connect.c 108.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 *   fs/cifs/connect.c
 *
S
Steve French 已提交
4
 *   Copyright (C) International Business Machines  Corp., 2002,2008
L
Linus Torvalds 已提交
5 6 7 8 9 10 11 12 13 14 15 16 17 18
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   This library is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published
 *   by the Free Software Foundation; either version 2.1 of the License, or
 *   (at your option) any later version.
 *
 *   This library is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
 *   along with this library; if not, write to the Free Software
S
Steve French 已提交
19
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
L
Linus Torvalds 已提交
20 21 22 23 24 25 26 27 28 29 30
 */
#include <linux/fs.h>
#include <linux/net.h>
#include <linux/string.h>
#include <linux/list.h>
#include <linux/wait.h>
#include <linux/ipv6.h>
#include <linux/pagemap.h>
#include <linux/ctype.h>
#include <linux/utsname.h>
#include <linux/mempool.h>
31
#include <linux/delay.h>
32
#include <linux/completion.h>
33
#include <linux/kthread.h>
34
#include <linux/pagevec.h>
35
#include <linux/freezer.h>
L
Linus Torvalds 已提交
36 37 38 39 40 41 42 43 44 45 46
#include <asm/uaccess.h>
#include <asm/processor.h>
#include "cifspdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "cifs_unicode.h"
#include "cifs_debug.h"
#include "cifs_fs_sb.h"
#include "ntlmssp.h"
#include "nterr.h"
#include "rfc1002pdu.h"
47
#include "cn_cifs.h"
L
Linus Torvalds 已提交
48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

#define CIFS_PORT 445
#define RFC1001_PORT 139

extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
			 unsigned char *p24);

extern mempool_t *cifs_req_poolp;

struct smb_vol {
	char *username;
	char *password;
	char *domainname;
	char *UNC;
	char *UNCip;
	char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
	char *iocharset;  /* local code page for mapping to and from Unicode */
	char source_rfc1001_name[16]; /* netbios name of client */
66
	char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
L
Linus Torvalds 已提交
67 68 69 70
	uid_t linux_uid;
	gid_t linux_gid;
	mode_t file_mode;
	mode_t dir_mode;
71
	unsigned secFlg;
72 73 74 75 76 77
	bool rw:1;
	bool retry:1;
	bool intr:1;
	bool setuids:1;
	bool override_uid:1;
	bool override_gid:1;
78
	bool dynperm:1;
79 80 81 82 83 84 85 86 87 88 89
	bool noperm:1;
	bool no_psx_acl:1; /* set if posix acl support should be disabled */
	bool cifs_acl:1;
	bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
	bool server_ino:1; /* use inode numbers from server ie UniqueId */
	bool direct_io:1;
	bool remap:1;     /* set to remap seven reserved chars in filenames */
	bool posix_paths:1;   /* unset to not ask for posix pathnames. */
	bool no_linux_ext:1;
	bool sfu_emul:1;
	bool nullauth:1; /* attempt to authenticate with null user */
90 91
	unsigned nocase;     /* request case insensitive filenames */
	unsigned nobrl;      /* disable sending byte range locks to srv */
L
Linus Torvalds 已提交
92 93 94 95
	unsigned int rsize;
	unsigned int wsize;
	unsigned int sockopt;
	unsigned short int port;
S
Steve French 已提交
96
	char *prepath;
L
Linus Torvalds 已提交
97 98
};

S
Steve French 已提交
99
static int ipv4_connect(struct sockaddr_in *psin_server,
L
Linus Torvalds 已提交
100
			struct socket **csocket,
S
Steve French 已提交
101 102 103
			char *netb_name,
			char *server_netb_name);
static int ipv6_connect(struct sockaddr_in6 *psin_server,
L
Linus Torvalds 已提交
104 105 106
			struct socket **csocket);


S
Steve French 已提交
107
	/*
L
Linus Torvalds 已提交
108
	 * cifs tcp session reconnection
S
Steve French 已提交
109
	 *
L
Linus Torvalds 已提交
110 111 112 113 114 115
	 * mark tcp session as reconnecting so temporarily locked
	 * mark all smb sessions as reconnecting for tcp session
	 * reconnect tcp session
	 * wake up waiters on reconnection? - (not needed currently)
	 */

116
static int
L
Linus Torvalds 已提交
117 118 119 120 121 122
cifs_reconnect(struct TCP_Server_Info *server)
{
	int rc = 0;
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	struct cifsTconInfo *tcon;
S
Steve French 已提交
123
	struct mid_q_entry *mid_entry;
124

L
Linus Torvalds 已提交
125
	spin_lock(&GlobalMid_Lock);
126
	if (kthread_should_stop()) {
S
Steve French 已提交
127
		/* the demux thread will exit normally
L
Linus Torvalds 已提交
128 129 130 131 132 133 134 135
		next time through the loop */
		spin_unlock(&GlobalMid_Lock);
		return rc;
	} else
		server->tcpStatus = CifsNeedReconnect;
	spin_unlock(&GlobalMid_Lock);
	server->maxBuf = 0;

136
	cFYI(1, ("Reconnecting tcp session"));
L
Linus Torvalds 已提交
137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152

	/* before reconnecting the tcp session, mark the smb session (uid)
		and the tid bad so they are not used until reconnected */
	read_lock(&GlobalSMBSeslock);
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
		if (ses->server) {
			if (ses->server == server) {
				ses->status = CifsNeedReconnect;
				ses->ipc_tid = 0;
			}
		}
		/* else tcp and smb sessions need reconnection */
	}
	list_for_each(tmp, &GlobalTreeConnectionList) {
		tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
153
		if ((tcon) && (tcon->ses) && (tcon->ses->server == server))
L
Linus Torvalds 已提交
154 155 156 157
			tcon->tidStatus = CifsNeedReconnect;
	}
	read_unlock(&GlobalSMBSeslock);
	/* do not want to be sending data on a socket we are freeing */
S
Steve French 已提交
158 159
	down(&server->tcpSem);
	if (server->ssocket) {
S
Steve French 已提交
160
		cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
L
Linus Torvalds 已提交
161
			server->ssocket->flags));
162
		kernel_sock_shutdown(server->ssocket, SHUT_WR);
S
Steve French 已提交
163
		cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
S
Steve French 已提交
164
			server->ssocket->state,
L
Linus Torvalds 已提交
165 166 167 168 169 170 171 172 173 174
			server->ssocket->flags));
		sock_release(server->ssocket);
		server->ssocket = NULL;
	}

	spin_lock(&GlobalMid_Lock);
	list_for_each(tmp, &server->pending_mid_q) {
		mid_entry = list_entry(tmp, struct
					mid_q_entry,
					qhead);
S
Steve French 已提交
175 176
		if (mid_entry) {
			if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
177 178 179 180
				/* Mark other intransit requests as needing
				   retry so we do not immediately mark the
				   session bad again (ie after we reconnect
				   below) as they timeout too */
L
Linus Torvalds 已提交
181 182 183 184 185
				mid_entry->midState = MID_RETRY_NEEDED;
			}
		}
	}
	spin_unlock(&GlobalMid_Lock);
S
Steve French 已提交
186
	up(&server->tcpSem);
L
Linus Torvalds 已提交
187

188
	while ((!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
189
		try_to_freeze();
S
Steve French 已提交
190 191 192
		if (server->protocolType == IPV6) {
			rc = ipv6_connect(&server->addr.sockAddr6,
					  &server->ssocket);
L
Linus Torvalds 已提交
193
		} else {
S
Steve French 已提交
194
			rc = ipv4_connect(&server->addr.sockAddr,
L
Linus Torvalds 已提交
195
					&server->ssocket,
196 197
					server->workstation_RFC1001_name,
					server->server_RFC1001_name);
L
Linus Torvalds 已提交
198
		}
S
Steve French 已提交
199 200
		if (rc) {
			cFYI(1, ("reconnect error %d", rc));
201
			msleep(3000);
L
Linus Torvalds 已提交
202 203 204
		} else {
			atomic_inc(&tcpSesReconnectCount);
			spin_lock(&GlobalMid_Lock);
205
			if (!kthread_should_stop())
L
Linus Torvalds 已提交
206
				server->tcpStatus = CifsGood;
207
			server->sequence_number = 0;
S
Steve French 已提交
208
			spin_unlock(&GlobalMid_Lock);
L
Linus Torvalds 已提交
209 210 211 212 213 214 215
	/*		atomic_set(&server->inFlight,0);*/
			wake_up(&server->response_q);
		}
	}
	return rc;
}

S
Steve French 已提交
216
/*
217 218 219 220 221 222
	return codes:
		0 	not a transact2, or all data present
		>0 	transact2 with that much data missing
		-EINVAL = invalid transact2

 */
S
Steve French 已提交
223
static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
224
{
S
Steve French 已提交
225 226
	struct smb_t2_rsp *pSMBt;
	int total_data_size;
227 228 229
	int data_in_this_rsp;
	int remaining;

S
Steve French 已提交
230
	if (pSMB->Command != SMB_COM_TRANSACTION2)
231 232
		return 0;

S
Steve French 已提交
233 234 235
	/* check for plausible wct, bcc and t2 data and parm sizes */
	/* check for parm and data offset going beyond end of smb */
	if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
S
Steve French 已提交
236
		cFYI(1, ("invalid transact2 word count"));
237 238 239 240 241 242 243 244 245 246
		return -EINVAL;
	}

	pSMBt = (struct smb_t2_rsp *)pSMB;

	total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
	data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);

	remaining = total_data_size - data_in_this_rsp;

S
Steve French 已提交
247
	if (remaining == 0)
248
		return 0;
S
Steve French 已提交
249
	else if (remaining < 0) {
S
Steve French 已提交
250
		cFYI(1, ("total data %d smaller than data in frame %d",
251 252 253
			total_data_size, data_in_this_rsp));
		return -EINVAL;
	} else {
S
Steve French 已提交
254
		cFYI(1, ("missing %d bytes from transact2, check next response",
255
			remaining));
S
Steve French 已提交
256 257 258 259
		if (total_data_size > maxBufSize) {
			cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
				total_data_size, maxBufSize));
			return -EINVAL;
260 261 262 263 264
		}
		return remaining;
	}
}

S
Steve French 已提交
265
static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
266 267 268 269 270 271 272
{
	struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
	struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
	int total_data_size;
	int total_in_buf;
	int remaining;
	int total_in_buf2;
S
Steve French 已提交
273 274
	char *data_area_of_target;
	char *data_area_of_buf2;
275 276 277 278
	__u16 byte_count;

	total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);

S
Steve French 已提交
279
	if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
280
		cFYI(1, ("total data size of primary and secondary t2 differ"));
281 282 283 284 285
	}

	total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);

	remaining = total_data_size - total_in_buf;
286

S
Steve French 已提交
287
	if (remaining < 0)
288 289
		return -EINVAL;

S
Steve French 已提交
290
	if (remaining == 0) /* nothing to do, ignore */
291
		return 0;
292

293
	total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
S
Steve French 已提交
294
	if (remaining < total_in_buf2) {
S
Steve French 已提交
295
		cFYI(1, ("transact2 2nd response contains too much data"));
296 297 298
	}

	/* find end of first SMB data area */
S
Steve French 已提交
299
	data_area_of_target = (char *)&pSMBt->hdr.Protocol +
300 301 302 303
				le16_to_cpu(pSMBt->t2_rsp.DataOffset);
	/* validate target area */

	data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
S
Steve French 已提交
304
					le16_to_cpu(pSMB2->t2_rsp.DataOffset);
305 306 307 308

	data_area_of_target += total_in_buf;

	/* copy second buffer into end of first buffer */
S
Steve French 已提交
309
	memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
310 311 312 313 314 315
	total_in_buf += total_in_buf2;
	pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
	byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
	byte_count += total_in_buf2;
	BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);

316
	byte_count = pTargetSMB->smb_buf_length;
317 318 319
	byte_count += total_in_buf2;

	/* BB also add check that we are not beyond maximum buffer size */
320

321
	pTargetSMB->smb_buf_length = byte_count;
322

S
Steve French 已提交
323
	if (remaining == total_in_buf2) {
S
Steve French 已提交
324
		cFYI(1, ("found the last secondary response"));
325 326 327 328 329 330
		return 0; /* we are done */
	} else /* more responses to go */
		return 1;

}

L
Linus Torvalds 已提交
331 332 333 334 335 336
static int
cifs_demultiplex_thread(struct TCP_Server_Info *server)
{
	int length;
	unsigned int pdu_length, total_read;
	struct smb_hdr *smb_buffer = NULL;
337 338
	struct smb_hdr *bigbuf = NULL;
	struct smb_hdr *smallbuf = NULL;
L
Linus Torvalds 已提交
339 340 341 342 343 344 345
	struct msghdr smb_msg;
	struct kvec iov;
	struct socket *csocket = server->ssocket;
	struct list_head *tmp;
	struct cifsSesInfo *ses;
	struct task_struct *task_to_wake = NULL;
	struct mid_q_entry *mid_entry;
346
	char temp;
347 348
	bool isLargeBuf = false;
	bool isMultiRsp;
349
	int reconnect;
L
Linus Torvalds 已提交
350 351

	current->flags |= PF_MEMALLOC;
352
	cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current)));
S
Steve French 已提交
353
	write_lock(&GlobalSMBSeslock);
L
Linus Torvalds 已提交
354 355 356
	atomic_inc(&tcpSesAllocCount);
	length = tcpSesAllocCount.counter;
	write_unlock(&GlobalSMBSeslock);
357 358 359
	if (length  > 1)
		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
				GFP_KERNEL);
L
Linus Torvalds 已提交
360

361
	set_freezable();
362
	while (!kthread_should_stop()) {
363 364
		if (try_to_freeze())
			continue;
365 366
		if (bigbuf == NULL) {
			bigbuf = cifs_buf_get();
367 368
			if (!bigbuf) {
				cERROR(1, ("No memory for large SMB response"));
369 370 371 372
				msleep(3000);
				/* retry will check if exiting */
				continue;
			}
373 374
		} else if (isLargeBuf) {
			/* we are reusing a dirty large buf, clear its start */
375
			memset(bigbuf, 0, sizeof(struct smb_hdr));
L
Linus Torvalds 已提交
376
		}
377 378 379

		if (smallbuf == NULL) {
			smallbuf = cifs_small_buf_get();
380 381
			if (!smallbuf) {
				cERROR(1, ("No memory for SMB response"));
382 383 384 385 386 387
				msleep(1000);
				/* retry will check if exiting */
				continue;
			}
			/* beginning of smb buffer is cleared in our buf_get */
		} else /* if existing small buf clear beginning */
388
			memset(smallbuf, 0, sizeof(struct smb_hdr));
389

390 391
		isLargeBuf = false;
		isMultiRsp = false;
392
		smb_buffer = smallbuf;
L
Linus Torvalds 已提交
393 394 395 396
		iov.iov_base = smb_buffer;
		iov.iov_len = 4;
		smb_msg.msg_control = NULL;
		smb_msg.msg_controllen = 0;
397 398
		pdu_length = 4; /* enough to get RFC1001 header */
incomplete_rcv:
L
Linus Torvalds 已提交
399 400
		length =
		    kernel_recvmsg(csocket, &smb_msg,
401
				&iov, 1, pdu_length, 0 /* BB other flags? */);
L
Linus Torvalds 已提交
402

403
		if (kthread_should_stop()) {
L
Linus Torvalds 已提交
404 405
			break;
		} else if (server->tcpStatus == CifsNeedReconnect) {
406
			cFYI(1, ("Reconnect after server stopped responding"));
L
Linus Torvalds 已提交
407
			cifs_reconnect(server);
408
			cFYI(1, ("call to reconnect done"));
L
Linus Torvalds 已提交
409 410 411
			csocket = server->ssocket;
			continue;
		} else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
412
			msleep(1); /* minimum sleep to prevent looping
L
Linus Torvalds 已提交
413 414
				allowing socket to clear and app threads to set
				tcpStatus CifsNeedReconnect if server hung */
415 416 417 418
			if (pdu_length < 4)
				goto incomplete_rcv;
			else
				continue;
L
Linus Torvalds 已提交
419
		} else if (length <= 0) {
420 421
			if (server->tcpStatus == CifsNew) {
				cFYI(1, ("tcp session abend after SMBnegprot"));
422 423 424 425
				/* some servers kill the TCP session rather than
				   returning an SMB negprot error, in which
				   case reconnecting here is not going to help,
				   and so simply return error to mount */
L
Linus Torvalds 已提交
426 427
				break;
			}
428
			if (!try_to_freeze() && (length == -EINTR)) {
S
Steve French 已提交
429
				cFYI(1, ("cifsd thread killed"));
L
Linus Torvalds 已提交
430 431
				break;
			}
S
Steve French 已提交
432
			cFYI(1, ("Reconnect after unexpected peek error %d",
433
				length));
L
Linus Torvalds 已提交
434 435 436 437
			cifs_reconnect(server);
			csocket = server->ssocket;
			wake_up(&server->response_q);
			continue;
438 439 440
		} else if (length < pdu_length) {
			cFYI(1, ("requested %d bytes but only got %d bytes",
				  pdu_length, length));
441 442 443
			pdu_length -= length;
			msleep(1);
			goto incomplete_rcv;
444
		}
L
Linus Torvalds 已提交
445

446 447
		/* The right amount was read from socket - 4 bytes */
		/* so we can now interpret the length field */
448

449 450 451 452
		/* the first byte big endian of the length field,
		is actually not part of the length but the type
		with the most common, zero, as regular data */
		temp = *((char *) smb_buffer);
453

S
Steve French 已提交
454
		/* Note that FC 1001 length is big endian on the wire,
455 456
		but we convert it here so it is always manipulated
		as host byte order */
457
		pdu_length = ntohl(smb_buffer->smb_buf_length);
458 459
		smb_buffer->smb_buf_length = pdu_length;

S
Steve French 已提交
460
		cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
461

462
		if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
S
Steve French 已提交
463
			continue;
464
		} else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
S
Steve French 已提交
465
			cFYI(1, ("Good RFC 1002 session rsp"));
466
			continue;
467
		} else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
S
Steve French 已提交
468
			/* we get this from Windows 98 instead of
469
			   an error on SMB negprot response */
S
Steve French 已提交
470
			cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
471
				pdu_length));
S
Steve French 已提交
472 473
			if (server->tcpStatus == CifsNew) {
				/* if nack on negprot (rather than
474 475 476 477 478 479 480 481 482
				ret of smb negprot error) reconnecting
				not going to help, ret error to mount */
				break;
			} else {
				/* give server a second to
				clean up before reconnect attempt */
				msleep(1000);
				/* always try 445 first on reconnect
				since we get NACK on some if we ever
S
Steve French 已提交
483
				connected to port 139 (the NACK is
484 485
				since we do not begin with RFC1001
				session initialize frame) */
S
Steve French 已提交
486
				server->addr.sockAddr.sin_port =
487
					htons(CIFS_PORT);
L
Linus Torvalds 已提交
488 489
				cifs_reconnect(server);
				csocket = server->ssocket;
490
				wake_up(&server->response_q);
L
Linus Torvalds 已提交
491
				continue;
492
			}
493
		} else if (temp != (char) 0) {
S
Steve French 已提交
494
			cERROR(1, ("Unknown RFC 1002 frame"));
495 496
			cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
				      length);
497 498 499
			cifs_reconnect(server);
			csocket = server->ssocket;
			continue;
500 501 502
		}

		/* else we have an SMB response */
S
Steve French 已提交
503
		if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
504
			    (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
505
			cERROR(1, ("Invalid size SMB length %d pdu_length %d",
506
					length, pdu_length+4));
507 508 509 510
			cifs_reconnect(server);
			csocket = server->ssocket;
			wake_up(&server->response_q);
			continue;
S
Steve French 已提交
511
		}
512 513 514 515

		/* else length ok */
		reconnect = 0;

S
Steve French 已提交
516
		if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
517
			isLargeBuf = true;
518 519 520 521 522 523
			memcpy(bigbuf, smallbuf, 4);
			smb_buffer = bigbuf;
		}
		length = 0;
		iov.iov_base = 4 + (char *)smb_buffer;
		iov.iov_len = pdu_length;
S
Steve French 已提交
524
		for (total_read = 0; total_read < pdu_length;
525 526 527
		     total_read += length) {
			length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
						pdu_length - total_read, 0);
528
			if (kthread_should_stop() ||
529 530 531 532 533
			    (length == -EINTR)) {
				/* then will exit */
				reconnect = 2;
				break;
			} else if (server->tcpStatus == CifsNeedReconnect) {
534 535
				cifs_reconnect(server);
				csocket = server->ssocket;
S
Steve French 已提交
536
				/* Reconnect wakes up rspns q */
537 538 539
				/* Now we will reread sock */
				reconnect = 1;
				break;
S
Steve French 已提交
540
			} else if ((length == -ERESTARTSYS) ||
541 542
				   (length == -EAGAIN)) {
				msleep(1); /* minimum sleep to prevent looping,
S
Steve French 已提交
543
					      allowing socket to clear and app
544 545
					      threads to set tcpStatus
					      CifsNeedReconnect if server hung*/
546
				length = 0;
547
				continue;
548
			} else if (length <= 0) {
S
Steve French 已提交
549
				cERROR(1, ("Received no data, expecting %d",
550 551 552 553 554
					      pdu_length - total_read));
				cifs_reconnect(server);
				csocket = server->ssocket;
				reconnect = 1;
				break;
555
			}
556
		}
S
Steve French 已提交
557
		if (reconnect == 2)
558
			break;
S
Steve French 已提交
559
		else if (reconnect == 1)
560
			continue;
L
Linus Torvalds 已提交
561

562
		length += 4; /* account for rfc1002 hdr */
563

564

565
		dump_smb(smb_buffer, length);
566
		if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
567
			cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
568 569
			continue;
		}
L
Linus Torvalds 已提交
570

571 572 573 574 575 576

		task_to_wake = NULL;
		spin_lock(&GlobalMid_Lock);
		list_for_each(tmp, &server->pending_mid_q) {
			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);

577
			if ((mid_entry->mid == smb_buffer->Mid) &&
578 579
			    (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
			    (mid_entry->command == smb_buffer->Command)) {
S
Steve French 已提交
580
				if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
581
					/* We have a multipart transact2 resp */
582
					isMultiRsp = true;
S
Steve French 已提交
583
					if (mid_entry->resp_buf) {
584
						/* merge response - fix up 1st*/
585
						if (coalesce_t2(smb_buffer,
586
							mid_entry->resp_buf)) {
587 588
							mid_entry->multiRsp =
								 true;
589 590 591
							break;
						} else {
							/* all parts received */
592 593
							mid_entry->multiEnd =
								 true;
594
							goto multi_t2_fnd;
595 596
						}
					} else {
S
Steve French 已提交
597
						if (!isLargeBuf) {
598 599
							cERROR(1,("1st trans2 resp needs bigbuf"));
					/* BB maybe we can fix this up,  switch
600
					   to already allocated large buffer? */
601
						} else {
602
							/* Have first buffer */
603 604
							mid_entry->resp_buf =
								 smb_buffer;
605 606
							mid_entry->largeBuf =
								 true;
607 608 609 610
							bigbuf = NULL;
						}
					}
					break;
611
				}
612
				mid_entry->resp_buf = smb_buffer;
613
				mid_entry->largeBuf = isLargeBuf;
614 615 616
multi_t2_fnd:
				task_to_wake = mid_entry->tsk;
				mid_entry->midState = MID_RESPONSE_RECEIVED;
S
Steve French 已提交
617 618 619
#ifdef CONFIG_CIFS_STATS2
				mid_entry->when_received = jiffies;
#endif
620 621 622 623
				/* so we do not time out requests to  server
				which is still responding (since server could
				be busy but not dead) */
				server->lstrp = jiffies;
624
				break;
625
			}
L
Linus Torvalds 已提交
626
		}
627 628
		spin_unlock(&GlobalMid_Lock);
		if (task_to_wake) {
629
			/* Was previous buf put in mpx struct for multi-rsp? */
S
Steve French 已提交
630
			if (!isMultiRsp) {
631
				/* smb buffer will be freed by user thread */
632
				if (isLargeBuf)
633
					bigbuf = NULL;
634
				else
635 636
					smallbuf = NULL;
			}
637
			wake_up_process(task_to_wake);
638 639
		} else if (!is_valid_oplock_break(smb_buffer, server) &&
			   !isMultiRsp) {
640 641 642
			cERROR(1, ("No task to wake, unknown frame received! "
				   "NumMids %d", midCount.counter));
			cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
643
				      sizeof(struct smb_hdr));
644 645 646 647
#ifdef CONFIG_CIFS_DEBUG2
			cifs_dump_detail(smb_buffer);
			cifs_dump_mids(server);
#endif /* CIFS_DEBUG2 */
648

649 650 651
		}
	} /* end while !EXITING */

L
Linus Torvalds 已提交
652 653
	spin_lock(&GlobalMid_Lock);
	server->tcpStatus = CifsExiting;
654 655 656 657 658 659 660 661 662 663
	spin_unlock(&GlobalMid_Lock);

	/* don't exit until kthread_stop is called */
	set_current_state(TASK_UNINTERRUPTIBLE);
	while (!kthread_should_stop()) {
		schedule();
		set_current_state(TASK_UNINTERRUPTIBLE);
	}
	set_current_state(TASK_RUNNING);

664 665 666
	/* check if we have blocked requests that need to free */
	/* Note that cifs_max_pending is normally 50, but
	can be set at module install time to as little as two */
667
	spin_lock(&GlobalMid_Lock);
S
Steve French 已提交
668
	if (atomic_read(&server->inFlight) >= cifs_max_pending)
669 670 671
		atomic_set(&server->inFlight, cifs_max_pending - 1);
	/* We do not want to set the max_pending too low or we
	could end up with the counter going negative */
L
Linus Torvalds 已提交
672
	spin_unlock(&GlobalMid_Lock);
673
	/* Although there should not be any requests blocked on
L
Linus Torvalds 已提交
674
	this queue it can not hurt to be paranoid and try to wake up requests
675
	that may haven been blocked when more than 50 at time were on the wire
L
Linus Torvalds 已提交
676 677 678 679
	to the same server - they now will see the session is in exit state
	and get out of SendReceive.  */
	wake_up_all(&server->request_q);
	/* give those requests time to exit */
680
	msleep(125);
681

S
Steve French 已提交
682
	if (server->ssocket) {
L
Linus Torvalds 已提交
683 684 685
		sock_release(csocket);
		server->ssocket = NULL;
	}
686
	/* buffer usuallly freed in free_mid - need to free it here on exit */
687 688
	cifs_buf_release(bigbuf);
	if (smallbuf) /* no sense logging a debug message if NULL */
689
		cifs_small_buf_release(smallbuf);
L
Linus Torvalds 已提交
690 691 692

	read_lock(&GlobalSMBSeslock);
	if (list_empty(&server->pending_mid_q)) {
693 694
		/* loop through server session structures attached to this and
		    mark them dead */
L
Linus Torvalds 已提交
695 696 697 698 699 700 701 702 703 704 705
		list_for_each(tmp, &GlobalSMBSessionList) {
			ses =
			    list_entry(tmp, struct cifsSesInfo,
				       cifsSessionList);
			if (ses->server == server) {
				ses->status = CifsExiting;
				ses->server = NULL;
			}
		}
		read_unlock(&GlobalSMBSeslock);
	} else {
706 707 708 709 710 711
		/* although we can not zero the server struct pointer yet,
		since there are active requests which may depnd on them,
		mark the corresponding SMB sessions as exiting too */
		list_for_each(tmp, &GlobalSMBSessionList) {
			ses = list_entry(tmp, struct cifsSesInfo,
					 cifsSessionList);
712
			if (ses->server == server)
713 714 715
				ses->status = CifsExiting;
		}

L
Linus Torvalds 已提交
716 717 718 719
		spin_lock(&GlobalMid_Lock);
		list_for_each(tmp, &server->pending_mid_q) {
		mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
			if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
720 721
				cFYI(1, ("Clearing Mid 0x%x - waking up ",
					 mid_entry->mid));
L
Linus Torvalds 已提交
722
				task_to_wake = mid_entry->tsk;
723
				if (task_to_wake)
L
Linus Torvalds 已提交
724 725 726 727 728 729
					wake_up_process(task_to_wake);
			}
		}
		spin_unlock(&GlobalMid_Lock);
		read_unlock(&GlobalSMBSeslock);
		/* 1/8th of sec is more than enough time for them to exit */
730
		msleep(125);
L
Linus Torvalds 已提交
731 732
	}

733
	if (!list_empty(&server->pending_mid_q)) {
734
		/* mpx threads have not exited yet give them
L
Linus Torvalds 已提交
735
		at least the smb send timeout time for long ops */
736 737 738 739
		/* due to delays on oplock break requests, we need
		to wait at least 45 seconds before giving up
		on a request getting a response and going ahead
		and killing cifsd */
L
Linus Torvalds 已提交
740
		cFYI(1, ("Wait for exit from demultiplex thread"));
741
		msleep(46000);
L
Linus Torvalds 已提交
742 743 744 745 746 747 748
		/* if threads still have not exited they are probably never
		coming home not much else we can do but free the memory */
	}

	write_lock(&GlobalSMBSeslock);
	atomic_dec(&tcpSesAllocCount);
	length = tcpSesAllocCount.counter;
749 750 751

	/* last chance to mark ses pointers invalid
	if there are any pointing to this (e.g
752
	if a crazy root user tried to kill cifsd
753 754 755 756
	kernel thread explicitly this might happen) */
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo,
				cifsSessionList);
757
		if (ses->server == server)
758 759
			ses->server = NULL;
	}
L
Linus Torvalds 已提交
760
	write_unlock(&GlobalSMBSeslock);
761

762
	kfree(server->hostname);
763
	kfree(server);
764 765 766
	if (length  > 0)
		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
				GFP_KERNEL);
767

L
Linus Torvalds 已提交
768 769 770
	return 0;
}

771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798
/* extract the host portion of the UNC string */
static char *
extract_hostname(const char *unc)
{
	const char *src;
	char *dst, *delim;
	unsigned int len;

	/* skip double chars at beginning of string */
	/* BB: check validity of these bytes? */
	src = unc + 2;

	/* delimiter between hostname and sharename is always '\\' now */
	delim = strchr(src, '\\');
	if (!delim)
		return ERR_PTR(-EINVAL);

	len = delim - src;
	dst = kmalloc((len + 1), GFP_KERNEL);
	if (dst == NULL)
		return ERR_PTR(-ENOMEM);

	memcpy(dst, src, len);
	dst[len] = '\0';

	return dst;
}

L
Linus Torvalds 已提交
799
static int
800 801
cifs_parse_mount_options(char *options, const char *devname,
			 struct smb_vol *vol)
L
Linus Torvalds 已提交
802 803 804 805 806 807 808
{
	char *value;
	char *data;
	unsigned int  temp_len, i, j;
	char separator[2];

	separator[0] = ',';
809
	separator[1] = 0;
L
Linus Torvalds 已提交
810

811
	if (Local_System_Name[0] != 0)
812
		memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
813
	else {
814
		char *nodename = utsname()->nodename;
815 816 817
		int n = strnlen(nodename, 15);
		memset(vol->source_rfc1001_name, 0x20, 15);
		for (i = 0; i < n; i++) {
818 819 820
			/* does not have to be perfect mapping since field is
			informational, only used for servers that do not support
			port 445 and it can be overridden at mount time */
821
			vol->source_rfc1001_name[i] = toupper(nodename[i]);
822
		}
L
Linus Torvalds 已提交
823 824
	}
	vol->source_rfc1001_name[15] = 0;
825 826 827
	/* null target name indicates to use *SMBSERVR default called name
	   if we end up sending RFC1001 session initialize */
	vol->target_rfc1001_name[0] = 0;
L
Linus Torvalds 已提交
828 829 830 831
	vol->linux_uid = current->uid;	/* current->euid instead? */
	vol->linux_gid = current->gid;
	vol->dir_mode = S_IRWXUGO;
	/* 2767 perms indicate mandatory locking support */
832
	vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
L
Linus Torvalds 已提交
833 834

	/* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
835
	vol->rw = true;
836 837 838
	/* default is always to request posix paths. */
	vol->posix_paths = 1;

L
Linus Torvalds 已提交
839 840 841
	if (!options)
		return 1;

842
	if (strncmp(options, "sep=", 4) == 0) {
S
Steve French 已提交
843
		if (options[4] != 0) {
L
Linus Torvalds 已提交
844 845 846
			separator[0] = options[4];
			options += 5;
		} else {
S
Steve French 已提交
847
			cFYI(1, ("Null separator not allowed"));
L
Linus Torvalds 已提交
848 849
		}
	}
850

L
Linus Torvalds 已提交
851 852 853 854 855 856
	while ((data = strsep(&options, separator)) != NULL) {
		if (!*data)
			continue;
		if ((value = strchr(data, '=')) != NULL)
			*value++ = '\0';

857 858
		/* Have to parse this before we parse for "user" */
		if (strnicmp(data, "user_xattr", 10) == 0) {
L
Linus Torvalds 已提交
859
			vol->no_xattr = 0;
860
		} else if (strnicmp(data, "nouser_xattr", 12) == 0) {
L
Linus Torvalds 已提交
861 862
			vol->no_xattr = 1;
		} else if (strnicmp(data, "user", 4) == 0) {
S
Steve French 已提交
863
			if (!value) {
L
Linus Torvalds 已提交
864 865 866
				printk(KERN_WARNING
				       "CIFS: invalid or missing username\n");
				return 1;	/* needs_arg; */
S
Steve French 已提交
867
			} else if (!*value) {
S
Steve French 已提交
868 869
				/* null user, ie anonymous, authentication */
				vol->nullauth = 1;
L
Linus Torvalds 已提交
870 871 872 873 874 875 876 877 878 879 880
			}
			if (strnlen(value, 200) < 200) {
				vol->username = value;
			} else {
				printk(KERN_WARNING "CIFS: username too long\n");
				return 1;
			}
		} else if (strnicmp(data, "pass", 4) == 0) {
			if (!value) {
				vol->password = NULL;
				continue;
S
Steve French 已提交
881
			} else if (value[0] == 0) {
L
Linus Torvalds 已提交
882 883 884 885
				/* check if string begins with double comma
				   since that would mean the password really
				   does start with a comma, and would not
				   indicate an empty string */
S
Steve French 已提交
886
				if (value[1] != separator[0]) {
L
Linus Torvalds 已提交
887 888 889 890 891 892 893 894
					vol->password = NULL;
					continue;
				}
			}
			temp_len = strlen(value);
			/* removed password length check, NTLM passwords
				can be arbitrarily long */

895
			/* if comma in password, the string will be
L
Linus Torvalds 已提交
896 897 898 899 900 901 902 903 904
			prematurely null terminated.  Commas in password are
			specified across the cifs mount interface by a double
			comma ie ,, and a comma used as in other cases ie ','
			as a parameter delimiter/separator is single and due
			to the strsep above is temporarily zeroed. */

			/* NB: password legally can have multiple commas and
			the only illegal character in a password is null */

905
			if ((value[temp_len] == 0) &&
906
			    (value[temp_len+1] == separator[0])) {
L
Linus Torvalds 已提交
907 908
				/* reinsert comma */
				value[temp_len] = separator[0];
909 910
				temp_len += 2;  /* move after second comma */
				while (value[temp_len] != 0)  {
L
Linus Torvalds 已提交
911
					if (value[temp_len] == separator[0]) {
912
						if (value[temp_len+1] ==
913 914 915
						     separator[0]) {
						/* skip second comma */
							temp_len++;
916
						} else {
L
Linus Torvalds 已提交
917 918 919 920 921 922 923
						/* single comma indicating start
							 of next parm */
							break;
						}
					}
					temp_len++;
				}
S
Steve French 已提交
924
				if (value[temp_len] == 0) {
L
Linus Torvalds 已提交
925 926 927 928 929 930
					options = NULL;
				} else {
					value[temp_len] = 0;
					/* point option to start of next parm */
					options = value + temp_len + 1;
				}
931
				/* go from value to value + temp_len condensing
L
Linus Torvalds 已提交
932 933
				double commas to singles. Note that this ends up
				allocating a few bytes too many, which is ok */
934
				vol->password = kzalloc(temp_len, GFP_KERNEL);
S
Steve French 已提交
935
				if (vol->password == NULL) {
936 937
					printk(KERN_WARNING "CIFS: no memory "
							    "for password\n");
938 939
					return 1;
				}
940
				for (i = 0, j = 0; i < temp_len; i++, j++) {
L
Linus Torvalds 已提交
941
					vol->password[j] = value[i];
S
Steve French 已提交
942
					if (value[i] == separator[0]
943
						&& value[i+1] == separator[0]) {
L
Linus Torvalds 已提交
944 945 946 947 948 949
						/* skip second comma */
						i++;
					}
				}
				vol->password[j] = 0;
			} else {
950
				vol->password = kzalloc(temp_len+1, GFP_KERNEL);
S
Steve French 已提交
951
				if (vol->password == NULL) {
952 953
					printk(KERN_WARNING "CIFS: no memory "
							    "for password\n");
954 955
					return 1;
				}
L
Linus Torvalds 已提交
956 957 958 959 960 961 962 963
				strcpy(vol->password, value);
			}
		} else if (strnicmp(data, "ip", 2) == 0) {
			if (!value || !*value) {
				vol->UNCip = NULL;
			} else if (strnlen(value, 35) < 35) {
				vol->UNCip = value;
			} else {
964 965
				printk(KERN_WARNING "CIFS: ip address "
						    "too long\n");
L
Linus Torvalds 已提交
966 967
				return 1;
			}
968 969 970 971 972 973
		} else if (strnicmp(data, "sec", 3) == 0) {
			if (!value || !*value) {
				cERROR(1, ("no security value specified"));
				continue;
			} else if (strnicmp(value, "krb5i", 5) == 0) {
				vol->secFlg |= CIFSSEC_MAY_KRB5 |
974
					CIFSSEC_MUST_SIGN;
975
			} else if (strnicmp(value, "krb5p", 5) == 0) {
976 977 978
				/* vol->secFlg |= CIFSSEC_MUST_SEAL |
					CIFSSEC_MAY_KRB5; */
				cERROR(1, ("Krb5 cifs privacy not supported"));
979 980
				return 1;
			} else if (strnicmp(value, "krb5", 4) == 0) {
981
				vol->secFlg |= CIFSSEC_MAY_KRB5;
982
			} else if (strnicmp(value, "ntlmv2i", 7) == 0) {
983
				vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
984
					CIFSSEC_MUST_SIGN;
985
			} else if (strnicmp(value, "ntlmv2", 6) == 0) {
986
				vol->secFlg |= CIFSSEC_MAY_NTLMV2;
987
			} else if (strnicmp(value, "ntlmi", 5) == 0) {
988
				vol->secFlg |= CIFSSEC_MAY_NTLM |
989
					CIFSSEC_MUST_SIGN;
990 991
			} else if (strnicmp(value, "ntlm", 4) == 0) {
				/* ntlm is default so can be turned off too */
992
				vol->secFlg |= CIFSSEC_MAY_NTLM;
993
			} else if (strnicmp(value, "nontlm", 6) == 0) {
994
				/* BB is there a better way to do this? */
995
				vol->secFlg |= CIFSSEC_MAY_NTLMV2;
996 997
#ifdef CONFIG_CIFS_WEAK_PW_HASH
			} else if (strnicmp(value, "lanman", 6) == 0) {
998
				vol->secFlg |= CIFSSEC_MAY_LANMAN;
999
#endif
1000
			} else if (strnicmp(value, "none", 4) == 0) {
1001
				vol->nullauth = 1;
1002 1003 1004 1005
			} else {
				cERROR(1, ("bad security option: %s", value));
				return 1;
			}
L
Linus Torvalds 已提交
1006 1007 1008 1009
		} else if ((strnicmp(data, "unc", 3) == 0)
			   || (strnicmp(data, "target", 6) == 0)
			   || (strnicmp(data, "path", 4) == 0)) {
			if (!value || !*value) {
1010 1011
				printk(KERN_WARNING "CIFS: invalid path to "
						    "network resource\n");
L
Linus Torvalds 已提交
1012 1013 1014
				return 1;	/* needs_arg; */
			}
			if ((temp_len = strnlen(value, 300)) < 300) {
1015
				vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1016
				if (vol->UNC == NULL)
L
Linus Torvalds 已提交
1017
					return 1;
1018
				strcpy(vol->UNC, value);
L
Linus Torvalds 已提交
1019 1020 1021
				if (strncmp(vol->UNC, "//", 2) == 0) {
					vol->UNC[0] = '\\';
					vol->UNC[1] = '\\';
1022
				} else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
L
Linus Torvalds 已提交
1023
					printk(KERN_WARNING
1024 1025
					       "CIFS: UNC Path does not begin "
					       "with // or \\\\ \n");
L
Linus Torvalds 已提交
1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039
					return 1;
				}
			} else {
				printk(KERN_WARNING "CIFS: UNC name too long\n");
				return 1;
			}
		} else if ((strnicmp(data, "domain", 3) == 0)
			   || (strnicmp(data, "workgroup", 5) == 0)) {
			if (!value || !*value) {
				printk(KERN_WARNING "CIFS: invalid domain name\n");
				return 1;	/* needs_arg; */
			}
			/* BB are there cases in which a comma can be valid in
			a domain name and need special handling? */
1040
			if (strnlen(value, 256) < 256) {
L
Linus Torvalds 已提交
1041 1042 1043
				vol->domainname = value;
				cFYI(1, ("Domain name set"));
			} else {
1044 1045
				printk(KERN_WARNING "CIFS: domain name too "
						    "long\n");
L
Linus Torvalds 已提交
1046 1047
				return 1;
			}
1048 1049 1050 1051 1052 1053 1054
		} else if (strnicmp(data, "prefixpath", 10) == 0) {
			if (!value || !*value) {
				printk(KERN_WARNING
					"CIFS: invalid path prefix\n");
				return 1;       /* needs_argument */
			}
			if ((temp_len = strnlen(value, 1024)) < 1024) {
1055
				if (value[0] != '/')
1056
					temp_len++;  /* missing leading slash */
1057 1058 1059
				vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
				if (vol->prepath == NULL)
					return 1;
1060
				if (value[0] != '/') {
1061
					vol->prepath[0] = '/';
1062
					strcpy(vol->prepath+1, value);
1063
				} else
1064 1065 1066 1067 1068 1069
					strcpy(vol->prepath, value);
				cFYI(1, ("prefix path %s", vol->prepath));
			} else {
				printk(KERN_WARNING "CIFS: prefix too long\n");
				return 1;
			}
L
Linus Torvalds 已提交
1070 1071
		} else if (strnicmp(data, "iocharset", 9) == 0) {
			if (!value || !*value) {
1072 1073
				printk(KERN_WARNING "CIFS: invalid iocharset "
						    "specified\n");
L
Linus Torvalds 已提交
1074 1075 1076
				return 1;	/* needs_arg; */
			}
			if (strnlen(value, 65) < 65) {
1077
				if (strnicmp(value, "default", 7))
L
Linus Torvalds 已提交
1078
					vol->iocharset = value;
1079 1080 1081
				/* if iocharset not set then load_nls_default
				   is used by caller */
				cFYI(1, ("iocharset set to %s", value));
L
Linus Torvalds 已提交
1082
			} else {
1083 1084
				printk(KERN_WARNING "CIFS: iocharset name "
						    "too long.\n");
L
Linus Torvalds 已提交
1085 1086 1087 1088 1089 1090
				return 1;
			}
		} else if (strnicmp(data, "uid", 3) == 0) {
			if (value && *value) {
				vol->linux_uid =
					simple_strtoul(value, &value, 0);
1091
				vol->override_uid = 1;
L
Linus Torvalds 已提交
1092 1093 1094 1095 1096
			}
		} else if (strnicmp(data, "gid", 3) == 0) {
			if (value && *value) {
				vol->linux_gid =
					simple_strtoul(value, &value, 0);
1097
				vol->override_gid = 1;
L
Linus Torvalds 已提交
1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135
			}
		} else if (strnicmp(data, "file_mode", 4) == 0) {
			if (value && *value) {
				vol->file_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "dir_mode", 4) == 0) {
			if (value && *value) {
				vol->dir_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "dirmode", 4) == 0) {
			if (value && *value) {
				vol->dir_mode =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "port", 4) == 0) {
			if (value && *value) {
				vol->port =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "rsize", 5) == 0) {
			if (value && *value) {
				vol->rsize =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "wsize", 5) == 0) {
			if (value && *value) {
				vol->wsize =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "sockopt", 5) == 0) {
			if (value && *value) {
				vol->sockopt =
					simple_strtoul(value, &value, 0);
			}
		} else if (strnicmp(data, "netbiosname", 4) == 0) {
			if (!value || !*value || (*value == ' ')) {
1136
				cFYI(1, ("invalid (empty) netbiosname"));
L
Linus Torvalds 已提交
1137
			} else {
1138 1139 1140
				memset(vol->source_rfc1001_name, 0x20, 15);
				for (i = 0; i < 15; i++) {
				/* BB are there cases in which a comma can be
L
Linus Torvalds 已提交
1141 1142 1143 1144
				valid in this workstation netbios name (and need
				special handling)? */

				/* We do not uppercase netbiosname for user */
1145
					if (value[i] == 0)
L
Linus Torvalds 已提交
1146
						break;
1147 1148 1149
					else
						vol->source_rfc1001_name[i] =
								value[i];
L
Linus Torvalds 已提交
1150 1151 1152
				}
				/* The string has 16th byte zero still from
				set at top of the function  */
1153 1154 1155
				if ((i == 15) && (value[i] != 0))
					printk(KERN_WARNING "CIFS: netbiosname"
						" longer than 15 truncated.\n");
1156 1157 1158 1159
			}
		} else if (strnicmp(data, "servern", 7) == 0) {
			/* servernetbiosname specified override *SMBSERVER */
			if (!value || !*value || (*value == ' ')) {
S
Steve French 已提交
1160
				cFYI(1, ("empty server netbiosname specified"));
1161 1162
			} else {
				/* last byte, type, is 0x20 for servr type */
1163
				memset(vol->target_rfc1001_name, 0x20, 16);
1164

1165
				for (i = 0; i < 15; i++) {
1166
				/* BB are there cases in which a comma can be
1167 1168
				   valid in this workstation netbios name
				   (and need special handling)? */
1169

1170 1171 1172
				/* user or mount helper must uppercase
				   the netbiosname */
					if (value[i] == 0)
1173 1174
						break;
					else
1175 1176
						vol->target_rfc1001_name[i] =
								value[i];
1177 1178 1179
				}
				/* The string has 16th byte zero still from
				   set at top of the function  */
1180 1181 1182
				if ((i == 15) && (value[i] != 0))
					printk(KERN_WARNING "CIFS: server net"
					"biosname longer than 15 truncated.\n");
L
Linus Torvalds 已提交
1183 1184 1185 1186 1187
			}
		} else if (strnicmp(data, "credentials", 4) == 0) {
			/* ignore */
		} else if (strnicmp(data, "version", 3) == 0) {
			/* ignore */
1188
		} else if (strnicmp(data, "guest", 5) == 0) {
L
Linus Torvalds 已提交
1189 1190
			/* ignore */
		} else if (strnicmp(data, "rw", 2) == 0) {
1191
			vol->rw = true;
L
Linus Torvalds 已提交
1192 1193 1194 1195 1196 1197 1198 1199
		} else if ((strnicmp(data, "suid", 4) == 0) ||
				   (strnicmp(data, "nosuid", 6) == 0) ||
				   (strnicmp(data, "exec", 4) == 0) ||
				   (strnicmp(data, "noexec", 6) == 0) ||
				   (strnicmp(data, "nodev", 5) == 0) ||
				   (strnicmp(data, "noauto", 6) == 0) ||
				   (strnicmp(data, "dev", 3) == 0)) {
			/*  The mount tool or mount.cifs helper (if present)
1200 1201 1202 1203 1204
			    uses these opts to set flags, and the flags are read
			    by the kernel vfs layer before we get here (ie
			    before read super) so there is no point trying to
			    parse these options again and set anything and it
			    is ok to just ignore them */
L
Linus Torvalds 已提交
1205 1206
			continue;
		} else if (strnicmp(data, "ro", 2) == 0) {
1207
			vol->rw = false;
L
Linus Torvalds 已提交
1208 1209 1210 1211 1212 1213 1214 1215
		} else if (strnicmp(data, "hard", 4) == 0) {
			vol->retry = 1;
		} else if (strnicmp(data, "soft", 4) == 0) {
			vol->retry = 0;
		} else if (strnicmp(data, "perm", 4) == 0) {
			vol->noperm = 0;
		} else if (strnicmp(data, "noperm", 6) == 0) {
			vol->noperm = 1;
1216 1217 1218 1219
		} else if (strnicmp(data, "mapchars", 8) == 0) {
			vol->remap = 1;
		} else if (strnicmp(data, "nomapchars", 10) == 0) {
			vol->remap = 0;
1220 1221 1222 1223
		} else if (strnicmp(data, "sfu", 3) == 0) {
			vol->sfu_emul = 1;
		} else if (strnicmp(data, "nosfu", 5) == 0) {
			vol->sfu_emul = 0;
1224 1225 1226 1227
		} else if (strnicmp(data, "posixpaths", 10) == 0) {
			vol->posix_paths = 1;
		} else if (strnicmp(data, "noposixpaths", 12) == 0) {
			vol->posix_paths = 0;
1228 1229 1230 1231
		} else if (strnicmp(data, "nounix", 6) == 0) {
			vol->no_linux_ext = 1;
		} else if (strnicmp(data, "nolinux", 7) == 0) {
			vol->no_linux_ext = 1;
1232
		} else if ((strnicmp(data, "nocase", 6) == 0) ||
1233
			   (strnicmp(data, "ignorecase", 10)  == 0)) {
1234
			vol->nocase = 1;
1235 1236
		} else if (strnicmp(data, "brl", 3) == 0) {
			vol->nobrl =  0;
1237
		} else if ((strnicmp(data, "nobrl", 5) == 0) ||
1238
			   (strnicmp(data, "nolock", 6) == 0)) {
1239
			vol->nobrl =  1;
1240 1241 1242
			/* turn off mandatory locking in mode
			if remote locking is turned off since the
			local vfs will do advisory */
1243 1244
			if (vol->file_mode ==
				(S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1245
				vol->file_mode = S_IALLUGO;
L
Linus Torvalds 已提交
1246 1247 1248 1249
		} else if (strnicmp(data, "setuids", 7) == 0) {
			vol->setuids = 1;
		} else if (strnicmp(data, "nosetuids", 9) == 0) {
			vol->setuids = 0;
1250 1251 1252 1253
		} else if (strnicmp(data, "dynperm", 7) == 0) {
			vol->dynperm = true;
		} else if (strnicmp(data, "nodynperm", 9) == 0) {
			vol->dynperm = false;
L
Linus Torvalds 已提交
1254 1255 1256 1257 1258 1259 1260 1261
		} else if (strnicmp(data, "nohard", 6) == 0) {
			vol->retry = 0;
		} else if (strnicmp(data, "nosoft", 6) == 0) {
			vol->retry = 1;
		} else if (strnicmp(data, "nointr", 6) == 0) {
			vol->intr = 0;
		} else if (strnicmp(data, "intr", 4) == 0) {
			vol->intr = 1;
1262
		} else if (strnicmp(data, "serverino", 7) == 0) {
L
Linus Torvalds 已提交
1263
			vol->server_ino = 1;
1264
		} else if (strnicmp(data, "noserverino", 9) == 0) {
L
Linus Torvalds 已提交
1265
			vol->server_ino = 0;
1266
		} else if (strnicmp(data, "cifsacl", 7) == 0) {
1267 1268 1269
			vol->cifs_acl = 1;
		} else if (strnicmp(data, "nocifsacl", 9) == 0) {
			vol->cifs_acl = 0;
1270
		} else if (strnicmp(data, "acl", 3) == 0) {
L
Linus Torvalds 已提交
1271
			vol->no_psx_acl = 0;
1272
		} else if (strnicmp(data, "noacl", 5) == 0) {
L
Linus Torvalds 已提交
1273
			vol->no_psx_acl = 1;
1274
		} else if (strnicmp(data, "sign", 4) == 0) {
1275 1276 1277
			vol->secFlg |= CIFSSEC_MUST_SIGN;
/*		} else if (strnicmp(data, "seal",4) == 0) {
			vol->secFlg |= CIFSSEC_MUST_SEAL; */
1278
		} else if (strnicmp(data, "direct", 6) == 0) {
L
Linus Torvalds 已提交
1279
			vol->direct_io = 1;
1280
		} else if (strnicmp(data, "forcedirectio", 13) == 0) {
L
Linus Torvalds 已提交
1281
			vol->direct_io = 1;
1282
		} else if (strnicmp(data, "in6_addr", 8) == 0) {
L
Linus Torvalds 已提交
1283 1284 1285 1286 1287
			if (!value || !*value) {
				vol->in6_addr = NULL;
			} else if (strnlen(value, 49) == 48) {
				vol->in6_addr = value;
			} else {
1288 1289
				printk(KERN_WARNING "CIFS: ip v6 address not "
						    "48 characters long\n");
L
Linus Torvalds 已提交
1290 1291 1292
				return 1;
			}
		} else if (strnicmp(data, "noac", 4) == 0) {
1293 1294 1295
			printk(KERN_WARNING "CIFS: Mount option noac not "
				"supported. Instead set "
				"/proc/fs/cifs/LookupCacheEnabled to 0\n");
L
Linus Torvalds 已提交
1296
		} else
1297 1298
			printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
						data);
L
Linus Torvalds 已提交
1299 1300
	}
	if (vol->UNC == NULL) {
1301
		if (devname == NULL) {
1302 1303
			printk(KERN_WARNING "CIFS: Missing UNC name for mount "
						"target\n");
L
Linus Torvalds 已提交
1304 1305 1306
			return 1;
		}
		if ((temp_len = strnlen(devname, 300)) < 300) {
1307
			vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1308
			if (vol->UNC == NULL)
L
Linus Torvalds 已提交
1309
				return 1;
1310
			strcpy(vol->UNC, devname);
L
Linus Torvalds 已提交
1311 1312 1313 1314
			if (strncmp(vol->UNC, "//", 2) == 0) {
				vol->UNC[0] = '\\';
				vol->UNC[1] = '\\';
			} else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1315 1316
				printk(KERN_WARNING "CIFS: UNC Path does not "
						    "begin with // or \\\\ \n");
L
Linus Torvalds 已提交
1317 1318
				return 1;
			}
1319 1320 1321
			value = strpbrk(vol->UNC+2, "/\\");
			if (value)
				*value = '\\';
L
Linus Torvalds 已提交
1322 1323 1324 1325 1326
		} else {
			printk(KERN_WARNING "CIFS: UNC name too long\n");
			return 1;
		}
	}
S
Steve French 已提交
1327
	if (vol->UNCip == NULL)
L
Linus Torvalds 已提交
1328 1329 1330 1331 1332 1333
		vol->UNCip = &vol->UNC[2];

	return 0;
}

static struct cifsSesInfo *
1334
cifs_find_tcp_session(struct in_addr *target_ip_addr,
1335 1336
		      struct in6_addr *target_ip6_addr,
		      char *userName, struct TCP_Server_Info **psrvTcp)
L
Linus Torvalds 已提交
1337 1338 1339
{
	struct list_head *tmp;
	struct cifsSesInfo *ses;
1340

L
Linus Torvalds 已提交
1341 1342
	*psrvTcp = NULL;

1343
	read_lock(&GlobalSMBSeslock);
L
Linus Torvalds 已提交
1344 1345
	list_for_each(tmp, &GlobalSMBSessionList) {
		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1346 1347 1348 1349 1350 1351 1352 1353 1354 1355
		if (!ses->server)
			continue;

		if (target_ip_addr &&
		    ses->server->addr.sockAddr.sin_addr.s_addr != target_ip_addr->s_addr)
				continue;
		else if (target_ip6_addr &&
			 memcmp(&ses->server->addr.sockAddr6.sin6_addr,
				target_ip6_addr, sizeof(*target_ip6_addr)))
				continue;
1356
		/* BB lock server and tcp session; increment use count here?? */
1357 1358 1359 1360 1361 1362 1363 1364 1365 1366

		/* found a match on the TCP session */
		*psrvTcp = ses->server;

		/* BB check if reconnection needed */
		if (strncmp(ses->userName, userName, MAX_USERNAME_SIZE) == 0) {
			read_unlock(&GlobalSMBSeslock);
			/* Found exact match on both TCP and
			   SMB sessions */
			return ses;
L
Linus Torvalds 已提交
1367 1368 1369 1370
		}
		/* else tcp and smb sessions need reconnection */
	}
	read_unlock(&GlobalSMBSeslock);
1371

L
Linus Torvalds 已提交
1372 1373 1374 1375 1376 1377 1378 1379
	return NULL;
}

static struct cifsTconInfo *
find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
{
	struct list_head *tmp;
	struct cifsTconInfo *tcon;
1380
	__be32 old_ip;
L
Linus Torvalds 已提交
1381 1382

	read_lock(&GlobalSMBSeslock);
1383

L
Linus Torvalds 已提交
1384
	list_for_each(tmp, &GlobalTreeConnectionList) {
1385
		cFYI(1, ("Next tcon"));
L
Linus Torvalds 已提交
1386
		tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414
		if (!tcon->ses || !tcon->ses->server)
			continue;

		old_ip = tcon->ses->server->addr.sockAddr.sin_addr.s_addr;
		cFYI(1, ("old ip addr: %x == new ip %x ?",
			old_ip, new_target_ip_addr));

		if (old_ip != new_target_ip_addr)
			continue;

		/* BB lock tcon, server, tcp session and increment use count? */
		/* found a match on the TCP session */
		/* BB check if reconnection needed */
		cFYI(1, ("IP match, old UNC: %s new: %s",
			tcon->treeName, uncName));

		if (strncmp(tcon->treeName, uncName, MAX_TREE_SIZE))
			continue;

		cFYI(1, ("and old usr: %s new: %s",
			tcon->treeName, uncName));

		if (strncmp(tcon->ses->userName, userName, MAX_USERNAME_SIZE))
			continue;

		/* matched smb session (user name) */
		read_unlock(&GlobalSMBSeslock);
		return tcon;
L
Linus Torvalds 已提交
1415
	}
1416

L
Linus Torvalds 已提交
1417 1418 1419 1420 1421 1422
	read_unlock(&GlobalSMBSeslock);
	return NULL;
}

int
connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1423 1424
		    const char *old_path, const struct nls_table *nls_codepage,
		    int remap)
L
Linus Torvalds 已提交
1425
{
S
Steve French 已提交
1426
	struct dfs_info3_param *referrals = NULL;
L
Linus Torvalds 已提交
1427 1428 1429
	unsigned int num_referrals;
	int rc = 0;

1430
	rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
1431
			&num_referrals, &referrals, remap);
L
Linus Torvalds 已提交
1432 1433

	/* BB Add in code to: if valid refrl, if not ip address contact
1434
		the helper that resolves tcp names, mount to it, try to
L
Linus Torvalds 已提交
1435 1436
		tcon to it unmount it if fail */

J
Jesper Juhl 已提交
1437
	kfree(referrals);
L
Linus Torvalds 已提交
1438 1439 1440 1441 1442

	return rc;
}

int
1443 1444
get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
	     const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
S
Steve French 已提交
1445
	     struct dfs_info3_param **preferrals, int remap)
L
Linus Torvalds 已提交
1446 1447 1448
{
	char *temp_unc;
	int rc = 0;
S
Steve French 已提交
1449
	unsigned char *targetUNCs;
L
Linus Torvalds 已提交
1450 1451

	*pnum_referrals = 0;
S
Steve French 已提交
1452
	*preferrals = NULL;
L
Linus Torvalds 已提交
1453 1454 1455

	if (pSesInfo->ipc_tid == 0) {
		temp_unc = kmalloc(2 /* for slashes */ +
1456 1457
			strnlen(pSesInfo->serverName,
				SERVER_NAME_LEN_WITH_NULL * 2)
L
Linus Torvalds 已提交
1458 1459 1460 1461 1462 1463 1464 1465 1466 1467
				 + 1 + 4 /* slash IPC$ */  + 2,
				GFP_KERNEL);
		if (temp_unc == NULL)
			return -ENOMEM;
		temp_unc[0] = '\\';
		temp_unc[1] = '\\';
		strcpy(temp_unc + 2, pSesInfo->serverName);
		strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
		rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
		cFYI(1,
1468
		     ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
L
Linus Torvalds 已提交
1469 1470 1471
		kfree(temp_unc);
	}
	if (rc == 0)
S
Steve French 已提交
1472
		rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, &targetUNCs,
1473
				     pnum_referrals, nls_codepage, remap);
S
Steve French 已提交
1474 1475
	/* BB map targetUNCs to dfs_info3 structures, here or
		in CIFSGetDFSRefer BB */
L
Linus Torvalds 已提交
1476 1477 1478 1479 1480

	return rc;
}

/* See RFC1001 section 14 on representation of Netbios names */
1481
static void rfc1002mangle(char *target, char *source, unsigned int length)
L
Linus Torvalds 已提交
1482
{
1483
	unsigned int i, j;
L
Linus Torvalds 已提交
1484

1485
	for (i = 0, j = 0; i < (length); i++) {
L
Linus Torvalds 已提交
1486 1487 1488
		/* mask a nibble at a time and encode */
		target[j] = 'A' + (0x0F & (source[i] >> 4));
		target[j+1] = 'A' + (0x0F & source[i]);
1489
		j += 2;
L
Linus Torvalds 已提交
1490 1491 1492 1493 1494 1495
	}

}


static int
1496 1497
ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
	     char *netbios_name, char *target_name)
L
Linus Torvalds 已提交
1498 1499 1500 1501 1502
{
	int rc = 0;
	int connected = 0;
	__be16 orig_port = 0;

S
Steve French 已提交
1503
	if (*csocket == NULL) {
1504 1505
		rc = sock_create_kern(PF_INET, SOCK_STREAM,
				      IPPROTO_TCP, csocket);
L
Linus Torvalds 已提交
1506
		if (rc < 0) {
1507
			cERROR(1, ("Error %d creating socket", rc));
L
Linus Torvalds 已提交
1508 1509 1510 1511
			*csocket = NULL;
			return rc;
		} else {
		/* BB other socket options to set KEEPALIVE, NODELAY? */
S
Steve French 已提交
1512
			cFYI(1, ("Socket created"));
1513
			(*csocket)->sk->sk_allocation = GFP_NOFS;
L
Linus Torvalds 已提交
1514 1515 1516 1517
		}
	}

	psin_server->sin_family = AF_INET;
S
Steve French 已提交
1518
	if (psin_server->sin_port) { /* user overrode default port */
L
Linus Torvalds 已提交
1519 1520
		rc = (*csocket)->ops->connect(*csocket,
				(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1521
				sizeof(struct sockaddr_in), 0);
L
Linus Torvalds 已提交
1522 1523
		if (rc >= 0)
			connected = 1;
1524
	}
L
Linus Torvalds 已提交
1525

S
Steve French 已提交
1526
	if (!connected) {
1527
		/* save original port so we can retry user specified port
L
Linus Torvalds 已提交
1528 1529 1530 1531
			later if fall back ports fail this time  */
		orig_port = psin_server->sin_port;

		/* do not retry on the same port we just failed on */
S
Steve French 已提交
1532
		if (psin_server->sin_port != htons(CIFS_PORT)) {
L
Linus Torvalds 已提交
1533 1534 1535 1536
			psin_server->sin_port = htons(CIFS_PORT);

			rc = (*csocket)->ops->connect(*csocket,
					(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1537
					sizeof(struct sockaddr_in), 0);
L
Linus Torvalds 已提交
1538 1539 1540 1541 1542 1543 1544
			if (rc >= 0)
				connected = 1;
		}
	}
	if (!connected) {
		psin_server->sin_port = htons(RFC1001_PORT);
		rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1545
					      psin_server,
C
Cyrill Gorcunov 已提交
1546
					      sizeof(struct sockaddr_in), 0);
1547
		if (rc >= 0)
L
Linus Torvalds 已提交
1548 1549 1550 1551 1552 1553
			connected = 1;
	}

	/* give up here - unless we want to retry on different
		protocol families some day */
	if (!connected) {
S
Steve French 已提交
1554
		if (orig_port)
L
Linus Torvalds 已提交
1555
			psin_server->sin_port = orig_port;
1556
		cFYI(1, ("Error %d connecting to server via ipv4", rc));
L
Linus Torvalds 已提交
1557 1558 1559 1560
		sock_release(*csocket);
		*csocket = NULL;
		return rc;
	}
1561 1562
	/* Eventually check for other socket options to change from
		the default. sock_setsockopt not used because it expects
L
Linus Torvalds 已提交
1563
		user space buffer */
1564 1565
	 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
		 (*csocket)->sk->sk_sndbuf,
1566
		 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
L
Linus Torvalds 已提交
1567
	(*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1568
	/* make the bufsizes depend on wsize/rsize and max requests */
S
Steve French 已提交
1569
	if ((*csocket)->sk->sk_sndbuf < (200 * 1024))
1570
		(*csocket)->sk->sk_sndbuf = 200 * 1024;
S
Steve French 已提交
1571
	if ((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1572
		(*csocket)->sk->sk_rcvbuf = 140 * 1024;
L
Linus Torvalds 已提交
1573 1574

	/* send RFC1001 sessinit */
S
Steve French 已提交
1575
	if (psin_server->sin_port == htons(RFC1001_PORT)) {
L
Linus Torvalds 已提交
1576
		/* some servers require RFC1001 sessinit before sending
1577
		negprot - BB check reconnection in case where second
L
Linus Torvalds 已提交
1578
		sessinit is sent but no second negprot */
1579 1580 1581 1582
		struct rfc1002_session_packet *ses_init_buf;
		struct smb_hdr *smb_buf;
		ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
				       GFP_KERNEL);
S
Steve French 已提交
1583
		if (ses_init_buf) {
L
Linus Torvalds 已提交
1584
			ses_init_buf->trailer.session_req.called_len = 32;
S
Steve French 已提交
1585
			if (target_name && (target_name[0] != 0)) {
1586 1587 1588 1589
				rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
					target_name, 16);
			} else {
				rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1590
					DEFAULT_CIFS_CALLED_NAME, 16);
1591 1592
			}

L
Linus Torvalds 已提交
1593 1594 1595
			ses_init_buf->trailer.session_req.calling_len = 32;
			/* calling name ends in null (byte 16) from old smb
			convention. */
1596
			if (netbios_name && (netbios_name[0] != 0)) {
L
Linus Torvalds 已提交
1597
				rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1598
					netbios_name, 16);
L
Linus Torvalds 已提交
1599 1600
			} else {
				rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1601
					"LINUX_CIFS_CLNT", 16);
L
Linus Torvalds 已提交
1602 1603 1604 1605 1606 1607 1608 1609 1610
			}
			ses_init_buf->trailer.session_req.scope1 = 0;
			ses_init_buf->trailer.session_req.scope2 = 0;
			smb_buf = (struct smb_hdr *)ses_init_buf;
			/* sizeof RFC1002_SESSION_REQUEST with no scope */
			smb_buf->smb_buf_length = 0x81000044;
			rc = smb_send(*csocket, smb_buf, 0x44,
				(struct sockaddr *)psin_server);
			kfree(ses_init_buf);
1611
			msleep(1); /* RFC1001 layer in at least one server
1612 1613 1614
				      requires very short break before negprot
				      presumably because not expecting negprot
				      to follow so fast.  This is a simple
1615
				      solution that works without
1616 1617 1618
				      complicating the code and causes no
				      significant slowing down on mount
				      for everyone else */
L
Linus Torvalds 已提交
1619
		}
1620
		/* else the negprot may still work without this
L
Linus Torvalds 已提交
1621
		even though malloc failed */
1622

L
Linus Torvalds 已提交
1623
	}
1624

L
Linus Torvalds 已提交
1625 1626 1627 1628 1629 1630 1631 1632 1633 1634
	return rc;
}

static int
ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
{
	int rc = 0;
	int connected = 0;
	__be16 orig_port = 0;

S
Steve French 已提交
1635
	if (*csocket == NULL) {
1636 1637
		rc = sock_create_kern(PF_INET6, SOCK_STREAM,
				      IPPROTO_TCP, csocket);
L
Linus Torvalds 已提交
1638
		if (rc < 0) {
1639
			cERROR(1, ("Error %d creating ipv6 socket", rc));
L
Linus Torvalds 已提交
1640 1641 1642 1643
			*csocket = NULL;
			return rc;
		} else {
		/* BB other socket options to set KEEPALIVE, NODELAY? */
S
Steve French 已提交
1644
			 cFYI(1, ("ipv6 Socket created"));
L
Linus Torvalds 已提交
1645 1646 1647 1648 1649 1650
			(*csocket)->sk->sk_allocation = GFP_NOFS;
		}
	}

	psin_server->sin6_family = AF_INET6;

S
Steve French 已提交
1651
	if (psin_server->sin6_port) { /* user overrode default port */
L
Linus Torvalds 已提交
1652 1653
		rc = (*csocket)->ops->connect(*csocket,
				(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1654
				sizeof(struct sockaddr_in6), 0);
L
Linus Torvalds 已提交
1655 1656
		if (rc >= 0)
			connected = 1;
1657
	}
L
Linus Torvalds 已提交
1658

S
Steve French 已提交
1659
	if (!connected) {
1660
		/* save original port so we can retry user specified port
L
Linus Torvalds 已提交
1661 1662 1663 1664
			later if fall back ports fail this time  */

		orig_port = psin_server->sin6_port;
		/* do not retry on the same port we just failed on */
S
Steve French 已提交
1665
		if (psin_server->sin6_port != htons(CIFS_PORT)) {
L
Linus Torvalds 已提交
1666 1667 1668 1669
			psin_server->sin6_port = htons(CIFS_PORT);

			rc = (*csocket)->ops->connect(*csocket,
					(struct sockaddr *) psin_server,
C
Cyrill Gorcunov 已提交
1670
					sizeof(struct sockaddr_in6), 0);
L
Linus Torvalds 已提交
1671 1672 1673 1674 1675 1676 1677
			if (rc >= 0)
				connected = 1;
		}
	}
	if (!connected) {
		psin_server->sin6_port = htons(RFC1001_PORT);
		rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
C
Cyrill Gorcunov 已提交
1678
				 psin_server, sizeof(struct sockaddr_in6), 0);
1679
		if (rc >= 0)
L
Linus Torvalds 已提交
1680 1681 1682 1683 1684 1685
			connected = 1;
	}

	/* give up here - unless we want to retry on different
		protocol families some day */
	if (!connected) {
S
Steve French 已提交
1686
		if (orig_port)
L
Linus Torvalds 已提交
1687
			psin_server->sin6_port = orig_port;
1688
		cFYI(1, ("Error %d connecting to server via ipv6", rc));
L
Linus Torvalds 已提交
1689 1690 1691 1692
		sock_release(*csocket);
		*csocket = NULL;
		return rc;
	}
1693 1694
	/* Eventually check for other socket options to change from
		the default. sock_setsockopt not used because it expects
L
Linus Torvalds 已提交
1695 1696
		user space buffer */
	(*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1697

L
Linus Torvalds 已提交
1698 1699 1700
	return rc;
}

1701 1702
void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
			  struct super_block *sb, struct smb_vol *vol_info)
1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713
{
	/* if we are reconnecting then should we check to see if
	 * any requested capabilities changed locally e.g. via
	 * remount but we can not do much about it here
	 * if they have (even if we could detect it by the following)
	 * Perhaps we could add a backpointer to array of sb from tcon
	 * or if we change to make all sb to same share the same
	 * sb as NFS - then we only have one backpointer to sb.
	 * What if we wanted to mount the server share twice once with
	 * and once without posixacls or posix paths? */
	__u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1714

1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726
	if (vol_info && vol_info->no_linux_ext) {
		tcon->fsUnixInfo.Capability = 0;
		tcon->unix_ext = 0; /* Unix Extensions disabled */
		cFYI(1, ("Linux protocol extensions disabled"));
		return;
	} else if (vol_info)
		tcon->unix_ext = 1; /* Unix Extensions supported */

	if (tcon->unix_ext == 0) {
		cFYI(1, ("Unix extensions disabled so not set on reconnect"));
		return;
	}
1727

S
Steve French 已提交
1728
	if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1729
		__u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1730

1731 1732
		/* check for reconnect case in which we do not
		   want to change the mount behavior if we can avoid it */
S
Steve French 已提交
1733
		if (vol_info == NULL) {
1734
			/* turn off POSIX ACL and PATHNAMES if not set
1735 1736 1737
			   originally at mount time */
			if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
				cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1738 1739 1740
			if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
				if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
					cERROR(1, ("POSIXPATH support change"));
1741
				cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1742 1743 1744 1745 1746
			} else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
				cERROR(1, ("possible reconnect error"));
				cERROR(1,
					("server disabled POSIX path support"));
			}
1747
		}
1748

1749
		cap &= CIFS_UNIX_CAP_MASK;
1750
		if (vol_info && vol_info->no_psx_acl)
1751
			cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1752
		else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
S
Steve French 已提交
1753 1754
			cFYI(1, ("negotiated posix acl support"));
			if (sb)
1755 1756 1757
				sb->s_flags |= MS_POSIXACL;
		}

1758
		if (vol_info && vol_info->posix_paths == 0)
1759
			cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1760
		else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
S
Steve French 已提交
1761
			cFYI(1, ("negotiate posix pathnames"));
1762
			if (sb)
1763
				CIFS_SB(sb)->mnt_cifs_flags |=
1764 1765
					CIFS_MOUNT_POSIX_PATHS;
		}
1766

1767 1768
		/* We might be setting the path sep back to a different
		form if we are reconnecting and the server switched its
1769
		posix path capability for this share */
1770
		if (sb && (CIFS_SB(sb)->prepathlen > 0))
1771
			CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1772 1773 1774 1775

		if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
			if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
				CIFS_SB(sb)->rsize = 127 * 1024;
1776 1777
				cFYI(DBG2,
					("larger reads not supported by srv"));
1778 1779
			}
		}
1780 1781 1782


		cFYI(1, ("Negotiate caps 0x%x", (int)cap));
1783
#ifdef CONFIG_CIFS_DEBUG2
1784
		if (cap & CIFS_UNIX_FCNTL_CAP)
S
Steve French 已提交
1785
			cFYI(1, ("FCNTL cap"));
1786
		if (cap & CIFS_UNIX_EXTATTR_CAP)
S
Steve French 已提交
1787
			cFYI(1, ("EXTATTR cap"));
1788
		if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
S
Steve French 已提交
1789
			cFYI(1, ("POSIX path cap"));
1790
		if (cap & CIFS_UNIX_XATTR_CAP)
S
Steve French 已提交
1791
			cFYI(1, ("XATTR cap"));
1792
		if (cap & CIFS_UNIX_POSIX_ACL_CAP)
S
Steve French 已提交
1793
			cFYI(1, ("POSIX ACL cap"));
1794
		if (cap & CIFS_UNIX_LARGE_READ_CAP)
S
Steve French 已提交
1795
			cFYI(1, ("very large read cap"));
1796
		if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
S
Steve French 已提交
1797
			cFYI(1, ("very large write cap"));
1798 1799
#endif /* CIFS_DEBUG2 */
		if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1800
			if (vol_info == NULL) {
1801
				cFYI(1, ("resetting capabilities failed"));
1802
			} else
1803 1804 1805 1806 1807
				cERROR(1, ("Negotiating Unix capabilities "
					   "with the server failed.  Consider "
					   "mounting with the Unix Extensions\n"
					   "disabled, if problems are found, "
					   "by specifying the nounix mount "
1808
					   "option."));
1809

1810 1811 1812 1813
		}
	}
}

1814 1815 1816 1817
static void
convert_delimiter(char *path, char delim)
{
	int i;
1818
	char old_delim;
1819 1820 1821 1822

	if (path == NULL)
		return;

1823
	if (delim == '/')
1824 1825 1826 1827
		old_delim = '\\';
	else
		old_delim = '/';

1828
	for (i = 0; path[i] != '\0'; i++) {
1829
		if (path[i] == old_delim)
1830 1831 1832 1833
			path[i] = delim;
	}
}

L
Linus Torvalds 已提交
1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852
int
cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
	   char *mount_data, const char *devname)
{
	int rc = 0;
	int xid;
	int address_type = AF_INET;
	struct socket *csocket = NULL;
	struct sockaddr_in sin_server;
	struct sockaddr_in6 sin_server6;
	struct smb_vol volume_info;
	struct cifsSesInfo *pSesInfo = NULL;
	struct cifsSesInfo *existingCifsSes = NULL;
	struct cifsTconInfo *tcon = NULL;
	struct TCP_Server_Info *srvTcp = NULL;

	xid = GetXid();

/* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1853 1854

	memset(&volume_info, 0, sizeof(struct smb_vol));
L
Linus Torvalds 已提交
1855
	if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1856 1857
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1858 1859
	}

1860
	if (volume_info.nullauth) {
S
Steve French 已提交
1861
		cFYI(1, ("null user"));
1862
		volume_info.username = "";
1863
	} else if (volume_info.username) {
L
Linus Torvalds 已提交
1864
		/* BB fixme parse for domain name here */
S
Steve French 已提交
1865
		cFYI(1, ("Username: %s", volume_info.username));
L
Linus Torvalds 已提交
1866
	} else {
1867
		cifserror("No username specified");
1868 1869
	/* In userspace mount helper we can get user name from alternate
	   locations such as env variables and files on disk */
1870 1871
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1872 1873 1874
	}

	if (volume_info.UNCip && volume_info.UNC) {
1875 1876
		rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
				    &sin_server.sin_addr.s_addr);
L
Linus Torvalds 已提交
1877

S
Steve French 已提交
1878
		if (rc <= 0) {
L
Linus Torvalds 已提交
1879
			/* not ipv4 address, try ipv6 */
1880 1881
			rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
					    &sin_server6.sin6_addr.in6_u);
S
Steve French 已提交
1882
			if (rc > 0)
L
Linus Torvalds 已提交
1883 1884 1885 1886
				address_type = AF_INET6;
		} else {
			address_type = AF_INET;
		}
1887

S
Steve French 已提交
1888
		if (rc <= 0) {
L
Linus Torvalds 已提交
1889
			/* we failed translating address */
1890 1891
			rc = -EINVAL;
			goto out;
L
Linus Torvalds 已提交
1892 1893 1894 1895 1896
		}

		cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
		/* success */
		rc = 0;
1897 1898 1899 1900
	} else if (volume_info.UNCip) {
		/* BB using ip addr as server name to connect to the
		   DFS root below */
		cERROR(1, ("Connecting to DFS root not implemented yet"));
1901 1902
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1903 1904
	} else /* which servers DFS root would we conect to */ {
		cERROR(1,
1905 1906
		       ("CIFS mount error: No UNC path (e.g. -o "
			"unc=//192.168.1.100/public) specified"));
1907 1908
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1909 1910 1911
	}

	/* this is needed for ASCII cp to Unicode converts */
S
Steve French 已提交
1912
	if (volume_info.iocharset == NULL) {
L
Linus Torvalds 已提交
1913 1914 1915 1916
		cifs_sb->local_nls = load_nls_default();
	/* load_nls_default can not return null */
	} else {
		cifs_sb->local_nls = load_nls(volume_info.iocharset);
S
Steve French 已提交
1917
		if (cifs_sb->local_nls == NULL) {
1918 1919
			cERROR(1, ("CIFS mount error: iocharset %s not found",
				 volume_info.iocharset));
1920 1921
			rc = -ELIBACC;
			goto out;
L
Linus Torvalds 已提交
1922 1923 1924
		}
	}

S
Steve French 已提交
1925
	if (address_type == AF_INET)
L
Linus Torvalds 已提交
1926 1927 1928
		existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
			NULL /* no ipv6 addr */,
			volume_info.username, &srvTcp);
S
Steve French 已提交
1929 1930
	else if (address_type == AF_INET6) {
		cFYI(1, ("looking for ipv6 address"));
L
Linus Torvalds 已提交
1931 1932 1933
		existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
			&sin_server6.sin6_addr,
			volume_info.username, &srvTcp);
S
Steve French 已提交
1934
	} else {
1935 1936
		rc = -EINVAL;
		goto out;
L
Linus Torvalds 已提交
1937 1938 1939
	}

	if (srvTcp) {
1940
		cFYI(1, ("Existing tcp session with server found"));
L
Linus Torvalds 已提交
1941
	} else {	/* create socket */
1942
		if (volume_info.port)
L
Linus Torvalds 已提交
1943 1944 1945
			sin_server.sin_port = htons(volume_info.port);
		else
			sin_server.sin_port = 0;
S
Steve French 已提交
1946
		if (address_type == AF_INET6) {
S
Steve French 已提交
1947
			cFYI(1, ("attempting ipv6 connect"));
S
Steve French 已提交
1948 1949
			/* BB should we allow ipv6 on port 139? */
			/* other OS never observed in Wild doing 139 with v6 */
1950 1951 1952
			rc = ipv6_connect(&sin_server6, &csocket);
		} else
			rc = ipv4_connect(&sin_server, &csocket,
1953 1954
				  volume_info.source_rfc1001_name,
				  volume_info.target_rfc1001_name);
L
Linus Torvalds 已提交
1955
		if (rc < 0) {
1956 1957
			cERROR(1, ("Error connecting to IPv4 socket. "
				   "Aborting operation"));
1958
			if (csocket != NULL)
L
Linus Torvalds 已提交
1959
				sock_release(csocket);
1960
			goto out;
L
Linus Torvalds 已提交
1961 1962
		}

1963 1964
		srvTcp = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
		if (!srvTcp) {
L
Linus Torvalds 已提交
1965 1966
			rc = -ENOMEM;
			sock_release(csocket);
1967
			goto out;
L
Linus Torvalds 已提交
1968
		} else {
1969
			memcpy(&srvTcp->addr.sockAddr, &sin_server,
C
Cyrill Gorcunov 已提交
1970
				sizeof(struct sockaddr_in));
1971
			atomic_set(&srvTcp->inFlight, 0);
L
Linus Torvalds 已提交
1972 1973 1974
			/* BB Add code for ipv6 case too */
			srvTcp->ssocket = csocket;
			srvTcp->protocolType = IPV4;
1975 1976 1977 1978 1979 1980
			srvTcp->hostname = extract_hostname(volume_info.UNC);
			if (IS_ERR(srvTcp->hostname)) {
				rc = PTR_ERR(srvTcp->hostname);
				sock_release(csocket);
				goto out;
			}
L
Linus Torvalds 已提交
1981 1982 1983 1984 1985 1986 1987 1988
			init_waitqueue_head(&srvTcp->response_q);
			init_waitqueue_head(&srvTcp->request_q);
			INIT_LIST_HEAD(&srvTcp->pending_mid_q);
			/* at this point we are the only ones with the pointer
			to the struct since the kernel thread not created yet
			so no need to spinlock this init of tcpStatus */
			srvTcp->tcpStatus = CifsNew;
			init_MUTEX(&srvTcp->tcpSem);
1989
			srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
S
Steve French 已提交
1990
			if (IS_ERR(srvTcp->tsk)) {
1991
				rc = PTR_ERR(srvTcp->tsk);
1992
				cERROR(1, ("error %d create cifsd thread", rc));
1993
				srvTcp->tsk = NULL;
L
Linus Torvalds 已提交
1994
				sock_release(csocket);
1995
				kfree(srvTcp->hostname);
1996
				goto out;
1997 1998
			}
			rc = 0;
1999 2000 2001 2002
			memcpy(srvTcp->workstation_RFC1001_name,
				volume_info.source_rfc1001_name, 16);
			memcpy(srvTcp->server_RFC1001_name,
				volume_info.target_rfc1001_name, 16);
2003
			srvTcp->sequence_number = 0;
L
Linus Torvalds 已提交
2004 2005 2006 2007 2008
		}
	}

	if (existingCifsSes) {
		pSesInfo = existingCifsSes;
2009 2010
		cFYI(1, ("Existing smb sess found (status=%d)",
			pSesInfo->status));
2011
		down(&pSesInfo->sesSem);
2012 2013 2014 2015 2016
		if (pSesInfo->status == CifsNeedReconnect) {
			cFYI(1, ("Session needs reconnect"));
			rc = cifs_setup_session(xid, pSesInfo,
						cifs_sb->local_nls);
		}
2017
		up(&pSesInfo->sesSem);
L
Linus Torvalds 已提交
2018
	} else if (!rc) {
2019
		cFYI(1, ("Existing smb sess not found"));
L
Linus Torvalds 已提交
2020 2021 2022 2023 2024 2025 2026 2027 2028
		pSesInfo = sesInfoAlloc();
		if (pSesInfo == NULL)
			rc = -ENOMEM;
		else {
			pSesInfo->server = srvTcp;
			sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
				NIPQUAD(sin_server.sin_addr.s_addr));
		}

2029 2030
		if (!rc) {
			/* volume_info.password freed at unmount */
2031
			if (volume_info.password) {
L
Linus Torvalds 已提交
2032
				pSesInfo->password = volume_info.password;
2033 2034 2035
				/* set to NULL to prevent freeing on exit */
				volume_info.password = NULL;
			}
L
Linus Torvalds 已提交
2036 2037
			if (volume_info.username)
				strncpy(pSesInfo->userName,
2038 2039
					volume_info.username,
					MAX_USERNAME_SIZE);
2040 2041
			if (volume_info.domainname) {
				int len = strlen(volume_info.domainname);
2042
				pSesInfo->domainName =
2043
					kmalloc(len + 1, GFP_KERNEL);
2044
				if (pSesInfo->domainName)
2045 2046 2047
					strcpy(pSesInfo->domainName,
						volume_info.domainname);
			}
L
Linus Torvalds 已提交
2048
			pSesInfo->linux_uid = volume_info.linux_uid;
2049
			pSesInfo->overrideSecFlg = volume_info.secFlg;
L
Linus Torvalds 已提交
2050
			down(&pSesInfo->sesSem);
2051
			/* BB FIXME need to pass vol->secFlgs BB */
2052 2053
			rc = cifs_setup_session(xid, pSesInfo,
						cifs_sb->local_nls);
L
Linus Torvalds 已提交
2054
			up(&pSesInfo->sesSem);
2055
			if (!rc)
L
Linus Torvalds 已提交
2056
				atomic_inc(&srvTcp->socketUseCount);
2057
		}
L
Linus Torvalds 已提交
2058
	}
2059

L
Linus Torvalds 已提交
2060 2061
	/* search for existing tcon to this server share */
	if (!rc) {
2062
		if (volume_info.rsize > CIFSMaxBufSize) {
2063
			cERROR(1, ("rsize %d too large, using MaxBufSize",
2064 2065
				volume_info.rsize));
			cifs_sb->rsize = CIFSMaxBufSize;
2066 2067
		} else if ((volume_info.rsize) &&
				(volume_info.rsize <= CIFSMaxBufSize))
L
Linus Torvalds 已提交
2068
			cifs_sb->rsize = volume_info.rsize;
2069 2070 2071
		else /* default */
			cifs_sb->rsize = CIFSMaxBufSize;

2072
		if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2073
			cERROR(1, ("wsize %d too large, using 4096 instead",
2074 2075
				  volume_info.wsize));
			cifs_sb->wsize = 4096;
2076
		} else if (volume_info.wsize)
L
Linus Torvalds 已提交
2077 2078
			cifs_sb->wsize = volume_info.wsize;
		else
2079
			cifs_sb->wsize =
S
Steve French 已提交
2080 2081
				min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
					127*1024);
2082
			/* old default of CIFSMaxBufSize was too small now
2083
			   that SMB Write2 can send multiple pages in kvec.
2084 2085 2086 2087 2088
			   RFC1001 does not describe what happens when frame
			   bigger than 128K is sent so use that as max in
			   conjunction with 52K kvec constraint on arch with 4K
			   page size  */

2089
		if (cifs_sb->rsize < 2048) {
2090
			cifs_sb->rsize = 2048;
2091
			/* Windows ME may prefer this */
S
Steve French 已提交
2092
			cFYI(1, ("readsize set to minimum: 2048"));
L
Linus Torvalds 已提交
2093
		}
2094 2095
		/* calculate prepath */
		cifs_sb->prepath = volume_info.prepath;
2096
		if (cifs_sb->prepath) {
2097
			cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2098 2099 2100 2101 2102
			/* we can not convert the / to \ in the path
			separators in the prefixpath yet because we do not
			know (until reset_cifs_unix_caps is called later)
			whether POSIX PATH CAP is available. We normalize
			the / to \ after reset_cifs_unix_caps is called */
2103
			volume_info.prepath = NULL;
2104
		} else
2105
			cifs_sb->prepathlen = 0;
L
Linus Torvalds 已提交
2106 2107 2108 2109
		cifs_sb->mnt_uid = volume_info.linux_uid;
		cifs_sb->mnt_gid = volume_info.linux_gid;
		cifs_sb->mnt_file_mode = volume_info.file_mode;
		cifs_sb->mnt_dir_mode = volume_info.dir_mode;
S
Steve French 已提交
2110 2111
		cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
			cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
L
Linus Torvalds 已提交
2112

2113
		if (volume_info.noperm)
L
Linus Torvalds 已提交
2114
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2115
		if (volume_info.setuids)
L
Linus Torvalds 已提交
2116
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2117
		if (volume_info.server_ino)
L
Linus Torvalds 已提交
2118
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2119
		if (volume_info.remap)
2120
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2121
		if (volume_info.no_xattr)
L
Linus Torvalds 已提交
2122
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2123
		if (volume_info.sfu_emul)
2124
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2125
		if (volume_info.nobrl)
2126
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2127
		if (volume_info.cifs_acl)
2128
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2129 2130 2131 2132
		if (volume_info.override_uid)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
		if (volume_info.override_gid)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2133 2134
		if (volume_info.dynperm)
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2135
		if (volume_info.direct_io) {
S
Steve French 已提交
2136
			cFYI(1, ("mounting share using direct i/o"));
L
Linus Torvalds 已提交
2137 2138 2139 2140 2141 2142 2143
			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
		}

		tcon =
		    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
			     volume_info.username);
		if (tcon) {
2144
			cFYI(1, ("Found match on UNC path"));
L
Linus Torvalds 已提交
2145 2146
			/* we can have only one retry value for a connection
			   to a share so for resources mounted more than once
2147
			   to the same server share the last value passed in
L
Linus Torvalds 已提交
2148 2149
			   for the retry flag is used */
			tcon->retry = volume_info.retry;
2150
			tcon->nocase = volume_info.nocase;
L
Linus Torvalds 已提交
2151 2152 2153 2154 2155
		} else {
			tcon = tconInfoAlloc();
			if (tcon == NULL)
				rc = -ENOMEM;
			else {
2156
				/* check for null share name ie connecting to
2157
				 * dfs root */
L
Linus Torvalds 已提交
2158

2159
				/* BB check if this works for exactly length
2160
				 * three strings */
L
Linus Torvalds 已提交
2161 2162 2163
				if ((strchr(volume_info.UNC + 3, '\\') == NULL)
				    && (strchr(volume_info.UNC + 3, '/') ==
					NULL)) {
2164
					rc = connect_to_dfs_path(xid, pSesInfo,
2165
						"", cifs_sb->local_nls,
2166
						cifs_sb->mnt_cifs_flags &
2167
						  CIFS_MOUNT_MAP_SPECIAL_CHR);
2168 2169
					rc = -ENODEV;
					goto out;
L
Linus Torvalds 已提交
2170
				} else {
2171 2172 2173
					/* BB Do we need to wrap sesSem around
					 * this TCon call and Unix SetFS as
					 * we do on SessSetup and reconnect? */
2174
					rc = CIFSTCon(xid, pSesInfo,
L
Linus Torvalds 已提交
2175 2176 2177 2178 2179 2180 2181
						volume_info.UNC,
						tcon, cifs_sb->local_nls);
					cFYI(1, ("CIFS Tcon rc = %d", rc));
				}
				if (!rc) {
					atomic_inc(&pSesInfo->inUse);
					tcon->retry = volume_info.retry;
2182
					tcon->nocase = volume_info.nocase;
L
Linus Torvalds 已提交
2183 2184 2185 2186
				}
			}
		}
	}
2187
	if (pSesInfo) {
L
Linus Torvalds 已提交
2188 2189 2190 2191 2192 2193
		if (pSesInfo->capabilities & CAP_LARGE_FILES) {
			sb->s_maxbytes = (u64) 1 << 63;
		} else
			sb->s_maxbytes = (u64) 1 << 31;	/* 2 GB */
	}

2194
	/* BB FIXME fix time_gran to be larger for LANMAN sessions */
L
Linus Torvalds 已提交
2195 2196 2197 2198 2199 2200
	sb->s_time_gran = 100;

/* on error free sesinfo and tcon struct if needed */
	if (rc) {
		/* if session setup failed, use count is zero but
		we still need to free cifsd thread */
2201
		if (atomic_read(&srvTcp->socketUseCount) == 0) {
L
Linus Torvalds 已提交
2202 2203 2204
			spin_lock(&GlobalMid_Lock);
			srvTcp->tcpStatus = CifsExiting;
			spin_unlock(&GlobalMid_Lock);
2205
			if (srvTcp->tsk) {
2206 2207 2208 2209
				/* If we could verify that kthread_stop would
				   always wake up processes blocked in
				   tcp in recv_mesg then we could remove the
				   send_sig call */
2210
				force_sig(SIGKILL, srvTcp->tsk);
2211
				kthread_stop(srvTcp->tsk);
2212
			}
L
Linus Torvalds 已提交
2213 2214 2215 2216 2217 2218
		}
		 /* If find_unc succeeded then rc == 0 so we can not end */
		if (tcon)  /* up accidently freeing someone elses tcon struct */
			tconInfoFree(tcon);
		if (existingCifsSes == NULL) {
			if (pSesInfo) {
2219
				if ((pSesInfo->server) &&
L
Linus Torvalds 已提交
2220 2221 2222 2223
				    (pSesInfo->status == CifsGood)) {
					int temp_rc;
					temp_rc = CIFSSMBLogoff(xid, pSesInfo);
					/* if the socketUseCount is now zero */
2224
					if ((temp_rc == -ESHUTDOWN) &&
2225
					    (pSesInfo->server) &&
2226 2227 2228
					    (pSesInfo->server->tsk)) {
						force_sig(SIGKILL,
							pSesInfo->server->tsk);
2229
						kthread_stop(pSesInfo->server->tsk);
2230
					}
2231
				} else {
L
Linus Torvalds 已提交
2232
					cFYI(1, ("No session or bad tcon"));
2233 2234 2235 2236
					if ((pSesInfo->server) &&
					    (pSesInfo->server->tsk)) {
						force_sig(SIGKILL,
							pSesInfo->server->tsk);
2237
						kthread_stop(pSesInfo->server->tsk);
2238 2239
					}
				}
L
Linus Torvalds 已提交
2240 2241 2242 2243 2244 2245 2246 2247 2248
				sesInfoFree(pSesInfo);
				/* pSesInfo = NULL; */
			}
		}
	} else {
		atomic_inc(&tcon->useCount);
		cifs_sb->tcon = tcon;
		tcon->ses = pSesInfo;

2249
		/* do not care if following two calls succeed - informational */
2250 2251 2252 2253
		if (!tcon->ipc) {
			CIFSSMBQFSDeviceInfo(xid, tcon);
			CIFSSMBQFSAttributeInfo(xid, tcon);
		}
2254

2255 2256
		/* tell server which Unix caps we support */
		if (tcon->ses->capabilities & CAP_UNIX)
2257 2258
			/* reset of caps checks mount to see if unix extensions
			   disabled for just this mount */
2259
			reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2260 2261 2262
		else
			tcon->unix_ext = 0; /* server does not support them */

2263
		/* convert forward to back slashes in prepath here if needed */
2264 2265 2266
		if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
			convert_delimiter(cifs_sb->prepath,
					  CIFS_DIR_SEP(cifs_sb));
2267

2268
		if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2269
			cifs_sb->rsize = 1024 * 127;
2270 2271
			cFYI(DBG2,
				("no very large read support, rsize now 127K"));
2272
		}
2273 2274 2275 2276
		if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
			cifs_sb->wsize = min(cifs_sb->wsize,
					     (tcon->ses->server->maxBuf -
					      MAX_CIFS_HDR_SIZE));
2277
		if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2278 2279 2280
			cifs_sb->rsize = min(cifs_sb->rsize,
					     (tcon->ses->server->maxBuf -
					      MAX_CIFS_HDR_SIZE));
L
Linus Torvalds 已提交
2281 2282 2283 2284 2285 2286
	}

	/* volume_info.password is freed above when existing session found
	(in which case it is not needed anymore) but when new sesion is created
	the password ptr is put in the new session structure (in which case the
	password will be freed at unmount time) */
2287 2288 2289 2290 2291 2292
out:
	/* zero out password before freeing */
	if (volume_info.password != NULL) {
		memset(volume_info.password, 0, strlen(volume_info.password));
		kfree(volume_info.password);
	}
J
Jesper Juhl 已提交
2293
	kfree(volume_info.UNC);
2294
	kfree(volume_info.prepath);
L
Linus Torvalds 已提交
2295 2296 2297 2298 2299 2300
	FreeXid(xid);
	return rc;
}

static int
CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2301
	      char session_key[CIFS_SESS_KEY_SIZE],
L
Linus Torvalds 已提交
2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317
	      const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *user;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
	__u32 capabilities;
	__u16 count;

2318
	cFYI(1, ("In sesssetup"));
2319
	if (ses == NULL)
L
Linus Torvalds 已提交
2320 2321 2322 2323
		return -EINVAL;
	user = ses->userName;
	domain = ses->domainName;
	smb_buffer = cifs_buf_get();
2324 2325

	if (smb_buffer == NULL)
L
Linus Torvalds 已提交
2326
		return -ENOMEM;
2327

L
Linus Torvalds 已提交
2328 2329 2330 2331 2332 2333 2334
	smb_buffer_response = smb_buffer;
	pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 13 /* wct */ );

2335
	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2336 2337 2338 2339
	pSMB->req_no_secext.AndXCommand = 0xFF;
	pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

2340 2341
	if (ses->server->secMode &
			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
		CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);

2360
	pSMB->req_no_secext.CaseInsensitivePasswordLength =
2361
		cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2362 2363

	pSMB->req_no_secext.CaseSensitivePasswordLength =
2364
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
2365
	bcc_ptr = pByteArea(smb_buffer);
2366 2367 2368 2369
	memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
	bcc_ptr += CIFS_SESS_KEY_SIZE;
	memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
	bcc_ptr += CIFS_SESS_KEY_SIZE;
L
Linus Torvalds 已提交
2370 2371 2372 2373 2374 2375

	if (ses->capabilities & CAP_UNICODE) {
		if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
			*bcc_ptr = 0;
			bcc_ptr++;
		}
2376
		if (user == NULL)
2377
			bytes_returned = 0; /* skip null user */
2378
		else
L
Linus Torvalds 已提交
2379
			bytes_returned =
2380
				cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
L
Linus Torvalds 已提交
2381 2382 2383 2384 2385 2386
					nls_codepage);
		/* convert number of 16 bit words to bytes */
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* trailing null */
		if (domain == NULL)
			bytes_returned =
2387
			    cifs_strtoUCS((__le16 *) bcc_ptr,
L
Linus Torvalds 已提交
2388 2389 2390
					  "CIFS_LINUX_DOM", 32, nls_codepage);
		else
			bytes_returned =
2391
			    cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
L
Linus Torvalds 已提交
2392 2393 2394 2395
					  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
		bytes_returned =
2396
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
2397 2398 2399
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
2400
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
L
Linus Torvalds 已提交
2401 2402 2403 2404
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
		bytes_returned =
2405
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
2406 2407 2408 2409
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;
	} else {
2410
		if (user != NULL) {
L
Linus Torvalds 已提交
2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426
		    strncpy(bcc_ptr, user, 200);
		    bcc_ptr += strnlen(user, 200);
		}
		*bcc_ptr = 0;
		bcc_ptr++;
		if (domain == NULL) {
			strcpy(bcc_ptr, "CIFS_LINUX_DOM");
			bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
		} else {
			strncpy(bcc_ptr, domain, 64);
			bcc_ptr += strnlen(domain, 64);
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
2427 2428
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
2429 2430 2431 2432 2433 2434 2435 2436
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
	}
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req_no_secext.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2437
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
2438 2439 2440 2441 2442 2443 2444
	if (rc) {
/* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
	} else if ((smb_buffer_response->WordCount == 3)
		   || (smb_buffer_response->WordCount == 4)) {
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
		if (action & GUEST_LOGIN)
2445 2446 2447
			cFYI(1, (" Guest login")); /* BB mark SesInfo struct? */
		ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
							 (little endian) */
L
Linus Torvalds 已提交
2448
		cFYI(1, ("UID = %d ", ses->Suid));
2449 2450
	/* response can have either 3 or 4 word count - Samba sends 3 */
		bcc_ptr = pByteArea(smb_buffer_response);
L
Linus Torvalds 已提交
2451 2452 2453 2454 2455 2456 2457 2458 2459
		if ((pSMBr->resp.hdr.WordCount == 3)
		    || ((pSMBr->resp.hdr.WordCount == 4)
			&& (blob_len < pSMBr->resp.ByteCount))) {
			if (pSMBr->resp.hdr.WordCount == 4)
				bcc_ptr += blob_len;

			if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
				if ((long) (bcc_ptr) % 2) {
					remaining_words =
2460 2461 2462 2463
					    (BCC(smb_buffer_response) - 1) / 2;
					/* Unicode strings must be word
					   aligned */
					bcc_ptr++;
L
Linus Torvalds 已提交
2464 2465 2466 2467 2468 2469 2470 2471 2472 2473
				} else {
					remaining_words =
						BCC(smb_buffer_response) / 2;
				}
				len =
				    UniStrnlen((wchar_t *) bcc_ptr,
					       remaining_words - 1);
/* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
S
Steve French 已提交
2474
				if (ses->serverOS)
2475
					kfree(ses->serverOS);
2476 2477
				ses->serverOS = kzalloc(2 * (len + 1),
							GFP_KERNEL);
S
Steve French 已提交
2478
				if (ses->serverOS == NULL)
2479
					goto sesssetup_nomem;
L
Linus Torvalds 已提交
2480
				cifs_strfromUCS_le(ses->serverOS,
2481 2482
						   (__le16 *)bcc_ptr,
						   len, nls_codepage);
L
Linus Torvalds 已提交
2483 2484 2485 2486 2487 2488 2489
				bcc_ptr += 2 * (len + 1);
				remaining_words -= len + 1;
				ses->serverOS[2 * len] = 0;
				ses->serverOS[1 + (2 * len)] = 0;
				if (remaining_words > 0) {
					len = UniStrnlen((wchar_t *)bcc_ptr,
							 remaining_words-1);
2490
					kfree(ses->serverNOS);
2491 2492
					ses->serverNOS = kzalloc(2 * (len + 1),
								 GFP_KERNEL);
S
Steve French 已提交
2493
					if (ses->serverNOS == NULL)
2494
						goto sesssetup_nomem;
L
Linus Torvalds 已提交
2495
					cifs_strfromUCS_le(ses->serverNOS,
2496 2497
							   (__le16 *)bcc_ptr,
							   len, nls_codepage);
L
Linus Torvalds 已提交
2498 2499 2500
					bcc_ptr += 2 * (len + 1);
					ses->serverNOS[2 * len] = 0;
					ses->serverNOS[1 + (2 * len)] = 0;
S
Steve French 已提交
2501
					if (strncmp(ses->serverNOS,
2502
						"NT LAN Manager 4", 16) == 0) {
S
Steve French 已提交
2503
						cFYI(1, ("NT4 server"));
L
Linus Torvalds 已提交
2504 2505 2506 2507
						ses->flags |= CIFS_SES_NT4;
					}
					remaining_words -= len + 1;
					if (remaining_words > 0) {
2508
						len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2509 2510
				/* last string is not always null terminated
				   (for e.g. for Windows XP & 2000) */
S
Steve French 已提交
2511
						if (ses->serverDomain)
2512
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2513
						ses->serverDomain =
2514 2515
						    kzalloc(2*(len+1),
							    GFP_KERNEL);
S
Steve French 已提交
2516
						if (ses->serverDomain == NULL)
2517
							goto sesssetup_nomem;
L
Linus Torvalds 已提交
2518
						cifs_strfromUCS_le(ses->serverDomain,
2519 2520
							(__le16 *)bcc_ptr,
							len, nls_codepage);
L
Linus Torvalds 已提交
2521 2522 2523
						bcc_ptr += 2 * (len + 1);
						ses->serverDomain[2*len] = 0;
						ses->serverDomain[1+(2*len)] = 0;
2524 2525
					} else { /* else no more room so create
						  dummy domain string */
S
Steve French 已提交
2526
						if (ses->serverDomain)
2527
							kfree(ses->serverDomain);
2528
						ses->serverDomain =
2529
							kzalloc(2, GFP_KERNEL);
2530
					}
2531 2532 2533
				} else { /* no room so create dummy domain
					    and NOS string */

2534 2535 2536
					/* if these kcallocs fail not much we
					   can do, but better to not fail the
					   sesssetup itself */
2537
					kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2538
					ses->serverDomain =
2539
					    kzalloc(2, GFP_KERNEL);
2540
					kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2541
					ses->serverNOS =
2542
					    kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
2543 2544 2545 2546 2547 2548
				}
			} else {	/* ASCII */
				len = strnlen(bcc_ptr, 1024);
				if (((long) bcc_ptr + len) - (long)
				    pByteArea(smb_buffer_response)
					    <= BCC(smb_buffer_response)) {
2549
					kfree(ses->serverOS);
2550 2551
					ses->serverOS = kzalloc(len + 1,
								GFP_KERNEL);
S
Steve French 已提交
2552
					if (ses->serverOS == NULL)
2553
						goto sesssetup_nomem;
2554
					strncpy(ses->serverOS, bcc_ptr, len);
L
Linus Torvalds 已提交
2555 2556

					bcc_ptr += len;
2557 2558
					/* null terminate the string */
					bcc_ptr[0] = 0;
L
Linus Torvalds 已提交
2559 2560 2561
					bcc_ptr++;

					len = strnlen(bcc_ptr, 1024);
2562
					kfree(ses->serverNOS);
2563 2564
					ses->serverNOS = kzalloc(len + 1,
								 GFP_KERNEL);
S
Steve French 已提交
2565
					if (ses->serverNOS == NULL)
2566
						goto sesssetup_nomem;
L
Linus Torvalds 已提交
2567 2568 2569 2570 2571 2572
					strncpy(ses->serverNOS, bcc_ptr, len);
					bcc_ptr += len;
					bcc_ptr[0] = 0;
					bcc_ptr++;

					len = strnlen(bcc_ptr, 1024);
S
Steve French 已提交
2573
					if (ses->serverDomain)
2574
						kfree(ses->serverDomain);
2575 2576
					ses->serverDomain = kzalloc(len + 1,
								    GFP_KERNEL);
S
Steve French 已提交
2577
					if (ses->serverDomain == NULL)
2578
						goto sesssetup_nomem;
2579 2580
					strncpy(ses->serverDomain, bcc_ptr,
						len);
L
Linus Torvalds 已提交
2581 2582 2583 2584 2585
					bcc_ptr += len;
					bcc_ptr[0] = 0;
					bcc_ptr++;
				} else
					cFYI(1,
2586 2587
					     ("Variable field of length %d "
						"extends beyond end of smb ",
L
Linus Torvalds 已提交
2588 2589 2590 2591
					      len));
			}
		} else {
			cERROR(1,
2592 2593
			       (" Security Blob Length extends beyond "
				"end of SMB"));
L
Linus Torvalds 已提交
2594 2595 2596 2597 2598 2599 2600
		}
	} else {
		cERROR(1,
		       (" Invalid Word count %d: ",
			smb_buffer_response->WordCount));
		rc = -EIO;
	}
2601 2602 2603
sesssetup_nomem:	/* do not return an error on nomem for the info strings,
			   since that could make reconnection harder, and
			   reconnection might be needed to free memory */
2604
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
2605 2606 2607 2608 2609 2610

	return rc;
}

static int
CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2611
			      struct cifsSesInfo *ses, bool *pNTLMv2_flag,
L
Linus Torvalds 已提交
2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623
			      const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
C
Cyrill Gorcunov 已提交
2624
	int SecurityBlobLength = sizeof(NEGOTIATE_MESSAGE);
L
Linus Torvalds 已提交
2625 2626 2627 2628 2629
	PNEGOTIATE_MESSAGE SecurityBlob;
	PCHALLENGE_MESSAGE SecurityBlob2;
	__u32 negotiate_flags, capabilities;
	__u16 count;

2630
	cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
S
Steve French 已提交
2631
	if (ses == NULL)
L
Linus Torvalds 已提交
2632 2633
		return -EINVAL;
	domain = ses->domainName;
2634
	*pNTLMv2_flag = false;
L
Linus Torvalds 已提交
2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
	pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
	pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 12 /* wct */ );
2646 2647

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2648 2649 2650 2651 2652 2653 2654
	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
	pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);

	pSMB->req.AndXCommand = 0xFF;
	pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

S
Steve French 已提交
2655
	if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
	    CAP_EXTENDED_SECURITY;
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req.Capabilities = cpu_to_le32(capabilities);

	bcc_ptr = (char *) &pSMB->req.SecurityBlob;
	SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
	strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
	SecurityBlob->MessageType = NtLmNegotiate;
	negotiate_flags =
	    NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2680 2681
	    NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
	    NTLMSSP_NEGOTIATE_56 |
L
Linus Torvalds 已提交
2682
	    /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
S
Steve French 已提交
2683
	if (sign_CIFS_PDUs)
L
Linus Torvalds 已提交
2684
		negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
S
Steve French 已提交
2685
/*	if (ntlmv2_support)
2686
		negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
L
Linus Torvalds 已提交
2687 2688 2689 2690 2691 2692 2693
	/* setup pointers to domain name and workstation name */
	bcc_ptr += SecurityBlobLength;

	SecurityBlob->WorkstationName.Buffer = 0;
	SecurityBlob->WorkstationName.Length = 0;
	SecurityBlob->WorkstationName.MaximumLength = 0;

2694 2695 2696 2697 2698
	/* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
	along with username on auth request (ie the response to challenge) */
	SecurityBlob->DomainName.Buffer = 0;
	SecurityBlob->DomainName.Length = 0;
	SecurityBlob->DomainName.MaximumLength = 0;
L
Linus Torvalds 已提交
2699 2700 2701 2702 2703 2704 2705
	if (ses->capabilities & CAP_UNICODE) {
		if ((long) bcc_ptr % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}

		bytes_returned =
2706
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
2707 2708 2709
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
2710
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
L
Linus Torvalds 已提交
2711 2712 2713 2714
				  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* null terminate Linux version */
		bytes_returned =
2715
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null terminate network opsys string */
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null domain */
	} else {		/* ASCII */
		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
2727 2728
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
		bcc_ptr++;	/* empty domain field */
		*bcc_ptr = 0;
	}
	SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
	pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2741
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754

	if (smb_buffer_response->Status.CifsError ==
	    cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
		rc = 0;

	if (rc) {
/*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
	} else if ((smb_buffer_response->WordCount == 3)
		   || (smb_buffer_response->WordCount == 4)) {
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);

		if (action & GUEST_LOGIN)
2755 2756
			cFYI(1, (" Guest login"));
	/* Do we want to set anything in SesInfo struct when guest login? */
L
Linus Torvalds 已提交
2757

2758 2759
		bcc_ptr = pByteArea(smb_buffer_response);
	/* response can have either 3 or 4 word count - Samba sends 3 */
L
Linus Torvalds 已提交
2760 2761 2762 2763 2764 2765 2766

		SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
		if (SecurityBlob2->MessageType != NtLmChallenge) {
			cFYI(1,
			     ("Unexpected NTLMSSP message type received %d",
			      SecurityBlob2->MessageType));
		} else if (ses) {
2767
			ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2768
			cFYI(1, ("UID = %d", ses->Suid));
L
Linus Torvalds 已提交
2769 2770 2771 2772 2773 2774 2775
			if ((pSMBr->resp.hdr.WordCount == 3)
			    || ((pSMBr->resp.hdr.WordCount == 4)
				&& (blob_len <
				    pSMBr->resp.ByteCount))) {

				if (pSMBr->resp.hdr.WordCount == 4) {
					bcc_ptr += blob_len;
2776
					cFYI(1, ("Security Blob Length %d",
L
Linus Torvalds 已提交
2777 2778 2779
					      blob_len));
				}

2780
				cFYI(1, ("NTLMSSP Challenge rcvd"));
L
Linus Torvalds 已提交
2781 2782 2783 2784

				memcpy(ses->server->cryptKey,
				       SecurityBlob2->Challenge,
				       CIFS_CRYPTO_KEY_SIZE);
2785
				if (SecurityBlob2->NegotiateFlags &
2786
					cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2787
					*pNTLMv2_flag = true;
L
Linus Torvalds 已提交
2788

2789 2790
				if ((SecurityBlob2->NegotiateFlags &
					cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
L
Linus Torvalds 已提交
2791
					|| (sign_CIFS_PDUs > 1))
2792 2793 2794
						ses->server->secMode |=
							SECMODE_SIGN_REQUIRED;
				if ((SecurityBlob2->NegotiateFlags &
L
Linus Torvalds 已提交
2795
					cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2796
						ses->server->secMode |=
L
Linus Torvalds 已提交
2797 2798 2799 2800 2801 2802 2803
							SECMODE_SIGN_ENABLED;

				if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
					if ((long) (bcc_ptr) % 2) {
						remaining_words =
						    (BCC(smb_buffer_response)
						     - 1) / 2;
2804 2805
					 /* Must word align unicode strings */
						bcc_ptr++;
L
Linus Torvalds 已提交
2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816
					} else {
						remaining_words =
						    BCC
						    (smb_buffer_response) / 2;
					}
					len =
					    UniStrnlen((wchar_t *) bcc_ptr,
						       remaining_words - 1);
/* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
S
Steve French 已提交
2817
					if (ses->serverOS)
2818
						kfree(ses->serverOS);
L
Linus Torvalds 已提交
2819
					ses->serverOS =
2820
					    kzalloc(2 * (len + 1), GFP_KERNEL);
L
Linus Torvalds 已提交
2821
					cifs_strfromUCS_le(ses->serverOS,
2822
							   (__le16 *)
L
Linus Torvalds 已提交
2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833
							   bcc_ptr, len,
							   nls_codepage);
					bcc_ptr += 2 * (len + 1);
					remaining_words -= len + 1;
					ses->serverOS[2 * len] = 0;
					ses->serverOS[1 + (2 * len)] = 0;
					if (remaining_words > 0) {
						len = UniStrnlen((wchar_t *)
								 bcc_ptr,
								 remaining_words
								 - 1);
2834
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2835
						ses->serverNOS =
2836
						    kzalloc(2 * (len + 1),
L
Linus Torvalds 已提交
2837 2838 2839
							    GFP_KERNEL);
						cifs_strfromUCS_le(ses->
								   serverNOS,
2840
								   (__le16 *)
L
Linus Torvalds 已提交
2841 2842 2843 2844 2845 2846 2847 2848 2849
								   bcc_ptr,
								   len,
								   nls_codepage);
						bcc_ptr += 2 * (len + 1);
						ses->serverNOS[2 * len] = 0;
						ses->serverNOS[1 +
							       (2 * len)] = 0;
						remaining_words -= len + 1;
						if (remaining_words > 0) {
2850 2851 2852
							len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
				/* last string not always null terminated
				   (for e.g. for Windows XP & 2000) */
2853
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2854
							ses->serverDomain =
2855
							    kzalloc(2 *
L
Linus Torvalds 已提交
2856 2857 2858 2859
								    (len +
								     1),
								    GFP_KERNEL);
							cifs_strfromUCS_le
2860 2861 2862
							    (ses->serverDomain,
							     (__le16 *)bcc_ptr,
							     len, nls_codepage);
L
Linus Torvalds 已提交
2863 2864
							bcc_ptr +=
							    2 * (len + 1);
2865
							ses->serverDomain[2*len]
L
Linus Torvalds 已提交
2866
							    = 0;
2867 2868
							ses->serverDomain
								[1 + (2 * len)]
L
Linus Torvalds 已提交
2869 2870
							    = 0;
						} /* else no more room so create dummy domain string */
2871
						else {
2872
							kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2873
							ses->serverDomain =
2874
							    kzalloc(2,
L
Linus Torvalds 已提交
2875
								    GFP_KERNEL);
2876
						}
L
Linus Torvalds 已提交
2877
					} else {	/* no room so create dummy domain and NOS string */
2878
						kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2879
						ses->serverDomain =
2880
						    kzalloc(2, GFP_KERNEL);
2881
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2882
						ses->serverNOS =
2883
						    kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
2884 2885 2886 2887 2888 2889
					}
				} else {	/* ASCII */
					len = strnlen(bcc_ptr, 1024);
					if (((long) bcc_ptr + len) - (long)
					    pByteArea(smb_buffer_response)
					    <= BCC(smb_buffer_response)) {
S
Steve French 已提交
2890
						if (ses->serverOS)
2891
							kfree(ses->serverOS);
L
Linus Torvalds 已提交
2892
						ses->serverOS =
2893
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2894 2895 2896 2897 2898 2899 2900 2901 2902
							    GFP_KERNEL);
						strncpy(ses->serverOS,
							bcc_ptr, len);

						bcc_ptr += len;
						bcc_ptr[0] = 0;	/* null terminate string */
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
2903
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
2904
						ses->serverNOS =
2905
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2906 2907 2908 2909 2910 2911 2912
							    GFP_KERNEL);
						strncpy(ses->serverNOS, bcc_ptr, len);
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
2913
						kfree(ses->serverDomain);
L
Linus Torvalds 已提交
2914
						ses->serverDomain =
2915
						    kzalloc(len + 1,
L
Linus Torvalds 已提交
2916
							    GFP_KERNEL);
2917 2918
						strncpy(ses->serverDomain,
							bcc_ptr, len);
L
Linus Torvalds 已提交
2919 2920 2921 2922 2923
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;
					} else
						cFYI(1,
2924 2925
						     ("field of length %d "
						    "extends beyond end of smb",
L
Linus Torvalds 已提交
2926 2927 2928
						      len));
				}
			} else {
2929 2930
				cERROR(1, ("Security Blob Length extends beyond"
					   " end of SMB"));
L
Linus Torvalds 已提交
2931 2932 2933 2934 2935 2936
			}
		} else {
			cERROR(1, ("No session structure passed in."));
		}
	} else {
		cERROR(1,
2937
		       (" Invalid Word count %d:",
L
Linus Torvalds 已提交
2938 2939 2940 2941
			smb_buffer_response->WordCount));
		rc = -EIO;
	}

2942
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
2943 2944 2945 2946 2947

	return rc;
}
static int
CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2948
			char *ntlm_session_key, bool ntlmv2_flag,
C
Cyrill Gorcunov 已提交
2949
			const struct nls_table *nls_codepage)
L
Linus Torvalds 已提交
2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	SESSION_SETUP_ANDX *pSMB;
	SESSION_SETUP_ANDX *pSMBr;
	char *bcc_ptr;
	char *user;
	char *domain;
	int rc = 0;
	int remaining_words = 0;
	int bytes_returned = 0;
	int len;
C
Cyrill Gorcunov 已提交
2962
	int SecurityBlobLength = sizeof(AUTHENTICATE_MESSAGE);
L
Linus Torvalds 已提交
2963 2964 2965 2966 2967
	PAUTHENTICATE_MESSAGE SecurityBlob;
	__u32 negotiate_flags, capabilities;
	__u16 count;

	cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
S
Steve French 已提交
2968
	if (ses == NULL)
L
Linus Torvalds 已提交
2969 2970 2971 2972 2973 2974 2975 2976
		return -EINVAL;
	user = ses->userName;
	domain = ses->domainName;
	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;
C
Cyrill Gorcunov 已提交
2977 2978
	pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
	pSMBr = (SESSION_SETUP_ANDX *)smb_buffer_response;
L
Linus Torvalds 已提交
2979 2980 2981 2982

	/* send SMBsessionSetup here */
	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
			NULL /* no tCon exists yet */ , 12 /* wct */ );
2983 2984

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
2985 2986 2987 2988 2989 2990 2991 2992
	pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
	pSMB->req.AndXCommand = 0xFF;
	pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
	pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);

	pSMB->req.hdr.Uid = ses->Suid;

S
Steve French 已提交
2993
	if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
2994 2995 2996
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
C
Cyrill Gorcunov 已提交
2997
			CAP_EXTENDED_SECURITY;
L
Linus Torvalds 已提交
2998 2999 3000 3001 3002 3003 3004 3005 3006 3007 3008 3009 3010 3011
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		capabilities |= CAP_UNICODE;
	}
	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
		capabilities |= CAP_STATUS32;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
		capabilities |= CAP_DFS;
	}
	pSMB->req.Capabilities = cpu_to_le32(capabilities);

C
Cyrill Gorcunov 已提交
3012 3013
	bcc_ptr = (char *)&pSMB->req.SecurityBlob;
	SecurityBlob = (PAUTHENTICATE_MESSAGE)bcc_ptr;
L
Linus Torvalds 已提交
3014 3015 3016
	strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
	SecurityBlob->MessageType = NtLmAuthenticate;
	bcc_ptr += SecurityBlobLength;
C
Cyrill Gorcunov 已提交
3017 3018 3019
	negotiate_flags = NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
			NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
			0x80000000 | NTLMSSP_NEGOTIATE_128;
S
Steve French 已提交
3020
	if (sign_CIFS_PDUs)
L
Linus Torvalds 已提交
3021
		negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
S
Steve French 已提交
3022
	if (ntlmv2_flag)
L
Linus Torvalds 已提交
3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038
		negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;

/* setup pointers to domain name and workstation name */

	SecurityBlob->WorkstationName.Buffer = 0;
	SecurityBlob->WorkstationName.Length = 0;
	SecurityBlob->WorkstationName.MaximumLength = 0;
	SecurityBlob->SessionKey.Length = 0;
	SecurityBlob->SessionKey.MaximumLength = 0;
	SecurityBlob->SessionKey.Buffer = 0;

	SecurityBlob->LmChallengeResponse.Length = 0;
	SecurityBlob->LmChallengeResponse.MaximumLength = 0;
	SecurityBlob->LmChallengeResponse.Buffer = 0;

	SecurityBlob->NtChallengeResponse.Length =
3039
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
3040
	SecurityBlob->NtChallengeResponse.MaximumLength =
3041 3042
	    cpu_to_le16(CIFS_SESS_KEY_SIZE);
	memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
L
Linus Torvalds 已提交
3043 3044
	SecurityBlob->NtChallengeResponse.Buffer =
	    cpu_to_le32(SecurityBlobLength);
3045 3046
	SecurityBlobLength += CIFS_SESS_KEY_SIZE;
	bcc_ptr += CIFS_SESS_KEY_SIZE;
L
Linus Torvalds 已提交
3047 3048 3049 3050 3051 3052 3053

	if (ses->capabilities & CAP_UNICODE) {
		if (domain == NULL) {
			SecurityBlob->DomainName.Buffer = 0;
			SecurityBlob->DomainName.Length = 0;
			SecurityBlob->DomainName.MaximumLength = 0;
		} else {
3054
			__u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
L
Linus Torvalds 已提交
3055
					  nls_codepage);
3056
			ln *= 2;
L
Linus Torvalds 已提交
3057
			SecurityBlob->DomainName.MaximumLength =
3058
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3059 3060
			SecurityBlob->DomainName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3061 3062 3063
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->DomainName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3064 3065 3066 3067 3068 3069
		}
		if (user == NULL) {
			SecurityBlob->UserName.Buffer = 0;
			SecurityBlob->UserName.Length = 0;
			SecurityBlob->UserName.MaximumLength = 0;
		} else {
3070
			__u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
L
Linus Torvalds 已提交
3071
					  nls_codepage);
3072
			ln *= 2;
L
Linus Torvalds 已提交
3073
			SecurityBlob->UserName.MaximumLength =
3074
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3075 3076
			SecurityBlob->UserName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3077 3078 3079
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->UserName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3080 3081
		}

3082 3083
		/* SecurityBlob->WorkstationName.Length =
		 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
L
Linus Torvalds 已提交
3084
		   SecurityBlob->WorkstationName.Length *= 2;
3085 3086 3087 3088
		   SecurityBlob->WorkstationName.MaximumLength =
			cpu_to_le16(SecurityBlob->WorkstationName.Length);
		   SecurityBlob->WorkstationName.Buffer =
				 cpu_to_le32(SecurityBlobLength);
L
Linus Torvalds 已提交
3089 3090
		   bcc_ptr += SecurityBlob->WorkstationName.Length;
		   SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3091 3092
		   SecurityBlob->WorkstationName.Length =
			cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
L
Linus Torvalds 已提交
3093 3094 3095 3096 3097 3098

		if ((long) bcc_ptr % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		bytes_returned =
3099
		    cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
L
Linus Torvalds 已提交
3100 3101 3102
				  32, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bytes_returned =
3103
		    cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
L
Linus Torvalds 已提交
3104 3105 3106 3107
				  nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		bcc_ptr += 2;	/* null term version string */
		bytes_returned =
3108
		    cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
L
Linus Torvalds 已提交
3109 3110 3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122
				  64, nls_codepage);
		bcc_ptr += 2 * bytes_returned;
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null terminate network opsys string */
		*(bcc_ptr + 1) = 0;
		*(bcc_ptr + 2) = 0;
		bcc_ptr += 2;	/* null domain */
	} else {		/* ASCII */
		if (domain == NULL) {
			SecurityBlob->DomainName.Buffer = 0;
			SecurityBlob->DomainName.Length = 0;
			SecurityBlob->DomainName.MaximumLength = 0;
		} else {
3123
			__u16 ln;
L
Linus Torvalds 已提交
3124 3125
			negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
			strncpy(bcc_ptr, domain, 63);
3126
			ln = strnlen(domain, 64);
L
Linus Torvalds 已提交
3127
			SecurityBlob->DomainName.MaximumLength =
3128
			    cpu_to_le16(ln);
L
Linus Torvalds 已提交
3129 3130
			SecurityBlob->DomainName.Buffer =
			    cpu_to_le32(SecurityBlobLength);
3131 3132 3133
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->DomainName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3134 3135 3136 3137 3138 3139
		}
		if (user == NULL) {
			SecurityBlob->UserName.Buffer = 0;
			SecurityBlob->UserName.Length = 0;
			SecurityBlob->UserName.MaximumLength = 0;
		} else {
3140
			__u16 ln;
L
Linus Torvalds 已提交
3141
			strncpy(bcc_ptr, user, 63);
3142 3143
			ln = strnlen(user, 64);
			SecurityBlob->UserName.MaximumLength = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3144
			SecurityBlob->UserName.Buffer =
3145 3146 3147 3148
						cpu_to_le32(SecurityBlobLength);
			bcc_ptr += ln;
			SecurityBlobLength += ln;
			SecurityBlob->UserName.Length = cpu_to_le16(ln);
L
Linus Torvalds 已提交
3149 3150 3151 3152 3153
		}
		/* BB fill in our workstation name if known BB */

		strcpy(bcc_ptr, "Linux version ");
		bcc_ptr += strlen("Linux version ");
3154 3155
		strcpy(bcc_ptr, utsname()->release);
		bcc_ptr += strlen(utsname()->release) + 1;
L
Linus Torvalds 已提交
3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167
		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
		bcc_ptr++;	/* null domain */
		*bcc_ptr = 0;
	}
	SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
	pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
	smb_buffer->smb_buf_length += count;
	pSMB->req.ByteCount = cpu_to_le16(count);

	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3168
			 &bytes_returned, CIFS_LONG_OP);
L
Linus Torvalds 已提交
3169
	if (rc) {
C
Cyrill Gorcunov 已提交
3170 3171 3172
/*   rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
	} else if ((smb_buffer_response->WordCount == 3) ||
		   (smb_buffer_response->WordCount == 4)) {
L
Linus Torvalds 已提交
3173
		__u16 action = le16_to_cpu(pSMBr->resp.Action);
C
Cyrill Gorcunov 已提交
3174
		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
L
Linus Torvalds 已提交
3175
		if (action & GUEST_LOGIN)
3176 3177 3178 3179 3180 3181
			cFYI(1, (" Guest login")); /* BB Should we set anything
							 in SesInfo struct ? */
/*		if (SecurityBlob2->MessageType != NtLm??) {
			cFYI("Unexpected message type on auth response is %d"));
		} */

L
Linus Torvalds 已提交
3182 3183
		if (ses) {
			cFYI(1,
3184
			     ("Check challenge UID %d vs auth response UID %d",
L
Linus Torvalds 已提交
3185
			      ses->Suid, smb_buffer_response->Uid));
3186 3187 3188 3189
			/* UID left in wire format */
			ses->Suid = smb_buffer_response->Uid;
			bcc_ptr = pByteArea(smb_buffer_response);
		/* response can have either 3 or 4 word count - Samba sends 3 */
L
Linus Torvalds 已提交
3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 3213
			if ((pSMBr->resp.hdr.WordCount == 3)
			    || ((pSMBr->resp.hdr.WordCount == 4)
				&& (blob_len <
				    pSMBr->resp.ByteCount))) {
				if (pSMBr->resp.hdr.WordCount == 4) {
					bcc_ptr +=
					    blob_len;
					cFYI(1,
					     ("Security Blob Length %d ",
					      blob_len));
				}

				cFYI(1,
				     ("NTLMSSP response to Authenticate "));

				if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
					if ((long) (bcc_ptr) % 2) {
						remaining_words =
						    (BCC(smb_buffer_response)
						     - 1) / 2;
						bcc_ptr++;	/* Unicode strings must be word aligned */
					} else {
						remaining_words = BCC(smb_buffer_response) / 2;
					}
3214 3215
					len = UniStrnlen((wchar_t *) bcc_ptr,
							remaining_words - 1);
L
Linus Torvalds 已提交
3216 3217 3218
/* We look for obvious messed up bcc or strings in response so we do not go off
  the end since (at least) WIN2K and Windows XP have a major bug in not null
  terminating last Unicode string in response  */
S
Steve French 已提交
3219
					if (ses->serverOS)
S
Steve French 已提交
3220
						kfree(ses->serverOS);
L
Linus Torvalds 已提交
3221
					ses->serverOS =
3222
					    kzalloc(2 * (len + 1), GFP_KERNEL);
L
Linus Torvalds 已提交
3223
					cifs_strfromUCS_le(ses->serverOS,
3224
							   (__le16 *)
L
Linus Torvalds 已提交
3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235
							   bcc_ptr, len,
							   nls_codepage);
					bcc_ptr += 2 * (len + 1);
					remaining_words -= len + 1;
					ses->serverOS[2 * len] = 0;
					ses->serverOS[1 + (2 * len)] = 0;
					if (remaining_words > 0) {
						len = UniStrnlen((wchar_t *)
								 bcc_ptr,
								 remaining_words
								 - 1);
3236
						kfree(ses->serverNOS);
L
Linus Torvalds 已提交
3237
						ses->serverNOS =
3238
						    kzalloc(2 * (len + 1),
L
Linus Torvalds 已提交
3239 3240 3241
							    GFP_KERNEL);
						cifs_strfromUCS_le(ses->
								   serverNOS,
3242
								   (__le16 *)
L
Linus Torvalds 已提交
3243 3244 3245 3246 3247 3248 3249 3250
								   bcc_ptr,
								   len,
								   nls_codepage);
						bcc_ptr += 2 * (len + 1);
						ses->serverNOS[2 * len] = 0;
						ses->serverNOS[1+(2*len)] = 0;
						remaining_words -= len + 1;
						if (remaining_words > 0) {
3251
							len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
L
Linus Torvalds 已提交
3252
     /* last string not always null terminated (e.g. for Windows XP & 2000) */
S
Steve French 已提交
3253
							if (ses->serverDomain)
3254
								kfree(ses->serverDomain);
L
Linus Torvalds 已提交
3255
							ses->serverDomain =
3256
							    kzalloc(2 *
L
Linus Torvalds 已提交
3257 3258 3259 3260 3261 3262
								    (len +
								     1),
								    GFP_KERNEL);
							cifs_strfromUCS_le
							    (ses->
							     serverDomain,
3263
							     (__le16 *)
L
Linus Torvalds 已提交
3264 3265 3266 3267 3268 3269 3270 3271 3272 3273 3274 3275 3276 3277 3278 3279
							     bcc_ptr, len,
							     nls_codepage);
							bcc_ptr +=
							    2 * (len + 1);
							ses->
							    serverDomain[2
									 * len]
							    = 0;
							ses->
							    serverDomain[1
									 +
									 (2
									  *
									  len)]
							    = 0;
						} /* else no more room so create dummy domain string */
3280
						else {
S
Steve French 已提交
3281
							if (ses->serverDomain)
3282
								kfree(ses->serverDomain);
3283
							ses->serverDomain = kzalloc(2,GFP_KERNEL);
3284
						}
L
Linus Torvalds 已提交
3285
					} else {  /* no room so create dummy domain and NOS string */
S
Steve French 已提交
3286
						if (ses->serverDomain)
3287
							kfree(ses->serverDomain);
3288
						ses->serverDomain = kzalloc(2, GFP_KERNEL);
3289
						kfree(ses->serverNOS);
3290
						ses->serverNOS = kzalloc(2, GFP_KERNEL);
L
Linus Torvalds 已提交
3291 3292 3293
					}
				} else {	/* ASCII */
					len = strnlen(bcc_ptr, 1024);
3294 3295
					if (((long) bcc_ptr + len) -
					   (long) pByteArea(smb_buffer_response)
3296
						<= BCC(smb_buffer_response)) {
S
Steve French 已提交
3297
						if (ses->serverOS)
3298
							kfree(ses->serverOS);
3299
						ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
L
Linus Torvalds 已提交
3300 3301 3302 3303 3304 3305 3306
						strncpy(ses->serverOS,bcc_ptr, len);

						bcc_ptr += len;
						bcc_ptr[0] = 0;	/* null terminate the string */
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
3307
						kfree(ses->serverNOS);
3308 3309
						ses->serverNOS = kzalloc(len+1,
								    GFP_KERNEL);
3310 3311
						strncpy(ses->serverNOS,
							bcc_ptr, len);
L
Linus Torvalds 已提交
3312 3313 3314 3315 3316
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;

						len = strnlen(bcc_ptr, 1024);
S
Steve French 已提交
3317
						if (ses->serverDomain)
3318
							kfree(ses->serverDomain);
3319 3320 3321 3322 3323
						ses->serverDomain =
								kzalloc(len+1,
								    GFP_KERNEL);
						strncpy(ses->serverDomain,
							bcc_ptr, len);
L
Linus Torvalds 已提交
3324 3325 3326 3327
						bcc_ptr += len;
						bcc_ptr[0] = 0;
						bcc_ptr++;
					} else
C
Cyrill Gorcunov 已提交
3328
						cFYI(1, ("field of length %d "
3329
						   "extends beyond end of smb ",
L
Linus Torvalds 已提交
3330 3331 3332
						      len));
				}
			} else {
C
Cyrill Gorcunov 已提交
3333
				cERROR(1, ("Security Blob extends beyond end "
3334
					"of SMB"));
L
Linus Torvalds 已提交
3335 3336 3337 3338 3339
			}
		} else {
			cERROR(1, ("No session structure passed in."));
		}
	} else {
C
Cyrill Gorcunov 已提交
3340
		cERROR(1, ("Invalid Word count %d: ",
L
Linus Torvalds 已提交
3341 3342 3343 3344
			smb_buffer_response->WordCount));
		rc = -EIO;
	}

3345
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
3346 3347 3348 3349 3350 3351 3352 3353 3354 3355 3356 3357 3358 3359 3360 3361 3362 3363 3364 3365 3366 3367 3368 3369 3370 3371 3372 3373 3374

	return rc;
}

int
CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
	 const char *tree, struct cifsTconInfo *tcon,
	 const struct nls_table *nls_codepage)
{
	struct smb_hdr *smb_buffer;
	struct smb_hdr *smb_buffer_response;
	TCONX_REQ *pSMB;
	TCONX_RSP *pSMBr;
	unsigned char *bcc_ptr;
	int rc = 0;
	int length;
	__u16 count;

	if (ses == NULL)
		return -EIO;

	smb_buffer = cifs_buf_get();
	if (smb_buffer == NULL) {
		return -ENOMEM;
	}
	smb_buffer_response = smb_buffer;

	header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
			NULL /*no tid */ , 4 /*wct */ );
3375 3376

	smb_buffer->Mid = GetNextMid(ses->server);
L
Linus Torvalds 已提交
3377 3378 3379 3380 3381 3382 3383
	smb_buffer->Uid = ses->Suid;
	pSMB = (TCONX_REQ *) smb_buffer;
	pSMBr = (TCONX_RSP *) smb_buffer_response;

	pSMB->AndXCommand = 0xFF;
	pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
	bcc_ptr = &pSMB->Password[0];
S
Steve French 已提交
3384
	if ((ses->server->secMode) & SECMODE_USER) {
3385
		pSMB->PasswordLength = cpu_to_le16(1);	/* minimum */
3386
		*bcc_ptr = 0; /* password is null byte */
3387
		bcc_ptr++;              /* skip password */
3388
		/* already aligned so no need to do it below */
3389
	} else {
3390
		pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3391 3392 3393
		/* BB FIXME add code to fail this if NTLMv2 or Kerberos
		   specified as required (when that support is added to
		   the vfs in the future) as only NTLM or the much
3394
		   weaker LANMAN (which we do not send by default) is accepted
3395 3396
		   by Samba (not sure whether other servers allow
		   NTLMv2 password here) */
3397
#ifdef CONFIG_CIFS_WEAK_PW_HASH
3398
		if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3399 3400 3401 3402
			(ses->server->secType == LANMAN))
			calc_lanman_hash(ses, bcc_ptr);
		else
#endif /* CIFS_WEAK_PW_HASH */
3403 3404 3405 3406
		SMBNTencrypt(ses->password,
			     ses->server->cryptKey,
			     bcc_ptr);

3407
		bcc_ptr += CIFS_SESS_KEY_SIZE;
S
Steve French 已提交
3408
		if (ses->capabilities & CAP_UNICODE) {
3409 3410 3411 3412
			/* must align unicode strings */
			*bcc_ptr = 0; /* null byte password */
			bcc_ptr++;
		}
3413
	}
L
Linus Torvalds 已提交
3414

3415
	if (ses->server->secMode &
3416
			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
L
Linus Torvalds 已提交
3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427
		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;

	if (ses->capabilities & CAP_STATUS32) {
		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
	}
	if (ses->capabilities & CAP_DFS) {
		smb_buffer->Flags2 |= SMBFLG2_DFS;
	}
	if (ses->capabilities & CAP_UNICODE) {
		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
		length =
3428 3429
		    cifs_strtoUCS((__le16 *) bcc_ptr, tree,
			6 /* max utf8 char length in bytes */ *
3430 3431
			(/* server len*/ + 256 /* share len */), nls_codepage);
		bcc_ptr += 2 * length;	/* convert num 16 bit words to bytes */
L
Linus Torvalds 已提交
3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443
		bcc_ptr += 2;	/* skip trailing null */
	} else {		/* ASCII */
		strcpy(bcc_ptr, tree);
		bcc_ptr += strlen(tree) + 1;
	}
	strcpy(bcc_ptr, "?????");
	bcc_ptr += strlen("?????");
	bcc_ptr += 1;
	count = bcc_ptr - &pSMB->Password[0];
	pSMB->hdr.smb_buf_length += count;
	pSMB->ByteCount = cpu_to_le16(count);

3444 3445
	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
			 CIFS_STD_OP);
L
Linus Torvalds 已提交
3446 3447 3448 3449 3450 3451 3452 3453

	/* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
	/* above now done in SendReceive */
	if ((rc == 0) && (tcon != NULL)) {
		tcon->tidStatus = CifsGood;
		tcon->tid = smb_buffer_response->Tid;
		bcc_ptr = pByteArea(smb_buffer_response);
		length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3454
		/* skip service field (NB: this field is always ASCII) */
3455 3456 3457 3458 3459 3460 3461 3462 3463 3464 3465 3466
		if (length == 3) {
			if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
			    (bcc_ptr[2] == 'C')) {
				cFYI(1, ("IPC connection"));
				tcon->ipc = 1;
			}
		} else if (length == 2) {
			if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
				/* the most common case */
				cFYI(1, ("disk share connection"));
			}
		}
3467
		bcc_ptr += length + 1;
L
Linus Torvalds 已提交
3468 3469 3470 3471 3472 3473
		strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
		if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
			length = UniStrnlen((wchar_t *) bcc_ptr, 512);
			if ((bcc_ptr + (2 * length)) -
			     pByteArea(smb_buffer_response) <=
			    BCC(smb_buffer_response)) {
J
Jesper Juhl 已提交
3474
				kfree(tcon->nativeFileSystem);
L
Linus Torvalds 已提交
3475
				tcon->nativeFileSystem =
3476
				    kzalloc(length + 2, GFP_KERNEL);
3477 3478 3479 3480 3481
				if (tcon->nativeFileSystem)
					cifs_strfromUCS_le(
						tcon->nativeFileSystem,
						(__le16 *) bcc_ptr,
						length, nls_codepage);
L
Linus Torvalds 已提交
3482 3483 3484 3485 3486
				bcc_ptr += 2 * length;
				bcc_ptr[0] = 0;	/* null terminate the string */
				bcc_ptr[1] = 0;
				bcc_ptr += 2;
			}
3487
			/* else do not bother copying these information fields*/
L
Linus Torvalds 已提交
3488 3489 3490 3491 3492
		} else {
			length = strnlen(bcc_ptr, 1024);
			if ((bcc_ptr + length) -
			    pByteArea(smb_buffer_response) <=
			    BCC(smb_buffer_response)) {
J
Jesper Juhl 已提交
3493
				kfree(tcon->nativeFileSystem);
L
Linus Torvalds 已提交
3494
				tcon->nativeFileSystem =
3495
				    kzalloc(length + 1, GFP_KERNEL);
3496 3497 3498
				if (tcon->nativeFileSystem)
					strncpy(tcon->nativeFileSystem, bcc_ptr,
						length);
L
Linus Torvalds 已提交
3499
			}
3500
			/* else do not bother copying these information fields*/
L
Linus Torvalds 已提交
3501
		}
S
Steve French 已提交
3502
		if ((smb_buffer_response->WordCount == 3) ||
S
Steve French 已提交
3503 3504
			 (smb_buffer_response->WordCount == 7))
			/* field is in same location */
3505 3506 3507
			tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
		else
			tcon->Flags = 0;
L
Linus Torvalds 已提交
3508 3509
		cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
	} else if ((rc == 0) && tcon == NULL) {
3510
		/* all we need to save for IPC$ connection */
L
Linus Torvalds 已提交
3511 3512 3513
		ses->ipc_tid = smb_buffer_response->Tid;
	}

3514
	cifs_buf_release(smb_buffer);
L
Linus Torvalds 已提交
3515 3516 3517 3518 3519 3520 3521 3522 3523 3524
	return rc;
}

int
cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
{
	int rc = 0;
	int xid;
	struct cifsSesInfo *ses = NULL;
	struct task_struct *cifsd_task;
3525
	char *tmp;
L
Linus Torvalds 已提交
3526 3527 3528 3529 3530 3531 3532 3533 3534 3535

	xid = GetXid();

	if (cifs_sb->tcon) {
		ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
		rc = CIFSSMBTDis(xid, cifs_sb->tcon);
		if (rc == -EBUSY) {
			FreeXid(xid);
			return 0;
		}
3536
		DeleteTconOplockQEntries(cifs_sb->tcon);
L
Linus Torvalds 已提交
3537 3538 3539 3540 3541 3542 3543 3544 3545 3546
		tconInfoFree(cifs_sb->tcon);
		if ((ses) && (ses->server)) {
			/* save off task so we do not refer to ses later */
			cifsd_task = ses->server->tsk;
			cFYI(1, ("About to do SMBLogoff "));
			rc = CIFSSMBLogoff(xid, ses);
			if (rc == -EBUSY) {
				FreeXid(xid);
				return 0;
			} else if (rc == -ESHUTDOWN) {
S
Steve French 已提交
3547
				cFYI(1, ("Waking up socket by sending signal"));
S
Steve French 已提交
3548
				if (cifsd_task) {
3549
					force_sig(SIGKILL, cifsd_task);
3550
					kthread_stop(cifsd_task);
3551
				}
L
Linus Torvalds 已提交
3552 3553 3554 3555 3556 3557
				rc = 0;
			} /* else - we have an smb session
				left on this socket do not kill cifsd */
		} else
			cFYI(1, ("No session or bad tcon"));
	}
3558

L
Linus Torvalds 已提交
3559
	cifs_sb->tcon = NULL;
3560 3561 3562 3563
	tmp = cifs_sb->prepath;
	cifs_sb->prepathlen = 0;
	cifs_sb->prepath = NULL;
	kfree(tmp);
L
Linus Torvalds 已提交
3564 3565 3566 3567
	if (ses)
		sesInfoFree(ses);

	FreeXid(xid);
3568
	return rc;
3569
}
L
Linus Torvalds 已提交
3570 3571

int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3572
					   struct nls_table *nls_info)
L
Linus Torvalds 已提交
3573 3574
{
	int rc = 0;
3575
	char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3576
	bool ntlmv2_flag = false;
3577
	int first_time = 0;
L
Linus Torvalds 已提交
3578 3579

	/* what if server changes its buffer size after dropping the session? */
S
Steve French 已提交
3580
	if (pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
L
Linus Torvalds 已提交
3581
		rc = CIFSSMBNegotiate(xid, pSesInfo);
S
Steve French 已提交
3582
		if (rc == -EAGAIN) /* retry only once on 1st time connection */ {
L
Linus Torvalds 已提交
3583
			rc = CIFSSMBNegotiate(xid, pSesInfo);
3584
			if (rc == -EAGAIN)
L
Linus Torvalds 已提交
3585 3586
				rc = -EHOSTDOWN;
		}
S
Steve French 已提交
3587
		if (rc == 0) {
L
Linus Torvalds 已提交
3588
			spin_lock(&GlobalMid_Lock);
S
Steve French 已提交
3589
			if (pSesInfo->server->tcpStatus != CifsExiting)
L
Linus Torvalds 已提交
3590 3591 3592 3593 3594 3595
				pSesInfo->server->tcpStatus = CifsGood;
			else
				rc = -EHOSTDOWN;
			spin_unlock(&GlobalMid_Lock);

		}
3596
		first_time = 1;
L
Linus Torvalds 已提交
3597 3598
	}
	if (!rc) {
3599
		pSesInfo->flags = 0;
L
Linus Torvalds 已提交
3600
		pSesInfo->capabilities = pSesInfo->server->capabilities;
S
Steve French 已提交
3601
		if (linuxExtEnabled == 0)
L
Linus Torvalds 已提交
3602
			pSesInfo->capabilities &= (~CAP_UNIX);
3603
	/*	pSesInfo->sequence_number = 0;*/
3604 3605
		cFYI(1,
		      ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
L
Linus Torvalds 已提交
3606 3607
			pSesInfo->server->secMode,
			pSesInfo->server->capabilities,
3608
			pSesInfo->server->timeAdj));
S
Steve French 已提交
3609
		if (experimEnabled < 2)
3610 3611
			rc = CIFS_SessSetup(xid, pSesInfo,
					    first_time, nls_info);
3612
		else if (extended_security
3613
				&& (pSesInfo->capabilities
3614
					& CAP_EXTENDED_SECURITY)
L
Linus Torvalds 已提交
3615
				&& (pSesInfo->server->secType == NTLMSSP)) {
3616
			rc = -EOPNOTSUPP;
L
Linus Torvalds 已提交
3617 3618 3619
		} else if (extended_security
			   && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
			   && (pSesInfo->server->secType == RawNTLMSSP)) {
3620
			cFYI(1, ("NTLMSSP sesssetup"));
L
Linus Torvalds 已提交
3621 3622 3623 3624 3625
			rc = CIFSNTLMSSPNegotiateSessSetup(xid,
						pSesInfo,
						&ntlmv2_flag,
						nls_info);
			if (!rc) {
S
Steve French 已提交
3626
				if (ntlmv2_flag) {
3627
					char *v2_response;
S
Steve French 已提交
3628
					cFYI(1, ("more secure NTLM ver2 hash"));
3629
					if (CalcNTLMv2_partial_mac_key(pSesInfo,
L
Linus Torvalds 已提交
3630 3631 3632 3633 3634
						nls_info)) {
						rc = -ENOMEM;
						goto ss_err_exit;
					} else
						v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
S
Steve French 已提交
3635
					if (v2_response) {
3636 3637
						CalcNTLMv2_response(pSesInfo,
								   v2_response);
S
Steve French 已提交
3638
				/*		if (first_time)
3639 3640 3641
						  cifs_calculate_ntlmv2_mac_key(
						   pSesInfo->server->mac_signing_key,
						   response, ntlm_session_key,*/
L
Linus Torvalds 已提交
3642 3643 3644 3645 3646 3647 3648 3649 3650 3651 3652 3653
						kfree(v2_response);
					/* BB Put dummy sig in SessSetup PDU? */
					} else {
						rc = -ENOMEM;
						goto ss_err_exit;
					}

				} else {
					SMBNTencrypt(pSesInfo->password,
						pSesInfo->server->cryptKey,
						ntlm_session_key);

S
Steve French 已提交
3654
					if (first_time)
3655
						cifs_calculate_mac_key(
3656
							&pSesInfo->server->mac_signing_key,
3657 3658
							ntlm_session_key,
							pSesInfo->password);
L
Linus Torvalds 已提交
3659 3660 3661 3662 3663 3664 3665 3666 3667 3668 3669 3670 3671 3672 3673
				}
			/* for better security the weaker lanman hash not sent
			   in AuthSessSetup so we no longer calculate it */

				rc = CIFSNTLMSSPAuthSessSetup(xid,
					pSesInfo,
					ntlm_session_key,
					ntlmv2_flag,
					nls_info);
			}
		} else { /* old style NTLM 0.12 session setup */
			SMBNTencrypt(pSesInfo->password,
				pSesInfo->server->cryptKey,
				ntlm_session_key);

S
Steve French 已提交
3674
			if (first_time)
3675
				cifs_calculate_mac_key(
3676
					&pSesInfo->server->mac_signing_key,
3677 3678
					ntlm_session_key, pSesInfo->password);

L
Linus Torvalds 已提交
3679 3680 3681 3682
			rc = CIFSSessSetup(xid, pSesInfo,
				ntlm_session_key, nls_info);
		}
		if (rc) {
S
Steve French 已提交
3683
			cERROR(1, ("Send error in SessSetup = %d", rc));
L
Linus Torvalds 已提交
3684
		} else {
S
Steve French 已提交
3685
			cFYI(1, ("CIFS Session Established successfully"));
L
Linus Torvalds 已提交
3686 3687 3688 3689 3690 3691 3692
			pSesInfo->status = CifsGood;
		}
	}
ss_err_exit:
	return rc;
}