
1594
			msleep(1); /* RFC1001 layer in at least one server
1595 1596 1597
				      requires very short break before negprot
				      presumably because not expecting negprot
				      to follow so fast.  This is a simple
1598
				      solution that works without
1599 1600 1601
				      complicating the code and causes no
				      significant slowing down on mount
				      for everyone else */
L
Linus Torvalds 已提交
1602
		}
1603
		/* else the negprot may still work without this
L
Linus Torvalds 已提交
1604
		even though malloc failed */
1605

L
Linus Torvalds 已提交
1606
	}
1607

L
Linus Torvalds 已提交
1608 1609 1610 1611 1612 1613 1614 1615 1616 1617
	return rc;
}

static int
ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
{
	int rc = 0;
	int connected = 0;
	__be16 orig_port = 0;

S
Steve French 已提交
1618
	if (*csocket == NULL) {
1619 1620
		rc = sock_create_kern(PF_INET6, SOCK_STREAM,
				      IPPROTO_TCP, csocket);
L
Linus Torvalds 已提交
1621
		if (rc < 0) {
1622
			cERROR(1, ("Error %d creating ipv6 socket", rc));
L
Linus Torvalds 已提交
1623 1624 1625 1626
			*csocket = NULL;
			return rc;
		} else {
		/* BB other socket options to set KEEPALIVE, NODELAY? */
S
Steve French 已提交
1627
			 cFYI(1, ("ipv6 Socket created"));
L
Linus Torvalds 已提交
1628 1629 1630 1631 1632 1633
			(*csocket)->sk->sk_allocation = GFP_NOFS;
		}
	}

	psin_server->sin6_family = AF_INET6;

S
Steve French 已提交
1634
	if (psin_server->sin6_port) { /* user overrode default port */
L
Linus Torvalds 已提交
1635 1636
		rc = (*csocket)->ops->connect(*csocket,
				(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1637
				sizeof(struct sockaddr_in6), 0);
L
Linus Torvalds 已提交
1638 1639
		if (rc >= 0)
			connected = 1;
1640
	}
L
Linus Torvalds 已提交
1641

S
Steve French 已提交
1642
	if (!connected) {
1643
		/* save original port so we can retry user specified port
L
Linus Torvalds 已提交
1644 1645 1646 1647
			later if fall back ports fail this time  */

		orig_port = psin_server->sin6_port;
		/* do not retry on the same port we just failed on */
S
Steve French 已提交
1648
		if (psin_server->sin6_port != htons(CIFS_PORT)) {
L
Linus Torvalds 已提交
1649 1650 1651 1652
			psin_server->sin6_port = htons(CIFS_PORT);

			rc = (*csocket)->ops->connect(*csocket,
					(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1653
					sizeof(struct sockaddr_in6), 0);
L
Linus Torvalds 已提交
1654 1655 1656 1657 1658 1659 1660
			if (rc >= 0)
				connected = 1;
		}
	}
	if (!connected) {
		psin_server->sin6_port = htons(RFC1001_PORT);
		rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
C
Cyrill Gorcunov 已提交
1661
				 psin_server, sizeof(struct sockaddr_in6), 0);
1662
		if (rc >= 0)
L
Linus Torvalds 已提交
1663 1664 1665 1666 1667 1668
			connected = 1;
	}

	/* give up here - unless we want to retry on different
		protocol families some day */
	if (!connected) {
S
Steve French 已提交
1669
		if (orig_port)
L
Linus Torvalds 已提交
1670
			psin_server->sin6_port = orig_port;
1671
		cFYI(1, ("Error %d connecting to server via ipv6", rc));
L
Linus Torvalds 已提交
1672 1673 1674 1675
		sock_release(*csocket);
		*csocket = NULL;
		return rc;
	}
1676 1677
	/* Eventually check for other socket options to change from
		the default. sock_setsockopt not used because it expects
L
Linus Torvalds 已提交
1678 1679
		user space buffer */
	(*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1680

L
Linus Torvalds 已提交
1681 1682 1683
	return rc;
}

1684 1685
void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
			  struct super_block *sb, struct smb_vol *vol_info)
1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696
{
	/* if we are reconnecting then should we check to see if
	 * any requested capabilities changed locally e.g. via
	 * remount but we can not do much about it here
	 * if they have (even if we could detect it by the following)
	 * Perhaps we could add a backpointer to array of sb from tcon
	 * or if we change to make all sb to same share the same
	 * sb as NFS - then we only have one backpointer to sb.
	 * What if we wanted to mount the server share twice once with
	 * and once without posixacls or posix paths? */
	__u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1697

1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709
	if (vol_info && vol_info->no_linux_ext) {
		tcon->fsUnixInfo.Capability = 0;
		tcon->unix_ext = 0; /* Unix Extensions disabled */
		cFYI(1, ("Linux protocol extensions disabled"));
		return;
	} else if (vol_info)
		tcon->unix_ext = 1; /* Unix Extensions supported */

	if (tcon->unix_ext == 0) {
		cFYI(1, ("Unix extensions disabled so not set on reconnect"));
		return;
	}
1710

S
Steve French 已提交
1711
	if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1712
		__u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1713

1714 1715
		/* check for reconnect case in which we do not
		   want to change the mount behavior if we can avoid it */
S
Steve French 已提交
1716
		if (vol_info == NULL) {
1717
			/* turn off POSIX ACL and PATHNAMES if not set
1718 1719 1720 1721 1722 1723
			   originally at mount time */
			if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
				cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
			if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
				cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
		}
1724

1725
		cap &= CIFS_UNIX_CAP_MASK;
1726
		if (vol_info && vol_info->no_psx_acl)
1727
			cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1728
		else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
S
Steve French 已提交
1729 1730
			cFYI(1, ("negotiated posix acl support"));
			if (sb)
1731 1732 1733
				sb->s_flags |= MS_POSIXACL;
		}

1734
		if (vol_info && vol_info->posix_paths == 0)
1735
			cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1736
		else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
S
Steve French 已提交
1737
			cFYI(1, ("negotiate posix pathnames"));
1738
			if (sb)
1739
				CIFS_SB(sb)->mnt_cifs_flags |=
1740 1741
					CIFS_MOUNT_POSIX_PATHS;
		}
1742

1743 1744
		/* We might be setting the path sep back to a different
		form if we are reconnecting and the server switched its
1745
		posix path capability for this share */
1746
		if (sb && (CIFS_SB(sb)->prepathlen > 0))
1747
			CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1748 1749 1750 1751 1752

		if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
			if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
				CIFS_SB(sb)->rsize = 127 * 1024;
#ifdef CONFIG_CIFS_DEBUG2
S
Steve French 已提交
1753
				cFYI(1, ("larger reads not supported by srv"));
1754 1755 1756
#endif
			}
		}
1757 1758 1759


		cFYI(1, ("Negotiate caps 0x%x", (int)cap));
1760
#ifdef CONFIG_CIFS_DEBUG2
1761
		if (cap & CIFS_UNIX_FCNTL_CAP)
S
Steve French 已提交
1762
			cFYI(1, ("FCNTL cap"));
1763
		if (cap & CIFS_UNIX_EXTATTR_CAP)
S
Steve French 已提交
1764
			cFYI(1, ("EXTATTR cap"));
1765
		if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
S
Steve French 已提交
1766
			cFYI(1, ("POSIX path cap"));
1767
		if (cap & CIFS_UNIX_XATTR_CAP)
S
Steve French 已提交
1768
			cFYI(1, ("XATTR cap"));
1769
		if (cap & CIFS_UNIX_POSIX_ACL_CAP)
S
Steve French 已提交
1770
			cFYI(1, ("POSIX ACL cap"));
1771
		if (cap & CIFS_UNIX_LARGE_READ_CAP)
S
Steve French 已提交
1772
			cFYI(1, ("very large read cap"));
1773
		if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
S
Steve French 已提交
1774
			cFYI(1, ("very large write cap"));
1775 1776
#endif /* CIFS_DEBUG2 */
		if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1777
			if (vol_info == NULL) {
1778
				cFYI(1, ("resetting capabilities failed"));
1779
			} else
1780 1781 1782 1783 1784
				cERROR(1, ("Negotiating Unix capabilities "
					   "with the server failed.  Consider "
					   "mounting with the Unix Extensions\n"
					   "disabled, if problems are found, "
					   "by specifying the nounix mount "
1785
					   "option."));
1786

1787 1788 1789 1790
		}
	}
}

L
Linus Torvalds 已提交
1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809
int
cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
	   char *mount_data, const char *devname)
{
	int rc = 0;
	int xid;
	int address_type = AF_INET;
	struct socket *csocket = NULL;
	struct sockaddr_in sin_server;
	struct sockaddr_in6 sin_server6;
	struct smb_vol volume_info;
	struct cifsSesInfo *pSesInfo = NULL;
	struct cifsSesInfo *existingCifsSes = NULL;
	struct cifsTconInfo *tcon = NULL;
	struct TCP_Server_Info *srvTcp = NULL;

	xid = GetXid();

/* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1810 1811

	memset(&volume_info, 0, sizeof(struct smb_vol));
L
Linus Torvalds 已提交
1812
	if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1813 1814
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1815 1816
	}

1817
	if (volume_info.nullauth) {
S
Steve French 已提交
1818
		cFYI(1, ("null user"));
1819
		volume_info.username = "";
1820
	} else if (volume_info.username) {
L
Linus Torvalds 已提交
1821
		/* BB fixme parse for domain name here */
S
Steve French 已提交
1822
		cFYI(1, ("Username: %s", volume_info.username));
L
Linus Torvalds 已提交
1823
	} else {
1824
		cifserror("No username specified");
1825 1826
	/* In userspace mount helper we can get user name from alternate
	   locations such as env variables and files on disk */
1827 1828
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1829 1830 1831
	}

	if (volume_info.UNCip && volume_info.UNC) {
1832 1833
		rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
				    &sin_server.sin_addr.s_addr);
L
Linus Torvalds 已提交
1834

S
Steve French 已提交
1835
		if (rc <= 0) {
L
Linus Torvalds 已提交
1836
			/* not ipv4 address, try ipv6 */
1837 1838
			rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
					    &sin_server6.sin6_addr.in6_u);
S
Steve French 已提交
1839
			if (rc > 0)
L
Linus Torvalds 已提交
1840 1841 1842 1843
				address_type = AF_INET6;
		} else {
			address_type = AF_INET;
		}
1844

S
Steve French 已提交
1845
		if (rc <= 0) {
L
Linus Torvalds 已提交
1846
			/* we failed translating address */
1847 1848
			rc = -EINVAL;
			goto out;
L
Linus Torvalds 已提交
1849 1850 1851 1852 1853
		}

		cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
		/* success */
		rc = 0;
1854 1855 1856 1857
	} else if (volume_info.UNCip) {
		/* BB using ip addr as server name to connect to the
		   DFS root below */
		cERROR(1, ("Connecting to DFS root not implemented yet"));
1858 1859
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1860 1861
	} else /* which servers DFS root would we conect to */ {
		cERROR(1,
1862 1863
		       ("CIFS mount error: No UNC path (e.g. -o "
			"unc=//192.168.1.100/public) specified"));
1864 1865
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1866 1867 1868
	}

	/* this is needed for ASCII cp to Unicode converts */
S
Steve French 已提交
1869
	if (volume_info.iocharset == NULL) {
L
Linus Torvalds 已提交
1870 1871 1872 1873
		cifs_sb->local_nls = load_nls_default();
	/* load_nls_default can not return null */
	} else {
		cifs_sb->local_nls = load_nls(volume_info.iocharset);
S
Steve French 已提交
1874
		if (cifs_sb->local_nls == NULL) {
1875 1876
			cERROR(1, ("CIFS mount error: iocharset %s not found",
				 volume_info.iocharset));
1877 1878
			rc = -ELIBACC;
			goto out;
L
Linus Torvalds 已提交
1879 1880 1881
		}
	}

S
Steve French 已提交
1882
	if (address_type == AF_INET)
L
Linus Torvalds 已提交
1883 1884 1885
		existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
			NULL /* no ipv6 addr */,
			volume_info.username, &srvTcp);
S
Steve French 已提交
1886 1887
	else if (address_type == AF_INET6) {
		cFYI(1, ("looking for ipv6 address"));
L
Linus Torvalds 已提交
1888 1889 1890
		existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
			&sin_server6.sin6_addr,
			volume_info.username, &srvTcp);
S
Steve French 已提交
1891
	} else {
1892 1893
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1894 1895 1896
	}

	if (srvTcp) {
1897
		cFYI(1, ("Existing tcp session with server found"));
L
Linus Torvalds 已提交
1898
	} else {	/* create socket */
1899
		if (volume_info.port)
L
Linus Torvalds 已提交
1900 1901 1902
			sin_server.sin_port = htons(volume_info.port);
		else
			sin_server.sin_port = 0;
S
Steve French 已提交
1903
		if (address_type == AF_INET6) {
S
Steve French 已提交
1904
			cFYI(1, ("attempting ipv6 connect"));
S
Steve French 已提交
1905 1906
			/* BB should we allow ipv6 on port 139? */
			/* other OS never observed in Wild doing 139 with v6 */
1907 1908 1909
			rc = ipv6_connect(&sin_server6, &csocket);
		} else
			rc = ipv4_connect(&sin_server, &csocket,
1910 1911
				  volume_info.source_rfc1001_name,
				  volume_info.target_rfc1001_name);
L
Linus Torvalds 已提交
1912
		if (rc < 0) {
1913 1914
			cERROR(1, ("Error connecting to IPv4 socket. "
				   "Aborting operation"));
1915
			if (csocket != NULL)
L
Linus Torvalds 已提交
1916
				sock_release(csocket);
1917
			goto out;
L
Linus Torvalds 已提交
1918 1919
		}

1920 1921
		srvTcp = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
		if (!srvTcp) {
L
Linus Torvalds 已提交
1922 1923
			rc = -ENOMEM;
			sock_release(csocket);
1924
			goto out;
L
Linus Torvalds 已提交
1925
		} else {
1926
			memcpy(&srvTcp->addr.sockAddr, &sin_server,
C
Cyrill Gorcunov 已提交
1927
				sizeof(struct sockaddr_in));
1928
			atomic_set(&srvTcp->inFlight, 0);
L
Linus Torvalds 已提交
1929 1930 1931
			/* BB Add code for ipv6 case too */
			srvTcp->ssocket = csocket;
			srvTcp->protocolType = IPV4;
1932 1933 1934 1935 1936 1937
			srvTcp->hostname = extract_hostname(volume_info.UNC);
			if (IS_ERR(srvTcp->hostname)) {
				rc = PTR_ERR(srvTcp->hostname);
				sock_release(csocket);
				goto out;
			}
L
Linus Torvalds 已提交
1938 1939 1940 1941 1942 1943 1944 1945
			init_waitqueue_head(&srvTcp->response_q);
			init_waitqueue_head(&srvTcp->request_q);
			INIT_LIST_HEAD(&srvTcp->pending_mid_q);
			/* at this point we are the only ones with the pointer
			to the struct since the kernel thread not created yet
			so no need to spinlock this init of tcpStatus */
			srvTcp->tcpStatus = CifsNew;
			init_MUTEX(&srvTcp->tcpSem);
1946
			srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1947
			if ( IS_ERR(srvTcp->tsk) ) {
1948
				rc = PTR_ERR(srvTcp->tsk);
1949
				cERROR(1, ("error %d create cifsd thread", rc));
1950
				srvTcp->tsk = NULL;
L
Linus Torvalds 已提交
1951
				sock_release(csocket);
1952
				kfree(srvTcp->hostname);
1953
				goto out;
1954 1955 1956
			}
			wait_for_completion(&cifsd_complete);
			rc = 0;
1957 1958 1959 1960
			memcpy(srvTcp->workstation_RFC1001_name,
				volume_info.source_rfc1001_name, 16);
			memcpy(srvTcp->server_RFC1001_name,
				volume_info.target_rfc1001_name, 16);
1961
			srvTcp->sequence_number = 0;
L
Linus Torvalds 已提交
1962 1963 1964 1965 1966
		}
	}

	if (existingCifsSes) {
		pSesInfo = existingCifsSes;
1967
		cFYI(1, ("Existing smb sess found"));
L
Linus Torvalds 已提交
1968
	} else if (!rc) {
1969
		cFYI(1, ("Existing smb sess not found"));
L
Linus Torvalds 已提交
1970 1971 1972 1973 1974 1975 1976 1977 1978
		pSesInfo = sesInfoAlloc();
		if (pSesInfo == NULL)
			rc = -ENOMEM;
		else {
			pSesInfo->server = srvTcp;
			sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
				NIPQUAD(sin_server.sin_addr.s_addr));
		}

1979 1980
		if (!rc) {
			/* volume_info.password freed at unmount */
1981
			if (volume_info.password) {
L
Linus Torvalds 已提交
1982
				pSesInfo->password = volume_info.password;
1983 1984 1985
				/* set to NULL to prevent freeing on exit */
				volume_info.password = NULL;
			}
L
Linus Torvalds 已提交
1986 1987
			if (volume_info.username)
				strncpy(pSesInfo->userName,
1988 1989
					volume_info.username,
					MAX_USERNAME_SIZE);
1990 1991
			if (volume_info.domainname) {
				int len = strlen(volume_info.domainname);
1992
				pSesInfo->domainName =
1993
					kmalloc(len + 1, GFP_KERNEL);
1994
				if (pSesInfo->domainName)
1995 1996 1997
					strcpy(pSesInfo->domainName,
						volume_info.domainname);
			}
L
Linus Torvalds 已提交
1998
			pSesInfo->linux_uid = volume_info.linux_uid;
1999
			pSesInfo->overrideSecFlg = volume_info.secFlg;
L
Linus Torvalds 已提交
2000
			down(&pSesInfo->sesSem);
2001
			/* BB FIXME need to pass vol->secFlgs BB */
2002 2003
			rc = cifs_setup_session(xid, pSesInfo,
						cifs_sb->local_nls);
L
Linus Torvalds 已提交
2004
			up(&pSesInfo->sesSem);
2005
			if (!rc)
L
Linus Torvalds 已提交
2006
				atomic_inc(&srvTcp->socketUseCount);
2007
		}
L
Linus Torvalds 已提交
2008
	}
2009

L
Linus Torvalds 已提交
2010 2011
	/* search for existing tcon to this server share */
	if (!rc) {
2012
		if (volume_info.rsize > CIFSMaxBufSize) {
2013
			cERROR(1, ("rsize %d too large, using MaxBufSize",
2014 2015
				volume_info.rsize));
			cifs_sb->rsize = CIFSMaxBufSize;
2016 2017
		} else if ((volume_info.rsize) &&
				(volume_info.rsize <= CIFSMaxBufSize))
L
Linus Torvalds 已提交
2018
			cifs_sb->rsize = volume_info.rsize;
2019 2020 2021
		else /* default */
			cifs_sb->rsize = CIFSMaxBufSize;

2022
		if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2023
			cERROR(1, ("wsize %d too large, using 4096 instead",
2024 2025
				  volume_info.wsize));
			cifs_sb->wsize = 4096;
2026
		} else if (volume_info.wsize)
L
Linus Torvalds 已提交
2027 2028
			cifs_sb->wsize = volume_info.wsize;
		else
2029
			cifs_sb->wsize =
S
Steve French 已提交
2030 2031
				min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
					127*1024);
2032
			/* old default of CIFSMaxBufSize was too small now
2033
			   that SMB Write2 can send multiple pages in kvec.
2034 2035 2036 2037 2038
			   RFC1001 does not describe what happens when frame
			   bigger than 128K is sent so use that as max in
			   conjunction with 52K kvec constraint on arch with 4K
			   page size  */

2039
		if (cifs_sb->rsize < 2048) {
2040
			cifs_sb->rsize = 2048;
2041
			/* Windows ME may prefer this */
S
Steve French 已提交
2042
			cFYI(1, ("readsize set to minimum: 2048"));
L
Linus Torvalds 已提交
2043
		}
2044 2045
		/* calculate prepath */
		cifs_sb->prepath = volume_info.prepath;
2046
		if (cifs_sb->prepath) {
2047 2048 2049
			cifs_sb->prepathlen = strlen(cifs_sb->prepath);
			cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
			volume_info.prepath = NULL;
2050
		} else
2051
			cifs_sb->prepathlen = 0;
L
Linus Torvalds 已提交
2052 2053 2054 2055
		cifs_sb->mnt_uid = volume_info.linux_uid;
		cifs_sb->mnt_gid = volume_info.linux_gid;
		cifs_sb->mnt_file_mode = volume_info.file_mode;
		cifs_sb->mnt_dir_mode = volume_info.dir_mode;
S
Steve French 已提交
2056 2057
		cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
			cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
L
Linus Torvalds 已提交
2058

2059
		if (volume_info.noperm)
L
Linus Torvalds 已提交
2060
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2061
		if (volume_info.setuids)
L
Linus Torvalds 已提交
2062
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2063
		if (volume_info.server_ino)
L
Linus Torvalds 已提交
2064
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2065
		if (volume_info.remap)
2066
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2067
		if (volume_info.no_xattr)
L
Linus Torvalds 已提交
2068
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2069
		if (volume_info.sfu_emul)
2070
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2071
		if (volume_info.nobrl)
2072
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2073
		if (volume_info.cifs_acl)
2074
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2075 2076 2077 2078 2079
		if (volume_info.override_uid)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
		if (volume_info.override_gid)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
		if (volume_info.direct_io) {
S
Steve French 已提交
2080
			cFYI(1, ("mounting share using direct i/o"));
L
Linus Torvalds 已提交
2081 2082 2083 2084 2085 2086 2087
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
		}

		tcon =
		    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
			     volume_info.username);
		if (tcon) {
2088
			cFYI(1, ("Found match on UNC path"));
L
Linus Torvalds 已提交
2089 2090
			/* we can have only one retry value for a connection
			   to a share so for resources mounted more than once
2091
			   to the same server share the last value passed in
L
Linus Torvalds 已提交
2092 2093
			   for the retry flag is used */
			tcon->retry = volume_info.retry;
2094
			tcon->nocase = volume_info.nocase;
L
Linus Torvalds 已提交
2095 2096 2097 2098 2099
		} else {
			tcon = tconInfoAlloc();
			if (tcon == NULL)
				rc = -ENOMEM;
			else {
2100
				/* check for null share name ie connecting to
2101
				 * dfs root */
L
Linus Torvalds 已提交
2102

2103
				/* BB check if this works for exactly length
2104
				 * three strings */
L
Linus Torvalds 已提交
2105 2106 2107
				if ((strchr(volume_info.UNC + 3, '\\') == NULL)
				    && (strchr(volume_info.UNC + 3, '/') ==
					NULL)) {
2108
					rc = connect_to_dfs_path(xid, pSesInfo,
2109
						"", cifs_sb->local_nls,
2110
						cifs_sb->mnt_cifs_flags &
2111
						  CIFS_MOUNT_MAP_SPECIAL_CHR);
2112 2113
					rc = -ENODEV;
					goto out;
L
Linus Torvalds 已提交
2114
				} else {
2115 2116 2117
					/* BB Do we need to wrap sesSem around
					 * this TCon call and Unix SetFS as
					 * we do on SessSetup and reconnect? */
2118
					rc = CIFSTCon(xid, pSesInfo,
L
Linus Torvalds 已提交
2119 2120 2121 2122 2123 2124 2125
						volume_info.UNC,
						tcon, cifs_sb->local_nls);
					cFYI(1, ("CIFS Tcon rc = %d", rc));
				}
				if (!rc) {
					atomic_inc(&pSesInfo->inUse);
					tcon->retry = volume_info.retry;
2126
					tcon->nocase = volume_info.nocase;
L
Linus Torvalds 已提交
2127 2128 2129 2130
				}
			}
		}
	}
2131
	if (pSesInfo) {
L
Linus Torvalds 已提交
2132 2133 2134 2135 2136 2137
		if (pSesInfo->capabilities & CAP_LARGE_FILES) {
			sb->s_maxbytes = (u64) 1 << 63;
		} else
			sb->s_maxbytes = (u64) 1 << 31;	/* 2 GB */
	}

2138
	/* BB FIXME fix time_gran to be larger for LANMAN sessions */
L
Linus Torvalds 已提交
2139 2140 2141 2142 2143 2144
	sb->s_time_gran = 100;

/* on error free sesinfo and tcon struct if needed */
	if (rc) {
		/* if session setup failed, use count is zero but
		we still need to free cifsd thread */
2145
		if (atomic_read(&srvTcp->socketUseCount) == 0) {
L
Linus Torvalds 已提交
2146 2147 2148
			spin_lock(&GlobalMid_Lock);
			srvTcp->tcpStatus = CifsExiting;
			spin_unlock(&GlobalMid_Lock);
2149
			if (srvTcp->tsk) {
2150 2151 2152 2153 2154
				struct task_struct *tsk;
				/* If we could verify that kthread_stop would
				   always wake up processes blocked in
				   tcp in recv_mesg then we could remove the
				   send_sig call */
2155
				force_sig(SIGKILL, srvTcp->tsk);
2156
				tsk = srvTcp->tsk;
S
Steve French 已提交
2157
				if (tsk)
S
Steve French 已提交
2158
					kthread_stop(tsk);
2159
			}
L
Linus Torvalds 已提交
2160 2161 2162 2163 2164 2165
		}
		 /* If find_unc succeeded then rc == 0 so we can not end */
		if (tcon)  /* up accidently freeing someone elses tcon struct */
			tconInfoFree(tcon);
		if (existingCifsSes == NULL) {
			if (pSesInfo) {
2166
				if ((pSesInfo->server) &&
L
Linus Torvalds 已提交
2167 2168 2169 2170
				    (pSesInfo->status == CifsGood)) {
					int temp_rc;
					temp_rc = CIFSSMBLogoff(xid, pSesInfo);
					/* if the socketUseCount is now zero */
2171
					if ((temp_rc == -ESHUTDOWN) &&
2172
					    (pSesInfo->server) &&
2173
					    (pSesInfo->server->tsk)) {
2174
						struct task_struct *tsk;
2175 2176
						force_sig(SIGKILL,
							pSesInfo->server->tsk);
2177
						tsk = pSesInfo->server->tsk;
S
Steve French 已提交
2178
						if (tsk)
2179
							kthread_stop(tsk);
2180
					}
2181
				} else {
L
Linus Torvalds 已提交
2182
					cFYI(1, ("No session or bad tcon"));
2183 2184 2185 2186 2187 2188 2189 2190 2191 2192
					if ((pSesInfo->server) &&
					    (pSesInfo->server->tsk)) {
						struct task_struct *tsk;
						force_sig(SIGKILL,
							pSesInfo->server->tsk);
						tsk = pSesInfo->server->tsk;
						if (tsk)
							kthread_stop(tsk);
					}
				}
L
Linus Torvalds 已提交
2193 2194 2195 2196 2197 2198 2199 2200 2201
				sesInfoFree(pSesInfo);
				/* pSesInfo = NULL; */
			}
		}
	} else {
		atomic_inc(&tcon->useCount);
		cifs_sb->tcon = tcon;
		tcon->ses = pSesInfo;

2202
		/* do not care if following two calls succeed - informational */
2203 2204 2205 2206
		if (!tcon->ipc) {
			CIFSSMBQFSDeviceInfo(xid, tcon);
			CIFSSMBQFSAttributeInfo(xid, tcon);
		}
2207

2208 2209
		/* tell server which Unix caps we support */
		if (tcon->ses->capabilities & CAP_UNIX)
2210 2211
			/* reset of caps checks mount to see if unix extensions
			   disabled for just this mount */
2212
			reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2213 2214 2215 2216
		else
			tcon->unix_ext = 0; /* server does not support them */

		if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2217 2218
			cifs_sb->rsize = 1024 * 127;
#ifdef CONFIG_CIFS_DEBUG2
2219
			cFYI(1, ("no very large read support, rsize now 127K"));
2220 2221
#endif
		}
2222 2223 2224 2225
		if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
			cifs_sb->wsize = min(cifs_sb->wsize,
					     (tcon->ses->server->maxBuf -
					      MAX_CIFS_HDR_SIZE));
2226
		if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2227 2228 2229
			cifs_sb->rsize = min(cifs_sb->rsize,
					     (tcon->ses->server->maxBuf -
					      MAX_CIFS_HDR_SIZE));
L
Linus Torvalds 已提交
2230 2231 2232 2233 2234 2235
	}

	/* volume_info.password is freed above when existing session found
	(in which case it is not needed anymore) but when new sesion is created
	the password ptr is put in the new session structure (in which case the
	password will be freed at unmount time) */
2236 2237 2238 2239 2240 2241
out:
	/* zero out password before freeing */
	if (volume_info.password != NULL) {
		memset(volume_info.password, 0, strlen(volume_info.password));
		kfree(volume_info.password);
	}
J
Jesper Juhl 已提交
2242
	kfree(volume_info.UNC);
2243
	kfree(volume_info.prepath);
L
Linus Torvalds 已提交
2244 2245 2246 2247 2248 2249
	FreeXid(xid);
	return rc;
}

static int
CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2250
	      char session_key[CIFS_SESS_KEY_SIZE],
L
Linus Torvalds 已提交
2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266
	      const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *user;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
	__u32 capabilities;
	__u16 count;

2267
	cFYI(1, ("In sesssetup"));
2268
	if (ses == NULL)
L
Linus Torvalds 已提交
2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282
		return -EINVAL;
	user = ses->userName;
	domain = ses->domainName;
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
	pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 13 /* wct */ );

2283
	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2284 2285 2286 2287
	pSMB->req_no_secext.AndXCommand = 0xFF;
	pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

2288 2289
	if (ses->server->secMode &
			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
		CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);

2308
	pSMB->req_no_secext.CaseInsensitivePasswordLength =
2309
		cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2310 2311

	pSMB->req_no_secext.CaseSensitivePasswordLength =
2312
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2313
	bcc_ptr = pByteArea(smb_buffer);
2314 2315 2316 2317
	memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
	bcc_ptr += CIFS_SESS_KEY_SIZE;
	memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
	bcc_ptr += CIFS_SESS_KEY_SIZE;
L
Linus Torvalds 已提交
2318 2319 2320 2321 2322 2323

	if (ses->capabilities & CAP_UNICODE) {
		if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
			*bcc_ptr = 0;
			bcc_ptr++;
		}
2324
		if (user == NULL)
2325
			bytes_returned = 0; /* skip null user */
2326
		else
L
Linus Torvalds 已提交
2327
			bytes_returned =
2328
				cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
L
Linus Torvalds 已提交
2329 2330 2331 2332 2333 2334
					nls_codepage);
		/* convert number of 16 bit words to bytes */
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* trailing null */
		if (domain == NULL)
			bytes_returned =
2335
			    cifs_strtoUCS((__le16 *) bcc_ptr,
L
Linus Torvalds 已提交
2336 2337 2338
					  "CIFS_LINUX_DOM", 32, nls_codepage);
		else
			bytes_returned =
2339
			    cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
L
Linus Torvalds 已提交
2340 2341 2342 2343
					  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
		bytes_returned =
2344
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
2345 2346 2347
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
2348
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
L
Linus Torvalds 已提交
2349 2350 2351 2352
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
		bytes_returned =
2353
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
2354 2355 2356 2357
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
	} else {
2358
		if (user != NULL) {
L
Linus Torvalds 已提交
2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374
		    strncpy(bcc_ptr, user, 200);
		    bcc_ptr += strnlen(user, 200);
		}
		*bcc_ptr = 0;
		bcc_ptr++;
		if (domain == NULL) {
			strcpy(bcc_ptr, "CIFS_LINUX_DOM");
			bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
		} else {
			strncpy(bcc_ptr, domain, 64);
			bcc_ptr += strnlen(domain, 64);
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
2375 2376
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
2377 2378 2379 2380 2381 2382 2383 2384
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
	}
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req_no_secext.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2385
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
2386 2387 2388 2389 2390 2391 2392
	if (rc) {
/* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
	} else if ((smb_buffer_response->WordCount == 3)
		   || (smb_buffer_response->WordCount == 4)) {
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
		if (action & GUEST_LOGIN)
2393 2394 2395
			cFYI(1, (" Guest login")); /* BB mark SesInfo struct? */
		ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
							 (little endian) */
L
Linus Torvalds 已提交
2396
		cFYI(1, ("UID = %d ", ses->Suid));
2397 2398
	/* response can have either 3 or 4 word count - Samba sends 3 */
		bcc_ptr = pByteArea(smb_buffer_response);
L
Linus Torvalds 已提交
2399 2400 2401 2402 2403 2404 2405 2406 2407
		if ((pSMBr->resp.hdr.WordCount == 3)
		    || ((pSMBr->resp.hdr.WordCount == 4)
			&& (blob_len < pSMBr->resp.ByteCount))) {
			if (pSMBr->resp.hdr.WordCount == 4)
				bcc_ptr += blob_len;

			if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
				if ((long) (bcc_ptr) % 2) {
					remaining_words =
2408 2409 2410 2411
					    (BCC(smb_buffer_response) - 1) / 2;
					/* Unicode strings must be word
					   aligned */
					bcc_ptr++;
L
Linus Torvalds 已提交
2412 2413 2414 2415 2416 2417 2418 2419 2420 2421
				} else {
					remaining_words =
						BCC(smb_buffer_response) / 2;
				}
				len =
				    UniStrnlen((wchar_t *) bcc_ptr,
					       remaining_words - 1);
/* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
S
Steve French 已提交
2422
				if (ses->serverOS)
2423
					kfree(ses->serverOS);
2424 2425
				ses->serverOS = kzalloc(2 * (len + 1),
							GFP_KERNEL);
S
Steve French 已提交
2426
				if (ses->serverOS == NULL)
2427
					goto sesssetup_nomem;
L
Linus Torvalds 已提交
2428
				cifs_strfromUCS_le(ses->serverOS,
2429 2430
						   (__le16 *)bcc_ptr,
						   len, nls_codepage);
L
Linus Torvalds 已提交
2431 2432 2433 2434 2435 2436 2437
				bcc_ptr += 2 * (len + 1);
				remaining_words -= len + 1;
				ses->serverOS[2 * len] = 0;
				ses->serverOS[1 + (2 * len)] = 0;
				if (remaining_words > 0) {
					len = UniStrnlen((wchar_t *)bcc_ptr,
							 remaining_words-1);
2438
					kfree(ses->serverNOS);
2439 2440
					ses->serverNOS = kzalloc(2 * (len + 1),
								 GFP_KERNEL);
S
Steve French 已提交
2441
					if (ses->serverNOS == NULL)
2442
						goto sesssetup_nomem;
L
Linus Torvalds 已提交
2443
					cifs_strfromUCS_le(ses->serverNOS,
2444 2445
							   (__le16 *)bcc_ptr,
							   len, nls_codepage);
L
Linus Torvalds 已提交
2446 2447 2448
					bcc_ptr += 2 * (len + 1);
					ses->serverNOS[2 * len] = 0;
					ses->serverNOS[1 + (2 * len)] = 0;
S
Steve French 已提交
2449
					if (strncmp(ses->serverNOS,
2450
						"NT LAN Manager 4", 16) == 0) {
S
Steve French 已提交
2451
						cFYI(1, ("NT4 server"));
L
Linus Torvalds 已提交
2452 2453 2454 2455
						ses->flags |= CIFS_SES_NT4;
					}
					remaining_words -= len + 1;
					if (remaining_words > 0) {
2456
						len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2457 2458
				/* last string is not always null terminated
				   (for e.g. for Windows XP & 2000) */
S
Steve French 已提交
2459
						if (ses->serverDomain)
2460
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2461
						ses->serverDomain =
2462 2463
						    kzalloc(2*(len+1),
							    GFP_KERNEL);
S
Steve French 已提交
2464
						if (ses->serverDomain == NULL)
2465
							goto sesssetup_nomem;
L
Linus Torvalds 已提交
2466
						cifs_strfromUCS_le(ses->serverDomain,
2467 2468
							(__le16 *)bcc_ptr,
							len, nls_codepage);
L
Linus Torvalds 已提交
2469 2470 2471
						bcc_ptr += 2 * (len + 1);
						ses->serverDomain[2*len] = 0;
						ses->serverDomain[1+(2*len)] = 0;
2472 2473
					} else { /* else no more room so create
						  dummy domain string */
S
Steve French 已提交
2474
						if (ses->serverDomain)
2475
							kfree(ses->serverDomain);
2476
						ses->serverDomain =
2477
							kzalloc(2, GFP_KERNEL);
2478
					}
2479 2480 2481
				} else { /* no room so create dummy domain
					    and NOS string */

2482 2483 2484
					/* if these kcallocs fail not much we
					   can do, but better to not fail the
					   sesssetup itself */
2485
					kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2486
					ses->serverDomain =
2487
					    kzalloc(2, GFP_KERNEL);
2488
					kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2489
					ses->serverNOS =
2490
					    kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
2491 2492 2493 2494 2495 2496
				}
			} else {	/* ASCII */
				len = strnlen(bcc_ptr, 1024);
				if (((long) bcc_ptr + len) - (long)
				    pByteArea(smb_buffer_response)
					    <= BCC(smb_buffer_response)) {
2497
					kfree(ses->serverOS);
2498 2499
					ses->serverOS = kzalloc(len + 1,
								GFP_KERNEL);
S
Steve French 已提交
2500
					if (ses->serverOS == NULL)
2501
						goto sesssetup_nomem;
2502
					strncpy(ses->serverOS, bcc_ptr, len);
L
Linus Torvalds 已提交
2503 2504

					bcc_ptr += len;
2505 2506
					/* null terminate the string */
					bcc_ptr[0] = 0;
L
Linus Torvalds 已提交
2507 2508 2509
					bcc_ptr++;

					len = strnlen(bcc_ptr, 1024);
2510
					kfree(ses->serverNOS);
2511 2512
					ses->serverNOS = kzalloc(len + 1,
								 GFP_KERNEL);
S
Steve French 已提交
2513
					if (ses->serverNOS == NULL)
2514
						goto sesssetup_nomem;
L
Linus Torvalds 已提交
2515 2516 2517 2518 2519 2520
					strncpy(ses->serverNOS, bcc_ptr, len);
					bcc_ptr += len;
					bcc_ptr[0] = 0;
					bcc_ptr++;

					len = strnlen(bcc_ptr, 1024);
S
Steve French 已提交
2521
					if (ses->serverDomain)
2522
						kfree(ses->serverDomain);
2523 2524
					ses->serverDomain = kzalloc(len + 1,
								    GFP_KERNEL);
S
Steve French 已提交
2525
					if (ses->serverDomain == NULL)
2526
						goto sesssetup_nomem;
2527 2528
					strncpy(ses->serverDomain, bcc_ptr,
						len);
L
Linus Torvalds 已提交
2529 2530 2531 2532 2533
					bcc_ptr += len;
					bcc_ptr[0] = 0;
					bcc_ptr++;
				} else
					cFYI(1,
2534 2535
					     ("Variable field of length %d "
						"extends beyond end of smb ",
L
Linus Torvalds 已提交
2536 2537 2538 2539
					      len));
			}
		} else {
			cERROR(1,
2540 2541
			       (" Security Blob Length extends beyond "
				"end of SMB"));
L
Linus Torvalds 已提交
2542 2543 2544 2545 2546 2547 2548
		}
	} else {
		cERROR(1,
		       (" Invalid Word count %d: ",
			smb_buffer_response->WordCount));
		rc = -EIO;
	}
2549 2550 2551
sesssetup_nomem:	/* do not return an error on nomem for the info strings,
			   since that could make reconnection harder, and
			   reconnection might be needed to free memory */
2552
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
2553 2554 2555 2556 2557 2558

	return rc;
}

static int
CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2559
			      struct cifsSesInfo *ses, int *pNTLMv2_flag,
L
Linus Torvalds 已提交
2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571
			      const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
C
Cyrill Gorcunov 已提交
2572
	int SecurityBlobLength = sizeof(NEGOTIATE_MESSAGE);
L
Linus Torvalds 已提交
2573 2574 2575 2576 2577
	PNEGOTIATE_MESSAGE SecurityBlob;
	PCHALLENGE_MESSAGE SecurityBlob2;
	__u32 negotiate_flags, capabilities;
	__u16 count;

2578
	cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
S
Steve French 已提交
2579
	if (ses == NULL)
L
Linus Torvalds 已提交
2580 2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593
		return -EINVAL;
	domain = ses->domainName;
	*pNTLMv2_flag = FALSE;
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
	pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
	pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 12 /* wct */ );
2594 2595

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2596 2597 2598 2599 2600 2601 2602
	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
	pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);

	pSMB->req.AndXCommand = 0xFF;
	pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

S
Steve French 已提交
2603
	if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
	    CAP_EXTENDED_SECURITY;
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req.Capabilities = cpu_to_le32(capabilities);

	bcc_ptr = (char *) &pSMB->req.SecurityBlob;
	SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
	strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
	SecurityBlob->MessageType = NtLmNegotiate;
	negotiate_flags =
	    NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2628 2629
	    NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
	    NTLMSSP_NEGOTIATE_56 |
L
Linus Torvalds 已提交
2630
	    /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
S
Steve French 已提交
2631
	if (sign_CIFS_PDUs)
L
Linus Torvalds 已提交
2632
		negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
S
Steve French 已提交
2633
/*	if (ntlmv2_support)
2634
		negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
L
Linus Torvalds 已提交
2635 2636 2637 2638 2639 2640 2641
	/* setup pointers to domain name and workstation name */
	bcc_ptr += SecurityBlobLength;

	SecurityBlob->WorkstationName.Buffer = 0;
	SecurityBlob->WorkstationName.Length = 0;
	SecurityBlob->WorkstationName.MaximumLength = 0;

2642 2643 2644 2645 2646
	/* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
	along with username on auth request (ie the response to challenge) */
	SecurityBlob->DomainName.Buffer = 0;
	SecurityBlob->DomainName.Length = 0;
	SecurityBlob->DomainName.MaximumLength = 0;
L
Linus Torvalds 已提交
2647 2648 2649 2650 2651 2652 2653
	if (ses->capabilities & CAP_UNICODE) {
		if ((long) bcc_ptr % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}

		bytes_returned =
2654
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
2655 2656 2657
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
2658
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
L
Linus Torvalds 已提交
2659 2660 2661 2662
				  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* null terminate Linux version */
		bytes_returned =
2663
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null terminate network opsys string */
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null domain */
	} else {		/* ASCII */
		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
2675 2676
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
		bcc_ptr++;	/* empty domain field */
		*bcc_ptr = 0;
	}
	SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
	pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2689
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702

	if (smb_buffer_response->Status.CifsError ==
	    cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
		rc = 0;

	if (rc) {
/*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
	} else if ((smb_buffer_response->WordCount == 3)
		   || (smb_buffer_response->WordCount == 4)) {
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);

		if (action & GUEST_LOGIN)
2703 2704
			cFYI(1, (" Guest login"));
	/* Do we want to set anything in SesInfo struct when guest login? */
L
Linus Torvalds 已提交
2705

2706 2707
		bcc_ptr = pByteArea(smb_buffer_response);
	/* response can have either 3 or 4 word count - Samba sends 3 */
L
Linus Torvalds 已提交
2708 2709 2710 2711 2712 2713 2714

		SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
		if (SecurityBlob2->MessageType != NtLmChallenge) {
			cFYI(1,
			     ("Unexpected NTLMSSP message type received %d",
			      SecurityBlob2->MessageType));
		} else if (ses) {
2715
			ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2716
			cFYI(1, ("UID = %d", ses->Suid));
L
Linus Torvalds 已提交
2717 2718 2719 2720 2721 2722 2723
			if ((pSMBr->resp.hdr.WordCount == 3)
			    || ((pSMBr->resp.hdr.WordCount == 4)
				&& (blob_len <
				    pSMBr->resp.ByteCount))) {

				if (pSMBr->resp.hdr.WordCount == 4) {
					bcc_ptr += blob_len;
2724
					cFYI(1, ("Security Blob Length %d",
L
Linus Torvalds 已提交
2725 2726 2727
					      blob_len));
				}

2728
				cFYI(1, ("NTLMSSP Challenge rcvd"));
L
Linus Torvalds 已提交
2729 2730 2731 2732

				memcpy(ses->server->cryptKey,
				       SecurityBlob2->Challenge,
				       CIFS_CRYPTO_KEY_SIZE);
2733
				if (SecurityBlob2->NegotiateFlags &
2734
					cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
L
Linus Torvalds 已提交
2735 2736
					*pNTLMv2_flag = TRUE;

2737 2738
				if ((SecurityBlob2->NegotiateFlags &
					cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
L
Linus Torvalds 已提交
2739
					|| (sign_CIFS_PDUs > 1))
2740 2741 2742
						ses->server->secMode |=
							SECMODE_SIGN_REQUIRED;
				if ((SecurityBlob2->NegotiateFlags &
L
Linus Torvalds 已提交
2743
					cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2744
						ses->server->secMode |=
L
Linus Torvalds 已提交
2745 2746 2747 2748 2749 2750 2751
							SECMODE_SIGN_ENABLED;

				if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
					if ((long) (bcc_ptr) % 2) {
						remaining_words =
						    (BCC(smb_buffer_response)
						     - 1) / 2;
2752 2753
					 /* Must word align unicode strings */
						bcc_ptr++;
L
Linus Torvalds 已提交
2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764
					} else {
						remaining_words =
						    BCC
						    (smb_buffer_response) / 2;
					}
					len =
					    UniStrnlen((wchar_t *) bcc_ptr,
						       remaining_words - 1);
/* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
S
Steve French 已提交
2765
					if (ses->serverOS)
2766
						kfree(ses->serverOS);
L
Linus Torvalds 已提交
2767
					ses->serverOS =
2768
					    kzalloc(2 * (len + 1), GFP_KERNEL);
L
Linus Torvalds 已提交
2769
					cifs_strfromUCS_le(ses->serverOS,
2770
							   (__le16 *)
L
Linus Torvalds 已提交
2771 2772 2773 2774 2775 2776 2777 2778 2779 2780 2781
							   bcc_ptr, len,
							   nls_codepage);
					bcc_ptr += 2 * (len + 1);
					remaining_words -= len + 1;
					ses->serverOS[2 * len] = 0;
					ses->serverOS[1 + (2 * len)] = 0;
					if (remaining_words > 0) {
						len = UniStrnlen((wchar_t *)
								 bcc_ptr,
								 remaining_words
								 - 1);
2782
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2783
						ses->serverNOS =
2784
						    kzalloc(2 * (len + 1),
L
Linus Torvalds 已提交
2785 2786 2787
							    GFP_KERNEL);
						cifs_strfromUCS_le(ses->
								   serverNOS,
2788
								   (__le16 *)
L
Linus Torvalds 已提交
2789 2790 2791 2792 2793 2794 2795 2796 2797
								   bcc_ptr,
								   len,
								   nls_codepage);
						bcc_ptr += 2 * (len + 1);
						ses->serverNOS[2 * len] = 0;
						ses->serverNOS[1 +
							       (2 * len)] = 0;
						remaining_words -= len + 1;
						if (remaining_words > 0) {
2798 2799 2800
							len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
				/* last string not always null terminated
				   (for e.g. for Windows XP & 2000) */
2801
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2802
							ses->serverDomain =
2803
							    kzalloc(2 *
L
Linus Torvalds 已提交
2804 2805 2806 2807
								    (len +
								     1),
								    GFP_KERNEL);
							cifs_strfromUCS_le
2808 2809 2810
							    (ses->serverDomain,
							     (__le16 *)bcc_ptr,
							     len, nls_codepage);
L
Linus Torvalds 已提交
2811 2812
							bcc_ptr +=
							    2 * (len + 1);
2813
							ses->serverDomain[2*len]
L
Linus Torvalds 已提交
2814
							    = 0;
2815 2816
							ses->serverDomain
								[1 + (2 * len)]
L
Linus Torvalds 已提交
2817 2818
							    = 0;
						} /* else no more room so create dummy domain string */
2819
						else {
2820
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2821
							ses->serverDomain =
2822
							    kzalloc(2,
L
Linus Torvalds 已提交
2823
								    GFP_KERNEL);
2824
						}
L
Linus Torvalds 已提交
2825
					} else {	/* no room so create dummy domain and NOS string */
2826
						kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2827
						ses->serverDomain =
2828
						    kzalloc(2, GFP_KERNEL);
2829
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2830
						ses->serverNOS =
2831
						    kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
2832 2833 2834 2835 2836 2837
					}
				} else {	/* ASCII */
					len = strnlen(bcc_ptr, 1024);
					if (((long) bcc_ptr + len) - (long)
					    pByteArea(smb_buffer_response)
					    <= BCC(smb_buffer_response)) {
S
Steve French 已提交
2838
						if (ses->serverOS)
2839
							kfree(ses->serverOS);
L
Linus Torvalds 已提交
2840
						ses->serverOS =
2841
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2842 2843 2844 2845 2846 2847 2848 2849 2850
							    GFP_KERNEL);
						strncpy(ses->serverOS,
							bcc_ptr, len);

						bcc_ptr += len;
						bcc_ptr[0] = 0;	/* null terminate string */
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
2851
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2852
						ses->serverNOS =
2853
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2854 2855 2856 2857 2858 2859 2860
							    GFP_KERNEL);
						strncpy(ses->serverNOS, bcc_ptr, len);
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
2861
						kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2862
						ses->serverDomain =
2863
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2864
							    GFP_KERNEL);
2865 2866
						strncpy(ses->serverDomain,
							bcc_ptr, len);
L
Linus Torvalds 已提交
2867 2868 2869 2870 2871
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;
					} else
						cFYI(1,
2872 2873
						     ("field of length %d "
						    "extends beyond end of smb",
L
Linus Torvalds 已提交
2874 2875 2876
						      len));
				}
			} else {
2877 2878
				cERROR(1, ("Security Blob Length extends beyond"
					   " end of SMB"));
L
Linus Torvalds 已提交
2879 2880 2881 2882 2883 2884
			}
		} else {
			cERROR(1, ("No session structure passed in."));
		}
	} else {
		cERROR(1,
2885
		       (" Invalid Word count %d:",
L
Linus Torvalds 已提交
2886 2887 2888 2889
			smb_buffer_response->WordCount));
		rc = -EIO;
	}

2890
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
2891 2892 2893 2894 2895

	return rc;
}
static int
CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
C
Cyrill Gorcunov 已提交
2896 2897
			char *ntlm_session_key, int ntlmv2_flag,
			const struct nls_table *nls_codepage)
L
Linus Torvalds 已提交
2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *user;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
C
Cyrill Gorcunov 已提交
2910
	int SecurityBlobLength = sizeof(AUTHENTICATE_MESSAGE);
L
Linus Torvalds 已提交
2911 2912 2913 2914 2915
	PAUTHENTICATE_MESSAGE SecurityBlob;
	__u32 negotiate_flags, capabilities;
	__u16 count;

	cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
S
Steve French 已提交
2916
	if (ses == NULL)
L
Linus Torvalds 已提交
2917 2918 2919 2920 2921 2922 2923 2924
		return -EINVAL;
	user = ses->userName;
	domain = ses->domainName;
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
C
Cyrill Gorcunov 已提交
2925 2926
	pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
	pSMBr = (SESSION_SETUP_ANDX *)smb_buffer_response;
L
Linus Torvalds 已提交
2927 2928 2929 2930

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 12 /* wct */ );
2931 2932

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2933 2934 2935 2936 2937 2938 2939 2940
	pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
	pSMB->req.AndXCommand = 0xFF;
	pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

	pSMB->req.hdr.Uid = ses->Suid;

S
Steve French 已提交
2941
	if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2942 2943 2944
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
C
Cyrill Gorcunov 已提交
2945
			CAP_EXTENDED_SECURITY;
L
Linus Torvalds 已提交
2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req.Capabilities = cpu_to_le32(capabilities);

C
Cyrill Gorcunov 已提交
2960 2961
	bcc_ptr = (char *)&pSMB->req.SecurityBlob;
	SecurityBlob = (PAUTHENTICATE_MESSAGE)bcc_ptr;
L
Linus Torvalds 已提交
2962 2963 2964
	strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
	SecurityBlob->MessageType = NtLmAuthenticate;
	bcc_ptr += SecurityBlobLength;
C
Cyrill Gorcunov 已提交
2965 2966 2967
	negotiate_flags = NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
			NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
			0x80000000 | NTLMSSP_NEGOTIATE_128;
S
Steve French 已提交
2968
	if (sign_CIFS_PDUs)
L
Linus Torvalds 已提交
2969
		negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
S
Steve French 已提交
2970
	if (ntlmv2_flag)
L
Linus Torvalds 已提交
2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985 2986
		negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;

/* setup pointers to domain name and workstation name */

	SecurityBlob->WorkstationName.Buffer = 0;
	SecurityBlob->WorkstationName.Length = 0;
	SecurityBlob->WorkstationName.MaximumLength = 0;
	SecurityBlob->SessionKey.Length = 0;
	SecurityBlob->SessionKey.MaximumLength = 0;
	SecurityBlob->SessionKey.Buffer = 0;

	SecurityBlob->LmChallengeResponse.Length = 0;
	SecurityBlob->LmChallengeResponse.MaximumLength = 0;
	SecurityBlob->LmChallengeResponse.Buffer = 0;

	SecurityBlob->NtChallengeResponse.Length =
2987
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2988
	SecurityBlob->NtChallengeResponse.MaximumLength =
2989 2990
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
	memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2991 2992
	SecurityBlob->NtChallengeResponse.Buffer =
	    cpu_to_le32(SecurityBlobLength);
2993 2994
	SecurityBlobLength += CIFS_SESS_KEY_SIZE;
	bcc_ptr += CIFS_SESS_KEY_SIZE;
L
Linus Torvalds 已提交
2995 2996 2997 2998 2999 3000 3001

	if (ses->capabilities & CAP_UNICODE) {
		if (domain == NULL) {
			SecurityBlob->DomainName.Buffer = 0;
			SecurityBlob->DomainName.Length = 0;
			SecurityBlob->DomainName.MaximumLength = 0;
		} else {
3002
			__u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
L
Linus Torvalds 已提交
3003
					  nls_codepage);
3004
			ln *= 2;
L
Linus Torvalds 已提交
3005
			SecurityBlob->DomainName.MaximumLength =
3006
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3007 3008
			SecurityBlob->DomainName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3009 3010 3011
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->DomainName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3012 3013 3014 3015 3016 3017
		}
		if (user == NULL) {
			SecurityBlob->UserName.Buffer = 0;
			SecurityBlob->UserName.Length = 0;
			SecurityBlob->UserName.MaximumLength = 0;
		} else {
3018
			__u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
L
Linus Torvalds 已提交
3019
					  nls_codepage);
3020
			ln *= 2;
L
Linus Torvalds 已提交
3021
			SecurityBlob->UserName.MaximumLength =
3022
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3023 3024
			SecurityBlob->UserName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3025 3026 3027
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->UserName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3028 3029
		}

3030 3031
		/* SecurityBlob->WorkstationName.Length =
		 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
L
Linus Torvalds 已提交
3032
		   SecurityBlob->WorkstationName.Length *= 2;
3033 3034 3035 3036
		   SecurityBlob->WorkstationName.MaximumLength =
			cpu_to_le16(SecurityBlob->WorkstationName.Length);
		   SecurityBlob->WorkstationName.Buffer =
				 cpu_to_le32(SecurityBlobLength);
L
Linus Torvalds 已提交
3037 3038
		   bcc_ptr += SecurityBlob->WorkstationName.Length;
		   SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3039 3040
		   SecurityBlob->WorkstationName.Length =
			cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
L
Linus Torvalds 已提交
3041 3042 3043 3044 3045 3046

		if ((long) bcc_ptr % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		bytes_returned =
3047
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
3048 3049 3050
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
3051
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
L
Linus Torvalds 已提交
3052 3053 3054 3055
				  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* null term version string */
		bytes_returned =
3056
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null terminate network opsys string */
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null domain */
	} else {		/* ASCII */
		if (domain == NULL) {
			SecurityBlob->DomainName.Buffer = 0;
			SecurityBlob->DomainName.Length = 0;
			SecurityBlob->DomainName.MaximumLength = 0;
		} else {
3071
			__u16 ln;
L
Linus Torvalds 已提交
3072 3073
			negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
			strncpy(bcc_ptr, domain, 63);
3074
			ln = strnlen(domain, 64);
L
Linus Torvalds 已提交
3075
			SecurityBlob->DomainName.MaximumLength =
3076
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3077 3078
			SecurityBlob->DomainName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3079 3080 3081
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->DomainName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3082 3083 3084 3085 3086 3087
		}
		if (user == NULL) {
			SecurityBlob->UserName.Buffer = 0;
			SecurityBlob->UserName.Length = 0;
			SecurityBlob->UserName.MaximumLength = 0;
		} else {
3088
			__u16 ln;
L
Linus Torvalds 已提交
3089
			strncpy(bcc_ptr, user, 63);
3090 3091
			ln = strnlen(user, 64);
			SecurityBlob->UserName.MaximumLength = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3092
			SecurityBlob->UserName.Buffer =
3093 3094 3095 3096
						cpu_to_le32(SecurityBlobLength);
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->UserName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3097 3098 3099 3100 3101
		}
		/* BB fill in our workstation name if known BB */

		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
3102 3103
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
		bcc_ptr++;	/* null domain */
		*bcc_ptr = 0;
	}
	SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
	pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3116
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
3117
	if (rc) {
C
Cyrill Gorcunov 已提交
3118 3119 3120
/*   rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
	} else if ((smb_buffer_response->WordCount == 3) ||
		   (smb_buffer_response->WordCount == 4)) {
L
Linus Torvalds 已提交
3121
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
C
Cyrill Gorcunov 已提交
3122
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
L
Linus Torvalds 已提交
3123
		if (action & GUEST_LOGIN)
3124 3125 3126 3127 3128 3129
			cFYI(1, (" Guest login")); /* BB Should we set anything
							 in SesInfo struct ? */
/*		if (SecurityBlob2->MessageType != NtLm??) {
			cFYI("Unexpected message type on auth response is %d"));
		} */

L
Linus Torvalds 已提交
3130 3131
		if (ses) {
			cFYI(1,
3132
			     ("Check challenge UID %d vs auth response UID %d",
L
Linus Torvalds 已提交
3133
			      ses->Suid, smb_buffer_response->Uid));
3134 3135 3136 3137
			/* UID left in wire format */
			ses->Suid = smb_buffer_response->Uid;
			bcc_ptr = pByteArea(smb_buffer_response);
		/* response can have either 3 or 4 word count - Samba sends 3 */
L
Linus Torvalds 已提交
3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161
			if ((pSMBr->resp.hdr.WordCount == 3)
			    || ((pSMBr->resp.hdr.WordCount == 4)
				&& (blob_len <
				    pSMBr->resp.ByteCount))) {
				if (pSMBr->resp.hdr.WordCount == 4) {
					bcc_ptr +=
					    blob_len;
					cFYI(1,
					     ("Security Blob Length %d ",
					      blob_len));
				}

				cFYI(1,
				     ("NTLMSSP response to Authenticate "));

				if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
					if ((long) (bcc_ptr) % 2) {
						remaining_words =
						    (BCC(smb_buffer_response)
						     - 1) / 2;
						bcc_ptr++;	/* Unicode strings must be word aligned */
					} else {
						remaining_words = BCC(smb_buffer_response) / 2;
					}
3162 3163
					len = UniStrnlen((wchar_t *) bcc_ptr,
							remaining_words - 1);
L
Linus Torvalds 已提交
3164 3165 3166
/* We look for obvious messed up bcc or strings in response so we do not go off
  the end since (at least) WIN2K and Windows XP have a major bug in not null
  terminating last Unicode string in response  */
S
Steve French 已提交
3167
					if (ses->serverOS)
S
Steve French 已提交
3168
						kfree(ses->serverOS);
L
Linus Torvalds 已提交
3169
					ses->serverOS =
3170
					    kzalloc(2 * (len + 1), GFP_KERNEL);
L
Linus Torvalds 已提交
3171
					cifs_strfromUCS_le(ses->serverOS,
3172
							   (__le16 *)
L
Linus Torvalds 已提交
3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183
							   bcc_ptr, len,
							   nls_codepage);
					bcc_ptr += 2 * (len + 1);
					remaining_words -= len + 1;
					ses->serverOS[2 * len] = 0;
					ses->serverOS[1 + (2 * len)] = 0;
					if (remaining_words > 0) {
						len = UniStrnlen((wchar_t *)
								 bcc_ptr,
								 remaining_words
								 - 1);
3184
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
3185
						ses->serverNOS =
3186
						    kzalloc(2 * (len + 1),
L
Linus Torvalds 已提交
3187 3188 3189
							    GFP_KERNEL);
						cifs_strfromUCS_le(ses->
								   serverNOS,
3190
								   (__le16 *)
L
Linus Torvalds 已提交
3191 3192 3193 3194 3195 3196 3197 3198
								   bcc_ptr,
								   len,
								   nls_codepage);
						bcc_ptr += 2 * (len + 1);
						ses->serverNOS[2 * len] = 0;
						ses->serverNOS[1+(2*len)] = 0;
						remaining_words -= len + 1;
						if (remaining_words > 0) {
3199
							len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
L
Linus Torvalds 已提交
3200
     /* last string not always null terminated (e.g. for Windows XP & 2000) */
S
Steve French 已提交
3201
							if (ses->serverDomain)
3202
								kfree(ses->serverDomain);
L
Linus Torvalds 已提交
3203
							ses->serverDomain =
3204
							    kzalloc(2 *
L
Linus Torvalds 已提交
3205 3206 3207 3208 3209 3210
								    (len +
								     1),
								    GFP_KERNEL);
							cifs_strfromUCS_le
							    (ses->
							     serverDomain,
3211
							     (__le16 *)
L
Linus Torvalds 已提交
3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227
							     bcc_ptr, len,
							     nls_codepage);
							bcc_ptr +=
							    2 * (len + 1);
							ses->
							    serverDomain[2
									 * len]
							    = 0;
							ses->
							    serverDomain[1
									 +
									 (2
									  *
									  len)]
							    = 0;
						} /* else no more room so create dummy domain string */
3228
						else {
S
Steve French 已提交
3229
							if (ses->serverDomain)
3230
								kfree(ses->serverDomain);
3231
							ses->serverDomain = kzalloc(2,GFP_KERNEL);
3232
						}
L
Linus Torvalds 已提交
3233
					} else {  /* no room so create dummy domain and NOS string */
S
Steve French 已提交
3234
						if (ses->serverDomain)
3235
							kfree(ses->serverDomain);
3236
						ses->serverDomain = kzalloc(2, GFP_KERNEL);
3237
						kfree(ses->serverNOS);
3238
						ses->serverNOS = kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
3239 3240 3241
					}
				} else {	/* ASCII */
					len = strnlen(bcc_ptr, 1024);
3242 3243
					if (((long) bcc_ptr + len) -
					   (long) pByteArea(smb_buffer_response)
3244
						<= BCC(smb_buffer_response)) {
S
Steve French 已提交
3245
						if (ses->serverOS)
3246
							kfree(ses->serverOS);
3247
						ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
L
Linus Torvalds 已提交
3248 3249 3250 3251 3252 3253 3254
						strncpy(ses->serverOS,bcc_ptr, len);

						bcc_ptr += len;
						bcc_ptr[0] = 0;	/* null terminate the string */
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
3255
						kfree(ses->serverNOS);
3256 3257
						ses->serverNOS = kzalloc(len+1,
								    GFP_KERNEL);
3258 3259
						strncpy(ses->serverNOS,
							bcc_ptr, len);
L
Linus Torvalds 已提交
3260 3261 3262 3263 3264
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
S
Steve French 已提交
3265
						if (ses->serverDomain)
3266
							kfree(ses->serverDomain);
3267 3268 3269 3270 3271
						ses->serverDomain =
								kzalloc(len+1,
								    GFP_KERNEL);
						strncpy(ses->serverDomain,
							bcc_ptr, len);
L
Linus Torvalds 已提交
3272 3273 3274 3275
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;
					} else
C
Cyrill Gorcunov 已提交
3276
						cFYI(1, ("field of length %d "
3277
						   "extends beyond end of smb ",
L
Linus Torvalds 已提交
3278 3279 3280
						      len));
				}
			} else {
C
Cyrill Gorcunov 已提交
3281
				cERROR(1, ("Security Blob extends beyond end "
3282
					"of SMB"));
L
Linus Torvalds 已提交
3283 3284 3285 3286 3287
			}
		} else {
			cERROR(1, ("No session structure passed in."));
		}
	} else {
C
Cyrill Gorcunov 已提交
3288
		cERROR(1, ("Invalid Word count %d: ",
L
Linus Torvalds 已提交
3289 3290 3291 3292
			smb_buffer_response->WordCount));
		rc = -EIO;
	}

3293
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
3294 3295 3296 3297 3298 3299 3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321 3322

	return rc;
}

int
CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
	 const char *tree, struct cifsTconInfo *tcon,
	 const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	TCONX_REQ *pSMB;
	TCONX_RSP *pSMBr;
	unsigned char *bcc_ptr;
	int rc = 0;
	int length;
	__u16 count;

	if (ses == NULL)
		return -EIO;

	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;

	header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
			NULL /*no tid */ , 4 /*wct */ );
3323 3324

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
3325 3326 3327 3328 3329 3330 3331
	smb_buffer->Uid = ses->Suid;
	pSMB = (TCONX_REQ *) smb_buffer;
	pSMBr = (TCONX_RSP *) smb_buffer_response;

	pSMB->AndXCommand = 0xFF;
	pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
	bcc_ptr = &pSMB->Password[0];
S
Steve French 已提交
3332
	if ((ses->server->secMode) & SECMODE_USER) {
3333
		pSMB->PasswordLength = cpu_to_le16(1);	/* minimum */
3334
		*bcc_ptr = 0; /* password is null byte */
3335
		bcc_ptr++;              /* skip password */
3336
		/* already aligned so no need to do it below */
3337
	} else {
3338
		pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3339 3340 3341
		/* BB FIXME add code to fail this if NTLMv2 or Kerberos
		   specified as required (when that support is added to
		   the vfs in the future) as only NTLM or the much
3342
		   weaker LANMAN (which we do not send by default) is accepted
3343 3344
		   by Samba (not sure whether other servers allow
		   NTLMv2 password here) */
3345
#ifdef CONFIG_CIFS_WEAK_PW_HASH
3346
		if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3347 3348 3349 3350
			(ses->server->secType == LANMAN))
			calc_lanman_hash(ses, bcc_ptr);
		else
#endif /* CIFS_WEAK_PW_HASH */
3351 3352 3353 3354
		SMBNTencrypt(ses->password,
			     ses->server->cryptKey,
			     bcc_ptr);

3355
		bcc_ptr += CIFS_SESS_KEY_SIZE;
S
Steve French 已提交
3356
		if (ses->capabilities & CAP_UNICODE) {
3357 3358 3359 3360
			/* must align unicode strings */
			*bcc_ptr = 0; /* null byte password */
			bcc_ptr++;
		}
3361
	}
L
Linus Torvalds 已提交
3362

3363
	if (ses->server->secMode &
3364
			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
3365 3366 3367 3368 3369 3370 3371 3372 3373 3374 3375
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
	}
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		length =
3376 3377
		    cifs_strtoUCS((__le16 *) bcc_ptr, tree,
			6 /* max utf8 char length in bytes */ *
3378 3379
			(/* server len*/ + 256 /* share len */), nls_codepage);
		bcc_ptr += 2 * length;	/* convert num 16 bit words to bytes */
L
Linus Torvalds 已提交
3380 3381 3382 3383 3384 3385 3386 3387 3388 3389 3390 3391
		bcc_ptr += 2;	/* skip trailing null */
	} else {		/* ASCII */
		strcpy(bcc_ptr, tree);
		bcc_ptr += strlen(tree) + 1;
	}
	strcpy(bcc_ptr, "?????");
	bcc_ptr += strlen("?????");
	bcc_ptr += 1;
	count = bcc_ptr - &pSMB->Password[0];
	pSMB->hdr.smb_buf_length += count;
	pSMB->ByteCount = cpu_to_le16(count);

3392 3393
	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
			 CIFS_STD_OP);
L
Linus Torvalds 已提交
3394 3395 3396 3397 3398 3399 3400 3401

	/* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
	/* above now done in SendReceive */
	if ((rc == 0) && (tcon != NULL)) {
		tcon->tidStatus = CifsGood;
		tcon->tid = smb_buffer_response->Tid;
		bcc_ptr = pByteArea(smb_buffer_response);
		length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3402
		/* skip service field (NB: this field is always ASCII) */
3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413 3414
		if (length == 3) {
			if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
			    (bcc_ptr[2] == 'C')) {
				cFYI(1, ("IPC connection"));
				tcon->ipc = 1;
			}
		} else if (length == 2) {
			if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
				/* the most common case */
				cFYI(1, ("disk share connection"));
			}
		}
3415
		bcc_ptr += length + 1;
L
Linus Torvalds 已提交
3416 3417 3418 3419 3420 3421
		strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
		if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
			length = UniStrnlen((wchar_t *) bcc_ptr, 512);
			if ((bcc_ptr + (2 * length)) -
			     pByteArea(smb_buffer_response) <=
			    BCC(smb_buffer_response)) {
J
Jesper Juhl 已提交
3422
				kfree(tcon->nativeFileSystem);
L
Linus Torvalds 已提交
3423
				tcon->nativeFileSystem =
3424
				    kzalloc(length + 2, GFP_KERNEL);
3425 3426 3427 3428 3429
				if (tcon->nativeFileSystem)
					cifs_strfromUCS_le(
						tcon->nativeFileSystem,
						(__le16 *) bcc_ptr,
						length, nls_codepage);
L
Linus Torvalds 已提交
3430 3431 3432 3433 3434
				bcc_ptr += 2 * length;
				bcc_ptr[0] = 0;	/* null terminate the string */
				bcc_ptr[1] = 0;
				bcc_ptr += 2;
			}
3435
			/* else do not bother copying these information fields*/
L
Linus Torvalds 已提交
3436 3437 3438 3439 3440
		} else {
			length = strnlen(bcc_ptr, 1024);
			if ((bcc_ptr + length) -
			    pByteArea(smb_buffer_response) <=
			    BCC(smb_buffer_response)) {
J
Jesper Juhl 已提交
3441
				kfree(tcon->nativeFileSystem);
L
Linus Torvalds 已提交
3442
				tcon->nativeFileSystem =
3443
				    kzalloc(length + 1, GFP_KERNEL);
3444 3445 3446
				if (tcon->nativeFileSystem)
					strncpy(tcon->nativeFileSystem, bcc_ptr,
						length);
L
Linus Torvalds 已提交
3447
			}
3448
			/* else do not bother copying these information fields*/
L
Linus Torvalds 已提交
3449
		}
S
Steve French 已提交
3450
		if ((smb_buffer_response->WordCount == 3) ||
S
Steve French 已提交
3451 3452
			 (smb_buffer_response->WordCount == 7))
			/* field is in same location */
3453 3454 3455
			tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
		else
			tcon->Flags = 0;
L
Linus Torvalds 已提交
3456 3457
		cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
	} else if ((rc == 0) && tcon == NULL) {
3458
		/* all we need to save for IPC$ connection */
L
Linus Torvalds 已提交
3459 3460 3461
		ses->ipc_tid = smb_buffer_response->Tid;
	}

3462
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
3463 3464 3465 3466 3467 3468 3469 3470 3471 3472
	return rc;
}

int
cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
{
	int rc = 0;
	int xid;
	struct cifsSesInfo *ses = NULL;
	struct task_struct *cifsd_task;
3473
	char *tmp;
L
Linus Torvalds 已提交
3474 3475 3476 3477 3478 3479 3480 3481 3482 3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493

	xid = GetXid();

	if (cifs_sb->tcon) {
		ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
		rc = CIFSSMBTDis(xid, cifs_sb->tcon);
		if (rc == -EBUSY) {
			FreeXid(xid);
			return 0;
		}
		tconInfoFree(cifs_sb->tcon);
		if ((ses) && (ses->server)) {
			/* save off task so we do not refer to ses later */
			cifsd_task = ses->server->tsk;
			cFYI(1, ("About to do SMBLogoff "));
			rc = CIFSSMBLogoff(xid, ses);
			if (rc == -EBUSY) {
				FreeXid(xid);
				return 0;
			} else if (rc == -ESHUTDOWN) {
S
Steve French 已提交
3494
				cFYI(1, ("Waking up socket by sending signal"));
S
Steve French 已提交
3495
				if (cifsd_task) {
3496
					force_sig(SIGKILL, cifsd_task);
3497
					kthread_stop(cifsd_task);
3498
				}
L
Linus Torvalds 已提交
3499 3500 3501 3502 3503 3504
				rc = 0;
			} /* else - we have an smb session
				left on this socket do not kill cifsd */
		} else
			cFYI(1, ("No session or bad tcon"));
	}
3505

L
Linus Torvalds 已提交
3506
	cifs_sb->tcon = NULL;
3507 3508 3509 3510
	tmp = cifs_sb->prepath;
	cifs_sb->prepathlen = 0;
	cifs_sb->prepath = NULL;
	kfree(tmp);
3511 3512
	if (ses)
		schedule_timeout_interruptible(msecs_to_jiffies(500));
L
Linus Torvalds 已提交
3513 3514 3515 3516
	if (ses)
		sesInfoFree(ses);

	FreeXid(xid);
3517 3518
	return rc;	/* BB check if we should always return zero here */
}
L
Linus Torvalds 已提交
3519 3520

int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3521
					   struct nls_table *nls_info)
L
Linus Torvalds 已提交
3522 3523
{
	int rc = 0;
3524
	char ntlm_session_key[CIFS_SESS_KEY_SIZE];
L
Linus Torvalds 已提交
3525
	int ntlmv2_flag = FALSE;
3526
	int first_time = 0;
L
Linus Torvalds 已提交
3527 3528

	/* what if server changes its buffer size after dropping the session? */
S
Steve French 已提交
3529
	if (pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
L
Linus Torvalds 已提交
3530
		rc = CIFSSMBNegotiate(xid, pSesInfo);
S
Steve French 已提交
3531
		if (rc == -EAGAIN) /* retry only once on 1st time connection */ {
L
Linus Torvalds 已提交
3532
			rc = CIFSSMBNegotiate(xid, pSesInfo);
3533
			if (rc == -EAGAIN)
L
Linus Torvalds 已提交
3534 3535
				rc = -EHOSTDOWN;
		}
S
Steve French 已提交
3536
		if (rc == 0) {
L
Linus Torvalds 已提交
3537
			spin_lock(&GlobalMid_Lock);
S
Steve French 已提交
3538
			if (pSesInfo->server->tcpStatus != CifsExiting)
L
Linus Torvalds 已提交
3539 3540 3541 3542 3543 3544
				pSesInfo->server->tcpStatus = CifsGood;
			else
				rc = -EHOSTDOWN;
			spin_unlock(&GlobalMid_Lock);

		}
3545
		first_time = 1;
L
Linus Torvalds 已提交
3546 3547
	}
	if (!rc) {
3548
		pSesInfo->flags = 0;
L
Linus Torvalds 已提交
3549
		pSesInfo->capabilities = pSesInfo->server->capabilities;
S
Steve French 已提交
3550
		if (linuxExtEnabled == 0)
L
Linus Torvalds 已提交
3551
			pSesInfo->capabilities &= (~CAP_UNIX);
3552
	/*	pSesInfo->sequence_number = 0;*/
3553 3554
		cFYI(1,
		      ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
L
Linus Torvalds 已提交
3555 3556
			pSesInfo->server->secMode,
			pSesInfo->server->capabilities,
3557
			pSesInfo->server->timeAdj));
S
Steve French 已提交
3558
		if (experimEnabled < 2)
3559 3560
			rc = CIFS_SessSetup(xid, pSesInfo,
					    first_time, nls_info);
3561
		else if (extended_security
3562
				&& (pSesInfo->capabilities
3563
					& CAP_EXTENDED_SECURITY)
L
Linus Torvalds 已提交
3564
				&& (pSesInfo->server->secType == NTLMSSP)) {
3565
			rc = -EOPNOTSUPP;
L
Linus Torvalds 已提交
3566 3567 3568
		} else if (extended_security
			   && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
			   && (pSesInfo->server->secType == RawNTLMSSP)) {
3569
			cFYI(1, ("NTLMSSP sesssetup"));
L
Linus Torvalds 已提交
3570 3571 3572 3573 3574
			rc = CIFSNTLMSSPNegotiateSessSetup(xid,
						pSesInfo,
						&ntlmv2_flag,
						nls_info);
			if (!rc) {
S
Steve French 已提交
3575
				if (ntlmv2_flag) {
3576
					char *v2_response;
S
Steve French 已提交
3577
					cFYI(1, ("more secure NTLM ver2 hash"));
3578
					if (CalcNTLMv2_partial_mac_key(pSesInfo,
L
Linus Torvalds 已提交
3579 3580 3581 3582 3583
						nls_info)) {
						rc = -ENOMEM;
						goto ss_err_exit;
					} else
						v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
S
Steve French 已提交
3584
					if (v2_response) {
3585 3586
						CalcNTLMv2_response(pSesInfo,
								   v2_response);
S
Steve French 已提交
3587
				/*		if (first_time)
3588 3589 3590
						  cifs_calculate_ntlmv2_mac_key(
						   pSesInfo->server->mac_signing_key,
						   response, ntlm_session_key,*/
L
Linus Torvalds 已提交
3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602
						kfree(v2_response);
					/* BB Put dummy sig in SessSetup PDU? */
					} else {
						rc = -ENOMEM;
						goto ss_err_exit;
					}

				} else {
					SMBNTencrypt(pSesInfo->password,
						pSesInfo->server->cryptKey,
						ntlm_session_key);

S
Steve French 已提交
3603
					if (first_time)
3604
						cifs_calculate_mac_key(
3605
							&pSesInfo->server->mac_signing_key,
3606 3607
							ntlm_session_key,
							pSesInfo->password);
L
Linus Torvalds 已提交
3608 3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619 3620 3621 3622
				}
			/* for better security the weaker lanman hash not sent
			   in AuthSessSetup so we no longer calculate it */

				rc = CIFSNTLMSSPAuthSessSetup(xid,
					pSesInfo,
					ntlm_session_key,
					ntlmv2_flag,
					nls_info);
			}
		} else { /* old style NTLM 0.12 session setup */
			SMBNTencrypt(pSesInfo->password,
				pSesInfo->server->cryptKey,
				ntlm_session_key);

S
Steve French 已提交
3623
			if (first_time)
3624
				cifs_calculate_mac_key(
3625
					&pSesInfo->server->mac_signing_key,
3626 3627
					ntlm_session_key, pSesInfo->password);

L
Linus Torvalds 已提交
3628 3629 3630 3631
			rc = CIFSSessSetup(xid, pSesInfo,
				ntlm_session_key, nls_info);
		}
		if (rc) {
S
Steve French 已提交
3632
			cERROR(1, ("Send error in SessSetup = %d", rc));
L
Linus Torvalds 已提交
3633
		} else {
S
Steve French 已提交
3634
			cFYI(1, ("CIFS Session Established successfully"));
L
Linus Torvalds 已提交
3635 3636 3637 3638 3639 3640 3641
			pSesInfo->status = CifsGood;
		}
	}
ss_err_exit:
	return rc;
}