fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2006
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <asm/uaccess.h>
  37 #include <asm/processor.h>
  38 #include "cifspdu.h"
  39 #include "cifsglob.h"
  40 #include "cifsproto.h"
  41 #include "cifs_unicode.h"
  42 #include "cifs_debug.h"
  43 #include "cifs_fs_sb.h"
  44 #include "ntlmssp.h"
  45 #include "nterr.h"
  46 #include "rfc1002pdu.h"
  47 #include "cn_cifs.h"
  48
  49 #define CIFS_PORT 445
  50 #define RFC1001_PORT 139
  51
  52 static DECLARE_COMPLETION(cifsd_complete);
  53
  54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  55                          unsigned char *p24);
  56
  57 extern mempool_t *cifs_req_poolp;
  58
  59 struct smb_vol {
  60         char *username;
  61         char *password;
  62         char *domainname;
  63         char *UNC;
  64         char *UNCip;
  65         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  66         char *iocharset;  /* local code page for mapping to and from Unicode */
  67         char source_rfc1001_name[16]; /* netbios name of client */
  68         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  69         uid_t linux_uid;
  70         gid_t linux_gid;
  71         mode_t file_mode;
  72         mode_t dir_mode;
  73         unsigned secFlg;
  74         unsigned rw:1;
  75         unsigned retry:1;
  76         unsigned intr:1;
  77         unsigned setuids:1;
  78         unsigned noperm:1;
  79         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  80         unsigned cifs_acl:1;
  81         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  82         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  83         unsigned direct_io:1;
  84         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  85         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  86         unsigned sfu_emul:1;
  87         unsigned nullauth:1; /* attempt to authenticate with null user */
  88         unsigned nocase;     /* request case insensitive filenames */
  89         unsigned nobrl;      /* disable sending byte range locks to srv */
  90         unsigned int rsize;
  91         unsigned int wsize;
  92         unsigned int sockopt;
  93         unsigned short int port;
  94         char * prepath;
  95 };
  96
  97 static int ipv4_connect(struct sockaddr_in *psin_server,
  98                         struct socket **csocket,
  99                         char * netb_name,
 100                         char * server_netb_name);
 101 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 102                         struct socket **csocket);
 103
 104
 105         /*
 106          * cifs tcp session reconnection
 107          *
 108          * mark tcp session as reconnecting so temporarily locked
 109          * mark all smb sessions as reconnecting for tcp session
 110          * reconnect tcp session
 111          * wake up waiters on reconnection? - (not needed currently)
 112          */
 113
 114 static int
 115 cifs_reconnect(struct TCP_Server_Info *server)
 116 {
 117         int rc = 0;
 118         struct list_head *tmp;
 119         struct cifsSesInfo *ses;
 120         struct cifsTconInfo *tcon;
 121         struct mid_q_entry * mid_entry;
 122
 123         spin_lock(&GlobalMid_Lock);
 124         if( kthread_should_stop() ) {
 125                 /* the demux thread will exit normally
 126                 next time through the loop */
 127                 spin_unlock(&GlobalMid_Lock);
 128                 return rc;
 129         } else
 130                 server->tcpStatus = CifsNeedReconnect;
 131         spin_unlock(&GlobalMid_Lock);
 132         server->maxBuf = 0;
 133
 134         cFYI(1, ("Reconnecting tcp session"));
 135
 136         /* before reconnecting the tcp session, mark the smb session (uid)
 137                 and the tid bad so they are not used until reconnected */
 138         read_lock(&GlobalSMBSeslock);
 139         list_for_each(tmp, &GlobalSMBSessionList) {
 140                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 141                 if (ses->server) {
 142                         if (ses->server == server) {
 143                                 ses->status = CifsNeedReconnect;
 144                                 ses->ipc_tid = 0;
 145                         }
 146                 }
 147                 /* else tcp and smb sessions need reconnection */
 148         }
 149         list_for_each(tmp, &GlobalTreeConnectionList) {
 150                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 151                 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 152                         tcon->tidStatus = CifsNeedReconnect;
 153                 }
 154         }
 155         read_unlock(&GlobalSMBSeslock);
 156         /* do not want to be sending data on a socket we are freeing */
 157         down(&server->tcpSem);
 158         if(server->ssocket) {
 159                 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 160                         server->ssocket->flags));
 161                 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
 162                 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
 163                         server->ssocket->flags));
 164                 sock_release(server->ssocket);
 165                 server->ssocket = NULL;
 166         }
 167
 168         spin_lock(&GlobalMid_Lock);
 169         list_for_each(tmp, &server->pending_mid_q) {
 170                 mid_entry = list_entry(tmp, struct
 171                                         mid_q_entry,
 172                                         qhead);
 173                 if(mid_entry) {
 174                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
 175                                 /* Mark other intransit requests as needing
 176                                    retry so we do not immediately mark the
 177                                    session bad again (ie after we reconnect
 178                                    below) as they timeout too */
 179                                 mid_entry->midState = MID_RETRY_NEEDED;
 180                         }
 181                 }
 182         }
 183         spin_unlock(&GlobalMid_Lock);
 184         up(&server->tcpSem);
 185
 186         while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood))
 187         {
 188                 try_to_freeze();
 189                 if(server->protocolType == IPV6) {
 190                         rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
 191                 } else {
 192                         rc = ipv4_connect(&server->addr.sockAddr,
 193                                         &server->ssocket,
 194                                         server->workstation_RFC1001_name,
 195                                         server->server_RFC1001_name);
 196                 }
 197                 if(rc) {
 198                         cFYI(1,("reconnect error %d",rc));
 199                         msleep(3000);
 200                 } else {
 201                         atomic_inc(&tcpSesReconnectCount);
 202                         spin_lock(&GlobalMid_Lock);
 203                         if( !kthread_should_stop() )
 204                                 server->tcpStatus = CifsGood;
 205                         server->sequence_number = 0;
 206                         spin_unlock(&GlobalMid_Lock);
 207         /*              atomic_set(&server->inFlight,0);*/
 208                         wake_up(&server->response_q);
 209                 }
 210         }
 211         return rc;
 212 }
 213
 214 /*
 215         return codes:
 216                 0       not a transact2, or all data present
 217                 >0      transact2 with that much data missing
 218                 -EINVAL = invalid transact2
 219
 220  */
 221 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
 222 {
 223         struct smb_t2_rsp * pSMBt;
 224         int total_data_size;
 225         int data_in_this_rsp;
 226         int remaining;
 227
 228         if(pSMB->Command != SMB_COM_TRANSACTION2)
 229                 return 0;
 230
 231         /* check for plausible wct, bcc and t2 data and parm sizes */
 232         /* check for parm and data offset going beyond end of smb */
 233         if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 234                 cFYI(1,("invalid transact2 word count"));
 235                 return -EINVAL;
 236         }
 237
 238         pSMBt = (struct smb_t2_rsp *)pSMB;
 239
 240         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 241         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 242
 243         remaining = total_data_size - data_in_this_rsp;
 244
 245         if(remaining == 0)
 246                 return 0;
 247         else if(remaining < 0) {
 248                 cFYI(1,("total data %d smaller than data in frame %d",
 249                         total_data_size, data_in_this_rsp));
 250                 return -EINVAL;
 251         } else {
 252                 cFYI(1,("missing %d bytes from transact2, check next response",
 253                         remaining));
 254                 if(total_data_size > maxBufSize) {
 255                         cERROR(1,("TotalDataSize %d is over maximum buffer %d",
 256                                 total_data_size,maxBufSize));
 257                         return -EINVAL;
 258                 }
 259                 return remaining;
 260         }
 261 }
 262
 263 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
 264 {
 265         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 266         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 267         int total_data_size;
 268         int total_in_buf;
 269         int remaining;
 270         int total_in_buf2;
 271         char * data_area_of_target;
 272         char * data_area_of_buf2;
 273         __u16 byte_count;
 274
 275         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 276
 277         if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 278                 cFYI(1,("total data sizes of primary and secondary t2 differ"));
 279         }
 280
 281         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 282
 283         remaining = total_data_size - total_in_buf;
 284
 285         if(remaining < 0)
 286                 return -EINVAL;
 287
 288         if(remaining == 0) /* nothing to do, ignore */
 289                 return 0;
 290
 291         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 292         if(remaining < total_in_buf2) {
 293                 cFYI(1,("transact2 2nd response contains too much data"));
 294         }
 295
 296         /* find end of first SMB data area */
 297         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 298                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 299         /* validate target area */
 300
 301         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 302                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 303
 304         data_area_of_target += total_in_buf;
 305
 306         /* copy second buffer into end of first buffer */
 307         memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
 308         total_in_buf += total_in_buf2;
 309         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 310         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 311         byte_count += total_in_buf2;
 312         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 313
 314         byte_count = pTargetSMB->smb_buf_length;
 315         byte_count += total_in_buf2;
 316
 317         /* BB also add check that we are not beyond maximum buffer size */
 318
 319         pTargetSMB->smb_buf_length = byte_count;
 320
 321         if(remaining == total_in_buf2) {
 322                 cFYI(1,("found the last secondary response"));
 323                 return 0; /* we are done */
 324         } else /* more responses to go */
 325                 return 1;
 326
 327 }
 328
 329 static int
 330 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 331 {
 332         int length;
 333         unsigned int pdu_length, total_read;
 334         struct smb_hdr *smb_buffer = NULL;
 335         struct smb_hdr *bigbuf = NULL;
 336         struct smb_hdr *smallbuf = NULL;
 337         struct msghdr smb_msg;
 338         struct kvec iov;
 339         struct socket *csocket = server->ssocket;
 340         struct list_head *tmp;
 341         struct cifsSesInfo *ses;
 342         struct task_struct *task_to_wake = NULL;
 343         struct mid_q_entry *mid_entry;
 344         char temp;
 345         int isLargeBuf = FALSE;
 346         int isMultiRsp;
 347         int reconnect;
 348
 349         allow_signal(SIGKILL);
 350         current->flags |= PF_MEMALLOC;
 351         server->tsk = current;  /* save process info to wake at shutdown */
 352         cFYI(1, ("Demultiplex PID: %d", current->pid));
 353         write_lock(&GlobalSMBSeslock);
 354         atomic_inc(&tcpSesAllocCount);
 355         length = tcpSesAllocCount.counter;
 356         write_unlock(&GlobalSMBSeslock);
 357         complete(&cifsd_complete);
 358         if(length  > 1) {
 359                 mempool_resize(cifs_req_poolp,
 360                         length + cifs_min_rcv,
 361                         GFP_KERNEL);
 362         }
 363
 364         while (!kthread_should_stop()) {
 365                 if (try_to_freeze())
 366                         continue;
 367                 if (bigbuf == NULL) {
 368                         bigbuf = cifs_buf_get();
 369                         if (!bigbuf) {
 370                                 cERROR(1, ("No memory for large SMB response"));
 371                                 msleep(3000);
 372                                 /* retry will check if exiting */
 373                                 continue;
 374                         }
 375                 } else if (isLargeBuf) {
 376                         /* we are reusing a dirty large buf, clear its start */
 377                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 378                 }
 379
 380                 if (smallbuf == NULL) {
 381                         smallbuf = cifs_small_buf_get();
 382                         if (!smallbuf) {
 383                                 cERROR(1, ("No memory for SMB response"));
 384                                 msleep(1000);
 385                                 /* retry will check if exiting */
 386                                 continue;
 387                         }
 388                         /* beginning of smb buffer is cleared in our buf_get */
 389                 } else /* if existing small buf clear beginning */
 390                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 391
 392                 isLargeBuf = FALSE;
 393                 isMultiRsp = FALSE;
 394                 smb_buffer = smallbuf;
 395                 iov.iov_base = smb_buffer;
 396                 iov.iov_len = 4;
 397                 smb_msg.msg_control = NULL;
 398                 smb_msg.msg_controllen = 0;
 399                 length =
 400                     kernel_recvmsg(csocket, &smb_msg,
 401                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 402
 403                 if ( kthread_should_stop() ) {
 404                         break;
 405                 } else if (server->tcpStatus == CifsNeedReconnect) {
 406                         cFYI(1, ("Reconnect after server stopped responding"));
 407                         cifs_reconnect(server);
 408                         cFYI(1, ("call to reconnect done"));
 409                         csocket = server->ssocket;
 410                         continue;
 411                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 412                         msleep(1); /* minimum sleep to prevent looping
 413                                 allowing socket to clear and app threads to set
 414                                 tcpStatus CifsNeedReconnect if server hung */
 415                         continue;
 416                 } else if (length <= 0) {
 417                         if (server->tcpStatus == CifsNew) {
 418                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 419                                 /* some servers kill the TCP session rather than
 420                                    returning an SMB negprot error, in which
 421                                    case reconnecting here is not going to help,
 422                                    and so simply return error to mount */
 423                                 break;
 424                         }
 425                         if (!try_to_freeze() && (length == -EINTR)) {
 426                                 cFYI(1,("cifsd thread killed"));
 427                                 break;
 428                         }
 429                         cFYI(1,("Reconnect after unexpected peek error %d",
 430                                 length));
 431                         cifs_reconnect(server);
 432                         csocket = server->ssocket;
 433                         wake_up(&server->response_q);
 434                         continue;
 435                 } else if (length < 4) {
 436                         cFYI(1,
 437                             ("Frame under four bytes received (%d bytes long)",
 438                               length));
 439                         cifs_reconnect(server);
 440                         csocket = server->ssocket;
 441                         wake_up(&server->response_q);
 442                         continue;
 443                 }
 444
 445                 /* The right amount was read from socket - 4 bytes */
 446                 /* so we can now interpret the length field */
 447
 448                 /* the first byte big endian of the length field,
 449                 is actually not part of the length but the type
 450                 with the most common, zero, as regular data */
 451                 temp = *((char *) smb_buffer);
 452
 453                 /* Note that FC 1001 length is big endian on the wire,
 454                 but we convert it here so it is always manipulated
 455                 as host byte order */
 456                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 457                 smb_buffer->smb_buf_length = pdu_length;
 458
 459                 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
 460
 461                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 462                         continue;
 463                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 464                         cFYI(1,("Good RFC 1002 session rsp"));
 465                         continue;
 466                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 467                         /* we get this from Windows 98 instead of
 468                            an error on SMB negprot response */
 469                         cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
 470                                 pdu_length));
 471                         if(server->tcpStatus == CifsNew) {
 472                                 /* if nack on negprot (rather than
 473                                 ret of smb negprot error) reconnecting
 474                                 not going to help, ret error to mount */
 475                                 break;
 476                         } else {
 477                                 /* give server a second to
 478                                 clean up before reconnect attempt */
 479                                 msleep(1000);
 480                                 /* always try 445 first on reconnect
 481                                 since we get NACK on some if we ever
 482                                 connected to port 139 (the NACK is
 483                                 since we do not begin with RFC1001
 484                                 session initialize frame) */
 485                                 server->addr.sockAddr.sin_port =
 486                                         htons(CIFS_PORT);
 487                                 cifs_reconnect(server);
 488                                 csocket = server->ssocket;
 489                                 wake_up(&server->response_q);
 490                                 continue;
 491                         }
 492                 } else if (temp != (char) 0) {
 493                         cERROR(1,("Unknown RFC 1002 frame"));
 494                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 495                                       length);
 496                         cifs_reconnect(server);
 497                         csocket = server->ssocket;
 498                         continue;
 499                 }
 500
 501                 /* else we have an SMB response */
 502                 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 503                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 504                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 505                                         length, pdu_length+4));
 506                         cifs_reconnect(server);
 507                         csocket = server->ssocket;
 508                         wake_up(&server->response_q);
 509                         continue;
 510                 }
 511
 512                 /* else length ok */
 513                 reconnect = 0;
 514
 515                 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 516                         isLargeBuf = TRUE;
 517                         memcpy(bigbuf, smallbuf, 4);
 518                         smb_buffer = bigbuf;
 519                 }
 520                 length = 0;
 521                 iov.iov_base = 4 + (char *)smb_buffer;
 522                 iov.iov_len = pdu_length;
 523                 for (total_read = 0; total_read < pdu_length;
 524                      total_read += length) {
 525                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 526                                                 pdu_length - total_read, 0);
 527                         if( kthread_should_stop() ||
 528                             (length == -EINTR)) {
 529                                 /* then will exit */
 530                                 reconnect = 2;
 531                                 break;
 532                         } else if (server->tcpStatus == CifsNeedReconnect) {
 533                                 cifs_reconnect(server);
 534                                 csocket = server->ssocket;
 535                                 /* Reconnect wakes up rspns q */
 536                                 /* Now we will reread sock */
 537                                 reconnect = 1;
 538                                 break;
 539                         } else if ((length == -ERESTARTSYS) ||
 540                                    (length == -EAGAIN)) {
 541                                 msleep(1); /* minimum sleep to prevent looping,
 542                                               allowing socket to clear and app
 543                                               threads to set tcpStatus
 544                                               CifsNeedReconnect if server hung*/
 545                                 continue;
 546                         } else if (length <= 0) {
 547                                 cERROR(1,("Received no data, expecting %d",
 548                                               pdu_length - total_read));
 549                                 cifs_reconnect(server);
 550                                 csocket = server->ssocket;
 551                                 reconnect = 1;
 552                                 break;
 553                         }
 554                 }
 555                 if(reconnect == 2)
 556                         break;
 557                 else if(reconnect == 1)
 558                         continue;
 559
 560                 length += 4; /* account for rfc1002 hdr */
 561
 562
 563                 dump_smb(smb_buffer, length);
 564                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 565                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 566                         continue;
 567                 }
 568
 569
 570                 task_to_wake = NULL;
 571                 spin_lock(&GlobalMid_Lock);
 572                 list_for_each(tmp, &server->pending_mid_q) {
 573                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 574
 575                         if ((mid_entry->mid == smb_buffer->Mid) &&
 576                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 577                             (mid_entry->command == smb_buffer->Command)) {
 578                                 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
 579                                         /* We have a multipart transact2 resp */
 580                                         isMultiRsp = TRUE;
 581                                         if(mid_entry->resp_buf) {
 582                                                 /* merge response - fix up 1st*/
 583                                                 if(coalesce_t2(smb_buffer,
 584                                                         mid_entry->resp_buf)) {
 585                                                         mid_entry->multiRsp = 1;
 586                                                         break;
 587                                                 } else {
 588                                                         /* all parts received */
 589                                                         mid_entry->multiEnd = 1;
 590                                                         goto multi_t2_fnd;
 591                                                 }
 592                                         } else {
 593                                                 if(!isLargeBuf) {
 594                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 595                                         /* BB maybe we can fix this up,  switch
 596                                            to already allocated large buffer? */
 597                                                 } else {
 598                                                         /* Have first buffer */
 599                                                         mid_entry->resp_buf =
 600                                                                  smb_buffer;
 601                                                         mid_entry->largeBuf = 1;
 602                                                         bigbuf = NULL;
 603                                                 }
 604                                         }
 605                                         break;
 606                                 }
 607                                 mid_entry->resp_buf = smb_buffer;
 608                                 if(isLargeBuf)
 609                                         mid_entry->largeBuf = 1;
 610                                 else
 611                                         mid_entry->largeBuf = 0;
 612 multi_t2_fnd:
 613                                 task_to_wake = mid_entry->tsk;
 614                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 615 #ifdef CONFIG_CIFS_STATS2
 616                                 mid_entry->when_received = jiffies;
 617 #endif
 618                                 /* so we do not time out requests to  server
 619                                 which is still responding (since server could
 620                                 be busy but not dead) */
 621                                 server->lstrp = jiffies;
 622                                 break;
 623                         }
 624                 }
 625                 spin_unlock(&GlobalMid_Lock);
 626                 if (task_to_wake) {
 627                         /* Was previous buf put in mpx struct for multi-rsp? */
 628                         if(!isMultiRsp) {
 629                                 /* smb buffer will be freed by user thread */
 630                                 if(isLargeBuf) {
 631                                         bigbuf = NULL;
 632                                 } else
 633                                         smallbuf = NULL;
 634                         }
 635                         wake_up_process(task_to_wake);
 636                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 637                     && (isMultiRsp == FALSE)) {
 638                         cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
 639                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
 640                                       sizeof(struct smb_hdr));
 641 #ifdef CONFIG_CIFS_DEBUG2
 642                         cifs_dump_detail(smb_buffer);
 643                         cifs_dump_mids(server);
 644 #endif /* CIFS_DEBUG2 */
 645
 646                 }
 647         } /* end while !EXITING */
 648
 649         spin_lock(&GlobalMid_Lock);
 650         server->tcpStatus = CifsExiting;
 651         server->tsk = NULL;
 652         /* check if we have blocked requests that need to free */
 653         /* Note that cifs_max_pending is normally 50, but
 654         can be set at module install time to as little as two */
 655         if(atomic_read(&server->inFlight) >= cifs_max_pending)
 656                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 657         /* We do not want to set the max_pending too low or we
 658         could end up with the counter going negative */
 659         spin_unlock(&GlobalMid_Lock);
 660         /* Although there should not be any requests blocked on
 661         this queue it can not hurt to be paranoid and try to wake up requests
 662         that may haven been blocked when more than 50 at time were on the wire
 663         to the same server - they now will see the session is in exit state
 664         and get out of SendReceive.  */
 665         wake_up_all(&server->request_q);
 666         /* give those requests time to exit */
 667         msleep(125);
 668
 669         if(server->ssocket) {
 670                 sock_release(csocket);
 671                 server->ssocket = NULL;
 672         }
 673         /* buffer usuallly freed in free_mid - need to free it here on exit */
 674         if (bigbuf != NULL)
 675                 cifs_buf_release(bigbuf);
 676         if (smallbuf != NULL)
 677                 cifs_small_buf_release(smallbuf);
 678
 679         read_lock(&GlobalSMBSeslock);
 680         if (list_empty(&server->pending_mid_q)) {
 681                 /* loop through server session structures attached to this and
 682                     mark them dead */
 683                 list_for_each(tmp, &GlobalSMBSessionList) {
 684                         ses =
 685                             list_entry(tmp, struct cifsSesInfo,
 686                                        cifsSessionList);
 687                         if (ses->server == server) {
 688                                 ses->status = CifsExiting;
 689                                 ses->server = NULL;
 690                         }
 691                 }
 692                 read_unlock(&GlobalSMBSeslock);
 693         } else {
 694                 /* although we can not zero the server struct pointer yet,
 695                 since there are active requests which may depnd on them,
 696                 mark the corresponding SMB sessions as exiting too */
 697                 list_for_each(tmp, &GlobalSMBSessionList) {
 698                         ses = list_entry(tmp, struct cifsSesInfo,
 699                                          cifsSessionList);
 700                         if (ses->server == server) {
 701                                 ses->status = CifsExiting;
 702                         }
 703                 }
 704
 705                 spin_lock(&GlobalMid_Lock);
 706                 list_for_each(tmp, &server->pending_mid_q) {
 707                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 708                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 709                                 cFYI(1,
 710                                   ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
 711                                 task_to_wake = mid_entry->tsk;
 712                                 if(task_to_wake) {
 713                                         wake_up_process(task_to_wake);
 714                                 }
 715                         }
 716                 }
 717                 spin_unlock(&GlobalMid_Lock);
 718                 read_unlock(&GlobalSMBSeslock);
 719                 /* 1/8th of sec is more than enough time for them to exit */
 720                 msleep(125);
 721         }
 722
 723         if (!list_empty(&server->pending_mid_q)) {
 724                 /* mpx threads have not exited yet give them
 725                 at least the smb send timeout time for long ops */
 726                 /* due to delays on oplock break requests, we need
 727                 to wait at least 45 seconds before giving up
 728                 on a request getting a response and going ahead
 729                 and killing cifsd */
 730                 cFYI(1, ("Wait for exit from demultiplex thread"));
 731                 msleep(46000);
 732                 /* if threads still have not exited they are probably never
 733                 coming home not much else we can do but free the memory */
 734         }
 735
 736         write_lock(&GlobalSMBSeslock);
 737         atomic_dec(&tcpSesAllocCount);
 738         length = tcpSesAllocCount.counter;
 739
 740         /* last chance to mark ses pointers invalid
 741         if there are any pointing to this (e.g
 742         if a crazy root user tried to kill cifsd
 743         kernel thread explicitly this might happen) */
 744         list_for_each(tmp, &GlobalSMBSessionList) {
 745                 ses = list_entry(tmp, struct cifsSesInfo,
 746                                 cifsSessionList);
 747                 if (ses->server == server) {
 748                         ses->server = NULL;
 749                 }
 750         }
 751         write_unlock(&GlobalSMBSeslock);
 752
 753         kfree(server);
 754         if(length  > 0) {
 755                 mempool_resize(cifs_req_poolp,
 756                         length + cifs_min_rcv,
 757                         GFP_KERNEL);
 758         }
 759
 760         return 0;
 761 }
 762
 763 static int
 764 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 765 {
 766         char *value;
 767         char *data;
 768         unsigned int  temp_len, i, j;
 769         char separator[2];
 770
 771         separator[0] = ',';
 772         separator[1] = 0;
 773
 774         if (Local_System_Name[0] != 0)
 775                 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
 776         else {
 777                 char *nodename = utsname()->nodename;
 778                 int n = strnlen(nodename,15);
 779                 memset(vol->source_rfc1001_name,0x20,15);
 780                 for(i=0 ; i < n ; i++) {
 781                         /* does not have to be perfect mapping since field is
 782                         informational, only used for servers that do not support
 783                         port 445 and it can be overridden at mount time */
 784                         vol->source_rfc1001_name[i] = toupper(nodename[i]);
 785                 }
 786         }
 787         vol->source_rfc1001_name[15] = 0;
 788         /* null target name indicates to use *SMBSERVR default called name
 789            if we end up sending RFC1001 session initialize */
 790         vol->target_rfc1001_name[0] = 0;
 791         vol->linux_uid = current->uid;  /* current->euid instead? */
 792         vol->linux_gid = current->gid;
 793         vol->dir_mode = S_IRWXUGO;
 794         /* 2767 perms indicate mandatory locking support */
 795         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 796
 797         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 798         vol->rw = TRUE;
 799         /* default is always to request posix paths. */
 800         vol->posix_paths = 1;
 801
 802         if (!options)
 803                 return 1;
 804
 805         if(strncmp(options,"sep=",4) == 0) {
 806                 if(options[4] != 0) {
 807                         separator[0] = options[4];
 808                         options += 5;
 809                 } else {
 810                         cFYI(1,("Null separator not allowed"));
 811                 }
 812         }
 813
 814         while ((data = strsep(&options, separator)) != NULL) {
 815                 if (!*data)
 816                         continue;
 817                 if ((value = strchr(data, '=')) != NULL)
 818                         *value++ = '\0';
 819
 820                 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
 821                         vol->no_xattr = 0;
 822                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
 823                         vol->no_xattr = 1;
 824                 } else if (strnicmp(data, "user", 4) == 0) {
 825                         if (!value) {
 826                                 printk(KERN_WARNING
 827                                        "CIFS: invalid or missing username\n");
 828                                 return 1;       /* needs_arg; */
 829                         } else if(!*value) {
 830                                 /* null user, ie anonymous, authentication */
 831                                 vol->nullauth = 1;
 832                         }
 833                         if (strnlen(value, 200) < 200) {
 834                                 vol->username = value;
 835                         } else {
 836                                 printk(KERN_WARNING "CIFS: username too long\n");
 837                                 return 1;
 838                         }
 839                 } else if (strnicmp(data, "pass", 4) == 0) {
 840                         if (!value) {
 841                                 vol->password = NULL;
 842                                 continue;
 843                         } else if(value[0] == 0) {
 844                                 /* check if string begins with double comma
 845                                    since that would mean the password really
 846                                    does start with a comma, and would not
 847                                    indicate an empty string */
 848                                 if(value[1] != separator[0]) {
 849                                         vol->password = NULL;
 850                                         continue;
 851                                 }
 852                         }
 853                         temp_len = strlen(value);
 854                         /* removed password length check, NTLM passwords
 855                                 can be arbitrarily long */
 856
 857                         /* if comma in password, the string will be
 858                         prematurely null terminated.  Commas in password are
 859                         specified across the cifs mount interface by a double
 860                         comma ie ,, and a comma used as in other cases ie ','
 861                         as a parameter delimiter/separator is single and due
 862                         to the strsep above is temporarily zeroed. */
 863
 864                         /* NB: password legally can have multiple commas and
 865                         the only illegal character in a password is null */
 866
 867                         if ((value[temp_len] == 0) &&
 868                             (value[temp_len+1] == separator[0])) {
 869                                 /* reinsert comma */
 870                                 value[temp_len] = separator[0];
 871                                 temp_len+=2;  /* move after the second comma */
 872                                 while(value[temp_len] != 0)  {
 873                                         if (value[temp_len] == separator[0]) {
 874                                                 if (value[temp_len+1] ==
 875                                                      separator[0]) {
 876                                                 /* skip second comma */
 877                                                         temp_len++;
 878                                                 } else {
 879                                                 /* single comma indicating start
 880                                                          of next parm */
 881                                                         break;
 882                                                 }
 883                                         }
 884                                         temp_len++;
 885                                 }
 886                                 if(value[temp_len] == 0) {
 887                                         options = NULL;
 888                                 } else {
 889                                         value[temp_len] = 0;
 890                                         /* point option to start of next parm */
 891                                         options = value + temp_len + 1;
 892                                 }
 893                                 /* go from value to value + temp_len condensing
 894                                 double commas to singles. Note that this ends up
 895                                 allocating a few bytes too many, which is ok */
 896                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 897                                 if(vol->password == NULL) {
 898                                         printk("CIFS: no memory for pass\n");
 899                                         return 1;
 900                                 }
 901                                 for(i=0,j=0;i<temp_len;i++,j++) {
 902                                         vol->password[j] = value[i];
 903                                         if(value[i] == separator[0]
 904                                                 && value[i+1] == separator[0]) {
 905                                                 /* skip second comma */
 906                                                 i++;
 907                                         }
 908                                 }
 909                                 vol->password[j] = 0;
 910                         } else {
 911                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 912                                 if(vol->password == NULL) {
 913                                         printk("CIFS: no memory for pass\n");
 914                                         return 1;
 915                                 }
 916                                 strcpy(vol->password, value);
 917                         }
 918                 } else if (strnicmp(data, "ip", 2) == 0) {
 919                         if (!value || !*value) {
 920                                 vol->UNCip = NULL;
 921                         } else if (strnlen(value, 35) < 35) {
 922                                 vol->UNCip = value;
 923                         } else {
 924                                 printk(KERN_WARNING "CIFS: ip address too long\n");
 925                                 return 1;
 926                         }
 927                 } else if (strnicmp(data, "sec", 3) == 0) {
 928                         if (!value || !*value) {
 929                                 cERROR(1,("no security value specified"));
 930                                 continue;
 931                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 932                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 933                                         CIFSSEC_MUST_SIGN;
 934                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 935                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 936                                         CIFSSEC_MAY_KRB5; */
 937                                 cERROR(1,("Krb5 cifs privacy not supported"));
 938                                 return 1;
 939                         } else if (strnicmp(value, "krb5", 4) == 0) {
 940                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 941                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 942                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 943                                         CIFSSEC_MUST_SIGN;
 944                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 945                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 946                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 947                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 948                                         CIFSSEC_MUST_SIGN;
 949                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 950                                 /* ntlm is default so can be turned off too */
 951                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 952                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 953                                 /* BB is there a better way to do this? */
 954                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 955 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 956                         } else if (strnicmp(value, "lanman", 6) == 0) {
 957                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 958 #endif
 959                         } else if (strnicmp(value, "none", 4) == 0) {
 960                                 vol->nullauth = 1;
 961                         } else {
 962                                 cERROR(1,("bad security option: %s", value));
 963                                 return 1;
 964                         }
 965                 } else if ((strnicmp(data, "unc", 3) == 0)
 966                            || (strnicmp(data, "target", 6) == 0)
 967                            || (strnicmp(data, "path", 4) == 0)) {
 968                         if (!value || !*value) {
 969                                 printk(KERN_WARNING
 970                                        "CIFS: invalid path to network resource\n");
 971                                 return 1;       /* needs_arg; */
 972                         }
 973                         if ((temp_len = strnlen(value, 300)) < 300) {
 974                                 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
 975                                 if(vol->UNC == NULL)
 976                                         return 1;
 977                                 strcpy(vol->UNC,value);
 978                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 979                                         vol->UNC[0] = '\\';
 980                                         vol->UNC[1] = '\\';
 981                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 982                                         printk(KERN_WARNING
 983                                                "CIFS: UNC Path does not begin with // or \\\\ \n");
 984                                         return 1;
 985                                 }
 986                         } else {
 987                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 988                                 return 1;
 989                         }
 990                 } else if ((strnicmp(data, "domain", 3) == 0)
 991                            || (strnicmp(data, "workgroup", 5) == 0)) {
 992                         if (!value || !*value) {
 993                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
 994                                 return 1;       /* needs_arg; */
 995                         }
 996                         /* BB are there cases in which a comma can be valid in
 997                         a domain name and need special handling? */
 998                         if (strnlen(value, 256) < 256) {
 999                                 vol->domainname = value;
1000                                 cFYI(1, ("Domain name set"));
1001                         } else {
1002                                 printk(KERN_WARNING "CIFS: domain name too long\n");
1003                                 return 1;
1004                         }
1005                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1006                         if (!value || !*value) {
1007                                 printk(KERN_WARNING
1008                                        "CIFS: invalid path prefix\n");
1009                                 return 1;       /* needs_arg; */
1010                         }
1011                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1012                                 if(value[0] != '/')
1013                                         temp_len++;  /* missing leading slash */
1014                                 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1015                                 if(vol->prepath == NULL)
1016                                         return 1;
1017                                 if(value[0] != '/') {
1018                                         vol->prepath[0] = '/';
1019                                         strcpy(vol->prepath+1,value);
1020                                 } else
1021                                         strcpy(vol->prepath,value);
1022                                 cFYI(1,("prefix path %s",vol->prepath));
1023                         } else {
1024                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1025                                 return 1;
1026                         }
1027                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1028                         if (!value || !*value) {
1029                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1030                                 return 1;       /* needs_arg; */
1031                         }
1032                         if (strnlen(value, 65) < 65) {
1033                                 if(strnicmp(value,"default",7))
1034                                         vol->iocharset = value;
1035                                 /* if iocharset not set load_nls_default used by caller */
1036                                 cFYI(1, ("iocharset set to %s",value));
1037                         } else {
1038                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1039                                 return 1;
1040                         }
1041                 } else if (strnicmp(data, "uid", 3) == 0) {
1042                         if (value && *value) {
1043                                 vol->linux_uid =
1044                                         simple_strtoul(value, &value, 0);
1045                         }
1046                 } else if (strnicmp(data, "gid", 3) == 0) {
1047                         if (value && *value) {
1048                                 vol->linux_gid =
1049                                         simple_strtoul(value, &value, 0);
1050                         }
1051                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1052                         if (value && *value) {
1053                                 vol->file_mode =
1054                                         simple_strtoul(value, &value, 0);
1055                         }
1056                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1057                         if (value && *value) {
1058                                 vol->dir_mode =
1059                                         simple_strtoul(value, &value, 0);
1060                         }
1061                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1062                         if (value && *value) {
1063                                 vol->dir_mode =
1064                                         simple_strtoul(value, &value, 0);
1065                         }
1066                 } else if (strnicmp(data, "port", 4) == 0) {
1067                         if (value && *value) {
1068                                 vol->port =
1069                                         simple_strtoul(value, &value, 0);
1070                         }
1071                 } else if (strnicmp(data, "rsize", 5) == 0) {
1072                         if (value && *value) {
1073                                 vol->rsize =
1074                                         simple_strtoul(value, &value, 0);
1075                         }
1076                 } else if (strnicmp(data, "wsize", 5) == 0) {
1077                         if (value && *value) {
1078                                 vol->wsize =
1079                                         simple_strtoul(value, &value, 0);
1080                         }
1081                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1082                         if (value && *value) {
1083                                 vol->sockopt =
1084                                         simple_strtoul(value, &value, 0);
1085                         }
1086                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1087                         if (!value || !*value || (*value == ' ')) {
1088                                 cFYI(1,("invalid (empty) netbiosname specified"));
1089                         } else {
1090                                 memset(vol->source_rfc1001_name,0x20,15);
1091                                 for(i=0;i<15;i++) {
1092                                 /* BB are there cases in which a comma can be
1093                                 valid in this workstation netbios name (and need
1094                                 special handling)? */
1095
1096                                 /* We do not uppercase netbiosname for user */
1097                                         if (value[i]==0)
1098                                                 break;
1099                                         else
1100                                                 vol->source_rfc1001_name[i] = value[i];
1101                                 }
1102                                 /* The string has 16th byte zero still from
1103                                 set at top of the function  */
1104                                 if((i==15) && (value[i] != 0))
1105                                         printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1106                         }
1107                 } else if (strnicmp(data, "servern", 7) == 0) {
1108                         /* servernetbiosname specified override *SMBSERVER */
1109                         if (!value || !*value || (*value == ' ')) {
1110                                 cFYI(1,("empty server netbiosname specified"));
1111                         } else {
1112                                 /* last byte, type, is 0x20 for servr type */
1113                                 memset(vol->target_rfc1001_name,0x20,16);
1114
1115                                 for(i=0;i<15;i++) {
1116                                 /* BB are there cases in which a comma can be
1117                                    valid in this workstation netbios name (and need
1118                                    special handling)? */
1119
1120                                 /* user or mount helper must uppercase netbiosname */
1121                                         if (value[i]==0)
1122                                                 break;
1123                                         else
1124                                                 vol->target_rfc1001_name[i] = value[i];
1125                                 }
1126                                 /* The string has 16th byte zero still from
1127                                    set at top of the function  */
1128                                 if((i==15) && (value[i] != 0))
1129                                         printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1130                         }
1131                 } else if (strnicmp(data, "credentials", 4) == 0) {
1132                         /* ignore */
1133                 } else if (strnicmp(data, "version", 3) == 0) {
1134                         /* ignore */
1135                 } else if (strnicmp(data, "guest",5) == 0) {
1136                         /* ignore */
1137                 } else if (strnicmp(data, "rw", 2) == 0) {
1138                         vol->rw = TRUE;
1139                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1140                                    (strnicmp(data, "nosuid", 6) == 0) ||
1141                                    (strnicmp(data, "exec", 4) == 0) ||
1142                                    (strnicmp(data, "noexec", 6) == 0) ||
1143                                    (strnicmp(data, "nodev", 5) == 0) ||
1144                                    (strnicmp(data, "noauto", 6) == 0) ||
1145                                    (strnicmp(data, "dev", 3) == 0)) {
1146                         /*  The mount tool or mount.cifs helper (if present)
1147                                 uses these opts to set flags, and the flags are read
1148                                 by the kernel vfs layer before we get here (ie
1149                                 before read super) so there is no point trying to
1150                                 parse these options again and set anything and it
1151                                 is ok to just ignore them */
1152                         continue;
1153                 } else if (strnicmp(data, "ro", 2) == 0) {
1154                         vol->rw = FALSE;
1155                 } else if (strnicmp(data, "hard", 4) == 0) {
1156                         vol->retry = 1;
1157                 } else if (strnicmp(data, "soft", 4) == 0) {
1158                         vol->retry = 0;
1159                 } else if (strnicmp(data, "perm", 4) == 0) {
1160                         vol->noperm = 0;
1161                 } else if (strnicmp(data, "noperm", 6) == 0) {
1162                         vol->noperm = 1;
1163                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1164                         vol->remap = 1;
1165                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1166                         vol->remap = 0;
1167                 } else if (strnicmp(data, "sfu", 3) == 0) {
1168                         vol->sfu_emul = 1;
1169                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1170                         vol->sfu_emul = 0;
1171                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1172                         vol->posix_paths = 1;
1173                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1174                         vol->posix_paths = 0;
1175                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1176                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1177                         vol->nocase = 1;
1178                 } else if (strnicmp(data, "brl", 3) == 0) {
1179                         vol->nobrl =  0;
1180                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1181                            (strnicmp(data, "nolock", 6) == 0)) {
1182                         vol->nobrl =  1;
1183                         /* turn off mandatory locking in mode
1184                         if remote locking is turned off since the
1185                         local vfs will do advisory */
1186                         if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1187                                 vol->file_mode = S_IALLUGO;
1188                 } else if (strnicmp(data, "setuids", 7) == 0) {
1189                         vol->setuids = 1;
1190                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1191                         vol->setuids = 0;
1192                 } else if (strnicmp(data, "nohard", 6) == 0) {
1193                         vol->retry = 0;
1194                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1195                         vol->retry = 1;
1196                 } else if (strnicmp(data, "nointr", 6) == 0) {
1197                         vol->intr = 0;
1198                 } else if (strnicmp(data, "intr", 4) == 0) {
1199                         vol->intr = 1;
1200                 } else if (strnicmp(data, "serverino",7) == 0) {
1201                         vol->server_ino = 1;
1202                 } else if (strnicmp(data, "noserverino",9) == 0) {
1203                         vol->server_ino = 0;
1204                 } else if (strnicmp(data, "cifsacl",7) == 0) {
1205                         vol->cifs_acl = 1;
1206                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1207                         vol->cifs_acl = 0;
1208                 } else if (strnicmp(data, "acl",3) == 0) {
1209                         vol->no_psx_acl = 0;
1210                 } else if (strnicmp(data, "noacl",5) == 0) {
1211                         vol->no_psx_acl = 1;
1212                 } else if (strnicmp(data, "sign",4) == 0) {
1213                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1214 /*              } else if (strnicmp(data, "seal",4) == 0) {
1215                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1216                 } else if (strnicmp(data, "direct",6) == 0) {
1217                         vol->direct_io = 1;
1218                 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1219                         vol->direct_io = 1;
1220                 } else if (strnicmp(data, "in6_addr",8) == 0) {
1221                         if (!value || !*value) {
1222                                 vol->in6_addr = NULL;
1223                         } else if (strnlen(value, 49) == 48) {
1224                                 vol->in6_addr = value;
1225                         } else {
1226                                 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1227                                 return 1;
1228                         }
1229                 } else if (strnicmp(data, "noac", 4) == 0) {
1230                         printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1231                 } else
1232                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1233         }
1234         if (vol->UNC == NULL) {
1235                 if(devname == NULL) {
1236                         printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1237                         return 1;
1238                 }
1239                 if ((temp_len = strnlen(devname, 300)) < 300) {
1240                         vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1241                         if(vol->UNC == NULL)
1242                                 return 1;
1243                         strcpy(vol->UNC,devname);
1244                         if (strncmp(vol->UNC, "//", 2) == 0) {
1245                                 vol->UNC[0] = '\\';
1246                                 vol->UNC[1] = '\\';
1247                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1248                                 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1249                                 return 1;
1250                         }
1251                 } else {
1252                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1253                         return 1;
1254                 }
1255         }
1256         if(vol->UNCip == NULL)
1257                 vol->UNCip = &vol->UNC[2];
1258
1259         return 0;
1260 }
1261
1262 static struct cifsSesInfo *
1263 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1264                 struct in6_addr *target_ip6_addr,
1265                  char *userName, struct TCP_Server_Info **psrvTcp)
1266 {
1267         struct list_head *tmp;
1268         struct cifsSesInfo *ses;
1269         *psrvTcp = NULL;
1270         read_lock(&GlobalSMBSeslock);
1271
1272         list_for_each(tmp, &GlobalSMBSessionList) {
1273                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1274                 if (ses->server) {
1275                         if((target_ip_addr &&
1276                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1277                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1278                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1279                                         target_ip6_addr,sizeof(*target_ip6_addr)))){
1280                                 /* BB lock server and tcp session and increment use count here?? */
1281                                 *psrvTcp = ses->server; /* found a match on the TCP session */
1282                                 /* BB check if reconnection needed */
1283                                 if (strncmp
1284                                     (ses->userName, userName,
1285                                      MAX_USERNAME_SIZE) == 0){
1286                                         read_unlock(&GlobalSMBSeslock);
1287                                         return ses;     /* found exact match on both tcp and SMB sessions */
1288                                 }
1289                         }
1290                 }
1291                 /* else tcp and smb sessions need reconnection */
1292         }
1293         read_unlock(&GlobalSMBSeslock);
1294         return NULL;
1295 }
1296
1297 static struct cifsTconInfo *
1298 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1299 {
1300         struct list_head *tmp;
1301         struct cifsTconInfo *tcon;
1302
1303         read_lock(&GlobalSMBSeslock);
1304         list_for_each(tmp, &GlobalTreeConnectionList) {
1305                 cFYI(1, ("Next tcon"));
1306                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1307                 if (tcon->ses) {
1308                         if (tcon->ses->server) {
1309                                 cFYI(1,
1310                                      ("old ip addr: %x == new ip %x ?",
1311                                       tcon->ses->server->addr.sockAddr.sin_addr.
1312                                       s_addr, new_target_ip_addr));
1313                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1314                                     s_addr == new_target_ip_addr) {
1315         /* BB lock tcon, server and tcp session and increment use count here? */
1316                                         /* found a match on the TCP session */
1317                                         /* BB check if reconnection needed */
1318                                         cFYI(1,("IP match, old UNC: %s new: %s",
1319                                               tcon->treeName, uncName));
1320                                         if (strncmp
1321                                             (tcon->treeName, uncName,
1322                                              MAX_TREE_SIZE) == 0) {
1323                                                 cFYI(1,
1324                                                      ("and old usr: %s new: %s",
1325                                                       tcon->treeName, uncName));
1326                                                 if (strncmp
1327                                                     (tcon->ses->userName,
1328                                                      userName,
1329                                                      MAX_USERNAME_SIZE) == 0) {
1330                                                         read_unlock(&GlobalSMBSeslock);
1331                                                         /* matched smb session
1332                                                         (user name */
1333                                                         return tcon;
1334                                                 }
1335                                         }
1336                                 }
1337                         }
1338                 }
1339         }
1340         read_unlock(&GlobalSMBSeslock);
1341         return NULL;
1342 }
1343
1344 int
1345 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1346                     const char *old_path, const struct nls_table *nls_codepage,
1347                     int remap)
1348 {
1349         unsigned char *referrals = NULL;
1350         unsigned int num_referrals;
1351         int rc = 0;
1352
1353         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1354                         &num_referrals, &referrals, remap);
1355
1356         /* BB Add in code to: if valid refrl, if not ip address contact
1357                 the helper that resolves tcp names, mount to it, try to
1358                 tcon to it unmount it if fail */
1359
1360         kfree(referrals);
1361
1362         return rc;
1363 }
1364
1365 int
1366 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1367                         const char *old_path, const struct nls_table *nls_codepage,
1368                         unsigned int *pnum_referrals,
1369                         unsigned char ** preferrals, int remap)
1370 {
1371         char *temp_unc;
1372         int rc = 0;
1373
1374         *pnum_referrals = 0;
1375
1376         if (pSesInfo->ipc_tid == 0) {
1377                 temp_unc = kmalloc(2 /* for slashes */ +
1378                         strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1379                                  + 1 + 4 /* slash IPC$ */  + 2,
1380                                 GFP_KERNEL);
1381                 if (temp_unc == NULL)
1382                         return -ENOMEM;
1383                 temp_unc[0] = '\\';
1384                 temp_unc[1] = '\\';
1385                 strcpy(temp_unc + 2, pSesInfo->serverName);
1386                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1387                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1388                 cFYI(1,
1389                      ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1390                 kfree(temp_unc);
1391         }
1392         if (rc == 0)
1393                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1394                                      pnum_referrals, nls_codepage, remap);
1395
1396         return rc;
1397 }
1398
1399 /* See RFC1001 section 14 on representation of Netbios names */
1400 static void rfc1002mangle(char * target,char * source, unsigned int length)
1401 {
1402         unsigned int i,j;
1403
1404         for(i=0,j=0;i<(length);i++) {
1405                 /* mask a nibble at a time and encode */
1406                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1407                 target[j+1] = 'A' + (0x0F & source[i]);
1408                 j+=2;
1409         }
1410
1411 }
1412
1413
1414 static int
1415 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1416              char * netbios_name, char * target_name)
1417 {
1418         int rc = 0;
1419         int connected = 0;
1420         __be16 orig_port = 0;
1421
1422         if(*csocket == NULL) {
1423                 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1424                 if (rc < 0) {
1425                         cERROR(1, ("Error %d creating socket",rc));
1426                         *csocket = NULL;
1427                         return rc;
1428                 } else {
1429                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1430                         cFYI(1,("Socket created"));
1431                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1432                 }
1433         }
1434
1435         psin_server->sin_family = AF_INET;
1436         if(psin_server->sin_port) { /* user overrode default port */
1437                 rc = (*csocket)->ops->connect(*csocket,
1438                                 (struct sockaddr *) psin_server,
1439                                 sizeof (struct sockaddr_in),0);
1440                 if (rc >= 0)
1441                         connected = 1;
1442         }
1443
1444         if(!connected) {
1445                 /* save original port so we can retry user specified port
1446                         later if fall back ports fail this time  */
1447                 orig_port = psin_server->sin_port;
1448
1449                 /* do not retry on the same port we just failed on */
1450                 if(psin_server->sin_port != htons(CIFS_PORT)) {
1451                         psin_server->sin_port = htons(CIFS_PORT);
1452
1453                         rc = (*csocket)->ops->connect(*csocket,
1454                                         (struct sockaddr *) psin_server,
1455                                         sizeof (struct sockaddr_in),0);
1456                         if (rc >= 0)
1457                                 connected = 1;
1458                 }
1459         }
1460         if (!connected) {
1461                 psin_server->sin_port = htons(RFC1001_PORT);
1462                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1463                                               psin_server, sizeof (struct sockaddr_in),0);
1464                 if (rc >= 0)
1465                         connected = 1;
1466         }
1467
1468         /* give up here - unless we want to retry on different
1469                 protocol families some day */
1470         if (!connected) {
1471                 if(orig_port)
1472                         psin_server->sin_port = orig_port;
1473                 cFYI(1,("Error %d connecting to server via ipv4",rc));
1474                 sock_release(*csocket);
1475                 *csocket = NULL;
1476                 return rc;
1477         }
1478         /* Eventually check for other socket options to change from
1479                 the default. sock_setsockopt not used because it expects
1480                 user space buffer */
1481          cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1482                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1483         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1484         /* make the bufsizes depend on wsize/rsize and max requests */
1485         if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1486                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1487         if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1488                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1489
1490         /* send RFC1001 sessinit */
1491         if(psin_server->sin_port == htons(RFC1001_PORT)) {
1492                 /* some servers require RFC1001 sessinit before sending
1493                 negprot - BB check reconnection in case where second
1494                 sessinit is sent but no second negprot */
1495                 struct rfc1002_session_packet * ses_init_buf;
1496                 struct smb_hdr * smb_buf;
1497                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1498                 if(ses_init_buf) {
1499                         ses_init_buf->trailer.session_req.called_len = 32;
1500                         if(target_name && (target_name[0] != 0)) {
1501                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1502                                         target_name, 16);
1503                         } else {
1504                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1505                                         DEFAULT_CIFS_CALLED_NAME,16);
1506                         }
1507
1508                         ses_init_buf->trailer.session_req.calling_len = 32;
1509                         /* calling name ends in null (byte 16) from old smb
1510                         convention. */
1511                         if(netbios_name && (netbios_name[0] !=0)) {
1512                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1513                                         netbios_name,16);
1514                         } else {
1515                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1516                                         "LINUX_CIFS_CLNT",16);
1517                         }
1518                         ses_init_buf->trailer.session_req.scope1 = 0;
1519                         ses_init_buf->trailer.session_req.scope2 = 0;
1520                         smb_buf = (struct smb_hdr *)ses_init_buf;
1521                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1522                         smb_buf->smb_buf_length = 0x81000044;
1523                         rc = smb_send(*csocket, smb_buf, 0x44,
1524                                 (struct sockaddr *)psin_server);
1525                         kfree(ses_init_buf);
1526                         msleep(1); /* RFC1001 layer in at least one server
1527                                       requires very short break before negprot
1528                                       presumably because not expecting negprot
1529                                       to follow so fast.  This is a simple
1530                                       solution that works without
1531                                       complicating the code and causes no
1532                                       significant slowing down on mount
1533                                       for everyone else */
1534                 }
1535                 /* else the negprot may still work without this
1536                 even though malloc failed */
1537
1538         }
1539
1540         return rc;
1541 }
1542
1543 static int
1544 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1545 {
1546         int rc = 0;
1547         int connected = 0;
1548         __be16 orig_port = 0;
1549
1550         if(*csocket == NULL) {
1551                 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1552                 if (rc < 0) {
1553                         cERROR(1, ("Error %d creating ipv6 socket",rc));
1554                         *csocket = NULL;
1555                         return rc;
1556                 } else {
1557                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1558                          cFYI(1,("ipv6 Socket created"));
1559                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1560                 }
1561         }
1562
1563         psin_server->sin6_family = AF_INET6;
1564
1565         if(psin_server->sin6_port) { /* user overrode default port */
1566                 rc = (*csocket)->ops->connect(*csocket,
1567                                 (struct sockaddr *) psin_server,
1568                                 sizeof (struct sockaddr_in6),0);
1569                 if (rc >= 0)
1570                         connected = 1;
1571         }
1572
1573         if(!connected) {
1574                 /* save original port so we can retry user specified port
1575                         later if fall back ports fail this time  */
1576
1577                 orig_port = psin_server->sin6_port;
1578                 /* do not retry on the same port we just failed on */
1579                 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1580                         psin_server->sin6_port = htons(CIFS_PORT);
1581
1582                         rc = (*csocket)->ops->connect(*csocket,
1583                                         (struct sockaddr *) psin_server,
1584                                         sizeof (struct sockaddr_in6),0);
1585                         if (rc >= 0)
1586                                 connected = 1;
1587                 }
1588         }
1589         if (!connected) {
1590                 psin_server->sin6_port = htons(RFC1001_PORT);
1591                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1592                                          psin_server, sizeof (struct sockaddr_in6),0);
1593                 if (rc >= 0)
1594                         connected = 1;
1595         }
1596
1597         /* give up here - unless we want to retry on different
1598                 protocol families some day */
1599         if (!connected) {
1600                 if(orig_port)
1601                         psin_server->sin6_port = orig_port;
1602                 cFYI(1,("Error %d connecting to server via ipv6",rc));
1603                 sock_release(*csocket);
1604                 *csocket = NULL;
1605                 return rc;
1606         }
1607         /* Eventually check for other socket options to change from
1608                 the default. sock_setsockopt not used because it expects
1609                 user space buffer */
1610         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1611
1612         return rc;
1613 }
1614
1615 void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1616                           struct super_block * sb, struct smb_vol * vol_info)
1617 {
1618         /* if we are reconnecting then should we check to see if
1619          * any requested capabilities changed locally e.g. via
1620          * remount but we can not do much about it here
1621          * if they have (even if we could detect it by the following)
1622          * Perhaps we could add a backpointer to array of sb from tcon
1623          * or if we change to make all sb to same share the same
1624          * sb as NFS - then we only have one backpointer to sb.
1625          * What if we wanted to mount the server share twice once with
1626          * and once without posixacls or posix paths? */
1627         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1628
1629
1630         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1631                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1632
1633                 /* check for reconnect case in which we do not
1634                    want to change the mount behavior if we can avoid it */
1635                 if(vol_info == NULL) {
1636                         /* turn off POSIX ACL and PATHNAMES if not set
1637                            originally at mount time */
1638                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1639                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1640                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1641                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1642
1643
1644
1645
1646                 }
1647
1648                 cap &= CIFS_UNIX_CAP_MASK;
1649                 if(vol_info && vol_info->no_psx_acl)
1650                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1651                 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1652                         cFYI(1,("negotiated posix acl support"));
1653                         if(sb)
1654                                 sb->s_flags |= MS_POSIXACL;
1655                 }
1656
1657                 if(vol_info && vol_info->posix_paths == 0)
1658                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1659                 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1660                         cFYI(1,("negotiate posix pathnames"));
1661                         if(sb)
1662                                 CIFS_SB(sb)->mnt_cifs_flags |=
1663                                         CIFS_MOUNT_POSIX_PATHS;
1664                 }
1665
1666                 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1667 #ifdef CONFIG_CIFS_DEBUG2
1668                 if(cap & CIFS_UNIX_FCNTL_CAP)
1669                         cFYI(1,("FCNTL cap"));
1670                 if(cap & CIFS_UNIX_EXTATTR_CAP)
1671                         cFYI(1,("EXTATTR cap"));
1672                 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1673                         cFYI(1,("POSIX path cap"));
1674                 if(cap & CIFS_UNIX_XATTR_CAP)
1675                         cFYI(1,("XATTR cap"));
1676                 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1677                         cFYI(1,("POSIX ACL cap"));
1678 #endif /* CIFS_DEBUG2 */
1679                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1680                         cFYI(1,("setting capabilities failed"));
1681                 }
1682         }
1683 }
1684
1685 int
1686 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1687            char *mount_data, const char *devname)
1688 {
1689         int rc = 0;
1690         int xid;
1691         int address_type = AF_INET;
1692         struct socket *csocket = NULL;
1693         struct sockaddr_in sin_server;
1694         struct sockaddr_in6 sin_server6;
1695         struct smb_vol volume_info;
1696         struct cifsSesInfo *pSesInfo = NULL;
1697         struct cifsSesInfo *existingCifsSes = NULL;
1698         struct cifsTconInfo *tcon = NULL;
1699         struct TCP_Server_Info *srvTcp = NULL;
1700
1701         xid = GetXid();
1702
1703 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1704
1705         memset(&volume_info,0,sizeof(struct smb_vol));
1706         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1707                 kfree(volume_info.UNC);
1708                 kfree(volume_info.password);
1709                 kfree(volume_info.prepath);
1710                 FreeXid(xid);
1711                 return -EINVAL;
1712         }
1713
1714         if (volume_info.username) {
1715                 /* BB fixme parse for domain name here */
1716                 cFYI(1, ("Username: %s ", volume_info.username));
1717
1718         } else if (volume_info.nullauth) {
1719                 cFYI(1,("null user"));
1720         } else {
1721                 cifserror("No username specified");
1722         /* In userspace mount helper we can get user name from alternate
1723            locations such as env variables and files on disk */
1724                 kfree(volume_info.UNC);
1725                 kfree(volume_info.password);
1726                 kfree(volume_info.prepath);
1727                 FreeXid(xid);
1728                 return -EINVAL;
1729         }
1730
1731         if (volume_info.UNCip && volume_info.UNC) {
1732                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1733
1734                 if(rc <= 0) {
1735                         /* not ipv4 address, try ipv6 */
1736                         rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1737                         if(rc > 0)
1738                                 address_type = AF_INET6;
1739                 } else {
1740                         address_type = AF_INET;
1741                 }
1742
1743                 if(rc <= 0) {
1744                         /* we failed translating address */
1745                         kfree(volume_info.UNC);
1746                         kfree(volume_info.password);
1747                         kfree(volume_info.prepath);
1748                         FreeXid(xid);
1749                         return -EINVAL;
1750                 }
1751
1752                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1753                 /* success */
1754                 rc = 0;
1755         } else if (volume_info.UNCip){
1756                 /* BB using ip addr as server name connect to the DFS root below */
1757                 cERROR(1,("Connecting to DFS root not implemented yet"));
1758                 kfree(volume_info.UNC);
1759                 kfree(volume_info.password);
1760                 kfree(volume_info.prepath);
1761                 FreeXid(xid);
1762                 return -EINVAL;
1763         } else /* which servers DFS root would we conect to */ {
1764                 cERROR(1,
1765                        ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1766                 kfree(volume_info.UNC);
1767                 kfree(volume_info.password);
1768                 kfree(volume_info.prepath);
1769                 FreeXid(xid);
1770                 return -EINVAL;
1771         }
1772
1773         /* this is needed for ASCII cp to Unicode converts */
1774         if(volume_info.iocharset == NULL) {
1775                 cifs_sb->local_nls = load_nls_default();
1776         /* load_nls_default can not return null */
1777         } else {
1778                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1779                 if(cifs_sb->local_nls == NULL) {
1780                         cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1781                         kfree(volume_info.UNC);
1782                         kfree(volume_info.password);
1783                         kfree(volume_info.prepath);
1784                         FreeXid(xid);
1785                         return -ELIBACC;
1786                 }
1787         }
1788
1789         if(address_type == AF_INET)
1790                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1791                         NULL /* no ipv6 addr */,
1792                         volume_info.username, &srvTcp);
1793         else if(address_type == AF_INET6)
1794                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1795                         &sin_server6.sin6_addr,
1796                         volume_info.username, &srvTcp);
1797         else {
1798                 kfree(volume_info.UNC);
1799                 kfree(volume_info.password);
1800                 kfree(volume_info.prepath);
1801                 FreeXid(xid);
1802                 return -EINVAL;
1803         }
1804
1805
1806         if (srvTcp) {
1807                 cFYI(1, ("Existing tcp session with server found"));
1808         } else {        /* create socket */
1809                 if(volume_info.port)
1810                         sin_server.sin_port = htons(volume_info.port);
1811                 else
1812                         sin_server.sin_port = 0;
1813                 rc = ipv4_connect(&sin_server,&csocket,
1814                                   volume_info.source_rfc1001_name,
1815                                   volume_info.target_rfc1001_name);
1816                 if (rc < 0) {
1817                         cERROR(1,
1818                                ("Error connecting to IPv4 socket. Aborting operation"));
1819                         if(csocket != NULL)
1820                                 sock_release(csocket);
1821                         kfree(volume_info.UNC);
1822                         kfree(volume_info.password);
1823                         kfree(volume_info.prepath);
1824                         FreeXid(xid);
1825                         return rc;
1826                 }
1827
1828                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1829                 if (srvTcp == NULL) {
1830                         rc = -ENOMEM;
1831                         sock_release(csocket);
1832                         kfree(volume_info.UNC);
1833                         kfree(volume_info.password);
1834                         kfree(volume_info.prepath);
1835                         FreeXid(xid);
1836                         return rc;
1837                 } else {
1838                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1839                         memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1840                         atomic_set(&srvTcp->inFlight,0);
1841                         /* BB Add code for ipv6 case too */
1842                         srvTcp->ssocket = csocket;
1843                         srvTcp->protocolType = IPV4;
1844                         init_waitqueue_head(&srvTcp->response_q);
1845                         init_waitqueue_head(&srvTcp->request_q);
1846                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1847                         /* at this point we are the only ones with the pointer
1848                         to the struct since the kernel thread not created yet
1849                         so no need to spinlock this init of tcpStatus */
1850                         srvTcp->tcpStatus = CifsNew;
1851                         init_MUTEX(&srvTcp->tcpSem);
1852                         srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1853                         if( IS_ERR(srvTcp->tsk) ) {
1854                                 rc = PTR_ERR(srvTcp->tsk);
1855                                 cERROR(1,("error %d create cifsd thread", rc));
1856                                 srvTcp->tsk = NULL;
1857                                 sock_release(csocket);
1858                                 kfree(volume_info.UNC);
1859                                 kfree(volume_info.password);
1860                                 kfree(volume_info.prepath);
1861                                 FreeXid(xid);
1862                                 return rc;
1863                         }
1864                         wait_for_completion(&cifsd_complete);
1865                         rc = 0;
1866                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1867                         memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1868                         srvTcp->sequence_number = 0;
1869                 }
1870         }
1871
1872         if (existingCifsSes) {
1873                 pSesInfo = existingCifsSes;
1874                 cFYI(1, ("Existing smb sess found"));
1875                 kfree(volume_info.password);
1876                 /* volume_info.UNC freed at end of function */
1877         } else if (!rc) {
1878                 cFYI(1, ("Existing smb sess not found"));
1879                 pSesInfo = sesInfoAlloc();
1880                 if (pSesInfo == NULL)
1881                         rc = -ENOMEM;
1882                 else {
1883                         pSesInfo->server = srvTcp;
1884                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1885                                 NIPQUAD(sin_server.sin_addr.s_addr));
1886                 }
1887
1888                 if (!rc){
1889                         /* volume_info.password freed at unmount */
1890                         if (volume_info.password)
1891                                 pSesInfo->password = volume_info.password;
1892                         if (volume_info.username)
1893                                 strncpy(pSesInfo->userName,
1894                                         volume_info.username,MAX_USERNAME_SIZE);
1895                         if (volume_info.domainname) {
1896                                 int len = strlen(volume_info.domainname);
1897                                 pSesInfo->domainName =
1898                                         kmalloc(len + 1, GFP_KERNEL);
1899                                 if(pSesInfo->domainName)
1900                                         strcpy(pSesInfo->domainName,
1901                                                 volume_info.domainname);
1902                         }
1903                         pSesInfo->linux_uid = volume_info.linux_uid;
1904                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1905                         down(&pSesInfo->sesSem);
1906                         /* BB FIXME need to pass vol->secFlgs BB */
1907                         rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1908                         up(&pSesInfo->sesSem);
1909                         if(!rc)
1910                                 atomic_inc(&srvTcp->socketUseCount);
1911                 } else
1912                         kfree(volume_info.password);
1913         }
1914
1915         /* search for existing tcon to this server share */
1916         if (!rc) {
1917                 if(volume_info.rsize > CIFSMaxBufSize) {
1918                         cERROR(1,("rsize %d too large, using MaxBufSize",
1919                                 volume_info.rsize));
1920                         cifs_sb->rsize = CIFSMaxBufSize;
1921                 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1922                         cifs_sb->rsize = volume_info.rsize;
1923                 else /* default */
1924                         cifs_sb->rsize = CIFSMaxBufSize;
1925
1926                 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1927                         cERROR(1,("wsize %d too large using 4096 instead",
1928                                   volume_info.wsize));
1929                         cifs_sb->wsize = 4096;
1930                 } else if(volume_info.wsize)
1931                         cifs_sb->wsize = volume_info.wsize;
1932                 else
1933                         cifs_sb->wsize =
1934                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1935                                         127*1024);
1936                         /* old default of CIFSMaxBufSize was too small now
1937                            that SMB Write2 can send multiple pages in kvec.
1938                            RFC1001 does not describe what happens when frame
1939                            bigger than 128K is sent so use that as max in
1940                            conjunction with 52K kvec constraint on arch with 4K
1941                            page size  */
1942
1943                 if(cifs_sb->rsize < 2048) {
1944                         cifs_sb->rsize = 2048;
1945                         /* Windows ME may prefer this */
1946                         cFYI(1,("readsize set to minimum 2048"));
1947                 }
1948                 /* calculate prepath */
1949                 cifs_sb->prepath = volume_info.prepath;
1950                 if(cifs_sb->prepath) {
1951                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1952                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1953                         volume_info.prepath = NULL;
1954                 } else
1955                         cifs_sb->prepathlen = 0;
1956                 cifs_sb->mnt_uid = volume_info.linux_uid;
1957                 cifs_sb->mnt_gid = volume_info.linux_gid;
1958                 cifs_sb->mnt_file_mode = volume_info.file_mode;
1959                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1960                 cFYI(1,("file mode: 0x%x  dir mode: 0x%x",
1961                         cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1962
1963                 if(volume_info.noperm)
1964                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1965                 if(volume_info.setuids)
1966                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1967                 if(volume_info.server_ino)
1968                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1969                 if(volume_info.remap)
1970                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1971                 if(volume_info.no_xattr)
1972                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1973                 if(volume_info.sfu_emul)
1974                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1975                 if(volume_info.nobrl)
1976                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1977                 if(volume_info.cifs_acl)
1978                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1979
1980                 if(volume_info.direct_io) {
1981                         cFYI(1,("mounting share using direct i/o"));
1982                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1983                 }
1984
1985                 tcon =
1986                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1987                              volume_info.username);
1988                 if (tcon) {
1989                         cFYI(1, ("Found match on UNC path"));
1990                         /* we can have only one retry value for a connection
1991                            to a share so for resources mounted more than once
1992                            to the same server share the last value passed in
1993                            for the retry flag is used */
1994                         tcon->retry = volume_info.retry;
1995                         tcon->nocase = volume_info.nocase;
1996                 } else {
1997                         tcon = tconInfoAlloc();
1998                         if (tcon == NULL)
1999                                 rc = -ENOMEM;
2000                         else {
2001                                 /* check for null share name ie connecting to
2002                                  * dfs root */
2003
2004                                 /* BB check if this works for exactly length
2005                                  * three strings */
2006                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2007                                     && (strchr(volume_info.UNC + 3, '/') ==
2008                                         NULL)) {
2009                                         rc = connect_to_dfs_path(xid, pSesInfo,
2010                                                 "", cifs_sb->local_nls,
2011                                                 cifs_sb->mnt_cifs_flags &
2012                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2013                                         kfree(volume_info.UNC);
2014                                         FreeXid(xid);
2015                                         return -ENODEV;
2016                                 } else {
2017                                         /* BB Do we need to wrap sesSem around
2018                                          * this TCon call and Unix SetFS as
2019                                          * we do on SessSetup and reconnect? */
2020                                         rc = CIFSTCon(xid, pSesInfo,
2021                                                 volume_info.UNC,
2022                                                 tcon, cifs_sb->local_nls);
2023                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
2024                                 }
2025                                 if (!rc) {
2026                                         atomic_inc(&pSesInfo->inUse);
2027                                         tcon->retry = volume_info.retry;
2028                                         tcon->nocase = volume_info.nocase;
2029                                 }
2030                         }
2031                 }
2032         }
2033         if(pSesInfo) {
2034                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2035                         sb->s_maxbytes = (u64) 1 << 63;
2036                 } else
2037                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2038         }
2039
2040         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2041         sb->s_time_gran = 100;
2042
2043 /* on error free sesinfo and tcon struct if needed */
2044         if (rc) {
2045                 /* if session setup failed, use count is zero but
2046                 we still need to free cifsd thread */
2047                 if(atomic_read(&srvTcp->socketUseCount) == 0) {
2048                         spin_lock(&GlobalMid_Lock);
2049                         srvTcp->tcpStatus = CifsExiting;
2050                         spin_unlock(&GlobalMid_Lock);
2051                         if(srvTcp->tsk) {
2052                                 send_sig(SIGKILL,srvTcp->tsk,1);
2053                                 kthread_stop(srvTcp->tsk);
2054                         }
2055                 }
2056                  /* If find_unc succeeded then rc == 0 so we can not end */
2057                 if (tcon)  /* up accidently freeing someone elses tcon struct */
2058                         tconInfoFree(tcon);
2059                 if (existingCifsSes == NULL) {
2060                         if (pSesInfo) {
2061                                 if ((pSesInfo->server) &&
2062                                     (pSesInfo->status == CifsGood)) {
2063                                         int temp_rc;
2064                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2065                                         /* if the socketUseCount is now zero */
2066                                         if((temp_rc == -ESHUTDOWN) &&
2067                                            (pSesInfo->server) && (pSesInfo->server->tsk)) {
2068                                                 send_sig(SIGKILL,pSesInfo->server->tsk,1);
2069                                                 kthread_stop(pSesInfo->server->tsk);
2070                                         }
2071                                 } else
2072                                         cFYI(1, ("No session or bad tcon"));
2073                                 sesInfoFree(pSesInfo);
2074                                 /* pSesInfo = NULL; */
2075                         }
2076                 }
2077         } else {
2078                 atomic_inc(&tcon->useCount);
2079                 cifs_sb->tcon = tcon;
2080                 tcon->ses = pSesInfo;
2081
2082                 /* do not care if following two calls succeed - informational */
2083                 CIFSSMBQFSDeviceInfo(xid, tcon);
2084                 CIFSSMBQFSAttributeInfo(xid, tcon);
2085
2086                 /* tell server which Unix caps we support */
2087                 if (tcon->ses->capabilities & CAP_UNIX)
2088                         reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2089
2090                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2091                         cifs_sb->wsize = min(cifs_sb->wsize,
2092                                              (tcon->ses->server->maxBuf -
2093                                               MAX_CIFS_HDR_SIZE));
2094                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2095                         cifs_sb->rsize = min(cifs_sb->rsize,
2096                                              (tcon->ses->server->maxBuf -
2097                                               MAX_CIFS_HDR_SIZE));
2098         }
2099
2100         /* volume_info.password is freed above when existing session found
2101         (in which case it is not needed anymore) but when new sesion is created
2102         the password ptr is put in the new session structure (in which case the
2103         password will be freed at unmount time) */
2104         kfree(volume_info.UNC);
2105         kfree(volume_info.prepath);
2106         FreeXid(xid);
2107         return rc;
2108 }
2109
2110 static int
2111 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2112               char session_key[CIFS_SESS_KEY_SIZE],
2113               const struct nls_table *nls_codepage)
2114 {
2115         struct smb_hdr *smb_buffer;
2116         struct smb_hdr *smb_buffer_response;
2117         SESSION_SETUP_ANDX *pSMB;
2118         SESSION_SETUP_ANDX *pSMBr;
2119         char *bcc_ptr;
2120         char *user;
2121         char *domain;
2122         int rc = 0;
2123         int remaining_words = 0;
2124         int bytes_returned = 0;
2125         int len;
2126         __u32 capabilities;
2127         __u16 count;
2128
2129         cFYI(1, ("In sesssetup"));
2130         if(ses == NULL)
2131                 return -EINVAL;
2132         user = ses->userName;
2133         domain = ses->domainName;
2134         smb_buffer = cifs_buf_get();
2135         if (smb_buffer == NULL) {
2136                 return -ENOMEM;
2137         }
2138         smb_buffer_response = smb_buffer;
2139         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2140
2141         /* send SMBsessionSetup here */
2142         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2143                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2144
2145         smb_buffer->Mid = GetNextMid(ses->server);
2146         pSMB->req_no_secext.AndXCommand = 0xFF;
2147         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2148         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2149
2150         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2151                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2152
2153         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2154                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2155         if (ses->capabilities & CAP_UNICODE) {
2156                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2157                 capabilities |= CAP_UNICODE;
2158         }
2159         if (ses->capabilities & CAP_STATUS32) {
2160                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2161                 capabilities |= CAP_STATUS32;
2162         }
2163         if (ses->capabilities & CAP_DFS) {
2164                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2165                 capabilities |= CAP_DFS;
2166         }
2167         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2168
2169         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2170                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2171
2172         pSMB->req_no_secext.CaseSensitivePasswordLength =
2173             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2174         bcc_ptr = pByteArea(smb_buffer);
2175         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2176         bcc_ptr += CIFS_SESS_KEY_SIZE;
2177         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2178         bcc_ptr += CIFS_SESS_KEY_SIZE;
2179
2180         if (ses->capabilities & CAP_UNICODE) {
2181                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2182                         *bcc_ptr = 0;
2183                         bcc_ptr++;
2184                 }
2185                 if(user == NULL)
2186                         bytes_returned = 0; /* skip null user */
2187                 else
2188                         bytes_returned =
2189                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2190                                         nls_codepage);
2191                 /* convert number of 16 bit words to bytes */
2192                 bcc_ptr += 2 * bytes_returned;
2193                 bcc_ptr += 2;   /* trailing null */
2194                 if (domain == NULL)
2195                         bytes_returned =
2196                             cifs_strtoUCS((__le16 *) bcc_ptr,
2197                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2198                 else
2199                         bytes_returned =
2200                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2201                                           nls_codepage);
2202                 bcc_ptr += 2 * bytes_returned;
2203                 bcc_ptr += 2;
2204                 bytes_returned =
2205                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2206                                   32, nls_codepage);
2207                 bcc_ptr += 2 * bytes_returned;
2208                 bytes_returned =
2209                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2210                                   32, nls_codepage);
2211                 bcc_ptr += 2 * bytes_returned;
2212                 bcc_ptr += 2;
2213                 bytes_returned =
2214                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2215                                   64, nls_codepage);
2216                 bcc_ptr += 2 * bytes_returned;
2217                 bcc_ptr += 2;
2218         } else {
2219                 if(user != NULL) {
2220                     strncpy(bcc_ptr, user, 200);
2221                     bcc_ptr += strnlen(user, 200);
2222                 }
2223                 *bcc_ptr = 0;
2224                 bcc_ptr++;
2225                 if (domain == NULL) {
2226                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2227                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2228                 } else {
2229                         strncpy(bcc_ptr, domain, 64);
2230                         bcc_ptr += strnlen(domain, 64);
2231                         *bcc_ptr = 0;
2232                         bcc_ptr++;
2233                 }
2234                 strcpy(bcc_ptr, "Linux version ");
2235                 bcc_ptr += strlen("Linux version ");
2236                 strcpy(bcc_ptr, utsname()->release);
2237                 bcc_ptr += strlen(utsname()->release) + 1;
2238                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2239                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2240         }
2241         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2242         smb_buffer->smb_buf_length += count;
2243         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2244
2245         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2246                          &bytes_returned, 1);
2247         if (rc) {
2248 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2249         } else if ((smb_buffer_response->WordCount == 3)
2250                    || (smb_buffer_response->WordCount == 4)) {
2251                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2252                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2253                 if (action & GUEST_LOGIN)
2254                         cFYI(1, (" Guest login"));      /* do we want to mark SesInfo struct ? */
2255                 ses->Suid = smb_buffer_response->Uid;   /* UID left in wire format (le) */
2256                 cFYI(1, ("UID = %d ", ses->Suid));
2257          /* response can have either 3 or 4 word count - Samba sends 3 */
2258                 bcc_ptr = pByteArea(smb_buffer_response);
2259                 if ((pSMBr->resp.hdr.WordCount == 3)
2260                     || ((pSMBr->resp.hdr.WordCount == 4)
2261                         && (blob_len < pSMBr->resp.ByteCount))) {
2262                         if (pSMBr->resp.hdr.WordCount == 4)
2263                                 bcc_ptr += blob_len;
2264
2265                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2266                                 if ((long) (bcc_ptr) % 2) {
2267                                         remaining_words =
2268                                             (BCC(smb_buffer_response) - 1) /2;
2269                                         bcc_ptr++;      /* Unicode strings must be word aligned */
2270                                 } else {
2271                                         remaining_words =
2272                                                 BCC(smb_buffer_response) / 2;
2273                                 }
2274                                 len =
2275                                     UniStrnlen((wchar_t *) bcc_ptr,
2276                                                remaining_words - 1);
2277 /* We look for obvious messed up bcc or strings in response so we do not go off
2278    the end since (at least) WIN2K and Windows XP have a major bug in not null
2279    terminating last Unicode string in response  */
2280                                 if(ses->serverOS)
2281                                         kfree(ses->serverOS);
2282                                 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2283                                 if(ses->serverOS == NULL)
2284                                         goto sesssetup_nomem;
2285                                 cifs_strfromUCS_le(ses->serverOS,
2286                                            (__le16 *)bcc_ptr, len,nls_codepage);
2287                                 bcc_ptr += 2 * (len + 1);
2288                                 remaining_words -= len + 1;
2289                                 ses->serverOS[2 * len] = 0;
2290                                 ses->serverOS[1 + (2 * len)] = 0;
2291                                 if (remaining_words > 0) {
2292                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2293                                                          remaining_words-1);
2294                                         kfree(ses->serverNOS);
2295                                         ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2296                                         if(ses->serverNOS == NULL)
2297                                                 goto sesssetup_nomem;
2298                                         cifs_strfromUCS_le(ses->serverNOS,
2299                                                            (__le16 *)bcc_ptr,len,nls_codepage);
2300                                         bcc_ptr += 2 * (len + 1);
2301                                         ses->serverNOS[2 * len] = 0;
2302                                         ses->serverNOS[1 + (2 * len)] = 0;
2303                                         if(strncmp(ses->serverNOS,
2304                                                 "NT LAN Manager 4",16) == 0) {
2305                                                 cFYI(1,("NT4 server"));
2306                                                 ses->flags |= CIFS_SES_NT4;
2307                                         }
2308                                         remaining_words -= len + 1;
2309                                         if (remaining_words > 0) {
2310                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2311           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2312                                                 if(ses->serverDomain)
2313                                                         kfree(ses->serverDomain);
2314                                                 ses->serverDomain =
2315                                                     kzalloc(2*(len+1),GFP_KERNEL);
2316                                                 if(ses->serverDomain == NULL)
2317                                                         goto sesssetup_nomem;
2318                                                 cifs_strfromUCS_le(ses->serverDomain,
2319                                                      (__le16 *)bcc_ptr,len,nls_codepage);
2320                                                 bcc_ptr += 2 * (len + 1);
2321                                                 ses->serverDomain[2*len] = 0;
2322                                                 ses->serverDomain[1+(2*len)] = 0;
2323                                         } /* else no more room so create dummy domain string */
2324                                         else {
2325                                                 if(ses->serverDomain)
2326                                                         kfree(ses->serverDomain);
2327                                                 ses->serverDomain =
2328                                                         kzalloc(2, GFP_KERNEL);
2329                                         }
2330                                 } else {        /* no room so create dummy domain and NOS string */
2331                                         /* if these kcallocs fail not much we
2332                                            can do, but better to not fail the
2333                                            sesssetup itself */
2334                                         kfree(ses->serverDomain);
2335                                         ses->serverDomain =
2336                                             kzalloc(2, GFP_KERNEL);
2337                                         kfree(ses->serverNOS);
2338                                         ses->serverNOS =
2339                                             kzalloc(2, GFP_KERNEL);
2340                                 }
2341                         } else {        /* ASCII */
2342                                 len = strnlen(bcc_ptr, 1024);
2343                                 if (((long) bcc_ptr + len) - (long)
2344                                     pByteArea(smb_buffer_response)
2345                                             <= BCC(smb_buffer_response)) {
2346                                         kfree(ses->serverOS);
2347                                         ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2348                                         if(ses->serverOS == NULL)
2349                                                 goto sesssetup_nomem;
2350                                         strncpy(ses->serverOS,bcc_ptr, len);
2351
2352                                         bcc_ptr += len;
2353                                         bcc_ptr[0] = 0; /* null terminate the string */
2354                                         bcc_ptr++;
2355
2356                                         len = strnlen(bcc_ptr, 1024);
2357                                         kfree(ses->serverNOS);
2358                                         ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2359                                         if(ses->serverNOS == NULL)
2360                                                 goto sesssetup_nomem;
2361                                         strncpy(ses->serverNOS, bcc_ptr, len);
2362                                         bcc_ptr += len;
2363                                         bcc_ptr[0] = 0;
2364                                         bcc_ptr++;
2365
2366                                         len = strnlen(bcc_ptr, 1024);
2367                                         if(ses->serverDomain)
2368                                                 kfree(ses->serverDomain);
2369                                         ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2370                                         if(ses->serverDomain == NULL)
2371                                                 goto sesssetup_nomem;
2372                                         strncpy(ses->serverDomain, bcc_ptr, len);
2373                                         bcc_ptr += len;
2374                                         bcc_ptr[0] = 0;
2375                                         bcc_ptr++;
2376                                 } else
2377                                         cFYI(1,
2378                                              ("Variable field of length %d extends beyond end of smb ",
2379                                               len));
2380                         }
2381                 } else {
2382                         cERROR(1,
2383                                (" Security Blob Length extends beyond end of SMB"));
2384                 }
2385         } else {
2386                 cERROR(1,
2387                        (" Invalid Word count %d: ",
2388                         smb_buffer_response->WordCount));
2389                 rc = -EIO;
2390         }
2391 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2392                            since that could make reconnection harder, and
2393                            reconnection might be needed to free memory */
2394         if (smb_buffer)
2395                 cifs_buf_release(smb_buffer);
2396
2397         return rc;
2398 }
2399
2400 static int
2401 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2402                               struct cifsSesInfo *ses, int * pNTLMv2_flag,
2403                               const struct nls_table *nls_codepage)
2404 {
2405         struct smb_hdr *smb_buffer;
2406         struct smb_hdr *smb_buffer_response;
2407         SESSION_SETUP_ANDX *pSMB;
2408         SESSION_SETUP_ANDX *pSMBr;
2409         char *bcc_ptr;
2410         char *domain;
2411         int rc = 0;
2412         int remaining_words = 0;
2413         int bytes_returned = 0;
2414         int len;
2415         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2416         PNEGOTIATE_MESSAGE SecurityBlob;
2417         PCHALLENGE_MESSAGE SecurityBlob2;
2418         __u32 negotiate_flags, capabilities;
2419         __u16 count;
2420
2421         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2422         if(ses == NULL)
2423                 return -EINVAL;
2424         domain = ses->domainName;
2425         *pNTLMv2_flag = FALSE;
2426         smb_buffer = cifs_buf_get();
2427         if (smb_buffer == NULL) {
2428                 return -ENOMEM;
2429         }
2430         smb_buffer_response = smb_buffer;
2431         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2432         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2433
2434         /* send SMBsessionSetup here */
2435         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2436                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2437
2438         smb_buffer->Mid = GetNextMid(ses->server);
2439         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2440         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2441
2442         pSMB->req.AndXCommand = 0xFF;
2443         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2444         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2445
2446         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2447                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2448
2449         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2450             CAP_EXTENDED_SECURITY;
2451         if (ses->capabilities & CAP_UNICODE) {
2452                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2453                 capabilities |= CAP_UNICODE;
2454         }
2455         if (ses->capabilities & CAP_STATUS32) {
2456                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2457                 capabilities |= CAP_STATUS32;
2458         }
2459         if (ses->capabilities & CAP_DFS) {
2460                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2461                 capabilities |= CAP_DFS;
2462         }
2463         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2464
2465         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2466         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2467         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2468         SecurityBlob->MessageType = NtLmNegotiate;
2469         negotiate_flags =
2470             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2471             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2472             NTLMSSP_NEGOTIATE_56 |
2473             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2474         if(sign_CIFS_PDUs)
2475                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2476 /*      if(ntlmv2_support)
2477                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2478         /* setup pointers to domain name and workstation name */
2479         bcc_ptr += SecurityBlobLength;
2480
2481         SecurityBlob->WorkstationName.Buffer = 0;
2482         SecurityBlob->WorkstationName.Length = 0;
2483         SecurityBlob->WorkstationName.MaximumLength = 0;
2484
2485         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2486         along with username on auth request (ie the response to challenge) */
2487         SecurityBlob->DomainName.Buffer = 0;
2488         SecurityBlob->DomainName.Length = 0;
2489         SecurityBlob->DomainName.MaximumLength = 0;
2490         if (ses->capabilities & CAP_UNICODE) {
2491                 if ((long) bcc_ptr % 2) {
2492                         *bcc_ptr = 0;
2493                         bcc_ptr++;
2494                 }
2495
2496                 bytes_returned =
2497                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2498                                   32, nls_codepage);
2499                 bcc_ptr += 2 * bytes_returned;
2500                 bytes_returned =
2501                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2502                                   nls_codepage);
2503                 bcc_ptr += 2 * bytes_returned;
2504                 bcc_ptr += 2;   /* null terminate Linux version */
2505                 bytes_returned =
2506                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2507                                   64, nls_codepage);
2508                 bcc_ptr += 2 * bytes_returned;
2509                 *(bcc_ptr + 1) = 0;
2510                 *(bcc_ptr + 2) = 0;
2511                 bcc_ptr += 2;   /* null terminate network opsys string */
2512                 *(bcc_ptr + 1) = 0;
2513                 *(bcc_ptr + 2) = 0;
2514                 bcc_ptr += 2;   /* null domain */
2515         } else {                /* ASCII */
2516                 strcpy(bcc_ptr, "Linux version ");
2517                 bcc_ptr += strlen("Linux version ");
2518                 strcpy(bcc_ptr, utsname()->release);
2519                 bcc_ptr += strlen(utsname()->release) + 1;
2520                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2521                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2522                 bcc_ptr++;      /* empty domain field */
2523                 *bcc_ptr = 0;
2524         }
2525         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2526         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2527         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2528         smb_buffer->smb_buf_length += count;
2529         pSMB->req.ByteCount = cpu_to_le16(count);
2530
2531         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2532                          &bytes_returned, 1);
2533
2534         if (smb_buffer_response->Status.CifsError ==
2535             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2536                 rc = 0;
2537
2538         if (rc) {
2539 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2540         } else if ((smb_buffer_response->WordCount == 3)
2541                    || (smb_buffer_response->WordCount == 4)) {
2542                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2543                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2544
2545                 if (action & GUEST_LOGIN)
2546                         cFYI(1, (" Guest login"));
2547         /* Do we want to set anything in SesInfo struct when guest login? */
2548
2549                 bcc_ptr = pByteArea(smb_buffer_response);
2550         /* response can have either 3 or 4 word count - Samba sends 3 */
2551
2552                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2553                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2554                         cFYI(1,
2555                              ("Unexpected NTLMSSP message type received %d",
2556                               SecurityBlob2->MessageType));
2557                 } else if (ses) {
2558                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2559                         cFYI(1, ("UID = %d", ses->Suid));
2560                         if ((pSMBr->resp.hdr.WordCount == 3)
2561                             || ((pSMBr->resp.hdr.WordCount == 4)
2562                                 && (blob_len <
2563                                     pSMBr->resp.ByteCount))) {
2564
2565                                 if (pSMBr->resp.hdr.WordCount == 4) {
2566                                         bcc_ptr += blob_len;
2567                                         cFYI(1, ("Security Blob Length %d",
2568                                               blob_len));
2569                                 }
2570
2571                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2572
2573                                 memcpy(ses->server->cryptKey,
2574                                        SecurityBlob2->Challenge,
2575                                        CIFS_CRYPTO_KEY_SIZE);
2576                                 if(SecurityBlob2->NegotiateFlags &
2577                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2578                                         *pNTLMv2_flag = TRUE;
2579
2580                                 if((SecurityBlob2->NegotiateFlags &
2581                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2582                                         || (sign_CIFS_PDUs > 1))
2583                                                 ses->server->secMode |=
2584                                                         SECMODE_SIGN_REQUIRED;
2585                                 if ((SecurityBlob2->NegotiateFlags &
2586                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2587                                                 ses->server->secMode |=
2588                                                         SECMODE_SIGN_ENABLED;
2589
2590                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2591                                         if ((long) (bcc_ptr) % 2) {
2592                                                 remaining_words =
2593                                                     (BCC(smb_buffer_response)
2594                                                      - 1) / 2;
2595                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2596                                         } else {
2597                                                 remaining_words =
2598                                                     BCC
2599                                                     (smb_buffer_response) / 2;
2600                                         }
2601                                         len =
2602                                             UniStrnlen((wchar_t *) bcc_ptr,
2603                                                        remaining_words - 1);
2604 /* We look for obvious messed up bcc or strings in response so we do not go off
2605    the end since (at least) WIN2K and Windows XP have a major bug in not null
2606    terminating last Unicode string in response  */
2607                                         if(ses->serverOS)
2608                                                 kfree(ses->serverOS);
2609                                         ses->serverOS =
2610                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2611                                         cifs_strfromUCS_le(ses->serverOS,
2612                                                            (__le16 *)
2613                                                            bcc_ptr, len,
2614                                                            nls_codepage);
2615                                         bcc_ptr += 2 * (len + 1);
2616                                         remaining_words -= len + 1;
2617                                         ses->serverOS[2 * len] = 0;
2618                                         ses->serverOS[1 + (2 * len)] = 0;
2619                                         if (remaining_words > 0) {
2620                                                 len = UniStrnlen((wchar_t *)
2621                                                                  bcc_ptr,
2622                                                                  remaining_words
2623                                                                  - 1);
2624                                                 kfree(ses->serverNOS);
2625                                                 ses->serverNOS =
2626                                                     kzalloc(2 * (len + 1),
2627                                                             GFP_KERNEL);
2628                                                 cifs_strfromUCS_le(ses->
2629                                                                    serverNOS,
2630                                                                    (__le16 *)
2631                                                                    bcc_ptr,
2632                                                                    len,
2633                                                                    nls_codepage);
2634                                                 bcc_ptr += 2 * (len + 1);
2635                                                 ses->serverNOS[2 * len] = 0;
2636                                                 ses->serverNOS[1 +
2637                                                                (2 * len)] = 0;
2638                                                 remaining_words -= len + 1;
2639                                                 if (remaining_words > 0) {
2640                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2641            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2642                                                         kfree(ses->serverDomain);
2643                                                         ses->serverDomain =
2644                                                             kzalloc(2 *
2645                                                                     (len +
2646                                                                      1),
2647                                                                     GFP_KERNEL);
2648                                                         cifs_strfromUCS_le
2649                                                             (ses->serverDomain,
2650                                                              (__le16 *)bcc_ptr,
2651                                                              len, nls_codepage);
2652                                                         bcc_ptr +=
2653                                                             2 * (len + 1);
2654                                                         ses->serverDomain[2*len]
2655                                                             = 0;
2656                                                         ses->serverDomain
2657                                                                 [1 + (2 * len)]
2658                                                             = 0;
2659                                                 } /* else no more room so create dummy domain string */
2660                                                 else {
2661                                                         kfree(ses->serverDomain);
2662                                                         ses->serverDomain =
2663                                                             kzalloc(2,
2664                                                                     GFP_KERNEL);
2665                                                 }
2666                                         } else {        /* no room so create dummy domain and NOS string */
2667                                                 kfree(ses->serverDomain);
2668                                                 ses->serverDomain =
2669                                                     kzalloc(2, GFP_KERNEL);
2670                                                 kfree(ses->serverNOS);
2671                                                 ses->serverNOS =
2672                                                     kzalloc(2, GFP_KERNEL);
2673                                         }
2674                                 } else {        /* ASCII */
2675                                         len = strnlen(bcc_ptr, 1024);
2676                                         if (((long) bcc_ptr + len) - (long)
2677                                             pByteArea(smb_buffer_response)
2678                                             <= BCC(smb_buffer_response)) {
2679                                                 if(ses->serverOS)
2680                                                         kfree(ses->serverOS);
2681                                                 ses->serverOS =
2682                                                     kzalloc(len + 1,
2683                                                             GFP_KERNEL);
2684                                                 strncpy(ses->serverOS,
2685                                                         bcc_ptr, len);
2686
2687                                                 bcc_ptr += len;
2688                                                 bcc_ptr[0] = 0; /* null terminate string */
2689                                                 bcc_ptr++;
2690
2691                                                 len = strnlen(bcc_ptr, 1024);
2692                                                 kfree(ses->serverNOS);
2693                                                 ses->serverNOS =
2694                                                     kzalloc(len + 1,
2695                                                             GFP_KERNEL);
2696                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2697                                                 bcc_ptr += len;
2698                                                 bcc_ptr[0] = 0;
2699                                                 bcc_ptr++;
2700
2701                                                 len = strnlen(bcc_ptr, 1024);
2702                                                 kfree(ses->serverDomain);
2703                                                 ses->serverDomain =
2704                                                     kzalloc(len + 1,
2705                                                             GFP_KERNEL);
2706                                                 strncpy(ses->serverDomain, bcc_ptr, len);
2707                                                 bcc_ptr += len;
2708                                                 bcc_ptr[0] = 0;
2709                                                 bcc_ptr++;
2710                                         } else
2711                                                 cFYI(1,
2712                                                      ("Variable field of length %d extends beyond end of smb",
2713                                                       len));
2714                                 }
2715                         } else {
2716                                 cERROR(1,
2717                                        (" Security Blob Length extends beyond end of SMB"));
2718                         }
2719                 } else {
2720                         cERROR(1, ("No session structure passed in."));
2721                 }
2722         } else {
2723                 cERROR(1,
2724                        (" Invalid Word count %d:",
2725                         smb_buffer_response->WordCount));
2726                 rc = -EIO;
2727         }
2728
2729         if (smb_buffer)
2730                 cifs_buf_release(smb_buffer);
2731
2732         return rc;
2733 }
2734 static int
2735 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2736                 char *ntlm_session_key, int ntlmv2_flag,
2737                 const struct nls_table *nls_codepage)
2738 {
2739         struct smb_hdr *smb_buffer;
2740         struct smb_hdr *smb_buffer_response;
2741         SESSION_SETUP_ANDX *pSMB;
2742         SESSION_SETUP_ANDX *pSMBr;
2743         char *bcc_ptr;
2744         char *user;
2745         char *domain;
2746         int rc = 0;
2747         int remaining_words = 0;
2748         int bytes_returned = 0;
2749         int len;
2750         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2751         PAUTHENTICATE_MESSAGE SecurityBlob;
2752         __u32 negotiate_flags, capabilities;
2753         __u16 count;
2754
2755         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2756         if(ses == NULL)
2757                 return -EINVAL;
2758         user = ses->userName;
2759         domain = ses->domainName;
2760         smb_buffer = cifs_buf_get();
2761         if (smb_buffer == NULL) {
2762                 return -ENOMEM;
2763         }
2764         smb_buffer_response = smb_buffer;
2765         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2766         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2767
2768         /* send SMBsessionSetup here */
2769         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2770                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2771
2772         smb_buffer->Mid = GetNextMid(ses->server);
2773         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2774         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2775         pSMB->req.AndXCommand = 0xFF;
2776         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2777         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2778
2779         pSMB->req.hdr.Uid = ses->Suid;
2780
2781         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2782                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2783
2784         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2785             CAP_EXTENDED_SECURITY;
2786         if (ses->capabilities & CAP_UNICODE) {
2787                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2788                 capabilities |= CAP_UNICODE;
2789         }
2790         if (ses->capabilities & CAP_STATUS32) {
2791                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2792                 capabilities |= CAP_STATUS32;
2793         }
2794         if (ses->capabilities & CAP_DFS) {
2795                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2796                 capabilities |= CAP_DFS;
2797         }
2798         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2799
2800         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2801         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2802         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2803         SecurityBlob->MessageType = NtLmAuthenticate;
2804         bcc_ptr += SecurityBlobLength;
2805         negotiate_flags =
2806             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2807             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2808             0x80000000 | NTLMSSP_NEGOTIATE_128;
2809         if(sign_CIFS_PDUs)
2810                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2811         if(ntlmv2_flag)
2812                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2813
2814 /* setup pointers to domain name and workstation name */
2815
2816         SecurityBlob->WorkstationName.Buffer = 0;
2817         SecurityBlob->WorkstationName.Length = 0;
2818         SecurityBlob->WorkstationName.MaximumLength = 0;
2819         SecurityBlob->SessionKey.Length = 0;
2820         SecurityBlob->SessionKey.MaximumLength = 0;
2821         SecurityBlob->SessionKey.Buffer = 0;
2822
2823         SecurityBlob->LmChallengeResponse.Length = 0;
2824         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2825         SecurityBlob->LmChallengeResponse.Buffer = 0;
2826
2827         SecurityBlob->NtChallengeResponse.Length =
2828             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2829         SecurityBlob->NtChallengeResponse.MaximumLength =
2830             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2831         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2832         SecurityBlob->NtChallengeResponse.Buffer =
2833             cpu_to_le32(SecurityBlobLength);
2834         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2835         bcc_ptr += CIFS_SESS_KEY_SIZE;
2836
2837         if (ses->capabilities & CAP_UNICODE) {
2838                 if (domain == NULL) {
2839                         SecurityBlob->DomainName.Buffer = 0;
2840                         SecurityBlob->DomainName.Length = 0;
2841                         SecurityBlob->DomainName.MaximumLength = 0;
2842                 } else {
2843                         __u16 len =
2844                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2845                                           nls_codepage);
2846                         len *= 2;
2847                         SecurityBlob->DomainName.MaximumLength =
2848                             cpu_to_le16(len);
2849                         SecurityBlob->DomainName.Buffer =
2850                             cpu_to_le32(SecurityBlobLength);
2851                         bcc_ptr += len;
2852                         SecurityBlobLength += len;
2853                         SecurityBlob->DomainName.Length =
2854                             cpu_to_le16(len);
2855                 }
2856                 if (user == NULL) {
2857                         SecurityBlob->UserName.Buffer = 0;
2858                         SecurityBlob->UserName.Length = 0;
2859                         SecurityBlob->UserName.MaximumLength = 0;
2860                 } else {
2861                         __u16 len =
2862                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2863                                           nls_codepage);
2864                         len *= 2;
2865                         SecurityBlob->UserName.MaximumLength =
2866                             cpu_to_le16(len);
2867                         SecurityBlob->UserName.Buffer =
2868                             cpu_to_le32(SecurityBlobLength);
2869                         bcc_ptr += len;
2870                         SecurityBlobLength += len;
2871                         SecurityBlob->UserName.Length =
2872                             cpu_to_le16(len);
2873                 }
2874
2875                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2876                    SecurityBlob->WorkstationName.Length *= 2;
2877                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2878                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2879                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2880                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2881                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
2882
2883                 if ((long) bcc_ptr % 2) {
2884                         *bcc_ptr = 0;
2885                         bcc_ptr++;
2886                 }
2887                 bytes_returned =
2888                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2889                                   32, nls_codepage);
2890                 bcc_ptr += 2 * bytes_returned;
2891                 bytes_returned =
2892                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2893                                   nls_codepage);
2894                 bcc_ptr += 2 * bytes_returned;
2895                 bcc_ptr += 2;   /* null term version string */
2896                 bytes_returned =
2897                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2898                                   64, nls_codepage);
2899                 bcc_ptr += 2 * bytes_returned;
2900                 *(bcc_ptr + 1) = 0;
2901                 *(bcc_ptr + 2) = 0;
2902                 bcc_ptr += 2;   /* null terminate network opsys string */
2903                 *(bcc_ptr + 1) = 0;
2904                 *(bcc_ptr + 2) = 0;
2905                 bcc_ptr += 2;   /* null domain */
2906         } else {                /* ASCII */
2907                 if (domain == NULL) {
2908                         SecurityBlob->DomainName.Buffer = 0;
2909                         SecurityBlob->DomainName.Length = 0;
2910                         SecurityBlob->DomainName.MaximumLength = 0;
2911                 } else {
2912                         __u16 len;
2913                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2914                         strncpy(bcc_ptr, domain, 63);
2915                         len = strnlen(domain, 64);
2916                         SecurityBlob->DomainName.MaximumLength =
2917                             cpu_to_le16(len);
2918                         SecurityBlob->DomainName.Buffer =
2919                             cpu_to_le32(SecurityBlobLength);
2920                         bcc_ptr += len;
2921                         SecurityBlobLength += len;
2922                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
2923                 }
2924                 if (user == NULL) {
2925                         SecurityBlob->UserName.Buffer = 0;
2926                         SecurityBlob->UserName.Length = 0;
2927                         SecurityBlob->UserName.MaximumLength = 0;
2928                 } else {
2929                         __u16 len;
2930                         strncpy(bcc_ptr, user, 63);
2931                         len = strnlen(user, 64);
2932                         SecurityBlob->UserName.MaximumLength =
2933                             cpu_to_le16(len);
2934                         SecurityBlob->UserName.Buffer =
2935                             cpu_to_le32(SecurityBlobLength);
2936                         bcc_ptr += len;
2937                         SecurityBlobLength += len;
2938                         SecurityBlob->UserName.Length = cpu_to_le16(len);
2939                 }
2940                 /* BB fill in our workstation name if known BB */
2941
2942                 strcpy(bcc_ptr, "Linux version ");
2943                 bcc_ptr += strlen("Linux version ");
2944                 strcpy(bcc_ptr, utsname()->release);
2945                 bcc_ptr += strlen(utsname()->release) + 1;
2946                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2947                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2948                 bcc_ptr++;      /* null domain */
2949                 *bcc_ptr = 0;
2950         }
2951         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2952         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2953         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2954         smb_buffer->smb_buf_length += count;
2955         pSMB->req.ByteCount = cpu_to_le16(count);
2956
2957         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2958                          &bytes_returned, 1);
2959         if (rc) {
2960 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2961         } else if ((smb_buffer_response->WordCount == 3)
2962                    || (smb_buffer_response->WordCount == 4)) {
2963                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2964                 __u16 blob_len =
2965                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2966                 if (action & GUEST_LOGIN)
2967                         cFYI(1, (" Guest login"));      /* BB do we want to set anything in SesInfo struct ? */
2968 /*        if(SecurityBlob2->MessageType != NtLm??){
2969                  cFYI("Unexpected message type on auth response is %d "));
2970         } */
2971                 if (ses) {
2972                         cFYI(1,
2973                              ("Does UID on challenge %d match auth response UID %d ",
2974                               ses->Suid, smb_buffer_response->Uid));
2975                         ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2976                         bcc_ptr = pByteArea(smb_buffer_response);
2977             /* response can have either 3 or 4 word count - Samba sends 3 */
2978                         if ((pSMBr->resp.hdr.WordCount == 3)
2979                             || ((pSMBr->resp.hdr.WordCount == 4)
2980                                 && (blob_len <
2981                                     pSMBr->resp.ByteCount))) {
2982                                 if (pSMBr->resp.hdr.WordCount == 4) {
2983                                         bcc_ptr +=
2984                                             blob_len;
2985                                         cFYI(1,
2986                                              ("Security Blob Length %d ",
2987                                               blob_len));
2988                                 }
2989
2990                                 cFYI(1,
2991                                      ("NTLMSSP response to Authenticate "));
2992
2993                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2994                                         if ((long) (bcc_ptr) % 2) {
2995                                                 remaining_words =
2996                                                     (BCC(smb_buffer_response)
2997                                                      - 1) / 2;
2998                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2999                                         } else {
3000                                                 remaining_words = BCC(smb_buffer_response) / 2;
3001                                         }
3002                                         len =
3003                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3004 /* We look for obvious messed up bcc or strings in response so we do not go off
3005   the end since (at least) WIN2K and Windows XP have a major bug in not null
3006   terminating last Unicode string in response  */
3007                                         if(ses->serverOS)
3008                                                 kfree(ses->serverOS);
3009                                         ses->serverOS =
3010                                             kzalloc(2 * (len + 1), GFP_KERNEL);
3011                                         cifs_strfromUCS_le(ses->serverOS,
3012                                                            (__le16 *)
3013                                                            bcc_ptr, len,
3014                                                            nls_codepage);
3015                                         bcc_ptr += 2 * (len + 1);
3016                                         remaining_words -= len + 1;
3017                                         ses->serverOS[2 * len] = 0;
3018                                         ses->serverOS[1 + (2 * len)] = 0;
3019                                         if (remaining_words > 0) {
3020                                                 len = UniStrnlen((wchar_t *)
3021                                                                  bcc_ptr,
3022                                                                  remaining_words
3023                                                                  - 1);
3024                                                 kfree(ses->serverNOS);
3025                                                 ses->serverNOS =
3026                                                     kzalloc(2 * (len + 1),
3027                                                             GFP_KERNEL);
3028                                                 cifs_strfromUCS_le(ses->
3029                                                                    serverNOS,
3030                                                                    (__le16 *)
3031                                                                    bcc_ptr,
3032                                                                    len,
3033                                                                    nls_codepage);
3034                                                 bcc_ptr += 2 * (len + 1);
3035                                                 ses->serverNOS[2 * len] = 0;
3036                                                 ses->serverNOS[1+(2*len)] = 0;
3037                                                 remaining_words -= len + 1;
3038                                                 if (remaining_words > 0) {
3039                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3040      /* last string not always null terminated (e.g. for Windows XP & 2000) */
3041                                                         if(ses->serverDomain)
3042                                                                 kfree(ses->serverDomain);
3043                                                         ses->serverDomain =
3044                                                             kzalloc(2 *
3045                                                                     (len +
3046                                                                      1),
3047                                                                     GFP_KERNEL);
3048                                                         cifs_strfromUCS_le
3049                                                             (ses->
3050                                                              serverDomain,
3051                                                              (__le16 *)
3052                                                              bcc_ptr, len,
3053                                                              nls_codepage);
3054                                                         bcc_ptr +=
3055                                                             2 * (len + 1);
3056                                                         ses->
3057                                                             serverDomain[2
3058                                                                          * len]
3059                                                             = 0;
3060                                                         ses->
3061                                                             serverDomain[1
3062                                                                          +
3063                                                                          (2
3064                                                                           *
3065                                                                           len)]
3066                                                             = 0;
3067                                                 } /* else no more room so create dummy domain string */
3068                                                 else {
3069                                                         if(ses->serverDomain)
3070                                                                 kfree(ses->serverDomain);
3071                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3072                                                 }
3073                                         } else {  /* no room so create dummy domain and NOS string */
3074                                                 if(ses->serverDomain)
3075                                                         kfree(ses->serverDomain);
3076                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3077                                                 kfree(ses->serverNOS);
3078                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3079                                         }
3080                                 } else {        /* ASCII */
3081                                         len = strnlen(bcc_ptr, 1024);
3082                                         if (((long) bcc_ptr + len) -
3083                         (long) pByteArea(smb_buffer_response)
3084                             <= BCC(smb_buffer_response)) {
3085                                                 if(ses->serverOS)
3086                                                         kfree(ses->serverOS);
3087                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3088                                                 strncpy(ses->serverOS,bcc_ptr, len);
3089
3090                                                 bcc_ptr += len;
3091                                                 bcc_ptr[0] = 0; /* null terminate the string */
3092                                                 bcc_ptr++;
3093
3094                                                 len = strnlen(bcc_ptr, 1024);
3095                                                 kfree(ses->serverNOS);
3096                                                 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3097                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3098                                                 bcc_ptr += len;
3099                                                 bcc_ptr[0] = 0;
3100                                                 bcc_ptr++;
3101
3102                                                 len = strnlen(bcc_ptr, 1024);
3103                                                 if(ses->serverDomain)
3104                                                         kfree(ses->serverDomain);
3105                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3106                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3107                                                 bcc_ptr += len;
3108                                                 bcc_ptr[0] = 0;
3109                                                 bcc_ptr++;
3110                                         } else
3111                                                 cFYI(1,
3112                                                      ("Variable field of length %d extends beyond end of smb ",
3113                                                       len));
3114                                 }
3115                         } else {
3116                                 cERROR(1,
3117                                        (" Security Blob Length extends beyond end of SMB"));
3118                         }
3119                 } else {
3120                         cERROR(1, ("No session structure passed in."));
3121                 }
3122         } else {
3123                 cERROR(1,
3124                        (" Invalid Word count %d: ",
3125                         smb_buffer_response->WordCount));
3126                 rc = -EIO;
3127         }
3128
3129         if (smb_buffer)
3130                 cifs_buf_release(smb_buffer);
3131
3132         return rc;
3133 }
3134
3135 int
3136 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3137          const char *tree, struct cifsTconInfo *tcon,
3138          const struct nls_table *nls_codepage)
3139 {
3140         struct smb_hdr *smb_buffer;
3141         struct smb_hdr *smb_buffer_response;
3142         TCONX_REQ *pSMB;
3143         TCONX_RSP *pSMBr;
3144         unsigned char *bcc_ptr;
3145         int rc = 0;
3146         int length;
3147         __u16 count;
3148
3149         if (ses == NULL)
3150                 return -EIO;
3151
3152         smb_buffer = cifs_buf_get();
3153         if (smb_buffer == NULL) {
3154                 return -ENOMEM;
3155         }
3156         smb_buffer_response = smb_buffer;
3157
3158         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3159                         NULL /*no tid */ , 4 /*wct */ );
3160
3161         smb_buffer->Mid = GetNextMid(ses->server);
3162         smb_buffer->Uid = ses->Suid;
3163         pSMB = (TCONX_REQ *) smb_buffer;
3164         pSMBr = (TCONX_RSP *) smb_buffer_response;
3165
3166         pSMB->AndXCommand = 0xFF;
3167         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3168         bcc_ptr = &pSMB->Password[0];
3169         if((ses->server->secMode) & SECMODE_USER) {
3170                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3171                 *bcc_ptr = 0; /* password is null byte */
3172                 bcc_ptr++;              /* skip password */
3173                 /* already aligned so no need to do it below */
3174         } else {
3175                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3176                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3177                    specified as required (when that support is added to
3178                    the vfs in the future) as only NTLM or the much
3179                    weaker LANMAN (which we do not send by default) is accepted
3180                    by Samba (not sure whether other servers allow
3181                    NTLMv2 password here) */
3182 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3183                 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3184                         (ses->server->secType == LANMAN))
3185                         calc_lanman_hash(ses, bcc_ptr);
3186                 else
3187 #endif /* CIFS_WEAK_PW_HASH */
3188                 SMBNTencrypt(ses->password,
3189                              ses->server->cryptKey,
3190                              bcc_ptr);
3191
3192                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3193                 if(ses->capabilities & CAP_UNICODE) {
3194                         /* must align unicode strings */
3195                         *bcc_ptr = 0; /* null byte password */
3196                         bcc_ptr++;
3197                 }
3198         }
3199
3200         if(ses->server->secMode &
3201                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3202                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3203
3204         if (ses->capabilities & CAP_STATUS32) {
3205                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3206         }
3207         if (ses->capabilities & CAP_DFS) {
3208                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3209         }
3210         if (ses->capabilities & CAP_UNICODE) {
3211                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3212                 length =
3213                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3214                         6 /* max utf8 char length in bytes */ *
3215                         (/* server len*/ + 256 /* share len */), nls_codepage);
3216                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3217                 bcc_ptr += 2;   /* skip trailing null */
3218         } else {                /* ASCII */
3219                 strcpy(bcc_ptr, tree);
3220                 bcc_ptr += strlen(tree) + 1;
3221         }
3222         strcpy(bcc_ptr, "?????");
3223         bcc_ptr += strlen("?????");
3224         bcc_ptr += 1;
3225         count = bcc_ptr - &pSMB->Password[0];
3226         pSMB->hdr.smb_buf_length += count;
3227         pSMB->ByteCount = cpu_to_le16(count);
3228
3229         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3230
3231         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3232         /* above now done in SendReceive */
3233         if ((rc == 0) && (tcon != NULL)) {
3234                 tcon->tidStatus = CifsGood;
3235                 tcon->tid = smb_buffer_response->Tid;
3236                 bcc_ptr = pByteArea(smb_buffer_response);
3237                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3238         /* skip service field (NB: this field is always ASCII) */
3239                 bcc_ptr += length + 1;
3240                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3241                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3242                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3243                         if ((bcc_ptr + (2 * length)) -
3244                              pByteArea(smb_buffer_response) <=
3245                             BCC(smb_buffer_response)) {
3246                                 kfree(tcon->nativeFileSystem);
3247                                 tcon->nativeFileSystem =
3248                                     kzalloc(length + 2, GFP_KERNEL);
3249                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3250                                                    (__le16 *) bcc_ptr,
3251                                                    length, nls_codepage);
3252                                 bcc_ptr += 2 * length;
3253                                 bcc_ptr[0] = 0; /* null terminate the string */
3254                                 bcc_ptr[1] = 0;
3255                                 bcc_ptr += 2;
3256                         }
3257                         /* else do not bother copying these informational fields */
3258                 } else {
3259                         length = strnlen(bcc_ptr, 1024);
3260                         if ((bcc_ptr + length) -
3261                             pByteArea(smb_buffer_response) <=
3262                             BCC(smb_buffer_response)) {
3263                                 kfree(tcon->nativeFileSystem);
3264                                 tcon->nativeFileSystem =
3265                                     kzalloc(length + 1, GFP_KERNEL);
3266                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3267                                         length);
3268                         }
3269                         /* else do not bother copying these informational fields */
3270                 }
3271                 if((smb_buffer_response->WordCount == 3) ||
3272                          (smb_buffer_response->WordCount == 7))
3273                         /* field is in same location */
3274                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3275                 else
3276                         tcon->Flags = 0;
3277                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3278         } else if ((rc == 0) && tcon == NULL) {
3279         /* all we need to save for IPC$ connection */
3280                 ses->ipc_tid = smb_buffer_response->Tid;
3281         }
3282
3283         if (smb_buffer)
3284                 cifs_buf_release(smb_buffer);
3285         return rc;
3286 }
3287
3288 int
3289 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3290 {
3291         int rc = 0;
3292         int xid;
3293         struct cifsSesInfo *ses = NULL;
3294         struct task_struct *cifsd_task;
3295         char * tmp;
3296
3297         xid = GetXid();
3298
3299         if (cifs_sb->tcon) {
3300                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3301                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3302                 if (rc == -EBUSY) {
3303                         FreeXid(xid);
3304                         return 0;
3305                 }
3306                 tconInfoFree(cifs_sb->tcon);
3307                 if ((ses) && (ses->server)) {
3308                         /* save off task so we do not refer to ses later */
3309                         cifsd_task = ses->server->tsk;
3310                         cFYI(1, ("About to do SMBLogoff "));
3311                         rc = CIFSSMBLogoff(xid, ses);
3312                         if (rc == -EBUSY) {
3313                                 FreeXid(xid);
3314                                 return 0;
3315                         } else if (rc == -ESHUTDOWN) {
3316                                 cFYI(1,("Waking up socket by sending it signal"));
3317                                 if(cifsd_task) {
3318                                         send_sig(SIGKILL,cifsd_task,1);
3319                                         kthread_stop(cifsd_task);
3320                                 }
3321                                 rc = 0;
3322                         } /* else - we have an smb session
3323                                 left on this socket do not kill cifsd */
3324                 } else
3325                         cFYI(1, ("No session or bad tcon"));
3326         }
3327
3328         cifs_sb->tcon = NULL;
3329         tmp = cifs_sb->prepath;
3330         cifs_sb->prepathlen = 0;
3331         cifs_sb->prepath = NULL;
3332         kfree(tmp);
3333         if (ses)
3334                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3335         if (ses)
3336                 sesInfoFree(ses);
3337
3338         FreeXid(xid);
3339         return rc;              /* BB check if we should always return zero here */
3340 }
3341
3342 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3343                                            struct nls_table * nls_info)
3344 {
3345         int rc = 0;
3346         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3347         int ntlmv2_flag = FALSE;
3348         int first_time = 0;
3349
3350         /* what if server changes its buffer size after dropping the session? */
3351         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3352                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3353                 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3354                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3355                         if(rc == -EAGAIN)
3356                                 rc = -EHOSTDOWN;
3357                 }
3358                 if(rc == 0) {
3359                         spin_lock(&GlobalMid_Lock);
3360                         if(pSesInfo->server->tcpStatus != CifsExiting)
3361                                 pSesInfo->server->tcpStatus = CifsGood;
3362                         else
3363                                 rc = -EHOSTDOWN;
3364                         spin_unlock(&GlobalMid_Lock);
3365
3366                 }
3367                 first_time = 1;
3368         }
3369         if (!rc) {
3370                 pSesInfo->flags = 0;
3371                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3372                 if(linuxExtEnabled == 0)
3373                         pSesInfo->capabilities &= (~CAP_UNIX);
3374         /*      pSesInfo->sequence_number = 0;*/
3375                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3376                         pSesInfo->server->secMode,
3377                         pSesInfo->server->capabilities,
3378                         pSesInfo->server->timeAdj));
3379                 if(experimEnabled < 2)
3380                         rc = CIFS_SessSetup(xid, pSesInfo,
3381                                             first_time, nls_info);
3382                 else if (extended_security
3383                                 && (pSesInfo->capabilities
3384                                         & CAP_EXTENDED_SECURITY)
3385                                 && (pSesInfo->server->secType == NTLMSSP)) {
3386                         rc = -EOPNOTSUPP;
3387                 } else if (extended_security
3388                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3389                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3390                         cFYI(1, ("NTLMSSP sesssetup"));
3391                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3392                                                 pSesInfo,
3393                                                 &ntlmv2_flag,
3394                                                 nls_info);
3395                         if (!rc) {
3396                                 if(ntlmv2_flag) {
3397                                         char * v2_response;
3398                                         cFYI(1,("more secure NTLM ver2 hash"));
3399                                         if(CalcNTLMv2_partial_mac_key(pSesInfo,
3400                                                 nls_info)) {
3401                                                 rc = -ENOMEM;
3402                                                 goto ss_err_exit;
3403                                         } else
3404                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3405                                         if(v2_response) {
3406                                                 CalcNTLMv2_response(pSesInfo,v2_response);
3407                                 /*              if(first_time)
3408                                                         cifs_calculate_ntlmv2_mac_key(
3409                                                           pSesInfo->server->mac_signing_key,
3410                                                           response, ntlm_session_key, */
3411                                                 kfree(v2_response);
3412                                         /* BB Put dummy sig in SessSetup PDU? */
3413                                         } else {
3414                                                 rc = -ENOMEM;
3415                                                 goto ss_err_exit;
3416                                         }
3417
3418                                 } else {
3419                                         SMBNTencrypt(pSesInfo->password,
3420                                                 pSesInfo->server->cryptKey,
3421                                                 ntlm_session_key);
3422
3423                                         if(first_time)
3424                                                 cifs_calculate_mac_key(
3425                                                         pSesInfo->server->mac_signing_key,
3426                                                         ntlm_session_key,
3427                                                         pSesInfo->password);
3428                                 }
3429                         /* for better security the weaker lanman hash not sent
3430                            in AuthSessSetup so we no longer calculate it */
3431
3432                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3433                                         pSesInfo,
3434                                         ntlm_session_key,
3435                                         ntlmv2_flag,
3436                                         nls_info);
3437                         }
3438                 } else { /* old style NTLM 0.12 session setup */
3439                         SMBNTencrypt(pSesInfo->password,
3440                                 pSesInfo->server->cryptKey,
3441                                 ntlm_session_key);
3442
3443                         if(first_time)
3444                                 cifs_calculate_mac_key(
3445                                         pSesInfo->server->mac_signing_key,
3446                                         ntlm_session_key, pSesInfo->password);
3447
3448                         rc = CIFSSessSetup(xid, pSesInfo,
3449                                 ntlm_session_key, nls_info);
3450                 }
3451                 if (rc) {
3452                         cERROR(1,("Send error in SessSetup = %d",rc));
3453                 } else {
3454                         cFYI(1,("CIFS Session Established successfully"));
3455                         pSesInfo->status = CifsGood;
3456                 }
3457         }
3458 ss_err_exit:
3459         return rc;
3460 }
3461