connect.c 108.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 *   fs/cifs/connect.c
 *
S
Steve French 已提交
4
 *   Copyright (C) International Business Machines  Corp., 2002,2008
L
Linus Torvalds 已提交
5 6 7 8 9 10 11 12 13 14 15 16 17 18
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   This library is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published
 *   by the Free Software Foundation; either version 2.1 of the License, or
 *   (at your option) any later version.
 *
 *   This library is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
 *   along with this library; if not, write to the Free Software
S
Steve French 已提交
19
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
L
Linus Torvalds 已提交
20 21 22 23 24 25 26 27 28 29 30
 */
#include <linux/fs.h>
#include <linux/net.h>
#include <linux/string.h>
#include <linux/list.h>
#include <linux/wait.h>
#include <linux/ipv6.h>
#include <linux/pagemap.h>
#include <linux/ctype.h>
#include <linux/utsname.h>
#include <linux/mempool.h>
31
#include <linux/delay.h>
32
#include <linux/completion.h>
33
#include <linux/kthread.h>
34
#include <linux/pagevec.h>
35
#include <linux/freezer.h>
L
Linus Torvalds 已提交
36 37 38 39 40 41 42 43 44 45 46
#include <asm/uaccess.h>
#include <asm/processor.h>
#include "cifspdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "cifs_unicode.h"
#include "cifs_debug.h"
#include "cifs_fs_sb.h"
#include "ntlmssp.h"
#include "nterr.h"
#include "rfc1002pdu.h"
47
#include "cn_cifs.h"
L
Linus Torvalds 已提交
48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

#define CIFS_PORT 445
#define RFC1001_PORT 139

extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
			 unsigned char *p24);

extern mempool_t *cifs_req_poolp;

struct smb_vol {
	char *username;
	char *password;
	char *domainname;
	char *UNC;
	char *UNCip;
	char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
	char *iocharset;  /* local code page for mapping to and from Unicode */
	char source_rfc1001_name[16]; /* netbios name of client */
66
	char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
L
Linus Torvalds 已提交
67 68 69 70
	uid_t linux_uid;
	gid_t linux_gid;
	mode_t file_mode;
	mode_t dir_mode;
71
	unsigned secFlg;
72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88
	bool rw:1;
	bool retry:1;
	bool intr:1;
	bool setuids:1;
	bool override_uid:1;
	bool override_gid:1;
	bool noperm:1;
	bool no_psx_acl:1; /* set if posix acl support should be disabled */
	bool cifs_acl:1;
	bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
	bool server_ino:1; /* use inode numbers from server ie UniqueId */
	bool direct_io:1;
	bool remap:1;     /* set to remap seven reserved chars in filenames */
	bool posix_paths:1;   /* unset to not ask for posix pathnames. */
	bool no_linux_ext:1;
	bool sfu_emul:1;
	bool nullauth:1; /* attempt to authenticate with null user */
89 90
	unsigned nocase;     /* request case insensitive filenames */
	unsigned nobrl;      /* disable sending byte range locks to srv */
L
Linus Torvalds 已提交
91 92 93 94
	unsigned int rsize;
	unsigned int wsize;
	unsigned int sockopt;
	unsigned short int port;
S
Steve French 已提交
95
	char *prepath;
L
Linus Torvalds 已提交
96 97
};

S
Steve French 已提交
98
static int ipv4_connect(struct sockaddr_in *psin_server,
L
Linus Torvalds 已提交
99
			struct socket **csocket,
S
Steve French 已提交
100 101 102
			char *netb_name,
			char *server_netb_name);
static int ipv6_connect(struct sockaddr_in6 *psin_server,
L
Linus Torvalds 已提交
103 104 105
			struct socket **csocket);


S
Steve French 已提交
106
	/*
L
Linus Torvalds 已提交
107
	 * cifs tcp session reconnection
S
Steve French 已提交
108
	 *
L
Linus Torvalds 已提交
109 110 111 112 113 114
	 * mark tcp session as reconnecting so temporarily locked
	 * mark all smb sessions as reconnecting for tcp session
	 * reconnect tcp session
	 * wake up waiters on reconnection? - (not needed currently)
	 */

115
static int
L
Linus Torvalds 已提交
116 117 118 119 120 121
cifs_reconnect(struct TCP_Server_Info *server)
{
	int rc = 0;
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	struct cifsTconInfo *tcon;
S
Steve French 已提交
122
	struct mid_q_entry *mid_entry;
123

L
Linus Torvalds 已提交
124
	spin_lock(&GlobalMid_Lock);
125
	if (kthread_should_stop()) {
S
Steve French 已提交
126
		/* the demux thread will exit normally
L
Linus Torvalds 已提交
127 128 129 130 131 132 133 134
		next time through the loop */
		spin_unlock(&GlobalMid_Lock);
		return rc;
	} else
		server->tcpStatus = CifsNeedReconnect;
	spin_unlock(&GlobalMid_Lock);
	server->maxBuf = 0;

135
	cFYI(1, ("Reconnecting tcp session"));
L
Linus Torvalds 已提交
136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151

	/* before reconnecting the tcp session, mark the smb session (uid)
		and the tid bad so they are not used until reconnected */
	read_lock(&GlobalSMBSeslock);
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
		if (ses->server) {
			if (ses->server == server) {
				ses->status = CifsNeedReconnect;
				ses->ipc_tid = 0;
			}
		}
		/* else tcp and smb sessions need reconnection */
	}
	list_for_each(tmp, &GlobalTreeConnectionList) {
		tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
152
		if ((tcon) && (tcon->ses) && (tcon->ses->server == server))
L
Linus Torvalds 已提交
153 154 155 156
			tcon->tidStatus = CifsNeedReconnect;
	}
	read_unlock(&GlobalSMBSeslock);
	/* do not want to be sending data on a socket we are freeing */
S
Steve French 已提交
157 158
	down(&server->tcpSem);
	if (server->ssocket) {
S
Steve French 已提交
159
		cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
L
Linus Torvalds 已提交
160
			server->ssocket->flags));
161
		kernel_sock_shutdown(server->ssocket, SHUT_WR);
S
Steve French 已提交
162
		cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
S
Steve French 已提交
163
			server->ssocket->state,
L
Linus Torvalds 已提交
164 165 166 167 168 169 170 171 172 173
			server->ssocket->flags));
		sock_release(server->ssocket);
		server->ssocket = NULL;
	}

	spin_lock(&GlobalMid_Lock);
	list_for_each(tmp, &server->pending_mid_q) {
		mid_entry = list_entry(tmp, struct
					mid_q_entry,
					qhead);
S
Steve French 已提交
174 175
		if (mid_entry) {
			if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
176 177 178 179
				/* Mark other intransit requests as needing
				   retry so we do not immediately mark the
				   session bad again (ie after we reconnect
				   below) as they timeout too */
L
Linus Torvalds 已提交
180 181 182 183 184
				mid_entry->midState = MID_RETRY_NEEDED;
			}
		}
	}
	spin_unlock(&GlobalMid_Lock);
S
Steve French 已提交
185
	up(&server->tcpSem);
L
Linus Torvalds 已提交
186

187
	while ((!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
188
		try_to_freeze();
S
Steve French 已提交
189 190 191
		if (server->protocolType == IPV6) {
			rc = ipv6_connect(&server->addr.sockAddr6,
					  &server->ssocket);
L
Linus Torvalds 已提交
192
		} else {
S
Steve French 已提交
193
			rc = ipv4_connect(&server->addr.sockAddr,
L
Linus Torvalds 已提交
194
					&server->ssocket,
195 196
					server->workstation_RFC1001_name,
					server->server_RFC1001_name);
L
Linus Torvalds 已提交
197
		}
S
Steve French 已提交
198 199
		if (rc) {
			cFYI(1, ("reconnect error %d", rc));
200
			msleep(3000);
L
Linus Torvalds 已提交
201 202 203
		} else {
			atomic_inc(&tcpSesReconnectCount);
			spin_lock(&GlobalMid_Lock);
204
			if (!kthread_should_stop())
L
Linus Torvalds 已提交
205
				server->tcpStatus = CifsGood;
206
			server->sequence_number = 0;
S
Steve French 已提交
207
			spin_unlock(&GlobalMid_Lock);
L
Linus Torvalds 已提交
208 209 210 211 212 213 214
	/*		atomic_set(&server->inFlight,0);*/
			wake_up(&server->response_q);
		}
	}
	return rc;
}

S
Steve French 已提交
215
/*
216 217 218 219 220 221
	return codes:
		0 	not a transact2, or all data present
		>0 	transact2 with that much data missing
		-EINVAL = invalid transact2

 */
S
Steve French 已提交
222
static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
223
{
S
Steve French 已提交
224 225
	struct smb_t2_rsp *pSMBt;
	int total_data_size;
226 227 228
	int data_in_this_rsp;
	int remaining;

S
Steve French 已提交
229
	if (pSMB->Command != SMB_COM_TRANSACTION2)
230 231
		return 0;

S
Steve French 已提交
232 233 234
	/* check for plausible wct, bcc and t2 data and parm sizes */
	/* check for parm and data offset going beyond end of smb */
	if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
S
Steve French 已提交
235
		cFYI(1, ("invalid transact2 word count"));
236 237 238 239 240 241 242 243 244 245
		return -EINVAL;
	}

	pSMBt = (struct smb_t2_rsp *)pSMB;

	total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
	data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);

	remaining = total_data_size - data_in_this_rsp;

S
Steve French 已提交
246
	if (remaining == 0)
247
		return 0;
S
Steve French 已提交
248
	else if (remaining < 0) {
S
Steve French 已提交
249
		cFYI(1, ("total data %d smaller than data in frame %d",
250 251 252
			total_data_size, data_in_this_rsp));
		return -EINVAL;
	} else {
S
Steve French 已提交
253
		cFYI(1, ("missing %d bytes from transact2, check next response",
254
			remaining));
S
Steve French 已提交
255 256 257 258
		if (total_data_size > maxBufSize) {
			cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
				total_data_size, maxBufSize));
			return -EINVAL;
259 260 261 262 263
		}
		return remaining;
	}
}

S
Steve French 已提交
264
static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
265 266 267 268 269 270 271
{
	struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
	struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
	int total_data_size;
	int total_in_buf;
	int remaining;
	int total_in_buf2;
S
Steve French 已提交
272 273
	char *data_area_of_target;
	char *data_area_of_buf2;
274 275 276 277
	__u16 byte_count;

	total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);

S
Steve French 已提交
278
	if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
279
		cFYI(1, ("total data size of primary and secondary t2 differ"));
280 281 282 283 284
	}

	total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);

	remaining = total_data_size - total_in_buf;
285

S
Steve French 已提交
286
	if (remaining < 0)
287 288
		return -EINVAL;

S
Steve French 已提交
289
	if (remaining == 0) /* nothing to do, ignore */
290
		return 0;
291

292
	total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
S
Steve French 已提交
293
	if (remaining < total_in_buf2) {
S
Steve French 已提交
294
		cFYI(1, ("transact2 2nd response contains too much data"));
295 296 297
	}

	/* find end of first SMB data area */
S
Steve French 已提交
298
	data_area_of_target = (char *)&pSMBt->hdr.Protocol +
299 300 301 302
				le16_to_cpu(pSMBt->t2_rsp.DataOffset);
	/* validate target area */

	data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
S
Steve French 已提交
303
					le16_to_cpu(pSMB2->t2_rsp.DataOffset);
304 305 306 307

	data_area_of_target += total_in_buf;

	/* copy second buffer into end of first buffer */
S
Steve French 已提交
308
	memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
309 310 311 312 313 314
	total_in_buf += total_in_buf2;
	pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
	byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
	byte_count += total_in_buf2;
	BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);

315
	byte_count = pTargetSMB->smb_buf_length;
316 317 318
	byte_count += total_in_buf2;

	/* BB also add check that we are not beyond maximum buffer size */
319

320
	pTargetSMB->smb_buf_length = byte_count;
321

S
Steve French 已提交
322
	if (remaining == total_in_buf2) {
S
Steve French 已提交
323
		cFYI(1, ("found the last secondary response"));
324 325 326 327 328 329
		return 0; /* we are done */
	} else /* more responses to go */
		return 1;

}

L
Linus Torvalds 已提交
330 331 332 333 334 335
static int
cifs_demultiplex_thread(struct TCP_Server_Info *server)
{
	int length;
	unsigned int pdu_length, total_read;
	struct smb_hdr *smb_buffer = NULL;
336 337
	struct smb_hdr *bigbuf = NULL;
	struct smb_hdr *smallbuf = NULL;
L
Linus Torvalds 已提交
338 339 340 341 342 343 344
	struct msghdr smb_msg;
	struct kvec iov;
	struct socket *csocket = server->ssocket;
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	struct task_struct *task_to_wake = NULL;
	struct mid_q_entry *mid_entry;
345
	char temp;
346 347
	bool isLargeBuf = false;
	bool isMultiRsp;
348
	int reconnect;
L
Linus Torvalds 已提交
349 350 351

	current->flags |= PF_MEMALLOC;
	server->tsk = current;	/* save process info to wake at shutdown */
352
	cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current)));
S
Steve French 已提交
353
	write_lock(&GlobalSMBSeslock);
L
Linus Torvalds 已提交
354 355 356
	atomic_inc(&tcpSesAllocCount);
	length = tcpSesAllocCount.counter;
	write_unlock(&GlobalSMBSeslock);
357 358 359
	if (length  > 1)
		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
				GFP_KERNEL);
L
Linus Torvalds 已提交
360

361
	set_freezable();
362
	while (!kthread_should_stop()) {
363 364
		if (try_to_freeze())
			continue;
365 366
		if (bigbuf == NULL) {
			bigbuf = cifs_buf_get();
367 368
			if (!bigbuf) {
				cERROR(1, ("No memory for large SMB response"));
369 370 371 372
				msleep(3000);
				/* retry will check if exiting */
				continue;
			}
373 374
		} else if (isLargeBuf) {
			/* we are reusing a dirty large buf, clear its start */
375
			memset(bigbuf, 0, sizeof(struct smb_hdr));
L
Linus Torvalds 已提交
376
		}
377 378 379

		if (smallbuf == NULL) {
			smallbuf = cifs_small_buf_get();
380 381
			if (!smallbuf) {
				cERROR(1, ("No memory for SMB response"));
382 383 384 385 386 387
				msleep(1000);
				/* retry will check if exiting */
				continue;
			}
			/* beginning of smb buffer is cleared in our buf_get */
		} else /* if existing small buf clear beginning */
388
			memset(smallbuf, 0, sizeof(struct smb_hdr));
389

390 391
		isLargeBuf = false;
		isMultiRsp = false;
392
		smb_buffer = smallbuf;
L
Linus Torvalds 已提交
393 394 395 396
		iov.iov_base = smb_buffer;
		iov.iov_len = 4;
		smb_msg.msg_control = NULL;
		smb_msg.msg_controllen = 0;
397 398
		pdu_length = 4; /* enough to get RFC1001 header */
incomplete_rcv:
L
Linus Torvalds 已提交
399 400
		length =
		    kernel_recvmsg(csocket, &smb_msg,
401
				&iov, 1, pdu_length, 0 /* BB other flags? */);
L
Linus Torvalds 已提交
402

403
		if (kthread_should_stop()) {
L
Linus Torvalds 已提交
404 405
			break;
		} else if (server->tcpStatus == CifsNeedReconnect) {
406
			cFYI(1, ("Reconnect after server stopped responding"));
L
Linus Torvalds 已提交
407
			cifs_reconnect(server);
408
			cFYI(1, ("call to reconnect done"));
L
Linus Torvalds 已提交
409 410 411
			csocket = server->ssocket;
			continue;
		} else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
412
			msleep(1); /* minimum sleep to prevent looping
L
Linus Torvalds 已提交
413 414
				allowing socket to clear and app threads to set
				tcpStatus CifsNeedReconnect if server hung */
415 416 417 418
			if (pdu_length < 4)
				goto incomplete_rcv;
			else
				continue;
L
Linus Torvalds 已提交
419
		} else if (length <= 0) {
420 421
			if (server->tcpStatus == CifsNew) {
				cFYI(1, ("tcp session abend after SMBnegprot"));
422 423 424 425
				/* some servers kill the TCP session rather than
				   returning an SMB negprot error, in which
				   case reconnecting here is not going to help,
				   and so simply return error to mount */
L
Linus Torvalds 已提交
426 427
				break;
			}
428
			if (!try_to_freeze() && (length == -EINTR)) {
S
Steve French 已提交
429
				cFYI(1, ("cifsd thread killed"));
L
Linus Torvalds 已提交
430 431
				break;
			}
S
Steve French 已提交
432
			cFYI(1, ("Reconnect after unexpected peek error %d",
433
				length));
L
Linus Torvalds 已提交
434 435 436 437
			cifs_reconnect(server);
			csocket = server->ssocket;
			wake_up(&server->response_q);
			continue;
438 439 440
		} else if (length < pdu_length) {
			cFYI(1, ("requested %d bytes but only got %d bytes",
				  pdu_length, length));
441 442 443
			pdu_length -= length;
			msleep(1);
			goto incomplete_rcv;
444
		}
L
Linus Torvalds 已提交
445

446 447
		/* The right amount was read from socket - 4 bytes */
		/* so we can now interpret the length field */
448

449 450 451 452
		/* the first byte big endian of the length field,
		is actually not part of the length but the type
		with the most common, zero, as regular data */
		temp = *((char *) smb_buffer);
453

S
Steve French 已提交
454
		/* Note that FC 1001 length is big endian on the wire,
455 456
		but we convert it here so it is always manipulated
		as host byte order */
457
		pdu_length = ntohl(smb_buffer->smb_buf_length);
458 459
		smb_buffer->smb_buf_length = pdu_length;

S
Steve French 已提交
460
		cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
461

462
		if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
S
Steve French 已提交
463
			continue;
464
		} else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
S
Steve French 已提交
465
			cFYI(1, ("Good RFC 1002 session rsp"));
466
			continue;
467
		} else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
S
Steve French 已提交
468
			/* we get this from Windows 98 instead of
469
			   an error on SMB negprot response */
S
Steve French 已提交
470
			cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
471
				pdu_length));
S
Steve French 已提交
472 473
			if (server->tcpStatus == CifsNew) {
				/* if nack on negprot (rather than
474 475 476 477 478 479 480 481 482
				ret of smb negprot error) reconnecting
				not going to help, ret error to mount */
				break;
			} else {
				/* give server a second to
				clean up before reconnect attempt */
				msleep(1000);
				/* always try 445 first on reconnect
				since we get NACK on some if we ever
S
Steve French 已提交
483
				connected to port 139 (the NACK is
484 485
				since we do not begin with RFC1001
				session initialize frame) */
S
Steve French 已提交
486
				server->addr.sockAddr.sin_port =
487
					htons(CIFS_PORT);
L
Linus Torvalds 已提交
488 489
				cifs_reconnect(server);
				csocket = server->ssocket;
490
				wake_up(&server->response_q);
L
Linus Torvalds 已提交
491
				continue;
492
			}
493
		} else if (temp != (char) 0) {
S
Steve French 已提交
494
			cERROR(1, ("Unknown RFC 1002 frame"));
495 496
			cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
				      length);
497 498 499
			cifs_reconnect(server);
			csocket = server->ssocket;
			continue;
500 501 502
		}

		/* else we have an SMB response */
S
Steve French 已提交
503
		if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
504
			    (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
505
			cERROR(1, ("Invalid size SMB length %d pdu_length %d",
506
					length, pdu_length+4));
507 508 509 510
			cifs_reconnect(server);
			csocket = server->ssocket;
			wake_up(&server->response_q);
			continue;
S
Steve French 已提交
511
		}
512 513 514 515

		/* else length ok */
		reconnect = 0;

S
Steve French 已提交
516
		if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
517
			isLargeBuf = true;
518 519 520 521 522 523
			memcpy(bigbuf, smallbuf, 4);
			smb_buffer = bigbuf;
		}
		length = 0;
		iov.iov_base = 4 + (char *)smb_buffer;
		iov.iov_len = pdu_length;
S
Steve French 已提交
524
		for (total_read = 0; total_read < pdu_length;
525 526 527
		     total_read += length) {
			length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
						pdu_length - total_read, 0);
528
			if (kthread_should_stop() ||
529 530 531 532 533
			    (length == -EINTR)) {
				/* then will exit */
				reconnect = 2;
				break;
			} else if (server->tcpStatus == CifsNeedReconnect) {
534 535
				cifs_reconnect(server);
				csocket = server->ssocket;
S
Steve French 已提交
536
				/* Reconnect wakes up rspns q */
537 538 539
				/* Now we will reread sock */
				reconnect = 1;
				break;
S
Steve French 已提交
540
			} else if ((length == -ERESTARTSYS) ||
541 542
				   (length == -EAGAIN)) {
				msleep(1); /* minimum sleep to prevent looping,
S
Steve French 已提交
543
					      allowing socket to clear and app
544 545
					      threads to set tcpStatus
					      CifsNeedReconnect if server hung*/
546
				length = 0;
547
				continue;
548
			} else if (length <= 0) {
S
Steve French 已提交
549
				cERROR(1, ("Received no data, expecting %d",
550 551 552 553 554
					      pdu_length - total_read));
				cifs_reconnect(server);
				csocket = server->ssocket;
				reconnect = 1;
				break;
555
			}
556
		}
S
Steve French 已提交
557
		if (reconnect == 2)
558
			break;
S
Steve French 已提交
559
		else if (reconnect == 1)
560
			continue;
L
Linus Torvalds 已提交
561

562
		length += 4; /* account for rfc1002 hdr */
563

564

565
		dump_smb(smb_buffer, length);
566
		if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
567
			cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
568 569
			continue;
		}
L
Linus Torvalds 已提交
570

571 572 573 574 575 576

		task_to_wake = NULL;
		spin_lock(&GlobalMid_Lock);
		list_for_each(tmp, &server->pending_mid_q) {
			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);

577
			if ((mid_entry->mid == smb_buffer->Mid) &&
578 579
			    (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
			    (mid_entry->command == smb_buffer->Command)) {
S
Steve French 已提交
580
				if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
581
					/* We have a multipart transact2 resp */
582
					isMultiRsp = true;
S
Steve French 已提交
583
					if (mid_entry->resp_buf) {
584
						/* merge response - fix up 1st*/
585
						if (coalesce_t2(smb_buffer,
586
							mid_entry->resp_buf)) {
587 588
							mid_entry->multiRsp =
								 true;
589 590 591
							break;
						} else {
							/* all parts received */
592 593
							mid_entry->multiEnd =
								 true;
594
							goto multi_t2_fnd;
595 596
						}
					} else {
S
Steve French 已提交
597
						if (!isLargeBuf) {
598 599
							cERROR(1,("1st trans2 resp needs bigbuf"));
					/* BB maybe we can fix this up,  switch
600
					   to already allocated large buffer? */
601
						} else {
602
							/* Have first buffer */
603 604
							mid_entry->resp_buf =
								 smb_buffer;
605 606
							mid_entry->largeBuf =
								 true;
607 608 609 610
							bigbuf = NULL;
						}
					}
					break;
611
				}
612
				mid_entry->resp_buf = smb_buffer;
613
				mid_entry->largeBuf = isLargeBuf;
614 615 616
multi_t2_fnd:
				task_to_wake = mid_entry->tsk;
				mid_entry->midState = MID_RESPONSE_RECEIVED;
S
Steve French 已提交
617 618 619
#ifdef CONFIG_CIFS_STATS2
				mid_entry->when_received = jiffies;
#endif
620 621 622 623
				/* so we do not time out requests to  server
				which is still responding (since server could
				be busy but not dead) */
				server->lstrp = jiffies;
624
				break;
625
			}
L
Linus Torvalds 已提交
626
		}
627 628
		spin_unlock(&GlobalMid_Lock);
		if (task_to_wake) {
629
			/* Was previous buf put in mpx struct for multi-rsp? */
S
Steve French 已提交
630
			if (!isMultiRsp) {
631
				/* smb buffer will be freed by user thread */
632
				if (isLargeBuf)
633
					bigbuf = NULL;
634
				else
635 636
					smallbuf = NULL;
			}
637
			wake_up_process(task_to_wake);
638 639
		} else if (!is_valid_oplock_break(smb_buffer, server) &&
			   !isMultiRsp) {
640 641 642
			cERROR(1, ("No task to wake, unknown frame received! "
				   "NumMids %d", midCount.counter));
			cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
643
				      sizeof(struct smb_hdr));
644 645 646 647
#ifdef CONFIG_CIFS_DEBUG2
			cifs_dump_detail(smb_buffer);
			cifs_dump_mids(server);
#endif /* CIFS_DEBUG2 */
648

649 650 651
		}
	} /* end while !EXITING */

L
Linus Torvalds 已提交
652 653 654
	spin_lock(&GlobalMid_Lock);
	server->tcpStatus = CifsExiting;
	server->tsk = NULL;
655 656 657
	/* check if we have blocked requests that need to free */
	/* Note that cifs_max_pending is normally 50, but
	can be set at module install time to as little as two */
S
Steve French 已提交
658
	if (atomic_read(&server->inFlight) >= cifs_max_pending)
659 660 661
		atomic_set(&server->inFlight, cifs_max_pending - 1);
	/* We do not want to set the max_pending too low or we
	could end up with the counter going negative */
L
Linus Torvalds 已提交
662
	spin_unlock(&GlobalMid_Lock);
663
	/* Although there should not be any requests blocked on
L
Linus Torvalds 已提交
664
	this queue it can not hurt to be paranoid and try to wake up requests
665
	that may haven been blocked when more than 50 at time were on the wire
L
Linus Torvalds 已提交
666 667 668 669
	to the same server - they now will see the session is in exit state
	and get out of SendReceive.  */
	wake_up_all(&server->request_q);
	/* give those requests time to exit */
670
	msleep(125);
671

S
Steve French 已提交
672
	if (server->ssocket) {
L
Linus Torvalds 已提交
673 674 675
		sock_release(csocket);
		server->ssocket = NULL;
	}
676
	/* buffer usuallly freed in free_mid - need to free it here on exit */
677 678
	cifs_buf_release(bigbuf);
	if (smallbuf) /* no sense logging a debug message if NULL */
679
		cifs_small_buf_release(smallbuf);
L
Linus Torvalds 已提交
680 681 682

	read_lock(&GlobalSMBSeslock);
	if (list_empty(&server->pending_mid_q)) {
683 684
		/* loop through server session structures attached to this and
		    mark them dead */
L
Linus Torvalds 已提交
685 686 687 688 689 690 691 692 693 694 695
		list_for_each(tmp, &GlobalSMBSessionList) {
			ses =
			    list_entry(tmp, struct cifsSesInfo,
				       cifsSessionList);
			if (ses->server == server) {
				ses->status = CifsExiting;
				ses->server = NULL;
			}
		}
		read_unlock(&GlobalSMBSeslock);
	} else {
696 697 698 699 700 701
		/* although we can not zero the server struct pointer yet,
		since there are active requests which may depnd on them,
		mark the corresponding SMB sessions as exiting too */
		list_for_each(tmp, &GlobalSMBSessionList) {
			ses = list_entry(tmp, struct cifsSesInfo,
					 cifsSessionList);
702
			if (ses->server == server)
703 704 705
				ses->status = CifsExiting;
		}

L
Linus Torvalds 已提交
706 707 708 709
		spin_lock(&GlobalMid_Lock);
		list_for_each(tmp, &server->pending_mid_q) {
		mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
			if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
710 711
				cFYI(1, ("Clearing Mid 0x%x - waking up ",
					 mid_entry->mid));
L
Linus Torvalds 已提交
712
				task_to_wake = mid_entry->tsk;
713
				if (task_to_wake)
L
Linus Torvalds 已提交
714 715 716 717 718 719
					wake_up_process(task_to_wake);
			}
		}
		spin_unlock(&GlobalMid_Lock);
		read_unlock(&GlobalSMBSeslock);
		/* 1/8th of sec is more than enough time for them to exit */
720
		msleep(125);
L
Linus Torvalds 已提交
721 722
	}

723
	if (!list_empty(&server->pending_mid_q)) {
724
		/* mpx threads have not exited yet give them
L
Linus Torvalds 已提交
725
		at least the smb send timeout time for long ops */
726 727 728 729
		/* due to delays on oplock break requests, we need
		to wait at least 45 seconds before giving up
		on a request getting a response and going ahead
		and killing cifsd */
L
Linus Torvalds 已提交
730
		cFYI(1, ("Wait for exit from demultiplex thread"));
731
		msleep(46000);
L
Linus Torvalds 已提交
732 733 734 735 736 737 738
		/* if threads still have not exited they are probably never
		coming home not much else we can do but free the memory */
	}

	write_lock(&GlobalSMBSeslock);
	atomic_dec(&tcpSesAllocCount);
	length = tcpSesAllocCount.counter;
739 740 741

	/* last chance to mark ses pointers invalid
	if there are any pointing to this (e.g
742
	if a crazy root user tried to kill cifsd
743 744 745 746
	kernel thread explicitly this might happen) */
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo,
				cifsSessionList);
747
		if (ses->server == server)
748 749
			ses->server = NULL;
	}
L
Linus Torvalds 已提交
750
	write_unlock(&GlobalSMBSeslock);
751

752
	kfree(server->hostname);
753
	kfree(server);
754 755 756
	if (length  > 0)
		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
				GFP_KERNEL);
757

L
Linus Torvalds 已提交
758 759 760
	return 0;
}

761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788
/* extract the host portion of the UNC string */
static char *
extract_hostname(const char *unc)
{
	const char *src;
	char *dst, *delim;
	unsigned int len;

	/* skip double chars at beginning of string */
	/* BB: check validity of these bytes? */
	src = unc + 2;

	/* delimiter between hostname and sharename is always '\\' now */
	delim = strchr(src, '\\');
	if (!delim)
		return ERR_PTR(-EINVAL);

	len = delim - src;
	dst = kmalloc((len + 1), GFP_KERNEL);
	if (dst == NULL)
		return ERR_PTR(-ENOMEM);

	memcpy(dst, src, len);
	dst[len] = '\0';

	return dst;
}

L
Linus Torvalds 已提交
789
static int
790 791
cifs_parse_mount_options(char *options, const char *devname,
			 struct smb_vol *vol)
L
Linus Torvalds 已提交
792 793 794 795 796 797 798
{
	char *value;
	char *data;
	unsigned int  temp_len, i, j;
	char separator[2];

	separator[0] = ',';
799
	separator[1] = 0;
L
Linus Torvalds 已提交
800

801
	if (Local_System_Name[0] != 0)
802
		memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
803
	else {
804
		char *nodename = utsname()->nodename;
805 806 807
		int n = strnlen(nodename, 15);
		memset(vol->source_rfc1001_name, 0x20, 15);
		for (i = 0; i < n; i++) {
808 809 810
			/* does not have to be perfect mapping since field is
			informational, only used for servers that do not support
			port 445 and it can be overridden at mount time */
811
			vol->source_rfc1001_name[i] = toupper(nodename[i]);
812
		}
L
Linus Torvalds 已提交
813 814
	}
	vol->source_rfc1001_name[15] = 0;
815 816 817
	/* null target name indicates to use *SMBSERVR default called name
	   if we end up sending RFC1001 session initialize */
	vol->target_rfc1001_name[0] = 0;
L
Linus Torvalds 已提交
818 819 820 821
	vol->linux_uid = current->uid;	/* current->euid instead? */
	vol->linux_gid = current->gid;
	vol->dir_mode = S_IRWXUGO;
	/* 2767 perms indicate mandatory locking support */
822
	vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
L
Linus Torvalds 已提交
823 824

	/* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
825
	vol->rw = true;
826 827 828
	/* default is always to request posix paths. */
	vol->posix_paths = 1;

L
Linus Torvalds 已提交
829 830 831
	if (!options)
		return 1;

832
	if (strncmp(options, "sep=", 4) == 0) {
S
Steve French 已提交
833
		if (options[4] != 0) {
L
Linus Torvalds 已提交
834 835 836
			separator[0] = options[4];
			options += 5;
		} else {
S
Steve French 已提交
837
			cFYI(1, ("Null separator not allowed"));
L
Linus Torvalds 已提交
838 839
		}
	}
840

L
Linus Torvalds 已提交
841 842 843 844 845 846
	while ((data = strsep(&options, separator)) != NULL) {
		if (!*data)
			continue;
		if ((value = strchr(data, '=')) != NULL)
			*value++ = '\0';

847 848
		/* Have to parse this before we parse for "user" */
		if (strnicmp(data, "user_xattr", 10) == 0) {
L
Linus Torvalds 已提交
849
			vol->no_xattr = 0;
850
		} else if (strnicmp(data, "nouser_xattr", 12) == 0) {
L
Linus Torvalds 已提交
851 852
			vol->no_xattr = 1;
		} else if (strnicmp(data, "user", 4) == 0) {
S
Steve French 已提交
853
			if (!value) {
L
Linus Torvalds 已提交
854 855 856
				printk(KERN_WARNING
				       "CIFS: invalid or missing username\n");
				return 1;	/* needs_arg; */
S
Steve French 已提交
857
			} else if (!*value) {
S
Steve French 已提交
858 859
				/* null user, ie anonymous, authentication */
				vol->nullauth = 1;
L
Linus Torvalds 已提交
860 861 862 863 864 865 866 867 868 869 870
			}
			if (strnlen(value, 200) < 200) {
				vol->username = value;
			} else {
				printk(KERN_WARNING "CIFS: username too long\n");
				return 1;
			}
		} else if (strnicmp(data, "pass", 4) == 0) {
			if (!value) {
				vol->password = NULL;
				continue;
S
Steve French 已提交
871
			} else if (value[0] == 0) {
L
Linus Torvalds 已提交
872 873 874 875
				/* check if string begins with double comma
				   since that would mean the password really
				   does start with a comma, and would not
				   indicate an empty string */
S
Steve French 已提交
876
				if (value[1] != separator[0]) {
L
Linus Torvalds 已提交
877 878 879 880 881 882 883 884
					vol->password = NULL;
					continue;
				}
			}
			temp_len = strlen(value);
			/* removed password length check, NTLM passwords
				can be arbitrarily long */

885
			/* if comma in password, the string will be
L
Linus Torvalds 已提交
886 887 888 889 890 891 892 893 894
			prematurely null terminated.  Commas in password are
			specified across the cifs mount interface by a double
			comma ie ,, and a comma used as in other cases ie ','
			as a parameter delimiter/separator is single and due
			to the strsep above is temporarily zeroed. */

			/* NB: password legally can have multiple commas and
			the only illegal character in a password is null */

895
			if ((value[temp_len] == 0) &&
896
			    (value[temp_len+1] == separator[0])) {
L
Linus Torvalds 已提交
897 898
				/* reinsert comma */
				value[temp_len] = separator[0];
899 900
				temp_len += 2;  /* move after second comma */
				while (value[temp_len] != 0)  {
L
Linus Torvalds 已提交
901
					if (value[temp_len] == separator[0]) {
902
						if (value[temp_len+1] ==
903 904 905
						     separator[0]) {
						/* skip second comma */
							temp_len++;
906
						} else {
L
Linus Torvalds 已提交
907 908 909 910 911 912 913
						/* single comma indicating start
							 of next parm */
							break;
						}
					}
					temp_len++;
				}
S
Steve French 已提交
914
				if (value[temp_len] == 0) {
L
Linus Torvalds 已提交
915 916 917 918 919 920
					options = NULL;
				} else {
					value[temp_len] = 0;
					/* point option to start of next parm */
					options = value + temp_len + 1;
				}
921
				/* go from value to value + temp_len condensing
L
Linus Torvalds 已提交
922 923
				double commas to singles. Note that this ends up
				allocating a few bytes too many, which is ok */
924
				vol->password = kzalloc(temp_len, GFP_KERNEL);
S
Steve French 已提交
925
				if (vol->password == NULL) {
926 927
					printk(KERN_WARNING "CIFS: no memory "
							    "for password\n");
928 929
					return 1;
				}
930
				for (i = 0, j = 0; i < temp_len; i++, j++) {
L
Linus Torvalds 已提交
931
					vol->password[j] = value[i];
S
Steve French 已提交
932
					if (value[i] == separator[0]
933
						&& value[i+1] == separator[0]) {
L
Linus Torvalds 已提交
934 935 936 937 938 939
						/* skip second comma */
						i++;
					}
				}
				vol->password[j] = 0;
			} else {
940
				vol->password = kzalloc(temp_len+1, GFP_KERNEL);
S
Steve French 已提交
941
				if (vol->password == NULL) {
942 943
					printk(KERN_WARNING "CIFS: no memory "
							    "for password\n");
944 945
					return 1;
				}
L
Linus Torvalds 已提交
946 947 948 949 950 951 952 953
				strcpy(vol->password, value);
			}
		} else if (strnicmp(data, "ip", 2) == 0) {
			if (!value || !*value) {
				vol->UNCip = NULL;
			} else if (strnlen(value, 35) < 35) {
				vol->UNCip = value;
			} else {
954 955
				printk(KERN_WARNING "CIFS: ip address "
						    "too long\n");
L
Linus Torvalds 已提交
956 957
				return 1;
			}
958 959 960 961 962 963
		} else if (strnicmp(data, "sec", 3) == 0) {
			if (!value || !*value) {
				cERROR(1, ("no security value specified"));
				continue;
			} else if (strnicmp(value, "krb5i", 5) == 0) {
				vol->secFlg |= CIFSSEC_MAY_KRB5 |
964
					CIFSSEC_MUST_SIGN;
965
			} else if (strnicmp(value, "krb5p", 5) == 0) {
966 967 968
				/* vol->secFlg |= CIFSSEC_MUST_SEAL |
					CIFSSEC_MAY_KRB5; */
				cERROR(1, ("Krb5 cifs privacy not supported"));
969 970
				return 1;
			} else if (strnicmp(value, "krb5", 4) == 0) {
971
				vol->secFlg |= CIFSSEC_MAY_KRB5;
972
			} else if (strnicmp(value, "ntlmv2i", 7) == 0) {
973
				vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
974
					CIFSSEC_MUST_SIGN;
975
			} else if (strnicmp(value, "ntlmv2", 6) == 0) {
976
				vol->secFlg |= CIFSSEC_MAY_NTLMV2;
977
			} else if (strnicmp(value, "ntlmi", 5) == 0) {
978
				vol->secFlg |= CIFSSEC_MAY_NTLM |
979
					CIFSSEC_MUST_SIGN;
980 981
			} else if (strnicmp(value, "ntlm", 4) == 0) {
				/* ntlm is default so can be turned off too */
982
				vol->secFlg |= CIFSSEC_MAY_NTLM;
983
			} else if (strnicmp(value, "nontlm", 6) == 0) {
984
				/* BB is there a better way to do this? */
985
				vol->secFlg |= CIFSSEC_MAY_NTLMV2;
986 987
#ifdef CONFIG_CIFS_WEAK_PW_HASH
			} else if (strnicmp(value, "lanman", 6) == 0) {
988
				vol->secFlg |= CIFSSEC_MAY_LANMAN;
989
#endif
990
			} else if (strnicmp(value, "none", 4) == 0) {
991
				vol->nullauth = 1;
992 993 994 995
			} else {
				cERROR(1, ("bad security option: %s", value));
				return 1;
			}
L
Linus Torvalds 已提交
996 997 998 999
		} else if ((strnicmp(data, "unc", 3) == 0)
			   || (strnicmp(data, "target", 6) == 0)
			   || (strnicmp(data, "path", 4) == 0)) {
			if (!value || !*value) {
1000 1001
				printk(KERN_WARNING "CIFS: invalid path to "
						    "network resource\n");
L
Linus Torvalds 已提交
1002 1003 1004
				return 1;	/* needs_arg; */
			}
			if ((temp_len = strnlen(value, 300)) < 300) {
1005
				vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1006
				if (vol->UNC == NULL)
L
Linus Torvalds 已提交
1007
					return 1;
1008
				strcpy(vol->UNC, value);
L
Linus Torvalds 已提交
1009 1010 1011
				if (strncmp(vol->UNC, "//", 2) == 0) {
					vol->UNC[0] = '\\';
					vol->UNC[1] = '\\';
1012
				} else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
L
Linus Torvalds 已提交
1013
					printk(KERN_WARNING
1014 1015
					       "CIFS: UNC Path does not begin "
					       "with // or \\\\ \n");
L
Linus Torvalds 已提交
1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029
					return 1;
				}
			} else {
				printk(KERN_WARNING "CIFS: UNC name too long\n");
				return 1;
			}
		} else if ((strnicmp(data, "domain", 3) == 0)
			   || (strnicmp(data, "workgroup", 5) == 0)) {
			if (!value || !*value) {
				printk(KERN_WARNING "CIFS: invalid domain name\n");
				return 1;	/* needs_arg; */
			}
			/* BB are there cases in which a comma can be valid in
			a domain name and need special handling? */
1030
			if (strnlen(value, 256) < 256) {
L
Linus Torvalds 已提交
1031 1032 1033
				vol->domainname = value;
				cFYI(1, ("Domain name set"));
			} else {
1034 1035
				printk(KERN_WARNING "CIFS: domain name too "
						    "long\n");
L
Linus Torvalds 已提交
1036 1037
				return 1;
			}
1038 1039 1040 1041 1042 1043 1044
		} else if (strnicmp(data, "prefixpath", 10) == 0) {
			if (!value || !*value) {
				printk(KERN_WARNING
					"CIFS: invalid path prefix\n");
				return 1;       /* needs_argument */
			}
			if ((temp_len = strnlen(value, 1024)) < 1024) {
1045
				if (value[0] != '/')
1046
					temp_len++;  /* missing leading slash */
1047 1048 1049
				vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
				if (vol->prepath == NULL)
					return 1;
1050
				if (value[0] != '/') {
1051
					vol->prepath[0] = '/';
1052
					strcpy(vol->prepath+1, value);
1053
				} else
1054 1055 1056 1057 1058 1059
					strcpy(vol->prepath, value);
				cFYI(1, ("prefix path %s", vol->prepath));
			} else {
				printk(KERN_WARNING "CIFS: prefix too long\n");
				return 1;
			}
L
Linus Torvalds 已提交
1060 1061
		} else if (strnicmp(data, "iocharset", 9) == 0) {
			if (!value || !*value) {
1062 1063
				printk(KERN_WARNING "CIFS: invalid iocharset "
						    "specified\n");
L
Linus Torvalds 已提交
1064 1065 1066
				return 1;	/* needs_arg; */
			}
			if (strnlen(value, 65) < 65) {
1067
				if (strnicmp(value, "default", 7))
L
Linus Torvalds 已提交
1068
					vol->iocharset = value;
1069 1070 1071
				/* if iocharset not set then load_nls_default
				   is used by caller */
				cFYI(1, ("iocharset set to %s", value));
L
Linus Torvalds 已提交
1072
			} else {
1073 1074
				printk(KERN_WARNING "CIFS: iocharset name "
						    "too long.\n");
L
Linus Torvalds 已提交
1075 1076 1077 1078 1079 1080
				return 1;
			}
		} else if (strnicmp(data, "uid", 3) == 0) {
			if (value && *value) {
				vol->linux_uid =
					simple_strtoul(value, &value, 0);
1081
				vol->override_uid = 1;
L
Linus Torvalds 已提交
1082 1083 1084 1085 1086
			}
		} else if (strnicmp(data, "gid", 3) == 0) {
			if (value && *value) {
				vol->linux_gid =
					simple_strtoul(value, &value, 0);
1087
				vol->override_gid = 1;
L
Linus Torvalds 已提交
1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125
			}
		} else if (strnicmp(data, "file_mode", 4) == 0) {
			if (value && *value) {
				vol->file_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "dir_mode", 4) == 0) {
			if (value && *value) {
				vol->dir_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "dirmode", 4) == 0) {
			if (value && *value) {
				vol->dir_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "port", 4) == 0) {
			if (value && *value) {
				vol->port =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "rsize", 5) == 0) {
			if (value && *value) {
				vol->rsize =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "wsize", 5) == 0) {
			if (value && *value) {
				vol->wsize =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "sockopt", 5) == 0) {
			if (value && *value) {
				vol->sockopt =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "netbiosname", 4) == 0) {
			if (!value || !*value || (*value == ' ')) {
1126
				cFYI(1, ("invalid (empty) netbiosname"));
L
Linus Torvalds 已提交
1127
			} else {
1128 1129 1130
				memset(vol->source_rfc1001_name, 0x20, 15);
				for (i = 0; i < 15; i++) {
				/* BB are there cases in which a comma can be
L
Linus Torvalds 已提交
1131 1132 1133 1134
				valid in this workstation netbios name (and need
				special handling)? */

				/* We do not uppercase netbiosname for user */
1135
					if (value[i] == 0)
L
Linus Torvalds 已提交
1136
						break;
1137 1138 1139
					else
						vol->source_rfc1001_name[i] =
								value[i];
L
Linus Torvalds 已提交
1140 1141 1142
				}
				/* The string has 16th byte zero still from
				set at top of the function  */
1143 1144 1145
				if ((i == 15) && (value[i] != 0))
					printk(KERN_WARNING "CIFS: netbiosname"
						" longer than 15 truncated.\n");
1146 1147 1148 1149
			}
		} else if (strnicmp(data, "servern", 7) == 0) {
			/* servernetbiosname specified override *SMBSERVER */
			if (!value || !*value || (*value == ' ')) {
S
Steve French 已提交
1150
				cFYI(1, ("empty server netbiosname specified"));
1151 1152
			} else {
				/* last byte, type, is 0x20 for servr type */
1153
				memset(vol->target_rfc1001_name, 0x20, 16);
1154

1155
				for (i = 0; i < 15; i++) {
1156
				/* BB are there cases in which a comma can be
1157 1158
				   valid in this workstation netbios name
				   (and need special handling)? */
1159

1160 1161 1162
				/* user or mount helper must uppercase
				   the netbiosname */
					if (value[i] == 0)
1163 1164
						break;
					else
1165 1166
						vol->target_rfc1001_name[i] =
								value[i];
1167 1168 1169
				}
				/* The string has 16th byte zero still from
				   set at top of the function  */
1170 1171 1172
				if ((i == 15) && (value[i] != 0))
					printk(KERN_WARNING "CIFS: server net"
					"biosname longer than 15 truncated.\n");
L
Linus Torvalds 已提交
1173 1174 1175 1176 1177
			}
		} else if (strnicmp(data, "credentials", 4) == 0) {
			/* ignore */
		} else if (strnicmp(data, "version", 3) == 0) {
			/* ignore */
1178
		} else if (strnicmp(data, "guest", 5) == 0) {
L
Linus Torvalds 已提交
1179 1180
			/* ignore */
		} else if (strnicmp(data, "rw", 2) == 0) {
1181
			vol->rw = true;
L
Linus Torvalds 已提交
1182 1183 1184 1185 1186 1187 1188 1189
		} else if ((strnicmp(data, "suid", 4) == 0) ||
				   (strnicmp(data, "nosuid", 6) == 0) ||
				   (strnicmp(data, "exec", 4) == 0) ||
				   (strnicmp(data, "noexec", 6) == 0) ||
				   (strnicmp(data, "nodev", 5) == 0) ||
				   (strnicmp(data, "noauto", 6) == 0) ||
				   (strnicmp(data, "dev", 3) == 0)) {
			/*  The mount tool or mount.cifs helper (if present)
1190 1191 1192 1193 1194
			    uses these opts to set flags, and the flags are read
			    by the kernel vfs layer before we get here (ie
			    before read super) so there is no point trying to
			    parse these options again and set anything and it
			    is ok to just ignore them */
L
Linus Torvalds 已提交
1195 1196
			continue;
		} else if (strnicmp(data, "ro", 2) == 0) {
1197
			vol->rw = false;
L
Linus Torvalds 已提交
1198 1199 1200 1201 1202 1203 1204 1205
		} else if (strnicmp(data, "hard", 4) == 0) {
			vol->retry = 1;
		} else if (strnicmp(data, "soft", 4) == 0) {
			vol->retry = 0;
		} else if (strnicmp(data, "perm", 4) == 0) {
			vol->noperm = 0;
		} else if (strnicmp(data, "noperm", 6) == 0) {
			vol->noperm = 1;
1206 1207 1208 1209
		} else if (strnicmp(data, "mapchars", 8) == 0) {
			vol->remap = 1;
		} else if (strnicmp(data, "nomapchars", 10) == 0) {
			vol->remap = 0;
1210 1211 1212 1213
		} else if (strnicmp(data, "sfu", 3) == 0) {
			vol->sfu_emul = 1;
		} else if (strnicmp(data, "nosfu", 5) == 0) {
			vol->sfu_emul = 0;
1214 1215 1216 1217
		} else if (strnicmp(data, "posixpaths", 10) == 0) {
			vol->posix_paths = 1;
		} else if (strnicmp(data, "noposixpaths", 12) == 0) {
			vol->posix_paths = 0;
1218 1219 1220 1221
		} else if (strnicmp(data, "nounix", 6) == 0) {
			vol->no_linux_ext = 1;
		} else if (strnicmp(data, "nolinux", 7) == 0) {
			vol->no_linux_ext = 1;
1222
		} else if ((strnicmp(data, "nocase", 6) == 0) ||
1223
			   (strnicmp(data, "ignorecase", 10)  == 0)) {
1224
			vol->nocase = 1;
1225 1226
		} else if (strnicmp(data, "brl", 3) == 0) {
			vol->nobrl =  0;
1227
		} else if ((strnicmp(data, "nobrl", 5) == 0) ||
1228
			   (strnicmp(data, "nolock", 6) == 0)) {
1229
			vol->nobrl =  1;
1230 1231 1232
			/* turn off mandatory locking in mode
			if remote locking is turned off since the
			local vfs will do advisory */
1233 1234
			if (vol->file_mode ==
				(S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1235
				vol->file_mode = S_IALLUGO;
L
Linus Torvalds 已提交
1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247
		} else if (strnicmp(data, "setuids", 7) == 0) {
			vol->setuids = 1;
		} else if (strnicmp(data, "nosetuids", 9) == 0) {
			vol->setuids = 0;
		} else if (strnicmp(data, "nohard", 6) == 0) {
			vol->retry = 0;
		} else if (strnicmp(data, "nosoft", 6) == 0) {
			vol->retry = 1;
		} else if (strnicmp(data, "nointr", 6) == 0) {
			vol->intr = 0;
		} else if (strnicmp(data, "intr", 4) == 0) {
			vol->intr = 1;
1248
		} else if (strnicmp(data, "serverino", 7) == 0) {
L
Linus Torvalds 已提交
1249
			vol->server_ino = 1;
1250
		} else if (strnicmp(data, "noserverino", 9) == 0) {
L
Linus Torvalds 已提交
1251
			vol->server_ino = 0;
1252
		} else if (strnicmp(data, "cifsacl", 7) == 0) {
1253 1254 1255
			vol->cifs_acl = 1;
		} else if (strnicmp(data, "nocifsacl", 9) == 0) {
			vol->cifs_acl = 0;
1256
		} else if (strnicmp(data, "acl", 3) == 0) {
L
Linus Torvalds 已提交
1257
			vol->no_psx_acl = 0;
1258
		} else if (strnicmp(data, "noacl", 5) == 0) {
L
Linus Torvalds 已提交
1259
			vol->no_psx_acl = 1;
1260
		} else if (strnicmp(data, "sign", 4) == 0) {
1261 1262 1263
			vol->secFlg |= CIFSSEC_MUST_SIGN;
/*		} else if (strnicmp(data, "seal",4) == 0) {
			vol->secFlg |= CIFSSEC_MUST_SEAL; */
1264
		} else if (strnicmp(data, "direct", 6) == 0) {
L
Linus Torvalds 已提交
1265
			vol->direct_io = 1;
1266
		} else if (strnicmp(data, "forcedirectio", 13) == 0) {
L
Linus Torvalds 已提交
1267
			vol->direct_io = 1;
1268
		} else if (strnicmp(data, "in6_addr", 8) == 0) {
L
Linus Torvalds 已提交
1269 1270 1271 1272 1273
			if (!value || !*value) {
				vol->in6_addr = NULL;
			} else if (strnlen(value, 49) == 48) {
				vol->in6_addr = value;
			} else {
1274 1275
				printk(KERN_WARNING "CIFS: ip v6 address not "
						    "48 characters long\n");
L
Linus Torvalds 已提交
1276 1277 1278
				return 1;
			}
		} else if (strnicmp(data, "noac", 4) == 0) {
1279 1280 1281
			printk(KERN_WARNING "CIFS: Mount option noac not "
				"supported. Instead set "
				"/proc/fs/cifs/LookupCacheEnabled to 0\n");
L
Linus Torvalds 已提交
1282
		} else
1283 1284
			printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
						data);
L
Linus Torvalds 已提交
1285 1286
	}
	if (vol->UNC == NULL) {
1287
		if (devname == NULL) {
1288 1289
			printk(KERN_WARNING "CIFS: Missing UNC name for mount "
						"target\n");
L
Linus Torvalds 已提交
1290 1291 1292
			return 1;
		}
		if ((temp_len = strnlen(devname, 300)) < 300) {
1293
			vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1294
			if (vol->UNC == NULL)
L
Linus Torvalds 已提交
1295
				return 1;
1296
			strcpy(vol->UNC, devname);
L
Linus Torvalds 已提交
1297 1298 1299 1300
			if (strncmp(vol->UNC, "//", 2) == 0) {
				vol->UNC[0] = '\\';
				vol->UNC[1] = '\\';
			} else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1301 1302
				printk(KERN_WARNING "CIFS: UNC Path does not "
						    "begin with // or \\\\ \n");
L
Linus Torvalds 已提交
1303 1304
				return 1;
			}
1305 1306 1307
			value = strpbrk(vol->UNC+2, "/\\");
			if (value)
				*value = '\\';
L
Linus Torvalds 已提交
1308 1309 1310 1311 1312
		} else {
			printk(KERN_WARNING "CIFS: UNC name too long\n");
			return 1;
		}
	}
S
Steve French 已提交
1313
	if (vol->UNCip == NULL)
L
Linus Torvalds 已提交
1314 1315 1316 1317 1318 1319
		vol->UNCip = &vol->UNC[2];

	return 0;
}

static struct cifsSesInfo *
1320
cifs_find_tcp_session(struct in_addr *target_ip_addr,
1321 1322
		      struct in6_addr *target_ip6_addr,
		      char *userName, struct TCP_Server_Info **psrvTcp)
L
Linus Torvalds 已提交
1323 1324 1325
{
	struct list_head *tmp;
	struct cifsSesInfo *ses;
1326

L
Linus Torvalds 已提交
1327 1328
	*psrvTcp = NULL;

1329
	read_lock(&GlobalSMBSeslock);
L
Linus Torvalds 已提交
1330 1331
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1332 1333 1334 1335 1336 1337 1338 1339 1340 1341
		if (!ses->server)
			continue;

		if (target_ip_addr &&
		    ses->server->addr.sockAddr.sin_addr.s_addr != target_ip_addr->s_addr)
				continue;
		else if (target_ip6_addr &&
			 memcmp(&ses->server->addr.sockAddr6.sin6_addr,
				target_ip6_addr, sizeof(*target_ip6_addr)))
				continue;
1342
		/* BB lock server and tcp session; increment use count here?? */
1343 1344 1345 1346 1347 1348 1349 1350 1351 1352

		/* found a match on the TCP session */
		*psrvTcp = ses->server;

		/* BB check if reconnection needed */
		if (strncmp(ses->userName, userName, MAX_USERNAME_SIZE) == 0) {
			read_unlock(&GlobalSMBSeslock);
			/* Found exact match on both TCP and
			   SMB sessions */
			return ses;
L
Linus Torvalds 已提交
1353 1354 1355 1356
		}
		/* else tcp and smb sessions need reconnection */
	}
	read_unlock(&GlobalSMBSeslock);
1357

L
Linus Torvalds 已提交
1358 1359 1360 1361 1362 1363 1364 1365
	return NULL;
}

static struct cifsTconInfo *
find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
{
	struct list_head *tmp;
	struct cifsTconInfo *tcon;
1366
	__be32 old_ip;
L
Linus Torvalds 已提交
1367 1368

	read_lock(&GlobalSMBSeslock);
1369

L
Linus Torvalds 已提交
1370
	list_for_each(tmp, &GlobalTreeConnectionList) {
1371
		cFYI(1, ("Next tcon"));
L
Linus Torvalds 已提交
1372
		tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400
		if (!tcon->ses || !tcon->ses->server)
			continue;

		old_ip = tcon->ses->server->addr.sockAddr.sin_addr.s_addr;
		cFYI(1, ("old ip addr: %x == new ip %x ?",
			old_ip, new_target_ip_addr));

		if (old_ip != new_target_ip_addr)
			continue;

		/* BB lock tcon, server, tcp session and increment use count? */
		/* found a match on the TCP session */
		/* BB check if reconnection needed */
		cFYI(1, ("IP match, old UNC: %s new: %s",
			tcon->treeName, uncName));

		if (strncmp(tcon->treeName, uncName, MAX_TREE_SIZE))
			continue;

		cFYI(1, ("and old usr: %s new: %s",
			tcon->treeName, uncName));

		if (strncmp(tcon->ses->userName, userName, MAX_USERNAME_SIZE))
			continue;

		/* matched smb session (user name) */
		read_unlock(&GlobalSMBSeslock);
		return tcon;
L
Linus Torvalds 已提交
1401
	}
1402

L
Linus Torvalds 已提交
1403 1404 1405 1406 1407 1408
	read_unlock(&GlobalSMBSeslock);
	return NULL;
}

int
connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1409 1410
		    const char *old_path, const struct nls_table *nls_codepage,
		    int remap)
L
Linus Torvalds 已提交
1411
{
S
Steve French 已提交
1412
	struct dfs_info3_param *referrals = NULL;
L
Linus Torvalds 已提交
1413 1414 1415
	unsigned int num_referrals;
	int rc = 0;

1416
	rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
1417
			&num_referrals, &referrals, remap);
L
Linus Torvalds 已提交
1418 1419

	/* BB Add in code to: if valid refrl, if not ip address contact
1420
		the helper that resolves tcp names, mount to it, try to
L
Linus Torvalds 已提交
1421 1422
		tcon to it unmount it if fail */

J
Jesper Juhl 已提交
1423
	kfree(referrals);
L
Linus Torvalds 已提交
1424 1425 1426 1427 1428

	return rc;
}

int
1429 1430
get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
	     const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
S
Steve French 已提交
1431
	     struct dfs_info3_param **preferrals, int remap)
L
Linus Torvalds 已提交
1432 1433 1434
{
	char *temp_unc;
	int rc = 0;
S
Steve French 已提交
1435
	unsigned char *targetUNCs;
L
Linus Torvalds 已提交
1436 1437

	*pnum_referrals = 0;
S
Steve French 已提交
1438
	*preferrals = NULL;
L
Linus Torvalds 已提交
1439 1440 1441

	if (pSesInfo->ipc_tid == 0) {
		temp_unc = kmalloc(2 /* for slashes */ +
1442 1443
			strnlen(pSesInfo->serverName,
				SERVER_NAME_LEN_WITH_NULL * 2)
L
Linus Torvalds 已提交
1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
				 + 1 + 4 /* slash IPC$ */  + 2,
				GFP_KERNEL);
		if (temp_unc == NULL)
			return -ENOMEM;
		temp_unc[0] = '\\';
		temp_unc[1] = '\\';
		strcpy(temp_unc + 2, pSesInfo->serverName);
		strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
		rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
		cFYI(1,
1454
		     ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
L
Linus Torvalds 已提交
1455 1456 1457
		kfree(temp_unc);
	}
	if (rc == 0)
S
Steve French 已提交
1458
		rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, &targetUNCs,
1459
				     pnum_referrals, nls_codepage, remap);
S
Steve French 已提交
1460 1461
	/* BB map targetUNCs to dfs_info3 structures, here or
		in CIFSGetDFSRefer BB */
L
Linus Torvalds 已提交
1462 1463 1464 1465 1466

	return rc;
}

/* See RFC1001 section 14 on representation of Netbios names */
1467
static void rfc1002mangle(char *target, char *source, unsigned int length)
L
Linus Torvalds 已提交
1468
{
1469
	unsigned int i, j;
L
Linus Torvalds 已提交
1470

1471
	for (i = 0, j = 0; i < (length); i++) {
L
Linus Torvalds 已提交
1472 1473 1474
		/* mask a nibble at a time and encode */
		target[j] = 'A' + (0x0F & (source[i] >> 4));
		target[j+1] = 'A' + (0x0F & source[i]);
1475
		j += 2;
L
Linus Torvalds 已提交
1476 1477 1478 1479 1480 1481
	}

}


static int
1482 1483
ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
	     char *netbios_name, char *target_name)
L
Linus Torvalds 已提交
1484 1485 1486 1487 1488
{
	int rc = 0;
	int connected = 0;
	__be16 orig_port = 0;

S
Steve French 已提交
1489
	if (*csocket == NULL) {
1490 1491
		rc = sock_create_kern(PF_INET, SOCK_STREAM,
				      IPPROTO_TCP, csocket);
L
Linus Torvalds 已提交
1492
		if (rc < 0) {
1493
			cERROR(1, ("Error %d creating socket", rc));
L
Linus Torvalds 已提交
1494 1495 1496 1497
			*csocket = NULL;
			return rc;
		} else {
		/* BB other socket options to set KEEPALIVE, NODELAY? */
S
Steve French 已提交
1498
			cFYI(1, ("Socket created"));
1499
			(*csocket)->sk->sk_allocation = GFP_NOFS;
L
Linus Torvalds 已提交
1500 1501 1502 1503
		}
	}

	psin_server->sin_family = AF_INET;
S
Steve French 已提交
1504
	if (psin_server->sin_port) { /* user overrode default port */
L
Linus Torvalds 已提交
1505 1506
		rc = (*csocket)->ops->connect(*csocket,
				(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1507
				sizeof(struct sockaddr_in), 0);
L
Linus Torvalds 已提交
1508 1509
		if (rc >= 0)
			connected = 1;
1510
	}
L
Linus Torvalds 已提交
1511

S
Steve French 已提交
1512
	if (!connected) {
1513
		/* save original port so we can retry user specified port
L
Linus Torvalds 已提交
1514 1515 1516 1517
			later if fall back ports fail this time  */
		orig_port = psin_server->sin_port;

		/* do not retry on the same port we just failed on */
S
Steve French 已提交
1518
		if (psin_server->sin_port != htons(CIFS_PORT)) {
L
Linus Torvalds 已提交
1519 1520 1521 1522
			psin_server->sin_port = htons(CIFS_PORT);

			rc = (*csocket)->ops->connect(*csocket,
					(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1523
					sizeof(struct sockaddr_in), 0);
L
Linus Torvalds 已提交
1524 1525 1526 1527 1528 1529 1530
			if (rc >= 0)
				connected = 1;
		}
	}
	if (!connected) {
		psin_server->sin_port = htons(RFC1001_PORT);
		rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1531
					      psin_server,
C
Cyrill Gorcunov 已提交
1532
					      sizeof(struct sockaddr_in), 0);
1533
		if (rc >= 0)
L
Linus Torvalds 已提交
1534 1535 1536 1537 1538 1539
			connected = 1;
	}

	/* give up here - unless we want to retry on different
		protocol families some day */
	if (!connected) {
S
Steve French 已提交
1540
		if (orig_port)
L
Linus Torvalds 已提交
1541
			psin_server->sin_port = orig_port;
1542
		cFYI(1, ("Error %d connecting to server via ipv4", rc));
L
Linus Torvalds 已提交
1543 1544 1545 1546
		sock_release(*csocket);
		*csocket = NULL;
		return rc;
	}
1547 1548
	/* Eventually check for other socket options to change from
		the default. sock_setsockopt not used because it expects
L
Linus Torvalds 已提交
1549
		user space buffer */
1550 1551
	 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
		 (*csocket)->sk->sk_sndbuf,
1552
		 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
L
Linus Torvalds 已提交
1553
	(*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1554
	/* make the bufsizes depend on wsize/rsize and max requests */
S
Steve French 已提交
1555
	if ((*csocket)->sk->sk_sndbuf < (200 * 1024))
1556
		(*csocket)->sk->sk_sndbuf = 200 * 1024;
S
Steve French 已提交
1557
	if ((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1558
		(*csocket)->sk->sk_rcvbuf = 140 * 1024;
L
Linus Torvalds 已提交
1559 1560

	/* send RFC1001 sessinit */
S
Steve French 已提交
1561
	if (psin_server->sin_port == htons(RFC1001_PORT)) {
L
Linus Torvalds 已提交
1562
		/* some servers require RFC1001 sessinit before sending
1563
		negprot - BB check reconnection in case where second
L
Linus Torvalds 已提交
1564
		sessinit is sent but no second negprot */
1565 1566 1567 1568
		struct rfc1002_session_packet *ses_init_buf;
		struct smb_hdr *smb_buf;
		ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
				       GFP_KERNEL);
S
Steve French 已提交
1569
		if (ses_init_buf) {
L
Linus Torvalds 已提交
1570
			ses_init_buf->trailer.session_req.called_len = 32;
S
Steve French 已提交
1571
			if (target_name && (target_name[0] != 0)) {
1572 1573 1574 1575
				rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
					target_name, 16);
			} else {
				rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1576
					DEFAULT_CIFS_CALLED_NAME, 16);
1577 1578
			}

L
Linus Torvalds 已提交
1579 1580 1581
			ses_init_buf->trailer.session_req.calling_len = 32;
			/* calling name ends in null (byte 16) from old smb
			convention. */
1582
			if (netbios_name && (netbios_name[0] != 0)) {
L
Linus Torvalds 已提交
1583
				rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1584
					netbios_name, 16);
L
Linus Torvalds 已提交
1585 1586
			} else {
				rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1587
					"LINUX_CIFS_CLNT", 16);
L
Linus Torvalds 已提交
1588 1589 1590 1591 1592 1593 1594 1595 1596
			}
			ses_init_buf->trailer.session_req.scope1 = 0;
			ses_init_buf->trailer.session_req.scope2 = 0;
			smb_buf = (struct smb_hdr *)ses_init_buf;
			/* sizeof RFC1002_SESSION_REQUEST with no scope */
			smb_buf->smb_buf_length = 0x81000044;
			rc = smb_send(*csocket, smb_buf, 0x44,
				(struct sockaddr *)psin_server);
			kfree(ses_init_buf);
1597
			msleep(1); /* RFC1001 layer in at least one server
1598 1599 1600
				      requires very short break before negprot
				      presumably because not expecting negprot
				      to follow so fast.  This is a simple
1601
				      solution that works without
1602 1603 1604
				      complicating the code and causes no
				      significant slowing down on mount
				      for everyone else */
L
Linus Torvalds 已提交
1605
		}
1606
		/* else the negprot may still work without this
L
Linus Torvalds 已提交
1607
		even though malloc failed */
1608

L
Linus Torvalds 已提交
1609
	}
1610

L
Linus Torvalds 已提交
1611 1612 1613 1614 1615 1616 1617 1618 1619 1620
	return rc;
}

static int
ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
{
	int rc = 0;
	int connected = 0;
	__be16 orig_port = 0;

S
Steve French 已提交
1621
	if (*csocket == NULL) {
1622 1623
		rc = sock_create_kern(PF_INET6, SOCK_STREAM,
				      IPPROTO_TCP, csocket);
L
Linus Torvalds 已提交
1624
		if (rc < 0) {
1625
			cERROR(1, ("Error %d creating ipv6 socket", rc));
L
Linus Torvalds 已提交
1626 1627 1628 1629
			*csocket = NULL;
			return rc;
		} else {
		/* BB other socket options to set KEEPALIVE, NODELAY? */
S
Steve French 已提交
1630
			 cFYI(1, ("ipv6 Socket created"));
L
Linus Torvalds 已提交
1631 1632 1633 1634 1635 1636
			(*csocket)->sk->sk_allocation = GFP_NOFS;
		}
	}

	psin_server->sin6_family = AF_INET6;

S
Steve French 已提交
1637
	if (psin_server->sin6_port) { /* user overrode default port */
L
Linus Torvalds 已提交
1638 1639
		rc = (*csocket)->ops->connect(*csocket,
				(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1640
				sizeof(struct sockaddr_in6), 0);
L
Linus Torvalds 已提交
1641 1642
		if (rc >= 0)
			connected = 1;
1643
	}
L
Linus Torvalds 已提交
1644

S
Steve French 已提交
1645
	if (!connected) {
1646
		/* save original port so we can retry user specified port
L
Linus Torvalds 已提交
1647 1648 1649 1650
			later if fall back ports fail this time  */

		orig_port = psin_server->sin6_port;
		/* do not retry on the same port we just failed on */
S
Steve French 已提交
1651
		if (psin_server->sin6_port != htons(CIFS_PORT)) {
L
Linus Torvalds 已提交
1652 1653 1654 1655
			psin_server->sin6_port = htons(CIFS_PORT);

			rc = (*csocket)->ops->connect(*csocket,
					(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1656
					sizeof(struct sockaddr_in6), 0);
L
Linus Torvalds 已提交
1657 1658 1659 1660 1661 1662 1663
			if (rc >= 0)
				connected = 1;
		}
	}
	if (!connected) {
		psin_server->sin6_port = htons(RFC1001_PORT);
		rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
C
Cyrill Gorcunov 已提交
1664
				 psin_server, sizeof(struct sockaddr_in6), 0);
1665
		if (rc >= 0)
L
Linus Torvalds 已提交
1666 1667 1668 1669 1670 1671
			connected = 1;
	}

	/* give up here - unless we want to retry on different
		protocol families some day */
	if (!connected) {
S
Steve French 已提交
1672
		if (orig_port)
L
Linus Torvalds 已提交
1673
			psin_server->sin6_port = orig_port;
1674
		cFYI(1, ("Error %d connecting to server via ipv6", rc));
L
Linus Torvalds 已提交
1675 1676 1677 1678
		sock_release(*csocket);
		*csocket = NULL;
		return rc;
	}
1679 1680
	/* Eventually check for other socket options to change from
		the default. sock_setsockopt not used because it expects
L
Linus Torvalds 已提交
1681 1682
		user space buffer */
	(*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1683

L
Linus Torvalds 已提交
1684 1685 1686
	return rc;
}

1687 1688
void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
			  struct super_block *sb, struct smb_vol *vol_info)
1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699
{
	/* if we are reconnecting then should we check to see if
	 * any requested capabilities changed locally e.g. via
	 * remount but we can not do much about it here
	 * if they have (even if we could detect it by the following)
	 * Perhaps we could add a backpointer to array of sb from tcon
	 * or if we change to make all sb to same share the same
	 * sb as NFS - then we only have one backpointer to sb.
	 * What if we wanted to mount the server share twice once with
	 * and once without posixacls or posix paths? */
	__u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1700

1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
	if (vol_info && vol_info->no_linux_ext) {
		tcon->fsUnixInfo.Capability = 0;
		tcon->unix_ext = 0; /* Unix Extensions disabled */
		cFYI(1, ("Linux protocol extensions disabled"));
		return;
	} else if (vol_info)
		tcon->unix_ext = 1; /* Unix Extensions supported */

	if (tcon->unix_ext == 0) {
		cFYI(1, ("Unix extensions disabled so not set on reconnect"));
		return;
	}
1713

S
Steve French 已提交
1714
	if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1715
		__u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1716

1717 1718
		/* check for reconnect case in which we do not
		   want to change the mount behavior if we can avoid it */
S
Steve French 已提交
1719
		if (vol_info == NULL) {
1720
			/* turn off POSIX ACL and PATHNAMES if not set
1721 1722 1723
			   originally at mount time */
			if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
				cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1724 1725 1726
			if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
				if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
					cERROR(1, ("POSIXPATH support change"));
1727
				cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1728 1729 1730 1731 1732
			} else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
				cERROR(1, ("possible reconnect error"));
				cERROR(1,
					("server disabled POSIX path support"));
			}
1733
		}
1734

1735
		cap &= CIFS_UNIX_CAP_MASK;
1736
		if (vol_info && vol_info->no_psx_acl)
1737
			cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1738
		else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
S
Steve French 已提交
1739 1740
			cFYI(1, ("negotiated posix acl support"));
			if (sb)
1741 1742 1743
				sb->s_flags |= MS_POSIXACL;
		}

1744
		if (vol_info && vol_info->posix_paths == 0)
1745
			cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1746
		else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
S
Steve French 已提交
1747
			cFYI(1, ("negotiate posix pathnames"));
1748
			if (sb)
1749
				CIFS_SB(sb)->mnt_cifs_flags |=
1750 1751
					CIFS_MOUNT_POSIX_PATHS;
		}
1752

1753 1754
		/* We might be setting the path sep back to a different
		form if we are reconnecting and the server switched its
1755
		posix path capability for this share */
1756
		if (sb && (CIFS_SB(sb)->prepathlen > 0))
1757
			CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1758 1759 1760 1761

		if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
			if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
				CIFS_SB(sb)->rsize = 127 * 1024;
1762 1763
				cFYI(DBG2,
					("larger reads not supported by srv"));
1764 1765
			}
		}
1766 1767 1768


		cFYI(1, ("Negotiate caps 0x%x", (int)cap));
1769
#ifdef CONFIG_CIFS_DEBUG2
1770
		if (cap & CIFS_UNIX_FCNTL_CAP)
S
Steve French 已提交
1771
			cFYI(1, ("FCNTL cap"));
1772
		if (cap & CIFS_UNIX_EXTATTR_CAP)
S
Steve French 已提交
1773
			cFYI(1, ("EXTATTR cap"));
1774
		if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
S
Steve French 已提交
1775
			cFYI(1, ("POSIX path cap"));
1776
		if (cap & CIFS_UNIX_XATTR_CAP)
S
Steve French 已提交
1777
			cFYI(1, ("XATTR cap"));
1778
		if (cap & CIFS_UNIX_POSIX_ACL_CAP)
S
Steve French 已提交
1779
			cFYI(1, ("POSIX ACL cap"));
1780
		if (cap & CIFS_UNIX_LARGE_READ_CAP)
S
Steve French 已提交
1781
			cFYI(1, ("very large read cap"));
1782
		if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
S
Steve French 已提交
1783
			cFYI(1, ("very large write cap"));
1784 1785
#endif /* CIFS_DEBUG2 */
		if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1786
			if (vol_info == NULL) {
1787
				cFYI(1, ("resetting capabilities failed"));
1788
			} else
1789 1790 1791 1792 1793
				cERROR(1, ("Negotiating Unix capabilities "
					   "with the server failed.  Consider "
					   "mounting with the Unix Extensions\n"
					   "disabled, if problems are found, "
					   "by specifying the nounix mount "
1794
					   "option."));
1795

1796 1797 1798 1799
		}
	}
}

1800 1801 1802 1803
static void
convert_delimiter(char *path, char delim)
{
	int i;
1804
	char old_delim;
1805 1806 1807 1808

	if (path == NULL)
		return;

1809 1810 1811 1812 1813
	if (delim == '/') 
		old_delim = '\\';
	else
		old_delim = '/';

1814
	for (i = 0; path[i] != '\0'; i++) {
1815
		if (path[i] == old_delim)
1816 1817 1818 1819
			path[i] = delim;
	}
}

L
Linus Torvalds 已提交
1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838
int
cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
	   char *mount_data, const char *devname)
{
	int rc = 0;
	int xid;
	int address_type = AF_INET;
	struct socket *csocket = NULL;
	struct sockaddr_in sin_server;
	struct sockaddr_in6 sin_server6;
	struct smb_vol volume_info;
	struct cifsSesInfo *pSesInfo = NULL;
	struct cifsSesInfo *existingCifsSes = NULL;
	struct cifsTconInfo *tcon = NULL;
	struct TCP_Server_Info *srvTcp = NULL;

	xid = GetXid();

/* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1839 1840

	memset(&volume_info, 0, sizeof(struct smb_vol));
L
Linus Torvalds 已提交
1841
	if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1842 1843
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1844 1845
	}

1846
	if (volume_info.nullauth) {
S
Steve French 已提交
1847
		cFYI(1, ("null user"));
1848
		volume_info.username = "";
1849
	} else if (volume_info.username) {
L
Linus Torvalds 已提交
1850
		/* BB fixme parse for domain name here */
S
Steve French 已提交
1851
		cFYI(1, ("Username: %s", volume_info.username));
L
Linus Torvalds 已提交
1852
	} else {
1853
		cifserror("No username specified");
1854 1855
	/* In userspace mount helper we can get user name from alternate
	   locations such as env variables and files on disk */
1856 1857
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1858 1859 1860
	}

	if (volume_info.UNCip && volume_info.UNC) {
1861 1862
		rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
				    &sin_server.sin_addr.s_addr);
L
Linus Torvalds 已提交
1863

S
Steve French 已提交
1864
		if (rc <= 0) {
L
Linus Torvalds 已提交
1865
			/* not ipv4 address, try ipv6 */
1866 1867
			rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
					    &sin_server6.sin6_addr.in6_u);
S
Steve French 已提交
1868
			if (rc > 0)
L
Linus Torvalds 已提交
1869 1870 1871 1872
				address_type = AF_INET6;
		} else {
			address_type = AF_INET;
		}
1873

S
Steve French 已提交
1874
		if (rc <= 0) {
L
Linus Torvalds 已提交
1875
			/* we failed translating address */
1876 1877
			rc = -EINVAL;
			goto out;
L
Linus Torvalds 已提交
1878 1879 1880 1881 1882
		}

		cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
		/* success */
		rc = 0;
1883 1884 1885 1886
	} else if (volume_info.UNCip) {
		/* BB using ip addr as server name to connect to the
		   DFS root below */
		cERROR(1, ("Connecting to DFS root not implemented yet"));
1887 1888
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1889 1890
	} else /* which servers DFS root would we conect to */ {
		cERROR(1,
1891 1892
		       ("CIFS mount error: No UNC path (e.g. -o "
			"unc=//192.168.1.100/public) specified"));
1893 1894
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1895 1896 1897
	}

	/* this is needed for ASCII cp to Unicode converts */
S
Steve French 已提交
1898
	if (volume_info.iocharset == NULL) {
L
Linus Torvalds 已提交
1899 1900 1901 1902
		cifs_sb->local_nls = load_nls_default();
	/* load_nls_default can not return null */
	} else {
		cifs_sb->local_nls = load_nls(volume_info.iocharset);
S
Steve French 已提交
1903
		if (cifs_sb->local_nls == NULL) {
1904 1905
			cERROR(1, ("CIFS mount error: iocharset %s not found",
				 volume_info.iocharset));
1906 1907
			rc = -ELIBACC;
			goto out;
L
Linus Torvalds 已提交
1908 1909 1910
		}
	}

S
Steve French 已提交
1911
	if (address_type == AF_INET)
L
Linus Torvalds 已提交
1912 1913 1914
		existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
			NULL /* no ipv6 addr */,
			volume_info.username, &srvTcp);
S
Steve French 已提交
1915 1916
	else if (address_type == AF_INET6) {
		cFYI(1, ("looking for ipv6 address"));
L
Linus Torvalds 已提交
1917 1918 1919
		existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
			&sin_server6.sin6_addr,
			volume_info.username, &srvTcp);
S
Steve French 已提交
1920
	} else {
1921 1922
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1923 1924 1925
	}

	if (srvTcp) {
1926
		cFYI(1, ("Existing tcp session with server found"));
L
Linus Torvalds 已提交
1927
	} else {	/* create socket */
1928
		if (volume_info.port)
L
Linus Torvalds 已提交
1929 1930 1931
			sin_server.sin_port = htons(volume_info.port);
		else
			sin_server.sin_port = 0;
S
Steve French 已提交
1932
		if (address_type == AF_INET6) {
S
Steve French 已提交
1933
			cFYI(1, ("attempting ipv6 connect"));
S
Steve French 已提交
1934 1935
			/* BB should we allow ipv6 on port 139? */
			/* other OS never observed in Wild doing 139 with v6 */
1936 1937 1938
			rc = ipv6_connect(&sin_server6, &csocket);
		} else
			rc = ipv4_connect(&sin_server, &csocket,
1939 1940
				  volume_info.source_rfc1001_name,
				  volume_info.target_rfc1001_name);
L
Linus Torvalds 已提交
1941
		if (rc < 0) {
1942 1943
			cERROR(1, ("Error connecting to IPv4 socket. "
				   "Aborting operation"));
1944
			if (csocket != NULL)
L
Linus Torvalds 已提交
1945
				sock_release(csocket);
1946
			goto out;
L
Linus Torvalds 已提交
1947 1948
		}

1949 1950
		srvTcp = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
		if (!srvTcp) {
L
Linus Torvalds 已提交
1951 1952
			rc = -ENOMEM;
			sock_release(csocket);
1953
			goto out;
L
Linus Torvalds 已提交
1954
		} else {
1955
			memcpy(&srvTcp->addr.sockAddr, &sin_server,
C
Cyrill Gorcunov 已提交
1956
				sizeof(struct sockaddr_in));
1957
			atomic_set(&srvTcp->inFlight, 0);
L
Linus Torvalds 已提交
1958 1959 1960
			/* BB Add code for ipv6 case too */
			srvTcp->ssocket = csocket;
			srvTcp->protocolType = IPV4;
1961 1962 1963 1964 1965 1966
			srvTcp->hostname = extract_hostname(volume_info.UNC);
			if (IS_ERR(srvTcp->hostname)) {
				rc = PTR_ERR(srvTcp->hostname);
				sock_release(csocket);
				goto out;
			}
L
Linus Torvalds 已提交
1967 1968 1969 1970 1971 1972 1973 1974
			init_waitqueue_head(&srvTcp->response_q);
			init_waitqueue_head(&srvTcp->request_q);
			INIT_LIST_HEAD(&srvTcp->pending_mid_q);
			/* at this point we are the only ones with the pointer
			to the struct since the kernel thread not created yet
			so no need to spinlock this init of tcpStatus */
			srvTcp->tcpStatus = CifsNew;
			init_MUTEX(&srvTcp->tcpSem);
1975
			srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
S
Steve French 已提交
1976
			if (IS_ERR(srvTcp->tsk)) {
1977
				rc = PTR_ERR(srvTcp->tsk);
1978
				cERROR(1, ("error %d create cifsd thread", rc));
1979
				srvTcp->tsk = NULL;
L
Linus Torvalds 已提交
1980
				sock_release(csocket);
1981
				kfree(srvTcp->hostname);
1982
				goto out;
1983 1984
			}
			rc = 0;
1985 1986 1987 1988
			memcpy(srvTcp->workstation_RFC1001_name,
				volume_info.source_rfc1001_name, 16);
			memcpy(srvTcp->server_RFC1001_name,
				volume_info.target_rfc1001_name, 16);
1989
			srvTcp->sequence_number = 0;
L
Linus Torvalds 已提交
1990 1991 1992 1993 1994
		}
	}

	if (existingCifsSes) {
		pSesInfo = existingCifsSes;
1995 1996
		cFYI(1, ("Existing smb sess found (status=%d)",
			pSesInfo->status));
1997
		down(&pSesInfo->sesSem);
1998 1999 2000 2001 2002
		if (pSesInfo->status == CifsNeedReconnect) {
			cFYI(1, ("Session needs reconnect"));
			rc = cifs_setup_session(xid, pSesInfo,
						cifs_sb->local_nls);
		}
2003
		up(&pSesInfo->sesSem);
L
Linus Torvalds 已提交
2004
	} else if (!rc) {
2005
		cFYI(1, ("Existing smb sess not found"));
L
Linus Torvalds 已提交
2006 2007 2008 2009 2010 2011 2012 2013 2014
		pSesInfo = sesInfoAlloc();
		if (pSesInfo == NULL)
			rc = -ENOMEM;
		else {
			pSesInfo->server = srvTcp;
			sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
				NIPQUAD(sin_server.sin_addr.s_addr));
		}

2015 2016
		if (!rc) {
			/* volume_info.password freed at unmount */
2017
			if (volume_info.password) {
L
Linus Torvalds 已提交
2018
				pSesInfo->password = volume_info.password;
2019 2020 2021
				/* set to NULL to prevent freeing on exit */
				volume_info.password = NULL;
			}
L
Linus Torvalds 已提交
2022 2023
			if (volume_info.username)
				strncpy(pSesInfo->userName,
2024 2025
					volume_info.username,
					MAX_USERNAME_SIZE);
2026 2027
			if (volume_info.domainname) {
				int len = strlen(volume_info.domainname);
2028
				pSesInfo->domainName =
2029
					kmalloc(len + 1, GFP_KERNEL);
2030
				if (pSesInfo->domainName)
2031 2032 2033
					strcpy(pSesInfo->domainName,
						volume_info.domainname);
			}
L
Linus Torvalds 已提交
2034
			pSesInfo->linux_uid = volume_info.linux_uid;
2035
			pSesInfo->overrideSecFlg = volume_info.secFlg;
L
Linus Torvalds 已提交
2036
			down(&pSesInfo->sesSem);
2037
			/* BB FIXME need to pass vol->secFlgs BB */
2038 2039
			rc = cifs_setup_session(xid, pSesInfo,
						cifs_sb->local_nls);
L
Linus Torvalds 已提交
2040
			up(&pSesInfo->sesSem);
2041
			if (!rc)
L
Linus Torvalds 已提交
2042
				atomic_inc(&srvTcp->socketUseCount);
2043
		}
L
Linus Torvalds 已提交
2044
	}
2045

L
Linus Torvalds 已提交
2046 2047
	/* search for existing tcon to this server share */
	if (!rc) {
2048
		if (volume_info.rsize > CIFSMaxBufSize) {
2049
			cERROR(1, ("rsize %d too large, using MaxBufSize",
2050 2051
				volume_info.rsize));
			cifs_sb->rsize = CIFSMaxBufSize;
2052 2053
		} else if ((volume_info.rsize) &&
				(volume_info.rsize <= CIFSMaxBufSize))
L
Linus Torvalds 已提交
2054
			cifs_sb->rsize = volume_info.rsize;
2055 2056 2057
		else /* default */
			cifs_sb->rsize = CIFSMaxBufSize;

2058
		if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2059
			cERROR(1, ("wsize %d too large, using 4096 instead",
2060 2061
				  volume_info.wsize));
			cifs_sb->wsize = 4096;
2062
		} else if (volume_info.wsize)
L
Linus Torvalds 已提交
2063 2064
			cifs_sb->wsize = volume_info.wsize;
		else
2065
			cifs_sb->wsize =
S
Steve French 已提交
2066 2067
				min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
					127*1024);
2068
			/* old default of CIFSMaxBufSize was too small now
2069
			   that SMB Write2 can send multiple pages in kvec.
2070 2071 2072 2073 2074
			   RFC1001 does not describe what happens when frame
			   bigger than 128K is sent so use that as max in
			   conjunction with 52K kvec constraint on arch with 4K
			   page size  */

2075
		if (cifs_sb->rsize < 2048) {
2076
			cifs_sb->rsize = 2048;
2077
			/* Windows ME may prefer this */
S
Steve French 已提交
2078
			cFYI(1, ("readsize set to minimum: 2048"));
L
Linus Torvalds 已提交
2079
		}
2080 2081
		/* calculate prepath */
		cifs_sb->prepath = volume_info.prepath;
2082
		if (cifs_sb->prepath) {
2083
			cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2084 2085 2086 2087 2088
			/* we can not convert the / to \ in the path
			separators in the prefixpath yet because we do not
			know (until reset_cifs_unix_caps is called later)
			whether POSIX PATH CAP is available. We normalize
			the / to \ after reset_cifs_unix_caps is called */
2089
			volume_info.prepath = NULL;
2090
		} else
2091
			cifs_sb->prepathlen = 0;
L
Linus Torvalds 已提交
2092 2093 2094 2095
		cifs_sb->mnt_uid = volume_info.linux_uid;
		cifs_sb->mnt_gid = volume_info.linux_gid;
		cifs_sb->mnt_file_mode = volume_info.file_mode;
		cifs_sb->mnt_dir_mode = volume_info.dir_mode;
S
Steve French 已提交
2096 2097
		cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
			cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
L
Linus Torvalds 已提交
2098

2099
		if (volume_info.noperm)
L
Linus Torvalds 已提交
2100
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2101
		if (volume_info.setuids)
L
Linus Torvalds 已提交
2102
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2103
		if (volume_info.server_ino)
L
Linus Torvalds 已提交
2104
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2105
		if (volume_info.remap)
2106
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2107
		if (volume_info.no_xattr)
L
Linus Torvalds 已提交
2108
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2109
		if (volume_info.sfu_emul)
2110
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2111
		if (volume_info.nobrl)
2112
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2113
		if (volume_info.cifs_acl)
2114
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2115 2116 2117 2118 2119
		if (volume_info.override_uid)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
		if (volume_info.override_gid)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
		if (volume_info.direct_io) {
S
Steve French 已提交
2120
			cFYI(1, ("mounting share using direct i/o"));
L
Linus Torvalds 已提交
2121 2122 2123 2124 2125 2126 2127
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
		}

		tcon =
		    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
			     volume_info.username);
		if (tcon) {
2128
			cFYI(1, ("Found match on UNC path"));
L
Linus Torvalds 已提交
2129 2130
			/* we can have only one retry value for a connection
			   to a share so for resources mounted more than once
2131
			   to the same server share the last value passed in
L
Linus Torvalds 已提交
2132 2133
			   for the retry flag is used */
			tcon->retry = volume_info.retry;
2134
			tcon->nocase = volume_info.nocase;
L
Linus Torvalds 已提交
2135 2136 2137 2138 2139
		} else {
			tcon = tconInfoAlloc();
			if (tcon == NULL)
				rc = -ENOMEM;
			else {
2140
				/* check for null share name ie connecting to
2141
				 * dfs root */
L
Linus Torvalds 已提交
2142

2143
				/* BB check if this works for exactly length
2144
				 * three strings */
L
Linus Torvalds 已提交
2145 2146 2147
				if ((strchr(volume_info.UNC + 3, '\\') == NULL)
				    && (strchr(volume_info.UNC + 3, '/') ==
					NULL)) {
2148
					rc = connect_to_dfs_path(xid, pSesInfo,
2149
						"", cifs_sb->local_nls,
2150
						cifs_sb->mnt_cifs_flags &
2151
						  CIFS_MOUNT_MAP_SPECIAL_CHR);
2152 2153
					rc = -ENODEV;
					goto out;
L
Linus Torvalds 已提交
2154
				} else {
2155 2156 2157
					/* BB Do we need to wrap sesSem around
					 * this TCon call and Unix SetFS as
					 * we do on SessSetup and reconnect? */
2158
					rc = CIFSTCon(xid, pSesInfo,
L
Linus Torvalds 已提交
2159 2160 2161 2162 2163 2164 2165
						volume_info.UNC,
						tcon, cifs_sb->local_nls);
					cFYI(1, ("CIFS Tcon rc = %d", rc));
				}
				if (!rc) {
					atomic_inc(&pSesInfo->inUse);
					tcon->retry = volume_info.retry;
2166
					tcon->nocase = volume_info.nocase;
L
Linus Torvalds 已提交
2167 2168 2169 2170
				}
			}
		}
	}
2171
	if (pSesInfo) {
L
Linus Torvalds 已提交
2172 2173 2174 2175 2176 2177
		if (pSesInfo->capabilities & CAP_LARGE_FILES) {
			sb->s_maxbytes = (u64) 1 << 63;
		} else
			sb->s_maxbytes = (u64) 1 << 31;	/* 2 GB */
	}

2178
	/* BB FIXME fix time_gran to be larger for LANMAN sessions */
L
Linus Torvalds 已提交
2179 2180 2181 2182 2183 2184
	sb->s_time_gran = 100;

/* on error free sesinfo and tcon struct if needed */
	if (rc) {
		/* if session setup failed, use count is zero but
		we still need to free cifsd thread */
2185
		if (atomic_read(&srvTcp->socketUseCount) == 0) {
L
Linus Torvalds 已提交
2186 2187 2188
			spin_lock(&GlobalMid_Lock);
			srvTcp->tcpStatus = CifsExiting;
			spin_unlock(&GlobalMid_Lock);
2189
			if (srvTcp->tsk) {
2190 2191 2192 2193 2194
				struct task_struct *tsk;
				/* If we could verify that kthread_stop would
				   always wake up processes blocked in
				   tcp in recv_mesg then we could remove the
				   send_sig call */
2195
				force_sig(SIGKILL, srvTcp->tsk);
2196
				tsk = srvTcp->tsk;
S
Steve French 已提交
2197
				if (tsk)
S
Steve French 已提交
2198
					kthread_stop(tsk);
2199
			}
L
Linus Torvalds 已提交
2200 2201 2202 2203 2204 2205
		}
		 /* If find_unc succeeded then rc == 0 so we can not end */
		if (tcon)  /* up accidently freeing someone elses tcon struct */
			tconInfoFree(tcon);
		if (existingCifsSes == NULL) {
			if (pSesInfo) {
2206
				if ((pSesInfo->server) &&
L
Linus Torvalds 已提交
2207 2208 2209 2210
				    (pSesInfo->status == CifsGood)) {
					int temp_rc;
					temp_rc = CIFSSMBLogoff(xid, pSesInfo);
					/* if the socketUseCount is now zero */
2211
					if ((temp_rc == -ESHUTDOWN) &&
2212
					    (pSesInfo->server) &&
2213
					    (pSesInfo->server->tsk)) {
2214
						struct task_struct *tsk;
2215 2216
						force_sig(SIGKILL,
							pSesInfo->server->tsk);
2217
						tsk = pSesInfo->server->tsk;
S
Steve French 已提交
2218
						if (tsk)
2219
							kthread_stop(tsk);
2220
					}
2221
				} else {
L
Linus Torvalds 已提交
2222
					cFYI(1, ("No session or bad tcon"));
2223 2224 2225 2226 2227 2228 2229 2230 2231 2232
					if ((pSesInfo->server) &&
					    (pSesInfo->server->tsk)) {
						struct task_struct *tsk;
						force_sig(SIGKILL,
							pSesInfo->server->tsk);
						tsk = pSesInfo->server->tsk;
						if (tsk)
							kthread_stop(tsk);
					}
				}
L
Linus Torvalds 已提交
2233 2234 2235 2236 2237 2238 2239 2240 2241
				sesInfoFree(pSesInfo);
				/* pSesInfo = NULL; */
			}
		}
	} else {
		atomic_inc(&tcon->useCount);
		cifs_sb->tcon = tcon;
		tcon->ses = pSesInfo;

2242
		/* do not care if following two calls succeed - informational */
2243 2244 2245 2246
		if (!tcon->ipc) {
			CIFSSMBQFSDeviceInfo(xid, tcon);
			CIFSSMBQFSAttributeInfo(xid, tcon);
		}
2247

2248 2249
		/* tell server which Unix caps we support */
		if (tcon->ses->capabilities & CAP_UNIX)
2250 2251
			/* reset of caps checks mount to see if unix extensions
			   disabled for just this mount */
2252
			reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2253 2254 2255
		else
			tcon->unix_ext = 0; /* server does not support them */

2256
		/* convert forward to back slashes in prepath here if needed */
2257 2258 2259
		if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
			convert_delimiter(cifs_sb->prepath,
					  CIFS_DIR_SEP(cifs_sb));
2260

2261
		if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2262
			cifs_sb->rsize = 1024 * 127;
2263 2264
			cFYI(DBG2,
				("no very large read support, rsize now 127K"));
2265
		}
2266 2267 2268 2269
		if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
			cifs_sb->wsize = min(cifs_sb->wsize,
					     (tcon->ses->server->maxBuf -
					      MAX_CIFS_HDR_SIZE));
2270
		if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2271 2272 2273
			cifs_sb->rsize = min(cifs_sb->rsize,
					     (tcon->ses->server->maxBuf -
					      MAX_CIFS_HDR_SIZE));
L
Linus Torvalds 已提交
2274 2275 2276 2277 2278 2279
	}

	/* volume_info.password is freed above when existing session found
	(in which case it is not needed anymore) but when new sesion is created
	the password ptr is put in the new session structure (in which case the
	password will be freed at unmount time) */
2280 2281 2282 2283 2284 2285
out:
	/* zero out password before freeing */
	if (volume_info.password != NULL) {
		memset(volume_info.password, 0, strlen(volume_info.password));
		kfree(volume_info.password);
	}
J
Jesper Juhl 已提交
2286
	kfree(volume_info.UNC);
2287
	kfree(volume_info.prepath);
L
Linus Torvalds 已提交
2288 2289 2290 2291 2292 2293
	FreeXid(xid);
	return rc;
}

static int
CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2294
	      char session_key[CIFS_SESS_KEY_SIZE],
L
Linus Torvalds 已提交
2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310
	      const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *user;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
	__u32 capabilities;
	__u16 count;

2311
	cFYI(1, ("In sesssetup"));
2312
	if (ses == NULL)
L
Linus Torvalds 已提交
2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326
		return -EINVAL;
	user = ses->userName;
	domain = ses->domainName;
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
	pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 13 /* wct */ );

2327
	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2328 2329 2330 2331
	pSMB->req_no_secext.AndXCommand = 0xFF;
	pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

2332 2333
	if (ses->server->secMode &
			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
		CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);

2352
	pSMB->req_no_secext.CaseInsensitivePasswordLength =
2353
		cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2354 2355

	pSMB->req_no_secext.CaseSensitivePasswordLength =
2356
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2357
	bcc_ptr = pByteArea(smb_buffer);
2358 2359 2360 2361
	memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
	bcc_ptr += CIFS_SESS_KEY_SIZE;
	memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
	bcc_ptr += CIFS_SESS_KEY_SIZE;
L
Linus Torvalds 已提交
2362 2363 2364 2365 2366 2367

	if (ses->capabilities & CAP_UNICODE) {
		if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
			*bcc_ptr = 0;
			bcc_ptr++;
		}
2368
		if (user == NULL)
2369
			bytes_returned = 0; /* skip null user */
2370
		else
L
Linus Torvalds 已提交
2371
			bytes_returned =
2372
				cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
L
Linus Torvalds 已提交
2373 2374 2375 2376 2377 2378
					nls_codepage);
		/* convert number of 16 bit words to bytes */
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* trailing null */
		if (domain == NULL)
			bytes_returned =
2379
			    cifs_strtoUCS((__le16 *) bcc_ptr,
L
Linus Torvalds 已提交
2380 2381 2382
					  "CIFS_LINUX_DOM", 32, nls_codepage);
		else
			bytes_returned =
2383
			    cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
L
Linus Torvalds 已提交
2384 2385 2386 2387
					  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
		bytes_returned =
2388
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
2389 2390 2391
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
2392
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
L
Linus Torvalds 已提交
2393 2394 2395 2396
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
		bytes_returned =
2397
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
2398 2399 2400 2401
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
	} else {
2402
		if (user != NULL) {
L
Linus Torvalds 已提交
2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418
		    strncpy(bcc_ptr, user, 200);
		    bcc_ptr += strnlen(user, 200);
		}
		*bcc_ptr = 0;
		bcc_ptr++;
		if (domain == NULL) {
			strcpy(bcc_ptr, "CIFS_LINUX_DOM");
			bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
		} else {
			strncpy(bcc_ptr, domain, 64);
			bcc_ptr += strnlen(domain, 64);
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
2419 2420
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
2421 2422 2423 2424 2425 2426 2427 2428
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
	}
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req_no_secext.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2429
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
2430 2431 2432 2433 2434 2435 2436
	if (rc) {
/* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
	} else if ((smb_buffer_response->WordCount == 3)
		   || (smb_buffer_response->WordCount == 4)) {
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
		if (action & GUEST_LOGIN)
2437 2438 2439
			cFYI(1, (" Guest login")); /* BB mark SesInfo struct? */
		ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
							 (little endian) */
L
Linus Torvalds 已提交
2440
		cFYI(1, ("UID = %d ", ses->Suid));
2441 2442
	/* response can have either 3 or 4 word count - Samba sends 3 */
		bcc_ptr = pByteArea(smb_buffer_response);
L
Linus Torvalds 已提交
2443 2444 2445 2446 2447 2448 2449 2450 2451
		if ((pSMBr->resp.hdr.WordCount == 3)
		    || ((pSMBr->resp.hdr.WordCount == 4)
			&& (blob_len < pSMBr->resp.ByteCount))) {
			if (pSMBr->resp.hdr.WordCount == 4)
				bcc_ptr += blob_len;

			if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
				if ((long) (bcc_ptr) % 2) {
					remaining_words =
2452 2453 2454 2455
					    (BCC(smb_buffer_response) - 1) / 2;
					/* Unicode strings must be word
					   aligned */
					bcc_ptr++;
L
Linus Torvalds 已提交
2456 2457 2458 2459 2460 2461 2462 2463 2464 2465
				} else {
					remaining_words =
						BCC(smb_buffer_response) / 2;
				}
				len =
				    UniStrnlen((wchar_t *) bcc_ptr,
					       remaining_words - 1);
/* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
S
Steve French 已提交
2466
				if (ses->serverOS)
2467
					kfree(ses->serverOS);
2468 2469
				ses->serverOS = kzalloc(2 * (len + 1),
							GFP_KERNEL);
S
Steve French 已提交
2470
				if (ses->serverOS == NULL)
2471
					goto sesssetup_nomem;
L
Linus Torvalds 已提交
2472
				cifs_strfromUCS_le(ses->serverOS,
2473 2474
						   (__le16 *)bcc_ptr,
						   len, nls_codepage);
L
Linus Torvalds 已提交
2475 2476 2477 2478 2479 2480 2481
				bcc_ptr += 2 * (len + 1);
				remaining_words -= len + 1;
				ses->serverOS[2 * len] = 0;
				ses->serverOS[1 + (2 * len)] = 0;
				if (remaining_words > 0) {
					len = UniStrnlen((wchar_t *)bcc_ptr,
							 remaining_words-1);
2482
					kfree(ses->serverNOS);
2483 2484
					ses->serverNOS = kzalloc(2 * (len + 1),
								 GFP_KERNEL);
S
Steve French 已提交
2485
					if (ses->serverNOS == NULL)
2486
						goto sesssetup_nomem;
L
Linus Torvalds 已提交
2487
					cifs_strfromUCS_le(ses->serverNOS,
2488 2489
							   (__le16 *)bcc_ptr,
							   len, nls_codepage);
L
Linus Torvalds 已提交
2490 2491 2492
					bcc_ptr += 2 * (len + 1);
					ses->serverNOS[2 * len] = 0;
					ses->serverNOS[1 + (2 * len)] = 0;
S
Steve French 已提交
2493
					if (strncmp(ses->serverNOS,
2494
						"NT LAN Manager 4", 16) == 0) {
S
Steve French 已提交
2495
						cFYI(1, ("NT4 server"));
L
Linus Torvalds 已提交
2496 2497 2498 2499
						ses->flags |= CIFS_SES_NT4;
					}
					remaining_words -= len + 1;
					if (remaining_words > 0) {
2500
						len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2501 2502
				/* last string is not always null terminated
				   (for e.g. for Windows XP & 2000) */
S
Steve French 已提交
2503
						if (ses->serverDomain)
2504
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2505
						ses->serverDomain =
2506 2507
						    kzalloc(2*(len+1),
							    GFP_KERNEL);
S
Steve French 已提交
2508
						if (ses->serverDomain == NULL)
2509
							goto sesssetup_nomem;
L
Linus Torvalds 已提交
2510
						cifs_strfromUCS_le(ses->serverDomain,
2511 2512
							(__le16 *)bcc_ptr,
							len, nls_codepage);
L
Linus Torvalds 已提交
2513 2514 2515
						bcc_ptr += 2 * (len + 1);
						ses->serverDomain[2*len] = 0;
						ses->serverDomain[1+(2*len)] = 0;
2516 2517
					} else { /* else no more room so create
						  dummy domain string */
S
Steve French 已提交
2518
						if (ses->serverDomain)
2519
							kfree(ses->serverDomain);
2520
						ses->serverDomain =
2521
							kzalloc(2, GFP_KERNEL);
2522
					}
2523 2524 2525
				} else { /* no room so create dummy domain
					    and NOS string */

2526 2527 2528
					/* if these kcallocs fail not much we
					   can do, but better to not fail the
					   sesssetup itself */
2529
					kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2530
					ses->serverDomain =
2531
					    kzalloc(2, GFP_KERNEL);
2532
					kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2533
					ses->serverNOS =
2534
					    kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
2535 2536 2537 2538 2539 2540
				}
			} else {	/* ASCII */
				len = strnlen(bcc_ptr, 1024);
				if (((long) bcc_ptr + len) - (long)
				    pByteArea(smb_buffer_response)
					    <= BCC(smb_buffer_response)) {
2541
					kfree(ses->serverOS);
2542 2543
					ses->serverOS = kzalloc(len + 1,
								GFP_KERNEL);
S
Steve French 已提交
2544
					if (ses->serverOS == NULL)
2545
						goto sesssetup_nomem;
2546
					strncpy(ses->serverOS, bcc_ptr, len);
L
Linus Torvalds 已提交
2547 2548

					bcc_ptr += len;
2549 2550
					/* null terminate the string */
					bcc_ptr[0] = 0;
L
Linus Torvalds 已提交
2551 2552 2553
					bcc_ptr++;

					len = strnlen(bcc_ptr, 1024);
2554
					kfree(ses->serverNOS);
2555 2556
					ses->serverNOS = kzalloc(len + 1,
								 GFP_KERNEL);
S
Steve French 已提交
2557
					if (ses->serverNOS == NULL)
2558
						goto sesssetup_nomem;
L
Linus Torvalds 已提交
2559 2560 2561 2562 2563 2564
					strncpy(ses->serverNOS, bcc_ptr, len);
					bcc_ptr += len;
					bcc_ptr[0] = 0;
					bcc_ptr++;

					len = strnlen(bcc_ptr, 1024);
S
Steve French 已提交
2565
					if (ses->serverDomain)
2566
						kfree(ses->serverDomain);
2567 2568
					ses->serverDomain = kzalloc(len + 1,
								    GFP_KERNEL);
S
Steve French 已提交
2569
					if (ses->serverDomain == NULL)
2570
						goto sesssetup_nomem;
2571 2572
					strncpy(ses->serverDomain, bcc_ptr,
						len);
L
Linus Torvalds 已提交
2573 2574 2575 2576 2577
					bcc_ptr += len;
					bcc_ptr[0] = 0;
					bcc_ptr++;
				} else
					cFYI(1,
2578 2579
					     ("Variable field of length %d "
						"extends beyond end of smb ",
L
Linus Torvalds 已提交
2580 2581 2582 2583
					      len));
			}
		} else {
			cERROR(1,
2584 2585
			       (" Security Blob Length extends beyond "
				"end of SMB"));
L
Linus Torvalds 已提交
2586 2587 2588 2589 2590 2591 2592
		}
	} else {
		cERROR(1,
		       (" Invalid Word count %d: ",
			smb_buffer_response->WordCount));
		rc = -EIO;
	}
2593 2594 2595
sesssetup_nomem:	/* do not return an error on nomem for the info strings,
			   since that could make reconnection harder, and
			   reconnection might be needed to free memory */
2596
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
2597 2598 2599 2600 2601 2602

	return rc;
}

static int
CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2603
			      struct cifsSesInfo *ses, bool *pNTLMv2_flag,
L
Linus Torvalds 已提交
2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615
			      const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
C
Cyrill Gorcunov 已提交
2616
	int SecurityBlobLength = sizeof(NEGOTIATE_MESSAGE);
L
Linus Torvalds 已提交
2617 2618 2619 2620 2621
	PNEGOTIATE_MESSAGE SecurityBlob;
	PCHALLENGE_MESSAGE SecurityBlob2;
	__u32 negotiate_flags, capabilities;
	__u16 count;

2622
	cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
S
Steve French 已提交
2623
	if (ses == NULL)
L
Linus Torvalds 已提交
2624 2625
		return -EINVAL;
	domain = ses->domainName;
2626
	*pNTLMv2_flag = false;
L
Linus Torvalds 已提交
2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
	pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
	pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 12 /* wct */ );
2638 2639

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2640 2641 2642 2643 2644 2645 2646
	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
	pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);

	pSMB->req.AndXCommand = 0xFF;
	pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

S
Steve French 已提交
2647
	if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
	    CAP_EXTENDED_SECURITY;
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req.Capabilities = cpu_to_le32(capabilities);

	bcc_ptr = (char *) &pSMB->req.SecurityBlob;
	SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
	strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
	SecurityBlob->MessageType = NtLmNegotiate;
	negotiate_flags =
	    NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2672 2673
	    NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
	    NTLMSSP_NEGOTIATE_56 |
L
Linus Torvalds 已提交
2674
	    /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
S
Steve French 已提交
2675
	if (sign_CIFS_PDUs)
L
Linus Torvalds 已提交
2676
		negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
S
Steve French 已提交
2677
/*	if (ntlmv2_support)
2678
		negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
L
Linus Torvalds 已提交
2679 2680 2681 2682 2683 2684 2685
	/* setup pointers to domain name and workstation name */
	bcc_ptr += SecurityBlobLength;

	SecurityBlob->WorkstationName.Buffer = 0;
	SecurityBlob->WorkstationName.Length = 0;
	SecurityBlob->WorkstationName.MaximumLength = 0;

2686 2687 2688 2689 2690
	/* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
	along with username on auth request (ie the response to challenge) */
	SecurityBlob->DomainName.Buffer = 0;
	SecurityBlob->DomainName.Length = 0;
	SecurityBlob->DomainName.MaximumLength = 0;
L
Linus Torvalds 已提交
2691 2692 2693 2694 2695 2696 2697
	if (ses->capabilities & CAP_UNICODE) {
		if ((long) bcc_ptr % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}

		bytes_returned =
2698
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
2699 2700 2701
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
2702
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
L
Linus Torvalds 已提交
2703 2704 2705 2706
				  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* null terminate Linux version */
		bytes_returned =
2707
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null terminate network opsys string */
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null domain */
	} else {		/* ASCII */
		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
2719 2720
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
		bcc_ptr++;	/* empty domain field */
		*bcc_ptr = 0;
	}
	SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
	pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2733
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746

	if (smb_buffer_response->Status.CifsError ==
	    cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
		rc = 0;

	if (rc) {
/*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
	} else if ((smb_buffer_response->WordCount == 3)
		   || (smb_buffer_response->WordCount == 4)) {
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);

		if (action & GUEST_LOGIN)
2747 2748
			cFYI(1, (" Guest login"));
	/* Do we want to set anything in SesInfo struct when guest login? */
L
Linus Torvalds 已提交
2749

2750 2751
		bcc_ptr = pByteArea(smb_buffer_response);
	/* response can have either 3 or 4 word count - Samba sends 3 */
L
Linus Torvalds 已提交
2752 2753 2754 2755 2756 2757 2758

		SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
		if (SecurityBlob2->MessageType != NtLmChallenge) {
			cFYI(1,
			     ("Unexpected NTLMSSP message type received %d",
			      SecurityBlob2->MessageType));
		} else if (ses) {
2759
			ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2760
			cFYI(1, ("UID = %d", ses->Suid));
L
Linus Torvalds 已提交
2761 2762 2763 2764 2765 2766 2767
			if ((pSMBr->resp.hdr.WordCount == 3)
			    || ((pSMBr->resp.hdr.WordCount == 4)
				&& (blob_len <
				    pSMBr->resp.ByteCount))) {

				if (pSMBr->resp.hdr.WordCount == 4) {
					bcc_ptr += blob_len;
2768
					cFYI(1, ("Security Blob Length %d",
L
Linus Torvalds 已提交
2769 2770 2771
					      blob_len));
				}

2772
				cFYI(1, ("NTLMSSP Challenge rcvd"));
L
Linus Torvalds 已提交
2773 2774 2775 2776

				memcpy(ses->server->cryptKey,
				       SecurityBlob2->Challenge,
				       CIFS_CRYPTO_KEY_SIZE);
2777
				if (SecurityBlob2->NegotiateFlags &
2778
					cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2779
					*pNTLMv2_flag = true;
L
Linus Torvalds 已提交
2780

2781 2782
				if ((SecurityBlob2->NegotiateFlags &
					cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
L
Linus Torvalds 已提交
2783
					|| (sign_CIFS_PDUs > 1))
2784 2785 2786
						ses->server->secMode |=
							SECMODE_SIGN_REQUIRED;
				if ((SecurityBlob2->NegotiateFlags &
L
Linus Torvalds 已提交
2787
					cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2788
						ses->server->secMode |=
L
Linus Torvalds 已提交
2789 2790 2791 2792 2793 2794 2795
							SECMODE_SIGN_ENABLED;

				if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
					if ((long) (bcc_ptr) % 2) {
						remaining_words =
						    (BCC(smb_buffer_response)
						     - 1) / 2;
2796 2797
					 /* Must word align unicode strings */
						bcc_ptr++;
L
Linus Torvalds 已提交
2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808
					} else {
						remaining_words =
						    BCC
						    (smb_buffer_response) / 2;
					}
					len =
					    UniStrnlen((wchar_t *) bcc_ptr,
						       remaining_words - 1);
/* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
S
Steve French 已提交
2809
					if (ses->serverOS)
2810
						kfree(ses->serverOS);
L
Linus Torvalds 已提交
2811
					ses->serverOS =
2812
					    kzalloc(2 * (len + 1), GFP_KERNEL);
L
Linus Torvalds 已提交
2813
					cifs_strfromUCS_le(ses->serverOS,
2814
							   (__le16 *)
L
Linus Torvalds 已提交
2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825
							   bcc_ptr, len,
							   nls_codepage);
					bcc_ptr += 2 * (len + 1);
					remaining_words -= len + 1;
					ses->serverOS[2 * len] = 0;
					ses->serverOS[1 + (2 * len)] = 0;
					if (remaining_words > 0) {
						len = UniStrnlen((wchar_t *)
								 bcc_ptr,
								 remaining_words
								 - 1);
2826
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2827
						ses->serverNOS =
2828
						    kzalloc(2 * (len + 1),
L
Linus Torvalds 已提交
2829 2830 2831
							    GFP_KERNEL);
						cifs_strfromUCS_le(ses->
								   serverNOS,
2832
								   (__le16 *)
L
Linus Torvalds 已提交
2833 2834 2835 2836 2837 2838 2839 2840 2841
								   bcc_ptr,
								   len,
								   nls_codepage);
						bcc_ptr += 2 * (len + 1);
						ses->serverNOS[2 * len] = 0;
						ses->serverNOS[1 +
							       (2 * len)] = 0;
						remaining_words -= len + 1;
						if (remaining_words > 0) {
2842 2843 2844
							len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
				/* last string not always null terminated
				   (for e.g. for Windows XP & 2000) */
2845
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2846
							ses->serverDomain =
2847
							    kzalloc(2 *
L
Linus Torvalds 已提交
2848 2849 2850 2851
								    (len +
								     1),
								    GFP_KERNEL);
							cifs_strfromUCS_le
2852 2853 2854
							    (ses->serverDomain,
							     (__le16 *)bcc_ptr,
							     len, nls_codepage);
L
Linus Torvalds 已提交
2855 2856
							bcc_ptr +=
							    2 * (len + 1);
2857
							ses->serverDomain[2*len]
L
Linus Torvalds 已提交
2858
							    = 0;
2859 2860
							ses->serverDomain
								[1 + (2 * len)]
L
Linus Torvalds 已提交
2861 2862
							    = 0;
						} /* else no more room so create dummy domain string */
2863
						else {
2864
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2865
							ses->serverDomain =
2866
							    kzalloc(2,
L
Linus Torvalds 已提交
2867
								    GFP_KERNEL);
2868
						}
L
Linus Torvalds 已提交
2869
					} else {	/* no room so create dummy domain and NOS string */
2870
						kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2871
						ses->serverDomain =
2872
						    kzalloc(2, GFP_KERNEL);
2873
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2874
						ses->serverNOS =
2875
						    kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
2876 2877 2878 2879 2880 2881
					}
				} else {	/* ASCII */
					len = strnlen(bcc_ptr, 1024);
					if (((long) bcc_ptr + len) - (long)
					    pByteArea(smb_buffer_response)
					    <= BCC(smb_buffer_response)) {
S
Steve French 已提交
2882
						if (ses->serverOS)
2883
							kfree(ses->serverOS);
L
Linus Torvalds 已提交
2884
						ses->serverOS =
2885
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2886 2887 2888 2889 2890 2891 2892 2893 2894
							    GFP_KERNEL);
						strncpy(ses->serverOS,
							bcc_ptr, len);

						bcc_ptr += len;
						bcc_ptr[0] = 0;	/* null terminate string */
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
2895
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2896
						ses->serverNOS =
2897
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2898 2899 2900 2901 2902 2903 2904
							    GFP_KERNEL);
						strncpy(ses->serverNOS, bcc_ptr, len);
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
2905
						kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2906
						ses->serverDomain =
2907
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2908
							    GFP_KERNEL);
2909 2910
						strncpy(ses->serverDomain,
							bcc_ptr, len);
L
Linus Torvalds 已提交
2911 2912 2913 2914 2915
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;
					} else
						cFYI(1,
2916 2917
						     ("field of length %d "
						    "extends beyond end of smb",
L
Linus Torvalds 已提交
2918 2919 2920
						      len));
				}
			} else {
2921 2922
				cERROR(1, ("Security Blob Length extends beyond"
					   " end of SMB"));
L
Linus Torvalds 已提交
2923 2924 2925 2926 2927 2928
			}
		} else {
			cERROR(1, ("No session structure passed in."));
		}
	} else {
		cERROR(1,
2929
		       (" Invalid Word count %d:",
L
Linus Torvalds 已提交
2930 2931 2932 2933
			smb_buffer_response->WordCount));
		rc = -EIO;
	}

2934
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
2935 2936 2937 2938 2939

	return rc;
}
static int
CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2940
			char *ntlm_session_key, bool ntlmv2_flag,
C
Cyrill Gorcunov 已提交
2941
			const struct nls_table *nls_codepage)
L
Linus Torvalds 已提交
2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *user;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
C
Cyrill Gorcunov 已提交
2954
	int SecurityBlobLength = sizeof(AUTHENTICATE_MESSAGE);
L
Linus Torvalds 已提交
2955 2956 2957 2958 2959
	PAUTHENTICATE_MESSAGE SecurityBlob;
	__u32 negotiate_flags, capabilities;
	__u16 count;

	cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
S
Steve French 已提交
2960
	if (ses == NULL)
L
Linus Torvalds 已提交
2961 2962 2963 2964 2965 2966 2967 2968
		return -EINVAL;
	user = ses->userName;
	domain = ses->domainName;
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
C
Cyrill Gorcunov 已提交
2969 2970
	pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
	pSMBr = (SESSION_SETUP_ANDX *)smb_buffer_response;
L
Linus Torvalds 已提交
2971 2972 2973 2974

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 12 /* wct */ );
2975 2976

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2977 2978 2979 2980 2981 2982 2983 2984
	pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
	pSMB->req.AndXCommand = 0xFF;
	pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

	pSMB->req.hdr.Uid = ses->Suid;

S
Steve French 已提交
2985
	if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2986 2987 2988
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
C
Cyrill Gorcunov 已提交
2989
			CAP_EXTENDED_SECURITY;
L
Linus Torvalds 已提交
2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002 3003
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req.Capabilities = cpu_to_le32(capabilities);

C
Cyrill Gorcunov 已提交
3004 3005
	bcc_ptr = (char *)&pSMB->req.SecurityBlob;
	SecurityBlob = (PAUTHENTICATE_MESSAGE)bcc_ptr;
L
Linus Torvalds 已提交
3006 3007 3008
	strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
	SecurityBlob->MessageType = NtLmAuthenticate;
	bcc_ptr += SecurityBlobLength;
C
Cyrill Gorcunov 已提交
3009 3010 3011
	negotiate_flags = NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
			NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
			0x80000000 | NTLMSSP_NEGOTIATE_128;
S
Steve French 已提交
3012
	if (sign_CIFS_PDUs)
L
Linus Torvalds 已提交
3013
		negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
S
Steve French 已提交
3014
	if (ntlmv2_flag)
L
Linus Torvalds 已提交
3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030
		negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;

/* setup pointers to domain name and workstation name */

	SecurityBlob->WorkstationName.Buffer = 0;
	SecurityBlob->WorkstationName.Length = 0;
	SecurityBlob->WorkstationName.MaximumLength = 0;
	SecurityBlob->SessionKey.Length = 0;
	SecurityBlob->SessionKey.MaximumLength = 0;
	SecurityBlob->SessionKey.Buffer = 0;

	SecurityBlob->LmChallengeResponse.Length = 0;
	SecurityBlob->LmChallengeResponse.MaximumLength = 0;
	SecurityBlob->LmChallengeResponse.Buffer = 0;

	SecurityBlob->NtChallengeResponse.Length =
3031
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
3032
	SecurityBlob->NtChallengeResponse.MaximumLength =
3033 3034
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
	memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
3035 3036
	SecurityBlob->NtChallengeResponse.Buffer =
	    cpu_to_le32(SecurityBlobLength);
3037 3038
	SecurityBlobLength += CIFS_SESS_KEY_SIZE;
	bcc_ptr += CIFS_SESS_KEY_SIZE;
L
Linus Torvalds 已提交
3039 3040 3041 3042 3043 3044 3045

	if (ses->capabilities & CAP_UNICODE) {
		if (domain == NULL) {
			SecurityBlob->DomainName.Buffer = 0;
			SecurityBlob->DomainName.Length = 0;
			SecurityBlob->DomainName.MaximumLength = 0;
		} else {
3046
			__u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
L
Linus Torvalds 已提交
3047
					  nls_codepage);
3048
			ln *= 2;
L
Linus Torvalds 已提交
3049
			SecurityBlob->DomainName.MaximumLength =
3050
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3051 3052
			SecurityBlob->DomainName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3053 3054 3055
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->DomainName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3056 3057 3058 3059 3060 3061
		}
		if (user == NULL) {
			SecurityBlob->UserName.Buffer = 0;
			SecurityBlob->UserName.Length = 0;
			SecurityBlob->UserName.MaximumLength = 0;
		} else {
3062
			__u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
L
Linus Torvalds 已提交
3063
					  nls_codepage);
3064
			ln *= 2;
L
Linus Torvalds 已提交
3065
			SecurityBlob->UserName.MaximumLength =
3066
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3067 3068
			SecurityBlob->UserName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3069 3070 3071
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->UserName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3072 3073
		}

3074 3075
		/* SecurityBlob->WorkstationName.Length =
		 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
L
Linus Torvalds 已提交
3076
		   SecurityBlob->WorkstationName.Length *= 2;
3077 3078 3079 3080
		   SecurityBlob->WorkstationName.MaximumLength =
			cpu_to_le16(SecurityBlob->WorkstationName.Length);
		   SecurityBlob->WorkstationName.Buffer =
				 cpu_to_le32(SecurityBlobLength);
L
Linus Torvalds 已提交
3081 3082
		   bcc_ptr += SecurityBlob->WorkstationName.Length;
		   SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3083 3084
		   SecurityBlob->WorkstationName.Length =
			cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
L
Linus Torvalds 已提交
3085 3086 3087 3088 3089 3090

		if ((long) bcc_ptr % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		bytes_returned =
3091
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
3092 3093 3094
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
3095
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
L
Linus Torvalds 已提交
3096 3097 3098 3099
				  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* null term version string */
		bytes_returned =
3100
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null terminate network opsys string */
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null domain */
	} else {		/* ASCII */
		if (domain == NULL) {
			SecurityBlob->DomainName.Buffer = 0;
			SecurityBlob->DomainName.Length = 0;
			SecurityBlob->DomainName.MaximumLength = 0;
		} else {
3115
			__u16 ln;
L
Linus Torvalds 已提交
3116 3117
			negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
			strncpy(bcc_ptr, domain, 63);
3118
			ln = strnlen(domain, 64);
L
Linus Torvalds 已提交
3119
			SecurityBlob->DomainName.MaximumLength =
3120
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3121 3122
			SecurityBlob->DomainName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3123 3124 3125
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->DomainName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3126 3127 3128 3129 3130 3131
		}
		if (user == NULL) {
			SecurityBlob->UserName.Buffer = 0;
			SecurityBlob->UserName.Length = 0;
			SecurityBlob->UserName.MaximumLength = 0;
		} else {
3132
			__u16 ln;
L
Linus Torvalds 已提交
3133
			strncpy(bcc_ptr, user, 63);
3134 3135
			ln = strnlen(user, 64);
			SecurityBlob->UserName.MaximumLength = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3136
			SecurityBlob->UserName.Buffer =
3137 3138 3139 3140
						cpu_to_le32(SecurityBlobLength);
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->UserName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3141 3142 3143 3144 3145
		}
		/* BB fill in our workstation name if known BB */

		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
3146 3147
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
		bcc_ptr++;	/* null domain */
		*bcc_ptr = 0;
	}
	SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
	pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3160
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
3161
	if (rc) {
C
Cyrill Gorcunov 已提交
3162 3163 3164
/*   rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
	} else if ((smb_buffer_response->WordCount == 3) ||
		   (smb_buffer_response->WordCount == 4)) {
L
Linus Torvalds 已提交
3165
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
C
Cyrill Gorcunov 已提交
3166
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
L
Linus Torvalds 已提交
3167
		if (action & GUEST_LOGIN)
3168 3169 3170 3171 3172 3173
			cFYI(1, (" Guest login")); /* BB Should we set anything
							 in SesInfo struct ? */
/*		if (SecurityBlob2->MessageType != NtLm??) {
			cFYI("Unexpected message type on auth response is %d"));
		} */

L
Linus Torvalds 已提交
3174 3175
		if (ses) {
			cFYI(1,
3176
			     ("Check challenge UID %d vs auth response UID %d",
L
Linus Torvalds 已提交
3177
			      ses->Suid, smb_buffer_response->Uid));
3178 3179 3180 3181
			/* UID left in wire format */
			ses->Suid = smb_buffer_response->Uid;
			bcc_ptr = pByteArea(smb_buffer_response);
		/* response can have either 3 or 4 word count - Samba sends 3 */
L
Linus Torvalds 已提交
3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205
			if ((pSMBr->resp.hdr.WordCount == 3)
			    || ((pSMBr->resp.hdr.WordCount == 4)
				&& (blob_len <
				    pSMBr->resp.ByteCount))) {
				if (pSMBr->resp.hdr.WordCount == 4) {
					bcc_ptr +=
					    blob_len;
					cFYI(1,
					     ("Security Blob Length %d ",
					      blob_len));
				}

				cFYI(1,
				     ("NTLMSSP response to Authenticate "));

				if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
					if ((long) (bcc_ptr) % 2) {
						remaining_words =
						    (BCC(smb_buffer_response)
						     - 1) / 2;
						bcc_ptr++;	/* Unicode strings must be word aligned */
					} else {
						remaining_words = BCC(smb_buffer_response) / 2;
					}
3206 3207
					len = UniStrnlen((wchar_t *) bcc_ptr,
							remaining_words - 1);
L
Linus Torvalds 已提交
3208 3209 3210
/* We look for obvious messed up bcc or strings in response so we do not go off
  the end since (at least) WIN2K and Windows XP have a major bug in not null
  terminating last Unicode string in response  */
S
Steve French 已提交
3211
					if (ses->serverOS)
S
Steve French 已提交
3212
						kfree(ses->serverOS);
L
Linus Torvalds 已提交
3213
					ses->serverOS =
3214
					    kzalloc(2 * (len + 1), GFP_KERNEL);
L
Linus Torvalds 已提交
3215
					cifs_strfromUCS_le(ses->serverOS,
3216
							   (__le16 *)
L
Linus Torvalds 已提交
3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227
							   bcc_ptr, len,
							   nls_codepage);
					bcc_ptr += 2 * (len + 1);
					remaining_words -= len + 1;
					ses->serverOS[2 * len] = 0;
					ses->serverOS[1 + (2 * len)] = 0;
					if (remaining_words > 0) {
						len = UniStrnlen((wchar_t *)
								 bcc_ptr,
								 remaining_words
								 - 1);
3228
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
3229
						ses->serverNOS =
3230
						    kzalloc(2 * (len + 1),
L
Linus Torvalds 已提交
3231 3232 3233
							    GFP_KERNEL);
						cifs_strfromUCS_le(ses->
								   serverNOS,
3234
								   (__le16 *)
L
Linus Torvalds 已提交
3235 3236 3237 3238 3239 3240 3241 3242
								   bcc_ptr,
								   len,
								   nls_codepage);
						bcc_ptr += 2 * (len + 1);
						ses->serverNOS[2 * len] = 0;
						ses->serverNOS[1+(2*len)] = 0;
						remaining_words -= len + 1;
						if (remaining_words > 0) {
3243
							len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
L
Linus Torvalds 已提交
3244
     /* last string not always null terminated (e.g. for Windows XP & 2000) */
S
Steve French 已提交
3245
							if (ses->serverDomain)
3246
								kfree(ses->serverDomain);
L
Linus Torvalds 已提交
3247
							ses->serverDomain =
3248
							    kzalloc(2 *
L
Linus Torvalds 已提交
3249 3250 3251 3252 3253 3254
								    (len +
								     1),
								    GFP_KERNEL);
							cifs_strfromUCS_le
							    (ses->
							     serverDomain,
3255
							     (__le16 *)
L
Linus Torvalds 已提交
3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267 3268 3269 3270 3271
							     bcc_ptr, len,
							     nls_codepage);
							bcc_ptr +=
							    2 * (len + 1);
							ses->
							    serverDomain[2
									 * len]
							    = 0;
							ses->
							    serverDomain[1
									 +
									 (2
									  *
									  len)]
							    = 0;
						} /* else no more room so create dummy domain string */
3272
						else {
S
Steve French 已提交
3273
							if (ses->serverDomain)
3274
								kfree(ses->serverDomain);
3275
							ses->serverDomain = kzalloc(2,GFP_KERNEL);
3276
						}
L
Linus Torvalds 已提交
3277
					} else {  /* no room so create dummy domain and NOS string */
S
Steve French 已提交
3278
						if (ses->serverDomain)
3279
							kfree(ses->serverDomain);
3280
						ses->serverDomain = kzalloc(2, GFP_KERNEL);
3281
						kfree(ses->serverNOS);
3282
						ses->serverNOS = kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
3283 3284 3285
					}
				} else {	/* ASCII */
					len = strnlen(bcc_ptr, 1024);
3286 3287
					if (((long) bcc_ptr + len) -
					   (long) pByteArea(smb_buffer_response)
3288
						<= BCC(smb_buffer_response)) {
S
Steve French 已提交
3289
						if (ses->serverOS)
3290
							kfree(ses->serverOS);
3291
						ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
L
Linus Torvalds 已提交
3292 3293 3294 3295 3296 3297 3298
						strncpy(ses->serverOS,bcc_ptr, len);

						bcc_ptr += len;
						bcc_ptr[0] = 0;	/* null terminate the string */
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
3299
						kfree(ses->serverNOS);
3300 3301
						ses->serverNOS = kzalloc(len+1,
								    GFP_KERNEL);
3302 3303
						strncpy(ses->serverNOS,
							bcc_ptr, len);
L
Linus Torvalds 已提交
3304 3305 3306 3307 3308
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
S
Steve French 已提交
3309
						if (ses->serverDomain)
3310
							kfree(ses->serverDomain);
3311 3312 3313 3314 3315
						ses->serverDomain =
								kzalloc(len+1,
								    GFP_KERNEL);
						strncpy(ses->serverDomain,
							bcc_ptr, len);
L
Linus Torvalds 已提交
3316 3317 3318 3319
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;
					} else
C
Cyrill Gorcunov 已提交
3320
						cFYI(1, ("field of length %d "
3321
						   "extends beyond end of smb ",
L
Linus Torvalds 已提交
3322 3323 3324
						      len));
				}
			} else {
C
Cyrill Gorcunov 已提交
3325
				cERROR(1, ("Security Blob extends beyond end "
3326
					"of SMB"));
L
Linus Torvalds 已提交
3327 3328 3329 3330 3331
			}
		} else {
			cERROR(1, ("No session structure passed in."));
		}
	} else {
C
Cyrill Gorcunov 已提交
3332
		cERROR(1, ("Invalid Word count %d: ",
L
Linus Torvalds 已提交
3333 3334 3335 3336
			smb_buffer_response->WordCount));
		rc = -EIO;
	}

3337
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349 3350 3351 3352 3353 3354 3355 3356 3357 3358 3359 3360 3361 3362 3363 3364 3365 3366

	return rc;
}

int
CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
	 const char *tree, struct cifsTconInfo *tcon,
	 const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	TCONX_REQ *pSMB;
	TCONX_RSP *pSMBr;
	unsigned char *bcc_ptr;
	int rc = 0;
	int length;
	__u16 count;

	if (ses == NULL)
		return -EIO;

	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;

	header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
			NULL /*no tid */ , 4 /*wct */ );
3367 3368

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
3369 3370 3371 3372 3373 3374 3375
	smb_buffer->Uid = ses->Suid;
	pSMB = (TCONX_REQ *) smb_buffer;
	pSMBr = (TCONX_RSP *) smb_buffer_response;

	pSMB->AndXCommand = 0xFF;
	pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
	bcc_ptr = &pSMB->Password[0];
S
Steve French 已提交
3376
	if ((ses->server->secMode) & SECMODE_USER) {
3377
		pSMB->PasswordLength = cpu_to_le16(1);	/* minimum */
3378
		*bcc_ptr = 0; /* password is null byte */
3379
		bcc_ptr++;              /* skip password */
3380
		/* already aligned so no need to do it below */
3381
	} else {
3382
		pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3383 3384 3385
		/* BB FIXME add code to fail this if NTLMv2 or Kerberos
		   specified as required (when that support is added to
		   the vfs in the future) as only NTLM or the much
3386
		   weaker LANMAN (which we do not send by default) is accepted
3387 3388
		   by Samba (not sure whether other servers allow
		   NTLMv2 password here) */
3389
#ifdef CONFIG_CIFS_WEAK_PW_HASH
3390
		if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3391 3392 3393 3394
			(ses->server->secType == LANMAN))
			calc_lanman_hash(ses, bcc_ptr);
		else
#endif /* CIFS_WEAK_PW_HASH */
3395 3396 3397 3398
		SMBNTencrypt(ses->password,
			     ses->server->cryptKey,
			     bcc_ptr);

3399
		bcc_ptr += CIFS_SESS_KEY_SIZE;
S
Steve French 已提交
3400
		if (ses->capabilities & CAP_UNICODE) {
3401 3402 3403 3404
			/* must align unicode strings */
			*bcc_ptr = 0; /* null byte password */
			bcc_ptr++;
		}
3405
	}
L
Linus Torvalds 已提交
3406

3407
	if (ses->server->secMode &
3408
			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
	}
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		length =
3420 3421
		    cifs_strtoUCS((__le16 *) bcc_ptr, tree,
			6 /* max utf8 char length in bytes */ *
3422 3423
			(/* server len*/ + 256 /* share len */), nls_codepage);
		bcc_ptr += 2 * length;	/* convert num 16 bit words to bytes */
L
Linus Torvalds 已提交
3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435
		bcc_ptr += 2;	/* skip trailing null */
	} else {		/* ASCII */
		strcpy(bcc_ptr, tree);
		bcc_ptr += strlen(tree) + 1;
	}
	strcpy(bcc_ptr, "?????");
	bcc_ptr += strlen("?????");
	bcc_ptr += 1;
	count = bcc_ptr - &pSMB->Password[0];
	pSMB->hdr.smb_buf_length += count;
	pSMB->ByteCount = cpu_to_le16(count);

3436 3437
	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
			 CIFS_STD_OP);
L
Linus Torvalds 已提交
3438 3439 3440 3441 3442 3443 3444 3445

	/* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
	/* above now done in SendReceive */
	if ((rc == 0) && (tcon != NULL)) {
		tcon->tidStatus = CifsGood;
		tcon->tid = smb_buffer_response->Tid;
		bcc_ptr = pByteArea(smb_buffer_response);
		length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3446
		/* skip service field (NB: this field is always ASCII) */
3447 3448 3449 3450 3451 3452 3453 3454 3455 3456 3457 3458
		if (length == 3) {
			if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
			    (bcc_ptr[2] == 'C')) {
				cFYI(1, ("IPC connection"));
				tcon->ipc = 1;
			}
		} else if (length == 2) {
			if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
				/* the most common case */
				cFYI(1, ("disk share connection"));
			}
		}
3459
		bcc_ptr += length + 1;
L
Linus Torvalds 已提交
3460 3461 3462 3463 3464 3465
		strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
		if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
			length = UniStrnlen((wchar_t *) bcc_ptr, 512);
			if ((bcc_ptr + (2 * length)) -
			     pByteArea(smb_buffer_response) <=
			    BCC(smb_buffer_response)) {
J
Jesper Juhl 已提交
3466
				kfree(tcon->nativeFileSystem);
L
Linus Torvalds 已提交
3467
				tcon->nativeFileSystem =
3468
				    kzalloc(length + 2, GFP_KERNEL);
3469 3470 3471 3472 3473
				if (tcon->nativeFileSystem)
					cifs_strfromUCS_le(
						tcon->nativeFileSystem,
						(__le16 *) bcc_ptr,
						length, nls_codepage);
L
Linus Torvalds 已提交
3474 3475 3476 3477 3478
				bcc_ptr += 2 * length;
				bcc_ptr[0] = 0;	/* null terminate the string */
				bcc_ptr[1] = 0;
				bcc_ptr += 2;
			}
3479
			/* else do not bother copying these information fields*/
L
Linus Torvalds 已提交
3480 3481 3482 3483 3484
		} else {
			length = strnlen(bcc_ptr, 1024);
			if ((bcc_ptr + length) -
			    pByteArea(smb_buffer_response) <=
			    BCC(smb_buffer_response)) {
J
Jesper Juhl 已提交
3485
				kfree(tcon->nativeFileSystem);
L
Linus Torvalds 已提交
3486
				tcon->nativeFileSystem =
3487
				    kzalloc(length + 1, GFP_KERNEL);
3488 3489 3490
				if (tcon->nativeFileSystem)
					strncpy(tcon->nativeFileSystem, bcc_ptr,
						length);
L
Linus Torvalds 已提交
3491
			}
3492
			/* else do not bother copying these information fields*/
L
Linus Torvalds 已提交
3493
		}
S
Steve French 已提交
3494
		if ((smb_buffer_response->WordCount == 3) ||
S
Steve French 已提交
3495 3496
			 (smb_buffer_response->WordCount == 7))
			/* field is in same location */
3497 3498 3499
			tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
		else
			tcon->Flags = 0;
L
Linus Torvalds 已提交
3500 3501
		cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
	} else if ((rc == 0) && tcon == NULL) {
3502
		/* all we need to save for IPC$ connection */
L
Linus Torvalds 已提交
3503 3504 3505
		ses->ipc_tid = smb_buffer_response->Tid;
	}

3506
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
3507 3508 3509 3510 3511 3512 3513 3514 3515 3516
	return rc;
}

int
cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
{
	int rc = 0;
	int xid;
	struct cifsSesInfo *ses = NULL;
	struct task_struct *cifsd_task;
3517
	char *tmp;
L
Linus Torvalds 已提交
3518 3519 3520 3521 3522 3523 3524 3525 3526 3527

	xid = GetXid();

	if (cifs_sb->tcon) {
		ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
		rc = CIFSSMBTDis(xid, cifs_sb->tcon);
		if (rc == -EBUSY) {
			FreeXid(xid);
			return 0;
		}
3528
		DeleteTconOplockQEntries(cifs_sb->tcon);
L
Linus Torvalds 已提交
3529 3530 3531 3532 3533 3534 3535 3536 3537 3538
		tconInfoFree(cifs_sb->tcon);
		if ((ses) && (ses->server)) {
			/* save off task so we do not refer to ses later */
			cifsd_task = ses->server->tsk;
			cFYI(1, ("About to do SMBLogoff "));
			rc = CIFSSMBLogoff(xid, ses);
			if (rc == -EBUSY) {
				FreeXid(xid);
				return 0;
			} else if (rc == -ESHUTDOWN) {
S
Steve French 已提交
3539
				cFYI(1, ("Waking up socket by sending signal"));
S
Steve French 已提交
3540
				if (cifsd_task) {
3541
					force_sig(SIGKILL, cifsd_task);
3542
					kthread_stop(cifsd_task);
3543
				}
L
Linus Torvalds 已提交
3544 3545 3546 3547 3548 3549
				rc = 0;
			} /* else - we have an smb session
				left on this socket do not kill cifsd */
		} else
			cFYI(1, ("No session or bad tcon"));
	}
3550

L
Linus Torvalds 已提交
3551
	cifs_sb->tcon = NULL;
3552 3553 3554 3555
	tmp = cifs_sb->prepath;
	cifs_sb->prepathlen = 0;
	cifs_sb->prepath = NULL;
	kfree(tmp);
L
Linus Torvalds 已提交
3556 3557 3558 3559
	if (ses)
		sesInfoFree(ses);

	FreeXid(xid);
3560
	return rc;
3561
}
L
Linus Torvalds 已提交
3562 3563

int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3564
					   struct nls_table *nls_info)
L
Linus Torvalds 已提交
3565 3566
{
	int rc = 0;
3567
	char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3568
	bool ntlmv2_flag = false;
3569
	int first_time = 0;
L
Linus Torvalds 已提交
3570 3571

	/* what if server changes its buffer size after dropping the session? */
S
Steve French 已提交
3572
	if (pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
L
Linus Torvalds 已提交
3573
		rc = CIFSSMBNegotiate(xid, pSesInfo);
S
Steve French 已提交
3574
		if (rc == -EAGAIN) /* retry only once on 1st time connection */ {
L
Linus Torvalds 已提交
3575
			rc = CIFSSMBNegotiate(xid, pSesInfo);
3576
			if (rc == -EAGAIN)
L
Linus Torvalds 已提交
3577 3578
				rc = -EHOSTDOWN;
		}
S
Steve French 已提交
3579
		if (rc == 0) {
L
Linus Torvalds 已提交
3580
			spin_lock(&GlobalMid_Lock);
S
Steve French 已提交
3581
			if (pSesInfo->server->tcpStatus != CifsExiting)
L
Linus Torvalds 已提交
3582 3583 3584 3585 3586 3587
				pSesInfo->server->tcpStatus = CifsGood;
			else
				rc = -EHOSTDOWN;
			spin_unlock(&GlobalMid_Lock);

		}
3588
		first_time = 1;
L
Linus Torvalds 已提交
3589 3590
	}
	if (!rc) {
3591
		pSesInfo->flags = 0;
L
Linus Torvalds 已提交
3592
		pSesInfo->capabilities = pSesInfo->server->capabilities;
S
Steve French 已提交
3593
		if (linuxExtEnabled == 0)
L
Linus Torvalds 已提交
3594
			pSesInfo->capabilities &= (~CAP_UNIX);
3595
	/*	pSesInfo->sequence_number = 0;*/
3596 3597
		cFYI(1,
		      ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
L
Linus Torvalds 已提交
3598 3599
			pSesInfo->server->secMode,
			pSesInfo->server->capabilities,
3600
			pSesInfo->server->timeAdj));
S
Steve French 已提交
3601
		if (experimEnabled < 2)
3602 3603
			rc = CIFS_SessSetup(xid, pSesInfo,
					    first_time, nls_info);
3604
		else if (extended_security
3605
				&& (pSesInfo->capabilities
3606
					& CAP_EXTENDED_SECURITY)
L
Linus Torvalds 已提交
3607
				&& (pSesInfo->server->secType == NTLMSSP)) {
3608
			rc = -EOPNOTSUPP;
L
Linus Torvalds 已提交
3609 3610 3611
		} else if (extended_security
			   && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
			   && (pSesInfo->server->secType == RawNTLMSSP)) {
3612
			cFYI(1, ("NTLMSSP sesssetup"));
L
Linus Torvalds 已提交
3613 3614 3615 3616 3617
			rc = CIFSNTLMSSPNegotiateSessSetup(xid,
						pSesInfo,
						&ntlmv2_flag,
						nls_info);
			if (!rc) {
S
Steve French 已提交
3618
				if (ntlmv2_flag) {
3619
					char *v2_response;
S
Steve French 已提交
3620
					cFYI(1, ("more secure NTLM ver2 hash"));
3621
					if (CalcNTLMv2_partial_mac_key(pSesInfo,
L
Linus Torvalds 已提交
3622 3623 3624 3625 3626
						nls_info)) {
						rc = -ENOMEM;
						goto ss_err_exit;
					} else
						v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
S
Steve French 已提交
3627
					if (v2_response) {
3628 3629
						CalcNTLMv2_response(pSesInfo,
								   v2_response);
S
Steve French 已提交
3630
				/*		if (first_time)
3631 3632 3633
						  cifs_calculate_ntlmv2_mac_key(
						   pSesInfo->server->mac_signing_key,
						   response, ntlm_session_key,*/
L
Linus Torvalds 已提交
3634 3635 3636 3637 3638 3639 3640 3641 3642 3643 3644 3645
						kfree(v2_response);
					/* BB Put dummy sig in SessSetup PDU? */
					} else {
						rc = -ENOMEM;
						goto ss_err_exit;
					}

				} else {
					SMBNTencrypt(pSesInfo->password,
						pSesInfo->server->cryptKey,
						ntlm_session_key);

S
Steve French 已提交
3646
					if (first_time)
3647
						cifs_calculate_mac_key(
3648
							&pSesInfo->server->mac_signing_key,
3649 3650
							ntlm_session_key,
							pSesInfo->password);
L
Linus Torvalds 已提交
3651 3652 3653 3654 3655 3656 3657 3658 3659 3660 3661 3662 3663 3664 3665
				}
			/* for better security the weaker lanman hash not sent
			   in AuthSessSetup so we no longer calculate it */

				rc = CIFSNTLMSSPAuthSessSetup(xid,
					pSesInfo,
					ntlm_session_key,
					ntlmv2_flag,
					nls_info);
			}
		} else { /* old style NTLM 0.12 session setup */
			SMBNTencrypt(pSesInfo->password,
				pSesInfo->server->cryptKey,
				ntlm_session_key);

S
Steve French 已提交
3666
			if (first_time)
3667
				cifs_calculate_mac_key(
3668
					&pSesInfo->server->mac_signing_key,
3669 3670
					ntlm_session_key, pSesInfo->password);

L
Linus Torvalds 已提交
3671 3672 3673 3674
			rc = CIFSSessSetup(xid, pSesInfo,
				ntlm_session_key, nls_info);
		}
		if (rc) {
S
Steve French 已提交
3675
			cERROR(1, ("Send error in SessSetup = %d", rc));
L
Linus Torvalds 已提交
3676
		} else {
S
Steve French 已提交
3677
			cFYI(1, ("CIFS Session Established successfully"));
L
Linus Torvalds 已提交
3678 3679 3680 3681 3682 3683 3684
			pSesInfo->status = CifsGood;
		}
	}
ss_err_exit:
	return rc;
}