4 * Copyright (C) International Business Machines Corp., 2002,2007
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/kthread.h>
34 #include <linux/pagevec.h>
35 #include <linux/freezer.h>
36 #include <asm/uaccess.h>
37 #include <asm/processor.h>
40 #include "cifsproto.h"
41 #include "cifs_unicode.h"
42 #include "cifs_debug.h"
43 #include "cifs_fs_sb.h"
46 #include "rfc1002pdu.h"
50 #define RFC1001_PORT 139
52 static DECLARE_COMPLETION(cifsd_complete);
54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
57 extern mempool_t *cifs_req_poolp;
65 char *in6_addr; /* ipv6 address as human readable form of in6_addr */
66 char *iocharset; /* local code page for mapping to and from Unicode */
67 char source_rfc1001_name[16]; /* netbios name of client */
68 char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
78 unsigned override_uid:1;
79 unsigned override_gid:1;
81 unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
83 unsigned no_xattr:1; /* set if xattr (EA) support should be disabled*/
84 unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
86 unsigned remap:1; /* set to remap seven reserved chars in filenames */
87 unsigned posix_paths:1; /* unset to not ask for posix pathnames. */
89 unsigned nullauth:1; /* attempt to authenticate with null user */
90 unsigned nocase; /* request case insensitive filenames */
91 unsigned nobrl; /* disable sending byte range locks to srv */
95 unsigned short int port;
99 static int ipv4_connect(struct sockaddr_in *psin_server,
100 struct socket **csocket,
102 char * server_netb_name);
103 static int ipv6_connect(struct sockaddr_in6 *psin_server,
104 struct socket **csocket);
108 * cifs tcp session reconnection
110 * mark tcp session as reconnecting so temporarily locked
111 * mark all smb sessions as reconnecting for tcp session
112 * reconnect tcp session
113 * wake up waiters on reconnection? - (not needed currently)
117 cifs_reconnect(struct TCP_Server_Info *server)
120 struct list_head *tmp;
121 struct cifsSesInfo *ses;
122 struct cifsTconInfo *tcon;
123 struct mid_q_entry * mid_entry;
125 spin_lock(&GlobalMid_Lock);
126 if( kthread_should_stop() ) {
127 /* the demux thread will exit normally
128 next time through the loop */
129 spin_unlock(&GlobalMid_Lock);
132 server->tcpStatus = CifsNeedReconnect;
133 spin_unlock(&GlobalMid_Lock);
136 cFYI(1, ("Reconnecting tcp session"));
138 /* before reconnecting the tcp session, mark the smb session (uid)
139 and the tid bad so they are not used until reconnected */
140 read_lock(&GlobalSMBSeslock);
141 list_for_each(tmp, &GlobalSMBSessionList) {
142 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
144 if (ses->server == server) {
145 ses->status = CifsNeedReconnect;
149 /* else tcp and smb sessions need reconnection */
151 list_for_each(tmp, &GlobalTreeConnectionList) {
152 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
153 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
154 tcon->tidStatus = CifsNeedReconnect;
157 read_unlock(&GlobalSMBSeslock);
158 /* do not want to be sending data on a socket we are freeing */
159 down(&server->tcpSem);
160 if(server->ssocket) {
161 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
162 server->ssocket->flags));
163 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
164 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
165 server->ssocket->flags));
166 sock_release(server->ssocket);
167 server->ssocket = NULL;
170 spin_lock(&GlobalMid_Lock);
171 list_for_each(tmp, &server->pending_mid_q) {
172 mid_entry = list_entry(tmp, struct
176 if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
177 /* Mark other intransit requests as needing
178 retry so we do not immediately mark the
179 session bad again (ie after we reconnect
180 below) as they timeout too */
181 mid_entry->midState = MID_RETRY_NEEDED;
185 spin_unlock(&GlobalMid_Lock);
188 while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood))
191 if(server->protocolType == IPV6) {
192 rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
194 rc = ipv4_connect(&server->addr.sockAddr,
196 server->workstation_RFC1001_name,
197 server->server_RFC1001_name);
200 cFYI(1,("reconnect error %d",rc));
203 atomic_inc(&tcpSesReconnectCount);
204 spin_lock(&GlobalMid_Lock);
205 if( !kthread_should_stop() )
206 server->tcpStatus = CifsGood;
207 server->sequence_number = 0;
208 spin_unlock(&GlobalMid_Lock);
209 /* atomic_set(&server->inFlight,0);*/
210 wake_up(&server->response_q);
218 0 not a transact2, or all data present
219 >0 transact2 with that much data missing
220 -EINVAL = invalid transact2
223 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
225 struct smb_t2_rsp * pSMBt;
227 int data_in_this_rsp;
230 if(pSMB->Command != SMB_COM_TRANSACTION2)
233 /* check for plausible wct, bcc and t2 data and parm sizes */
234 /* check for parm and data offset going beyond end of smb */
235 if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
236 cFYI(1,("invalid transact2 word count"));
240 pSMBt = (struct smb_t2_rsp *)pSMB;
242 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
243 data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
245 remaining = total_data_size - data_in_this_rsp;
249 else if(remaining < 0) {
250 cFYI(1,("total data %d smaller than data in frame %d",
251 total_data_size, data_in_this_rsp));
254 cFYI(1,("missing %d bytes from transact2, check next response",
256 if(total_data_size > maxBufSize) {
257 cERROR(1,("TotalDataSize %d is over maximum buffer %d",
258 total_data_size,maxBufSize));
265 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
267 struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
268 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB;
273 char * data_area_of_target;
274 char * data_area_of_buf2;
277 total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
279 if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
280 cFYI(1,("total data sizes of primary and secondary t2 differ"));
283 total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
285 remaining = total_data_size - total_in_buf;
290 if(remaining == 0) /* nothing to do, ignore */
293 total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
294 if(remaining < total_in_buf2) {
295 cFYI(1,("transact2 2nd response contains too much data"));
298 /* find end of first SMB data area */
299 data_area_of_target = (char *)&pSMBt->hdr.Protocol +
300 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
301 /* validate target area */
303 data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
304 le16_to_cpu(pSMB2->t2_rsp.DataOffset);
306 data_area_of_target += total_in_buf;
308 /* copy second buffer into end of first buffer */
309 memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
310 total_in_buf += total_in_buf2;
311 pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
312 byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
313 byte_count += total_in_buf2;
314 BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
316 byte_count = pTargetSMB->smb_buf_length;
317 byte_count += total_in_buf2;
319 /* BB also add check that we are not beyond maximum buffer size */
321 pTargetSMB->smb_buf_length = byte_count;
323 if(remaining == total_in_buf2) {
324 cFYI(1,("found the last secondary response"));
325 return 0; /* we are done */
326 } else /* more responses to go */
332 cifs_demultiplex_thread(struct TCP_Server_Info *server)
335 unsigned int pdu_length, total_read;
336 struct smb_hdr *smb_buffer = NULL;
337 struct smb_hdr *bigbuf = NULL;
338 struct smb_hdr *smallbuf = NULL;
339 struct msghdr smb_msg;
341 struct socket *csocket = server->ssocket;
342 struct list_head *tmp;
343 struct cifsSesInfo *ses;
344 struct task_struct *task_to_wake = NULL;
345 struct mid_q_entry *mid_entry;
347 int isLargeBuf = FALSE;
351 allow_signal(SIGKILL);
352 current->flags |= PF_MEMALLOC;
353 server->tsk = current; /* save process info to wake at shutdown */
354 cFYI(1, ("Demultiplex PID: %d", current->pid));
355 write_lock(&GlobalSMBSeslock);
356 atomic_inc(&tcpSesAllocCount);
357 length = tcpSesAllocCount.counter;
358 write_unlock(&GlobalSMBSeslock);
359 complete(&cifsd_complete);
361 mempool_resize(cifs_req_poolp,
362 length + cifs_min_rcv,
366 while (!kthread_should_stop()) {
369 if (bigbuf == NULL) {
370 bigbuf = cifs_buf_get();
372 cERROR(1, ("No memory for large SMB response"));
374 /* retry will check if exiting */
377 } else if (isLargeBuf) {
378 /* we are reusing a dirty large buf, clear its start */
379 memset(bigbuf, 0, sizeof (struct smb_hdr));
382 if (smallbuf == NULL) {
383 smallbuf = cifs_small_buf_get();
385 cERROR(1, ("No memory for SMB response"));
387 /* retry will check if exiting */
390 /* beginning of smb buffer is cleared in our buf_get */
391 } else /* if existing small buf clear beginning */
392 memset(smallbuf, 0, sizeof (struct smb_hdr));
396 smb_buffer = smallbuf;
397 iov.iov_base = smb_buffer;
399 smb_msg.msg_control = NULL;
400 smb_msg.msg_controllen = 0;
402 kernel_recvmsg(csocket, &smb_msg,
403 &iov, 1, 4, 0 /* BB see socket.h flags */);
405 if ( kthread_should_stop() ) {
407 } else if (server->tcpStatus == CifsNeedReconnect) {
408 cFYI(1, ("Reconnect after server stopped responding"));
409 cifs_reconnect(server);
410 cFYI(1, ("call to reconnect done"));
411 csocket = server->ssocket;
413 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
414 msleep(1); /* minimum sleep to prevent looping
415 allowing socket to clear and app threads to set
416 tcpStatus CifsNeedReconnect if server hung */
418 } else if (length <= 0) {
419 if (server->tcpStatus == CifsNew) {
420 cFYI(1, ("tcp session abend after SMBnegprot"));
421 /* some servers kill the TCP session rather than
422 returning an SMB negprot error, in which
423 case reconnecting here is not going to help,
424 and so simply return error to mount */
427 if (!try_to_freeze() && (length == -EINTR)) {
428 cFYI(1,("cifsd thread killed"));
431 cFYI(1,("Reconnect after unexpected peek error %d",
433 cifs_reconnect(server);
434 csocket = server->ssocket;
435 wake_up(&server->response_q);
437 } else if (length < 4) {
439 ("Frame under four bytes received (%d bytes long)",
441 cifs_reconnect(server);
442 csocket = server->ssocket;
443 wake_up(&server->response_q);
447 /* The right amount was read from socket - 4 bytes */
448 /* so we can now interpret the length field */
450 /* the first byte big endian of the length field,
451 is actually not part of the length but the type
452 with the most common, zero, as regular data */
453 temp = *((char *) smb_buffer);
455 /* Note that FC 1001 length is big endian on the wire,
456 but we convert it here so it is always manipulated
457 as host byte order */
458 pdu_length = ntohl(smb_buffer->smb_buf_length);
459 smb_buffer->smb_buf_length = pdu_length;
461 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
463 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
465 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
466 cFYI(1,("Good RFC 1002 session rsp"));
468 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
469 /* we get this from Windows 98 instead of
470 an error on SMB negprot response */
471 cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
473 if(server->tcpStatus == CifsNew) {
474 /* if nack on negprot (rather than
475 ret of smb negprot error) reconnecting
476 not going to help, ret error to mount */
479 /* give server a second to
480 clean up before reconnect attempt */
482 /* always try 445 first on reconnect
483 since we get NACK on some if we ever
484 connected to port 139 (the NACK is
485 since we do not begin with RFC1001
486 session initialize frame) */
487 server->addr.sockAddr.sin_port =
489 cifs_reconnect(server);
490 csocket = server->ssocket;
491 wake_up(&server->response_q);
494 } else if (temp != (char) 0) {
495 cERROR(1,("Unknown RFC 1002 frame"));
496 cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
498 cifs_reconnect(server);
499 csocket = server->ssocket;
503 /* else we have an SMB response */
504 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
505 (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
506 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
507 length, pdu_length+4));
508 cifs_reconnect(server);
509 csocket = server->ssocket;
510 wake_up(&server->response_q);
517 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
519 memcpy(bigbuf, smallbuf, 4);
523 iov.iov_base = 4 + (char *)smb_buffer;
524 iov.iov_len = pdu_length;
525 for (total_read = 0; total_read < pdu_length;
526 total_read += length) {
527 length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
528 pdu_length - total_read, 0);
529 if( kthread_should_stop() ||
530 (length == -EINTR)) {
534 } else if (server->tcpStatus == CifsNeedReconnect) {
535 cifs_reconnect(server);
536 csocket = server->ssocket;
537 /* Reconnect wakes up rspns q */
538 /* Now we will reread sock */
541 } else if ((length == -ERESTARTSYS) ||
542 (length == -EAGAIN)) {
543 msleep(1); /* minimum sleep to prevent looping,
544 allowing socket to clear and app
545 threads to set tcpStatus
546 CifsNeedReconnect if server hung*/
548 } else if (length <= 0) {
549 cERROR(1,("Received no data, expecting %d",
550 pdu_length - total_read));
551 cifs_reconnect(server);
552 csocket = server->ssocket;
559 else if(reconnect == 1)
562 length += 4; /* account for rfc1002 hdr */
565 dump_smb(smb_buffer, length);
566 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
567 cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
573 spin_lock(&GlobalMid_Lock);
574 list_for_each(tmp, &server->pending_mid_q) {
575 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
577 if ((mid_entry->mid == smb_buffer->Mid) &&
578 (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
579 (mid_entry->command == smb_buffer->Command)) {
580 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
581 /* We have a multipart transact2 resp */
583 if(mid_entry->resp_buf) {
584 /* merge response - fix up 1st*/
585 if(coalesce_t2(smb_buffer,
586 mid_entry->resp_buf)) {
587 mid_entry->multiRsp = 1;
590 /* all parts received */
591 mid_entry->multiEnd = 1;
596 cERROR(1,("1st trans2 resp needs bigbuf"));
597 /* BB maybe we can fix this up, switch
598 to already allocated large buffer? */
600 /* Have first buffer */
601 mid_entry->resp_buf =
603 mid_entry->largeBuf = 1;
609 mid_entry->resp_buf = smb_buffer;
611 mid_entry->largeBuf = 1;
613 mid_entry->largeBuf = 0;
615 task_to_wake = mid_entry->tsk;
616 mid_entry->midState = MID_RESPONSE_RECEIVED;
617 #ifdef CONFIG_CIFS_STATS2
618 mid_entry->when_received = jiffies;
620 /* so we do not time out requests to server
621 which is still responding (since server could
622 be busy but not dead) */
623 server->lstrp = jiffies;
627 spin_unlock(&GlobalMid_Lock);
629 /* Was previous buf put in mpx struct for multi-rsp? */
631 /* smb buffer will be freed by user thread */
637 wake_up_process(task_to_wake);
638 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
639 && (isMultiRsp == FALSE)) {
640 cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
641 cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
642 sizeof(struct smb_hdr));
643 #ifdef CONFIG_CIFS_DEBUG2
644 cifs_dump_detail(smb_buffer);
645 cifs_dump_mids(server);
646 #endif /* CIFS_DEBUG2 */
649 } /* end while !EXITING */
651 spin_lock(&GlobalMid_Lock);
652 server->tcpStatus = CifsExiting;
654 /* check if we have blocked requests that need to free */
655 /* Note that cifs_max_pending is normally 50, but
656 can be set at module install time to as little as two */
657 if(atomic_read(&server->inFlight) >= cifs_max_pending)
658 atomic_set(&server->inFlight, cifs_max_pending - 1);
659 /* We do not want to set the max_pending too low or we
660 could end up with the counter going negative */
661 spin_unlock(&GlobalMid_Lock);
662 /* Although there should not be any requests blocked on
663 this queue it can not hurt to be paranoid and try to wake up requests
664 that may haven been blocked when more than 50 at time were on the wire
665 to the same server - they now will see the session is in exit state
666 and get out of SendReceive. */
667 wake_up_all(&server->request_q);
668 /* give those requests time to exit */
671 if(server->ssocket) {
672 sock_release(csocket);
673 server->ssocket = NULL;
675 /* buffer usuallly freed in free_mid - need to free it here on exit */
677 cifs_buf_release(bigbuf);
678 if (smallbuf != NULL)
679 cifs_small_buf_release(smallbuf);
681 read_lock(&GlobalSMBSeslock);
682 if (list_empty(&server->pending_mid_q)) {
683 /* loop through server session structures attached to this and
685 list_for_each(tmp, &GlobalSMBSessionList) {
687 list_entry(tmp, struct cifsSesInfo,
689 if (ses->server == server) {
690 ses->status = CifsExiting;
694 read_unlock(&GlobalSMBSeslock);
696 /* although we can not zero the server struct pointer yet,
697 since there are active requests which may depnd on them,
698 mark the corresponding SMB sessions as exiting too */
699 list_for_each(tmp, &GlobalSMBSessionList) {
700 ses = list_entry(tmp, struct cifsSesInfo,
702 if (ses->server == server) {
703 ses->status = CifsExiting;
707 spin_lock(&GlobalMid_Lock);
708 list_for_each(tmp, &server->pending_mid_q) {
709 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
710 if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
712 ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
713 task_to_wake = mid_entry->tsk;
715 wake_up_process(task_to_wake);
719 spin_unlock(&GlobalMid_Lock);
720 read_unlock(&GlobalSMBSeslock);
721 /* 1/8th of sec is more than enough time for them to exit */
725 if (!list_empty(&server->pending_mid_q)) {
726 /* mpx threads have not exited yet give them
727 at least the smb send timeout time for long ops */
728 /* due to delays on oplock break requests, we need
729 to wait at least 45 seconds before giving up
730 on a request getting a response and going ahead
732 cFYI(1, ("Wait for exit from demultiplex thread"));
734 /* if threads still have not exited they are probably never
735 coming home not much else we can do but free the memory */
738 write_lock(&GlobalSMBSeslock);
739 atomic_dec(&tcpSesAllocCount);
740 length = tcpSesAllocCount.counter;
742 /* last chance to mark ses pointers invalid
743 if there are any pointing to this (e.g
744 if a crazy root user tried to kill cifsd
745 kernel thread explicitly this might happen) */
746 list_for_each(tmp, &GlobalSMBSessionList) {
747 ses = list_entry(tmp, struct cifsSesInfo,
749 if (ses->server == server) {
753 write_unlock(&GlobalSMBSeslock);
757 mempool_resize(cifs_req_poolp,
758 length + cifs_min_rcv,
766 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
770 unsigned int temp_len, i, j;
776 if (Local_System_Name[0] != 0)
777 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
779 char *nodename = utsname()->nodename;
780 int n = strnlen(nodename,15);
781 memset(vol->source_rfc1001_name,0x20,15);
782 for(i=0 ; i < n ; i++) {
783 /* does not have to be perfect mapping since field is
784 informational, only used for servers that do not support
785 port 445 and it can be overridden at mount time */
786 vol->source_rfc1001_name[i] = toupper(nodename[i]);
789 vol->source_rfc1001_name[15] = 0;
790 /* null target name indicates to use *SMBSERVR default called name
791 if we end up sending RFC1001 session initialize */
792 vol->target_rfc1001_name[0] = 0;
793 vol->linux_uid = current->uid; /* current->euid instead? */
794 vol->linux_gid = current->gid;
795 vol->dir_mode = S_IRWXUGO;
796 /* 2767 perms indicate mandatory locking support */
797 vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
799 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
801 /* default is always to request posix paths. */
802 vol->posix_paths = 1;
807 if(strncmp(options,"sep=",4) == 0) {
808 if(options[4] != 0) {
809 separator[0] = options[4];
812 cFYI(1,("Null separator not allowed"));
816 while ((data = strsep(&options, separator)) != NULL) {
819 if ((value = strchr(data, '=')) != NULL)
822 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
824 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
826 } else if (strnicmp(data, "user", 4) == 0) {
829 "CIFS: invalid or missing username\n");
830 return 1; /* needs_arg; */
832 /* null user, ie anonymous, authentication */
835 if (strnlen(value, 200) < 200) {
836 vol->username = value;
838 printk(KERN_WARNING "CIFS: username too long\n");
841 } else if (strnicmp(data, "pass", 4) == 0) {
843 vol->password = NULL;
845 } else if(value[0] == 0) {
846 /* check if string begins with double comma
847 since that would mean the password really
848 does start with a comma, and would not
849 indicate an empty string */
850 if(value[1] != separator[0]) {
851 vol->password = NULL;
855 temp_len = strlen(value);
856 /* removed password length check, NTLM passwords
857 can be arbitrarily long */
859 /* if comma in password, the string will be
860 prematurely null terminated. Commas in password are
861 specified across the cifs mount interface by a double
862 comma ie ,, and a comma used as in other cases ie ','
863 as a parameter delimiter/separator is single and due
864 to the strsep above is temporarily zeroed. */
866 /* NB: password legally can have multiple commas and
867 the only illegal character in a password is null */
869 if ((value[temp_len] == 0) &&
870 (value[temp_len+1] == separator[0])) {
872 value[temp_len] = separator[0];
873 temp_len+=2; /* move after the second comma */
874 while(value[temp_len] != 0) {
875 if (value[temp_len] == separator[0]) {
876 if (value[temp_len+1] ==
878 /* skip second comma */
881 /* single comma indicating start
888 if(value[temp_len] == 0) {
892 /* point option to start of next parm */
893 options = value + temp_len + 1;
895 /* go from value to value + temp_len condensing
896 double commas to singles. Note that this ends up
897 allocating a few bytes too many, which is ok */
898 vol->password = kzalloc(temp_len, GFP_KERNEL);
899 if(vol->password == NULL) {
900 printk("CIFS: no memory for pass\n");
903 for(i=0,j=0;i<temp_len;i++,j++) {
904 vol->password[j] = value[i];
905 if(value[i] == separator[0]
906 && value[i+1] == separator[0]) {
907 /* skip second comma */
911 vol->password[j] = 0;
913 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
914 if(vol->password == NULL) {
915 printk("CIFS: no memory for pass\n");
918 strcpy(vol->password, value);
920 } else if (strnicmp(data, "ip", 2) == 0) {
921 if (!value || !*value) {
923 } else if (strnlen(value, 35) < 35) {
926 printk(KERN_WARNING "CIFS: ip address too long\n");
929 } else if (strnicmp(data, "sec", 3) == 0) {
930 if (!value || !*value) {
931 cERROR(1,("no security value specified"));
933 } else if (strnicmp(value, "krb5i", 5) == 0) {
934 vol->secFlg |= CIFSSEC_MAY_KRB5 |
936 } else if (strnicmp(value, "krb5p", 5) == 0) {
937 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
939 cERROR(1,("Krb5 cifs privacy not supported"));
941 } else if (strnicmp(value, "krb5", 4) == 0) {
942 vol->secFlg |= CIFSSEC_MAY_KRB5;
943 } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
944 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
946 } else if (strnicmp(value, "ntlmv2", 6) == 0) {
947 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
948 } else if (strnicmp(value, "ntlmi", 5) == 0) {
949 vol->secFlg |= CIFSSEC_MAY_NTLM |
951 } else if (strnicmp(value, "ntlm", 4) == 0) {
952 /* ntlm is default so can be turned off too */
953 vol->secFlg |= CIFSSEC_MAY_NTLM;
954 } else if (strnicmp(value, "nontlm", 6) == 0) {
955 /* BB is there a better way to do this? */
956 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
957 #ifdef CONFIG_CIFS_WEAK_PW_HASH
958 } else if (strnicmp(value, "lanman", 6) == 0) {
959 vol->secFlg |= CIFSSEC_MAY_LANMAN;
961 } else if (strnicmp(value, "none", 4) == 0) {
964 cERROR(1,("bad security option: %s", value));
967 } else if ((strnicmp(data, "unc", 3) == 0)
968 || (strnicmp(data, "target", 6) == 0)
969 || (strnicmp(data, "path", 4) == 0)) {
970 if (!value || !*value) {
972 "CIFS: invalid path to network resource\n");
973 return 1; /* needs_arg; */
975 if ((temp_len = strnlen(value, 300)) < 300) {
976 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
977 if (vol->UNC == NULL)
979 strcpy(vol->UNC,value);
980 if (strncmp(vol->UNC, "//", 2) == 0) {
983 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
985 "CIFS: UNC Path does not begin with // or \\\\ \n");
989 printk(KERN_WARNING "CIFS: UNC name too long\n");
992 } else if ((strnicmp(data, "domain", 3) == 0)
993 || (strnicmp(data, "workgroup", 5) == 0)) {
994 if (!value || !*value) {
995 printk(KERN_WARNING "CIFS: invalid domain name\n");
996 return 1; /* needs_arg; */
998 /* BB are there cases in which a comma can be valid in
999 a domain name and need special handling? */
1000 if (strnlen(value, 256) < 256) {
1001 vol->domainname = value;
1002 cFYI(1, ("Domain name set"));
1004 printk(KERN_WARNING "CIFS: domain name too long\n");
1007 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1008 if (!value || !*value) {
1010 "CIFS: invalid path prefix\n");
1011 return 1; /* needs_arg; */
1013 if ((temp_len = strnlen(value, 1024)) < 1024) {
1014 if (value[0] != '/')
1015 temp_len++; /* missing leading slash */
1016 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1017 if (vol->prepath == NULL)
1019 if (value[0] != '/') {
1020 vol->prepath[0] = '/';
1021 strcpy(vol->prepath+1,value);
1023 strcpy(vol->prepath,value);
1024 cFYI(1,("prefix path %s",vol->prepath));
1026 printk(KERN_WARNING "CIFS: prefix too long\n");
1029 } else if (strnicmp(data, "iocharset", 9) == 0) {
1030 if (!value || !*value) {
1031 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1032 return 1; /* needs_arg; */
1034 if (strnlen(value, 65) < 65) {
1035 if (strnicmp(value,"default",7))
1036 vol->iocharset = value;
1037 /* if iocharset not set load_nls_default used by caller */
1038 cFYI(1, ("iocharset set to %s",value));
1040 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1043 } else if (strnicmp(data, "uid", 3) == 0) {
1044 if (value && *value) {
1046 simple_strtoul(value, &value, 0);
1047 vol->override_uid = 1;
1049 } else if (strnicmp(data, "gid", 3) == 0) {
1050 if (value && *value) {
1052 simple_strtoul(value, &value, 0);
1053 vol->override_gid = 1;
1055 } else if (strnicmp(data, "file_mode", 4) == 0) {
1056 if (value && *value) {
1058 simple_strtoul(value, &value, 0);
1060 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1061 if (value && *value) {
1063 simple_strtoul(value, &value, 0);
1065 } else if (strnicmp(data, "dirmode", 4) == 0) {
1066 if (value && *value) {
1068 simple_strtoul(value, &value, 0);
1070 } else if (strnicmp(data, "port", 4) == 0) {
1071 if (value && *value) {
1073 simple_strtoul(value, &value, 0);
1075 } else if (strnicmp(data, "rsize", 5) == 0) {
1076 if (value && *value) {
1078 simple_strtoul(value, &value, 0);
1080 } else if (strnicmp(data, "wsize", 5) == 0) {
1081 if (value && *value) {
1083 simple_strtoul(value, &value, 0);
1085 } else if (strnicmp(data, "sockopt", 5) == 0) {
1086 if (value && *value) {
1088 simple_strtoul(value, &value, 0);
1090 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1091 if (!value || !*value || (*value == ' ')) {
1092 cFYI(1,("invalid (empty) netbiosname specified"));
1094 memset(vol->source_rfc1001_name,0x20,15);
1096 /* BB are there cases in which a comma can be
1097 valid in this workstation netbios name (and need
1098 special handling)? */
1100 /* We do not uppercase netbiosname for user */
1104 vol->source_rfc1001_name[i] = value[i];
1106 /* The string has 16th byte zero still from
1107 set at top of the function */
1108 if ((i==15) && (value[i] != 0))
1109 printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1111 } else if (strnicmp(data, "servern", 7) == 0) {
1112 /* servernetbiosname specified override *SMBSERVER */
1113 if (!value || !*value || (*value == ' ')) {
1114 cFYI(1,("empty server netbiosname specified"));
1116 /* last byte, type, is 0x20 for servr type */
1117 memset(vol->target_rfc1001_name,0x20,16);
1120 /* BB are there cases in which a comma can be
1121 valid in this workstation netbios name (and need
1122 special handling)? */
1124 /* user or mount helper must uppercase netbiosname */
1128 vol->target_rfc1001_name[i] = value[i];
1130 /* The string has 16th byte zero still from
1131 set at top of the function */
1132 if ((i==15) && (value[i] != 0))
1133 printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1135 } else if (strnicmp(data, "credentials", 4) == 0) {
1137 } else if (strnicmp(data, "version", 3) == 0) {
1139 } else if (strnicmp(data, "guest",5) == 0) {
1141 } else if (strnicmp(data, "rw", 2) == 0) {
1143 } else if ((strnicmp(data, "suid", 4) == 0) ||
1144 (strnicmp(data, "nosuid", 6) == 0) ||
1145 (strnicmp(data, "exec", 4) == 0) ||
1146 (strnicmp(data, "noexec", 6) == 0) ||
1147 (strnicmp(data, "nodev", 5) == 0) ||
1148 (strnicmp(data, "noauto", 6) == 0) ||
1149 (strnicmp(data, "dev", 3) == 0)) {
1150 /* The mount tool or mount.cifs helper (if present)
1151 uses these opts to set flags, and the flags are read
1152 by the kernel vfs layer before we get here (ie
1153 before read super) so there is no point trying to
1154 parse these options again and set anything and it
1155 is ok to just ignore them */
1157 } else if (strnicmp(data, "ro", 2) == 0) {
1159 } else if (strnicmp(data, "hard", 4) == 0) {
1161 } else if (strnicmp(data, "soft", 4) == 0) {
1163 } else if (strnicmp(data, "perm", 4) == 0) {
1165 } else if (strnicmp(data, "noperm", 6) == 0) {
1167 } else if (strnicmp(data, "mapchars", 8) == 0) {
1169 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1171 } else if (strnicmp(data, "sfu", 3) == 0) {
1173 } else if (strnicmp(data, "nosfu", 5) == 0) {
1175 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1176 vol->posix_paths = 1;
1177 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1178 vol->posix_paths = 0;
1179 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1180 (strnicmp(data, "ignorecase", 10) == 0)) {
1182 } else if (strnicmp(data, "brl", 3) == 0) {
1184 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1185 (strnicmp(data, "nolock", 6) == 0)) {
1187 /* turn off mandatory locking in mode
1188 if remote locking is turned off since the
1189 local vfs will do advisory */
1190 if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1191 vol->file_mode = S_IALLUGO;
1192 } else if (strnicmp(data, "setuids", 7) == 0) {
1194 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1196 } else if (strnicmp(data, "nohard", 6) == 0) {
1198 } else if (strnicmp(data, "nosoft", 6) == 0) {
1200 } else if (strnicmp(data, "nointr", 6) == 0) {
1202 } else if (strnicmp(data, "intr", 4) == 0) {
1204 } else if (strnicmp(data, "serverino",7) == 0) {
1205 vol->server_ino = 1;
1206 } else if (strnicmp(data, "noserverino",9) == 0) {
1207 vol->server_ino = 0;
1208 } else if (strnicmp(data, "cifsacl",7) == 0) {
1210 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1212 } else if (strnicmp(data, "acl",3) == 0) {
1213 vol->no_psx_acl = 0;
1214 } else if (strnicmp(data, "noacl",5) == 0) {
1215 vol->no_psx_acl = 1;
1216 } else if (strnicmp(data, "sign",4) == 0) {
1217 vol->secFlg |= CIFSSEC_MUST_SIGN;
1218 /* } else if (strnicmp(data, "seal",4) == 0) {
1219 vol->secFlg |= CIFSSEC_MUST_SEAL; */
1220 } else if (strnicmp(data, "direct",6) == 0) {
1222 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1224 } else if (strnicmp(data, "in6_addr",8) == 0) {
1225 if (!value || !*value) {
1226 vol->in6_addr = NULL;
1227 } else if (strnlen(value, 49) == 48) {
1228 vol->in6_addr = value;
1230 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1233 } else if (strnicmp(data, "noac", 4) == 0) {
1234 printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1236 printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1238 if (vol->UNC == NULL) {
1239 if (devname == NULL) {
1240 printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1243 if ((temp_len = strnlen(devname, 300)) < 300) {
1244 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1245 if (vol->UNC == NULL)
1247 strcpy(vol->UNC,devname);
1248 if (strncmp(vol->UNC, "//", 2) == 0) {
1251 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1252 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1256 printk(KERN_WARNING "CIFS: UNC name too long\n");
1260 if(vol->UNCip == NULL)
1261 vol->UNCip = &vol->UNC[2];
1266 static struct cifsSesInfo *
1267 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1268 struct in6_addr *target_ip6_addr,
1269 char *userName, struct TCP_Server_Info **psrvTcp)
1271 struct list_head *tmp;
1272 struct cifsSesInfo *ses;
1274 read_lock(&GlobalSMBSeslock);
1276 list_for_each(tmp, &GlobalSMBSessionList) {
1277 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1279 if((target_ip_addr &&
1280 (ses->server->addr.sockAddr.sin_addr.s_addr
1281 == target_ip_addr->s_addr)) || (target_ip6_addr
1282 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1283 target_ip6_addr,sizeof(*target_ip6_addr)))){
1284 /* BB lock server and tcp session and increment use count here?? */
1285 *psrvTcp = ses->server; /* found a match on the TCP session */
1286 /* BB check if reconnection needed */
1288 (ses->userName, userName,
1289 MAX_USERNAME_SIZE) == 0){
1290 read_unlock(&GlobalSMBSeslock);
1291 return ses; /* found exact match on both tcp and SMB sessions */
1295 /* else tcp and smb sessions need reconnection */
1297 read_unlock(&GlobalSMBSeslock);
1301 static struct cifsTconInfo *
1302 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1304 struct list_head *tmp;
1305 struct cifsTconInfo *tcon;
1307 read_lock(&GlobalSMBSeslock);
1308 list_for_each(tmp, &GlobalTreeConnectionList) {
1309 cFYI(1, ("Next tcon"));
1310 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1312 if (tcon->ses->server) {
1314 ("old ip addr: %x == new ip %x ?",
1315 tcon->ses->server->addr.sockAddr.sin_addr.
1316 s_addr, new_target_ip_addr));
1317 if (tcon->ses->server->addr.sockAddr.sin_addr.
1318 s_addr == new_target_ip_addr) {
1319 /* BB lock tcon, server and tcp session and increment use count here? */
1320 /* found a match on the TCP session */
1321 /* BB check if reconnection needed */
1322 cFYI(1,("IP match, old UNC: %s new: %s",
1323 tcon->treeName, uncName));
1325 (tcon->treeName, uncName,
1326 MAX_TREE_SIZE) == 0) {
1328 ("and old usr: %s new: %s",
1329 tcon->treeName, uncName));
1331 (tcon->ses->userName,
1333 MAX_USERNAME_SIZE) == 0) {
1334 read_unlock(&GlobalSMBSeslock);
1335 /* matched smb session
1344 read_unlock(&GlobalSMBSeslock);
1349 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1350 const char *old_path, const struct nls_table *nls_codepage,
1353 unsigned char *referrals = NULL;
1354 unsigned int num_referrals;
1357 rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1358 &num_referrals, &referrals, remap);
1360 /* BB Add in code to: if valid refrl, if not ip address contact
1361 the helper that resolves tcp names, mount to it, try to
1362 tcon to it unmount it if fail */
1370 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1371 const char *old_path, const struct nls_table *nls_codepage,
1372 unsigned int *pnum_referrals,
1373 unsigned char ** preferrals, int remap)
1378 *pnum_referrals = 0;
1380 if (pSesInfo->ipc_tid == 0) {
1381 temp_unc = kmalloc(2 /* for slashes */ +
1382 strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1383 + 1 + 4 /* slash IPC$ */ + 2,
1385 if (temp_unc == NULL)
1389 strcpy(temp_unc + 2, pSesInfo->serverName);
1390 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1391 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1393 ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1397 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1398 pnum_referrals, nls_codepage, remap);
1403 /* See RFC1001 section 14 on representation of Netbios names */
1404 static void rfc1002mangle(char * target,char * source, unsigned int length)
1408 for(i=0,j=0;i<(length);i++) {
1409 /* mask a nibble at a time and encode */
1410 target[j] = 'A' + (0x0F & (source[i] >> 4));
1411 target[j+1] = 'A' + (0x0F & source[i]);
1419 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1420 char * netbios_name, char * target_name)
1424 __be16 orig_port = 0;
1426 if(*csocket == NULL) {
1427 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1429 cERROR(1, ("Error %d creating socket",rc));
1433 /* BB other socket options to set KEEPALIVE, NODELAY? */
1434 cFYI(1,("Socket created"));
1435 (*csocket)->sk->sk_allocation = GFP_NOFS;
1439 psin_server->sin_family = AF_INET;
1440 if(psin_server->sin_port) { /* user overrode default port */
1441 rc = (*csocket)->ops->connect(*csocket,
1442 (struct sockaddr *) psin_server,
1443 sizeof (struct sockaddr_in),0);
1449 /* save original port so we can retry user specified port
1450 later if fall back ports fail this time */
1451 orig_port = psin_server->sin_port;
1453 /* do not retry on the same port we just failed on */
1454 if(psin_server->sin_port != htons(CIFS_PORT)) {
1455 psin_server->sin_port = htons(CIFS_PORT);
1457 rc = (*csocket)->ops->connect(*csocket,
1458 (struct sockaddr *) psin_server,
1459 sizeof (struct sockaddr_in),0);
1465 psin_server->sin_port = htons(RFC1001_PORT);
1466 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1467 psin_server, sizeof (struct sockaddr_in),0);
1472 /* give up here - unless we want to retry on different
1473 protocol families some day */
1476 psin_server->sin_port = orig_port;
1477 cFYI(1,("Error %d connecting to server via ipv4",rc));
1478 sock_release(*csocket);
1482 /* Eventually check for other socket options to change from
1483 the default. sock_setsockopt not used because it expects
1484 user space buffer */
1485 cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1486 (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1487 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1488 /* make the bufsizes depend on wsize/rsize and max requests */
1489 if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1490 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1491 if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1492 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1494 /* send RFC1001 sessinit */
1495 if(psin_server->sin_port == htons(RFC1001_PORT)) {
1496 /* some servers require RFC1001 sessinit before sending
1497 negprot - BB check reconnection in case where second
1498 sessinit is sent but no second negprot */
1499 struct rfc1002_session_packet * ses_init_buf;
1500 struct smb_hdr * smb_buf;
1501 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1503 ses_init_buf->trailer.session_req.called_len = 32;
1504 if(target_name && (target_name[0] != 0)) {
1505 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1508 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1509 DEFAULT_CIFS_CALLED_NAME,16);
1512 ses_init_buf->trailer.session_req.calling_len = 32;
1513 /* calling name ends in null (byte 16) from old smb
1515 if(netbios_name && (netbios_name[0] !=0)) {
1516 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1519 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1520 "LINUX_CIFS_CLNT",16);
1522 ses_init_buf->trailer.session_req.scope1 = 0;
1523 ses_init_buf->trailer.session_req.scope2 = 0;
1524 smb_buf = (struct smb_hdr *)ses_init_buf;
1525 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1526 smb_buf->smb_buf_length = 0x81000044;
1527 rc = smb_send(*csocket, smb_buf, 0x44,
1528 (struct sockaddr *)psin_server);
1529 kfree(ses_init_buf);
1530 msleep(1); /* RFC1001 layer in at least one server
1531 requires very short break before negprot
1532 presumably because not expecting negprot
1533 to follow so fast. This is a simple
1534 solution that works without
1535 complicating the code and causes no
1536 significant slowing down on mount
1537 for everyone else */
1539 /* else the negprot may still work without this
1540 even though malloc failed */
1548 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1552 __be16 orig_port = 0;
1554 if(*csocket == NULL) {
1555 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1557 cERROR(1, ("Error %d creating ipv6 socket",rc));
1561 /* BB other socket options to set KEEPALIVE, NODELAY? */
1562 cFYI(1,("ipv6 Socket created"));
1563 (*csocket)->sk->sk_allocation = GFP_NOFS;
1567 psin_server->sin6_family = AF_INET6;
1569 if(psin_server->sin6_port) { /* user overrode default port */
1570 rc = (*csocket)->ops->connect(*csocket,
1571 (struct sockaddr *) psin_server,
1572 sizeof (struct sockaddr_in6),0);
1578 /* save original port so we can retry user specified port
1579 later if fall back ports fail this time */
1581 orig_port = psin_server->sin6_port;
1582 /* do not retry on the same port we just failed on */
1583 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1584 psin_server->sin6_port = htons(CIFS_PORT);
1586 rc = (*csocket)->ops->connect(*csocket,
1587 (struct sockaddr *) psin_server,
1588 sizeof (struct sockaddr_in6),0);
1594 psin_server->sin6_port = htons(RFC1001_PORT);
1595 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1596 psin_server, sizeof (struct sockaddr_in6),0);
1601 /* give up here - unless we want to retry on different
1602 protocol families some day */
1605 psin_server->sin6_port = orig_port;
1606 cFYI(1,("Error %d connecting to server via ipv6",rc));
1607 sock_release(*csocket);
1611 /* Eventually check for other socket options to change from
1612 the default. sock_setsockopt not used because it expects
1613 user space buffer */
1614 (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1619 void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1620 struct super_block * sb, struct smb_vol * vol_info)
1622 /* if we are reconnecting then should we check to see if
1623 * any requested capabilities changed locally e.g. via
1624 * remount but we can not do much about it here
1625 * if they have (even if we could detect it by the following)
1626 * Perhaps we could add a backpointer to array of sb from tcon
1627 * or if we change to make all sb to same share the same
1628 * sb as NFS - then we only have one backpointer to sb.
1629 * What if we wanted to mount the server share twice once with
1630 * and once without posixacls or posix paths? */
1631 __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1634 if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1635 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1637 /* check for reconnect case in which we do not
1638 want to change the mount behavior if we can avoid it */
1639 if(vol_info == NULL) {
1640 /* turn off POSIX ACL and PATHNAMES if not set
1641 originally at mount time */
1642 if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1643 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1644 if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1645 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1652 cap &= CIFS_UNIX_CAP_MASK;
1653 if (vol_info && vol_info->no_psx_acl)
1654 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1655 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
1656 cFYI(1,("negotiated posix acl support"));
1658 sb->s_flags |= MS_POSIXACL;
1661 if (vol_info && vol_info->posix_paths == 0)
1662 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1663 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1664 cFYI(1,("negotiate posix pathnames"));
1666 CIFS_SB(sb)->mnt_cifs_flags |=
1667 CIFS_MOUNT_POSIX_PATHS;
1670 /* We might be setting the path sep back to a different
1671 form if we are reconnecting and the server switched its
1672 posix path capability for this share */
1673 if (sb && (CIFS_SB(sb)->prepathlen > 0))
1674 CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1676 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
1677 if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
1678 CIFS_SB(sb)->rsize = 127 * 1024;
1679 #ifdef CONFIG_CIFS_DEBUG2
1680 cFYI(1,("larger reads not supported by srv"));
1686 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1687 #ifdef CONFIG_CIFS_DEBUG2
1688 if (cap & CIFS_UNIX_FCNTL_CAP)
1689 cFYI(1,("FCNTL cap"));
1690 if (cap & CIFS_UNIX_EXTATTR_CAP)
1691 cFYI(1,("EXTATTR cap"));
1692 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1693 cFYI(1,("POSIX path cap"));
1694 if (cap & CIFS_UNIX_XATTR_CAP)
1695 cFYI(1,("XATTR cap"));
1696 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
1697 cFYI(1,("POSIX ACL cap"));
1698 if (cap & CIFS_UNIX_LARGE_READ_CAP)
1699 cFYI(1,("very large read cap"));
1700 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
1701 cFYI(1,("very large write cap"));
1702 #endif /* CIFS_DEBUG2 */
1703 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1704 cFYI(1,("setting capabilities failed"));
1710 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1711 char *mount_data, const char *devname)
1715 int address_type = AF_INET;
1716 struct socket *csocket = NULL;
1717 struct sockaddr_in sin_server;
1718 struct sockaddr_in6 sin_server6;
1719 struct smb_vol volume_info;
1720 struct cifsSesInfo *pSesInfo = NULL;
1721 struct cifsSesInfo *existingCifsSes = NULL;
1722 struct cifsTconInfo *tcon = NULL;
1723 struct TCP_Server_Info *srvTcp = NULL;
1727 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1729 memset(&volume_info,0,sizeof(struct smb_vol));
1730 if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1731 kfree(volume_info.UNC);
1732 kfree(volume_info.password);
1733 kfree(volume_info.prepath);
1738 if (volume_info.nullauth) {
1739 cFYI(1,("null user"));
1740 volume_info.username = NULL;
1741 } else if (volume_info.username) {
1742 /* BB fixme parse for domain name here */
1743 cFYI(1, ("Username: %s ", volume_info.username));
1745 cifserror("No username specified");
1746 /* In userspace mount helper we can get user name from alternate
1747 locations such as env variables and files on disk */
1748 kfree(volume_info.UNC);
1749 kfree(volume_info.password);
1750 kfree(volume_info.prepath);
1755 if (volume_info.UNCip && volume_info.UNC) {
1756 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1759 /* not ipv4 address, try ipv6 */
1760 rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1762 address_type = AF_INET6;
1764 address_type = AF_INET;
1768 /* we failed translating address */
1769 kfree(volume_info.UNC);
1770 kfree(volume_info.password);
1771 kfree(volume_info.prepath);
1776 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1779 } else if (volume_info.UNCip){
1780 /* BB using ip addr as server name connect to the DFS root below */
1781 cERROR(1,("Connecting to DFS root not implemented yet"));
1782 kfree(volume_info.UNC);
1783 kfree(volume_info.password);
1784 kfree(volume_info.prepath);
1787 } else /* which servers DFS root would we conect to */ {
1789 ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1790 kfree(volume_info.UNC);
1791 kfree(volume_info.password);
1792 kfree(volume_info.prepath);
1797 /* this is needed for ASCII cp to Unicode converts */
1798 if(volume_info.iocharset == NULL) {
1799 cifs_sb->local_nls = load_nls_default();
1800 /* load_nls_default can not return null */
1802 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1803 if(cifs_sb->local_nls == NULL) {
1804 cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1805 kfree(volume_info.UNC);
1806 kfree(volume_info.password);
1807 kfree(volume_info.prepath);
1813 if(address_type == AF_INET)
1814 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1815 NULL /* no ipv6 addr */,
1816 volume_info.username, &srvTcp);
1817 else if(address_type == AF_INET6) {
1818 cFYI(1,("looking for ipv6 address"));
1819 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1820 &sin_server6.sin6_addr,
1821 volume_info.username, &srvTcp);
1823 kfree(volume_info.UNC);
1824 kfree(volume_info.password);
1825 kfree(volume_info.prepath);
1832 cFYI(1, ("Existing tcp session with server found"));
1833 } else { /* create socket */
1834 if (volume_info.port)
1835 sin_server.sin_port = htons(volume_info.port);
1837 sin_server.sin_port = 0;
1838 if (address_type == AF_INET6) {
1839 cFYI(1,("attempting ipv6 connect"));
1840 /* BB should we allow ipv6 on port 139? */
1841 /* other OS never observed in Wild doing 139 with v6 */
1842 rc = ipv6_connect(&sin_server6,&csocket);
1844 rc = ipv4_connect(&sin_server,&csocket,
1845 volume_info.source_rfc1001_name,
1846 volume_info.target_rfc1001_name);
1849 ("Error connecting to IPv4 socket. Aborting operation"));
1850 if (csocket != NULL)
1851 sock_release(csocket);
1852 kfree(volume_info.UNC);
1853 kfree(volume_info.password);
1854 kfree(volume_info.prepath);
1859 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1860 if (srvTcp == NULL) {
1862 sock_release(csocket);
1863 kfree(volume_info.UNC);
1864 kfree(volume_info.password);
1865 kfree(volume_info.prepath);
1869 memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1870 memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1871 atomic_set(&srvTcp->inFlight,0);
1872 /* BB Add code for ipv6 case too */
1873 srvTcp->ssocket = csocket;
1874 srvTcp->protocolType = IPV4;
1875 init_waitqueue_head(&srvTcp->response_q);
1876 init_waitqueue_head(&srvTcp->request_q);
1877 INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1878 /* at this point we are the only ones with the pointer
1879 to the struct since the kernel thread not created yet
1880 so no need to spinlock this init of tcpStatus */
1881 srvTcp->tcpStatus = CifsNew;
1882 init_MUTEX(&srvTcp->tcpSem);
1883 srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1884 if ( IS_ERR(srvTcp->tsk) ) {
1885 rc = PTR_ERR(srvTcp->tsk);
1886 cERROR(1,("error %d create cifsd thread", rc));
1888 sock_release(csocket);
1889 kfree(volume_info.UNC);
1890 kfree(volume_info.password);
1891 kfree(volume_info.prepath);
1895 wait_for_completion(&cifsd_complete);
1897 memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1898 memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1899 srvTcp->sequence_number = 0;
1903 if (existingCifsSes) {
1904 pSesInfo = existingCifsSes;
1905 cFYI(1, ("Existing smb sess found"));
1906 kfree(volume_info.password);
1907 /* volume_info.UNC freed at end of function */
1909 cFYI(1, ("Existing smb sess not found"));
1910 pSesInfo = sesInfoAlloc();
1911 if (pSesInfo == NULL)
1914 pSesInfo->server = srvTcp;
1915 sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1916 NIPQUAD(sin_server.sin_addr.s_addr));
1920 /* volume_info.password freed at unmount */
1921 if (volume_info.password)
1922 pSesInfo->password = volume_info.password;
1923 if (volume_info.username)
1924 strncpy(pSesInfo->userName,
1925 volume_info.username,MAX_USERNAME_SIZE);
1926 if (volume_info.domainname) {
1927 int len = strlen(volume_info.domainname);
1928 pSesInfo->domainName =
1929 kmalloc(len + 1, GFP_KERNEL);
1930 if (pSesInfo->domainName)
1931 strcpy(pSesInfo->domainName,
1932 volume_info.domainname);
1934 pSesInfo->linux_uid = volume_info.linux_uid;
1935 pSesInfo->overrideSecFlg = volume_info.secFlg;
1936 down(&pSesInfo->sesSem);
1937 /* BB FIXME need to pass vol->secFlgs BB */
1938 rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1939 up(&pSesInfo->sesSem);
1941 atomic_inc(&srvTcp->socketUseCount);
1943 kfree(volume_info.password);
1946 /* search for existing tcon to this server share */
1948 if (volume_info.rsize > CIFSMaxBufSize) {
1949 cERROR(1,("rsize %d too large, using MaxBufSize",
1950 volume_info.rsize));
1951 cifs_sb->rsize = CIFSMaxBufSize;
1952 } else if ((volume_info.rsize) &&
1953 (volume_info.rsize <= CIFSMaxBufSize))
1954 cifs_sb->rsize = volume_info.rsize;
1956 cifs_sb->rsize = CIFSMaxBufSize;
1958 if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1959 cERROR(1,("wsize %d too large, using 4096 instead",
1960 volume_info.wsize));
1961 cifs_sb->wsize = 4096;
1962 } else if (volume_info.wsize)
1963 cifs_sb->wsize = volume_info.wsize;
1966 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1968 /* old default of CIFSMaxBufSize was too small now
1969 that SMB Write2 can send multiple pages in kvec.
1970 RFC1001 does not describe what happens when frame
1971 bigger than 128K is sent so use that as max in
1972 conjunction with 52K kvec constraint on arch with 4K
1975 if (cifs_sb->rsize < 2048) {
1976 cifs_sb->rsize = 2048;
1977 /* Windows ME may prefer this */
1978 cFYI(1,("readsize set to minimum: 2048"));
1980 /* calculate prepath */
1981 cifs_sb->prepath = volume_info.prepath;
1982 if (cifs_sb->prepath) {
1983 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1984 cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1985 volume_info.prepath = NULL;
1987 cifs_sb->prepathlen = 0;
1988 cifs_sb->mnt_uid = volume_info.linux_uid;
1989 cifs_sb->mnt_gid = volume_info.linux_gid;
1990 cifs_sb->mnt_file_mode = volume_info.file_mode;
1991 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1992 cFYI(1,("file mode: 0x%x dir mode: 0x%x",
1993 cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1995 if (volume_info.noperm)
1996 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1997 if (volume_info.setuids)
1998 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1999 if (volume_info.server_ino)
2000 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2001 if (volume_info.remap)
2002 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2003 if (volume_info.no_xattr)
2004 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2005 if (volume_info.sfu_emul)
2006 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2007 if (volume_info.nobrl)
2008 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2009 if (volume_info.cifs_acl)
2010 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2011 if (volume_info.override_uid)
2012 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2013 if (volume_info.override_gid)
2014 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2015 if (volume_info.direct_io) {
2016 cFYI(1,("mounting share using direct i/o"));
2017 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2021 find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
2022 volume_info.username);
2024 cFYI(1, ("Found match on UNC path"));
2025 /* we can have only one retry value for a connection
2026 to a share so for resources mounted more than once
2027 to the same server share the last value passed in
2028 for the retry flag is used */
2029 tcon->retry = volume_info.retry;
2030 tcon->nocase = volume_info.nocase;
2032 tcon = tconInfoAlloc();
2036 /* check for null share name ie connecting to
2039 /* BB check if this works for exactly length
2041 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2042 && (strchr(volume_info.UNC + 3, '/') ==
2044 rc = connect_to_dfs_path(xid, pSesInfo,
2045 "", cifs_sb->local_nls,
2046 cifs_sb->mnt_cifs_flags &
2047 CIFS_MOUNT_MAP_SPECIAL_CHR);
2048 kfree(volume_info.UNC);
2052 /* BB Do we need to wrap sesSem around
2053 * this TCon call and Unix SetFS as
2054 * we do on SessSetup and reconnect? */
2055 rc = CIFSTCon(xid, pSesInfo,
2057 tcon, cifs_sb->local_nls);
2058 cFYI(1, ("CIFS Tcon rc = %d", rc));
2061 atomic_inc(&pSesInfo->inUse);
2062 tcon->retry = volume_info.retry;
2063 tcon->nocase = volume_info.nocase;
2069 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2070 sb->s_maxbytes = (u64) 1 << 63;
2072 sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2075 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2076 sb->s_time_gran = 100;
2078 /* on error free sesinfo and tcon struct if needed */
2080 /* if session setup failed, use count is zero but
2081 we still need to free cifsd thread */
2082 if (atomic_read(&srvTcp->socketUseCount) == 0) {
2083 spin_lock(&GlobalMid_Lock);
2084 srvTcp->tcpStatus = CifsExiting;
2085 spin_unlock(&GlobalMid_Lock);
2087 struct task_struct *tsk;
2088 /* If we could verify that kthread_stop would
2089 always wake up processes blocked in
2090 tcp in recv_mesg then we could remove the
2092 send_sig(SIGKILL,srvTcp->tsk,1);
2098 /* If find_unc succeeded then rc == 0 so we can not end */
2099 if (tcon) /* up accidently freeing someone elses tcon struct */
2101 if (existingCifsSes == NULL) {
2103 if ((pSesInfo->server) &&
2104 (pSesInfo->status == CifsGood)) {
2106 temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2107 /* if the socketUseCount is now zero */
2108 if ((temp_rc == -ESHUTDOWN) &&
2109 (pSesInfo->server) && (pSesInfo->server->tsk)) {
2110 struct task_struct *tsk;
2111 send_sig(SIGKILL,pSesInfo->server->tsk,1);
2112 tsk = pSesInfo->server->tsk;
2117 cFYI(1, ("No session or bad tcon"));
2118 sesInfoFree(pSesInfo);
2119 /* pSesInfo = NULL; */
2123 atomic_inc(&tcon->useCount);
2124 cifs_sb->tcon = tcon;
2125 tcon->ses = pSesInfo;
2127 /* do not care if following two calls succeed - informational */
2128 CIFSSMBQFSDeviceInfo(xid, tcon);
2129 CIFSSMBQFSAttributeInfo(xid, tcon);
2131 /* tell server which Unix caps we support */
2132 if (tcon->ses->capabilities & CAP_UNIX)
2133 reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2134 else if(cifs_sb->rsize > (1024 * 127)) {
2135 cifs_sb->rsize = 1024 * 127;
2136 #ifdef CONFIG_CIFS_DEBUG2
2137 cFYI(1,("no very large read support, rsize 127K"));
2141 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2142 cifs_sb->wsize = min(cifs_sb->wsize,
2143 (tcon->ses->server->maxBuf -
2144 MAX_CIFS_HDR_SIZE));
2145 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2146 cifs_sb->rsize = min(cifs_sb->rsize,
2147 (tcon->ses->server->maxBuf -
2148 MAX_CIFS_HDR_SIZE));
2151 /* volume_info.password is freed above when existing session found
2152 (in which case it is not needed anymore) but when new sesion is created
2153 the password ptr is put in the new session structure (in which case the
2154 password will be freed at unmount time) */
2155 kfree(volume_info.UNC);
2156 kfree(volume_info.prepath);
2162 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2163 char session_key[CIFS_SESS_KEY_SIZE],
2164 const struct nls_table *nls_codepage)
2166 struct smb_hdr *smb_buffer;
2167 struct smb_hdr *smb_buffer_response;
2168 SESSION_SETUP_ANDX *pSMB;
2169 SESSION_SETUP_ANDX *pSMBr;
2174 int remaining_words = 0;
2175 int bytes_returned = 0;
2180 cFYI(1, ("In sesssetup"));
2183 user = ses->userName;
2184 domain = ses->domainName;
2185 smb_buffer = cifs_buf_get();
2186 if (smb_buffer == NULL) {
2189 smb_buffer_response = smb_buffer;
2190 pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2192 /* send SMBsessionSetup here */
2193 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2194 NULL /* no tCon exists yet */ , 13 /* wct */ );
2196 smb_buffer->Mid = GetNextMid(ses->server);
2197 pSMB->req_no_secext.AndXCommand = 0xFF;
2198 pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2199 pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2201 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2202 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2204 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2205 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2206 if (ses->capabilities & CAP_UNICODE) {
2207 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2208 capabilities |= CAP_UNICODE;
2210 if (ses->capabilities & CAP_STATUS32) {
2211 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2212 capabilities |= CAP_STATUS32;
2214 if (ses->capabilities & CAP_DFS) {
2215 smb_buffer->Flags2 |= SMBFLG2_DFS;
2216 capabilities |= CAP_DFS;
2218 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2220 pSMB->req_no_secext.CaseInsensitivePasswordLength =
2221 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2223 pSMB->req_no_secext.CaseSensitivePasswordLength =
2224 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2225 bcc_ptr = pByteArea(smb_buffer);
2226 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2227 bcc_ptr += CIFS_SESS_KEY_SIZE;
2228 memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2229 bcc_ptr += CIFS_SESS_KEY_SIZE;
2231 if (ses->capabilities & CAP_UNICODE) {
2232 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2237 bytes_returned = 0; /* skip null user */
2240 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2242 /* convert number of 16 bit words to bytes */
2243 bcc_ptr += 2 * bytes_returned;
2244 bcc_ptr += 2; /* trailing null */
2247 cifs_strtoUCS((__le16 *) bcc_ptr,
2248 "CIFS_LINUX_DOM", 32, nls_codepage);
2251 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2253 bcc_ptr += 2 * bytes_returned;
2256 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2258 bcc_ptr += 2 * bytes_returned;
2260 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2262 bcc_ptr += 2 * bytes_returned;
2265 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2267 bcc_ptr += 2 * bytes_returned;
2271 strncpy(bcc_ptr, user, 200);
2272 bcc_ptr += strnlen(user, 200);
2276 if (domain == NULL) {
2277 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2278 bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2280 strncpy(bcc_ptr, domain, 64);
2281 bcc_ptr += strnlen(domain, 64);
2285 strcpy(bcc_ptr, "Linux version ");
2286 bcc_ptr += strlen("Linux version ");
2287 strcpy(bcc_ptr, utsname()->release);
2288 bcc_ptr += strlen(utsname()->release) + 1;
2289 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2290 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2292 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2293 smb_buffer->smb_buf_length += count;
2294 pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2296 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2297 &bytes_returned, 1);
2299 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2300 } else if ((smb_buffer_response->WordCount == 3)
2301 || (smb_buffer_response->WordCount == 4)) {
2302 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2303 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2304 if (action & GUEST_LOGIN)
2305 cFYI(1, (" Guest login")); /* do we want to mark SesInfo struct ? */
2306 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format (le) */
2307 cFYI(1, ("UID = %d ", ses->Suid));
2308 /* response can have either 3 or 4 word count - Samba sends 3 */
2309 bcc_ptr = pByteArea(smb_buffer_response);
2310 if ((pSMBr->resp.hdr.WordCount == 3)
2311 || ((pSMBr->resp.hdr.WordCount == 4)
2312 && (blob_len < pSMBr->resp.ByteCount))) {
2313 if (pSMBr->resp.hdr.WordCount == 4)
2314 bcc_ptr += blob_len;
2316 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2317 if ((long) (bcc_ptr) % 2) {
2319 (BCC(smb_buffer_response) - 1) /2;
2320 bcc_ptr++; /* Unicode strings must be word aligned */
2323 BCC(smb_buffer_response) / 2;
2326 UniStrnlen((wchar_t *) bcc_ptr,
2327 remaining_words - 1);
2328 /* We look for obvious messed up bcc or strings in response so we do not go off
2329 the end since (at least) WIN2K and Windows XP have a major bug in not null
2330 terminating last Unicode string in response */
2332 kfree(ses->serverOS);
2333 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2334 if(ses->serverOS == NULL)
2335 goto sesssetup_nomem;
2336 cifs_strfromUCS_le(ses->serverOS,
2337 (__le16 *)bcc_ptr, len,nls_codepage);
2338 bcc_ptr += 2 * (len + 1);
2339 remaining_words -= len + 1;
2340 ses->serverOS[2 * len] = 0;
2341 ses->serverOS[1 + (2 * len)] = 0;
2342 if (remaining_words > 0) {
2343 len = UniStrnlen((wchar_t *)bcc_ptr,
2345 kfree(ses->serverNOS);
2346 ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2347 if(ses->serverNOS == NULL)
2348 goto sesssetup_nomem;
2349 cifs_strfromUCS_le(ses->serverNOS,
2350 (__le16 *)bcc_ptr,len,nls_codepage);
2351 bcc_ptr += 2 * (len + 1);
2352 ses->serverNOS[2 * len] = 0;
2353 ses->serverNOS[1 + (2 * len)] = 0;
2354 if(strncmp(ses->serverNOS,
2355 "NT LAN Manager 4",16) == 0) {
2356 cFYI(1,("NT4 server"));
2357 ses->flags |= CIFS_SES_NT4;
2359 remaining_words -= len + 1;
2360 if (remaining_words > 0) {
2361 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2362 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2363 if(ses->serverDomain)
2364 kfree(ses->serverDomain);
2366 kzalloc(2*(len+1),GFP_KERNEL);
2367 if(ses->serverDomain == NULL)
2368 goto sesssetup_nomem;
2369 cifs_strfromUCS_le(ses->serverDomain,
2370 (__le16 *)bcc_ptr,len,nls_codepage);
2371 bcc_ptr += 2 * (len + 1);
2372 ses->serverDomain[2*len] = 0;
2373 ses->serverDomain[1+(2*len)] = 0;
2374 } /* else no more room so create dummy domain string */
2376 if(ses->serverDomain)
2377 kfree(ses->serverDomain);
2379 kzalloc(2, GFP_KERNEL);
2381 } else { /* no room so create dummy domain and NOS string */
2382 /* if these kcallocs fail not much we
2383 can do, but better to not fail the
2385 kfree(ses->serverDomain);
2387 kzalloc(2, GFP_KERNEL);
2388 kfree(ses->serverNOS);
2390 kzalloc(2, GFP_KERNEL);
2392 } else { /* ASCII */
2393 len = strnlen(bcc_ptr, 1024);
2394 if (((long) bcc_ptr + len) - (long)
2395 pByteArea(smb_buffer_response)
2396 <= BCC(smb_buffer_response)) {
2397 kfree(ses->serverOS);
2398 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2399 if(ses->serverOS == NULL)
2400 goto sesssetup_nomem;
2401 strncpy(ses->serverOS,bcc_ptr, len);
2404 bcc_ptr[0] = 0; /* null terminate the string */
2407 len = strnlen(bcc_ptr, 1024);
2408 kfree(ses->serverNOS);
2409 ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2410 if(ses->serverNOS == NULL)
2411 goto sesssetup_nomem;
2412 strncpy(ses->serverNOS, bcc_ptr, len);
2417 len = strnlen(bcc_ptr, 1024);
2418 if(ses->serverDomain)
2419 kfree(ses->serverDomain);
2420 ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2421 if(ses->serverDomain == NULL)
2422 goto sesssetup_nomem;
2423 strncpy(ses->serverDomain, bcc_ptr, len);
2429 ("Variable field of length %d extends beyond end of smb ",
2434 (" Security Blob Length extends beyond end of SMB"));
2438 (" Invalid Word count %d: ",
2439 smb_buffer_response->WordCount));
2442 sesssetup_nomem: /* do not return an error on nomem for the info strings,
2443 since that could make reconnection harder, and
2444 reconnection might be needed to free memory */
2446 cifs_buf_release(smb_buffer);
2452 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2453 struct cifsSesInfo *ses, int * pNTLMv2_flag,
2454 const struct nls_table *nls_codepage)
2456 struct smb_hdr *smb_buffer;
2457 struct smb_hdr *smb_buffer_response;
2458 SESSION_SETUP_ANDX *pSMB;
2459 SESSION_SETUP_ANDX *pSMBr;
2463 int remaining_words = 0;
2464 int bytes_returned = 0;
2466 int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2467 PNEGOTIATE_MESSAGE SecurityBlob;
2468 PCHALLENGE_MESSAGE SecurityBlob2;
2469 __u32 negotiate_flags, capabilities;
2472 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2475 domain = ses->domainName;
2476 *pNTLMv2_flag = FALSE;
2477 smb_buffer = cifs_buf_get();
2478 if (smb_buffer == NULL) {
2481 smb_buffer_response = smb_buffer;
2482 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2483 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2485 /* send SMBsessionSetup here */
2486 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2487 NULL /* no tCon exists yet */ , 12 /* wct */ );
2489 smb_buffer->Mid = GetNextMid(ses->server);
2490 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2491 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2493 pSMB->req.AndXCommand = 0xFF;
2494 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2495 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2497 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2498 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2500 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2501 CAP_EXTENDED_SECURITY;
2502 if (ses->capabilities & CAP_UNICODE) {
2503 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2504 capabilities |= CAP_UNICODE;
2506 if (ses->capabilities & CAP_STATUS32) {
2507 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2508 capabilities |= CAP_STATUS32;
2510 if (ses->capabilities & CAP_DFS) {
2511 smb_buffer->Flags2 |= SMBFLG2_DFS;
2512 capabilities |= CAP_DFS;
2514 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2516 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2517 SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2518 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2519 SecurityBlob->MessageType = NtLmNegotiate;
2521 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2522 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2523 NTLMSSP_NEGOTIATE_56 |
2524 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2526 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2527 /* if(ntlmv2_support)
2528 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2529 /* setup pointers to domain name and workstation name */
2530 bcc_ptr += SecurityBlobLength;
2532 SecurityBlob->WorkstationName.Buffer = 0;
2533 SecurityBlob->WorkstationName.Length = 0;
2534 SecurityBlob->WorkstationName.MaximumLength = 0;
2536 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2537 along with username on auth request (ie the response to challenge) */
2538 SecurityBlob->DomainName.Buffer = 0;
2539 SecurityBlob->DomainName.Length = 0;
2540 SecurityBlob->DomainName.MaximumLength = 0;
2541 if (ses->capabilities & CAP_UNICODE) {
2542 if ((long) bcc_ptr % 2) {
2548 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2550 bcc_ptr += 2 * bytes_returned;
2552 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2554 bcc_ptr += 2 * bytes_returned;
2555 bcc_ptr += 2; /* null terminate Linux version */
2557 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2559 bcc_ptr += 2 * bytes_returned;
2562 bcc_ptr += 2; /* null terminate network opsys string */
2565 bcc_ptr += 2; /* null domain */
2566 } else { /* ASCII */
2567 strcpy(bcc_ptr, "Linux version ");
2568 bcc_ptr += strlen("Linux version ");
2569 strcpy(bcc_ptr, utsname()->release);
2570 bcc_ptr += strlen(utsname()->release) + 1;
2571 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2572 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2573 bcc_ptr++; /* empty domain field */
2576 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2577 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2578 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2579 smb_buffer->smb_buf_length += count;
2580 pSMB->req.ByteCount = cpu_to_le16(count);
2582 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2583 &bytes_returned, 1);
2585 if (smb_buffer_response->Status.CifsError ==
2586 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2590 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2591 } else if ((smb_buffer_response->WordCount == 3)
2592 || (smb_buffer_response->WordCount == 4)) {
2593 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2594 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2596 if (action & GUEST_LOGIN)
2597 cFYI(1, (" Guest login"));
2598 /* Do we want to set anything in SesInfo struct when guest login? */
2600 bcc_ptr = pByteArea(smb_buffer_response);
2601 /* response can have either 3 or 4 word count - Samba sends 3 */
2603 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2604 if (SecurityBlob2->MessageType != NtLmChallenge) {
2606 ("Unexpected NTLMSSP message type received %d",
2607 SecurityBlob2->MessageType));
2609 ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2610 cFYI(1, ("UID = %d", ses->Suid));
2611 if ((pSMBr->resp.hdr.WordCount == 3)
2612 || ((pSMBr->resp.hdr.WordCount == 4)
2614 pSMBr->resp.ByteCount))) {
2616 if (pSMBr->resp.hdr.WordCount == 4) {
2617 bcc_ptr += blob_len;
2618 cFYI(1, ("Security Blob Length %d",
2622 cFYI(1, ("NTLMSSP Challenge rcvd"));
2624 memcpy(ses->server->cryptKey,
2625 SecurityBlob2->Challenge,
2626 CIFS_CRYPTO_KEY_SIZE);
2627 if(SecurityBlob2->NegotiateFlags &
2628 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2629 *pNTLMv2_flag = TRUE;
2631 if((SecurityBlob2->NegotiateFlags &
2632 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2633 || (sign_CIFS_PDUs > 1))
2634 ses->server->secMode |=
2635 SECMODE_SIGN_REQUIRED;
2636 if ((SecurityBlob2->NegotiateFlags &
2637 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2638 ses->server->secMode |=
2639 SECMODE_SIGN_ENABLED;
2641 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2642 if ((long) (bcc_ptr) % 2) {
2644 (BCC(smb_buffer_response)
2646 bcc_ptr++; /* Unicode strings must be word aligned */
2650 (smb_buffer_response) / 2;
2653 UniStrnlen((wchar_t *) bcc_ptr,
2654 remaining_words - 1);
2655 /* We look for obvious messed up bcc or strings in response so we do not go off
2656 the end since (at least) WIN2K and Windows XP have a major bug in not null
2657 terminating last Unicode string in response */
2659 kfree(ses->serverOS);
2661 kzalloc(2 * (len + 1), GFP_KERNEL);
2662 cifs_strfromUCS_le(ses->serverOS,
2666 bcc_ptr += 2 * (len + 1);
2667 remaining_words -= len + 1;
2668 ses->serverOS[2 * len] = 0;
2669 ses->serverOS[1 + (2 * len)] = 0;
2670 if (remaining_words > 0) {
2671 len = UniStrnlen((wchar_t *)
2675 kfree(ses->serverNOS);
2677 kzalloc(2 * (len + 1),
2679 cifs_strfromUCS_le(ses->
2685 bcc_ptr += 2 * (len + 1);
2686 ses->serverNOS[2 * len] = 0;
2689 remaining_words -= len + 1;
2690 if (remaining_words > 0) {
2691 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2692 /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2693 kfree(ses->serverDomain);
2705 ses->serverDomain[2*len]
2710 } /* else no more room so create dummy domain string */
2712 kfree(ses->serverDomain);
2717 } else { /* no room so create dummy domain and NOS string */
2718 kfree(ses->serverDomain);
2720 kzalloc(2, GFP_KERNEL);
2721 kfree(ses->serverNOS);
2723 kzalloc(2, GFP_KERNEL);
2725 } else { /* ASCII */
2726 len = strnlen(bcc_ptr, 1024);
2727 if (((long) bcc_ptr + len) - (long)
2728 pByteArea(smb_buffer_response)
2729 <= BCC(smb_buffer_response)) {
2731 kfree(ses->serverOS);
2735 strncpy(ses->serverOS,
2739 bcc_ptr[0] = 0; /* null terminate string */
2742 len = strnlen(bcc_ptr, 1024);
2743 kfree(ses->serverNOS);
2747 strncpy(ses->serverNOS, bcc_ptr, len);
2752 len = strnlen(bcc_ptr, 1024);
2753 kfree(ses->serverDomain);
2757 strncpy(ses->serverDomain, bcc_ptr, len);
2763 ("Variable field of length %d extends beyond end of smb",
2768 (" Security Blob Length extends beyond end of SMB"));
2771 cERROR(1, ("No session structure passed in."));
2775 (" Invalid Word count %d:",
2776 smb_buffer_response->WordCount));
2781 cifs_buf_release(smb_buffer);
2786 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2787 char *ntlm_session_key, int ntlmv2_flag,
2788 const struct nls_table *nls_codepage)
2790 struct smb_hdr *smb_buffer;
2791 struct smb_hdr *smb_buffer_response;
2792 SESSION_SETUP_ANDX *pSMB;
2793 SESSION_SETUP_ANDX *pSMBr;
2798 int remaining_words = 0;
2799 int bytes_returned = 0;
2801 int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2802 PAUTHENTICATE_MESSAGE SecurityBlob;
2803 __u32 negotiate_flags, capabilities;
2806 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2809 user = ses->userName;
2810 domain = ses->domainName;
2811 smb_buffer = cifs_buf_get();
2812 if (smb_buffer == NULL) {
2815 smb_buffer_response = smb_buffer;
2816 pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2817 pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2819 /* send SMBsessionSetup here */
2820 header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2821 NULL /* no tCon exists yet */ , 12 /* wct */ );
2823 smb_buffer->Mid = GetNextMid(ses->server);
2824 pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2825 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2826 pSMB->req.AndXCommand = 0xFF;
2827 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2828 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2830 pSMB->req.hdr.Uid = ses->Suid;
2832 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2833 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2835 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2836 CAP_EXTENDED_SECURITY;
2837 if (ses->capabilities & CAP_UNICODE) {
2838 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2839 capabilities |= CAP_UNICODE;
2841 if (ses->capabilities & CAP_STATUS32) {
2842 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2843 capabilities |= CAP_STATUS32;
2845 if (ses->capabilities & CAP_DFS) {
2846 smb_buffer->Flags2 |= SMBFLG2_DFS;
2847 capabilities |= CAP_DFS;
2849 pSMB->req.Capabilities = cpu_to_le32(capabilities);
2851 bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2852 SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2853 strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2854 SecurityBlob->MessageType = NtLmAuthenticate;
2855 bcc_ptr += SecurityBlobLength;
2857 NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2858 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2859 0x80000000 | NTLMSSP_NEGOTIATE_128;
2861 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2863 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2865 /* setup pointers to domain name and workstation name */
2867 SecurityBlob->WorkstationName.Buffer = 0;
2868 SecurityBlob->WorkstationName.Length = 0;
2869 SecurityBlob->WorkstationName.MaximumLength = 0;
2870 SecurityBlob->SessionKey.Length = 0;
2871 SecurityBlob->SessionKey.MaximumLength = 0;
2872 SecurityBlob->SessionKey.Buffer = 0;
2874 SecurityBlob->LmChallengeResponse.Length = 0;
2875 SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2876 SecurityBlob->LmChallengeResponse.Buffer = 0;
2878 SecurityBlob->NtChallengeResponse.Length =
2879 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2880 SecurityBlob->NtChallengeResponse.MaximumLength =
2881 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2882 memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2883 SecurityBlob->NtChallengeResponse.Buffer =
2884 cpu_to_le32(SecurityBlobLength);
2885 SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2886 bcc_ptr += CIFS_SESS_KEY_SIZE;
2888 if (ses->capabilities & CAP_UNICODE) {
2889 if (domain == NULL) {
2890 SecurityBlob->DomainName.Buffer = 0;
2891 SecurityBlob->DomainName.Length = 0;
2892 SecurityBlob->DomainName.MaximumLength = 0;
2895 cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2898 SecurityBlob->DomainName.MaximumLength =
2900 SecurityBlob->DomainName.Buffer =
2901 cpu_to_le32(SecurityBlobLength);
2903 SecurityBlobLength += len;
2904 SecurityBlob->DomainName.Length =
2908 SecurityBlob->UserName.Buffer = 0;
2909 SecurityBlob->UserName.Length = 0;
2910 SecurityBlob->UserName.MaximumLength = 0;
2913 cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2916 SecurityBlob->UserName.MaximumLength =
2918 SecurityBlob->UserName.Buffer =
2919 cpu_to_le32(SecurityBlobLength);
2921 SecurityBlobLength += len;
2922 SecurityBlob->UserName.Length =
2926 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2927 SecurityBlob->WorkstationName.Length *= 2;
2928 SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2929 SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2930 bcc_ptr += SecurityBlob->WorkstationName.Length;
2931 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2932 SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length); */
2934 if ((long) bcc_ptr % 2) {
2939 cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2941 bcc_ptr += 2 * bytes_returned;
2943 cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2945 bcc_ptr += 2 * bytes_returned;
2946 bcc_ptr += 2; /* null term version string */
2948 cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2950 bcc_ptr += 2 * bytes_returned;
2953 bcc_ptr += 2; /* null terminate network opsys string */
2956 bcc_ptr += 2; /* null domain */
2957 } else { /* ASCII */
2958 if (domain == NULL) {
2959 SecurityBlob->DomainName.Buffer = 0;
2960 SecurityBlob->DomainName.Length = 0;
2961 SecurityBlob->DomainName.MaximumLength = 0;
2964 negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2965 strncpy(bcc_ptr, domain, 63);
2966 len = strnlen(domain, 64);
2967 SecurityBlob->DomainName.MaximumLength =
2969 SecurityBlob->DomainName.Buffer =
2970 cpu_to_le32(SecurityBlobLength);
2972 SecurityBlobLength += len;
2973 SecurityBlob->DomainName.Length = cpu_to_le16(len);
2976 SecurityBlob->UserName.Buffer = 0;
2977 SecurityBlob->UserName.Length = 0;
2978 SecurityBlob->UserName.MaximumLength = 0;
2981 strncpy(bcc_ptr, user, 63);
2982 len = strnlen(user, 64);
2983 SecurityBlob->UserName.MaximumLength =
2985 SecurityBlob->UserName.Buffer =
2986 cpu_to_le32(SecurityBlobLength);
2988 SecurityBlobLength += len;
2989 SecurityBlob->UserName.Length = cpu_to_le16(len);
2991 /* BB fill in our workstation name if known BB */
2993 strcpy(bcc_ptr, "Linux version ");
2994 bcc_ptr += strlen("Linux version ");
2995 strcpy(bcc_ptr, utsname()->release);
2996 bcc_ptr += strlen(utsname()->release) + 1;
2997 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2998 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2999 bcc_ptr++; /* null domain */
3002 SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
3003 pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
3004 count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
3005 smb_buffer->smb_buf_length += count;
3006 pSMB->req.ByteCount = cpu_to_le16(count);
3008 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3009 &bytes_returned, 1);
3011 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
3012 } else if ((smb_buffer_response->WordCount == 3)
3013 || (smb_buffer_response->WordCount == 4)) {
3014 __u16 action = le16_to_cpu(pSMBr->resp.Action);
3016 le16_to_cpu(pSMBr->resp.SecurityBlobLength);
3017 if (action & GUEST_LOGIN)
3018 cFYI(1, (" Guest login")); /* BB do we want to set anything in SesInfo struct ? */
3019 /* if(SecurityBlob2->MessageType != NtLm??){
3020 cFYI("Unexpected message type on auth response is %d "));
3024 ("Does UID on challenge %d match auth response UID %d ",
3025 ses->Suid, smb_buffer_response->Uid));
3026 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
3027 bcc_ptr = pByteArea(smb_buffer_response);
3028 /* response can have either 3 or 4 word count - Samba sends 3 */
3029 if ((pSMBr->resp.hdr.WordCount == 3)
3030 || ((pSMBr->resp.hdr.WordCount == 4)
3032 pSMBr->resp.ByteCount))) {
3033 if (pSMBr->resp.hdr.WordCount == 4) {
3037 ("Security Blob Length %d ",
3042 ("NTLMSSP response to Authenticate "));
3044 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3045 if ((long) (bcc_ptr) % 2) {
3047 (BCC(smb_buffer_response)
3049 bcc_ptr++; /* Unicode strings must be word aligned */
3051 remaining_words = BCC(smb_buffer_response) / 2;
3054 UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3055 /* We look for obvious messed up bcc or strings in response so we do not go off
3056 the end since (at least) WIN2K and Windows XP have a major bug in not null
3057 terminating last Unicode string in response */
3059 kfree(ses->serverOS);
3061 kzalloc(2 * (len + 1), GFP_KERNEL);
3062 cifs_strfromUCS_le(ses->serverOS,
3066 bcc_ptr += 2 * (len + 1);
3067 remaining_words -= len + 1;
3068 ses->serverOS[2 * len] = 0;
3069 ses->serverOS[1 + (2 * len)] = 0;
3070 if (remaining_words > 0) {
3071 len = UniStrnlen((wchar_t *)
3075 kfree(ses->serverNOS);
3077 kzalloc(2 * (len + 1),
3079 cifs_strfromUCS_le(ses->
3085 bcc_ptr += 2 * (len + 1);
3086 ses->serverNOS[2 * len] = 0;
3087 ses->serverNOS[1+(2*len)] = 0;
3088 remaining_words -= len + 1;
3089 if (remaining_words > 0) {
3090 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3091 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3092 if(ses->serverDomain)
3093 kfree(ses->serverDomain);
3118 } /* else no more room so create dummy domain string */
3120 if(ses->serverDomain)
3121 kfree(ses->serverDomain);
3122 ses->serverDomain = kzalloc(2,GFP_KERNEL);
3124 } else { /* no room so create dummy domain and NOS string */
3125 if(ses->serverDomain)
3126 kfree(ses->serverDomain);
3127 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3128 kfree(ses->serverNOS);
3129 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3131 } else { /* ASCII */
3132 len = strnlen(bcc_ptr, 1024);
3133 if (((long) bcc_ptr + len) -
3134 (long) pByteArea(smb_buffer_response)
3135 <= BCC(smb_buffer_response)) {
3137 kfree(ses->serverOS);
3138 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3139 strncpy(ses->serverOS,bcc_ptr, len);
3142 bcc_ptr[0] = 0; /* null terminate the string */
3145 len = strnlen(bcc_ptr, 1024);
3146 kfree(ses->serverNOS);
3147 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3148 strncpy(ses->serverNOS, bcc_ptr, len);
3153 len = strnlen(bcc_ptr, 1024);
3154 if(ses->serverDomain)
3155 kfree(ses->serverDomain);
3156 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3157 strncpy(ses->serverDomain, bcc_ptr, len);
3163 ("Variable field of length %d extends beyond end of smb ",
3168 (" Security Blob Length extends beyond end of SMB"));
3171 cERROR(1, ("No session structure passed in."));
3175 (" Invalid Word count %d: ",
3176 smb_buffer_response->WordCount));
3181 cifs_buf_release(smb_buffer);
3187 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3188 const char *tree, struct cifsTconInfo *tcon,
3189 const struct nls_table *nls_codepage)
3191 struct smb_hdr *smb_buffer;
3192 struct smb_hdr *smb_buffer_response;
3195 unsigned char *bcc_ptr;
3203 smb_buffer = cifs_buf_get();
3204 if (smb_buffer == NULL) {
3207 smb_buffer_response = smb_buffer;
3209 header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3210 NULL /*no tid */ , 4 /*wct */ );
3212 smb_buffer->Mid = GetNextMid(ses->server);
3213 smb_buffer->Uid = ses->Suid;
3214 pSMB = (TCONX_REQ *) smb_buffer;
3215 pSMBr = (TCONX_RSP *) smb_buffer_response;
3217 pSMB->AndXCommand = 0xFF;
3218 pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3219 bcc_ptr = &pSMB->Password[0];
3220 if((ses->server->secMode) & SECMODE_USER) {
3221 pSMB->PasswordLength = cpu_to_le16(1); /* minimum */
3222 *bcc_ptr = 0; /* password is null byte */
3223 bcc_ptr++; /* skip password */
3224 /* already aligned so no need to do it below */
3226 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3227 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3228 specified as required (when that support is added to
3229 the vfs in the future) as only NTLM or the much
3230 weaker LANMAN (which we do not send by default) is accepted
3231 by Samba (not sure whether other servers allow
3232 NTLMv2 password here) */
3233 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3234 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3235 (ses->server->secType == LANMAN))
3236 calc_lanman_hash(ses, bcc_ptr);
3238 #endif /* CIFS_WEAK_PW_HASH */
3239 SMBNTencrypt(ses->password,
3240 ses->server->cryptKey,
3243 bcc_ptr += CIFS_SESS_KEY_SIZE;
3244 if(ses->capabilities & CAP_UNICODE) {
3245 /* must align unicode strings */
3246 *bcc_ptr = 0; /* null byte password */
3251 if(ses->server->secMode &
3252 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3253 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3255 if (ses->capabilities & CAP_STATUS32) {
3256 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3258 if (ses->capabilities & CAP_DFS) {
3259 smb_buffer->Flags2 |= SMBFLG2_DFS;
3261 if (ses->capabilities & CAP_UNICODE) {
3262 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3264 cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3265 6 /* max utf8 char length in bytes */ *
3266 (/* server len*/ + 256 /* share len */), nls_codepage);
3267 bcc_ptr += 2 * length; /* convert num 16 bit words to bytes */
3268 bcc_ptr += 2; /* skip trailing null */
3269 } else { /* ASCII */
3270 strcpy(bcc_ptr, tree);
3271 bcc_ptr += strlen(tree) + 1;
3273 strcpy(bcc_ptr, "?????");
3274 bcc_ptr += strlen("?????");
3276 count = bcc_ptr - &pSMB->Password[0];
3277 pSMB->hdr.smb_buf_length += count;
3278 pSMB->ByteCount = cpu_to_le16(count);
3280 rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3282 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3283 /* above now done in SendReceive */
3284 if ((rc == 0) && (tcon != NULL)) {
3285 tcon->tidStatus = CifsGood;
3286 tcon->tid = smb_buffer_response->Tid;
3287 bcc_ptr = pByteArea(smb_buffer_response);
3288 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3289 /* skip service field (NB: this field is always ASCII) */
3290 bcc_ptr += length + 1;
3291 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3292 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3293 length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3294 if ((bcc_ptr + (2 * length)) -
3295 pByteArea(smb_buffer_response) <=
3296 BCC(smb_buffer_response)) {
3297 kfree(tcon->nativeFileSystem);
3298 tcon->nativeFileSystem =
3299 kzalloc(length + 2, GFP_KERNEL);
3300 cifs_strfromUCS_le(tcon->nativeFileSystem,
3302 length, nls_codepage);
3303 bcc_ptr += 2 * length;
3304 bcc_ptr[0] = 0; /* null terminate the string */
3308 /* else do not bother copying these informational fields */
3310 length = strnlen(bcc_ptr, 1024);
3311 if ((bcc_ptr + length) -
3312 pByteArea(smb_buffer_response) <=
3313 BCC(smb_buffer_response)) {
3314 kfree(tcon->nativeFileSystem);
3315 tcon->nativeFileSystem =
3316 kzalloc(length + 1, GFP_KERNEL);
3317 strncpy(tcon->nativeFileSystem, bcc_ptr,
3320 /* else do not bother copying these informational fields */
3322 if((smb_buffer_response->WordCount == 3) ||
3323 (smb_buffer_response->WordCount == 7))
3324 /* field is in same location */
3325 tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3328 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3329 } else if ((rc == 0) && tcon == NULL) {
3330 /* all we need to save for IPC$ connection */
3331 ses->ipc_tid = smb_buffer_response->Tid;
3335 cifs_buf_release(smb_buffer);
3340 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3344 struct cifsSesInfo *ses = NULL;
3345 struct task_struct *cifsd_task;
3350 if (cifs_sb->tcon) {
3351 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3352 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3357 tconInfoFree(cifs_sb->tcon);
3358 if ((ses) && (ses->server)) {
3359 /* save off task so we do not refer to ses later */
3360 cifsd_task = ses->server->tsk;
3361 cFYI(1, ("About to do SMBLogoff "));
3362 rc = CIFSSMBLogoff(xid, ses);
3366 } else if (rc == -ESHUTDOWN) {
3367 cFYI(1,("Waking up socket by sending it signal"));
3369 send_sig(SIGKILL,cifsd_task,1);
3370 kthread_stop(cifsd_task);
3373 } /* else - we have an smb session
3374 left on this socket do not kill cifsd */
3376 cFYI(1, ("No session or bad tcon"));
3379 cifs_sb->tcon = NULL;
3380 tmp = cifs_sb->prepath;
3381 cifs_sb->prepathlen = 0;
3382 cifs_sb->prepath = NULL;
3385 schedule_timeout_interruptible(msecs_to_jiffies(500));
3390 return rc; /* BB check if we should always return zero here */
3393 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3394 struct nls_table * nls_info)
3397 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3398 int ntlmv2_flag = FALSE;
3401 /* what if server changes its buffer size after dropping the session? */
3402 if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3403 rc = CIFSSMBNegotiate(xid, pSesInfo);
3404 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3405 rc = CIFSSMBNegotiate(xid, pSesInfo);
3410 spin_lock(&GlobalMid_Lock);
3411 if(pSesInfo->server->tcpStatus != CifsExiting)
3412 pSesInfo->server->tcpStatus = CifsGood;
3415 spin_unlock(&GlobalMid_Lock);
3421 pSesInfo->flags = 0;
3422 pSesInfo->capabilities = pSesInfo->server->capabilities;
3423 if(linuxExtEnabled == 0)
3424 pSesInfo->capabilities &= (~CAP_UNIX);
3425 /* pSesInfo->sequence_number = 0;*/
3426 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3427 pSesInfo->server->secMode,
3428 pSesInfo->server->capabilities,
3429 pSesInfo->server->timeAdj));
3430 if(experimEnabled < 2)
3431 rc = CIFS_SessSetup(xid, pSesInfo,
3432 first_time, nls_info);
3433 else if (extended_security
3434 && (pSesInfo->capabilities
3435 & CAP_EXTENDED_SECURITY)
3436 && (pSesInfo->server->secType == NTLMSSP)) {
3438 } else if (extended_security
3439 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3440 && (pSesInfo->server->secType == RawNTLMSSP)) {
3441 cFYI(1, ("NTLMSSP sesssetup"));
3442 rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3449 cFYI(1,("more secure NTLM ver2 hash"));
3450 if(CalcNTLMv2_partial_mac_key(pSesInfo,
3455 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3457 CalcNTLMv2_response(pSesInfo,v2_response);
3459 cifs_calculate_ntlmv2_mac_key(
3460 pSesInfo->server->mac_signing_key,
3461 response, ntlm_session_key, */
3463 /* BB Put dummy sig in SessSetup PDU? */
3470 SMBNTencrypt(pSesInfo->password,
3471 pSesInfo->server->cryptKey,
3475 cifs_calculate_mac_key(
3476 pSesInfo->server->mac_signing_key,
3478 pSesInfo->password);
3480 /* for better security the weaker lanman hash not sent
3481 in AuthSessSetup so we no longer calculate it */
3483 rc = CIFSNTLMSSPAuthSessSetup(xid,
3489 } else { /* old style NTLM 0.12 session setup */
3490 SMBNTencrypt(pSesInfo->password,
3491 pSesInfo->server->cryptKey,
3495 cifs_calculate_mac_key(
3496 pSesInfo->server->mac_signing_key,
3497 ntlm_session_key, pSesInfo->password);
3499 rc = CIFSSessSetup(xid, pSesInfo,
3500 ntlm_session_key, nls_info);
3503 cERROR(1,("Send error in SessSetup = %d",rc));
3505 cFYI(1,("CIFS Session Established successfully"));
3506 pSesInfo->status = CifsGood;