fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2006
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/pagevec.h>
  34 #include <linux/freezer.h>
  35 #include <asm/uaccess.h>
  36 #include <asm/processor.h>
  37 #include "cifspdu.h"
  38 #include "cifsglob.h"
  39 #include "cifsproto.h"
  40 #include "cifs_unicode.h"
  41 #include "cifs_debug.h"
  42 #include "cifs_fs_sb.h"
  43 #include "ntlmssp.h"
  44 #include "nterr.h"
  45 #include "rfc1002pdu.h"
  46 #include "cn_cifs.h"
  47
  48 #define CIFS_PORT 445
  49 #define RFC1001_PORT 139
  50
  51 static DECLARE_COMPLETION(cifsd_complete);
  52
  53 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  54                          unsigned char *p24);
  55
  56 extern mempool_t *cifs_req_poolp;
  57
  58 struct smb_vol {
  59         char *username;
  60         char *password;
  61         char *domainname;
  62         char *UNC;
  63         char *UNCip;
  64         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  65         char *iocharset;  /* local code page for mapping to and from Unicode */
  66         char source_rfc1001_name[16]; /* netbios name of client */
  67         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  68         uid_t linux_uid;
  69         gid_t linux_gid;
  70         mode_t file_mode;
  71         mode_t dir_mode;
  72         unsigned secFlg;
  73         unsigned rw:1;
  74         unsigned retry:1;
  75         unsigned intr:1;
  76         unsigned setuids:1;
  77         unsigned noperm:1;
  78         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  79         unsigned cifs_acl:1;
  80         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  81         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  82         unsigned direct_io:1;
  83         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  84         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  85         unsigned sfu_emul:1;
  86         unsigned nullauth:1; /* attempt to authenticate with null user */
  87         unsigned nocase;     /* request case insensitive filenames */
  88         unsigned nobrl;      /* disable sending byte range locks to srv */
  89         unsigned int rsize;
  90         unsigned int wsize;
  91         unsigned int sockopt;
  92         unsigned short int port;
  93         char * prepath;
  94 };
  95
  96 static int ipv4_connect(struct sockaddr_in *psin_server,
  97                         struct socket **csocket,
  98                         char * netb_name,
  99                         char * server_netb_name);
 100 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 101                         struct socket **csocket);
 102
 103
 104         /*
 105          * cifs tcp session reconnection
 106          *
 107          * mark tcp session as reconnecting so temporarily locked
 108          * mark all smb sessions as reconnecting for tcp session
 109          * reconnect tcp session
 110          * wake up waiters on reconnection? - (not needed currently)
 111          */
 112
 113 static int
 114 cifs_reconnect(struct TCP_Server_Info *server)
 115 {
 116         int rc = 0;
 117         struct list_head *tmp;
 118         struct cifsSesInfo *ses;
 119         struct cifsTconInfo *tcon;
 120         struct mid_q_entry * mid_entry;
 121
 122         spin_lock(&GlobalMid_Lock);
 123         if(server->tcpStatus == CifsExiting) {
 124                 /* the demux thread will exit normally
 125                 next time through the loop */
 126                 spin_unlock(&GlobalMid_Lock);
 127                 return rc;
 128         } else
 129                 server->tcpStatus = CifsNeedReconnect;
 130         spin_unlock(&GlobalMid_Lock);
 131         server->maxBuf = 0;
 132
 133         cFYI(1, ("Reconnecting tcp session"));
 134
 135         /* before reconnecting the tcp session, mark the smb session (uid)
 136                 and the tid bad so they are not used until reconnected */
 137         read_lock(&GlobalSMBSeslock);
 138         list_for_each(tmp, &GlobalSMBSessionList) {
 139                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 140                 if (ses->server) {
 141                         if (ses->server == server) {
 142                                 ses->status = CifsNeedReconnect;
 143                                 ses->ipc_tid = 0;
 144                         }
 145                 }
 146                 /* else tcp and smb sessions need reconnection */
 147         }
 148         list_for_each(tmp, &GlobalTreeConnectionList) {
 149                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 150                 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 151                         tcon->tidStatus = CifsNeedReconnect;
 152                 }
 153         }
 154         read_unlock(&GlobalSMBSeslock);
 155         /* do not want to be sending data on a socket we are freeing */
 156         down(&server->tcpSem);
 157         if(server->ssocket) {
 158                 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 159                         server->ssocket->flags));
 160                 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
 161                 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
 162                         server->ssocket->flags));
 163                 sock_release(server->ssocket);
 164                 server->ssocket = NULL;
 165         }
 166
 167         spin_lock(&GlobalMid_Lock);
 168         list_for_each(tmp, &server->pending_mid_q) {
 169                 mid_entry = list_entry(tmp, struct
 170                                         mid_q_entry,
 171                                         qhead);
 172                 if(mid_entry) {
 173                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
 174                                 /* Mark other intransit requests as needing
 175                                    retry so we do not immediately mark the
 176                                    session bad again (ie after we reconnect
 177                                    below) as they timeout too */
 178                                 mid_entry->midState = MID_RETRY_NEEDED;
 179                         }
 180                 }
 181         }
 182         spin_unlock(&GlobalMid_Lock);
 183         up(&server->tcpSem);
 184
 185         while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
 186         {
 187                 try_to_freeze();
 188                 if(server->protocolType == IPV6) {
 189                         rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
 190                 } else {
 191                         rc = ipv4_connect(&server->addr.sockAddr,
 192                                         &server->ssocket,
 193                                         server->workstation_RFC1001_name,
 194                                         server->server_RFC1001_name);
 195                 }
 196                 if(rc) {
 197                         cFYI(1,("reconnect error %d",rc));
 198                         msleep(3000);
 199                 } else {
 200                         atomic_inc(&tcpSesReconnectCount);
 201                         spin_lock(&GlobalMid_Lock);
 202                         if(server->tcpStatus != CifsExiting)
 203                                 server->tcpStatus = CifsGood;
 204                         server->sequence_number = 0;
 205                         spin_unlock(&GlobalMid_Lock);
 206         /*              atomic_set(&server->inFlight,0);*/
 207                         wake_up(&server->response_q);
 208                 }
 209         }
 210         return rc;
 211 }
 212
 213 /*
 214         return codes:
 215                 0       not a transact2, or all data present
 216                 >0      transact2 with that much data missing
 217                 -EINVAL = invalid transact2
 218
 219  */
 220 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
 221 {
 222         struct smb_t2_rsp * pSMBt;
 223         int total_data_size;
 224         int data_in_this_rsp;
 225         int remaining;
 226
 227         if(pSMB->Command != SMB_COM_TRANSACTION2)
 228                 return 0;
 229
 230         /* check for plausible wct, bcc and t2 data and parm sizes */
 231         /* check for parm and data offset going beyond end of smb */
 232         if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 233                 cFYI(1,("invalid transact2 word count"));
 234                 return -EINVAL;
 235         }
 236
 237         pSMBt = (struct smb_t2_rsp *)pSMB;
 238
 239         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 240         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 241
 242         remaining = total_data_size - data_in_this_rsp;
 243
 244         if(remaining == 0)
 245                 return 0;
 246         else if(remaining < 0) {
 247                 cFYI(1,("total data %d smaller than data in frame %d",
 248                         total_data_size, data_in_this_rsp));
 249                 return -EINVAL;
 250         } else {
 251                 cFYI(1,("missing %d bytes from transact2, check next response",
 252                         remaining));
 253                 if(total_data_size > maxBufSize) {
 254                         cERROR(1,("TotalDataSize %d is over maximum buffer %d",
 255                                 total_data_size,maxBufSize));
 256                         return -EINVAL;
 257                 }
 258                 return remaining;
 259         }
 260 }
 261
 262 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
 263 {
 264         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 265         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 266         int total_data_size;
 267         int total_in_buf;
 268         int remaining;
 269         int total_in_buf2;
 270         char * data_area_of_target;
 271         char * data_area_of_buf2;
 272         __u16 byte_count;
 273
 274         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 275
 276         if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 277                 cFYI(1,("total data sizes of primary and secondary t2 differ"));
 278         }
 279
 280         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 281
 282         remaining = total_data_size - total_in_buf;
 283
 284         if(remaining < 0)
 285                 return -EINVAL;
 286
 287         if(remaining == 0) /* nothing to do, ignore */
 288                 return 0;
 289
 290         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 291         if(remaining < total_in_buf2) {
 292                 cFYI(1,("transact2 2nd response contains too much data"));
 293         }
 294
 295         /* find end of first SMB data area */
 296         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 297                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 298         /* validate target area */
 299
 300         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 301                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 302
 303         data_area_of_target += total_in_buf;
 304
 305         /* copy second buffer into end of first buffer */
 306         memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
 307         total_in_buf += total_in_buf2;
 308         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 309         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 310         byte_count += total_in_buf2;
 311         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 312
 313         byte_count = pTargetSMB->smb_buf_length;
 314         byte_count += total_in_buf2;
 315
 316         /* BB also add check that we are not beyond maximum buffer size */
 317
 318         pTargetSMB->smb_buf_length = byte_count;
 319
 320         if(remaining == total_in_buf2) {
 321                 cFYI(1,("found the last secondary response"));
 322                 return 0; /* we are done */
 323         } else /* more responses to go */
 324                 return 1;
 325
 326 }
 327
 328 static int
 329 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 330 {
 331         int length;
 332         unsigned int pdu_length, total_read;
 333         struct smb_hdr *smb_buffer = NULL;
 334         struct smb_hdr *bigbuf = NULL;
 335         struct smb_hdr *smallbuf = NULL;
 336         struct msghdr smb_msg;
 337         struct kvec iov;
 338         struct socket *csocket = server->ssocket;
 339         struct list_head *tmp;
 340         struct cifsSesInfo *ses;
 341         struct task_struct *task_to_wake = NULL;
 342         struct mid_q_entry *mid_entry;
 343         char temp;
 344         int isLargeBuf = FALSE;
 345         int isMultiRsp;
 346         int reconnect;
 347
 348         daemonize("cifsd");
 349         allow_signal(SIGKILL);
 350         current->flags |= PF_MEMALLOC;
 351         server->tsk = current;  /* save process info to wake at shutdown */
 352         cFYI(1, ("Demultiplex PID: %d", current->pid));
 353         write_lock(&GlobalSMBSeslock);
 354         atomic_inc(&tcpSesAllocCount);
 355         length = tcpSesAllocCount.counter;
 356         write_unlock(&GlobalSMBSeslock);
 357         complete(&cifsd_complete);
 358         if(length  > 1) {
 359                 mempool_resize(cifs_req_poolp,
 360                         length + cifs_min_rcv,
 361                         GFP_KERNEL);
 362         }
 363
 364         while (server->tcpStatus != CifsExiting) {
 365                 if (try_to_freeze())
 366                         continue;
 367                 if (bigbuf == NULL) {
 368                         bigbuf = cifs_buf_get();
 369                         if (!bigbuf) {
 370                                 cERROR(1, ("No memory for large SMB response"));
 371                                 msleep(3000);
 372                                 /* retry will check if exiting */
 373                                 continue;
 374                         }
 375                 } else if (isLargeBuf) {
 376                         /* we are reusing a dirty large buf, clear its start */
 377                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 378                 }
 379
 380                 if (smallbuf == NULL) {
 381                         smallbuf = cifs_small_buf_get();
 382                         if (!smallbuf) {
 383                                 cERROR(1, ("No memory for SMB response"));
 384                                 msleep(1000);
 385                                 /* retry will check if exiting */
 386                                 continue;
 387                         }
 388                         /* beginning of smb buffer is cleared in our buf_get */
 389                 } else /* if existing small buf clear beginning */
 390                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 391
 392                 isLargeBuf = FALSE;
 393                 isMultiRsp = FALSE;
 394                 smb_buffer = smallbuf;
 395                 iov.iov_base = smb_buffer;
 396                 iov.iov_len = 4;
 397                 smb_msg.msg_control = NULL;
 398                 smb_msg.msg_controllen = 0;
 399                 length =
 400                     kernel_recvmsg(csocket, &smb_msg,
 401                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 402
 403                 if (server->tcpStatus == CifsExiting) {
 404                         break;
 405                 } else if (server->tcpStatus == CifsNeedReconnect) {
 406                         cFYI(1, ("Reconnect after server stopped responding"));
 407                         cifs_reconnect(server);
 408                         cFYI(1, ("call to reconnect done"));
 409                         csocket = server->ssocket;
 410                         continue;
 411                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 412                         msleep(1); /* minimum sleep to prevent looping
 413                                 allowing socket to clear and app threads to set
 414                                 tcpStatus CifsNeedReconnect if server hung */
 415                         continue;
 416                 } else if (length <= 0) {
 417                         if (server->tcpStatus == CifsNew) {
 418                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 419                                 /* some servers kill the TCP session rather than
 420                                    returning an SMB negprot error, in which
 421                                    case reconnecting here is not going to help,
 422                                    and so simply return error to mount */
 423                                 break;
 424                         }
 425                         if (!try_to_freeze() && (length == -EINTR)) {
 426                                 cFYI(1,("cifsd thread killed"));
 427                                 break;
 428                         }
 429                         cFYI(1,("Reconnect after unexpected peek error %d",
 430                                 length));
 431                         cifs_reconnect(server);
 432                         csocket = server->ssocket;
 433                         wake_up(&server->response_q);
 434                         continue;
 435                 } else if (length < 4) {
 436                         cFYI(1,
 437                             ("Frame under four bytes received (%d bytes long)",
 438                               length));
 439                         cifs_reconnect(server);
 440                         csocket = server->ssocket;
 441                         wake_up(&server->response_q);
 442                         continue;
 443                 }
 444
 445                 /* The right amount was read from socket - 4 bytes */
 446                 /* so we can now interpret the length field */
 447
 448                 /* the first byte big endian of the length field,
 449                 is actually not part of the length but the type
 450                 with the most common, zero, as regular data */
 451                 temp = *((char *) smb_buffer);
 452
 453                 /* Note that FC 1001 length is big endian on the wire,
 454                 but we convert it here so it is always manipulated
 455                 as host byte order */
 456                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 457                 smb_buffer->smb_buf_length = pdu_length;
 458
 459                 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
 460
 461                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 462                         continue;
 463                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 464                         cFYI(1,("Good RFC 1002 session rsp"));
 465                         continue;
 466                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 467                         /* we get this from Windows 98 instead of
 468                            an error on SMB negprot response */
 469                         cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
 470                                 pdu_length));
 471                         if(server->tcpStatus == CifsNew) {
 472                                 /* if nack on negprot (rather than
 473                                 ret of smb negprot error) reconnecting
 474                                 not going to help, ret error to mount */
 475                                 break;
 476                         } else {
 477                                 /* give server a second to
 478                                 clean up before reconnect attempt */
 479                                 msleep(1000);
 480                                 /* always try 445 first on reconnect
 481                                 since we get NACK on some if we ever
 482                                 connected to port 139 (the NACK is
 483                                 since we do not begin with RFC1001
 484                                 session initialize frame) */
 485                                 server->addr.sockAddr.sin_port =
 486                                         htons(CIFS_PORT);
 487                                 cifs_reconnect(server);
 488                                 csocket = server->ssocket;
 489                                 wake_up(&server->response_q);
 490                                 continue;
 491                         }
 492                 } else if (temp != (char) 0) {
 493                         cERROR(1,("Unknown RFC 1002 frame"));
 494                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 495                                       length);
 496                         cifs_reconnect(server);
 497                         csocket = server->ssocket;
 498                         continue;
 499                 }
 500
 501                 /* else we have an SMB response */
 502                 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 503                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 504                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 505                                         length, pdu_length+4));
 506                         cifs_reconnect(server);
 507                         csocket = server->ssocket;
 508                         wake_up(&server->response_q);
 509                         continue;
 510                 }
 511
 512                 /* else length ok */
 513                 reconnect = 0;
 514
 515                 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 516                         isLargeBuf = TRUE;
 517                         memcpy(bigbuf, smallbuf, 4);
 518                         smb_buffer = bigbuf;
 519                 }
 520                 length = 0;
 521                 iov.iov_base = 4 + (char *)smb_buffer;
 522                 iov.iov_len = pdu_length;
 523                 for (total_read = 0; total_read < pdu_length;
 524                      total_read += length) {
 525                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 526                                                 pdu_length - total_read, 0);
 527                         if((server->tcpStatus == CifsExiting) ||
 528                             (length == -EINTR)) {
 529                                 /* then will exit */
 530                                 reconnect = 2;
 531                                 break;
 532                         } else if (server->tcpStatus == CifsNeedReconnect) {
 533                                 cifs_reconnect(server);
 534                                 csocket = server->ssocket;
 535                                 /* Reconnect wakes up rspns q */
 536                                 /* Now we will reread sock */
 537                                 reconnect = 1;
 538                                 break;
 539                         } else if ((length == -ERESTARTSYS) ||
 540                                    (length == -EAGAIN)) {
 541                                 msleep(1); /* minimum sleep to prevent looping,
 542                                               allowing socket to clear and app
 543                                               threads to set tcpStatus
 544                                               CifsNeedReconnect if server hung*/
 545                                 continue;
 546                         } else if (length <= 0) {
 547                                 cERROR(1,("Received no data, expecting %d",
 548                                               pdu_length - total_read));
 549                                 cifs_reconnect(server);
 550                                 csocket = server->ssocket;
 551                                 reconnect = 1;
 552                                 break;
 553                         }
 554                 }
 555                 if(reconnect == 2)
 556                         break;
 557                 else if(reconnect == 1)
 558                         continue;
 559
 560                 length += 4; /* account for rfc1002 hdr */
 561
 562
 563                 dump_smb(smb_buffer, length);
 564                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 565                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 566                         continue;
 567                 }
 568
 569
 570                 task_to_wake = NULL;
 571                 spin_lock(&GlobalMid_Lock);
 572                 list_for_each(tmp, &server->pending_mid_q) {
 573                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 574
 575                         if ((mid_entry->mid == smb_buffer->Mid) &&
 576                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 577                             (mid_entry->command == smb_buffer->Command)) {
 578                                 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
 579                                         /* We have a multipart transact2 resp */
 580                                         isMultiRsp = TRUE;
 581                                         if(mid_entry->resp_buf) {
 582                                                 /* merge response - fix up 1st*/
 583                                                 if(coalesce_t2(smb_buffer,
 584                                                         mid_entry->resp_buf)) {
 585                                                         mid_entry->multiRsp = 1;
 586                                                         break;
 587                                                 } else {
 588                                                         /* all parts received */
 589                                                         mid_entry->multiEnd = 1;
 590                                                         goto multi_t2_fnd;
 591                                                 }
 592                                         } else {
 593                                                 if(!isLargeBuf) {
 594                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 595                                         /* BB maybe we can fix this up,  switch
 596                                            to already allocated large buffer? */
 597                                                 } else {
 598                                                         /* Have first buffer */
 599                                                         mid_entry->resp_buf =
 600                                                                  smb_buffer;
 601                                                         mid_entry->largeBuf = 1;
 602                                                         bigbuf = NULL;
 603                                                 }
 604                                         }
 605                                         break;
 606                                 }
 607                                 mid_entry->resp_buf = smb_buffer;
 608                                 if(isLargeBuf)
 609                                         mid_entry->largeBuf = 1;
 610                                 else
 611                                         mid_entry->largeBuf = 0;
 612 multi_t2_fnd:
 613                                 task_to_wake = mid_entry->tsk;
 614                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 615 #ifdef CONFIG_CIFS_STATS2
 616                                 mid_entry->when_received = jiffies;
 617 #endif
 618                                 /* so we do not time out requests to  server
 619                                 which is still responding (since server could
 620                                 be busy but not dead) */
 621                                 server->lstrp = jiffies;
 622                                 break;
 623                         }
 624                 }
 625                 spin_unlock(&GlobalMid_Lock);
 626                 if (task_to_wake) {
 627                         /* Was previous buf put in mpx struct for multi-rsp? */
 628                         if(!isMultiRsp) {
 629                                 /* smb buffer will be freed by user thread */
 630                                 if(isLargeBuf) {
 631                                         bigbuf = NULL;
 632                                 } else
 633                                         smallbuf = NULL;
 634                         }
 635                         wake_up_process(task_to_wake);
 636                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 637                     && (isMultiRsp == FALSE)) {
 638                         cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
 639                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
 640                                       sizeof(struct smb_hdr));
 641 #ifdef CONFIG_CIFS_DEBUG2
 642                         cifs_dump_detail(smb_buffer);
 643                         cifs_dump_mids(server);
 644 #endif /* CIFS_DEBUG2 */
 645
 646                 }
 647         } /* end while !EXITING */
 648
 649         spin_lock(&GlobalMid_Lock);
 650         server->tcpStatus = CifsExiting;
 651         server->tsk = NULL;
 652         /* check if we have blocked requests that need to free */
 653         /* Note that cifs_max_pending is normally 50, but
 654         can be set at module install time to as little as two */
 655         if(atomic_read(&server->inFlight) >= cifs_max_pending)
 656                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 657         /* We do not want to set the max_pending too low or we
 658         could end up with the counter going negative */
 659         spin_unlock(&GlobalMid_Lock);
 660         /* Although there should not be any requests blocked on
 661         this queue it can not hurt to be paranoid and try to wake up requests
 662         that may haven been blocked when more than 50 at time were on the wire
 663         to the same server - they now will see the session is in exit state
 664         and get out of SendReceive.  */
 665         wake_up_all(&server->request_q);
 666         /* give those requests time to exit */
 667         msleep(125);
 668
 669         if(server->ssocket) {
 670                 sock_release(csocket);
 671                 server->ssocket = NULL;
 672         }
 673         /* buffer usuallly freed in free_mid - need to free it here on exit */
 674         if (bigbuf != NULL)
 675                 cifs_buf_release(bigbuf);
 676         if (smallbuf != NULL)
 677                 cifs_small_buf_release(smallbuf);
 678
 679         read_lock(&GlobalSMBSeslock);
 680         if (list_empty(&server->pending_mid_q)) {
 681                 /* loop through server session structures attached to this and
 682                     mark them dead */
 683                 list_for_each(tmp, &GlobalSMBSessionList) {
 684                         ses =
 685                             list_entry(tmp, struct cifsSesInfo,
 686                                        cifsSessionList);
 687                         if (ses->server == server) {
 688                                 ses->status = CifsExiting;
 689                                 ses->server = NULL;
 690                         }
 691                 }
 692                 read_unlock(&GlobalSMBSeslock);
 693         } else {
 694                 /* although we can not zero the server struct pointer yet,
 695                 since there are active requests which may depnd on them,
 696                 mark the corresponding SMB sessions as exiting too */
 697                 list_for_each(tmp, &GlobalSMBSessionList) {
 698                         ses = list_entry(tmp, struct cifsSesInfo,
 699                                          cifsSessionList);
 700                         if (ses->server == server) {
 701                                 ses->status = CifsExiting;
 702                         }
 703                 }
 704
 705                 spin_lock(&GlobalMid_Lock);
 706                 list_for_each(tmp, &server->pending_mid_q) {
 707                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 708                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 709                                 cFYI(1,
 710                                   ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
 711                                 task_to_wake = mid_entry->tsk;
 712                                 if(task_to_wake) {
 713                                         wake_up_process(task_to_wake);
 714                                 }
 715                         }
 716                 }
 717                 spin_unlock(&GlobalMid_Lock);
 718                 read_unlock(&GlobalSMBSeslock);
 719                 /* 1/8th of sec is more than enough time for them to exit */
 720                 msleep(125);
 721         }
 722
 723         if (!list_empty(&server->pending_mid_q)) {
 724                 /* mpx threads have not exited yet give them
 725                 at least the smb send timeout time for long ops */
 726                 /* due to delays on oplock break requests, we need
 727                 to wait at least 45 seconds before giving up
 728                 on a request getting a response and going ahead
 729                 and killing cifsd */
 730                 cFYI(1, ("Wait for exit from demultiplex thread"));
 731                 msleep(46000);
 732                 /* if threads still have not exited they are probably never
 733                 coming home not much else we can do but free the memory */
 734         }
 735
 736         write_lock(&GlobalSMBSeslock);
 737         atomic_dec(&tcpSesAllocCount);
 738         length = tcpSesAllocCount.counter;
 739
 740         /* last chance to mark ses pointers invalid
 741         if there are any pointing to this (e.g
 742         if a crazy root user tried to kill cifsd
 743         kernel thread explicitly this might happen) */
 744         list_for_each(tmp, &GlobalSMBSessionList) {
 745                 ses = list_entry(tmp, struct cifsSesInfo,
 746                                 cifsSessionList);
 747                 if (ses->server == server) {
 748                         ses->server = NULL;
 749                 }
 750         }
 751         write_unlock(&GlobalSMBSeslock);
 752
 753         kfree(server);
 754         if(length  > 0) {
 755                 mempool_resize(cifs_req_poolp,
 756                         length + cifs_min_rcv,
 757                         GFP_KERNEL);
 758         }
 759
 760         complete_and_exit(&cifsd_complete, 0);
 761         return 0;
 762 }
 763
 764 static int
 765 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 766 {
 767         char *value;
 768         char *data;
 769         unsigned int  temp_len, i, j;
 770         char separator[2];
 771
 772         separator[0] = ',';
 773         separator[1] = 0;
 774
 775         if (Local_System_Name[0] != 0)
 776                 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
 777         else {
 778                 char *nodename = utsname()->nodename;
 779                 int n = strnlen(nodename,15);
 780                 memset(vol->source_rfc1001_name,0x20,15);
 781                 for(i=0 ; i < n ; i++) {
 782                         /* does not have to be perfect mapping since field is
 783                         informational, only used for servers that do not support
 784                         port 445 and it can be overridden at mount time */
 785                         vol->source_rfc1001_name[i] = toupper(nodename[i]);
 786                 }
 787         }
 788         vol->source_rfc1001_name[15] = 0;
 789         /* null target name indicates to use *SMBSERVR default called name
 790            if we end up sending RFC1001 session initialize */
 791         vol->target_rfc1001_name[0] = 0;
 792         vol->linux_uid = current->uid;  /* current->euid instead? */
 793         vol->linux_gid = current->gid;
 794         vol->dir_mode = S_IRWXUGO;
 795         /* 2767 perms indicate mandatory locking support */
 796         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 797
 798         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 799         vol->rw = TRUE;
 800         /* default is always to request posix paths. */
 801         vol->posix_paths = 1;
 802
 803         if (!options)
 804                 return 1;
 805
 806         if(strncmp(options,"sep=",4) == 0) {
 807                 if(options[4] != 0) {
 808                         separator[0] = options[4];
 809                         options += 5;
 810                 } else {
 811                         cFYI(1,("Null separator not allowed"));
 812                 }
 813         }
 814
 815         while ((data = strsep(&options, separator)) != NULL) {
 816                 if (!*data)
 817                         continue;
 818                 if ((value = strchr(data, '=')) != NULL)
 819                         *value++ = '\0';
 820
 821                 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
 822                         vol->no_xattr = 0;
 823                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
 824                         vol->no_xattr = 1;
 825                 } else if (strnicmp(data, "user", 4) == 0) {
 826                         if (!value) {
 827                                 printk(KERN_WARNING
 828                                        "CIFS: invalid or missing username\n");
 829                                 return 1;       /* needs_arg; */
 830                         } else if(!*value) {
 831                                 /* null user, ie anonymous, authentication */
 832                                 vol->nullauth = 1;
 833                         }
 834                         if (strnlen(value, 200) < 200) {
 835                                 vol->username = value;
 836                         } else {
 837                                 printk(KERN_WARNING "CIFS: username too long\n");
 838                                 return 1;
 839                         }
 840                 } else if (strnicmp(data, "pass", 4) == 0) {
 841                         if (!value) {
 842                                 vol->password = NULL;
 843                                 continue;
 844                         } else if(value[0] == 0) {
 845                                 /* check if string begins with double comma
 846                                    since that would mean the password really
 847                                    does start with a comma, and would not
 848                                    indicate an empty string */
 849                                 if(value[1] != separator[0]) {
 850                                         vol->password = NULL;
 851                                         continue;
 852                                 }
 853                         }
 854                         temp_len = strlen(value);
 855                         /* removed password length check, NTLM passwords
 856                                 can be arbitrarily long */
 857
 858                         /* if comma in password, the string will be
 859                         prematurely null terminated.  Commas in password are
 860                         specified across the cifs mount interface by a double
 861                         comma ie ,, and a comma used as in other cases ie ','
 862                         as a parameter delimiter/separator is single and due
 863                         to the strsep above is temporarily zeroed. */
 864
 865                         /* NB: password legally can have multiple commas and
 866                         the only illegal character in a password is null */
 867
 868                         if ((value[temp_len] == 0) &&
 869                             (value[temp_len+1] == separator[0])) {
 870                                 /* reinsert comma */
 871                                 value[temp_len] = separator[0];
 872                                 temp_len+=2;  /* move after the second comma */
 873                                 while(value[temp_len] != 0)  {
 874                                         if (value[temp_len] == separator[0]) {
 875                                                 if (value[temp_len+1] ==
 876                                                      separator[0]) {
 877                                                 /* skip second comma */
 878                                                         temp_len++;
 879                                                 } else {
 880                                                 /* single comma indicating start
 881                                                          of next parm */
 882                                                         break;
 883                                                 }
 884                                         }
 885                                         temp_len++;
 886                                 }
 887                                 if(value[temp_len] == 0) {
 888                                         options = NULL;
 889                                 } else {
 890                                         value[temp_len] = 0;
 891                                         /* point option to start of next parm */
 892                                         options = value + temp_len + 1;
 893                                 }
 894                                 /* go from value to value + temp_len condensing
 895                                 double commas to singles. Note that this ends up
 896                                 allocating a few bytes too many, which is ok */
 897                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 898                                 if(vol->password == NULL) {
 899                                         printk("CIFS: no memory for pass\n");
 900                                         return 1;
 901                                 }
 902                                 for(i=0,j=0;i<temp_len;i++,j++) {
 903                                         vol->password[j] = value[i];
 904                                         if(value[i] == separator[0]
 905                                                 && value[i+1] == separator[0]) {
 906                                                 /* skip second comma */
 907                                                 i++;
 908                                         }
 909                                 }
 910                                 vol->password[j] = 0;
 911                         } else {
 912                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 913                                 if(vol->password == NULL) {
 914                                         printk("CIFS: no memory for pass\n");
 915                                         return 1;
 916                                 }
 917                                 strcpy(vol->password, value);
 918                         }
 919                 } else if (strnicmp(data, "ip", 2) == 0) {
 920                         if (!value || !*value) {
 921                                 vol->UNCip = NULL;
 922                         } else if (strnlen(value, 35) < 35) {
 923                                 vol->UNCip = value;
 924                         } else {
 925                                 printk(KERN_WARNING "CIFS: ip address too long\n");
 926                                 return 1;
 927                         }
 928                 } else if (strnicmp(data, "sec", 3) == 0) {
 929                         if (!value || !*value) {
 930                                 cERROR(1,("no security value specified"));
 931                                 continue;
 932                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 933                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 934                                         CIFSSEC_MUST_SIGN;
 935                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 936                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 937                                         CIFSSEC_MAY_KRB5; */
 938                                 cERROR(1,("Krb5 cifs privacy not supported"));
 939                                 return 1;
 940                         } else if (strnicmp(value, "krb5", 4) == 0) {
 941                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 942                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 943                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 944                                         CIFSSEC_MUST_SIGN;
 945                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 946                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 947                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 948                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 949                                         CIFSSEC_MUST_SIGN;
 950                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 951                                 /* ntlm is default so can be turned off too */
 952                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 953                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 954                                 /* BB is there a better way to do this? */
 955                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 956 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 957                         } else if (strnicmp(value, "lanman", 6) == 0) {
 958                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 959 #endif
 960                         } else if (strnicmp(value, "none", 4) == 0) {
 961                                 vol->nullauth = 1;
 962                         } else {
 963                                 cERROR(1,("bad security option: %s", value));
 964                                 return 1;
 965                         }
 966                 } else if ((strnicmp(data, "unc", 3) == 0)
 967                            || (strnicmp(data, "target", 6) == 0)
 968                            || (strnicmp(data, "path", 4) == 0)) {
 969                         if (!value || !*value) {
 970                                 printk(KERN_WARNING
 971                                        "CIFS: invalid path to network resource\n");
 972                                 return 1;       /* needs_arg; */
 973                         }
 974                         if ((temp_len = strnlen(value, 300)) < 300) {
 975                                 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
 976                                 if(vol->UNC == NULL)
 977                                         return 1;
 978                                 strcpy(vol->UNC,value);
 979                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 980                                         vol->UNC[0] = '\\';
 981                                         vol->UNC[1] = '\\';
 982                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 983                                         printk(KERN_WARNING
 984                                                "CIFS: UNC Path does not begin with // or \\\\ \n");
 985                                         return 1;
 986                                 }
 987                         } else {
 988                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 989                                 return 1;
 990                         }
 991                 } else if ((strnicmp(data, "domain", 3) == 0)
 992                            || (strnicmp(data, "workgroup", 5) == 0)) {
 993                         if (!value || !*value) {
 994                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
 995                                 return 1;       /* needs_arg; */
 996                         }
 997                         /* BB are there cases in which a comma can be valid in
 998                         a domain name and need special handling? */
 999                         if (strnlen(value, 256) < 256) {
1000                                 vol->domainname = value;
1001                                 cFYI(1, ("Domain name set"));
1002                         } else {
1003                                 printk(KERN_WARNING "CIFS: domain name too long\n");
1004                                 return 1;
1005                         }
1006                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1007                         if (!value || !*value) {
1008                                 printk(KERN_WARNING
1009                                        "CIFS: invalid path prefix\n");
1010                                 return 1;       /* needs_arg; */
1011                         }
1012                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1013                                 if(value[0] != '/')
1014                                         temp_len++;  /* missing leading slash */
1015                                 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1016                                 if(vol->prepath == NULL)
1017                                         return 1;
1018                                 if(value[0] != '/') {
1019                                         vol->prepath[0] = '/';
1020                                         strcpy(vol->prepath+1,value);
1021                                 } else
1022                                         strcpy(vol->prepath,value);
1023                                 cFYI(1,("prefix path %s",vol->prepath));
1024                         } else {
1025                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1026                                 return 1;
1027                         }
1028                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1029                         if (!value || !*value) {
1030                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1031                                 return 1;       /* needs_arg; */
1032                         }
1033                         if (strnlen(value, 65) < 65) {
1034                                 if(strnicmp(value,"default",7))
1035                                         vol->iocharset = value;
1036                                 /* if iocharset not set load_nls_default used by caller */
1037                                 cFYI(1, ("iocharset set to %s",value));
1038                         } else {
1039                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1040                                 return 1;
1041                         }
1042                 } else if (strnicmp(data, "uid", 3) == 0) {
1043                         if (value && *value) {
1044                                 vol->linux_uid =
1045                                         simple_strtoul(value, &value, 0);
1046                         }
1047                 } else if (strnicmp(data, "gid", 3) == 0) {
1048                         if (value && *value) {
1049                                 vol->linux_gid =
1050                                         simple_strtoul(value, &value, 0);
1051                         }
1052                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1053                         if (value && *value) {
1054                                 vol->file_mode =
1055                                         simple_strtoul(value, &value, 0);
1056                         }
1057                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1058                         if (value && *value) {
1059                                 vol->dir_mode =
1060                                         simple_strtoul(value, &value, 0);
1061                         }
1062                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1063                         if (value && *value) {
1064                                 vol->dir_mode =
1065                                         simple_strtoul(value, &value, 0);
1066                         }
1067                 } else if (strnicmp(data, "port", 4) == 0) {
1068                         if (value && *value) {
1069                                 vol->port =
1070                                         simple_strtoul(value, &value, 0);
1071                         }
1072                 } else if (strnicmp(data, "rsize", 5) == 0) {
1073                         if (value && *value) {
1074                                 vol->rsize =
1075                                         simple_strtoul(value, &value, 0);
1076                         }
1077                 } else if (strnicmp(data, "wsize", 5) == 0) {
1078                         if (value && *value) {
1079                                 vol->wsize =
1080                                         simple_strtoul(value, &value, 0);
1081                         }
1082                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1083                         if (value && *value) {
1084                                 vol->sockopt =
1085                                         simple_strtoul(value, &value, 0);
1086                         }
1087                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1088                         if (!value || !*value || (*value == ' ')) {
1089                                 cFYI(1,("invalid (empty) netbiosname specified"));
1090                         } else {
1091                                 memset(vol->source_rfc1001_name,0x20,15);
1092                                 for(i=0;i<15;i++) {
1093                                 /* BB are there cases in which a comma can be
1094                                 valid in this workstation netbios name (and need
1095                                 special handling)? */
1096
1097                                 /* We do not uppercase netbiosname for user */
1098                                         if (value[i]==0)
1099                                                 break;
1100                                         else
1101                                                 vol->source_rfc1001_name[i] = value[i];
1102                                 }
1103                                 /* The string has 16th byte zero still from
1104                                 set at top of the function  */
1105                                 if((i==15) && (value[i] != 0))
1106                                         printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1107                         }
1108                 } else if (strnicmp(data, "servern", 7) == 0) {
1109                         /* servernetbiosname specified override *SMBSERVER */
1110                         if (!value || !*value || (*value == ' ')) {
1111                                 cFYI(1,("empty server netbiosname specified"));
1112                         } else {
1113                                 /* last byte, type, is 0x20 for servr type */
1114                                 memset(vol->target_rfc1001_name,0x20,16);
1115
1116                                 for(i=0;i<15;i++) {
1117                                 /* BB are there cases in which a comma can be
1118                                    valid in this workstation netbios name (and need
1119                                    special handling)? */
1120
1121                                 /* user or mount helper must uppercase netbiosname */
1122                                         if (value[i]==0)
1123                                                 break;
1124                                         else
1125                                                 vol->target_rfc1001_name[i] = value[i];
1126                                 }
1127                                 /* The string has 16th byte zero still from
1128                                    set at top of the function  */
1129                                 if((i==15) && (value[i] != 0))
1130                                         printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1131                         }
1132                 } else if (strnicmp(data, "credentials", 4) == 0) {
1133                         /* ignore */
1134                 } else if (strnicmp(data, "version", 3) == 0) {
1135                         /* ignore */
1136                 } else if (strnicmp(data, "guest",5) == 0) {
1137                         /* ignore */
1138                 } else if (strnicmp(data, "rw", 2) == 0) {
1139                         vol->rw = TRUE;
1140                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1141                                    (strnicmp(data, "nosuid", 6) == 0) ||
1142                                    (strnicmp(data, "exec", 4) == 0) ||
1143                                    (strnicmp(data, "noexec", 6) == 0) ||
1144                                    (strnicmp(data, "nodev", 5) == 0) ||
1145                                    (strnicmp(data, "noauto", 6) == 0) ||
1146                                    (strnicmp(data, "dev", 3) == 0)) {
1147                         /*  The mount tool or mount.cifs helper (if present)
1148                                 uses these opts to set flags, and the flags are read
1149                                 by the kernel vfs layer before we get here (ie
1150                                 before read super) so there is no point trying to
1151                                 parse these options again and set anything and it
1152                                 is ok to just ignore them */
1153                         continue;
1154                 } else if (strnicmp(data, "ro", 2) == 0) {
1155                         vol->rw = FALSE;
1156                 } else if (strnicmp(data, "hard", 4) == 0) {
1157                         vol->retry = 1;
1158                 } else if (strnicmp(data, "soft", 4) == 0) {
1159                         vol->retry = 0;
1160                 } else if (strnicmp(data, "perm", 4) == 0) {
1161                         vol->noperm = 0;
1162                 } else if (strnicmp(data, "noperm", 6) == 0) {
1163                         vol->noperm = 1;
1164                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1165                         vol->remap = 1;
1166                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1167                         vol->remap = 0;
1168                 } else if (strnicmp(data, "sfu", 3) == 0) {
1169                         vol->sfu_emul = 1;
1170                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1171                         vol->sfu_emul = 0;
1172                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1173                         vol->posix_paths = 1;
1174                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1175                         vol->posix_paths = 0;
1176                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1177                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1178                         vol->nocase = 1;
1179                 } else if (strnicmp(data, "brl", 3) == 0) {
1180                         vol->nobrl =  0;
1181                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1182                            (strnicmp(data, "nolock", 6) == 0)) {
1183                         vol->nobrl =  1;
1184                         /* turn off mandatory locking in mode
1185                         if remote locking is turned off since the
1186                         local vfs will do advisory */
1187                         if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1188                                 vol->file_mode = S_IALLUGO;
1189                 } else if (strnicmp(data, "setuids", 7) == 0) {
1190                         vol->setuids = 1;
1191                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1192                         vol->setuids = 0;
1193                 } else if (strnicmp(data, "nohard", 6) == 0) {
1194                         vol->retry = 0;
1195                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1196                         vol->retry = 1;
1197                 } else if (strnicmp(data, "nointr", 6) == 0) {
1198                         vol->intr = 0;
1199                 } else if (strnicmp(data, "intr", 4) == 0) {
1200                         vol->intr = 1;
1201                 } else if (strnicmp(data, "serverino",7) == 0) {
1202                         vol->server_ino = 1;
1203                 } else if (strnicmp(data, "noserverino",9) == 0) {
1204                         vol->server_ino = 0;
1205                 } else if (strnicmp(data, "cifsacl",7) == 0) {
1206                         vol->cifs_acl = 1;
1207                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1208                         vol->cifs_acl = 0;
1209                 } else if (strnicmp(data, "acl",3) == 0) {
1210                         vol->no_psx_acl = 0;
1211                 } else if (strnicmp(data, "noacl",5) == 0) {
1212                         vol->no_psx_acl = 1;
1213                 } else if (strnicmp(data, "sign",4) == 0) {
1214                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1215 /*              } else if (strnicmp(data, "seal",4) == 0) {
1216                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1217                 } else if (strnicmp(data, "direct",6) == 0) {
1218                         vol->direct_io = 1;
1219                 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1220                         vol->direct_io = 1;
1221                 } else if (strnicmp(data, "in6_addr",8) == 0) {
1222                         if (!value || !*value) {
1223                                 vol->in6_addr = NULL;
1224                         } else if (strnlen(value, 49) == 48) {
1225                                 vol->in6_addr = value;
1226                         } else {
1227                                 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1228                                 return 1;
1229                         }
1230                 } else if (strnicmp(data, "noac", 4) == 0) {
1231                         printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1232                 } else
1233                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1234         }
1235         if (vol->UNC == NULL) {
1236                 if(devname == NULL) {
1237                         printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1238                         return 1;
1239                 }
1240                 if ((temp_len = strnlen(devname, 300)) < 300) {
1241                         vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1242                         if(vol->UNC == NULL)
1243                                 return 1;
1244                         strcpy(vol->UNC,devname);
1245                         if (strncmp(vol->UNC, "//", 2) == 0) {
1246                                 vol->UNC[0] = '\\';
1247                                 vol->UNC[1] = '\\';
1248                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1249                                 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1250                                 return 1;
1251                         }
1252                 } else {
1253                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1254                         return 1;
1255                 }
1256         }
1257         if(vol->UNCip == NULL)
1258                 vol->UNCip = &vol->UNC[2];
1259
1260         return 0;
1261 }
1262
1263 static struct cifsSesInfo *
1264 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1265                 struct in6_addr *target_ip6_addr,
1266                  char *userName, struct TCP_Server_Info **psrvTcp)
1267 {
1268         struct list_head *tmp;
1269         struct cifsSesInfo *ses;
1270         *psrvTcp = NULL;
1271         read_lock(&GlobalSMBSeslock);
1272
1273         list_for_each(tmp, &GlobalSMBSessionList) {
1274                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1275                 if (ses->server) {
1276                         if((target_ip_addr &&
1277                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1278                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1279                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1280                                         target_ip6_addr,sizeof(*target_ip6_addr)))){
1281                                 /* BB lock server and tcp session and increment use count here?? */
1282                                 *psrvTcp = ses->server; /* found a match on the TCP session */
1283                                 /* BB check if reconnection needed */
1284                                 if (strncmp
1285                                     (ses->userName, userName,
1286                                      MAX_USERNAME_SIZE) == 0){
1287                                         read_unlock(&GlobalSMBSeslock);
1288                                         return ses;     /* found exact match on both tcp and SMB sessions */
1289                                 }
1290                         }
1291                 }
1292                 /* else tcp and smb sessions need reconnection */
1293         }
1294         read_unlock(&GlobalSMBSeslock);
1295         return NULL;
1296 }
1297
1298 static struct cifsTconInfo *
1299 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1300 {
1301         struct list_head *tmp;
1302         struct cifsTconInfo *tcon;
1303
1304         read_lock(&GlobalSMBSeslock);
1305         list_for_each(tmp, &GlobalTreeConnectionList) {
1306                 cFYI(1, ("Next tcon"));
1307                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1308                 if (tcon->ses) {
1309                         if (tcon->ses->server) {
1310                                 cFYI(1,
1311                                      ("old ip addr: %x == new ip %x ?",
1312                                       tcon->ses->server->addr.sockAddr.sin_addr.
1313                                       s_addr, new_target_ip_addr));
1314                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1315                                     s_addr == new_target_ip_addr) {
1316         /* BB lock tcon, server and tcp session and increment use count here? */
1317                                         /* found a match on the TCP session */
1318                                         /* BB check if reconnection needed */
1319                                         cFYI(1,("IP match, old UNC: %s new: %s",
1320                                               tcon->treeName, uncName));
1321                                         if (strncmp
1322                                             (tcon->treeName, uncName,
1323                                              MAX_TREE_SIZE) == 0) {
1324                                                 cFYI(1,
1325                                                      ("and old usr: %s new: %s",
1326                                                       tcon->treeName, uncName));
1327                                                 if (strncmp
1328                                                     (tcon->ses->userName,
1329                                                      userName,
1330                                                      MAX_USERNAME_SIZE) == 0) {
1331                                                         read_unlock(&GlobalSMBSeslock);
1332                                                         /* matched smb session
1333                                                         (user name */
1334                                                         return tcon;
1335                                                 }
1336                                         }
1337                                 }
1338                         }
1339                 }
1340         }
1341         read_unlock(&GlobalSMBSeslock);
1342         return NULL;
1343 }
1344
1345 int
1346 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1347                     const char *old_path, const struct nls_table *nls_codepage,
1348                     int remap)
1349 {
1350         unsigned char *referrals = NULL;
1351         unsigned int num_referrals;
1352         int rc = 0;
1353
1354         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1355                         &num_referrals, &referrals, remap);
1356
1357         /* BB Add in code to: if valid refrl, if not ip address contact
1358                 the helper that resolves tcp names, mount to it, try to
1359                 tcon to it unmount it if fail */
1360
1361         kfree(referrals);
1362
1363         return rc;
1364 }
1365
1366 int
1367 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1368                         const char *old_path, const struct nls_table *nls_codepage,
1369                         unsigned int *pnum_referrals,
1370                         unsigned char ** preferrals, int remap)
1371 {
1372         char *temp_unc;
1373         int rc = 0;
1374
1375         *pnum_referrals = 0;
1376
1377         if (pSesInfo->ipc_tid == 0) {
1378                 temp_unc = kmalloc(2 /* for slashes */ +
1379                         strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1380                                  + 1 + 4 /* slash IPC$ */  + 2,
1381                                 GFP_KERNEL);
1382                 if (temp_unc == NULL)
1383                         return -ENOMEM;
1384                 temp_unc[0] = '\\';
1385                 temp_unc[1] = '\\';
1386                 strcpy(temp_unc + 2, pSesInfo->serverName);
1387                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1388                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1389                 cFYI(1,
1390                      ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1391                 kfree(temp_unc);
1392         }
1393         if (rc == 0)
1394                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1395                                      pnum_referrals, nls_codepage, remap);
1396
1397         return rc;
1398 }
1399
1400 /* See RFC1001 section 14 on representation of Netbios names */
1401 static void rfc1002mangle(char * target,char * source, unsigned int length)
1402 {
1403         unsigned int i,j;
1404
1405         for(i=0,j=0;i<(length);i++) {
1406                 /* mask a nibble at a time and encode */
1407                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1408                 target[j+1] = 'A' + (0x0F & source[i]);
1409                 j+=2;
1410         }
1411
1412 }
1413
1414
1415 static int
1416 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1417              char * netbios_name, char * target_name)
1418 {
1419         int rc = 0;
1420         int connected = 0;
1421         __be16 orig_port = 0;
1422
1423         if(*csocket == NULL) {
1424                 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1425                 if (rc < 0) {
1426                         cERROR(1, ("Error %d creating socket",rc));
1427                         *csocket = NULL;
1428                         return rc;
1429                 } else {
1430                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1431                         cFYI(1,("Socket created"));
1432                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1433                 }
1434         }
1435
1436         psin_server->sin_family = AF_INET;
1437         if(psin_server->sin_port) { /* user overrode default port */
1438                 rc = (*csocket)->ops->connect(*csocket,
1439                                 (struct sockaddr *) psin_server,
1440                                 sizeof (struct sockaddr_in),0);
1441                 if (rc >= 0)
1442                         connected = 1;
1443         }
1444
1445         if(!connected) {
1446                 /* save original port so we can retry user specified port
1447                         later if fall back ports fail this time  */
1448                 orig_port = psin_server->sin_port;
1449
1450                 /* do not retry on the same port we just failed on */
1451                 if(psin_server->sin_port != htons(CIFS_PORT)) {
1452                         psin_server->sin_port = htons(CIFS_PORT);
1453
1454                         rc = (*csocket)->ops->connect(*csocket,
1455                                         (struct sockaddr *) psin_server,
1456                                         sizeof (struct sockaddr_in),0);
1457                         if (rc >= 0)
1458                                 connected = 1;
1459                 }
1460         }
1461         if (!connected) {
1462                 psin_server->sin_port = htons(RFC1001_PORT);
1463                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1464                                               psin_server, sizeof (struct sockaddr_in),0);
1465                 if (rc >= 0)
1466                         connected = 1;
1467         }
1468
1469         /* give up here - unless we want to retry on different
1470                 protocol families some day */
1471         if (!connected) {
1472                 if(orig_port)
1473                         psin_server->sin_port = orig_port;
1474                 cFYI(1,("Error %d connecting to server via ipv4",rc));
1475                 sock_release(*csocket);
1476                 *csocket = NULL;
1477                 return rc;
1478         }
1479         /* Eventually check for other socket options to change from
1480                 the default. sock_setsockopt not used because it expects
1481                 user space buffer */
1482          cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1483                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1484         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1485         /* make the bufsizes depend on wsize/rsize and max requests */
1486         if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1487                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1488         if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1489                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1490
1491         /* send RFC1001 sessinit */
1492         if(psin_server->sin_port == htons(RFC1001_PORT)) {
1493                 /* some servers require RFC1001 sessinit before sending
1494                 negprot - BB check reconnection in case where second
1495                 sessinit is sent but no second negprot */
1496                 struct rfc1002_session_packet * ses_init_buf;
1497                 struct smb_hdr * smb_buf;
1498                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1499                 if(ses_init_buf) {
1500                         ses_init_buf->trailer.session_req.called_len = 32;
1501                         if(target_name && (target_name[0] != 0)) {
1502                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1503                                         target_name, 16);
1504                         } else {
1505                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1506                                         DEFAULT_CIFS_CALLED_NAME,16);
1507                         }
1508
1509                         ses_init_buf->trailer.session_req.calling_len = 32;
1510                         /* calling name ends in null (byte 16) from old smb
1511                         convention. */
1512                         if(netbios_name && (netbios_name[0] !=0)) {
1513                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1514                                         netbios_name,16);
1515                         } else {
1516                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1517                                         "LINUX_CIFS_CLNT",16);
1518                         }
1519                         ses_init_buf->trailer.session_req.scope1 = 0;
1520                         ses_init_buf->trailer.session_req.scope2 = 0;
1521                         smb_buf = (struct smb_hdr *)ses_init_buf;
1522                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1523                         smb_buf->smb_buf_length = 0x81000044;
1524                         rc = smb_send(*csocket, smb_buf, 0x44,
1525                                 (struct sockaddr *)psin_server);
1526                         kfree(ses_init_buf);
1527                         msleep(1); /* RFC1001 layer in at least one server
1528                                       requires very short break before negprot
1529                                       presumably because not expecting negprot
1530                                       to follow so fast.  This is a simple
1531                                       solution that works without
1532                                       complicating the code and causes no
1533                                       significant slowing down on mount
1534                                       for everyone else */
1535                 }
1536                 /* else the negprot may still work without this
1537                 even though malloc failed */
1538
1539         }
1540
1541         return rc;
1542 }
1543
1544 static int
1545 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1546 {
1547         int rc = 0;
1548         int connected = 0;
1549         __be16 orig_port = 0;
1550
1551         if(*csocket == NULL) {
1552                 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1553                 if (rc < 0) {
1554                         cERROR(1, ("Error %d creating ipv6 socket",rc));
1555                         *csocket = NULL;
1556                         return rc;
1557                 } else {
1558                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1559                          cFYI(1,("ipv6 Socket created"));
1560                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1561                 }
1562         }
1563
1564         psin_server->sin6_family = AF_INET6;
1565
1566         if(psin_server->sin6_port) { /* user overrode default port */
1567                 rc = (*csocket)->ops->connect(*csocket,
1568                                 (struct sockaddr *) psin_server,
1569                                 sizeof (struct sockaddr_in6),0);
1570                 if (rc >= 0)
1571                         connected = 1;
1572         }
1573
1574         if(!connected) {
1575                 /* save original port so we can retry user specified port
1576                         later if fall back ports fail this time  */
1577
1578                 orig_port = psin_server->sin6_port;
1579                 /* do not retry on the same port we just failed on */
1580                 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1581                         psin_server->sin6_port = htons(CIFS_PORT);
1582
1583                         rc = (*csocket)->ops->connect(*csocket,
1584                                         (struct sockaddr *) psin_server,
1585                                         sizeof (struct sockaddr_in6),0);
1586                         if (rc >= 0)
1587                                 connected = 1;
1588                 }
1589         }
1590         if (!connected) {
1591                 psin_server->sin6_port = htons(RFC1001_PORT);
1592                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1593                                          psin_server, sizeof (struct sockaddr_in6),0);
1594                 if (rc >= 0)
1595                         connected = 1;
1596         }
1597
1598         /* give up here - unless we want to retry on different
1599                 protocol families some day */
1600         if (!connected) {
1601                 if(orig_port)
1602                         psin_server->sin6_port = orig_port;
1603                 cFYI(1,("Error %d connecting to server via ipv6",rc));
1604                 sock_release(*csocket);
1605                 *csocket = NULL;
1606                 return rc;
1607         }
1608         /* Eventually check for other socket options to change from
1609                 the default. sock_setsockopt not used because it expects
1610                 user space buffer */
1611         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1612
1613         return rc;
1614 }
1615
1616 void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1617                           struct super_block * sb, struct smb_vol * vol_info)
1618 {
1619         /* if we are reconnecting then should we check to see if
1620          * any requested capabilities changed locally e.g. via
1621          * remount but we can not do much about it here
1622          * if they have (even if we could detect it by the following)
1623          * Perhaps we could add a backpointer to array of sb from tcon
1624          * or if we change to make all sb to same share the same
1625          * sb as NFS - then we only have one backpointer to sb.
1626          * What if we wanted to mount the server share twice once with
1627          * and once without posixacls or posix paths? */
1628         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1629
1630
1631         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1632                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1633
1634                 /* check for reconnect case in which we do not
1635                    want to change the mount behavior if we can avoid it */
1636                 if(vol_info == NULL) {
1637                         /* turn off POSIX ACL and PATHNAMES if not set
1638                            originally at mount time */
1639                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1640                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1641                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1642                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1643
1644
1645
1646
1647                 }
1648
1649                 cap &= CIFS_UNIX_CAP_MASK;
1650                 if(vol_info && vol_info->no_psx_acl)
1651                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1652                 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1653                         cFYI(1,("negotiated posix acl support"));
1654                         if(sb)
1655                                 sb->s_flags |= MS_POSIXACL;
1656                 }
1657
1658                 if(vol_info && vol_info->posix_paths == 0)
1659                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1660                 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1661                         cFYI(1,("negotiate posix pathnames"));
1662                         if(sb)
1663                                 CIFS_SB(sb)->mnt_cifs_flags |=
1664                                         CIFS_MOUNT_POSIX_PATHS;
1665                 }
1666
1667                 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1668 #ifdef CONFIG_CIFS_DEBUG2
1669                 if(cap & CIFS_UNIX_FCNTL_CAP)
1670                         cFYI(1,("FCNTL cap"));
1671                 if(cap & CIFS_UNIX_EXTATTR_CAP)
1672                         cFYI(1,("EXTATTR cap"));
1673                 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1674                         cFYI(1,("POSIX path cap"));
1675                 if(cap & CIFS_UNIX_XATTR_CAP)
1676                         cFYI(1,("XATTR cap"));
1677                 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1678                         cFYI(1,("POSIX ACL cap"));
1679 #endif /* CIFS_DEBUG2 */
1680                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1681                         cFYI(1,("setting capabilities failed"));
1682                 }
1683         }
1684 }
1685
1686 int
1687 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1688            char *mount_data, const char *devname)
1689 {
1690         int rc = 0;
1691         int xid;
1692         int address_type = AF_INET;
1693         struct socket *csocket = NULL;
1694         struct sockaddr_in sin_server;
1695         struct sockaddr_in6 sin_server6;
1696         struct smb_vol volume_info;
1697         struct cifsSesInfo *pSesInfo = NULL;
1698         struct cifsSesInfo *existingCifsSes = NULL;
1699         struct cifsTconInfo *tcon = NULL;
1700         struct TCP_Server_Info *srvTcp = NULL;
1701
1702         xid = GetXid();
1703
1704 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1705
1706         memset(&volume_info,0,sizeof(struct smb_vol));
1707         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1708                 kfree(volume_info.UNC);
1709                 kfree(volume_info.password);
1710                 kfree(volume_info.prepath);
1711                 FreeXid(xid);
1712                 return -EINVAL;
1713         }
1714
1715         if (volume_info.username) {
1716                 /* BB fixme parse for domain name here */
1717                 cFYI(1, ("Username: %s ", volume_info.username));
1718
1719         } else if (volume_info.nullauth) {
1720                 cFYI(1,("null user"));
1721         } else {
1722                 cifserror("No username specified");
1723         /* In userspace mount helper we can get user name from alternate
1724            locations such as env variables and files on disk */
1725                 kfree(volume_info.UNC);
1726                 kfree(volume_info.password);
1727                 kfree(volume_info.prepath);
1728                 FreeXid(xid);
1729                 return -EINVAL;
1730         }
1731
1732         if (volume_info.UNCip && volume_info.UNC) {
1733                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1734
1735                 if(rc <= 0) {
1736                         /* not ipv4 address, try ipv6 */
1737                         rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1738                         if(rc > 0)
1739                                 address_type = AF_INET6;
1740                 } else {
1741                         address_type = AF_INET;
1742                 }
1743
1744                 if(rc <= 0) {
1745                         /* we failed translating address */
1746                         kfree(volume_info.UNC);
1747                         kfree(volume_info.password);
1748                         kfree(volume_info.prepath);
1749                         FreeXid(xid);
1750                         return -EINVAL;
1751                 }
1752
1753                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1754                 /* success */
1755                 rc = 0;
1756         } else if (volume_info.UNCip){
1757                 /* BB using ip addr as server name connect to the DFS root below */
1758                 cERROR(1,("Connecting to DFS root not implemented yet"));
1759                 kfree(volume_info.UNC);
1760                 kfree(volume_info.password);
1761                 kfree(volume_info.prepath);
1762                 FreeXid(xid);
1763                 return -EINVAL;
1764         } else /* which servers DFS root would we conect to */ {
1765                 cERROR(1,
1766                        ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1767                 kfree(volume_info.UNC);
1768                 kfree(volume_info.password);
1769                 kfree(volume_info.prepath);
1770                 FreeXid(xid);
1771                 return -EINVAL;
1772         }
1773
1774         /* this is needed for ASCII cp to Unicode converts */
1775         if(volume_info.iocharset == NULL) {
1776                 cifs_sb->local_nls = load_nls_default();
1777         /* load_nls_default can not return null */
1778         } else {
1779                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1780                 if(cifs_sb->local_nls == NULL) {
1781                         cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1782                         kfree(volume_info.UNC);
1783                         kfree(volume_info.password);
1784                         kfree(volume_info.prepath);
1785                         FreeXid(xid);
1786                         return -ELIBACC;
1787                 }
1788         }
1789
1790         if(address_type == AF_INET)
1791                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1792                         NULL /* no ipv6 addr */,
1793                         volume_info.username, &srvTcp);
1794         else if(address_type == AF_INET6)
1795                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1796                         &sin_server6.sin6_addr,
1797                         volume_info.username, &srvTcp);
1798         else {
1799                 kfree(volume_info.UNC);
1800                 kfree(volume_info.password);
1801                 kfree(volume_info.prepath);
1802                 FreeXid(xid);
1803                 return -EINVAL;
1804         }
1805
1806
1807         if (srvTcp) {
1808                 cFYI(1, ("Existing tcp session with server found"));
1809         } else {        /* create socket */
1810                 if(volume_info.port)
1811                         sin_server.sin_port = htons(volume_info.port);
1812                 else
1813                         sin_server.sin_port = 0;
1814                 rc = ipv4_connect(&sin_server,&csocket,
1815                                   volume_info.source_rfc1001_name,
1816                                   volume_info.target_rfc1001_name);
1817                 if (rc < 0) {
1818                         cERROR(1,
1819                                ("Error connecting to IPv4 socket. Aborting operation"));
1820                         if(csocket != NULL)
1821                                 sock_release(csocket);
1822                         kfree(volume_info.UNC);
1823                         kfree(volume_info.password);
1824                         kfree(volume_info.prepath);
1825                         FreeXid(xid);
1826                         return rc;
1827                 }
1828
1829                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1830                 if (srvTcp == NULL) {
1831                         rc = -ENOMEM;
1832                         sock_release(csocket);
1833                         kfree(volume_info.UNC);
1834                         kfree(volume_info.password);
1835                         kfree(volume_info.prepath);
1836                         FreeXid(xid);
1837                         return rc;
1838                 } else {
1839                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1840                         memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1841                         atomic_set(&srvTcp->inFlight,0);
1842                         /* BB Add code for ipv6 case too */
1843                         srvTcp->ssocket = csocket;
1844                         srvTcp->protocolType = IPV4;
1845                         init_waitqueue_head(&srvTcp->response_q);
1846                         init_waitqueue_head(&srvTcp->request_q);
1847                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1848                         /* at this point we are the only ones with the pointer
1849                         to the struct since the kernel thread not created yet
1850                         so no need to spinlock this init of tcpStatus */
1851                         srvTcp->tcpStatus = CifsNew;
1852                         init_MUTEX(&srvTcp->tcpSem);
1853                         rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1854                                       CLONE_FS | CLONE_FILES | CLONE_VM);
1855                         if(rc < 0) {
1856                                 rc = -ENOMEM;
1857                                 sock_release(csocket);
1858                                 kfree(volume_info.UNC);
1859                                 kfree(volume_info.password);
1860                                 kfree(volume_info.prepath);
1861                                 FreeXid(xid);
1862                                 return rc;
1863                         }
1864                         wait_for_completion(&cifsd_complete);
1865                         rc = 0;
1866                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1867                         memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1868                         srvTcp->sequence_number = 0;
1869                 }
1870         }
1871
1872         if (existingCifsSes) {
1873                 pSesInfo = existingCifsSes;
1874                 cFYI(1, ("Existing smb sess found"));
1875                 kfree(volume_info.password);
1876                 /* volume_info.UNC freed at end of function */
1877         } else if (!rc) {
1878                 cFYI(1, ("Existing smb sess not found"));
1879                 pSesInfo = sesInfoAlloc();
1880                 if (pSesInfo == NULL)
1881                         rc = -ENOMEM;
1882                 else {
1883                         pSesInfo->server = srvTcp;
1884                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1885                                 NIPQUAD(sin_server.sin_addr.s_addr));
1886                 }
1887
1888                 if (!rc){
1889                         /* volume_info.password freed at unmount */
1890                         if (volume_info.password)
1891                                 pSesInfo->password = volume_info.password;
1892                         if (volume_info.username)
1893                                 strncpy(pSesInfo->userName,
1894                                         volume_info.username,MAX_USERNAME_SIZE);
1895                         if (volume_info.domainname) {
1896                                 int len = strlen(volume_info.domainname);
1897                                 pSesInfo->domainName =
1898                                         kmalloc(len + 1, GFP_KERNEL);
1899                                 if(pSesInfo->domainName)
1900                                         strcpy(pSesInfo->domainName,
1901                                                 volume_info.domainname);
1902                         }
1903                         pSesInfo->linux_uid = volume_info.linux_uid;
1904                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1905                         down(&pSesInfo->sesSem);
1906                         /* BB FIXME need to pass vol->secFlgs BB */
1907                         rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1908                         up(&pSesInfo->sesSem);
1909                         if(!rc)
1910                                 atomic_inc(&srvTcp->socketUseCount);
1911                 } else
1912                         kfree(volume_info.password);
1913         }
1914
1915         /* search for existing tcon to this server share */
1916         if (!rc) {
1917                 if(volume_info.rsize > CIFSMaxBufSize) {
1918                         cERROR(1,("rsize %d too large, using MaxBufSize",
1919                                 volume_info.rsize));
1920                         cifs_sb->rsize = CIFSMaxBufSize;
1921                 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1922                         cifs_sb->rsize = volume_info.rsize;
1923                 else /* default */
1924                         cifs_sb->rsize = CIFSMaxBufSize;
1925
1926                 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1927                         cERROR(1,("wsize %d too large using 4096 instead",
1928                                   volume_info.wsize));
1929                         cifs_sb->wsize = 4096;
1930                 } else if(volume_info.wsize)
1931                         cifs_sb->wsize = volume_info.wsize;
1932                 else
1933                         cifs_sb->wsize =
1934                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1935                                         127*1024);
1936                         /* old default of CIFSMaxBufSize was too small now
1937                            that SMB Write2 can send multiple pages in kvec.
1938                            RFC1001 does not describe what happens when frame
1939                            bigger than 128K is sent so use that as max in
1940                            conjunction with 52K kvec constraint on arch with 4K
1941                            page size  */
1942
1943                 if(cifs_sb->rsize < 2048) {
1944                         cifs_sb->rsize = 2048;
1945                         /* Windows ME may prefer this */
1946                         cFYI(1,("readsize set to minimum 2048"));
1947                 }
1948                 /* calculate prepath */
1949                 cifs_sb->prepath = volume_info.prepath;
1950                 if(cifs_sb->prepath) {
1951                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1952                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1953                         volume_info.prepath = NULL;
1954                 } else
1955                         cifs_sb->prepathlen = 0;
1956                 cifs_sb->mnt_uid = volume_info.linux_uid;
1957                 cifs_sb->mnt_gid = volume_info.linux_gid;
1958                 cifs_sb->mnt_file_mode = volume_info.file_mode;
1959                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1960                 cFYI(1,("file mode: 0x%x  dir mode: 0x%x",
1961                         cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1962
1963                 if(volume_info.noperm)
1964                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1965                 if(volume_info.setuids)
1966                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1967                 if(volume_info.server_ino)
1968                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1969                 if(volume_info.remap)
1970                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1971                 if(volume_info.no_xattr)
1972                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1973                 if(volume_info.sfu_emul)
1974                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1975                 if(volume_info.nobrl)
1976                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1977                 if(volume_info.cifs_acl)
1978                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1979
1980                 if(volume_info.direct_io) {
1981                         cFYI(1,("mounting share using direct i/o"));
1982                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1983                 }
1984
1985                 tcon =
1986                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1987                              volume_info.username);
1988                 if (tcon) {
1989                         cFYI(1, ("Found match on UNC path"));
1990                         /* we can have only one retry value for a connection
1991                            to a share so for resources mounted more than once
1992                            to the same server share the last value passed in
1993                            for the retry flag is used */
1994                         tcon->retry = volume_info.retry;
1995                         tcon->nocase = volume_info.nocase;
1996                 } else {
1997                         tcon = tconInfoAlloc();
1998                         if (tcon == NULL)
1999                                 rc = -ENOMEM;
2000                         else {
2001                                 /* check for null share name ie connecting to
2002                                  * dfs root */
2003
2004                                 /* BB check if this works for exactly length
2005                                  * three strings */
2006                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2007                                     && (strchr(volume_info.UNC + 3, '/') ==
2008                                         NULL)) {
2009                                         rc = connect_to_dfs_path(xid, pSesInfo,
2010                                                 "", cifs_sb->local_nls,
2011                                                 cifs_sb->mnt_cifs_flags &
2012                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2013                                         kfree(volume_info.UNC);
2014                                         FreeXid(xid);
2015                                         return -ENODEV;
2016                                 } else {
2017                                         /* BB Do we need to wrap sesSem around
2018                                          * this TCon call and Unix SetFS as
2019                                          * we do on SessSetup and reconnect? */
2020                                         rc = CIFSTCon(xid, pSesInfo,
2021                                                 volume_info.UNC,
2022                                                 tcon, cifs_sb->local_nls);
2023                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
2024                                 }
2025                                 if (!rc) {
2026                                         atomic_inc(&pSesInfo->inUse);
2027                                         tcon->retry = volume_info.retry;
2028                                         tcon->nocase = volume_info.nocase;
2029                                 }
2030                         }
2031                 }
2032         }
2033         if(pSesInfo) {
2034                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2035                         sb->s_maxbytes = (u64) 1 << 63;
2036                 } else
2037                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2038         }
2039
2040         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2041         sb->s_time_gran = 100;
2042
2043 /* on error free sesinfo and tcon struct if needed */
2044         if (rc) {
2045                 /* if session setup failed, use count is zero but
2046                 we still need to free cifsd thread */
2047                 if(atomic_read(&srvTcp->socketUseCount) == 0) {
2048                         spin_lock(&GlobalMid_Lock);
2049                         srvTcp->tcpStatus = CifsExiting;
2050                         spin_unlock(&GlobalMid_Lock);
2051                         if(srvTcp->tsk) {
2052                                 send_sig(SIGKILL,srvTcp->tsk,1);
2053                                 wait_for_completion(&cifsd_complete);
2054                         }
2055                 }
2056                  /* If find_unc succeeded then rc == 0 so we can not end */
2057                 if (tcon)  /* up accidently freeing someone elses tcon struct */
2058                         tconInfoFree(tcon);
2059                 if (existingCifsSes == NULL) {
2060                         if (pSesInfo) {
2061                                 if ((pSesInfo->server) &&
2062                                     (pSesInfo->status == CifsGood)) {
2063                                         int temp_rc;
2064                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2065                                         /* if the socketUseCount is now zero */
2066                                         if((temp_rc == -ESHUTDOWN) &&
2067                                            (pSesInfo->server->tsk)) {
2068                                                 send_sig(SIGKILL,pSesInfo->server->tsk,1);
2069                                                 wait_for_completion(&cifsd_complete);
2070                                         }
2071                                 } else
2072                                         cFYI(1, ("No session or bad tcon"));
2073                                 sesInfoFree(pSesInfo);
2074                                 /* pSesInfo = NULL; */
2075                         }
2076                 }
2077         } else {
2078                 atomic_inc(&tcon->useCount);
2079                 cifs_sb->tcon = tcon;
2080                 tcon->ses = pSesInfo;
2081
2082                 /* do not care if following two calls succeed - informational */
2083                 CIFSSMBQFSDeviceInfo(xid, tcon);
2084                 CIFSSMBQFSAttributeInfo(xid, tcon);
2085
2086                 /* tell server which Unix caps we support */
2087                 if (tcon->ses->capabilities & CAP_UNIX)
2088                         reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2089
2090                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2091                         cifs_sb->wsize = min(cifs_sb->wsize,
2092                                              (tcon->ses->server->maxBuf -
2093                                               MAX_CIFS_HDR_SIZE));
2094                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2095                         cifs_sb->rsize = min(cifs_sb->rsize,
2096                                              (tcon->ses->server->maxBuf -
2097                                               MAX_CIFS_HDR_SIZE));
2098         }
2099
2100         /* volume_info.password is freed above when existing session found
2101         (in which case it is not needed anymore) but when new sesion is created
2102         the password ptr is put in the new session structure (in which case the
2103         password will be freed at unmount time) */
2104         kfree(volume_info.UNC);
2105         kfree(volume_info.prepath);
2106         FreeXid(xid);
2107         return rc;
2108 }
2109
2110 static int
2111 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2112               char session_key[CIFS_SESS_KEY_SIZE],
2113               const struct nls_table *nls_codepage)
2114 {
2115         struct smb_hdr *smb_buffer;
2116         struct smb_hdr *smb_buffer_response;
2117         SESSION_SETUP_ANDX *pSMB;
2118         SESSION_SETUP_ANDX *pSMBr;
2119         char *bcc_ptr;
2120         char *user;
2121         char *domain;
2122         int rc = 0;
2123         int remaining_words = 0;
2124         int bytes_returned = 0;
2125         int len;
2126         __u32 capabilities;
2127         __u16 count;
2128
2129         cFYI(1, ("In sesssetup"));
2130         if(ses == NULL)
2131                 return -EINVAL;
2132         user = ses->userName;
2133         domain = ses->domainName;
2134         smb_buffer = cifs_buf_get();
2135         if (smb_buffer == NULL) {
2136                 return -ENOMEM;
2137         }
2138         smb_buffer_response = smb_buffer;
2139         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2140
2141         /* send SMBsessionSetup here */
2142         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2143                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2144
2145         smb_buffer->Mid = GetNextMid(ses->server);
2146         pSMB->req_no_secext.AndXCommand = 0xFF;
2147         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2148         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2149
2150         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2151                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2152
2153         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2154                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2155         if (ses->capabilities & CAP_UNICODE) {
2156                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2157                 capabilities |= CAP_UNICODE;
2158         }
2159         if (ses->capabilities & CAP_STATUS32) {
2160                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2161                 capabilities |= CAP_STATUS32;
2162         }
2163         if (ses->capabilities & CAP_DFS) {
2164                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2165                 capabilities |= CAP_DFS;
2166         }
2167         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2168
2169         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2170                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2171
2172         pSMB->req_no_secext.CaseSensitivePasswordLength =
2173             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2174         bcc_ptr = pByteArea(smb_buffer);
2175         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2176         bcc_ptr += CIFS_SESS_KEY_SIZE;
2177         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2178         bcc_ptr += CIFS_SESS_KEY_SIZE;
2179
2180         if (ses->capabilities & CAP_UNICODE) {
2181                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2182                         *bcc_ptr = 0;
2183                         bcc_ptr++;
2184                 }
2185                 if(user == NULL)
2186                         bytes_returned = 0; /* skip null user */
2187                 else
2188                         bytes_returned =
2189                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2190                                         nls_codepage);
2191                 /* convert number of 16 bit words to bytes */
2192                 bcc_ptr += 2 * bytes_returned;
2193                 bcc_ptr += 2;   /* trailing null */
2194                 if (domain == NULL)
2195                         bytes_returned =
2196                             cifs_strtoUCS((__le16 *) bcc_ptr,
2197                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2198                 else
2199                         bytes_returned =
2200                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2201                                           nls_codepage);
2202                 bcc_ptr += 2 * bytes_returned;
2203                 bcc_ptr += 2;
2204                 bytes_returned =
2205                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2206                                   32, nls_codepage);
2207                 bcc_ptr += 2 * bytes_returned;
2208                 bytes_returned =
2209                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2210                                   32, nls_codepage);
2211                 bcc_ptr += 2 * bytes_returned;
2212                 bcc_ptr += 2;
2213                 bytes_returned =
2214                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2215                                   64, nls_codepage);
2216                 bcc_ptr += 2 * bytes_returned;
2217                 bcc_ptr += 2;
2218         } else {
2219                 if(user != NULL) {
2220                     strncpy(bcc_ptr, user, 200);
2221                     bcc_ptr += strnlen(user, 200);
2222                 }
2223                 *bcc_ptr = 0;
2224                 bcc_ptr++;
2225                 if (domain == NULL) {
2226                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2227                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2228                 } else {
2229                         strncpy(bcc_ptr, domain, 64);
2230                         bcc_ptr += strnlen(domain, 64);
2231                         *bcc_ptr = 0;
2232                         bcc_ptr++;
2233                 }
2234                 strcpy(bcc_ptr, "Linux version ");
2235                 bcc_ptr += strlen("Linux version ");
2236                 strcpy(bcc_ptr, utsname()->release);
2237                 bcc_ptr += strlen(utsname()->release) + 1;
2238                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2239                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2240         }
2241         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2242         smb_buffer->smb_buf_length += count;
2243         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2244
2245         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2246                          &bytes_returned, 1);
2247         if (rc) {
2248 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2249         } else if ((smb_buffer_response->WordCount == 3)
2250                    || (smb_buffer_response->WordCount == 4)) {
2251                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2252                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2253                 if (action & GUEST_LOGIN)
2254                         cFYI(1, (" Guest login"));      /* do we want to mark SesInfo struct ? */
2255                 ses->Suid = smb_buffer_response->Uid;   /* UID left in wire format (le) */
2256                 cFYI(1, ("UID = %d ", ses->Suid));
2257          /* response can have either 3 or 4 word count - Samba sends 3 */
2258                 bcc_ptr = pByteArea(smb_buffer_response);
2259                 if ((pSMBr->resp.hdr.WordCount == 3)
2260                     || ((pSMBr->resp.hdr.WordCount == 4)
2261                         && (blob_len < pSMBr->resp.ByteCount))) {
2262                         if (pSMBr->resp.hdr.WordCount == 4)
2263                                 bcc_ptr += blob_len;
2264
2265                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2266                                 if ((long) (bcc_ptr) % 2) {
2267                                         remaining_words =
2268                                             (BCC(smb_buffer_response) - 1) /2;
2269                                         bcc_ptr++;      /* Unicode strings must be word aligned */
2270                                 } else {
2271                                         remaining_words =
2272                                                 BCC(smb_buffer_response) / 2;
2273                                 }
2274                                 len =
2275                                     UniStrnlen((wchar_t *) bcc_ptr,
2276                                                remaining_words - 1);
2277 /* We look for obvious messed up bcc or strings in response so we do not go off
2278    the end since (at least) WIN2K and Windows XP have a major bug in not null
2279    terminating last Unicode string in response  */
2280                                 if(ses->serverOS)
2281                                         kfree(ses->serverOS);
2282                                 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2283                                 if(ses->serverOS == NULL)
2284                                         goto sesssetup_nomem;
2285                                 cifs_strfromUCS_le(ses->serverOS,
2286                                            (__le16 *)bcc_ptr, len,nls_codepage);
2287                                 bcc_ptr += 2 * (len + 1);
2288                                 remaining_words -= len + 1;
2289                                 ses->serverOS[2 * len] = 0;
2290                                 ses->serverOS[1 + (2 * len)] = 0;
2291                                 if (remaining_words > 0) {
2292                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2293                                                          remaining_words-1);
2294                                         kfree(ses->serverNOS);
2295                                         ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2296                                         if(ses->serverNOS == NULL)
2297                                                 goto sesssetup_nomem;
2298                                         cifs_strfromUCS_le(ses->serverNOS,
2299                                                            (__le16 *)bcc_ptr,len,nls_codepage);
2300                                         bcc_ptr += 2 * (len + 1);
2301                                         ses->serverNOS[2 * len] = 0;
2302                                         ses->serverNOS[1 + (2 * len)] = 0;
2303                                         if(strncmp(ses->serverNOS,
2304                                                 "NT LAN Manager 4",16) == 0) {
2305                                                 cFYI(1,("NT4 server"));
2306                                                 ses->flags |= CIFS_SES_NT4;
2307                                         }
2308                                         remaining_words -= len + 1;
2309                                         if (remaining_words > 0) {
2310                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2311           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2312                                                 if(ses->serverDomain)
2313                                                         kfree(ses->serverDomain);
2314                                                 ses->serverDomain =
2315                                                     kzalloc(2*(len+1),GFP_KERNEL);
2316                                                 if(ses->serverDomain == NULL)
2317                                                         goto sesssetup_nomem;
2318                                                 cifs_strfromUCS_le(ses->serverDomain,
2319                                                      (__le16 *)bcc_ptr,len,nls_codepage);
2320                                                 bcc_ptr += 2 * (len + 1);
2321                                                 ses->serverDomain[2*len] = 0;
2322                                                 ses->serverDomain[1+(2*len)] = 0;
2323                                         } /* else no more room so create dummy domain string */
2324                                         else {
2325                                                 if(ses->serverDomain)
2326                                                         kfree(ses->serverDomain);
2327                                                 ses->serverDomain =
2328                                                         kzalloc(2, GFP_KERNEL);
2329                                         }
2330                                 } else {        /* no room so create dummy domain and NOS string */
2331                                         /* if these kcallocs fail not much we
2332                                            can do, but better to not fail the
2333                                            sesssetup itself */
2334                                         kfree(ses->serverDomain);
2335                                         ses->serverDomain =
2336                                             kzalloc(2, GFP_KERNEL);
2337                                         kfree(ses->serverNOS);
2338                                         ses->serverNOS =
2339                                             kzalloc(2, GFP_KERNEL);
2340                                 }
2341                         } else {        /* ASCII */
2342                                 len = strnlen(bcc_ptr, 1024);
2343                                 if (((long) bcc_ptr + len) - (long)
2344                                     pByteArea(smb_buffer_response)
2345                                             <= BCC(smb_buffer_response)) {
2346                                         kfree(ses->serverOS);
2347                                         ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2348                                         if(ses->serverOS == NULL)
2349                                                 goto sesssetup_nomem;
2350                                         strncpy(ses->serverOS,bcc_ptr, len);
2351
2352                                         bcc_ptr += len;
2353                                         bcc_ptr[0] = 0; /* null terminate the string */
2354                                         bcc_ptr++;
2355
2356                                         len = strnlen(bcc_ptr, 1024);
2357                                         kfree(ses->serverNOS);
2358                                         ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2359                                         if(ses->serverNOS == NULL)
2360                                                 goto sesssetup_nomem;
2361                                         strncpy(ses->serverNOS, bcc_ptr, len);
2362                                         bcc_ptr += len;
2363                                         bcc_ptr[0] = 0;
2364                                         bcc_ptr++;
2365
2366                                         len = strnlen(bcc_ptr, 1024);
2367                                         if(ses->serverDomain)
2368                                                 kfree(ses->serverDomain);
2369                                         ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2370                                         if(ses->serverDomain == NULL)
2371                                                 goto sesssetup_nomem;
2372                                         strncpy(ses->serverDomain, bcc_ptr, len);
2373                                         bcc_ptr += len;
2374                                         bcc_ptr[0] = 0;
2375                                         bcc_ptr++;
2376                                 } else
2377                                         cFYI(1,
2378                                              ("Variable field of length %d extends beyond end of smb ",
2379                                               len));
2380                         }
2381                 } else {
2382                         cERROR(1,
2383                                (" Security Blob Length extends beyond end of SMB"));
2384                 }
2385         } else {
2386                 cERROR(1,
2387                        (" Invalid Word count %d: ",
2388                         smb_buffer_response->WordCount));
2389                 rc = -EIO;
2390         }
2391 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2392                            since that could make reconnection harder, and
2393                            reconnection might be needed to free memory */
2394         if (smb_buffer)
2395                 cifs_buf_release(smb_buffer);
2396
2397         return rc;
2398 }
2399
2400 static int
2401 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2402                               struct cifsSesInfo *ses, int * pNTLMv2_flag,
2403                               const struct nls_table *nls_codepage)
2404 {
2405         struct smb_hdr *smb_buffer;
2406         struct smb_hdr *smb_buffer_response;
2407         SESSION_SETUP_ANDX *pSMB;
2408         SESSION_SETUP_ANDX *pSMBr;
2409         char *bcc_ptr;
2410         char *domain;
2411         int rc = 0;
2412         int remaining_words = 0;
2413         int bytes_returned = 0;
2414         int len;
2415         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2416         PNEGOTIATE_MESSAGE SecurityBlob;
2417         PCHALLENGE_MESSAGE SecurityBlob2;
2418         __u32 negotiate_flags, capabilities;
2419         __u16 count;
2420
2421         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2422         if(ses == NULL)
2423                 return -EINVAL;
2424         domain = ses->domainName;
2425         *pNTLMv2_flag = FALSE;
2426         smb_buffer = cifs_buf_get();
2427         if (smb_buffer == NULL) {
2428                 return -ENOMEM;
2429         }
2430         smb_buffer_response = smb_buffer;
2431         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2432         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2433
2434         /* send SMBsessionSetup here */
2435         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2436                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2437
2438         smb_buffer->Mid = GetNextMid(ses->server);
2439         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2440         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2441
2442         pSMB->req.AndXCommand = 0xFF;
2443         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2444         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2445
2446         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2447                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2448
2449         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2450             CAP_EXTENDED_SECURITY;
2451         if (ses->capabilities & CAP_UNICODE) {
2452                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2453                 capabilities |= CAP_UNICODE;
2454         }
2455         if (ses->capabilities & CAP_STATUS32) {
2456                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2457                 capabilities |= CAP_STATUS32;
2458         }
2459         if (ses->capabilities & CAP_DFS) {
2460                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2461                 capabilities |= CAP_DFS;
2462         }
2463         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2464
2465         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2466         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2467         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2468         SecurityBlob->MessageType = NtLmNegotiate;
2469         negotiate_flags =
2470             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2471             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2472             NTLMSSP_NEGOTIATE_56 |
2473             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2474         if(sign_CIFS_PDUs)
2475                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2476 /*      if(ntlmv2_support)
2477                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2478         /* setup pointers to domain name and workstation name */
2479         bcc_ptr += SecurityBlobLength;
2480
2481         SecurityBlob->WorkstationName.Buffer = 0;
2482         SecurityBlob->WorkstationName.Length = 0;
2483         SecurityBlob->WorkstationName.MaximumLength = 0;
2484
2485         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2486         along with username on auth request (ie the response to challenge) */
2487         SecurityBlob->DomainName.Buffer = 0;
2488         SecurityBlob->DomainName.Length = 0;
2489         SecurityBlob->DomainName.MaximumLength = 0;
2490         if (ses->capabilities & CAP_UNICODE) {
2491                 if ((long) bcc_ptr % 2) {
2492                         *bcc_ptr = 0;
2493                         bcc_ptr++;
2494                 }
2495
2496                 bytes_returned =
2497                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2498                                   32, nls_codepage);
2499                 bcc_ptr += 2 * bytes_returned;
2500                 bytes_returned =
2501                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2502                                   nls_codepage);
2503                 bcc_ptr += 2 * bytes_returned;
2504                 bcc_ptr += 2;   /* null terminate Linux version */
2505                 bytes_returned =
2506                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2507                                   64, nls_codepage);
2508                 bcc_ptr += 2 * bytes_returned;
2509                 *(bcc_ptr + 1) = 0;
2510                 *(bcc_ptr + 2) = 0;
2511                 bcc_ptr += 2;   /* null terminate network opsys string */
2512                 *(bcc_ptr + 1) = 0;
2513                 *(bcc_ptr + 2) = 0;
2514                 bcc_ptr += 2;   /* null domain */
2515         } else {                /* ASCII */
2516                 strcpy(bcc_ptr, "Linux version ");
2517                 bcc_ptr += strlen("Linux version ");
2518                 strcpy(bcc_ptr, utsname()->release);
2519                 bcc_ptr += strlen(utsname()->release) + 1;
2520                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2521                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2522                 bcc_ptr++;      /* empty domain field */
2523                 *bcc_ptr = 0;
2524         }
2525         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2526         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2527         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2528         smb_buffer->smb_buf_length += count;
2529         pSMB->req.ByteCount = cpu_to_le16(count);
2530
2531         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2532                          &bytes_returned, 1);
2533
2534         if (smb_buffer_response->Status.CifsError ==
2535             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2536                 rc = 0;
2537
2538         if (rc) {
2539 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2540         } else if ((smb_buffer_response->WordCount == 3)
2541                    || (smb_buffer_response->WordCount == 4)) {
2542                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2543                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2544
2545                 if (action & GUEST_LOGIN)
2546                         cFYI(1, (" Guest login"));
2547         /* Do we want to set anything in SesInfo struct when guest login? */
2548
2549                 bcc_ptr = pByteArea(smb_buffer_response);
2550         /* response can have either 3 or 4 word count - Samba sends 3 */
2551
2552                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2553                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2554                         cFYI(1,
2555                              ("Unexpected NTLMSSP message type received %d",
2556                               SecurityBlob2->MessageType));
2557                 } else if (ses) {
2558                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2559                         cFYI(1, ("UID = %d", ses->Suid));
2560                         if ((pSMBr->resp.hdr.WordCount == 3)
2561                             || ((pSMBr->resp.hdr.WordCount == 4)
2562                                 && (blob_len <
2563                                     pSMBr->resp.ByteCount))) {
2564
2565                                 if (pSMBr->resp.hdr.WordCount == 4) {
2566                                         bcc_ptr += blob_len;
2567                                         cFYI(1, ("Security Blob Length %d",
2568                                               blob_len));
2569                                 }
2570
2571                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2572
2573                                 memcpy(ses->server->cryptKey,
2574                                        SecurityBlob2->Challenge,
2575                                        CIFS_CRYPTO_KEY_SIZE);
2576                                 if(SecurityBlob2->NegotiateFlags &
2577                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2578                                         *pNTLMv2_flag = TRUE;
2579
2580                                 if((SecurityBlob2->NegotiateFlags &
2581                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2582                                         || (sign_CIFS_PDUs > 1))
2583                                                 ses->server->secMode |=
2584                                                         SECMODE_SIGN_REQUIRED;
2585                                 if ((SecurityBlob2->NegotiateFlags &
2586                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2587                                                 ses->server->secMode |=
2588                                                         SECMODE_SIGN_ENABLED;
2589
2590                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2591                                         if ((long) (bcc_ptr) % 2) {
2592                                                 remaining_words =
2593                                                     (BCC(smb_buffer_response)
2594                                                      - 1) / 2;
2595                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2596                                         } else {
2597                                                 remaining_words =
2598                                                     BCC
2599                                                     (smb_buffer_response) / 2;
2600                                         }
2601                                         len =
2602                                             UniStrnlen((wchar_t *) bcc_ptr,
2603                                                        remaining_words - 1);
2604 /* We look for obvious messed up bcc or strings in response so we do not go off
2605    the end since (at least) WIN2K and Windows XP have a major bug in not null
2606    terminating last Unicode string in response  */
2607                                         if(ses->serverOS)
2608                                                 kfree(ses->serverOS);
2609                                         ses->serverOS =
2610                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2611                                         cifs_strfromUCS_le(ses->serverOS,
2612                                                            (__le16 *)
2613                                                            bcc_ptr, len,
2614                                                            nls_codepage);
2615                                         bcc_ptr += 2 * (len + 1);
2616                                         remaining_words -= len + 1;
2617                                         ses->serverOS[2 * len] = 0;
2618                                         ses->serverOS[1 + (2 * len)] = 0;
2619                                         if (remaining_words > 0) {
2620                                                 len = UniStrnlen((wchar_t *)
2621                                                                  bcc_ptr,
2622                                                                  remaining_words
2623                                                                  - 1);
2624                                                 kfree(ses->serverNOS);
2625                                                 ses->serverNOS =
2626                                                     kzalloc(2 * (len + 1),
2627                                                             GFP_KERNEL);
2628                                                 cifs_strfromUCS_le(ses->
2629                                                                    serverNOS,
2630                                                                    (__le16 *)
2631                                                                    bcc_ptr,
2632                                                                    len,
2633                                                                    nls_codepage);
2634                                                 bcc_ptr += 2 * (len + 1);
2635                                                 ses->serverNOS[2 * len] = 0;
2636                                                 ses->serverNOS[1 +
2637                                                                (2 * len)] = 0;
2638                                                 remaining_words -= len + 1;
2639                                                 if (remaining_words > 0) {
2640                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2641            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2642                                                         kfree(ses->serverDomain);
2643                                                         ses->serverDomain =
2644                                                             kzalloc(2 *
2645                                                                     (len +
2646                                                                      1),
2647                                                                     GFP_KERNEL);
2648                                                         cifs_strfromUCS_le
2649                                                             (ses->serverDomain,
2650                                                              (__le16 *)bcc_ptr,
2651                                                              len, nls_codepage);
2652                                                         bcc_ptr +=
2653                                                             2 * (len + 1);
2654                                                         ses->serverDomain[2*len]
2655                                                             = 0;
2656                                                         ses->serverDomain
2657                                                                 [1 + (2 * len)]
2658                                                             = 0;
2659                                                 } /* else no more room so create dummy domain string */
2660                                                 else {
2661                                                         kfree(ses->serverDomain);
2662                                                         ses->serverDomain =
2663                                                             kzalloc(2,
2664                                                                     GFP_KERNEL);
2665                                                 }
2666                                         } else {        /* no room so create dummy domain and NOS string */
2667                                                 kfree(ses->serverDomain);
2668                                                 ses->serverDomain =
2669                                                     kzalloc(2, GFP_KERNEL);
2670                                                 kfree(ses->serverNOS);
2671                                                 ses->serverNOS =
2672                                                     kzalloc(2, GFP_KERNEL);
2673                                         }
2674                                 } else {        /* ASCII */
2675                                         len = strnlen(bcc_ptr, 1024);
2676                                         if (((long) bcc_ptr + len) - (long)
2677                                             pByteArea(smb_buffer_response)
2678                                             <= BCC(smb_buffer_response)) {
2679                                                 if(ses->serverOS)
2680                                                         kfree(ses->serverOS);
2681                                                 ses->serverOS =
2682                                                     kzalloc(len + 1,
2683                                                             GFP_KERNEL);
2684                                                 strncpy(ses->serverOS,
2685                                                         bcc_ptr, len);
2686
2687                                                 bcc_ptr += len;
2688                                                 bcc_ptr[0] = 0; /* null terminate string */
2689                                                 bcc_ptr++;
2690
2691                                                 len = strnlen(bcc_ptr, 1024);
2692                                                 kfree(ses->serverNOS);
2693                                                 ses->serverNOS =
2694                                                     kzalloc(len + 1,
2695                                                             GFP_KERNEL);
2696                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2697                                                 bcc_ptr += len;
2698                                                 bcc_ptr[0] = 0;
2699                                                 bcc_ptr++;
2700
2701                                                 len = strnlen(bcc_ptr, 1024);
2702                                                 kfree(ses->serverDomain);
2703                                                 ses->serverDomain =
2704                                                     kzalloc(len + 1,
2705                                                             GFP_KERNEL);
2706                                                 strncpy(ses->serverDomain, bcc_ptr, len);
2707                                                 bcc_ptr += len;
2708                                                 bcc_ptr[0] = 0;
2709                                                 bcc_ptr++;
2710                                         } else
2711                                                 cFYI(1,
2712                                                      ("Variable field of length %d extends beyond end of smb",
2713                                                       len));
2714                                 }
2715                         } else {
2716                                 cERROR(1,
2717                                        (" Security Blob Length extends beyond end of SMB"));
2718                         }
2719                 } else {
2720                         cERROR(1, ("No session structure passed in."));
2721                 }
2722         } else {
2723                 cERROR(1,
2724                        (" Invalid Word count %d:",
2725                         smb_buffer_response->WordCount));
2726                 rc = -EIO;
2727         }
2728
2729         if (smb_buffer)
2730                 cifs_buf_release(smb_buffer);
2731
2732         return rc;
2733 }
2734 static int
2735 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2736                 char *ntlm_session_key, int ntlmv2_flag,
2737                 const struct nls_table *nls_codepage)
2738 {
2739         struct smb_hdr *smb_buffer;
2740         struct smb_hdr *smb_buffer_response;
2741         SESSION_SETUP_ANDX *pSMB;
2742         SESSION_SETUP_ANDX *pSMBr;
2743         char *bcc_ptr;
2744         char *user;
2745         char *domain;
2746         int rc = 0;
2747         int remaining_words = 0;
2748         int bytes_returned = 0;
2749         int len;
2750         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2751         PAUTHENTICATE_MESSAGE SecurityBlob;
2752         __u32 negotiate_flags, capabilities;
2753         __u16 count;
2754
2755         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2756         if(ses == NULL)
2757                 return -EINVAL;
2758         user = ses->userName;
2759         domain = ses->domainName;
2760         smb_buffer = cifs_buf_get();
2761         if (smb_buffer == NULL) {
2762                 return -ENOMEM;
2763         }
2764         smb_buffer_response = smb_buffer;
2765         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2766         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2767
2768         /* send SMBsessionSetup here */
2769         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2770                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2771
2772         smb_buffer->Mid = GetNextMid(ses->server);
2773         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2774         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2775         pSMB->req.AndXCommand = 0xFF;
2776         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2777         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2778
2779         pSMB->req.hdr.Uid = ses->Suid;
2780
2781         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2782                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2783
2784         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2785             CAP_EXTENDED_SECURITY;
2786         if (ses->capabilities & CAP_UNICODE) {
2787                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2788                 capabilities |= CAP_UNICODE;
2789         }
2790         if (ses->capabilities & CAP_STATUS32) {
2791                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2792                 capabilities |= CAP_STATUS32;
2793         }
2794         if (ses->capabilities & CAP_DFS) {
2795                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2796                 capabilities |= CAP_DFS;
2797         }
2798         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2799
2800         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2801         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2802         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2803         SecurityBlob->MessageType = NtLmAuthenticate;
2804         bcc_ptr += SecurityBlobLength;
2805         negotiate_flags =
2806             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2807             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2808             0x80000000 | NTLMSSP_NEGOTIATE_128;
2809         if(sign_CIFS_PDUs)
2810                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2811         if(ntlmv2_flag)
2812                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2813
2814 /* setup pointers to domain name and workstation name */
2815
2816         SecurityBlob->WorkstationName.Buffer = 0;
2817         SecurityBlob->WorkstationName.Length = 0;
2818         SecurityBlob->WorkstationName.MaximumLength = 0;
2819         SecurityBlob->SessionKey.Length = 0;
2820         SecurityBlob->SessionKey.MaximumLength = 0;
2821         SecurityBlob->SessionKey.Buffer = 0;
2822
2823         SecurityBlob->LmChallengeResponse.Length = 0;
2824         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2825         SecurityBlob->LmChallengeResponse.Buffer = 0;
2826
2827         SecurityBlob->NtChallengeResponse.Length =
2828             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2829         SecurityBlob->NtChallengeResponse.MaximumLength =
2830             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2831         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2832         SecurityBlob->NtChallengeResponse.Buffer =
2833             cpu_to_le32(SecurityBlobLength);
2834         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2835         bcc_ptr += CIFS_SESS_KEY_SIZE;
2836
2837         if (ses->capabilities & CAP_UNICODE) {
2838                 if (domain == NULL) {
2839                         SecurityBlob->DomainName.Buffer = 0;
2840                         SecurityBlob->DomainName.Length = 0;
2841                         SecurityBlob->DomainName.MaximumLength = 0;
2842                 } else {
2843                         __u16 len =
2844                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2845                                           nls_codepage);
2846                         len *= 2;
2847                         SecurityBlob->DomainName.MaximumLength =
2848                             cpu_to_le16(len);
2849                         SecurityBlob->DomainName.Buffer =
2850                             cpu_to_le32(SecurityBlobLength);
2851                         bcc_ptr += len;
2852                         SecurityBlobLength += len;
2853                         SecurityBlob->DomainName.Length =
2854                             cpu_to_le16(len);
2855                 }
2856                 if (user == NULL) {
2857                         SecurityBlob->UserName.Buffer = 0;
2858                         SecurityBlob->UserName.Length = 0;
2859                         SecurityBlob->UserName.MaximumLength = 0;
2860                 } else {
2861                         __u16 len =
2862                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2863                                           nls_codepage);
2864                         len *= 2;
2865                         SecurityBlob->UserName.MaximumLength =
2866                             cpu_to_le16(len);
2867                         SecurityBlob->UserName.Buffer =
2868                             cpu_to_le32(SecurityBlobLength);
2869                         bcc_ptr += len;
2870                         SecurityBlobLength += len;
2871                         SecurityBlob->UserName.Length =
2872                             cpu_to_le16(len);
2873                 }
2874
2875                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2876                    SecurityBlob->WorkstationName.Length *= 2;
2877                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2878                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2879                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2880                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2881                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
2882
2883                 if ((long) bcc_ptr % 2) {
2884                         *bcc_ptr = 0;
2885                         bcc_ptr++;
2886                 }
2887                 bytes_returned =
2888                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2889                                   32, nls_codepage);
2890                 bcc_ptr += 2 * bytes_returned;
2891                 bytes_returned =
2892                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2893                                   nls_codepage);
2894                 bcc_ptr += 2 * bytes_returned;
2895                 bcc_ptr += 2;   /* null term version string */
2896                 bytes_returned =
2897                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2898                                   64, nls_codepage);
2899                 bcc_ptr += 2 * bytes_returned;
2900                 *(bcc_ptr + 1) = 0;
2901                 *(bcc_ptr + 2) = 0;
2902                 bcc_ptr += 2;   /* null terminate network opsys string */
2903                 *(bcc_ptr + 1) = 0;
2904                 *(bcc_ptr + 2) = 0;
2905                 bcc_ptr += 2;   /* null domain */
2906         } else {                /* ASCII */
2907                 if (domain == NULL) {
2908                         SecurityBlob->DomainName.Buffer = 0;
2909                         SecurityBlob->DomainName.Length = 0;
2910                         SecurityBlob->DomainName.MaximumLength = 0;
2911                 } else {
2912                         __u16 len;
2913                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2914                         strncpy(bcc_ptr, domain, 63);
2915                         len = strnlen(domain, 64);
2916                         SecurityBlob->DomainName.MaximumLength =
2917                             cpu_to_le16(len);
2918                         SecurityBlob->DomainName.Buffer =
2919                             cpu_to_le32(SecurityBlobLength);
2920                         bcc_ptr += len;
2921                         SecurityBlobLength += len;
2922                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
2923                 }
2924                 if (user == NULL) {
2925                         SecurityBlob->UserName.Buffer = 0;
2926                         SecurityBlob->UserName.Length = 0;
2927                         SecurityBlob->UserName.MaximumLength = 0;
2928                 } else {
2929                         __u16 len;
2930                         strncpy(bcc_ptr, user, 63);
2931                         len = strnlen(user, 64);
2932                         SecurityBlob->UserName.MaximumLength =
2933                             cpu_to_le16(len);
2934                         SecurityBlob->UserName.Buffer =
2935                             cpu_to_le32(SecurityBlobLength);
2936                         bcc_ptr += len;
2937                         SecurityBlobLength += len;
2938                         SecurityBlob->UserName.Length = cpu_to_le16(len);
2939                 }
2940                 /* BB fill in our workstation name if known BB */
2941
2942                 strcpy(bcc_ptr, "Linux version ");
2943                 bcc_ptr += strlen("Linux version ");
2944                 strcpy(bcc_ptr, utsname()->release);
2945                 bcc_ptr += strlen(utsname()->release) + 1;
2946                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2947                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2948                 bcc_ptr++;      /* null domain */
2949                 *bcc_ptr = 0;
2950         }
2951         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2952         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2953         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2954         smb_buffer->smb_buf_length += count;
2955         pSMB->req.ByteCount = cpu_to_le16(count);
2956
2957         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2958                          &bytes_returned, 1);
2959         if (rc) {
2960 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2961         } else if ((smb_buffer_response->WordCount == 3)
2962                    || (smb_buffer_response->WordCount == 4)) {
2963                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2964                 __u16 blob_len =
2965                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2966                 if (action & GUEST_LOGIN)
2967                         cFYI(1, (" Guest login"));      /* BB do we want to set anything in SesInfo struct ? */
2968 /*        if(SecurityBlob2->MessageType != NtLm??){
2969                  cFYI("Unexpected message type on auth response is %d "));
2970         } */
2971                 if (ses) {
2972                         cFYI(1,
2973                              ("Does UID on challenge %d match auth response UID %d ",
2974                               ses->Suid, smb_buffer_response->Uid));
2975                         ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2976                         bcc_ptr = pByteArea(smb_buffer_response);
2977             /* response can have either 3 or 4 word count - Samba sends 3 */
2978                         if ((pSMBr->resp.hdr.WordCount == 3)
2979                             || ((pSMBr->resp.hdr.WordCount == 4)
2980                                 && (blob_len <
2981                                     pSMBr->resp.ByteCount))) {
2982                                 if (pSMBr->resp.hdr.WordCount == 4) {
2983                                         bcc_ptr +=
2984                                             blob_len;
2985                                         cFYI(1,
2986                                              ("Security Blob Length %d ",
2987                                               blob_len));
2988                                 }
2989
2990                                 cFYI(1,
2991                                      ("NTLMSSP response to Authenticate "));
2992
2993                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2994                                         if ((long) (bcc_ptr) % 2) {
2995                                                 remaining_words =
2996                                                     (BCC(smb_buffer_response)
2997                                                      - 1) / 2;
2998                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2999                                         } else {
3000                                                 remaining_words = BCC(smb_buffer_response) / 2;
3001                                         }
3002                                         len =
3003                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3004 /* We look for obvious messed up bcc or strings in response so we do not go off
3005   the end since (at least) WIN2K and Windows XP have a major bug in not null
3006   terminating last Unicode string in response  */
3007                                         if(ses->serverOS)
3008                                                 kfree(ses->serverOS);
3009                                         ses->serverOS =
3010                                             kzalloc(2 * (len + 1), GFP_KERNEL);
3011                                         cifs_strfromUCS_le(ses->serverOS,
3012                                                            (__le16 *)
3013                                                            bcc_ptr, len,
3014                                                            nls_codepage);
3015                                         bcc_ptr += 2 * (len + 1);
3016                                         remaining_words -= len + 1;
3017                                         ses->serverOS[2 * len] = 0;
3018                                         ses->serverOS[1 + (2 * len)] = 0;
3019                                         if (remaining_words > 0) {
3020                                                 len = UniStrnlen((wchar_t *)
3021                                                                  bcc_ptr,
3022                                                                  remaining_words
3023                                                                  - 1);
3024                                                 kfree(ses->serverNOS);
3025                                                 ses->serverNOS =
3026                                                     kzalloc(2 * (len + 1),
3027                                                             GFP_KERNEL);
3028                                                 cifs_strfromUCS_le(ses->
3029                                                                    serverNOS,
3030                                                                    (__le16 *)
3031                                                                    bcc_ptr,
3032                                                                    len,
3033                                                                    nls_codepage);
3034                                                 bcc_ptr += 2 * (len + 1);
3035                                                 ses->serverNOS[2 * len] = 0;
3036                                                 ses->serverNOS[1+(2*len)] = 0;
3037                                                 remaining_words -= len + 1;
3038                                                 if (remaining_words > 0) {
3039                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3040      /* last string not always null terminated (e.g. for Windows XP & 2000) */
3041                                                         if(ses->serverDomain)
3042                                                                 kfree(ses->serverDomain);
3043                                                         ses->serverDomain =
3044                                                             kzalloc(2 *
3045                                                                     (len +
3046                                                                      1),
3047                                                                     GFP_KERNEL);
3048                                                         cifs_strfromUCS_le
3049                                                             (ses->
3050                                                              serverDomain,
3051                                                              (__le16 *)
3052                                                              bcc_ptr, len,
3053                                                              nls_codepage);
3054                                                         bcc_ptr +=
3055                                                             2 * (len + 1);
3056                                                         ses->
3057                                                             serverDomain[2
3058                                                                          * len]
3059                                                             = 0;
3060                                                         ses->
3061                                                             serverDomain[1
3062                                                                          +
3063                                                                          (2
3064                                                                           *
3065                                                                           len)]
3066                                                             = 0;
3067                                                 } /* else no more room so create dummy domain string */
3068                                                 else {
3069                                                         if(ses->serverDomain)
3070                                                                 kfree(ses->serverDomain);
3071                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3072                                                 }
3073                                         } else {  /* no room so create dummy domain and NOS string */
3074                                                 if(ses->serverDomain)
3075                                                         kfree(ses->serverDomain);
3076                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3077                                                 kfree(ses->serverNOS);
3078                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3079                                         }
3080                                 } else {        /* ASCII */
3081                                         len = strnlen(bcc_ptr, 1024);
3082                                         if (((long) bcc_ptr + len) -
3083                         (long) pByteArea(smb_buffer_response)
3084                             <= BCC(smb_buffer_response)) {
3085                                                 if(ses->serverOS)
3086                                                         kfree(ses->serverOS);
3087                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3088                                                 strncpy(ses->serverOS,bcc_ptr, len);
3089
3090                                                 bcc_ptr += len;
3091                                                 bcc_ptr[0] = 0; /* null terminate the string */
3092                                                 bcc_ptr++;
3093
3094                                                 len = strnlen(bcc_ptr, 1024);
3095                                                 kfree(ses->serverNOS);
3096                                                 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3097                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3098                                                 bcc_ptr += len;
3099                                                 bcc_ptr[0] = 0;
3100                                                 bcc_ptr++;
3101
3102                                                 len = strnlen(bcc_ptr, 1024);
3103                                                 if(ses->serverDomain)
3104                                                         kfree(ses->serverDomain);
3105                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3106                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3107                                                 bcc_ptr += len;
3108                                                 bcc_ptr[0] = 0;
3109                                                 bcc_ptr++;
3110                                         } else
3111                                                 cFYI(1,
3112                                                      ("Variable field of length %d extends beyond end of smb ",
3113                                                       len));
3114                                 }
3115                         } else {
3116                                 cERROR(1,
3117                                        (" Security Blob Length extends beyond end of SMB"));
3118                         }
3119                 } else {
3120                         cERROR(1, ("No session structure passed in."));
3121                 }
3122         } else {
3123                 cERROR(1,
3124                        (" Invalid Word count %d: ",
3125                         smb_buffer_response->WordCount));
3126                 rc = -EIO;
3127         }
3128
3129         if (smb_buffer)
3130                 cifs_buf_release(smb_buffer);
3131
3132         return rc;
3133 }
3134
3135 int
3136 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3137          const char *tree, struct cifsTconInfo *tcon,
3138          const struct nls_table *nls_codepage)
3139 {
3140         struct smb_hdr *smb_buffer;
3141         struct smb_hdr *smb_buffer_response;
3142         TCONX_REQ *pSMB;
3143         TCONX_RSP *pSMBr;
3144         unsigned char *bcc_ptr;
3145         int rc = 0;
3146         int length;
3147         __u16 count;
3148
3149         if (ses == NULL)
3150                 return -EIO;
3151
3152         smb_buffer = cifs_buf_get();
3153         if (smb_buffer == NULL) {
3154                 return -ENOMEM;
3155         }
3156         smb_buffer_response = smb_buffer;
3157
3158         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3159                         NULL /*no tid */ , 4 /*wct */ );
3160
3161         smb_buffer->Mid = GetNextMid(ses->server);
3162         smb_buffer->Uid = ses->Suid;
3163         pSMB = (TCONX_REQ *) smb_buffer;
3164         pSMBr = (TCONX_RSP *) smb_buffer_response;
3165
3166         pSMB->AndXCommand = 0xFF;
3167         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3168         bcc_ptr = &pSMB->Password[0];
3169         if((ses->server->secMode) & SECMODE_USER) {
3170                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3171                 *bcc_ptr = 0; /* password is null byte */
3172                 bcc_ptr++;              /* skip password */
3173                 /* already aligned so no need to do it below */
3174         } else {
3175                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3176                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3177                    specified as required (when that support is added to
3178                    the vfs in the future) as only NTLM or the much
3179                    weaker LANMAN (which we do not send by default) is accepted
3180                    by Samba (not sure whether other servers allow
3181                    NTLMv2 password here) */
3182 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3183                 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3184                         (ses->server->secType == LANMAN))
3185                         calc_lanman_hash(ses, bcc_ptr);
3186                 else
3187 #endif /* CIFS_WEAK_PW_HASH */
3188                 SMBNTencrypt(ses->password,
3189                              ses->server->cryptKey,
3190                              bcc_ptr);
3191
3192                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3193                 if(ses->capabilities & CAP_UNICODE) {
3194                         /* must align unicode strings */
3195                         *bcc_ptr = 0; /* null byte password */
3196                         bcc_ptr++;
3197                 }
3198         }
3199
3200         if(ses->server->secMode &
3201                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3202                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3203
3204         if (ses->capabilities & CAP_STATUS32) {
3205                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3206         }
3207         if (ses->capabilities & CAP_DFS) {
3208                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3209         }
3210         if (ses->capabilities & CAP_UNICODE) {
3211                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3212                 length =
3213                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3214                         6 /* max utf8 char length in bytes */ *
3215                         (/* server len*/ + 256 /* share len */), nls_codepage);
3216                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3217                 bcc_ptr += 2;   /* skip trailing null */
3218         } else {                /* ASCII */
3219                 strcpy(bcc_ptr, tree);
3220                 bcc_ptr += strlen(tree) + 1;
3221         }
3222         strcpy(bcc_ptr, "?????");
3223         bcc_ptr += strlen("?????");
3224         bcc_ptr += 1;
3225         count = bcc_ptr - &pSMB->Password[0];
3226         pSMB->hdr.smb_buf_length += count;
3227         pSMB->ByteCount = cpu_to_le16(count);
3228
3229         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3230
3231         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3232         /* above now done in SendReceive */
3233         if ((rc == 0) && (tcon != NULL)) {
3234                 tcon->tidStatus = CifsGood;
3235                 tcon->tid = smb_buffer_response->Tid;
3236                 bcc_ptr = pByteArea(smb_buffer_response);
3237                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3238         /* skip service field (NB: this field is always ASCII) */
3239                 bcc_ptr += length + 1;
3240                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3241                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3242                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3243                         if ((bcc_ptr + (2 * length)) -
3244                              pByteArea(smb_buffer_response) <=
3245                             BCC(smb_buffer_response)) {
3246                                 kfree(tcon->nativeFileSystem);
3247                                 tcon->nativeFileSystem =
3248                                     kzalloc(length + 2, GFP_KERNEL);
3249                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3250                                                    (__le16 *) bcc_ptr,
3251                                                    length, nls_codepage);
3252                                 bcc_ptr += 2 * length;
3253                                 bcc_ptr[0] = 0; /* null terminate the string */
3254                                 bcc_ptr[1] = 0;
3255                                 bcc_ptr += 2;
3256                         }
3257                         /* else do not bother copying these informational fields */
3258                 } else {
3259                         length = strnlen(bcc_ptr, 1024);
3260                         if ((bcc_ptr + length) -
3261                             pByteArea(smb_buffer_response) <=
3262                             BCC(smb_buffer_response)) {
3263                                 kfree(tcon->nativeFileSystem);
3264                                 tcon->nativeFileSystem =
3265                                     kzalloc(length + 1, GFP_KERNEL);
3266                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3267                                         length);
3268                         }
3269                         /* else do not bother copying these informational fields */
3270                 }
3271                 if((smb_buffer_response->WordCount == 3) ||
3272                          (smb_buffer_response->WordCount == 7))
3273                         /* field is in same location */
3274                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3275                 else
3276                         tcon->Flags = 0;
3277                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3278         } else if ((rc == 0) && tcon == NULL) {
3279         /* all we need to save for IPC$ connection */
3280                 ses->ipc_tid = smb_buffer_response->Tid;
3281         }
3282
3283         if (smb_buffer)
3284                 cifs_buf_release(smb_buffer);
3285         return rc;
3286 }
3287
3288 int
3289 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3290 {
3291         int rc = 0;
3292         int xid;
3293         struct cifsSesInfo *ses = NULL;
3294         struct task_struct *cifsd_task;
3295         char * tmp;
3296
3297         xid = GetXid();
3298
3299         if (cifs_sb->tcon) {
3300                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3301                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3302                 if (rc == -EBUSY) {
3303                         FreeXid(xid);
3304                         return 0;
3305                 }
3306                 tconInfoFree(cifs_sb->tcon);
3307                 if ((ses) && (ses->server)) {
3308                         /* save off task so we do not refer to ses later */
3309                         cifsd_task = ses->server->tsk;
3310                         cFYI(1, ("About to do SMBLogoff "));
3311                         rc = CIFSSMBLogoff(xid, ses);
3312                         if (rc == -EBUSY) {
3313                                 FreeXid(xid);
3314                                 return 0;
3315                         } else if (rc == -ESHUTDOWN) {
3316                                 cFYI(1,("Waking up socket by sending it signal"));
3317                                 if(cifsd_task) {
3318                                         send_sig(SIGKILL,cifsd_task,1);
3319                                         wait_for_completion(&cifsd_complete);
3320                                 }
3321                                 rc = 0;
3322                         } /* else - we have an smb session
3323                                 left on this socket do not kill cifsd */
3324                 } else
3325                         cFYI(1, ("No session or bad tcon"));
3326         }
3327
3328         cifs_sb->tcon = NULL;
3329         tmp = cifs_sb->prepath;
3330         cifs_sb->prepathlen = 0;
3331         cifs_sb->prepath = NULL;
3332         kfree(tmp);
3333         if (ses)
3334                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3335         if (ses)
3336                 sesInfoFree(ses);
3337
3338         FreeXid(xid);
3339         return rc;              /* BB check if we should always return zero here */
3340 }
3341
3342 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3343                                            struct nls_table * nls_info)
3344 {
3345         int rc = 0;
3346         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3347         int ntlmv2_flag = FALSE;
3348         int first_time = 0;
3349
3350         /* what if server changes its buffer size after dropping the session? */
3351         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3352                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3353                 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3354                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3355                         if(rc == -EAGAIN)
3356                                 rc = -EHOSTDOWN;
3357                 }
3358                 if(rc == 0) {
3359                         spin_lock(&GlobalMid_Lock);
3360                         if(pSesInfo->server->tcpStatus != CifsExiting)
3361                                 pSesInfo->server->tcpStatus = CifsGood;
3362                         else
3363                                 rc = -EHOSTDOWN;
3364                         spin_unlock(&GlobalMid_Lock);
3365
3366                 }
3367                 first_time = 1;
3368         }
3369         if (!rc) {
3370                 pSesInfo->flags = 0;
3371                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3372                 if(linuxExtEnabled == 0)
3373                         pSesInfo->capabilities &= (~CAP_UNIX);
3374         /*      pSesInfo->sequence_number = 0;*/
3375                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3376                         pSesInfo->server->secMode,
3377                         pSesInfo->server->capabilities,
3378                         pSesInfo->server->timeAdj));
3379                 if(experimEnabled < 2)
3380                         rc = CIFS_SessSetup(xid, pSesInfo,
3381                                             first_time, nls_info);
3382                 else if (extended_security
3383                                 && (pSesInfo->capabilities
3384                                         & CAP_EXTENDED_SECURITY)
3385                                 && (pSesInfo->server->secType == NTLMSSP)) {
3386                         rc = -EOPNOTSUPP;
3387                 } else if (extended_security
3388                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3389                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3390                         cFYI(1, ("NTLMSSP sesssetup"));
3391                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3392                                                 pSesInfo,
3393                                                 &ntlmv2_flag,
3394                                                 nls_info);
3395                         if (!rc) {
3396                                 if(ntlmv2_flag) {
3397                                         char * v2_response;
3398                                         cFYI(1,("more secure NTLM ver2 hash"));
3399                                         if(CalcNTLMv2_partial_mac_key(pSesInfo,
3400                                                 nls_info)) {
3401                                                 rc = -ENOMEM;
3402                                                 goto ss_err_exit;
3403                                         } else
3404                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3405                                         if(v2_response) {
3406                                                 CalcNTLMv2_response(pSesInfo,v2_response);
3407                                 /*              if(first_time)
3408                                                         cifs_calculate_ntlmv2_mac_key(
3409                                                           pSesInfo->server->mac_signing_key,
3410                                                           response, ntlm_session_key, */
3411                                                 kfree(v2_response);
3412                                         /* BB Put dummy sig in SessSetup PDU? */
3413                                         } else {
3414                                                 rc = -ENOMEM;
3415                                                 goto ss_err_exit;
3416                                         }
3417
3418                                 } else {
3419                                         SMBNTencrypt(pSesInfo->password,
3420                                                 pSesInfo->server->cryptKey,
3421                                                 ntlm_session_key);
3422
3423                                         if(first_time)
3424                                                 cifs_calculate_mac_key(
3425                                                         pSesInfo->server->mac_signing_key,
3426                                                         ntlm_session_key,
3427                                                         pSesInfo->password);
3428                                 }
3429                         /* for better security the weaker lanman hash not sent
3430                            in AuthSessSetup so we no longer calculate it */
3431
3432                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3433                                         pSesInfo,
3434                                         ntlm_session_key,
3435                                         ntlmv2_flag,
3436                                         nls_info);
3437                         }
3438                 } else { /* old style NTLM 0.12 session setup */
3439                         SMBNTencrypt(pSesInfo->password,
3440                                 pSesInfo->server->cryptKey,
3441                                 ntlm_session_key);
3442
3443                         if(first_time)
3444                                 cifs_calculate_mac_key(
3445                                         pSesInfo->server->mac_signing_key,
3446                                         ntlm_session_key, pSesInfo->password);
3447
3448                         rc = CIFSSessSetup(xid, pSesInfo,
3449                                 ntlm_session_key, nls_info);
3450                 }
3451                 if (rc) {
3452                         cERROR(1,("Send error in SessSetup = %d",rc));
3453                 } else {
3454                         cFYI(1,("CIFS Session Established successfully"));
3455                         pSesInfo->status = CifsGood;
3456                 }
3457         }
3458 ss_err_exit:
3459         return rc;
3460 }
3461