4 * Copyright (C) International Business Machines Corp., 2002,2005
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/pagevec.h>
34 #include <asm/uaccess.h>
35 #include <asm/processor.h>
38 #include "cifsproto.h"
39 #include "cifs_unicode.h"
40 #include "cifs_debug.h"
41 #include "cifs_fs_sb.h"
44 #include "rfc1002pdu.h"
48 #define RFC1001_PORT 139
50 static DECLARE_COMPLETION(cifsd_complete);
52 extern void SMBencrypt(unsigned char *passwd, unsigned char *c8,
54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
57 extern mempool_t *cifs_req_poolp;
65 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
66 char *iocharset; /* local code page for mapping to and from Unicode */
67 char source_rfc1001_name[16]; /* netbios name of client */
68 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
78 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
80 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
81 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
83 unsigned remap:1; /* set to remap seven reserved chars in filenames */
84 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
89 unsigned nullauth:1; /* attempt to authenticate with null user */
91 unsigned seal:1; /* encrypt */
92 unsigned nocase; /* request case insensitive filenames */
93 unsigned nobrl; /* disable sending byte range locks to srv */
97 unsigned short int port;
100 static int ipv4_connect(struct sockaddr_in *psin_server,
101 struct socket **csocket,
103 char * server_netb_name);
104 static int ipv6_connect(struct sockaddr_in6 *psin_server,
105 struct socket **csocket);
109 * cifs tcp session reconnection
111 * mark tcp session as reconnecting so temporarily locked
112 * mark all smb sessions as reconnecting for tcp session
113 * reconnect tcp session
114 * wake up waiters on reconnection? - (not needed currently)
118 cifs_reconnect(struct TCP_Server_Info *server)
121 struct list_head *tmp;
122 struct cifsSesInfo *ses;
123 struct cifsTconInfo *tcon;
124 struct mid_q_entry * mid_entry;
126 spin_lock(&GlobalMid_Lock);
127 if(server->tcpStatus == CifsExiting) {
128 /* the demux thread will exit normally
129 next time through the loop */
130 spin_unlock(&GlobalMid_Lock);
133 server->tcpStatus = CifsNeedReconnect;
134 spin_unlock(&GlobalMid_Lock);
137 cFYI(1, ("Reconnecting tcp session"));
139 /* before reconnecting the tcp session, mark the smb session (uid)
140 and the tid bad so they are not used until reconnected */
141 read_lock(&GlobalSMBSeslock);
142 list_for_each(tmp, &GlobalSMBSessionList) {
143 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
145 if (ses->server == server) {
146 ses->status = CifsNeedReconnect;
150 /* else tcp and smb sessions need reconnection */
152 list_for_each(tmp, &GlobalTreeConnectionList) {
153 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
154 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
155 tcon->tidStatus = CifsNeedReconnect;
158 read_unlock(&GlobalSMBSeslock);
159 /* do not want to be sending data on a socket we are freeing */
160 down(&server->tcpSem);
161 if(server->ssocket) {
162 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
163 server->ssocket->flags));
164 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
165 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
166 server->ssocket->flags));
167 sock_release(server->ssocket);
168 server->ssocket = NULL;
171 spin_lock(&GlobalMid_Lock);
172 list_for_each(tmp, &server->pending_mid_q) {
173 mid_entry = list_entry(tmp, struct
177 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
178 /* Mark other intransit requests as needing
179 retry so we do not immediately mark the
180 session bad again (ie after we reconnect
181 below) as they timeout too */
182 mid_entry->midState = MID_RETRY_NEEDED;
186 spin_unlock(&GlobalMid_Lock);
189 while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
191 if(server->protocolType == IPV6) {
192 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
194 rc = ipv4_connect(&server->addr.sockAddr,
196 server->workstation_RFC1001_name,
197 server->server_RFC1001_name);
200 cFYI(1,("reconnect error %d",rc));
203 atomic_inc(&tcpSesReconnectCount);
204 spin_lock(&GlobalMid_Lock);
205 if(server->tcpStatus != CifsExiting)
206 server->tcpStatus = CifsGood;
207 server->sequence_number = 0;
208 spin_unlock(&GlobalMid_Lock);
209 /* atomic_set(&server->inFlight,0);*/
210 wake_up(&server->response_q);
218 0 not a transact2, or all data present
219 >0 transact2 with that much data missing
220 -EINVAL = invalid transact2
223 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
225 struct smb_t2_rsp * pSMBt;
227 int data_in_this_rsp;
230 if(pSMB->Command != SMB_COM_TRANSACTION2)
233 /* check for plausible wct, bcc and t2 data and parm sizes */
234 /* check for parm and data offset going beyond end of smb */
235 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
236 cFYI(1,("invalid transact2 word count"));
240 pSMBt = (struct smb_t2_rsp *)pSMB;
242 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
243 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
245 remaining = total_data_size - data_in_this_rsp;
249 else if(remaining < 0) {
250 cFYI(1,("total data %d smaller than data in frame %d",
251 total_data_size, data_in_this_rsp));
254 cFYI(1,("missing %d bytes from transact2, check next response",
256 if(total_data_size > maxBufSize) {
257 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
258 total_data_size,maxBufSize));
265 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
267 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
268 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
273 char * data_area_of_target;
274 char * data_area_of_buf2;
277 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
279 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
280 cFYI(1,("total data sizes of primary and secondary t2 differ"));
283 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
285 remaining = total_data_size - total_in_buf;
290 if(remaining == 0) /* nothing to do, ignore */
293 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
294 if(remaining < total_in_buf2) {
295 cFYI(1,("transact2 2nd response contains too much data"));
298 /* find end of first SMB data area */
299 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
300 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
301 /* validate target area */
303 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
304 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
306 data_area_of_target += total_in_buf;
308 /* copy second buffer into end of first buffer */
309 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
310 total_in_buf += total_in_buf2;
311 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
312 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
313 byte_count += total_in_buf2;
314 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
316 byte_count = pTargetSMB->smb_buf_length;
317 byte_count += total_in_buf2;
319 /* BB also add check that we are not beyond maximum buffer size */
321 pTargetSMB->smb_buf_length = byte_count;
323 if(remaining == total_in_buf2) {
324 cFYI(1,("found the last secondary response"));
325 return 0; /* we are done */
326 } else /* more responses to go */
332 cifs_demultiplex_thread(struct TCP_Server_Info *server)
335 unsigned int pdu_length, total_read;
336 struct smb_hdr *smb_buffer = NULL;
337 struct smb_hdr *bigbuf = NULL;
338 struct smb_hdr *smallbuf = NULL;
339 struct msghdr smb_msg;
341 struct socket *csocket = server->ssocket;
342 struct list_head *tmp;
343 struct cifsSesInfo *ses;
344 struct task_struct *task_to_wake = NULL;
345 struct mid_q_entry *mid_entry;
347 int isLargeBuf = FALSE;
352 allow_signal(SIGKILL);
353 current->flags |= PF_MEMALLOC;
354 server->tsk = current; /* save process info to wake at shutdown */
355 cFYI(1, ("Demultiplex PID: %d", current->pid));
356 write_lock(&GlobalSMBSeslock);
357 atomic_inc(&tcpSesAllocCount);
358 length = tcpSesAllocCount.counter;
359 write_unlock(&GlobalSMBSeslock);
360 complete(&cifsd_complete);
362 mempool_resize(cifs_req_poolp,
363 length + cifs_min_rcv,
367 while (server->tcpStatus != CifsExiting) {
370 if (bigbuf == NULL) {
371 bigbuf = cifs_buf_get();
373 cERROR(1,("No memory for large SMB response"));
375 /* retry will check if exiting */
378 } else if(isLargeBuf) {
379 /* we are reusing a dirtry large buf, clear its start */
380 memset(bigbuf, 0, sizeof (struct smb_hdr));
383 if (smallbuf == NULL) {
384 smallbuf = cifs_small_buf_get();
385 if(smallbuf == NULL) {
386 cERROR(1,("No memory for SMB response"));
388 /* retry will check if exiting */
391 /* beginning of smb buffer is cleared in our buf_get */
392 } else /* if existing small buf clear beginning */
393 memset(smallbuf, 0, sizeof (struct smb_hdr));
397 smb_buffer = smallbuf;
398 iov.iov_base = smb_buffer;
400 smb_msg.msg_control = NULL;
401 smb_msg.msg_controllen = 0;
403 kernel_recvmsg(csocket, &smb_msg,
404 &iov, 1, 4, 0 /* BB see socket.h flags */);
406 if(server->tcpStatus == CifsExiting) {
408 } else if (server->tcpStatus == CifsNeedReconnect) {
409 cFYI(1,("Reconnect after server stopped responding"));
410 cifs_reconnect(server);
411 cFYI(1,("call to reconnect done"));
412 csocket = server->ssocket;
414 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
415 msleep(1); /* minimum sleep to prevent looping
416 allowing socket to clear and app threads to set
417 tcpStatus CifsNeedReconnect if server hung */
419 } else if (length <= 0) {
420 if(server->tcpStatus == CifsNew) {
421 cFYI(1,("tcp session abend after SMBnegprot"));
422 /* some servers kill the TCP session rather than
423 returning an SMB negprot error, in which
424 case reconnecting here is not going to help,
425 and so simply return error to mount */
428 if(length == -EINTR) {
429 cFYI(1,("cifsd thread killed"));
432 cFYI(1,("Reconnect after unexpected peek error %d",
434 cifs_reconnect(server);
435 csocket = server->ssocket;
436 wake_up(&server->response_q);
438 } else if (length < 4) {
440 ("Frame under four bytes received (%d bytes long)",
442 cifs_reconnect(server);
443 csocket = server->ssocket;
444 wake_up(&server->response_q);
448 /* The right amount was read from socket - 4 bytes */
449 /* so we can now interpret the length field */
451 /* the first byte big endian of the length field,
452 is actually not part of the length but the type
453 with the most common, zero, as regular data */
454 temp = *((char *) smb_buffer);
456 /* Note that FC 1001 length is big endian on the wire,
457 but we convert it here so it is always manipulated
458 as host byte order */
459 pdu_length = ntohl(smb_buffer->smb_buf_length);
460 smb_buffer->smb_buf_length = pdu_length;
462 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
464 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
466 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
467 cFYI(1,("Good RFC 1002 session rsp"));
469 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
470 /* we get this from Windows 98 instead of
471 an error on SMB negprot response */
472 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
474 if(server->tcpStatus == CifsNew) {
475 /* if nack on negprot (rather than
476 ret of smb negprot error) reconnecting
477 not going to help, ret error to mount */
480 /* give server a second to
481 clean up before reconnect attempt */
483 /* always try 445 first on reconnect
484 since we get NACK on some if we ever
485 connected to port 139 (the NACK is
486 since we do not begin with RFC1001
487 session initialize frame) */
488 server->addr.sockAddr.sin_port =
490 cifs_reconnect(server);
491 csocket = server->ssocket;
492 wake_up(&server->response_q);
495 } else if (temp != (char) 0) {
496 cERROR(1,("Unknown RFC 1002 frame"));
497 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
499 cifs_reconnect(server);
500 csocket = server->ssocket;
504 /* else we have an SMB response */
505 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
506 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
507 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
508 length, pdu_length+4));
509 cifs_reconnect(server);
510 csocket = server->ssocket;
511 wake_up(&server->response_q);
518 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
520 memcpy(bigbuf, smallbuf, 4);
524 iov.iov_base = 4 + (char *)smb_buffer;
525 iov.iov_len = pdu_length;
526 for (total_read = 0; total_read < pdu_length;
527 total_read += length) {
528 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
529 pdu_length - total_read, 0);
530 if((server->tcpStatus == CifsExiting) ||
531 (length == -EINTR)) {
535 } else if (server->tcpStatus == CifsNeedReconnect) {
536 cifs_reconnect(server);
537 csocket = server->ssocket;
538 /* Reconnect wakes up rspns q */
539 /* Now we will reread sock */
542 } else if ((length == -ERESTARTSYS) ||
543 (length == -EAGAIN)) {
544 msleep(1); /* minimum sleep to prevent looping,
545 allowing socket to clear and app
546 threads to set tcpStatus
547 CifsNeedReconnect if server hung*/
549 } else if (length <= 0) {
550 cERROR(1,("Received no data, expecting %d",
551 pdu_length - total_read));
552 cifs_reconnect(server);
553 csocket = server->ssocket;
560 else if(reconnect == 1)
563 length += 4; /* account for rfc1002 hdr */
566 dump_smb(smb_buffer, length);
567 if (checkSMB (smb_buffer, smb_buffer->Mid, total_read+4)) {
568 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
574 spin_lock(&GlobalMid_Lock);
575 list_for_each(tmp, &server->pending_mid_q) {
576 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
578 if ((mid_entry->mid == smb_buffer->Mid) &&
579 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
580 (mid_entry->command == smb_buffer->Command)) {
581 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
582 /* We have a multipart transact2 resp */
584 if(mid_entry->resp_buf) {
585 /* merge response - fix up 1st*/
586 if(coalesce_t2(smb_buffer,
587 mid_entry->resp_buf)) {
590 /* all parts received */
595 cERROR(1,("1st trans2 resp needs bigbuf"));
596 /* BB maybe we can fix this up, switch
597 to already allocated large buffer? */
599 /* Have first buffer */
600 mid_entry->resp_buf =
602 mid_entry->largeBuf = 1;
608 mid_entry->resp_buf = smb_buffer;
610 mid_entry->largeBuf = 1;
612 mid_entry->largeBuf = 0;
614 task_to_wake = mid_entry->tsk;
615 mid_entry->midState = MID_RESPONSE_RECEIVED;
616 #ifdef CONFIG_CIFS_STATS2
617 mid_entry->when_received = jiffies;
622 spin_unlock(&GlobalMid_Lock);
624 /* Was previous buf put in mpx struct for multi-rsp? */
626 /* smb buffer will be freed by user thread */
632 wake_up_process(task_to_wake);
633 } else if ((is_valid_oplock_break(smb_buffer) == FALSE)
634 && (isMultiRsp == FALSE)) {
635 cERROR(1, ("No task to wake, unknown frame rcvd!"));
636 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
637 sizeof(struct smb_hdr));
639 } /* end while !EXITING */
641 spin_lock(&GlobalMid_Lock);
642 server->tcpStatus = CifsExiting;
644 /* check if we have blocked requests that need to free */
645 /* Note that cifs_max_pending is normally 50, but
646 can be set at module install time to as little as two */
647 if(atomic_read(&server->inFlight) >= cifs_max_pending)
648 atomic_set(&server->inFlight, cifs_max_pending - 1);
649 /* We do not want to set the max_pending too low or we
650 could end up with the counter going negative */
651 spin_unlock(&GlobalMid_Lock);
652 /* Although there should not be any requests blocked on
653 this queue it can not hurt to be paranoid and try to wake up requests
654 that may haven been blocked when more than 50 at time were on the wire
655 to the same server - they now will see the session is in exit state
656 and get out of SendReceive. */
657 wake_up_all(&server->request_q);
658 /* give those requests time to exit */
661 if(server->ssocket) {
662 sock_release(csocket);
663 server->ssocket = NULL;
665 /* buffer usuallly freed in free_mid - need to free it here on exit */
667 cifs_buf_release(bigbuf);
668 if (smallbuf != NULL)
669 cifs_small_buf_release(smallbuf);
671 read_lock(&GlobalSMBSeslock);
672 if (list_empty(&server->pending_mid_q)) {
673 /* loop through server session structures attached to this and
675 list_for_each(tmp, &GlobalSMBSessionList) {
677 list_entry(tmp, struct cifsSesInfo,
679 if (ses->server == server) {
680 ses->status = CifsExiting;
684 read_unlock(&GlobalSMBSeslock);
686 /* although we can not zero the server struct pointer yet,
687 since there are active requests which may depnd on them,
688 mark the corresponding SMB sessions as exiting too */
689 list_for_each(tmp, &GlobalSMBSessionList) {
690 ses = list_entry(tmp, struct cifsSesInfo,
692 if (ses->server == server) {
693 ses->status = CifsExiting;
697 spin_lock(&GlobalMid_Lock);
698 list_for_each(tmp, &server->pending_mid_q) {
699 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
700 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
702 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
703 task_to_wake = mid_entry->tsk;
705 wake_up_process(task_to_wake);
709 spin_unlock(&GlobalMid_Lock);
710 read_unlock(&GlobalSMBSeslock);
711 /* 1/8th of sec is more than enough time for them to exit */
715 if (!list_empty(&server->pending_mid_q)) {
716 /* mpx threads have not exited yet give them
717 at least the smb send timeout time for long ops */
718 /* due to delays on oplock break requests, we need
719 to wait at least 45 seconds before giving up
720 on a request getting a response and going ahead
722 cFYI(1, ("Wait for exit from demultiplex thread"));
724 /* if threads still have not exited they are probably never
725 coming home not much else we can do but free the memory */
728 write_lock(&GlobalSMBSeslock);
729 atomic_dec(&tcpSesAllocCount);
730 length = tcpSesAllocCount.counter;
732 /* last chance to mark ses pointers invalid
733 if there are any pointing to this (e.g
734 if a crazy root user tried to kill cifsd
735 kernel thread explicitly this might happen) */
736 list_for_each(tmp, &GlobalSMBSessionList) {
737 ses = list_entry(tmp, struct cifsSesInfo,
739 if (ses->server == server) {
743 write_unlock(&GlobalSMBSeslock);
747 mempool_resize(cifs_req_poolp,
748 length + cifs_min_rcv,
752 complete_and_exit(&cifsd_complete, 0);
757 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
761 unsigned int temp_len, i, j;
767 memset(vol->source_rfc1001_name,0x20,15);
768 for(i=0;i < strnlen(system_utsname.nodename,15);i++) {
769 /* does not have to be a perfect mapping since the field is
770 informational, only used for servers that do not support
771 port 445 and it can be overridden at mount time */
772 vol->source_rfc1001_name[i] =
773 toupper(system_utsname.nodename[i]);
775 vol->source_rfc1001_name[15] = 0;
776 /* null target name indicates to use *SMBSERVR default called name
777 if we end up sending RFC1001 session initialize */
778 vol->target_rfc1001_name[0] = 0;
779 vol->linux_uid = current->uid; /* current->euid instead? */
780 vol->linux_gid = current->gid;
781 vol->dir_mode = S_IRWXUGO;
782 /* 2767 perms indicate mandatory locking support */
783 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
785 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
788 /* default is always to request posix paths. */
789 vol->posix_paths = 1;
794 if(strncmp(options,"sep=",4) == 0) {
795 if(options[4] != 0) {
796 separator[0] = options[4];
799 cFYI(1,("Null separator not allowed"));
803 while ((data = strsep(&options, separator)) != NULL) {
806 if ((value = strchr(data, '=')) != NULL)
809 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
811 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
813 } else if (strnicmp(data, "user", 4) == 0) {
814 if (!value || !*value) {
816 "CIFS: invalid or missing username\n");
817 return 1; /* needs_arg; */
819 if (strnlen(value, 200) < 200) {
820 vol->username = value;
822 printk(KERN_WARNING "CIFS: username too long\n");
825 } else if (strnicmp(data, "pass", 4) == 0) {
827 vol->password = NULL;
829 } else if(value[0] == 0) {
830 /* check if string begins with double comma
831 since that would mean the password really
832 does start with a comma, and would not
833 indicate an empty string */
834 if(value[1] != separator[0]) {
835 vol->password = NULL;
839 temp_len = strlen(value);
840 /* removed password length check, NTLM passwords
841 can be arbitrarily long */
843 /* if comma in password, the string will be
844 prematurely null terminated. Commas in password are
845 specified across the cifs mount interface by a double
846 comma ie ,, and a comma used as in other cases ie ','
847 as a parameter delimiter/separator is single and due
848 to the strsep above is temporarily zeroed. */
850 /* NB: password legally can have multiple commas and
851 the only illegal character in a password is null */
853 if ((value[temp_len] == 0) &&
854 (value[temp_len+1] == separator[0])) {
856 value[temp_len] = separator[0];
857 temp_len+=2; /* move after the second comma */
858 while(value[temp_len] != 0) {
859 if (value[temp_len] == separator[0]) {
860 if (value[temp_len+1] ==
862 /* skip second comma */
865 /* single comma indicating start
872 if(value[temp_len] == 0) {
876 /* point option to start of next parm */
877 options = value + temp_len + 1;
879 /* go from value to value + temp_len condensing
880 double commas to singles. Note that this ends up
881 allocating a few bytes too many, which is ok */
882 vol->password = kzalloc(temp_len, GFP_KERNEL);
883 if(vol->password == NULL) {
884 printk("CIFS: no memory for pass\n");
887 for(i=0,j=0;i<temp_len;i++,j++) {
888 vol->password[j] = value[i];
889 if(value[i] == separator[0]
890 && value[i+1] == separator[0]) {
891 /* skip second comma */
895 vol->password[j] = 0;
897 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
898 if(vol->password == NULL) {
899 printk("CIFS: no memory for pass\n");
902 strcpy(vol->password, value);
904 } else if (strnicmp(data, "ip", 2) == 0) {
905 if (!value || !*value) {
907 } else if (strnlen(value, 35) < 35) {
910 printk(KERN_WARNING "CIFS: ip address too long\n");
913 } else if (strnicmp(data, "sec", 3) == 0) {
914 if (!value || !*value) {
915 cERROR(1,("no security value specified"));
917 } else if (strnicmp(value, "krb5i", 5) == 0) {
920 } else if (strnicmp(value, "krb5p", 5) == 0) {
923 cERROR(1,("Krb5 cifs privacy not supported"));
925 } else if (strnicmp(value, "krb5", 4) == 0) {
927 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
930 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
932 } else if (strnicmp(value, "ntlmi", 5) == 0) {
935 } else if (strnicmp(value, "ntlm", 4) == 0) {
936 /* ntlm is default so can be turned off too */
938 } else if (strnicmp(value, "nontlm", 6) == 0) {
940 } else if (strnicmp(value, "none", 4) == 0) {
943 cERROR(1,("bad security option: %s", value));
946 } else if ((strnicmp(data, "unc", 3) == 0)
947 || (strnicmp(data, "target", 6) == 0)
948 || (strnicmp(data, "path", 4) == 0)) {
949 if (!value || !*value) {
951 "CIFS: invalid path to network resource\n");
952 return 1; /* needs_arg; */
954 if ((temp_len = strnlen(value, 300)) < 300) {
955 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
958 strcpy(vol->UNC,value);
959 if (strncmp(vol->UNC, "//", 2) == 0) {
962 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
964 "CIFS: UNC Path does not begin with // or \\\\ \n");
968 printk(KERN_WARNING "CIFS: UNC name too long\n");
971 } else if ((strnicmp(data, "domain", 3) == 0)
972 || (strnicmp(data, "workgroup", 5) == 0)) {
973 if (!value || !*value) {
974 printk(KERN_WARNING "CIFS: invalid domain name\n");
975 return 1; /* needs_arg; */
977 /* BB are there cases in which a comma can be valid in
978 a domain name and need special handling? */
979 if (strnlen(value, 65) < 65) {
980 vol->domainname = value;
981 cFYI(1, ("Domain name set"));
983 printk(KERN_WARNING "CIFS: domain name too long\n");
986 } else if (strnicmp(data, "iocharset", 9) == 0) {
987 if (!value || !*value) {
988 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
989 return 1; /* needs_arg; */
991 if (strnlen(value, 65) < 65) {
992 if(strnicmp(value,"default",7))
993 vol->iocharset = value;
994 /* if iocharset not set load_nls_default used by caller */
995 cFYI(1, ("iocharset set to %s",value));
997 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1000 } else if (strnicmp(data, "uid", 3) == 0) {
1001 if (value && *value) {
1003 simple_strtoul(value, &value, 0);
1005 } else if (strnicmp(data, "gid", 3) == 0) {
1006 if (value && *value) {
1008 simple_strtoul(value, &value, 0);
1010 } else if (strnicmp(data, "file_mode", 4) == 0) {
1011 if (value && *value) {
1013 simple_strtoul(value, &value, 0);
1015 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1016 if (value && *value) {
1018 simple_strtoul(value, &value, 0);
1020 } else if (strnicmp(data, "dirmode", 4) == 0) {
1021 if (value && *value) {
1023 simple_strtoul(value, &value, 0);
1025 } else if (strnicmp(data, "port", 4) == 0) {
1026 if (value && *value) {
1028 simple_strtoul(value, &value, 0);
1030 } else if (strnicmp(data, "rsize", 5) == 0) {
1031 if (value && *value) {
1033 simple_strtoul(value, &value, 0);
1035 } else if (strnicmp(data, "wsize", 5) == 0) {
1036 if (value && *value) {
1038 simple_strtoul(value, &value, 0);
1040 } else if (strnicmp(data, "sockopt", 5) == 0) {
1041 if (value && *value) {
1043 simple_strtoul(value, &value, 0);
1045 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1046 if (!value || !*value || (*value == ' ')) {
1047 cFYI(1,("invalid (empty) netbiosname specified"));
1049 memset(vol->source_rfc1001_name,0x20,15);
1051 /* BB are there cases in which a comma can be
1052 valid in this workstation netbios name (and need
1053 special handling)? */
1055 /* We do not uppercase netbiosname for user */
1059 vol->source_rfc1001_name[i] = value[i];
1061 /* The string has 16th byte zero still from
1062 set at top of the function */
1063 if((i==15) && (value[i] != 0))
1064 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1066 } else if (strnicmp(data, "servern", 7) == 0) {
1067 /* servernetbiosname specified override *SMBSERVER */
1068 if (!value || !*value || (*value == ' ')) {
1069 cFYI(1,("empty server netbiosname specified"));
1071 /* last byte, type, is 0x20 for servr type */
1072 memset(vol->target_rfc1001_name,0x20,16);
1075 /* BB are there cases in which a comma can be
1076 valid in this workstation netbios name (and need
1077 special handling)? */
1079 /* user or mount helper must uppercase netbiosname */
1083 vol->target_rfc1001_name[i] = value[i];
1085 /* The string has 16th byte zero still from
1086 set at top of the function */
1087 if((i==15) && (value[i] != 0))
1088 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1090 } else if (strnicmp(data, "credentials", 4) == 0) {
1092 } else if (strnicmp(data, "version", 3) == 0) {
1094 } else if (strnicmp(data, "guest",5) == 0) {
1096 } else if (strnicmp(data, "rw", 2) == 0) {
1098 } else if ((strnicmp(data, "suid", 4) == 0) ||
1099 (strnicmp(data, "nosuid", 6) == 0) ||
1100 (strnicmp(data, "exec", 4) == 0) ||
1101 (strnicmp(data, "noexec", 6) == 0) ||
1102 (strnicmp(data, "nodev", 5) == 0) ||
1103 (strnicmp(data, "noauto", 6) == 0) ||
1104 (strnicmp(data, "dev", 3) == 0)) {
1105 /* The mount tool or mount.cifs helper (if present)
1106 uses these opts to set flags, and the flags are read
1107 by the kernel vfs layer before we get here (ie
1108 before read super) so there is no point trying to
1109 parse these options again and set anything and it
1110 is ok to just ignore them */
1112 } else if (strnicmp(data, "ro", 2) == 0) {
1114 } else if (strnicmp(data, "hard", 4) == 0) {
1116 } else if (strnicmp(data, "soft", 4) == 0) {
1118 } else if (strnicmp(data, "perm", 4) == 0) {
1120 } else if (strnicmp(data, "noperm", 6) == 0) {
1122 } else if (strnicmp(data, "mapchars", 8) == 0) {
1124 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1126 } else if (strnicmp(data, "sfu", 3) == 0) {
1128 } else if (strnicmp(data, "nosfu", 5) == 0) {
1130 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1131 vol->posix_paths = 1;
1132 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1133 vol->posix_paths = 0;
1134 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1135 (strnicmp(data, "ignorecase", 10) == 0)) {
1137 } else if (strnicmp(data, "brl", 3) == 0) {
1139 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1140 (strnicmp(data, "nolock", 6) == 0)) {
1142 /* turn off mandatory locking in mode
1143 if remote locking is turned off since the
1144 local vfs will do advisory */
1145 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1146 vol->file_mode = S_IALLUGO;
1147 } else if (strnicmp(data, "setuids", 7) == 0) {
1149 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1151 } else if (strnicmp(data, "nohard", 6) == 0) {
1153 } else if (strnicmp(data, "nosoft", 6) == 0) {
1155 } else if (strnicmp(data, "nointr", 6) == 0) {
1157 } else if (strnicmp(data, "intr", 4) == 0) {
1159 } else if (strnicmp(data, "serverino",7) == 0) {
1160 vol->server_ino = 1;
1161 } else if (strnicmp(data, "noserverino",9) == 0) {
1162 vol->server_ino = 0;
1163 } else if (strnicmp(data, "cifsacl",7) == 0) {
1165 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1167 } else if (strnicmp(data, "acl",3) == 0) {
1168 vol->no_psx_acl = 0;
1169 } else if (strnicmp(data, "noacl",5) == 0) {
1170 vol->no_psx_acl = 1;
1171 } else if (strnicmp(data, "direct",6) == 0) {
1173 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1175 } else if (strnicmp(data, "in6_addr",8) == 0) {
1176 if (!value || !*value) {
1177 vol->in6_addr = NULL;
1178 } else if (strnlen(value, 49) == 48) {
1179 vol->in6_addr = value;
1181 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1184 } else if (strnicmp(data, "noac", 4) == 0) {
1185 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1187 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1189 if (vol->UNC == NULL) {
1190 if(devname == NULL) {
1191 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1194 if ((temp_len = strnlen(devname, 300)) < 300) {
1195 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1196 if(vol->UNC == NULL)
1198 strcpy(vol->UNC,devname);
1199 if (strncmp(vol->UNC, "//", 2) == 0) {
1202 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1203 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1207 printk(KERN_WARNING "CIFS: UNC name too long\n");
1211 if(vol->UNCip == NULL)
1212 vol->UNCip = &vol->UNC[2];
1217 static struct cifsSesInfo *
1218 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1219 struct in6_addr *target_ip6_addr,
1220 char *userName, struct TCP_Server_Info **psrvTcp)
1222 struct list_head *tmp;
1223 struct cifsSesInfo *ses;
1225 read_lock(&GlobalSMBSeslock);
1227 list_for_each(tmp, &GlobalSMBSessionList) {
1228 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1230 if((target_ip_addr &&
1231 (ses->server->addr.sockAddr.sin_addr.s_addr
1232 == target_ip_addr->s_addr)) || (target_ip6_addr
1233 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1234 target_ip6_addr,sizeof(*target_ip6_addr)))){
1235 /* BB lock server and tcp session and increment use count here?? */
1236 *psrvTcp = ses->server; /* found a match on the TCP session */
1237 /* BB check if reconnection needed */
1239 (ses->userName, userName,
1240 MAX_USERNAME_SIZE) == 0){
1241 read_unlock(&GlobalSMBSeslock);
1242 return ses; /* found exact match on both tcp and SMB sessions */
1246 /* else tcp and smb sessions need reconnection */
1248 read_unlock(&GlobalSMBSeslock);
1252 static struct cifsTconInfo *
1253 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1255 struct list_head *tmp;
1256 struct cifsTconInfo *tcon;
1258 read_lock(&GlobalSMBSeslock);
1259 list_for_each(tmp, &GlobalTreeConnectionList) {
1260 cFYI(1, ("Next tcon - "));
1261 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1263 if (tcon->ses->server) {
1265 (" old ip addr: %x == new ip %x ?",
1266 tcon->ses->server->addr.sockAddr.sin_addr.
1267 s_addr, new_target_ip_addr));
1268 if (tcon->ses->server->addr.sockAddr.sin_addr.
1269 s_addr == new_target_ip_addr) {
1270 /* BB lock tcon and server and tcp session and increment use count here? */
1271 /* found a match on the TCP session */
1272 /* BB check if reconnection needed */
1273 cFYI(1,("Matched ip, old UNC: %s == new: %s ?",
1274 tcon->treeName, uncName));
1276 (tcon->treeName, uncName,
1277 MAX_TREE_SIZE) == 0) {
1279 ("Matched UNC, old user: %s == new: %s ?",
1280 tcon->treeName, uncName));
1282 (tcon->ses->userName,
1284 MAX_USERNAME_SIZE) == 0) {
1285 read_unlock(&GlobalSMBSeslock);
1286 return tcon;/* also matched user (smb session)*/
1293 read_unlock(&GlobalSMBSeslock);
1298 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1299 const char *old_path, const struct nls_table *nls_codepage,
1302 unsigned char *referrals = NULL;
1303 unsigned int num_referrals;
1306 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1307 &num_referrals, &referrals, remap);
1309 /* BB Add in code to: if valid refrl, if not ip address contact
1310 the helper that resolves tcp names, mount to it, try to
1311 tcon to it unmount it if fail */
1319 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1320 const char *old_path, const struct nls_table *nls_codepage,
1321 unsigned int *pnum_referrals,
1322 unsigned char ** preferrals, int remap)
1327 *pnum_referrals = 0;
1329 if (pSesInfo->ipc_tid == 0) {
1330 temp_unc = kmalloc(2 /* for slashes */ +
1331 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1332 + 1 + 4 /* slash IPC$ */ + 2,
1334 if (temp_unc == NULL)
1338 strcpy(temp_unc + 2, pSesInfo->serverName);
1339 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1340 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1342 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1346 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1347 pnum_referrals, nls_codepage, remap);
1352 /* See RFC1001 section 14 on representation of Netbios names */
1353 static void rfc1002mangle(char * target,char * source, unsigned int length)
1357 for(i=0,j=0;i<(length);i++) {
1358 /* mask a nibble at a time and encode */
1359 target[j] = 'A' + (0x0F & (source[i] >> 4));
1360 target[j+1] = 'A' + (0x0F & source[i]);
1368 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1369 char * netbios_name, char * target_name)
1373 __be16 orig_port = 0;
1375 if(*csocket == NULL) {
1376 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1378 cERROR(1, ("Error %d creating socket",rc));
1382 /* BB other socket options to set KEEPALIVE, NODELAY? */
1383 cFYI(1,("Socket created"));
1384 (*csocket)->sk->sk_allocation = GFP_NOFS;
1388 psin_server->sin_family = AF_INET;
1389 if(psin_server->sin_port) { /* user overrode default port */
1390 rc = (*csocket)->ops->connect(*csocket,
1391 (struct sockaddr *) psin_server,
1392 sizeof (struct sockaddr_in),0);
1398 /* save original port so we can retry user specified port
1399 later if fall back ports fail this time */
1400 orig_port = psin_server->sin_port;
1402 /* do not retry on the same port we just failed on */
1403 if(psin_server->sin_port != htons(CIFS_PORT)) {
1404 psin_server->sin_port = htons(CIFS_PORT);
1406 rc = (*csocket)->ops->connect(*csocket,
1407 (struct sockaddr *) psin_server,
1408 sizeof (struct sockaddr_in),0);
1414 psin_server->sin_port = htons(RFC1001_PORT);
1415 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1416 psin_server, sizeof (struct sockaddr_in),0);
1421 /* give up here - unless we want to retry on different
1422 protocol families some day */
1425 psin_server->sin_port = orig_port;
1426 cFYI(1,("Error %d connecting to server via ipv4",rc));
1427 sock_release(*csocket);
1431 /* Eventually check for other socket options to change from
1432 the default. sock_setsockopt not used because it expects
1433 user space buffer */
1434 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1435 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1436 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1437 /* make the bufsizes depend on wsize/rsize and max requests */
1438 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1439 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1440 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1441 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1443 /* send RFC1001 sessinit */
1444 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1445 /* some servers require RFC1001 sessinit before sending
1446 negprot - BB check reconnection in case where second
1447 sessinit is sent but no second negprot */
1448 struct rfc1002_session_packet * ses_init_buf;
1449 struct smb_hdr * smb_buf;
1450 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1452 ses_init_buf->trailer.session_req.called_len = 32;
1453 if(target_name && (target_name[0] != 0)) {
1454 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1457 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1458 DEFAULT_CIFS_CALLED_NAME,16);
1461 ses_init_buf->trailer.session_req.calling_len = 32;
1462 /* calling name ends in null (byte 16) from old smb
1464 if(netbios_name && (netbios_name[0] !=0)) {
1465 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1468 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1469 "LINUX_CIFS_CLNT",16);
1471 ses_init_buf->trailer.session_req.scope1 = 0;
1472 ses_init_buf->trailer.session_req.scope2 = 0;
1473 smb_buf = (struct smb_hdr *)ses_init_buf;
1474 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1475 smb_buf->smb_buf_length = 0x81000044;
1476 rc = smb_send(*csocket, smb_buf, 0x44,
1477 (struct sockaddr *)psin_server);
1478 kfree(ses_init_buf);
1480 /* else the negprot may still work without this
1481 even though malloc failed */
1489 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1493 __be16 orig_port = 0;
1495 if(*csocket == NULL) {
1496 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1498 cERROR(1, ("Error %d creating ipv6 socket",rc));
1502 /* BB other socket options to set KEEPALIVE, NODELAY? */
1503 cFYI(1,("ipv6 Socket created"));
1504 (*csocket)->sk->sk_allocation = GFP_NOFS;
1508 psin_server->sin6_family = AF_INET6;
1510 if(psin_server->sin6_port) { /* user overrode default port */
1511 rc = (*csocket)->ops->connect(*csocket,
1512 (struct sockaddr *) psin_server,
1513 sizeof (struct sockaddr_in6),0);
1519 /* save original port so we can retry user specified port
1520 later if fall back ports fail this time */
1522 orig_port = psin_server->sin6_port;
1523 /* do not retry on the same port we just failed on */
1524 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1525 psin_server->sin6_port = htons(CIFS_PORT);
1527 rc = (*csocket)->ops->connect(*csocket,
1528 (struct sockaddr *) psin_server,
1529 sizeof (struct sockaddr_in6),0);
1535 psin_server->sin6_port = htons(RFC1001_PORT);
1536 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1537 psin_server, sizeof (struct sockaddr_in6),0);
1542 /* give up here - unless we want to retry on different
1543 protocol families some day */
1546 psin_server->sin6_port = orig_port;
1547 cFYI(1,("Error %d connecting to server via ipv6",rc));
1548 sock_release(*csocket);
1552 /* Eventually check for other socket options to change from
1553 the default. sock_setsockopt not used because it expects
1554 user space buffer */
1555 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1561 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1562 char *mount_data, const char *devname)
1566 int address_type = AF_INET;
1567 struct socket *csocket = NULL;
1568 struct sockaddr_in sin_server;
1569 struct sockaddr_in6 sin_server6;
1570 struct smb_vol volume_info;
1571 struct cifsSesInfo *pSesInfo = NULL;
1572 struct cifsSesInfo *existingCifsSes = NULL;
1573 struct cifsTconInfo *tcon = NULL;
1574 struct TCP_Server_Info *srvTcp = NULL;
1578 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1580 memset(&volume_info,0,sizeof(struct smb_vol));
1581 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1582 kfree(volume_info.UNC);
1583 kfree(volume_info.password);
1588 if (volume_info.username) {
1589 /* BB fixme parse for domain name here */
1590 cFYI(1, ("Username: %s ", volume_info.username));
1593 cifserror("No username specified");
1594 /* In userspace mount helper we can get user name from alternate
1595 locations such as env variables and files on disk */
1596 kfree(volume_info.UNC);
1597 kfree(volume_info.password);
1602 if (volume_info.UNCip && volume_info.UNC) {
1603 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1606 /* not ipv4 address, try ipv6 */
1607 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1609 address_type = AF_INET6;
1611 address_type = AF_INET;
1615 /* we failed translating address */
1616 kfree(volume_info.UNC);
1617 kfree(volume_info.password);
1622 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1625 } else if (volume_info.UNCip){
1626 /* BB using ip addr as server name connect to the DFS root below */
1627 cERROR(1,("Connecting to DFS root not implemented yet"));
1628 kfree(volume_info.UNC);
1629 kfree(volume_info.password);
1632 } else /* which servers DFS root would we conect to */ {
1634 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1635 kfree(volume_info.UNC);
1636 kfree(volume_info.password);
1641 /* this is needed for ASCII cp to Unicode converts */
1642 if(volume_info.iocharset == NULL) {
1643 cifs_sb->local_nls = load_nls_default();
1644 /* load_nls_default can not return null */
1646 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1647 if(cifs_sb->local_nls == NULL) {
1648 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1649 kfree(volume_info.UNC);
1650 kfree(volume_info.password);
1656 if(address_type == AF_INET)
1657 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1658 NULL /* no ipv6 addr */,
1659 volume_info.username, &srvTcp);
1660 else if(address_type == AF_INET6)
1661 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1662 &sin_server6.sin6_addr,
1663 volume_info.username, &srvTcp);
1665 kfree(volume_info.UNC);
1666 kfree(volume_info.password);
1673 cFYI(1, ("Existing tcp session with server found"));
1674 } else { /* create socket */
1675 if(volume_info.port)
1676 sin_server.sin_port = htons(volume_info.port);
1678 sin_server.sin_port = 0;
1679 rc = ipv4_connect(&sin_server,&csocket,
1680 volume_info.source_rfc1001_name,
1681 volume_info.target_rfc1001_name);
1684 ("Error connecting to IPv4 socket. Aborting operation"));
1686 sock_release(csocket);
1687 kfree(volume_info.UNC);
1688 kfree(volume_info.password);
1693 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1694 if (srvTcp == NULL) {
1696 sock_release(csocket);
1697 kfree(volume_info.UNC);
1698 kfree(volume_info.password);
1702 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1703 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1704 atomic_set(&srvTcp->inFlight,0);
1705 /* BB Add code for ipv6 case too */
1706 srvTcp->ssocket = csocket;
1707 srvTcp->protocolType = IPV4;
1708 init_waitqueue_head(&srvTcp->response_q);
1709 init_waitqueue_head(&srvTcp->request_q);
1710 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1711 /* at this point we are the only ones with the pointer
1712 to the struct since the kernel thread not created yet
1713 so no need to spinlock this init of tcpStatus */
1714 srvTcp->tcpStatus = CifsNew;
1715 init_MUTEX(&srvTcp->tcpSem);
1716 rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1717 CLONE_FS | CLONE_FILES | CLONE_VM);
1720 sock_release(csocket);
1721 kfree(volume_info.UNC);
1722 kfree(volume_info.password);
1726 wait_for_completion(&cifsd_complete);
1728 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1729 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1730 srvTcp->sequence_number = 0;
1734 if (existingCifsSes) {
1735 pSesInfo = existingCifsSes;
1736 cFYI(1, ("Existing smb sess found"));
1737 kfree(volume_info.password);
1738 /* volume_info.UNC freed at end of function */
1740 cFYI(1, ("Existing smb sess not found"));
1741 pSesInfo = sesInfoAlloc();
1742 if (pSesInfo == NULL)
1745 pSesInfo->server = srvTcp;
1746 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1747 NIPQUAD(sin_server.sin_addr.s_addr));
1751 /* volume_info.password freed at unmount */
1752 if (volume_info.password)
1753 pSesInfo->password = volume_info.password;
1754 if (volume_info.username)
1755 strncpy(pSesInfo->userName,
1756 volume_info.username,MAX_USERNAME_SIZE);
1757 if (volume_info.domainname)
1758 strncpy(pSesInfo->domainName,
1759 volume_info.domainname,MAX_USERNAME_SIZE);
1760 pSesInfo->linux_uid = volume_info.linux_uid;
1761 down(&pSesInfo->sesSem);
1762 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1763 up(&pSesInfo->sesSem);
1765 atomic_inc(&srvTcp->socketUseCount);
1767 kfree(volume_info.password);
1770 /* search for existing tcon to this server share */
1772 if(volume_info.rsize > CIFSMaxBufSize) {
1773 cERROR(1,("rsize %d too large, using MaxBufSize",
1774 volume_info.rsize));
1775 cifs_sb->rsize = CIFSMaxBufSize;
1776 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1777 cifs_sb->rsize = volume_info.rsize;
1779 cifs_sb->rsize = CIFSMaxBufSize;
1781 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1782 cERROR(1,("wsize %d too large using 4096 instead",
1783 volume_info.wsize));
1784 cifs_sb->wsize = 4096;
1785 } else if(volume_info.wsize)
1786 cifs_sb->wsize = volume_info.wsize;
1788 cifs_sb->wsize = CIFSMaxBufSize; /* default */
1789 if(cifs_sb->rsize < PAGE_CACHE_SIZE) {
1790 cifs_sb->rsize = PAGE_CACHE_SIZE;
1791 /* Windows ME does this */
1792 cFYI(1,("Attempt to set readsize for mount to less than one page (4096)"));
1794 cifs_sb->mnt_uid = volume_info.linux_uid;
1795 cifs_sb->mnt_gid = volume_info.linux_gid;
1796 cifs_sb->mnt_file_mode = volume_info.file_mode;
1797 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1798 cFYI(1,("file mode: 0x%x dir mode: 0x%x",cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1800 if(volume_info.noperm)
1801 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1802 if(volume_info.setuids)
1803 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1804 if(volume_info.server_ino)
1805 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1806 if(volume_info.remap)
1807 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1808 if(volume_info.no_xattr)
1809 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1810 if(volume_info.sfu_emul)
1811 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1812 if(volume_info.nobrl)
1813 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1814 if(volume_info.cifs_acl)
1815 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1817 if(volume_info.direct_io) {
1818 cFYI(1,("mounting share using direct i/o"));
1819 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1823 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1824 volume_info.username);
1826 cFYI(1, ("Found match on UNC path"));
1827 /* we can have only one retry value for a connection
1828 to a share so for resources mounted more than once
1829 to the same server share the last value passed in
1830 for the retry flag is used */
1831 tcon->retry = volume_info.retry;
1832 tcon->nocase = volume_info.nocase;
1834 tcon = tconInfoAlloc();
1838 /* check for null share name ie connect to dfs root */
1840 /* BB check if this works for exactly length three strings */
1841 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
1842 && (strchr(volume_info.UNC + 3, '/') ==
1844 rc = connect_to_dfs_path(xid, pSesInfo,
1845 "", cifs_sb->local_nls,
1846 cifs_sb->mnt_cifs_flags &
1847 CIFS_MOUNT_MAP_SPECIAL_CHR);
1848 kfree(volume_info.UNC);
1852 rc = CIFSTCon(xid, pSesInfo,
1854 tcon, cifs_sb->local_nls);
1855 cFYI(1, ("CIFS Tcon rc = %d", rc));
1858 atomic_inc(&pSesInfo->inUse);
1859 tcon->retry = volume_info.retry;
1860 tcon->nocase = volume_info.nocase;
1866 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
1867 sb->s_maxbytes = (u64) 1 << 63;
1869 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
1872 sb->s_time_gran = 100;
1874 /* on error free sesinfo and tcon struct if needed */
1876 /* if session setup failed, use count is zero but
1877 we still need to free cifsd thread */
1878 if(atomic_read(&srvTcp->socketUseCount) == 0) {
1879 spin_lock(&GlobalMid_Lock);
1880 srvTcp->tcpStatus = CifsExiting;
1881 spin_unlock(&GlobalMid_Lock);
1883 send_sig(SIGKILL,srvTcp->tsk,1);
1884 wait_for_completion(&cifsd_complete);
1887 /* If find_unc succeeded then rc == 0 so we can not end */
1888 if (tcon) /* up accidently freeing someone elses tcon struct */
1890 if (existingCifsSes == NULL) {
1892 if ((pSesInfo->server) &&
1893 (pSesInfo->status == CifsGood)) {
1895 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
1896 /* if the socketUseCount is now zero */
1897 if((temp_rc == -ESHUTDOWN) &&
1898 (pSesInfo->server->tsk)) {
1899 send_sig(SIGKILL,pSesInfo->server->tsk,1);
1900 wait_for_completion(&cifsd_complete);
1903 cFYI(1, ("No session or bad tcon"));
1904 sesInfoFree(pSesInfo);
1905 /* pSesInfo = NULL; */
1909 atomic_inc(&tcon->useCount);
1910 cifs_sb->tcon = tcon;
1911 tcon->ses = pSesInfo;
1913 /* do not care if following two calls succeed - informational only */
1914 CIFSSMBQFSDeviceInfo(xid, tcon);
1915 CIFSSMBQFSAttributeInfo(xid, tcon);
1916 if (tcon->ses->capabilities & CAP_UNIX) {
1917 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1918 if(!volume_info.no_psx_acl) {
1919 if(CIFS_UNIX_POSIX_ACL_CAP &
1920 le64_to_cpu(tcon->fsUnixInfo.Capability))
1921 cFYI(1,("server negotiated posix acl support"));
1922 sb->s_flags |= MS_POSIXACL;
1925 /* Try and negotiate POSIX pathnames if we can. */
1926 if (volume_info.posix_paths && (CIFS_UNIX_POSIX_PATHNAMES_CAP &
1927 le64_to_cpu(tcon->fsUnixInfo.Capability))) {
1928 if (!CIFSSMBSetFSUnixInfo(xid, tcon, CIFS_UNIX_POSIX_PATHNAMES_CAP)) {
1929 cFYI(1,("negotiated posix pathnames support"));
1930 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
1932 cFYI(1,("posix pathnames support requested but not supported"));
1937 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
1938 cifs_sb->wsize = min(cifs_sb->wsize,
1939 (tcon->ses->server->maxBuf -
1940 MAX_CIFS_HDR_SIZE));
1941 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
1942 cifs_sb->rsize = min(cifs_sb->rsize,
1943 (tcon->ses->server->maxBuf -
1944 MAX_CIFS_HDR_SIZE));
1947 /* volume_info.password is freed above when existing session found
1948 (in which case it is not needed anymore) but when new sesion is created
1949 the password ptr is put in the new session structure (in which case the
1950 password will be freed at unmount time) */
1951 kfree(volume_info.UNC);
1957 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
1958 char session_key[CIFS_SESSION_KEY_SIZE],
1959 const struct nls_table *nls_codepage)
1961 struct smb_hdr *smb_buffer;
1962 struct smb_hdr *smb_buffer_response;
1963 SESSION_SETUP_ANDX *pSMB;
1964 SESSION_SETUP_ANDX *pSMBr;
1969 int remaining_words = 0;
1970 int bytes_returned = 0;
1975 cFYI(1, ("In sesssetup "));
1978 user = ses->userName;
1979 domain = ses->domainName;
1980 smb_buffer = cifs_buf_get();
1981 if (smb_buffer == NULL) {
1984 smb_buffer_response = smb_buffer;
1985 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
1987 /* send SMBsessionSetup here */
1988 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
1989 NULL /* no tCon exists yet */ , 13 /* wct */ );
1991 smb_buffer->Mid = GetNextMid(ses->server);
1992 pSMB->req_no_secext.AndXCommand = 0xFF;
1993 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
1994 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
1996 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
1997 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
1999 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2000 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2001 if (ses->capabilities & CAP_UNICODE) {
2002 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2003 capabilities |= CAP_UNICODE;
2005 if (ses->capabilities & CAP_STATUS32) {
2006 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2007 capabilities |= CAP_STATUS32;
2009 if (ses->capabilities & CAP_DFS) {
2010 smb_buffer->Flags2 |= SMBFLG2_DFS;
2011 capabilities |= CAP_DFS;
2013 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2015 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2016 cpu_to_le16(CIFS_SESSION_KEY_SIZE);
2018 pSMB->req_no_secext.CaseSensitivePasswordLength =
2019 cpu_to_le16(CIFS_SESSION_KEY_SIZE);
2020 bcc_ptr = pByteArea(smb_buffer);
2021 memcpy(bcc_ptr, (char *) session_key, CIFS_SESSION_KEY_SIZE);
2022 bcc_ptr += CIFS_SESSION_KEY_SIZE;
2023 memcpy(bcc_ptr, (char *) session_key, CIFS_SESSION_KEY_SIZE);
2024 bcc_ptr += CIFS_SESSION_KEY_SIZE;
2026 if (ses->capabilities & CAP_UNICODE) {
2027 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2032 bytes_returned = 0; /* skill null user */
2035 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2037 /* convert number of 16 bit words to bytes */
2038 bcc_ptr += 2 * bytes_returned;
2039 bcc_ptr += 2; /* trailing null */
2042 cifs_strtoUCS((__le16 *) bcc_ptr,
2043 "CIFS_LINUX_DOM", 32, nls_codepage);
2046 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2048 bcc_ptr += 2 * bytes_returned;
2051 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2053 bcc_ptr += 2 * bytes_returned;
2055 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release,
2057 bcc_ptr += 2 * bytes_returned;
2060 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2062 bcc_ptr += 2 * bytes_returned;
2066 strncpy(bcc_ptr, user, 200);
2067 bcc_ptr += strnlen(user, 200);
2071 if (domain == NULL) {
2072 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2073 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2075 strncpy(bcc_ptr, domain, 64);
2076 bcc_ptr += strnlen(domain, 64);
2080 strcpy(bcc_ptr, "Linux version ");
2081 bcc_ptr += strlen("Linux version ");
2082 strcpy(bcc_ptr, system_utsname.release);
2083 bcc_ptr += strlen(system_utsname.release) + 1;
2084 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2085 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2087 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2088 smb_buffer->smb_buf_length += count;
2089 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2091 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2092 &bytes_returned, 1);
2094 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2095 } else if ((smb_buffer_response->WordCount == 3)
2096 || (smb_buffer_response->WordCount == 4)) {
2097 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2098 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2099 if (action & GUEST_LOGIN)
2100 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2101 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2102 cFYI(1, ("UID = %d ", ses->Suid));
2103 /* response can have either 3 or 4 word count - Samba sends 3 */
2104 bcc_ptr = pByteArea(smb_buffer_response);
2105 if ((pSMBr->resp.hdr.WordCount == 3)
2106 || ((pSMBr->resp.hdr.WordCount == 4)
2107 && (blob_len < pSMBr->resp.ByteCount))) {
2108 if (pSMBr->resp.hdr.WordCount == 4)
2109 bcc_ptr += blob_len;
2111 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2112 if ((long) (bcc_ptr) % 2) {
2114 (BCC(smb_buffer_response) - 1) /2;
2115 bcc_ptr++; /* Unicode strings must be word aligned */
2118 BCC(smb_buffer_response) / 2;
2121 UniStrnlen((wchar_t *) bcc_ptr,
2122 remaining_words - 1);
2123 /* We look for obvious messed up bcc or strings in response so we do not go off
2124 the end since (at least) WIN2K and Windows XP have a major bug in not null
2125 terminating last Unicode string in response */
2126 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2127 if(ses->serverOS == NULL)
2128 goto sesssetup_nomem;
2129 cifs_strfromUCS_le(ses->serverOS,
2130 (__le16 *)bcc_ptr, len,nls_codepage);
2131 bcc_ptr += 2 * (len + 1);
2132 remaining_words -= len + 1;
2133 ses->serverOS[2 * len] = 0;
2134 ses->serverOS[1 + (2 * len)] = 0;
2135 if (remaining_words > 0) {
2136 len = UniStrnlen((wchar_t *)bcc_ptr,
2138 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2139 if(ses->serverNOS == NULL)
2140 goto sesssetup_nomem;
2141 cifs_strfromUCS_le(ses->serverNOS,
2142 (__le16 *)bcc_ptr,len,nls_codepage);
2143 bcc_ptr += 2 * (len + 1);
2144 ses->serverNOS[2 * len] = 0;
2145 ses->serverNOS[1 + (2 * len)] = 0;
2146 if(strncmp(ses->serverNOS,
2147 "NT LAN Manager 4",16) == 0) {
2148 cFYI(1,("NT4 server"));
2149 ses->flags |= CIFS_SES_NT4;
2151 remaining_words -= len + 1;
2152 if (remaining_words > 0) {
2153 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2154 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2156 kzalloc(2*(len+1),GFP_KERNEL);
2157 if(ses->serverDomain == NULL)
2158 goto sesssetup_nomem;
2159 cifs_strfromUCS_le(ses->serverDomain,
2160 (__le16 *)bcc_ptr,len,nls_codepage);
2161 bcc_ptr += 2 * (len + 1);
2162 ses->serverDomain[2*len] = 0;
2163 ses->serverDomain[1+(2*len)] = 0;
2164 } /* else no more room so create dummy domain string */
2167 kzalloc(2, GFP_KERNEL);
2168 } else { /* no room so create dummy domain and NOS string */
2169 /* if these kcallocs fail not much we
2170 can do, but better to not fail the
2173 kzalloc(2, GFP_KERNEL);
2175 kzalloc(2, GFP_KERNEL);
2177 } else { /* ASCII */
2178 len = strnlen(bcc_ptr, 1024);
2179 if (((long) bcc_ptr + len) - (long)
2180 pByteArea(smb_buffer_response)
2181 <= BCC(smb_buffer_response)) {
2182 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2183 if(ses->serverOS == NULL)
2184 goto sesssetup_nomem;
2185 strncpy(ses->serverOS,bcc_ptr, len);
2188 bcc_ptr[0] = 0; /* null terminate the string */
2191 len = strnlen(bcc_ptr, 1024);
2192 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2193 if(ses->serverNOS == NULL)
2194 goto sesssetup_nomem;
2195 strncpy(ses->serverNOS, bcc_ptr, len);
2200 len = strnlen(bcc_ptr, 1024);
2201 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2202 if(ses->serverDomain == NULL)
2203 goto sesssetup_nomem;
2204 strncpy(ses->serverDomain, bcc_ptr, len);
2210 ("Variable field of length %d extends beyond end of smb ",
2215 (" Security Blob Length extends beyond end of SMB"));
2219 (" Invalid Word count %d: ",
2220 smb_buffer_response->WordCount));
2223 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2224 since that could make reconnection harder, and
2225 reconnection might be needed to free memory */
2227 cifs_buf_release(smb_buffer);
2233 CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2234 char *SecurityBlob,int SecurityBlobLength,
2235 const struct nls_table *nls_codepage)
2237 struct smb_hdr *smb_buffer;
2238 struct smb_hdr *smb_buffer_response;
2239 SESSION_SETUP_ANDX *pSMB;
2240 SESSION_SETUP_ANDX *pSMBr;
2245 int remaining_words = 0;
2246 int bytes_returned = 0;
2251 cFYI(1, ("In spnego sesssetup "));
2254 user = ses->userName;
2255 domain = ses->domainName;
2257 smb_buffer = cifs_buf_get();
2258 if (smb_buffer == NULL) {
2261 smb_buffer_response = smb_buffer;
2262 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2264 /* send SMBsessionSetup here */
2265 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2266 NULL /* no tCon exists yet */ , 12 /* wct */ );
2268 smb_buffer->Mid = GetNextMid(ses->server);
2269 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2270 pSMB->req.AndXCommand = 0xFF;
2271 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2272 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2274 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2275 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2277 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2278 CAP_EXTENDED_SECURITY;
2279 if (ses->capabilities & CAP_UNICODE) {
2280 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2281 capabilities |= CAP_UNICODE;
2283 if (ses->capabilities & CAP_STATUS32) {
2284 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2285 capabilities |= CAP_STATUS32;
2287 if (ses->capabilities & CAP_DFS) {
2288 smb_buffer->Flags2 |= SMBFLG2_DFS;
2289 capabilities |= CAP_DFS;
2291 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2293 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2294 bcc_ptr = pByteArea(smb_buffer);
2295 memcpy(bcc_ptr, SecurityBlob, SecurityBlobLength);
2296 bcc_ptr += SecurityBlobLength;
2298 if (ses->capabilities & CAP_UNICODE) {
2299 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode strings */
2304 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100, nls_codepage);
2305 bcc_ptr += 2 * bytes_returned; /* convert num of 16 bit words to bytes */
2306 bcc_ptr += 2; /* trailing null */
2309 cifs_strtoUCS((__le16 *) bcc_ptr,
2310 "CIFS_LINUX_DOM", 32, nls_codepage);
2313 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2315 bcc_ptr += 2 * bytes_returned;
2318 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2320 bcc_ptr += 2 * bytes_returned;
2322 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2324 bcc_ptr += 2 * bytes_returned;
2327 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2329 bcc_ptr += 2 * bytes_returned;
2332 strncpy(bcc_ptr, user, 200);
2333 bcc_ptr += strnlen(user, 200);
2336 if (domain == NULL) {
2337 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2338 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2340 strncpy(bcc_ptr, domain, 64);
2341 bcc_ptr += strnlen(domain, 64);
2345 strcpy(bcc_ptr, "Linux version ");
2346 bcc_ptr += strlen("Linux version ");
2347 strcpy(bcc_ptr, system_utsname.release);
2348 bcc_ptr += strlen(system_utsname.release) + 1;
2349 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2350 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2352 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2353 smb_buffer->smb_buf_length += count;
2354 pSMB->req.ByteCount = cpu_to_le16(count);
2356 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2357 &bytes_returned, 1);
2359 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2360 } else if ((smb_buffer_response->WordCount == 3)
2361 || (smb_buffer_response->WordCount == 4)) {
2362 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2364 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2365 if (action & GUEST_LOGIN)
2366 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
2368 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2369 cFYI(1, ("UID = %d ", ses->Suid));
2370 bcc_ptr = pByteArea(smb_buffer_response); /* response can have either 3 or 4 word count - Samba sends 3 */
2372 /* BB Fix below to make endian neutral !! */
2374 if ((pSMBr->resp.hdr.WordCount == 3)
2375 || ((pSMBr->resp.hdr.WordCount == 4)
2377 pSMBr->resp.ByteCount))) {
2378 if (pSMBr->resp.hdr.WordCount == 4) {
2382 ("Security Blob Length %d ",
2386 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2387 if ((long) (bcc_ptr) % 2) {
2389 (BCC(smb_buffer_response)
2391 bcc_ptr++; /* Unicode strings must be word aligned */
2395 (smb_buffer_response) / 2;
2398 UniStrnlen((wchar_t *) bcc_ptr,
2399 remaining_words - 1);
2400 /* We look for obvious messed up bcc or strings in response so we do not go off
2401 the end since (at least) WIN2K and Windows XP have a major bug in not null
2402 terminating last Unicode string in response */
2404 kzalloc(2 * (len + 1), GFP_KERNEL);
2405 cifs_strfromUCS_le(ses->serverOS,
2409 bcc_ptr += 2 * (len + 1);
2410 remaining_words -= len + 1;
2411 ses->serverOS[2 * len] = 0;
2412 ses->serverOS[1 + (2 * len)] = 0;
2413 if (remaining_words > 0) {
2414 len = UniStrnlen((wchar_t *)bcc_ptr,
2418 kzalloc(2 * (len + 1),
2420 cifs_strfromUCS_le(ses->serverNOS,
2424 bcc_ptr += 2 * (len + 1);
2425 ses->serverNOS[2 * len] = 0;
2426 ses->serverNOS[1 + (2 * len)] = 0;
2427 remaining_words -= len + 1;
2428 if (remaining_words > 0) {
2429 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2430 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2431 ses->serverDomain = kzalloc(2*(len+1),GFP_KERNEL);
2432 cifs_strfromUCS_le(ses->serverDomain,
2435 bcc_ptr += 2*(len+1);
2436 ses->serverDomain[2*len] = 0;
2437 ses->serverDomain[1+(2*len)] = 0;
2438 } /* else no more room so create dummy domain string */
2441 kzalloc(2,GFP_KERNEL);
2442 } else { /* no room so create dummy domain and NOS string */
2443 ses->serverDomain = kzalloc(2, GFP_KERNEL);
2444 ses->serverNOS = kzalloc(2, GFP_KERNEL);
2446 } else { /* ASCII */
2448 len = strnlen(bcc_ptr, 1024);
2449 if (((long) bcc_ptr + len) - (long)
2450 pByteArea(smb_buffer_response)
2451 <= BCC(smb_buffer_response)) {
2452 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
2453 strncpy(ses->serverOS, bcc_ptr, len);
2456 bcc_ptr[0] = 0; /* null terminate the string */
2459 len = strnlen(bcc_ptr, 1024);
2460 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2461 strncpy(ses->serverNOS, bcc_ptr, len);
2466 len = strnlen(bcc_ptr, 1024);
2467 ses->serverDomain = kzalloc(len + 1, GFP_KERNEL);
2468 strncpy(ses->serverDomain, bcc_ptr, len);
2474 ("Variable field of length %d extends beyond end of smb ",
2479 (" Security Blob Length extends beyond end of SMB"));
2482 cERROR(1, ("No session structure passed in."));
2486 (" Invalid Word count %d: ",
2487 smb_buffer_response->WordCount));
2492 cifs_buf_release(smb_buffer);
2498 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2499 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2500 const struct nls_table *nls_codepage)
2502 struct smb_hdr *smb_buffer;
2503 struct smb_hdr *smb_buffer_response;
2504 SESSION_SETUP_ANDX *pSMB;
2505 SESSION_SETUP_ANDX *pSMBr;
2509 int remaining_words = 0;
2510 int bytes_returned = 0;
2512 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2513 PNEGOTIATE_MESSAGE SecurityBlob;
2514 PCHALLENGE_MESSAGE SecurityBlob2;
2515 __u32 negotiate_flags, capabilities;
2518 cFYI(1, ("In NTLMSSP sesssetup (negotiate) "));
2521 domain = ses->domainName;
2522 *pNTLMv2_flag = FALSE;
2523 smb_buffer = cifs_buf_get();
2524 if (smb_buffer == NULL) {
2527 smb_buffer_response = smb_buffer;
2528 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2529 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2531 /* send SMBsessionSetup here */
2532 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2533 NULL /* no tCon exists yet */ , 12 /* wct */ );
2535 smb_buffer->Mid = GetNextMid(ses->server);
2536 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2537 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2539 pSMB->req.AndXCommand = 0xFF;
2540 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2541 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2543 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2544 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2546 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2547 CAP_EXTENDED_SECURITY;
2548 if (ses->capabilities & CAP_UNICODE) {
2549 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2550 capabilities |= CAP_UNICODE;
2552 if (ses->capabilities & CAP_STATUS32) {
2553 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2554 capabilities |= CAP_STATUS32;
2556 if (ses->capabilities & CAP_DFS) {
2557 smb_buffer->Flags2 |= SMBFLG2_DFS;
2558 capabilities |= CAP_DFS;
2560 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2562 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2563 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2564 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2565 SecurityBlob->MessageType = NtLmNegotiate;
2567 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2568 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM | 0x80000000 |
2569 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2571 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2573 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2574 /* setup pointers to domain name and workstation name */
2575 bcc_ptr += SecurityBlobLength;
2577 SecurityBlob->WorkstationName.Buffer = 0;
2578 SecurityBlob->WorkstationName.Length = 0;
2579 SecurityBlob->WorkstationName.MaximumLength = 0;
2581 if (domain == NULL) {
2582 SecurityBlob->DomainName.Buffer = 0;
2583 SecurityBlob->DomainName.Length = 0;
2584 SecurityBlob->DomainName.MaximumLength = 0;
2587 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2588 strncpy(bcc_ptr, domain, 63);
2589 len = strnlen(domain, 64);
2590 SecurityBlob->DomainName.MaximumLength =
2592 SecurityBlob->DomainName.Buffer =
2593 cpu_to_le32((long) &SecurityBlob->
2595 (long) &SecurityBlob->Signature);
2597 SecurityBlobLength += len;
2598 SecurityBlob->DomainName.Length =
2601 if (ses->capabilities & CAP_UNICODE) {
2602 if ((long) bcc_ptr % 2) {
2608 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2610 bcc_ptr += 2 * bytes_returned;
2612 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2614 bcc_ptr += 2 * bytes_returned;
2615 bcc_ptr += 2; /* null terminate Linux version */
2617 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2619 bcc_ptr += 2 * bytes_returned;
2622 bcc_ptr += 2; /* null terminate network opsys string */
2625 bcc_ptr += 2; /* null domain */
2626 } else { /* ASCII */
2627 strcpy(bcc_ptr, "Linux version ");
2628 bcc_ptr += strlen("Linux version ");
2629 strcpy(bcc_ptr, system_utsname.release);
2630 bcc_ptr += strlen(system_utsname.release) + 1;
2631 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2632 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2633 bcc_ptr++; /* empty domain field */
2636 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2637 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2638 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2639 smb_buffer->smb_buf_length += count;
2640 pSMB->req.ByteCount = cpu_to_le16(count);
2642 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2643 &bytes_returned, 1);
2645 if (smb_buffer_response->Status.CifsError ==
2646 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2650 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2651 } else if ((smb_buffer_response->WordCount == 3)
2652 || (smb_buffer_response->WordCount == 4)) {
2653 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2654 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2656 if (action & GUEST_LOGIN)
2657 cFYI(1, (" Guest login"));
2658 /* Do we want to set anything in SesInfo struct when guest login? */
2660 bcc_ptr = pByteArea(smb_buffer_response);
2661 /* response can have either 3 or 4 word count - Samba sends 3 */
2663 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2664 if (SecurityBlob2->MessageType != NtLmChallenge) {
2666 ("Unexpected NTLMSSP message type received %d",
2667 SecurityBlob2->MessageType));
2669 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2670 cFYI(1, ("UID = %d ", ses->Suid));
2671 if ((pSMBr->resp.hdr.WordCount == 3)
2672 || ((pSMBr->resp.hdr.WordCount == 4)
2674 pSMBr->resp.ByteCount))) {
2676 if (pSMBr->resp.hdr.WordCount == 4) {
2677 bcc_ptr += blob_len;
2679 ("Security Blob Length %d ",
2683 cFYI(1, ("NTLMSSP Challenge rcvd "));
2685 memcpy(ses->server->cryptKey,
2686 SecurityBlob2->Challenge,
2687 CIFS_CRYPTO_KEY_SIZE);
2688 if(SecurityBlob2->NegotiateFlags & cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2689 *pNTLMv2_flag = TRUE;
2691 if((SecurityBlob2->NegotiateFlags &
2692 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2693 || (sign_CIFS_PDUs > 1))
2694 ses->server->secMode |=
2695 SECMODE_SIGN_REQUIRED;
2696 if ((SecurityBlob2->NegotiateFlags &
2697 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2698 ses->server->secMode |=
2699 SECMODE_SIGN_ENABLED;
2701 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2702 if ((long) (bcc_ptr) % 2) {
2704 (BCC(smb_buffer_response)
2706 bcc_ptr++; /* Unicode strings must be word aligned */
2710 (smb_buffer_response) / 2;
2713 UniStrnlen((wchar_t *) bcc_ptr,
2714 remaining_words - 1);
2715 /* We look for obvious messed up bcc or strings in response so we do not go off
2716 the end since (at least) WIN2K and Windows XP have a major bug in not null
2717 terminating last Unicode string in response */
2719 kzalloc(2 * (len + 1), GFP_KERNEL);
2720 cifs_strfromUCS_le(ses->serverOS,
2724 bcc_ptr += 2 * (len + 1);
2725 remaining_words -= len + 1;
2726 ses->serverOS[2 * len] = 0;
2727 ses->serverOS[1 + (2 * len)] = 0;
2728 if (remaining_words > 0) {
2729 len = UniStrnlen((wchar_t *)
2734 kzalloc(2 * (len + 1),
2736 cifs_strfromUCS_le(ses->
2742 bcc_ptr += 2 * (len + 1);
2743 ses->serverNOS[2 * len] = 0;
2746 remaining_words -= len + 1;
2747 if (remaining_words > 0) {
2748 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2749 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2761 ses->serverDomain[2*len]
2766 } /* else no more room so create dummy domain string */
2771 } else { /* no room so create dummy domain and NOS string */
2773 kzalloc(2, GFP_KERNEL);
2775 kzalloc(2, GFP_KERNEL);
2777 } else { /* ASCII */
2778 len = strnlen(bcc_ptr, 1024);
2779 if (((long) bcc_ptr + len) - (long)
2780 pByteArea(smb_buffer_response)
2781 <= BCC(smb_buffer_response)) {
2785 strncpy(ses->serverOS,
2789 bcc_ptr[0] = 0; /* null terminate string */
2792 len = strnlen(bcc_ptr, 1024);
2796 strncpy(ses->serverNOS, bcc_ptr, len);
2801 len = strnlen(bcc_ptr, 1024);
2805 strncpy(ses->serverDomain, bcc_ptr, len);
2811 ("Variable field of length %d extends beyond end of smb ",
2816 (" Security Blob Length extends beyond end of SMB"));
2819 cERROR(1, ("No session structure passed in."));
2823 (" Invalid Word count %d: ",
2824 smb_buffer_response->WordCount));
2829 cifs_buf_release(smb_buffer);
2834 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2835 char *ntlm_session_key, int ntlmv2_flag,
2836 const struct nls_table *nls_codepage)
2838 struct smb_hdr *smb_buffer;
2839 struct smb_hdr *smb_buffer_response;
2840 SESSION_SETUP_ANDX *pSMB;
2841 SESSION_SETUP_ANDX *pSMBr;
2846 int remaining_words = 0;
2847 int bytes_returned = 0;
2849 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2850 PAUTHENTICATE_MESSAGE SecurityBlob;
2851 __u32 negotiate_flags, capabilities;
2854 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2857 user = ses->userName;
2858 domain = ses->domainName;
2859 smb_buffer = cifs_buf_get();
2860 if (smb_buffer == NULL) {
2863 smb_buffer_response = smb_buffer;
2864 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2865 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2867 /* send SMBsessionSetup here */
2868 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2869 NULL /* no tCon exists yet */ , 12 /* wct */ );
2871 smb_buffer->Mid = GetNextMid(ses->server);
2872 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2873 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2874 pSMB->req.AndXCommand = 0xFF;
2875 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2876 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2878 pSMB->req.hdr.Uid = ses->Suid;
2880 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2881 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2883 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2884 CAP_EXTENDED_SECURITY;
2885 if (ses->capabilities & CAP_UNICODE) {
2886 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2887 capabilities |= CAP_UNICODE;
2889 if (ses->capabilities & CAP_STATUS32) {
2890 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2891 capabilities |= CAP_STATUS32;
2893 if (ses->capabilities & CAP_DFS) {
2894 smb_buffer->Flags2 |= SMBFLG2_DFS;
2895 capabilities |= CAP_DFS;
2897 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2899 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2900 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2901 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2902 SecurityBlob->MessageType = NtLmAuthenticate;
2903 bcc_ptr += SecurityBlobLength;
2905 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2906 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2907 0x80000000 | NTLMSSP_NEGOTIATE_128;
2909 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2911 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2913 /* setup pointers to domain name and workstation name */
2915 SecurityBlob->WorkstationName.Buffer = 0;
2916 SecurityBlob->WorkstationName.Length = 0;
2917 SecurityBlob->WorkstationName.MaximumLength = 0;
2918 SecurityBlob->SessionKey.Length = 0;
2919 SecurityBlob->SessionKey.MaximumLength = 0;
2920 SecurityBlob->SessionKey.Buffer = 0;
2922 SecurityBlob->LmChallengeResponse.Length = 0;
2923 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2924 SecurityBlob->LmChallengeResponse.Buffer = 0;
2926 SecurityBlob->NtChallengeResponse.Length =
2927 cpu_to_le16(CIFS_SESSION_KEY_SIZE);
2928 SecurityBlob->NtChallengeResponse.MaximumLength =
2929 cpu_to_le16(CIFS_SESSION_KEY_SIZE);
2930 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESSION_KEY_SIZE);
2931 SecurityBlob->NtChallengeResponse.Buffer =
2932 cpu_to_le32(SecurityBlobLength);
2933 SecurityBlobLength += CIFS_SESSION_KEY_SIZE;
2934 bcc_ptr += CIFS_SESSION_KEY_SIZE;
2936 if (ses->capabilities & CAP_UNICODE) {
2937 if (domain == NULL) {
2938 SecurityBlob->DomainName.Buffer = 0;
2939 SecurityBlob->DomainName.Length = 0;
2940 SecurityBlob->DomainName.MaximumLength = 0;
2943 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2946 SecurityBlob->DomainName.MaximumLength =
2948 SecurityBlob->DomainName.Buffer =
2949 cpu_to_le32(SecurityBlobLength);
2951 SecurityBlobLength += len;
2952 SecurityBlob->DomainName.Length =
2956 SecurityBlob->UserName.Buffer = 0;
2957 SecurityBlob->UserName.Length = 0;
2958 SecurityBlob->UserName.MaximumLength = 0;
2961 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2964 SecurityBlob->UserName.MaximumLength =
2966 SecurityBlob->UserName.Buffer =
2967 cpu_to_le32(SecurityBlobLength);
2969 SecurityBlobLength += len;
2970 SecurityBlob->UserName.Length =
2974 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2975 SecurityBlob->WorkstationName.Length *= 2;
2976 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2977 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2978 bcc_ptr += SecurityBlob->WorkstationName.Length;
2979 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2980 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2982 if ((long) bcc_ptr % 2) {
2987 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2989 bcc_ptr += 2 * bytes_returned;
2991 cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2993 bcc_ptr += 2 * bytes_returned;
2994 bcc_ptr += 2; /* null term version string */
2996 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2998 bcc_ptr += 2 * bytes_returned;
3001 bcc_ptr += 2; /* null terminate network opsys string */
3004 bcc_ptr += 2; /* null domain */
3005 } else { /* ASCII */
3006 if (domain == NULL) {
3007 SecurityBlob->DomainName.Buffer = 0;
3008 SecurityBlob->DomainName.Length = 0;
3009 SecurityBlob->DomainName.MaximumLength = 0;
3012 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
3013 strncpy(bcc_ptr, domain, 63);
3014 len = strnlen(domain, 64);
3015 SecurityBlob->DomainName.MaximumLength =
3017 SecurityBlob->DomainName.Buffer =
3018 cpu_to_le32(SecurityBlobLength);
3020 SecurityBlobLength += len;
3021 SecurityBlob->DomainName.Length = cpu_to_le16(len);
3024 SecurityBlob->UserName.Buffer = 0;
3025 SecurityBlob->UserName.Length = 0;
3026 SecurityBlob->UserName.MaximumLength = 0;
3029 strncpy(bcc_ptr, user, 63);
3030 len = strnlen(user, 64);
3031 SecurityBlob->UserName.MaximumLength =
3033 SecurityBlob->UserName.Buffer =
3034 cpu_to_le32(SecurityBlobLength);
3036 SecurityBlobLength += len;
3037 SecurityBlob->UserName.Length = cpu_to_le16(len);
3039 /* BB fill in our workstation name if known BB */
3041 strcpy(bcc_ptr, "Linux version ");
3042 bcc_ptr += strlen("Linux version ");
3043 strcpy(bcc_ptr, system_utsname.release);
3044 bcc_ptr += strlen(system_utsname.release) + 1;
3045 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
3046 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
3047 bcc_ptr++; /* null domain */
3050 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
3051 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
3052 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
3053 smb_buffer->smb_buf_length += count;
3054 pSMB->req.ByteCount = cpu_to_le16(count);
3056 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3057 &bytes_returned, 1);
3059 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
3060 } else if ((smb_buffer_response->WordCount == 3)
3061 || (smb_buffer_response->WordCount == 4)) {
3062 __u16 action = le16_to_cpu(pSMBr->resp.Action);
3064 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
3065 if (action & GUEST_LOGIN)
3066 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
3067 /* if(SecurityBlob2->MessageType != NtLm??){
3068 cFYI("Unexpected message type on auth response is %d "));
3072 ("Does UID on challenge %d match auth response UID %d ",
3073 ses->Suid, smb_buffer_response->Uid));
3074 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
3075 bcc_ptr = pByteArea(smb_buffer_response);
3076 /* response can have either 3 or 4 word count - Samba sends 3 */
3077 if ((pSMBr->resp.hdr.WordCount == 3)
3078 || ((pSMBr->resp.hdr.WordCount == 4)
3080 pSMBr->resp.ByteCount))) {
3081 if (pSMBr->resp.hdr.WordCount == 4) {
3085 ("Security Blob Length %d ",
3090 ("NTLMSSP response to Authenticate "));
3092 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3093 if ((long) (bcc_ptr) % 2) {
3095 (BCC(smb_buffer_response)
3097 bcc_ptr++; /* Unicode strings must be word aligned */
3099 remaining_words = BCC(smb_buffer_response) / 2;
3102 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3103 /* We look for obvious messed up bcc or strings in response so we do not go off
3104 the end since (at least) WIN2K and Windows XP have a major bug in not null
3105 terminating last Unicode string in response */
3107 kzalloc(2 * (len + 1), GFP_KERNEL);
3108 cifs_strfromUCS_le(ses->serverOS,
3112 bcc_ptr += 2 * (len + 1);
3113 remaining_words -= len + 1;
3114 ses->serverOS[2 * len] = 0;
3115 ses->serverOS[1 + (2 * len)] = 0;
3116 if (remaining_words > 0) {
3117 len = UniStrnlen((wchar_t *)
3122 kzalloc(2 * (len + 1),
3124 cifs_strfromUCS_le(ses->
3130 bcc_ptr += 2 * (len + 1);
3131 ses->serverNOS[2 * len] = 0;
3132 ses->serverNOS[1+(2*len)] = 0;
3133 remaining_words -= len + 1;
3134 if (remaining_words > 0) {
3135 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3136 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3161 } /* else no more room so create dummy domain string */
3163 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3164 } else { /* no room so create dummy domain and NOS string */
3165 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3166 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3168 } else { /* ASCII */
3169 len = strnlen(bcc_ptr, 1024);
3170 if (((long) bcc_ptr + len) -
3171 (long) pByteArea(smb_buffer_response)
3172 <= BCC(smb_buffer_response)) {
3173 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3174 strncpy(ses->serverOS,bcc_ptr, len);
3177 bcc_ptr[0] = 0; /* null terminate the string */
3180 len = strnlen(bcc_ptr, 1024);
3181 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3182 strncpy(ses->serverNOS, bcc_ptr, len);
3187 len = strnlen(bcc_ptr, 1024);
3188 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3189 strncpy(ses->serverDomain, bcc_ptr, len);
3195 ("Variable field of length %d extends beyond end of smb ",
3200 (" Security Blob Length extends beyond end of SMB"));
3203 cERROR(1, ("No session structure passed in."));
3207 (" Invalid Word count %d: ",
3208 smb_buffer_response->WordCount));
3213 cifs_buf_release(smb_buffer);
3219 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3220 const char *tree, struct cifsTconInfo *tcon,
3221 const struct nls_table *nls_codepage)
3223 struct smb_hdr *smb_buffer;
3224 struct smb_hdr *smb_buffer_response;
3227 unsigned char *bcc_ptr;
3235 smb_buffer = cifs_buf_get();
3236 if (smb_buffer == NULL) {
3239 smb_buffer_response = smb_buffer;
3241 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3242 NULL /*no tid */ , 4 /*wct */ );
3244 smb_buffer->Mid = GetNextMid(ses->server);
3245 smb_buffer->Uid = ses->Suid;
3246 pSMB = (TCONX_REQ *) smb_buffer;
3247 pSMBr = (TCONX_RSP *) smb_buffer_response;
3249 pSMB->AndXCommand = 0xFF;
3250 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3251 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3252 bcc_ptr = &pSMB->Password[0];
3253 bcc_ptr++; /* skip password */
3255 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3256 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3258 if (ses->capabilities & CAP_STATUS32) {
3259 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3261 if (ses->capabilities & CAP_DFS) {
3262 smb_buffer->Flags2 |= SMBFLG2_DFS;
3264 if (ses->capabilities & CAP_UNICODE) {
3265 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3267 cifs_strtoUCS((__le16 *) bcc_ptr, tree, 100, nls_codepage);
3268 bcc_ptr += 2 * length; /* convert num of 16 bit words to bytes */
3269 bcc_ptr += 2; /* skip trailing null */
3270 } else { /* ASCII */
3272 strcpy(bcc_ptr, tree);
3273 bcc_ptr += strlen(tree) + 1;
3275 strcpy(bcc_ptr, "?????");
3276 bcc_ptr += strlen("?????");
3278 count = bcc_ptr - &pSMB->Password[0];
3279 pSMB->hdr.smb_buf_length += count;
3280 pSMB->ByteCount = cpu_to_le16(count);
3282 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3284 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3285 /* above now done in SendReceive */
3286 if ((rc == 0) && (tcon != NULL)) {
3287 tcon->tidStatus = CifsGood;
3288 tcon->tid = smb_buffer_response->Tid;
3289 bcc_ptr = pByteArea(smb_buffer_response);
3290 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3291 /* skip service field (NB: this field is always ASCII) */
3292 bcc_ptr += length + 1;
3293 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3294 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3295 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3296 if ((bcc_ptr + (2 * length)) -
3297 pByteArea(smb_buffer_response) <=
3298 BCC(smb_buffer_response)) {
3299 kfree(tcon->nativeFileSystem);
3300 tcon->nativeFileSystem =
3301 kzalloc(length + 2, GFP_KERNEL);
3302 cifs_strfromUCS_le(tcon->nativeFileSystem,
3304 length, nls_codepage);
3305 bcc_ptr += 2 * length;
3306 bcc_ptr[0] = 0; /* null terminate the string */
3310 /* else do not bother copying these informational fields */
3312 length = strnlen(bcc_ptr, 1024);
3313 if ((bcc_ptr + length) -
3314 pByteArea(smb_buffer_response) <=
3315 BCC(smb_buffer_response)) {
3316 kfree(tcon->nativeFileSystem);
3317 tcon->nativeFileSystem =
3318 kzalloc(length + 1, GFP_KERNEL);
3319 strncpy(tcon->nativeFileSystem, bcc_ptr,
3322 /* else do not bother copying these informational fields */
3324 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3325 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3326 } else if ((rc == 0) && tcon == NULL) {
3327 /* all we need to save for IPC$ connection */
3328 ses->ipc_tid = smb_buffer_response->Tid;
3332 cifs_buf_release(smb_buffer);
3337 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3341 struct cifsSesInfo *ses = NULL;
3342 struct task_struct *cifsd_task;
3346 if (cifs_sb->tcon) {
3347 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3348 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3353 tconInfoFree(cifs_sb->tcon);
3354 if ((ses) && (ses->server)) {
3355 /* save off task so we do not refer to ses later */
3356 cifsd_task = ses->server->tsk;
3357 cFYI(1, ("About to do SMBLogoff "));
3358 rc = CIFSSMBLogoff(xid, ses);
3362 } else if (rc == -ESHUTDOWN) {
3363 cFYI(1,("Waking up socket by sending it signal"));
3365 send_sig(SIGKILL,cifsd_task,1);
3366 wait_for_completion(&cifsd_complete);
3369 } /* else - we have an smb session
3370 left on this socket do not kill cifsd */
3372 cFYI(1, ("No session or bad tcon"));
3375 cifs_sb->tcon = NULL;
3377 schedule_timeout_interruptible(msecs_to_jiffies(500));
3382 return rc; /* BB check if we should always return zero here */
3385 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3386 struct nls_table * nls_info)
3389 char ntlm_session_key[CIFS_SESSION_KEY_SIZE];
3390 int ntlmv2_flag = FALSE;
3393 /* what if server changes its buffer size after dropping the session? */
3394 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3395 rc = CIFSSMBNegotiate(xid, pSesInfo);
3396 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3397 rc = CIFSSMBNegotiate(xid, pSesInfo);
3402 spin_lock(&GlobalMid_Lock);
3403 if(pSesInfo->server->tcpStatus != CifsExiting)
3404 pSesInfo->server->tcpStatus = CifsGood;
3407 spin_unlock(&GlobalMid_Lock);
3413 pSesInfo->capabilities = pSesInfo->server->capabilities;
3414 if(linuxExtEnabled == 0)
3415 pSesInfo->capabilities &= (~CAP_UNIX);
3416 /* pSesInfo->sequence_number = 0;*/
3417 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x Time Zone: %d",
3418 pSesInfo->server->secMode,
3419 pSesInfo->server->capabilities,
3420 pSesInfo->server->timeZone));
3421 if (extended_security
3422 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3423 && (pSesInfo->server->secType == NTLMSSP)) {
3424 cFYI(1, ("New style sesssetup "));
3425 rc = CIFSSpnegoSessSetup(xid, pSesInfo,
3426 NULL /* security blob */,
3427 0 /* blob length */,
3429 } else if (extended_security
3430 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3431 && (pSesInfo->server->secType == RawNTLMSSP)) {
3432 cFYI(1, ("NTLMSSP sesssetup "));
3433 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3440 cFYI(1,("Can use more secure NTLM version 2 password hash"));
3441 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3446 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3448 CalcNTLMv2_response(pSesInfo,v2_response);
3450 cifs_calculate_ntlmv2_mac_key(
3451 pSesInfo->server->mac_signing_key,
3452 response, ntlm_session_key, */
3454 /* BB Put dummy sig in SessSetup PDU? */
3461 SMBNTencrypt(pSesInfo->password,
3462 pSesInfo->server->cryptKey,
3466 cifs_calculate_mac_key(
3467 pSesInfo->server->mac_signing_key,
3469 pSesInfo->password);
3471 /* for better security the weaker lanman hash not sent
3472 in AuthSessSetup so we no longer calculate it */
3474 rc = CIFSNTLMSSPAuthSessSetup(xid,
3480 } else { /* old style NTLM 0.12 session setup */
3481 SMBNTencrypt(pSesInfo->password,
3482 pSesInfo->server->cryptKey,
3486 cifs_calculate_mac_key(
3487 pSesInfo->server->mac_signing_key,
3488 ntlm_session_key, pSesInfo->password);
3490 rc = CIFSSessSetup(xid, pSesInfo,
3491 ntlm_session_key, nls_info);
3494 cERROR(1,("Send error in SessSetup = %d",rc));
3496 cFYI(1,("CIFS Session Established successfully"));
3497 pSesInfo->status = CifsGood;