4 * Copyright (C) International Business Machines Corp., 2002,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * This library is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as published
9 * by the Free Software Foundation; either version 2.1 of the License, or
10 * (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
15 * the GNU Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public License
18 * along with this library; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/net.h>
23 #include <linux/string.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/ipv6.h>
27 #include <linux/pagemap.h>
28 #include <linux/ctype.h>
29 #include <linux/utsname.h>
30 #include <linux/mempool.h>
31 #include <linux/delay.h>
32 #include <linux/completion.h>
33 #include <linux/kthread.h>
34 #include <linux/pagevec.h>
35 #include <linux/freezer.h>
36 #include <asm/uaccess.h>
37 #include <asm/processor.h>
40 #include "cifsproto.h"
41 #include "cifs_unicode.h"
42 #include "cifs_debug.h"
43 #include "cifs_fs_sb.h"
46 #include "rfc1002pdu.h"
50 #define RFC1001_PORT 139
52 extern void SMBNTencrypt(unsigned char *passwd
, unsigned char *c8
,
55 extern mempool_t
*cifs_req_poolp
;
63 char *in6_addr
; /* ipv6 address as human readable form of in6_addr */
64 char *iocharset
; /* local code page for mapping to and from Unicode */
65 char source_rfc1001_name
[16]; /* netbios name of client */
66 char target_rfc1001_name
[16]; /* netbios name of server for Win9x/ME */
80 bool no_psx_acl
:1; /* set if posix acl support should be disabled */
82 bool no_xattr
:1; /* set if xattr (EA) support should be disabled*/
83 bool server_ino
:1; /* use inode numbers from server ie UniqueId */
85 bool remap
:1; /* set to remap seven reserved chars in filenames */
86 bool posix_paths
:1; /* unset to not ask for posix pathnames. */
89 bool nullauth
:1; /* attempt to authenticate with null user */
90 bool nocase
:1; /* request case insensitive filenames */
91 bool nobrl
:1; /* disable sending byte range locks to srv */
92 bool mand_lock
:1; /* send mandatory not posix byte range lock reqs */
93 bool seal
:1; /* request transport encryption on share */
94 bool nodfs
:1; /* Do not request DFS, even if available */
95 bool local_lease
:1; /* check leases only on local system, not remote */
100 unsigned int sockopt
;
101 unsigned short int port
;
105 static int ipv4_connect(struct TCP_Server_Info
*server
);
106 static int ipv6_connect(struct TCP_Server_Info
*server
);
109 * cifs tcp session reconnection
111 * mark tcp session as reconnecting so temporarily locked
112 * mark all smb sessions as reconnecting for tcp session
113 * reconnect tcp session
114 * wake up waiters on reconnection? - (not needed currently)
117 cifs_reconnect(struct TCP_Server_Info
*server
)
120 struct list_head
*tmp
, *tmp2
;
121 struct cifsSesInfo
*ses
;
122 struct cifsTconInfo
*tcon
;
123 struct mid_q_entry
*mid_entry
;
125 spin_lock(&GlobalMid_Lock
);
126 if (server
->tcpStatus
== CifsExiting
) {
127 /* the demux thread will exit normally
128 next time through the loop */
129 spin_unlock(&GlobalMid_Lock
);
132 server
->tcpStatus
= CifsNeedReconnect
;
133 spin_unlock(&GlobalMid_Lock
);
136 cFYI(1, ("Reconnecting tcp session"));
138 /* before reconnecting the tcp session, mark the smb session (uid)
139 and the tid bad so they are not used until reconnected */
140 read_lock(&cifs_tcp_ses_lock
);
141 list_for_each(tmp
, &server
->smb_ses_list
) {
142 ses
= list_entry(tmp
, struct cifsSesInfo
, smb_ses_list
);
143 ses
->need_reconnect
= true;
145 list_for_each(tmp2
, &ses
->tcon_list
) {
146 tcon
= list_entry(tmp2
, struct cifsTconInfo
, tcon_list
);
147 tcon
->need_reconnect
= true;
150 read_unlock(&cifs_tcp_ses_lock
);
151 /* do not want to be sending data on a socket we are freeing */
152 mutex_lock(&server
->srv_mutex
);
153 if (server
->ssocket
) {
154 cFYI(1, ("State: 0x%x Flags: 0x%lx", server
->ssocket
->state
,
155 server
->ssocket
->flags
));
156 kernel_sock_shutdown(server
->ssocket
, SHUT_WR
);
157 cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
158 server
->ssocket
->state
,
159 server
->ssocket
->flags
));
160 sock_release(server
->ssocket
);
161 server
->ssocket
= NULL
;
164 spin_lock(&GlobalMid_Lock
);
165 list_for_each(tmp
, &server
->pending_mid_q
) {
166 mid_entry
= list_entry(tmp
, struct
169 if (mid_entry
->midState
== MID_REQUEST_SUBMITTED
) {
170 /* Mark other intransit requests as needing
171 retry so we do not immediately mark the
172 session bad again (ie after we reconnect
173 below) as they timeout too */
174 mid_entry
->midState
= MID_RETRY_NEEDED
;
177 spin_unlock(&GlobalMid_Lock
);
178 mutex_unlock(&server
->srv_mutex
);
180 while ((server
->tcpStatus
!= CifsExiting
) &&
181 (server
->tcpStatus
!= CifsGood
)) {
183 if (server
->addr
.sockAddr6
.sin6_family
== AF_INET6
)
184 rc
= ipv6_connect(server
);
186 rc
= ipv4_connect(server
);
188 cFYI(1, ("reconnect error %d", rc
));
191 atomic_inc(&tcpSesReconnectCount
);
192 spin_lock(&GlobalMid_Lock
);
193 if (server
->tcpStatus
!= CifsExiting
)
194 server
->tcpStatus
= CifsGood
;
195 server
->sequence_number
= 0;
196 spin_unlock(&GlobalMid_Lock
);
197 /* atomic_set(&server->inFlight,0);*/
198 wake_up(&server
->response_q
);
206 0 not a transact2, or all data present
207 >0 transact2 with that much data missing
208 -EINVAL = invalid transact2
211 static int check2ndT2(struct smb_hdr
*pSMB
, unsigned int maxBufSize
)
213 struct smb_t2_rsp
*pSMBt
;
215 int data_in_this_rsp
;
218 if (pSMB
->Command
!= SMB_COM_TRANSACTION2
)
221 /* check for plausible wct, bcc and t2 data and parm sizes */
222 /* check for parm and data offset going beyond end of smb */
223 if (pSMB
->WordCount
!= 10) { /* coalesce_t2 depends on this */
224 cFYI(1, ("invalid transact2 word count"));
228 pSMBt
= (struct smb_t2_rsp
*)pSMB
;
230 total_data_size
= le16_to_cpu(pSMBt
->t2_rsp
.TotalDataCount
);
231 data_in_this_rsp
= le16_to_cpu(pSMBt
->t2_rsp
.DataCount
);
233 remaining
= total_data_size
- data_in_this_rsp
;
237 else if (remaining
< 0) {
238 cFYI(1, ("total data %d smaller than data in frame %d",
239 total_data_size
, data_in_this_rsp
));
242 cFYI(1, ("missing %d bytes from transact2, check next response",
244 if (total_data_size
> maxBufSize
) {
245 cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
246 total_data_size
, maxBufSize
));
253 static int coalesce_t2(struct smb_hdr
*psecond
, struct smb_hdr
*pTargetSMB
)
255 struct smb_t2_rsp
*pSMB2
= (struct smb_t2_rsp
*)psecond
;
256 struct smb_t2_rsp
*pSMBt
= (struct smb_t2_rsp
*)pTargetSMB
;
261 char *data_area_of_target
;
262 char *data_area_of_buf2
;
265 total_data_size
= le16_to_cpu(pSMBt
->t2_rsp
.TotalDataCount
);
267 if (total_data_size
!= le16_to_cpu(pSMB2
->t2_rsp
.TotalDataCount
)) {
268 cFYI(1, ("total data size of primary and secondary t2 differ"));
271 total_in_buf
= le16_to_cpu(pSMBt
->t2_rsp
.DataCount
);
273 remaining
= total_data_size
- total_in_buf
;
278 if (remaining
== 0) /* nothing to do, ignore */
281 total_in_buf2
= le16_to_cpu(pSMB2
->t2_rsp
.DataCount
);
282 if (remaining
< total_in_buf2
) {
283 cFYI(1, ("transact2 2nd response contains too much data"));
286 /* find end of first SMB data area */
287 data_area_of_target
= (char *)&pSMBt
->hdr
.Protocol
+
288 le16_to_cpu(pSMBt
->t2_rsp
.DataOffset
);
289 /* validate target area */
291 data_area_of_buf2
= (char *) &pSMB2
->hdr
.Protocol
+
292 le16_to_cpu(pSMB2
->t2_rsp
.DataOffset
);
294 data_area_of_target
+= total_in_buf
;
296 /* copy second buffer into end of first buffer */
297 memcpy(data_area_of_target
, data_area_of_buf2
, total_in_buf2
);
298 total_in_buf
+= total_in_buf2
;
299 pSMBt
->t2_rsp
.DataCount
= cpu_to_le16(total_in_buf
);
300 byte_count
= le16_to_cpu(BCC_LE(pTargetSMB
));
301 byte_count
+= total_in_buf2
;
302 BCC_LE(pTargetSMB
) = cpu_to_le16(byte_count
);
304 byte_count
= pTargetSMB
->smb_buf_length
;
305 byte_count
+= total_in_buf2
;
307 /* BB also add check that we are not beyond maximum buffer size */
309 pTargetSMB
->smb_buf_length
= byte_count
;
311 if (remaining
== total_in_buf2
) {
312 cFYI(1, ("found the last secondary response"));
313 return 0; /* we are done */
314 } else /* more responses to go */
320 cifs_demultiplex_thread(struct TCP_Server_Info
*server
)
323 unsigned int pdu_length
, total_read
;
324 struct smb_hdr
*smb_buffer
= NULL
;
325 struct smb_hdr
*bigbuf
= NULL
;
326 struct smb_hdr
*smallbuf
= NULL
;
327 struct msghdr smb_msg
;
329 struct socket
*csocket
= server
->ssocket
;
330 struct list_head
*tmp
;
331 struct cifsSesInfo
*ses
;
332 struct task_struct
*task_to_wake
= NULL
;
333 struct mid_q_entry
*mid_entry
;
335 bool isLargeBuf
= false;
339 current
->flags
|= PF_MEMALLOC
;
340 cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current
)));
342 length
= atomic_inc_return(&tcpSesAllocCount
);
344 mempool_resize(cifs_req_poolp
, length
+ cifs_min_rcv
,
348 while (server
->tcpStatus
!= CifsExiting
) {
351 if (bigbuf
== NULL
) {
352 bigbuf
= cifs_buf_get();
354 cERROR(1, ("No memory for large SMB response"));
356 /* retry will check if exiting */
359 } else if (isLargeBuf
) {
360 /* we are reusing a dirty large buf, clear its start */
361 memset(bigbuf
, 0, sizeof(struct smb_hdr
));
364 if (smallbuf
== NULL
) {
365 smallbuf
= cifs_small_buf_get();
367 cERROR(1, ("No memory for SMB response"));
369 /* retry will check if exiting */
372 /* beginning of smb buffer is cleared in our buf_get */
373 } else /* if existing small buf clear beginning */
374 memset(smallbuf
, 0, sizeof(struct smb_hdr
));
378 smb_buffer
= smallbuf
;
379 iov
.iov_base
= smb_buffer
;
381 smb_msg
.msg_control
= NULL
;
382 smb_msg
.msg_controllen
= 0;
383 pdu_length
= 4; /* enough to get RFC1001 header */
386 kernel_recvmsg(csocket
, &smb_msg
,
387 &iov
, 1, pdu_length
, 0 /* BB other flags? */);
389 if (server
->tcpStatus
== CifsExiting
) {
391 } else if (server
->tcpStatus
== CifsNeedReconnect
) {
392 cFYI(1, ("Reconnect after server stopped responding"));
393 cifs_reconnect(server
);
394 cFYI(1, ("call to reconnect done"));
395 csocket
= server
->ssocket
;
397 } else if ((length
== -ERESTARTSYS
) || (length
== -EAGAIN
)) {
398 msleep(1); /* minimum sleep to prevent looping
399 allowing socket to clear and app threads to set
400 tcpStatus CifsNeedReconnect if server hung */
401 if (pdu_length
< 4) {
402 iov
.iov_base
= (4 - pdu_length
) +
404 iov
.iov_len
= pdu_length
;
405 smb_msg
.msg_control
= NULL
;
406 smb_msg
.msg_controllen
= 0;
410 } else if (length
<= 0) {
411 if (server
->tcpStatus
== CifsNew
) {
412 cFYI(1, ("tcp session abend after SMBnegprot"));
413 /* some servers kill the TCP session rather than
414 returning an SMB negprot error, in which
415 case reconnecting here is not going to help,
416 and so simply return error to mount */
419 if (!try_to_freeze() && (length
== -EINTR
)) {
420 cFYI(1, ("cifsd thread killed"));
423 cFYI(1, ("Reconnect after unexpected peek error %d",
425 cifs_reconnect(server
);
426 csocket
= server
->ssocket
;
427 wake_up(&server
->response_q
);
429 } else if (length
< pdu_length
) {
430 cFYI(1, ("requested %d bytes but only got %d bytes",
431 pdu_length
, length
));
432 pdu_length
-= length
;
437 /* The right amount was read from socket - 4 bytes */
438 /* so we can now interpret the length field */
440 /* the first byte big endian of the length field,
441 is actually not part of the length but the type
442 with the most common, zero, as regular data */
443 temp
= *((char *) smb_buffer
);
445 /* Note that FC 1001 length is big endian on the wire,
446 but we convert it here so it is always manipulated
447 as host byte order */
448 pdu_length
= be32_to_cpu((__force __be32
)smb_buffer
->smb_buf_length
);
449 smb_buffer
->smb_buf_length
= pdu_length
;
451 cFYI(1, ("rfc1002 length 0x%x", pdu_length
+4));
453 if (temp
== (char) RFC1002_SESSION_KEEP_ALIVE
) {
455 } else if (temp
== (char)RFC1002_POSITIVE_SESSION_RESPONSE
) {
456 cFYI(1, ("Good RFC 1002 session rsp"));
458 } else if (temp
== (char)RFC1002_NEGATIVE_SESSION_RESPONSE
) {
459 /* we get this from Windows 98 instead of
460 an error on SMB negprot response */
461 cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
463 if (server
->tcpStatus
== CifsNew
) {
464 /* if nack on negprot (rather than
465 ret of smb negprot error) reconnecting
466 not going to help, ret error to mount */
469 /* give server a second to
470 clean up before reconnect attempt */
472 /* always try 445 first on reconnect
473 since we get NACK on some if we ever
474 connected to port 139 (the NACK is
475 since we do not begin with RFC1001
476 session initialize frame) */
477 server
->addr
.sockAddr
.sin_port
=
479 cifs_reconnect(server
);
480 csocket
= server
->ssocket
;
481 wake_up(&server
->response_q
);
484 } else if (temp
!= (char) 0) {
485 cERROR(1, ("Unknown RFC 1002 frame"));
486 cifs_dump_mem(" Received Data: ", (char *)smb_buffer
,
488 cifs_reconnect(server
);
489 csocket
= server
->ssocket
;
493 /* else we have an SMB response */
494 if ((pdu_length
> CIFSMaxBufSize
+ MAX_CIFS_HDR_SIZE
- 4) ||
495 (pdu_length
< sizeof(struct smb_hdr
) - 1 - 4)) {
496 cERROR(1, ("Invalid size SMB length %d pdu_length %d",
497 length
, pdu_length
+4));
498 cifs_reconnect(server
);
499 csocket
= server
->ssocket
;
500 wake_up(&server
->response_q
);
507 if (pdu_length
> MAX_CIFS_SMALL_BUFFER_SIZE
- 4) {
509 memcpy(bigbuf
, smallbuf
, 4);
513 iov
.iov_base
= 4 + (char *)smb_buffer
;
514 iov
.iov_len
= pdu_length
;
515 for (total_read
= 0; total_read
< pdu_length
;
516 total_read
+= length
) {
517 length
= kernel_recvmsg(csocket
, &smb_msg
, &iov
, 1,
518 pdu_length
- total_read
, 0);
519 if ((server
->tcpStatus
== CifsExiting
) ||
520 (length
== -EINTR
)) {
524 } else if (server
->tcpStatus
== CifsNeedReconnect
) {
525 cifs_reconnect(server
);
526 csocket
= server
->ssocket
;
527 /* Reconnect wakes up rspns q */
528 /* Now we will reread sock */
531 } else if ((length
== -ERESTARTSYS
) ||
532 (length
== -EAGAIN
)) {
533 msleep(1); /* minimum sleep to prevent looping,
534 allowing socket to clear and app
535 threads to set tcpStatus
536 CifsNeedReconnect if server hung*/
539 } else if (length
<= 0) {
540 cERROR(1, ("Received no data, expecting %d",
541 pdu_length
- total_read
));
542 cifs_reconnect(server
);
543 csocket
= server
->ssocket
;
550 else if (reconnect
== 1)
553 length
+= 4; /* account for rfc1002 hdr */
556 dump_smb(smb_buffer
, length
);
557 if (checkSMB(smb_buffer
, smb_buffer
->Mid
, total_read
+4)) {
558 cifs_dump_mem("Bad SMB: ", smb_buffer
, 48);
564 spin_lock(&GlobalMid_Lock
);
565 list_for_each(tmp
, &server
->pending_mid_q
) {
566 mid_entry
= list_entry(tmp
, struct mid_q_entry
, qhead
);
568 if ((mid_entry
->mid
== smb_buffer
->Mid
) &&
569 (mid_entry
->midState
== MID_REQUEST_SUBMITTED
) &&
570 (mid_entry
->command
== smb_buffer
->Command
)) {
571 if (check2ndT2(smb_buffer
,server
->maxBuf
) > 0) {
572 /* We have a multipart transact2 resp */
574 if (mid_entry
->resp_buf
) {
575 /* merge response - fix up 1st*/
576 if (coalesce_t2(smb_buffer
,
577 mid_entry
->resp_buf
)) {
578 mid_entry
->multiRsp
=
582 /* all parts received */
583 mid_entry
->multiEnd
=
589 cERROR(1,("1st trans2 resp needs bigbuf"));
590 /* BB maybe we can fix this up, switch
591 to already allocated large buffer? */
593 /* Have first buffer */
594 mid_entry
->resp_buf
=
596 mid_entry
->largeBuf
=
603 mid_entry
->resp_buf
= smb_buffer
;
604 mid_entry
->largeBuf
= isLargeBuf
;
606 task_to_wake
= mid_entry
->tsk
;
607 mid_entry
->midState
= MID_RESPONSE_RECEIVED
;
608 #ifdef CONFIG_CIFS_STATS2
609 mid_entry
->when_received
= jiffies
;
611 /* so we do not time out requests to server
612 which is still responding (since server could
613 be busy but not dead) */
614 server
->lstrp
= jiffies
;
618 spin_unlock(&GlobalMid_Lock
);
620 /* Was previous buf put in mpx struct for multi-rsp? */
622 /* smb buffer will be freed by user thread */
628 wake_up_process(task_to_wake
);
629 } else if (!is_valid_oplock_break(smb_buffer
, server
) &&
631 cERROR(1, ("No task to wake, unknown frame received! "
632 "NumMids %d", midCount
.counter
));
633 cifs_dump_mem("Received Data is: ", (char *)smb_buffer
,
634 sizeof(struct smb_hdr
));
635 #ifdef CONFIG_CIFS_DEBUG2
636 cifs_dump_detail(smb_buffer
);
637 cifs_dump_mids(server
);
638 #endif /* CIFS_DEBUG2 */
641 } /* end while !EXITING */
643 /* take it off the list, if it's not already */
644 write_lock(&cifs_tcp_ses_lock
);
645 list_del_init(&server
->tcp_ses_list
);
646 write_unlock(&cifs_tcp_ses_lock
);
648 spin_lock(&GlobalMid_Lock
);
649 server
->tcpStatus
= CifsExiting
;
650 spin_unlock(&GlobalMid_Lock
);
651 wake_up_all(&server
->response_q
);
653 /* check if we have blocked requests that need to free */
654 /* Note that cifs_max_pending is normally 50, but
655 can be set at module install time to as little as two */
656 spin_lock(&GlobalMid_Lock
);
657 if (atomic_read(&server
->inFlight
) >= cifs_max_pending
)
658 atomic_set(&server
->inFlight
, cifs_max_pending
- 1);
659 /* We do not want to set the max_pending too low or we
660 could end up with the counter going negative */
661 spin_unlock(&GlobalMid_Lock
);
662 /* Although there should not be any requests blocked on
663 this queue it can not hurt to be paranoid and try to wake up requests
664 that may haven been blocked when more than 50 at time were on the wire
665 to the same server - they now will see the session is in exit state
666 and get out of SendReceive. */
667 wake_up_all(&server
->request_q
);
668 /* give those requests time to exit */
671 if (server
->ssocket
) {
672 sock_release(csocket
);
673 server
->ssocket
= NULL
;
675 /* buffer usuallly freed in free_mid - need to free it here on exit */
676 cifs_buf_release(bigbuf
);
677 if (smallbuf
) /* no sense logging a debug message if NULL */
678 cifs_small_buf_release(smallbuf
);
681 * BB: we shouldn't have to do any of this. It shouldn't be
682 * possible to exit from the thread with active SMB sessions
684 read_lock(&cifs_tcp_ses_lock
);
685 if (list_empty(&server
->pending_mid_q
)) {
686 /* loop through server session structures attached to this and
688 list_for_each(tmp
, &server
->smb_ses_list
) {
689 ses
= list_entry(tmp
, struct cifsSesInfo
,
691 ses
->status
= CifsExiting
;
694 read_unlock(&cifs_tcp_ses_lock
);
696 /* although we can not zero the server struct pointer yet,
697 since there are active requests which may depnd on them,
698 mark the corresponding SMB sessions as exiting too */
699 list_for_each(tmp
, &server
->smb_ses_list
) {
700 ses
= list_entry(tmp
, struct cifsSesInfo
,
702 ses
->status
= CifsExiting
;
705 spin_lock(&GlobalMid_Lock
);
706 list_for_each(tmp
, &server
->pending_mid_q
) {
707 mid_entry
= list_entry(tmp
, struct mid_q_entry
, qhead
);
708 if (mid_entry
->midState
== MID_REQUEST_SUBMITTED
) {
709 cFYI(1, ("Clearing Mid 0x%x - waking up ",
711 task_to_wake
= mid_entry
->tsk
;
713 wake_up_process(task_to_wake
);
716 spin_unlock(&GlobalMid_Lock
);
717 read_unlock(&cifs_tcp_ses_lock
);
718 /* 1/8th of sec is more than enough time for them to exit */
722 if (!list_empty(&server
->pending_mid_q
)) {
723 /* mpx threads have not exited yet give them
724 at least the smb send timeout time for long ops */
725 /* due to delays on oplock break requests, we need
726 to wait at least 45 seconds before giving up
727 on a request getting a response and going ahead
729 cFYI(1, ("Wait for exit from demultiplex thread"));
731 /* if threads still have not exited they are probably never
732 coming home not much else we can do but free the memory */
735 /* last chance to mark ses pointers invalid
736 if there are any pointing to this (e.g
737 if a crazy root user tried to kill cifsd
738 kernel thread explicitly this might happen) */
739 /* BB: This shouldn't be necessary, see above */
740 read_lock(&cifs_tcp_ses_lock
);
741 list_for_each(tmp
, &server
->smb_ses_list
) {
742 ses
= list_entry(tmp
, struct cifsSesInfo
, smb_ses_list
);
745 read_unlock(&cifs_tcp_ses_lock
);
747 kfree(server
->hostname
);
748 task_to_wake
= xchg(&server
->tsk
, NULL
);
751 length
= atomic_dec_return(&tcpSesAllocCount
);
753 mempool_resize(cifs_req_poolp
, length
+ cifs_min_rcv
,
756 /* if server->tsk was NULL then wait for a signal before exiting */
758 set_current_state(TASK_INTERRUPTIBLE
);
759 while (!signal_pending(current
)) {
761 set_current_state(TASK_INTERRUPTIBLE
);
763 set_current_state(TASK_RUNNING
);
766 module_put_and_exit(0);
769 /* extract the host portion of the UNC string */
771 extract_hostname(const char *unc
)
777 /* skip double chars at beginning of string */
778 /* BB: check validity of these bytes? */
781 /* delimiter between hostname and sharename is always '\\' now */
782 delim
= strchr(src
, '\\');
784 return ERR_PTR(-EINVAL
);
787 dst
= kmalloc((len
+ 1), GFP_KERNEL
);
789 return ERR_PTR(-ENOMEM
);
791 memcpy(dst
, src
, len
);
798 cifs_parse_mount_options(char *options
, const char *devname
,
803 unsigned int temp_len
, i
, j
;
809 if (Local_System_Name
[0] != 0)
810 memcpy(vol
->source_rfc1001_name
, Local_System_Name
, 15);
812 char *nodename
= utsname()->nodename
;
813 int n
= strnlen(nodename
, 15);
814 memset(vol
->source_rfc1001_name
, 0x20, 15);
815 for (i
= 0; i
< n
; i
++) {
816 /* does not have to be perfect mapping since field is
817 informational, only used for servers that do not support
818 port 445 and it can be overridden at mount time */
819 vol
->source_rfc1001_name
[i
] = toupper(nodename
[i
]);
822 vol
->source_rfc1001_name
[15] = 0;
823 /* null target name indicates to use *SMBSERVR default called name
824 if we end up sending RFC1001 session initialize */
825 vol
->target_rfc1001_name
[0] = 0;
826 vol
->linux_uid
= current
->uid
; /* current->euid instead? */
827 vol
->linux_gid
= current
->gid
;
828 vol
->dir_mode
= S_IRWXUGO
;
829 /* 2767 perms indicate mandatory locking support */
830 vol
->file_mode
= (S_IRWXUGO
| S_ISGID
) & (~S_IXGRP
);
832 /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
834 /* default is always to request posix paths. */
835 vol
->posix_paths
= 1;
840 if (strncmp(options
, "sep=", 4) == 0) {
841 if (options
[4] != 0) {
842 separator
[0] = options
[4];
845 cFYI(1, ("Null separator not allowed"));
849 while ((data
= strsep(&options
, separator
)) != NULL
) {
852 if ((value
= strchr(data
, '=')) != NULL
)
855 /* Have to parse this before we parse for "user" */
856 if (strnicmp(data
, "user_xattr", 10) == 0) {
858 } else if (strnicmp(data
, "nouser_xattr", 12) == 0) {
860 } else if (strnicmp(data
, "user", 4) == 0) {
863 "CIFS: invalid or missing username\n");
864 return 1; /* needs_arg; */
865 } else if (!*value
) {
866 /* null user, ie anonymous, authentication */
869 if (strnlen(value
, 200) < 200) {
870 vol
->username
= value
;
872 printk(KERN_WARNING
"CIFS: username too long\n");
875 } else if (strnicmp(data
, "pass", 4) == 0) {
877 vol
->password
= NULL
;
879 } else if (value
[0] == 0) {
880 /* check if string begins with double comma
881 since that would mean the password really
882 does start with a comma, and would not
883 indicate an empty string */
884 if (value
[1] != separator
[0]) {
885 vol
->password
= NULL
;
889 temp_len
= strlen(value
);
890 /* removed password length check, NTLM passwords
891 can be arbitrarily long */
893 /* if comma in password, the string will be
894 prematurely null terminated. Commas in password are
895 specified across the cifs mount interface by a double
896 comma ie ,, and a comma used as in other cases ie ','
897 as a parameter delimiter/separator is single and due
898 to the strsep above is temporarily zeroed. */
900 /* NB: password legally can have multiple commas and
901 the only illegal character in a password is null */
903 if ((value
[temp_len
] == 0) &&
904 (value
[temp_len
+1] == separator
[0])) {
906 value
[temp_len
] = separator
[0];
907 temp_len
+= 2; /* move after second comma */
908 while (value
[temp_len
] != 0) {
909 if (value
[temp_len
] == separator
[0]) {
910 if (value
[temp_len
+1] ==
912 /* skip second comma */
915 /* single comma indicating start
922 if (value
[temp_len
] == 0) {
926 /* point option to start of next parm */
927 options
= value
+ temp_len
+ 1;
929 /* go from value to value + temp_len condensing
930 double commas to singles. Note that this ends up
931 allocating a few bytes too many, which is ok */
932 vol
->password
= kzalloc(temp_len
, GFP_KERNEL
);
933 if (vol
->password
== NULL
) {
934 printk(KERN_WARNING
"CIFS: no memory "
938 for (i
= 0, j
= 0; i
< temp_len
; i
++, j
++) {
939 vol
->password
[j
] = value
[i
];
940 if (value
[i
] == separator
[0]
941 && value
[i
+1] == separator
[0]) {
942 /* skip second comma */
946 vol
->password
[j
] = 0;
948 vol
->password
= kzalloc(temp_len
+1, GFP_KERNEL
);
949 if (vol
->password
== NULL
) {
950 printk(KERN_WARNING
"CIFS: no memory "
954 strcpy(vol
->password
, value
);
956 } else if (strnicmp(data
, "ip", 2) == 0) {
957 if (!value
|| !*value
) {
959 } else if (strnlen(value
, 35) < 35) {
962 printk(KERN_WARNING
"CIFS: ip address "
966 } else if (strnicmp(data
, "sec", 3) == 0) {
967 if (!value
|| !*value
) {
968 cERROR(1, ("no security value specified"));
970 } else if (strnicmp(value
, "krb5i", 5) == 0) {
971 vol
->secFlg
|= CIFSSEC_MAY_KRB5
|
973 } else if (strnicmp(value
, "krb5p", 5) == 0) {
974 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
976 cERROR(1, ("Krb5 cifs privacy not supported"));
978 } else if (strnicmp(value
, "krb5", 4) == 0) {
979 vol
->secFlg
|= CIFSSEC_MAY_KRB5
;
980 } else if (strnicmp(value
, "ntlmv2i", 7) == 0) {
981 vol
->secFlg
|= CIFSSEC_MAY_NTLMV2
|
983 } else if (strnicmp(value
, "ntlmv2", 6) == 0) {
984 vol
->secFlg
|= CIFSSEC_MAY_NTLMV2
;
985 } else if (strnicmp(value
, "ntlmi", 5) == 0) {
986 vol
->secFlg
|= CIFSSEC_MAY_NTLM
|
988 } else if (strnicmp(value
, "ntlm", 4) == 0) {
989 /* ntlm is default so can be turned off too */
990 vol
->secFlg
|= CIFSSEC_MAY_NTLM
;
991 } else if (strnicmp(value
, "nontlm", 6) == 0) {
992 /* BB is there a better way to do this? */
993 vol
->secFlg
|= CIFSSEC_MAY_NTLMV2
;
994 #ifdef CONFIG_CIFS_WEAK_PW_HASH
995 } else if (strnicmp(value
, "lanman", 6) == 0) {
996 vol
->secFlg
|= CIFSSEC_MAY_LANMAN
;
998 } else if (strnicmp(value
, "none", 4) == 0) {
1001 cERROR(1, ("bad security option: %s", value
));
1004 } else if ((strnicmp(data
, "unc", 3) == 0)
1005 || (strnicmp(data
, "target", 6) == 0)
1006 || (strnicmp(data
, "path", 4) == 0)) {
1007 if (!value
|| !*value
) {
1008 printk(KERN_WARNING
"CIFS: invalid path to "
1009 "network resource\n");
1010 return 1; /* needs_arg; */
1012 if ((temp_len
= strnlen(value
, 300)) < 300) {
1013 vol
->UNC
= kmalloc(temp_len
+1, GFP_KERNEL
);
1014 if (vol
->UNC
== NULL
)
1016 strcpy(vol
->UNC
, value
);
1017 if (strncmp(vol
->UNC
, "//", 2) == 0) {
1020 } else if (strncmp(vol
->UNC
, "\\\\", 2) != 0) {
1022 "CIFS: UNC Path does not begin "
1023 "with // or \\\\ \n");
1027 printk(KERN_WARNING
"CIFS: UNC name too long\n");
1030 } else if ((strnicmp(data
, "domain", 3) == 0)
1031 || (strnicmp(data
, "workgroup", 5) == 0)) {
1032 if (!value
|| !*value
) {
1033 printk(KERN_WARNING
"CIFS: invalid domain name\n");
1034 return 1; /* needs_arg; */
1036 /* BB are there cases in which a comma can be valid in
1037 a domain name and need special handling? */
1038 if (strnlen(value
, 256) < 256) {
1039 vol
->domainname
= value
;
1040 cFYI(1, ("Domain name set"));
1042 printk(KERN_WARNING
"CIFS: domain name too "
1046 } else if (strnicmp(data
, "prefixpath", 10) == 0) {
1047 if (!value
|| !*value
) {
1049 "CIFS: invalid path prefix\n");
1050 return 1; /* needs_argument */
1052 if ((temp_len
= strnlen(value
, 1024)) < 1024) {
1053 if (value
[0] != '/')
1054 temp_len
++; /* missing leading slash */
1055 vol
->prepath
= kmalloc(temp_len
+1, GFP_KERNEL
);
1056 if (vol
->prepath
== NULL
)
1058 if (value
[0] != '/') {
1059 vol
->prepath
[0] = '/';
1060 strcpy(vol
->prepath
+1, value
);
1062 strcpy(vol
->prepath
, value
);
1063 cFYI(1, ("prefix path %s", vol
->prepath
));
1065 printk(KERN_WARNING
"CIFS: prefix too long\n");
1068 } else if (strnicmp(data
, "iocharset", 9) == 0) {
1069 if (!value
|| !*value
) {
1070 printk(KERN_WARNING
"CIFS: invalid iocharset "
1072 return 1; /* needs_arg; */
1074 if (strnlen(value
, 65) < 65) {
1075 if (strnicmp(value
, "default", 7))
1076 vol
->iocharset
= value
;
1077 /* if iocharset not set then load_nls_default
1078 is used by caller */
1079 cFYI(1, ("iocharset set to %s", value
));
1081 printk(KERN_WARNING
"CIFS: iocharset name "
1085 } else if (strnicmp(data
, "uid", 3) == 0) {
1086 if (value
&& *value
) {
1088 simple_strtoul(value
, &value
, 0);
1089 vol
->override_uid
= 1;
1091 } else if (strnicmp(data
, "gid", 3) == 0) {
1092 if (value
&& *value
) {
1094 simple_strtoul(value
, &value
, 0);
1095 vol
->override_gid
= 1;
1097 } else if (strnicmp(data
, "file_mode", 4) == 0) {
1098 if (value
&& *value
) {
1100 simple_strtoul(value
, &value
, 0);
1102 } else if (strnicmp(data
, "dir_mode", 4) == 0) {
1103 if (value
&& *value
) {
1105 simple_strtoul(value
, &value
, 0);
1107 } else if (strnicmp(data
, "dirmode", 4) == 0) {
1108 if (value
&& *value
) {
1110 simple_strtoul(value
, &value
, 0);
1112 } else if (strnicmp(data
, "port", 4) == 0) {
1113 if (value
&& *value
) {
1115 simple_strtoul(value
, &value
, 0);
1117 } else if (strnicmp(data
, "rsize", 5) == 0) {
1118 if (value
&& *value
) {
1120 simple_strtoul(value
, &value
, 0);
1122 } else if (strnicmp(data
, "wsize", 5) == 0) {
1123 if (value
&& *value
) {
1125 simple_strtoul(value
, &value
, 0);
1127 } else if (strnicmp(data
, "sockopt", 5) == 0) {
1128 if (value
&& *value
) {
1130 simple_strtoul(value
, &value
, 0);
1132 } else if (strnicmp(data
, "netbiosname", 4) == 0) {
1133 if (!value
|| !*value
|| (*value
== ' ')) {
1134 cFYI(1, ("invalid (empty) netbiosname"));
1136 memset(vol
->source_rfc1001_name
, 0x20, 15);
1137 for (i
= 0; i
< 15; i
++) {
1138 /* BB are there cases in which a comma can be
1139 valid in this workstation netbios name (and need
1140 special handling)? */
1142 /* We do not uppercase netbiosname for user */
1146 vol
->source_rfc1001_name
[i
] =
1149 /* The string has 16th byte zero still from
1150 set at top of the function */
1151 if ((i
== 15) && (value
[i
] != 0))
1152 printk(KERN_WARNING
"CIFS: netbiosname"
1153 " longer than 15 truncated.\n");
1155 } else if (strnicmp(data
, "servern", 7) == 0) {
1156 /* servernetbiosname specified override *SMBSERVER */
1157 if (!value
|| !*value
|| (*value
== ' ')) {
1158 cFYI(1, ("empty server netbiosname specified"));
1160 /* last byte, type, is 0x20 for servr type */
1161 memset(vol
->target_rfc1001_name
, 0x20, 16);
1163 for (i
= 0; i
< 15; i
++) {
1164 /* BB are there cases in which a comma can be
1165 valid in this workstation netbios name
1166 (and need special handling)? */
1168 /* user or mount helper must uppercase
1173 vol
->target_rfc1001_name
[i
] =
1176 /* The string has 16th byte zero still from
1177 set at top of the function */
1178 if ((i
== 15) && (value
[i
] != 0))
1179 printk(KERN_WARNING
"CIFS: server net"
1180 "biosname longer than 15 truncated.\n");
1182 } else if (strnicmp(data
, "credentials", 4) == 0) {
1184 } else if (strnicmp(data
, "version", 3) == 0) {
1186 } else if (strnicmp(data
, "guest", 5) == 0) {
1188 } else if (strnicmp(data
, "rw", 2) == 0) {
1190 } else if (strnicmp(data
, "noblocksend", 11) == 0) {
1191 vol
->noblocksnd
= 1;
1192 } else if (strnicmp(data
, "noautotune", 10) == 0) {
1193 vol
->noautotune
= 1;
1194 } else if ((strnicmp(data
, "suid", 4) == 0) ||
1195 (strnicmp(data
, "nosuid", 6) == 0) ||
1196 (strnicmp(data
, "exec", 4) == 0) ||
1197 (strnicmp(data
, "noexec", 6) == 0) ||
1198 (strnicmp(data
, "nodev", 5) == 0) ||
1199 (strnicmp(data
, "noauto", 6) == 0) ||
1200 (strnicmp(data
, "dev", 3) == 0)) {
1201 /* The mount tool or mount.cifs helper (if present)
1202 uses these opts to set flags, and the flags are read
1203 by the kernel vfs layer before we get here (ie
1204 before read super) so there is no point trying to
1205 parse these options again and set anything and it
1206 is ok to just ignore them */
1208 } else if (strnicmp(data
, "ro", 2) == 0) {
1210 } else if (strnicmp(data
, "hard", 4) == 0) {
1212 } else if (strnicmp(data
, "soft", 4) == 0) {
1214 } else if (strnicmp(data
, "perm", 4) == 0) {
1216 } else if (strnicmp(data
, "noperm", 6) == 0) {
1218 } else if (strnicmp(data
, "mapchars", 8) == 0) {
1220 } else if (strnicmp(data
, "nomapchars", 10) == 0) {
1222 } else if (strnicmp(data
, "sfu", 3) == 0) {
1224 } else if (strnicmp(data
, "nosfu", 5) == 0) {
1226 } else if (strnicmp(data
, "nodfs", 5) == 0) {
1228 } else if (strnicmp(data
, "posixpaths", 10) == 0) {
1229 vol
->posix_paths
= 1;
1230 } else if (strnicmp(data
, "noposixpaths", 12) == 0) {
1231 vol
->posix_paths
= 0;
1232 } else if (strnicmp(data
, "nounix", 6) == 0) {
1233 vol
->no_linux_ext
= 1;
1234 } else if (strnicmp(data
, "nolinux", 7) == 0) {
1235 vol
->no_linux_ext
= 1;
1236 } else if ((strnicmp(data
, "nocase", 6) == 0) ||
1237 (strnicmp(data
, "ignorecase", 10) == 0)) {
1239 } else if (strnicmp(data
, "brl", 3) == 0) {
1241 } else if ((strnicmp(data
, "nobrl", 5) == 0) ||
1242 (strnicmp(data
, "nolock", 6) == 0)) {
1244 /* turn off mandatory locking in mode
1245 if remote locking is turned off since the
1246 local vfs will do advisory */
1247 if (vol
->file_mode
==
1248 (S_IALLUGO
& ~(S_ISUID
| S_IXGRP
)))
1249 vol
->file_mode
= S_IALLUGO
;
1250 } else if (strnicmp(data
, "forcemandatorylock", 9) == 0) {
1251 /* will take the shorter form "forcemand" as well */
1252 /* This mount option will force use of mandatory
1253 (DOS/Windows style) byte range locks, instead of
1254 using posix advisory byte range locks, even if the
1255 Unix extensions are available and posix locks would
1256 be supported otherwise. If Unix extensions are not
1257 negotiated this has no effect since mandatory locks
1258 would be used (mandatory locks is all that those
1259 those servers support) */
1261 } else if (strnicmp(data
, "setuids", 7) == 0) {
1263 } else if (strnicmp(data
, "nosetuids", 9) == 0) {
1265 } else if (strnicmp(data
, "dynperm", 7) == 0) {
1266 vol
->dynperm
= true;
1267 } else if (strnicmp(data
, "nodynperm", 9) == 0) {
1268 vol
->dynperm
= false;
1269 } else if (strnicmp(data
, "nohard", 6) == 0) {
1271 } else if (strnicmp(data
, "nosoft", 6) == 0) {
1273 } else if (strnicmp(data
, "nointr", 6) == 0) {
1275 } else if (strnicmp(data
, "intr", 4) == 0) {
1277 } else if (strnicmp(data
, "serverino", 7) == 0) {
1278 vol
->server_ino
= 1;
1279 } else if (strnicmp(data
, "noserverino", 9) == 0) {
1280 vol
->server_ino
= 0;
1281 } else if (strnicmp(data
, "cifsacl", 7) == 0) {
1283 } else if (strnicmp(data
, "nocifsacl", 9) == 0) {
1285 } else if (strnicmp(data
, "acl", 3) == 0) {
1286 vol
->no_psx_acl
= 0;
1287 } else if (strnicmp(data
, "noacl", 5) == 0) {
1288 vol
->no_psx_acl
= 1;
1289 #ifdef CONFIG_CIFS_EXPERIMENTAL
1290 } else if (strnicmp(data
, "locallease", 6) == 0) {
1291 vol
->local_lease
= 1;
1293 } else if (strnicmp(data
, "sign", 4) == 0) {
1294 vol
->secFlg
|= CIFSSEC_MUST_SIGN
;
1295 } else if (strnicmp(data
, "seal", 4) == 0) {
1296 /* we do not do the following in secFlags because seal
1297 is a per tree connection (mount) not a per socket
1298 or per-smb connection option in the protocol */
1299 /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1301 } else if (strnicmp(data
, "direct", 6) == 0) {
1303 } else if (strnicmp(data
, "forcedirectio", 13) == 0) {
1305 } else if (strnicmp(data
, "in6_addr", 8) == 0) {
1306 if (!value
|| !*value
) {
1307 vol
->in6_addr
= NULL
;
1308 } else if (strnlen(value
, 49) == 48) {
1309 vol
->in6_addr
= value
;
1311 printk(KERN_WARNING
"CIFS: ip v6 address not "
1312 "48 characters long\n");
1315 } else if (strnicmp(data
, "noac", 4) == 0) {
1316 printk(KERN_WARNING
"CIFS: Mount option noac not "
1317 "supported. Instead set "
1318 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1320 printk(KERN_WARNING
"CIFS: Unknown mount option %s\n",
1323 if (vol
->UNC
== NULL
) {
1324 if (devname
== NULL
) {
1325 printk(KERN_WARNING
"CIFS: Missing UNC name for mount "
1329 if ((temp_len
= strnlen(devname
, 300)) < 300) {
1330 vol
->UNC
= kmalloc(temp_len
+1, GFP_KERNEL
);
1331 if (vol
->UNC
== NULL
)
1333 strcpy(vol
->UNC
, devname
);
1334 if (strncmp(vol
->UNC
, "//", 2) == 0) {
1337 } else if (strncmp(vol
->UNC
, "\\\\", 2) != 0) {
1338 printk(KERN_WARNING
"CIFS: UNC Path does not "
1339 "begin with // or \\\\ \n");
1342 value
= strpbrk(vol
->UNC
+2, "/\\");
1346 printk(KERN_WARNING
"CIFS: UNC name too long\n");
1350 if (vol
->UNCip
== NULL
)
1351 vol
->UNCip
= &vol
->UNC
[2];
1356 static struct TCP_Server_Info
*
1357 cifs_find_tcp_session(struct sockaddr
*addr
)
1359 struct list_head
*tmp
;
1360 struct TCP_Server_Info
*server
;
1361 struct sockaddr_in
*addr4
= (struct sockaddr_in
*) addr
;
1362 struct sockaddr_in6
*addr6
= (struct sockaddr_in6
*) addr
;
1364 write_lock(&cifs_tcp_ses_lock
);
1365 list_for_each(tmp
, &cifs_tcp_ses_list
) {
1366 server
= list_entry(tmp
, struct TCP_Server_Info
,
1369 * the demux thread can exit on its own while still in CifsNew
1370 * so don't accept any sockets in that state. Since the
1371 * tcpStatus never changes back to CifsNew it's safe to check
1372 * for this without a lock.
1374 if (server
->tcpStatus
== CifsNew
)
1377 if (addr
->sa_family
== AF_INET
&&
1378 (addr4
->sin_addr
.s_addr
!=
1379 server
->addr
.sockAddr
.sin_addr
.s_addr
))
1381 else if (addr
->sa_family
== AF_INET6
&&
1382 memcmp(&server
->addr
.sockAddr6
.sin6_addr
,
1383 &addr6
->sin6_addr
, sizeof(addr6
->sin6_addr
)))
1386 ++server
->srv_count
;
1387 write_unlock(&cifs_tcp_ses_lock
);
1388 cFYI(1, ("Existing tcp session with server found"));
1391 write_unlock(&cifs_tcp_ses_lock
);
1396 cifs_put_tcp_session(struct TCP_Server_Info
*server
)
1398 struct task_struct
*task
;
1400 write_lock(&cifs_tcp_ses_lock
);
1401 if (--server
->srv_count
> 0) {
1402 write_unlock(&cifs_tcp_ses_lock
);
1406 list_del_init(&server
->tcp_ses_list
);
1407 write_unlock(&cifs_tcp_ses_lock
);
1409 spin_lock(&GlobalMid_Lock
);
1410 server
->tcpStatus
= CifsExiting
;
1411 spin_unlock(&GlobalMid_Lock
);
1413 task
= xchg(&server
->tsk
, NULL
);
1415 force_sig(SIGKILL
, task
);
1418 static struct TCP_Server_Info
*
1419 cifs_get_tcp_session(struct smb_vol
*volume_info
)
1421 struct TCP_Server_Info
*tcp_ses
= NULL
;
1422 struct sockaddr addr
;
1423 struct sockaddr_in
*sin_server
= (struct sockaddr_in
*) &addr
;
1424 struct sockaddr_in6
*sin_server6
= (struct sockaddr_in6
*) &addr
;
1427 memset(&addr
, 0, sizeof(struct sockaddr
));
1429 if (volume_info
->UNCip
&& volume_info
->UNC
) {
1430 rc
= cifs_inet_pton(AF_INET
, volume_info
->UNCip
,
1431 &sin_server
->sin_addr
.s_addr
);
1434 /* not ipv4 address, try ipv6 */
1435 rc
= cifs_inet_pton(AF_INET6
, volume_info
->UNCip
,
1436 &sin_server6
->sin6_addr
.in6_u
);
1438 addr
.sa_family
= AF_INET6
;
1440 addr
.sa_family
= AF_INET
;
1444 /* we failed translating address */
1449 cFYI(1, ("UNC: %s ip: %s", volume_info
->UNC
,
1450 volume_info
->UNCip
));
1451 } else if (volume_info
->UNCip
) {
1452 /* BB using ip addr as tcp_ses name to connect to the
1454 cERROR(1, ("Connecting to DFS root not implemented yet"));
1457 } else /* which tcp_sess DFS root would we conect to */ {
1459 ("CIFS mount error: No UNC path (e.g. -o "
1460 "unc=//192.168.1.100/public) specified"));
1465 /* see if we already have a matching tcp_ses */
1466 tcp_ses
= cifs_find_tcp_session(&addr
);
1470 tcp_ses
= kzalloc(sizeof(struct TCP_Server_Info
), GFP_KERNEL
);
1476 tcp_ses
->hostname
= extract_hostname(volume_info
->UNC
);
1477 if (IS_ERR(tcp_ses
->hostname
)) {
1478 rc
= PTR_ERR(tcp_ses
->hostname
);
1482 tcp_ses
->noblocksnd
= volume_info
->noblocksnd
;
1483 tcp_ses
->noautotune
= volume_info
->noautotune
;
1484 atomic_set(&tcp_ses
->inFlight
, 0);
1485 init_waitqueue_head(&tcp_ses
->response_q
);
1486 init_waitqueue_head(&tcp_ses
->request_q
);
1487 INIT_LIST_HEAD(&tcp_ses
->pending_mid_q
);
1488 mutex_init(&tcp_ses
->srv_mutex
);
1489 memcpy(tcp_ses
->workstation_RFC1001_name
,
1490 volume_info
->source_rfc1001_name
, RFC1001_NAME_LEN_WITH_NULL
);
1491 memcpy(tcp_ses
->server_RFC1001_name
,
1492 volume_info
->target_rfc1001_name
, RFC1001_NAME_LEN_WITH_NULL
);
1493 tcp_ses
->sequence_number
= 0;
1494 INIT_LIST_HEAD(&tcp_ses
->tcp_ses_list
);
1495 INIT_LIST_HEAD(&tcp_ses
->smb_ses_list
);
1498 * at this point we are the only ones with the pointer
1499 * to the struct since the kernel thread not created yet
1500 * no need to spinlock this init of tcpStatus or srv_count
1502 tcp_ses
->tcpStatus
= CifsNew
;
1503 ++tcp_ses
->srv_count
;
1505 if (addr
.sa_family
== AF_INET6
) {
1506 cFYI(1, ("attempting ipv6 connect"));
1507 /* BB should we allow ipv6 on port 139? */
1508 /* other OS never observed in Wild doing 139 with v6 */
1509 memcpy(&tcp_ses
->addr
.sockAddr6
, sin_server6
,
1510 sizeof(struct sockaddr_in6
));
1511 sin_server6
->sin6_port
= htons(volume_info
->port
);
1512 rc
= ipv6_connect(tcp_ses
);
1514 memcpy(&tcp_ses
->addr
.sockAddr
, sin_server
,
1515 sizeof(struct sockaddr_in
));
1516 sin_server
->sin_port
= htons(volume_info
->port
);
1517 rc
= ipv4_connect(tcp_ses
);
1520 cERROR(1, ("Error connecting to socket. Aborting operation"));
1525 * since we're in a cifs function already, we know that
1526 * this will succeed. No need for try_module_get().
1528 __module_get(THIS_MODULE
);
1529 tcp_ses
->tsk
= kthread_run((void *)(void *)cifs_demultiplex_thread
,
1531 if (IS_ERR(tcp_ses
->tsk
)) {
1532 rc
= PTR_ERR(tcp_ses
->tsk
);
1533 cERROR(1, ("error %d create cifsd thread", rc
));
1534 module_put(THIS_MODULE
);
1538 /* thread spawned, put it on the list */
1539 write_lock(&cifs_tcp_ses_lock
);
1540 list_add(&tcp_ses
->tcp_ses_list
, &cifs_tcp_ses_list
);
1541 write_unlock(&cifs_tcp_ses_lock
);
1547 kfree(tcp_ses
->hostname
);
1548 if (tcp_ses
->ssocket
)
1549 sock_release(tcp_ses
->ssocket
);
1555 static struct cifsSesInfo
*
1556 cifs_find_smb_ses(struct TCP_Server_Info
*server
, char *username
)
1558 struct list_head
*tmp
;
1559 struct cifsSesInfo
*ses
;
1561 write_lock(&cifs_tcp_ses_lock
);
1562 list_for_each(tmp
, &server
->smb_ses_list
) {
1563 ses
= list_entry(tmp
, struct cifsSesInfo
, smb_ses_list
);
1564 if (strncmp(ses
->userName
, username
, MAX_USERNAME_SIZE
))
1568 write_unlock(&cifs_tcp_ses_lock
);
1571 write_unlock(&cifs_tcp_ses_lock
);
1576 cifs_put_smb_ses(struct cifsSesInfo
*ses
)
1579 struct TCP_Server_Info
*server
= ses
->server
;
1581 write_lock(&cifs_tcp_ses_lock
);
1582 if (--ses
->ses_count
> 0) {
1583 write_unlock(&cifs_tcp_ses_lock
);
1587 list_del_init(&ses
->smb_ses_list
);
1588 write_unlock(&cifs_tcp_ses_lock
);
1590 if (ses
->status
== CifsGood
) {
1592 CIFSSMBLogoff(xid
, ses
);
1596 cifs_put_tcp_session(server
);
1599 static struct cifsTconInfo
*
1600 cifs_find_tcon(struct cifsSesInfo
*ses
, const char *unc
)
1602 struct list_head
*tmp
;
1603 struct cifsTconInfo
*tcon
;
1605 write_lock(&cifs_tcp_ses_lock
);
1606 list_for_each(tmp
, &ses
->tcon_list
) {
1607 tcon
= list_entry(tmp
, struct cifsTconInfo
, tcon_list
);
1608 if (tcon
->tidStatus
== CifsExiting
)
1610 if (strncmp(tcon
->treeName
, unc
, MAX_TREE_SIZE
))
1614 write_unlock(&cifs_tcp_ses_lock
);
1617 write_unlock(&cifs_tcp_ses_lock
);
1622 cifs_put_tcon(struct cifsTconInfo
*tcon
)
1625 struct cifsSesInfo
*ses
= tcon
->ses
;
1627 write_lock(&cifs_tcp_ses_lock
);
1628 if (--tcon
->tc_count
> 0) {
1629 write_unlock(&cifs_tcp_ses_lock
);
1633 list_del_init(&tcon
->tcon_list
);
1634 write_unlock(&cifs_tcp_ses_lock
);
1637 CIFSSMBTDis(xid
, tcon
);
1640 DeleteTconOplockQEntries(tcon
);
1642 cifs_put_smb_ses(ses
);
1646 get_dfs_path(int xid
, struct cifsSesInfo
*pSesInfo
, const char *old_path
,
1647 const struct nls_table
*nls_codepage
, unsigned int *pnum_referrals
,
1648 struct dfs_info3_param
**preferrals
, int remap
)
1653 *pnum_referrals
= 0;
1656 if (pSesInfo
->ipc_tid
== 0) {
1657 temp_unc
= kmalloc(2 /* for slashes */ +
1658 strnlen(pSesInfo
->serverName
,
1659 SERVER_NAME_LEN_WITH_NULL
* 2)
1660 + 1 + 4 /* slash IPC$ */ + 2,
1662 if (temp_unc
== NULL
)
1666 strcpy(temp_unc
+ 2, pSesInfo
->serverName
);
1667 strcpy(temp_unc
+ 2 + strlen(pSesInfo
->serverName
), "\\IPC$");
1668 rc
= CIFSTCon(xid
, pSesInfo
, temp_unc
, NULL
, nls_codepage
);
1670 ("CIFS Tcon rc = %d ipc_tid = %d", rc
, pSesInfo
->ipc_tid
));
1674 rc
= CIFSGetDFSRefer(xid
, pSesInfo
, old_path
, preferrals
,
1675 pnum_referrals
, nls_codepage
, remap
);
1676 /* BB map targetUNCs to dfs_info3 structures, here or
1677 in CIFSGetDFSRefer BB */
1682 #ifdef CONFIG_DEBUG_LOCK_ALLOC
1683 static struct lock_class_key cifs_key
[2];
1684 static struct lock_class_key cifs_slock_key
[2];
1687 cifs_reclassify_socket4(struct socket
*sock
)
1689 struct sock
*sk
= sock
->sk
;
1690 BUG_ON(sock_owned_by_user(sk
));
1691 sock_lock_init_class_and_name(sk
, "slock-AF_INET-CIFS",
1692 &cifs_slock_key
[0], "sk_lock-AF_INET-CIFS", &cifs_key
[0]);
1696 cifs_reclassify_socket6(struct socket
*sock
)
1698 struct sock
*sk
= sock
->sk
;
1699 BUG_ON(sock_owned_by_user(sk
));
1700 sock_lock_init_class_and_name(sk
, "slock-AF_INET6-CIFS",
1701 &cifs_slock_key
[1], "sk_lock-AF_INET6-CIFS", &cifs_key
[1]);
1705 cifs_reclassify_socket4(struct socket
*sock
)
1710 cifs_reclassify_socket6(struct socket
*sock
)
1715 /* See RFC1001 section 14 on representation of Netbios names */
1716 static void rfc1002mangle(char *target
, char *source
, unsigned int length
)
1720 for (i
= 0, j
= 0; i
< (length
); i
++) {
1721 /* mask a nibble at a time and encode */
1722 target
[j
] = 'A' + (0x0F & (source
[i
] >> 4));
1723 target
[j
+1] = 'A' + (0x0F & source
[i
]);
1731 ipv4_connect(struct TCP_Server_Info
*server
)
1734 bool connected
= false;
1735 __be16 orig_port
= 0;
1736 struct socket
*socket
= server
->ssocket
;
1738 if (socket
== NULL
) {
1739 rc
= sock_create_kern(PF_INET
, SOCK_STREAM
,
1740 IPPROTO_TCP
, &socket
);
1742 cERROR(1, ("Error %d creating socket", rc
));
1746 /* BB other socket options to set KEEPALIVE, NODELAY? */
1747 cFYI(1, ("Socket created"));
1748 server
->ssocket
= socket
;
1749 socket
->sk
->sk_allocation
= GFP_NOFS
;
1750 cifs_reclassify_socket4(socket
);
1753 /* user overrode default port */
1754 if (server
->addr
.sockAddr
.sin_port
) {
1755 rc
= socket
->ops
->connect(socket
, (struct sockaddr
*)
1756 &server
->addr
.sockAddr
,
1757 sizeof(struct sockaddr_in
), 0);
1763 /* save original port so we can retry user specified port
1764 later if fall back ports fail this time */
1765 orig_port
= server
->addr
.sockAddr
.sin_port
;
1767 /* do not retry on the same port we just failed on */
1768 if (server
->addr
.sockAddr
.sin_port
!= htons(CIFS_PORT
)) {
1769 server
->addr
.sockAddr
.sin_port
= htons(CIFS_PORT
);
1770 rc
= socket
->ops
->connect(socket
,
1772 &server
->addr
.sockAddr
,
1773 sizeof(struct sockaddr_in
), 0);
1779 server
->addr
.sockAddr
.sin_port
= htons(RFC1001_PORT
);
1780 rc
= socket
->ops
->connect(socket
, (struct sockaddr
*)
1781 &server
->addr
.sockAddr
,
1782 sizeof(struct sockaddr_in
), 0);
1787 /* give up here - unless we want to retry on different
1788 protocol families some day */
1791 server
->addr
.sockAddr
.sin_port
= orig_port
;
1792 cFYI(1, ("Error %d connecting to server via ipv4", rc
));
1793 sock_release(socket
);
1794 server
->ssocket
= NULL
;
1800 * Eventually check for other socket options to change from
1801 * the default. sock_setsockopt not used because it expects
1804 socket
->sk
->sk_rcvtimeo
= 7 * HZ
;
1805 socket
->sk
->sk_sndtimeo
= 3 * HZ
;
1807 /* make the bufsizes depend on wsize/rsize and max requests */
1808 if (server
->noautotune
) {
1809 if (socket
->sk
->sk_sndbuf
< (200 * 1024))
1810 socket
->sk
->sk_sndbuf
= 200 * 1024;
1811 if (socket
->sk
->sk_rcvbuf
< (140 * 1024))
1812 socket
->sk
->sk_rcvbuf
= 140 * 1024;
1815 cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
1816 socket
->sk
->sk_sndbuf
,
1817 socket
->sk
->sk_rcvbuf
, socket
->sk
->sk_rcvtimeo
));
1819 /* send RFC1001 sessinit */
1820 if (server
->addr
.sockAddr
.sin_port
== htons(RFC1001_PORT
)) {
1821 /* some servers require RFC1001 sessinit before sending
1822 negprot - BB check reconnection in case where second
1823 sessinit is sent but no second negprot */
1824 struct rfc1002_session_packet
*ses_init_buf
;
1825 struct smb_hdr
*smb_buf
;
1826 ses_init_buf
= kzalloc(sizeof(struct rfc1002_session_packet
),
1829 ses_init_buf
->trailer
.session_req
.called_len
= 32;
1830 if (server
->server_RFC1001_name
&&
1831 server
->server_RFC1001_name
[0] != 0)
1832 rfc1002mangle(ses_init_buf
->trailer
.
1833 session_req
.called_name
,
1834 server
->server_RFC1001_name
,
1835 RFC1001_NAME_LEN_WITH_NULL
);
1837 rfc1002mangle(ses_init_buf
->trailer
.
1838 session_req
.called_name
,
1839 DEFAULT_CIFS_CALLED_NAME
,
1840 RFC1001_NAME_LEN_WITH_NULL
);
1842 ses_init_buf
->trailer
.session_req
.calling_len
= 32;
1844 /* calling name ends in null (byte 16) from old smb
1846 if (server
->workstation_RFC1001_name
&&
1847 server
->workstation_RFC1001_name
[0] != 0)
1848 rfc1002mangle(ses_init_buf
->trailer
.
1849 session_req
.calling_name
,
1850 server
->workstation_RFC1001_name
,
1851 RFC1001_NAME_LEN_WITH_NULL
);
1853 rfc1002mangle(ses_init_buf
->trailer
.
1854 session_req
.calling_name
,
1856 RFC1001_NAME_LEN_WITH_NULL
);
1858 ses_init_buf
->trailer
.session_req
.scope1
= 0;
1859 ses_init_buf
->trailer
.session_req
.scope2
= 0;
1860 smb_buf
= (struct smb_hdr
*)ses_init_buf
;
1861 /* sizeof RFC1002_SESSION_REQUEST with no scope */
1862 smb_buf
->smb_buf_length
= 0x81000044;
1863 rc
= smb_send(socket
, smb_buf
, 0x44,
1864 (struct sockaddr
*) &server
->addr
.sockAddr
,
1865 server
->noblocksnd
);
1866 kfree(ses_init_buf
);
1867 msleep(1); /* RFC1001 layer in at least one server
1868 requires very short break before negprot
1869 presumably because not expecting negprot
1870 to follow so fast. This is a simple
1871 solution that works without
1872 complicating the code and causes no
1873 significant slowing down on mount
1874 for everyone else */
1876 /* else the negprot may still work without this
1877 even though malloc failed */
1885 ipv6_connect(struct TCP_Server_Info
*server
)
1888 bool connected
= false;
1889 __be16 orig_port
= 0;
1890 struct socket
*socket
= server
->ssocket
;
1892 if (socket
== NULL
) {
1893 rc
= sock_create_kern(PF_INET6
, SOCK_STREAM
,
1894 IPPROTO_TCP
, &socket
);
1896 cERROR(1, ("Error %d creating ipv6 socket", rc
));
1901 /* BB other socket options to set KEEPALIVE, NODELAY? */
1902 cFYI(1, ("ipv6 Socket created"));
1903 server
->ssocket
= socket
;
1904 socket
->sk
->sk_allocation
= GFP_NOFS
;
1905 cifs_reclassify_socket6(socket
);
1908 /* user overrode default port */
1909 if (server
->addr
.sockAddr6
.sin6_port
) {
1910 rc
= socket
->ops
->connect(socket
,
1911 (struct sockaddr
*) &server
->addr
.sockAddr6
,
1912 sizeof(struct sockaddr_in6
), 0);
1918 /* save original port so we can retry user specified port
1919 later if fall back ports fail this time */
1921 orig_port
= server
->addr
.sockAddr6
.sin6_port
;
1922 /* do not retry on the same port we just failed on */
1923 if (server
->addr
.sockAddr6
.sin6_port
!= htons(CIFS_PORT
)) {
1924 server
->addr
.sockAddr6
.sin6_port
= htons(CIFS_PORT
);
1925 rc
= socket
->ops
->connect(socket
, (struct sockaddr
*)
1926 &server
->addr
.sockAddr6
,
1927 sizeof(struct sockaddr_in6
), 0);
1933 server
->addr
.sockAddr6
.sin6_port
= htons(RFC1001_PORT
);
1934 rc
= socket
->ops
->connect(socket
, (struct sockaddr
*)
1935 &server
->addr
.sockAddr6
,
1936 sizeof(struct sockaddr_in6
), 0);
1941 /* give up here - unless we want to retry on different
1942 protocol families some day */
1945 server
->addr
.sockAddr6
.sin6_port
= orig_port
;
1946 cFYI(1, ("Error %d connecting to server via ipv6", rc
));
1947 sock_release(socket
);
1948 server
->ssocket
= NULL
;
1953 * Eventually check for other socket options to change from
1954 * the default. sock_setsockopt not used because it expects
1957 socket
->sk
->sk_rcvtimeo
= 7 * HZ
;
1958 socket
->sk
->sk_sndtimeo
= 3 * HZ
;
1959 server
->ssocket
= socket
;
1964 void reset_cifs_unix_caps(int xid
, struct cifsTconInfo
*tcon
,
1965 struct super_block
*sb
, struct smb_vol
*vol_info
)
1967 /* if we are reconnecting then should we check to see if
1968 * any requested capabilities changed locally e.g. via
1969 * remount but we can not do much about it here
1970 * if they have (even if we could detect it by the following)
1971 * Perhaps we could add a backpointer to array of sb from tcon
1972 * or if we change to make all sb to same share the same
1973 * sb as NFS - then we only have one backpointer to sb.
1974 * What if we wanted to mount the server share twice once with
1975 * and once without posixacls or posix paths? */
1976 __u64 saved_cap
= le64_to_cpu(tcon
->fsUnixInfo
.Capability
);
1978 if (vol_info
&& vol_info
->no_linux_ext
) {
1979 tcon
->fsUnixInfo
.Capability
= 0;
1980 tcon
->unix_ext
= 0; /* Unix Extensions disabled */
1981 cFYI(1, ("Linux protocol extensions disabled"));
1983 } else if (vol_info
)
1984 tcon
->unix_ext
= 1; /* Unix Extensions supported */
1986 if (tcon
->unix_ext
== 0) {
1987 cFYI(1, ("Unix extensions disabled so not set on reconnect"));
1991 if (!CIFSSMBQFSUnixInfo(xid
, tcon
)) {
1992 __u64 cap
= le64_to_cpu(tcon
->fsUnixInfo
.Capability
);
1994 /* check for reconnect case in which we do not
1995 want to change the mount behavior if we can avoid it */
1996 if (vol_info
== NULL
) {
1997 /* turn off POSIX ACL and PATHNAMES if not set
1998 originally at mount time */
1999 if ((saved_cap
& CIFS_UNIX_POSIX_ACL_CAP
) == 0)
2000 cap
&= ~CIFS_UNIX_POSIX_ACL_CAP
;
2001 if ((saved_cap
& CIFS_UNIX_POSIX_PATHNAMES_CAP
) == 0) {
2002 if (cap
& CIFS_UNIX_POSIX_PATHNAMES_CAP
)
2003 cERROR(1, ("POSIXPATH support change"));
2004 cap
&= ~CIFS_UNIX_POSIX_PATHNAMES_CAP
;
2005 } else if ((cap
& CIFS_UNIX_POSIX_PATHNAMES_CAP
) == 0) {
2006 cERROR(1, ("possible reconnect error"));
2008 ("server disabled POSIX path support"));
2012 cap
&= CIFS_UNIX_CAP_MASK
;
2013 if (vol_info
&& vol_info
->no_psx_acl
)
2014 cap
&= ~CIFS_UNIX_POSIX_ACL_CAP
;
2015 else if (CIFS_UNIX_POSIX_ACL_CAP
& cap
) {
2016 cFYI(1, ("negotiated posix acl support"));
2018 sb
->s_flags
|= MS_POSIXACL
;
2021 if (vol_info
&& vol_info
->posix_paths
== 0)
2022 cap
&= ~CIFS_UNIX_POSIX_PATHNAMES_CAP
;
2023 else if (cap
& CIFS_UNIX_POSIX_PATHNAMES_CAP
) {
2024 cFYI(1, ("negotiate posix pathnames"));
2026 CIFS_SB(sb
)->mnt_cifs_flags
|=
2027 CIFS_MOUNT_POSIX_PATHS
;
2030 /* We might be setting the path sep back to a different
2031 form if we are reconnecting and the server switched its
2032 posix path capability for this share */
2033 if (sb
&& (CIFS_SB(sb
)->prepathlen
> 0))
2034 CIFS_SB(sb
)->prepath
[0] = CIFS_DIR_SEP(CIFS_SB(sb
));
2036 if (sb
&& (CIFS_SB(sb
)->rsize
> 127 * 1024)) {
2037 if ((cap
& CIFS_UNIX_LARGE_READ_CAP
) == 0) {
2038 CIFS_SB(sb
)->rsize
= 127 * 1024;
2040 ("larger reads not supported by srv"));
2045 cFYI(1, ("Negotiate caps 0x%x", (int)cap
));
2046 #ifdef CONFIG_CIFS_DEBUG2
2047 if (cap
& CIFS_UNIX_FCNTL_CAP
)
2048 cFYI(1, ("FCNTL cap"));
2049 if (cap
& CIFS_UNIX_EXTATTR_CAP
)
2050 cFYI(1, ("EXTATTR cap"));
2051 if (cap
& CIFS_UNIX_POSIX_PATHNAMES_CAP
)
2052 cFYI(1, ("POSIX path cap"));
2053 if (cap
& CIFS_UNIX_XATTR_CAP
)
2054 cFYI(1, ("XATTR cap"));
2055 if (cap
& CIFS_UNIX_POSIX_ACL_CAP
)
2056 cFYI(1, ("POSIX ACL cap"));
2057 if (cap
& CIFS_UNIX_LARGE_READ_CAP
)
2058 cFYI(1, ("very large read cap"));
2059 if (cap
& CIFS_UNIX_LARGE_WRITE_CAP
)
2060 cFYI(1, ("very large write cap"));
2061 #endif /* CIFS_DEBUG2 */
2062 if (CIFSSMBSetFSUnixInfo(xid
, tcon
, cap
)) {
2063 if (vol_info
== NULL
) {
2064 cFYI(1, ("resetting capabilities failed"));
2066 cERROR(1, ("Negotiating Unix capabilities "
2067 "with the server failed. Consider "
2068 "mounting with the Unix Extensions\n"
2069 "disabled, if problems are found, "
2070 "by specifying the nounix mount "
2078 convert_delimiter(char *path
, char delim
)
2091 for (i
= 0; path
[i
] != '\0'; i
++) {
2092 if (path
[i
] == old_delim
)
2097 static void setup_cifs_sb(struct smb_vol
*pvolume_info
,
2098 struct cifs_sb_info
*cifs_sb
)
2100 if (pvolume_info
->rsize
> CIFSMaxBufSize
) {
2101 cERROR(1, ("rsize %d too large, using MaxBufSize",
2102 pvolume_info
->rsize
));
2103 cifs_sb
->rsize
= CIFSMaxBufSize
;
2104 } else if ((pvolume_info
->rsize
) &&
2105 (pvolume_info
->rsize
<= CIFSMaxBufSize
))
2106 cifs_sb
->rsize
= pvolume_info
->rsize
;
2108 cifs_sb
->rsize
= CIFSMaxBufSize
;
2110 if (pvolume_info
->wsize
> PAGEVEC_SIZE
* PAGE_CACHE_SIZE
) {
2111 cERROR(1, ("wsize %d too large, using 4096 instead",
2112 pvolume_info
->wsize
));
2113 cifs_sb
->wsize
= 4096;
2114 } else if (pvolume_info
->wsize
)
2115 cifs_sb
->wsize
= pvolume_info
->wsize
;
2117 cifs_sb
->wsize
= min_t(const int,
2118 PAGEVEC_SIZE
* PAGE_CACHE_SIZE
,
2120 /* old default of CIFSMaxBufSize was too small now
2121 that SMB Write2 can send multiple pages in kvec.
2122 RFC1001 does not describe what happens when frame
2123 bigger than 128K is sent so use that as max in
2124 conjunction with 52K kvec constraint on arch with 4K
2127 if (cifs_sb
->rsize
< 2048) {
2128 cifs_sb
->rsize
= 2048;
2129 /* Windows ME may prefer this */
2130 cFYI(1, ("readsize set to minimum: 2048"));
2132 /* calculate prepath */
2133 cifs_sb
->prepath
= pvolume_info
->prepath
;
2134 if (cifs_sb
->prepath
) {
2135 cifs_sb
->prepathlen
= strlen(cifs_sb
->prepath
);
2136 /* we can not convert the / to \ in the path
2137 separators in the prefixpath yet because we do not
2138 know (until reset_cifs_unix_caps is called later)
2139 whether POSIX PATH CAP is available. We normalize
2140 the / to \ after reset_cifs_unix_caps is called */
2141 pvolume_info
->prepath
= NULL
;
2143 cifs_sb
->prepathlen
= 0;
2144 cifs_sb
->mnt_uid
= pvolume_info
->linux_uid
;
2145 cifs_sb
->mnt_gid
= pvolume_info
->linux_gid
;
2146 cifs_sb
->mnt_file_mode
= pvolume_info
->file_mode
;
2147 cifs_sb
->mnt_dir_mode
= pvolume_info
->dir_mode
;
2148 cFYI(1, ("file mode: 0x%x dir mode: 0x%x",
2149 cifs_sb
->mnt_file_mode
, cifs_sb
->mnt_dir_mode
));
2151 if (pvolume_info
->noperm
)
2152 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_NO_PERM
;
2153 if (pvolume_info
->setuids
)
2154 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_SET_UID
;
2155 if (pvolume_info
->server_ino
)
2156 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_SERVER_INUM
;
2157 if (pvolume_info
->remap
)
2158 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_MAP_SPECIAL_CHR
;
2159 if (pvolume_info
->no_xattr
)
2160 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_NO_XATTR
;
2161 if (pvolume_info
->sfu_emul
)
2162 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_UNX_EMUL
;
2163 if (pvolume_info
->nobrl
)
2164 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_NO_BRL
;
2165 if (pvolume_info
->mand_lock
)
2166 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_NOPOSIXBRL
;
2167 if (pvolume_info
->cifs_acl
)
2168 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_CIFS_ACL
;
2169 if (pvolume_info
->override_uid
)
2170 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_OVERR_UID
;
2171 if (pvolume_info
->override_gid
)
2172 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_OVERR_GID
;
2173 if (pvolume_info
->dynperm
)
2174 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_DYNPERM
;
2175 if (pvolume_info
->direct_io
) {
2176 cFYI(1, ("mounting share using direct i/o"));
2177 cifs_sb
->mnt_cifs_flags
|= CIFS_MOUNT_DIRECT_IO
;
2180 if ((pvolume_info
->cifs_acl
) && (pvolume_info
->dynperm
))
2181 cERROR(1, ("mount option dynperm ignored if cifsacl "
2182 "mount option supported"));
2186 cifs_mount(struct super_block
*sb
, struct cifs_sb_info
*cifs_sb
,
2187 char *mount_data
, const char *devname
)
2191 struct smb_vol
*volume_info
;
2192 struct cifsSesInfo
*pSesInfo
= NULL
;
2193 struct cifsTconInfo
*tcon
= NULL
;
2194 struct TCP_Server_Info
*srvTcp
= NULL
;
2198 volume_info
= kzalloc(sizeof(struct smb_vol
), GFP_KERNEL
);
2204 if (cifs_parse_mount_options(mount_data
, devname
, volume_info
)) {
2209 if (volume_info
->nullauth
) {
2210 cFYI(1, ("null user"));
2211 volume_info
->username
= "";
2212 } else if (volume_info
->username
) {
2213 /* BB fixme parse for domain name here */
2214 cFYI(1, ("Username: %s", volume_info
->username
));
2216 cifserror("No username specified");
2217 /* In userspace mount helper we can get user name from alternate
2218 locations such as env variables and files on disk */
2224 /* this is needed for ASCII cp to Unicode converts */
2225 if (volume_info
->iocharset
== NULL
) {
2226 cifs_sb
->local_nls
= load_nls_default();
2227 /* load_nls_default can not return null */
2229 cifs_sb
->local_nls
= load_nls(volume_info
->iocharset
);
2230 if (cifs_sb
->local_nls
== NULL
) {
2231 cERROR(1, ("CIFS mount error: iocharset %s not found",
2232 volume_info
->iocharset
));
2238 /* get a reference to a tcp session */
2239 srvTcp
= cifs_get_tcp_session(volume_info
);
2240 if (IS_ERR(srvTcp
)) {
2241 rc
= PTR_ERR(srvTcp
);
2245 pSesInfo
= cifs_find_smb_ses(srvTcp
, volume_info
->username
);
2247 cFYI(1, ("Existing smb sess found (status=%d)",
2250 * The existing SMB session already has a reference to srvTcp,
2251 * so we can put back the extra one we got before
2253 cifs_put_tcp_session(srvTcp
);
2255 down(&pSesInfo
->sesSem
);
2256 if (pSesInfo
->need_reconnect
) {
2257 cFYI(1, ("Session needs reconnect"));
2258 rc
= cifs_setup_session(xid
, pSesInfo
,
2259 cifs_sb
->local_nls
);
2261 up(&pSesInfo
->sesSem
);
2263 cFYI(1, ("Existing smb sess not found"));
2264 pSesInfo
= sesInfoAlloc();
2265 if (pSesInfo
== NULL
) {
2267 goto mount_fail_check
;
2270 /* new SMB session uses our srvTcp ref */
2271 pSesInfo
->server
= srvTcp
;
2272 if (srvTcp
->addr
.sockAddr6
.sin6_family
== AF_INET6
)
2273 sprintf(pSesInfo
->serverName
, NIP6_FMT
,
2274 NIP6(srvTcp
->addr
.sockAddr6
.sin6_addr
));
2276 sprintf(pSesInfo
->serverName
, NIPQUAD_FMT
,
2277 NIPQUAD(srvTcp
->addr
.sockAddr
.sin_addr
.s_addr
));
2279 write_lock(&cifs_tcp_ses_lock
);
2280 list_add(&pSesInfo
->smb_ses_list
, &srvTcp
->smb_ses_list
);
2281 write_unlock(&cifs_tcp_ses_lock
);
2283 /* volume_info->password freed at unmount */
2284 if (volume_info
->password
) {
2285 pSesInfo
->password
= volume_info
->password
;
2286 /* set to NULL to prevent freeing on exit */
2287 volume_info
->password
= NULL
;
2289 if (volume_info
->username
)
2290 strncpy(pSesInfo
->userName
, volume_info
->username
,
2292 if (volume_info
->domainname
) {
2293 int len
= strlen(volume_info
->domainname
);
2294 pSesInfo
->domainName
= kmalloc(len
+ 1, GFP_KERNEL
);
2295 if (pSesInfo
->domainName
)
2296 strcpy(pSesInfo
->domainName
,
2297 volume_info
->domainname
);
2299 pSesInfo
->linux_uid
= volume_info
->linux_uid
;
2300 pSesInfo
->overrideSecFlg
= volume_info
->secFlg
;
2301 down(&pSesInfo
->sesSem
);
2303 /* BB FIXME need to pass vol->secFlgs BB */
2304 rc
= cifs_setup_session(xid
, pSesInfo
,
2305 cifs_sb
->local_nls
);
2306 up(&pSesInfo
->sesSem
);
2309 /* search for existing tcon to this server share */
2311 setup_cifs_sb(volume_info
, cifs_sb
);
2313 tcon
= cifs_find_tcon(pSesInfo
, volume_info
->UNC
);
2315 cFYI(1, ("Found match on UNC path"));
2316 /* existing tcon already has a reference */
2317 cifs_put_smb_ses(pSesInfo
);
2318 if (tcon
->seal
!= volume_info
->seal
)
2319 cERROR(1, ("transport encryption setting "
2320 "conflicts with existing tid"));
2322 tcon
= tconInfoAlloc();
2325 goto mount_fail_check
;
2327 tcon
->ses
= pSesInfo
;
2329 /* check for null share name ie connect to dfs root */
2330 if ((strchr(volume_info
->UNC
+ 3, '\\') == NULL
)
2331 && (strchr(volume_info
->UNC
+ 3, '/') == NULL
)) {
2332 /* rc = connect_to_dfs_path(...) */
2333 cFYI(1, ("DFS root not supported"));
2335 goto mount_fail_check
;
2337 /* BB Do we need to wrap sesSem around
2338 * this TCon call and Unix SetFS as
2339 * we do on SessSetup and reconnect? */
2340 rc
= CIFSTCon(xid
, pSesInfo
, volume_info
->UNC
,
2341 tcon
, cifs_sb
->local_nls
);
2342 cFYI(1, ("CIFS Tcon rc = %d", rc
));
2343 if (volume_info
->nodfs
) {
2344 tcon
->Flags
&= ~SMB_SHARE_IS_IN_DFS
;
2345 cFYI(1, ("DFS disabled (%d)",
2350 goto mount_fail_check
;
2351 tcon
->seal
= volume_info
->seal
;
2352 write_lock(&cifs_tcp_ses_lock
);
2353 list_add(&tcon
->tcon_list
, &pSesInfo
->tcon_list
);
2354 write_unlock(&cifs_tcp_ses_lock
);
2357 /* we can have only one retry value for a connection
2358 to a share so for resources mounted more than once
2359 to the same server share the last value passed in
2360 for the retry flag is used */
2361 tcon
->retry
= volume_info
->retry
;
2362 tcon
->nocase
= volume_info
->nocase
;
2363 tcon
->local_lease
= volume_info
->local_lease
;
2366 if (pSesInfo
->capabilities
& CAP_LARGE_FILES
) {
2367 sb
->s_maxbytes
= (u64
) 1 << 63;
2369 sb
->s_maxbytes
= (u64
) 1 << 31; /* 2 GB */
2372 /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2373 sb
->s_time_gran
= 100;
2376 /* on error free sesinfo and tcon struct if needed */
2378 /* If find_unc succeeded then rc == 0 so we can not end */
2379 /* up accidently freeing someone elses tcon struct */
2381 cifs_put_tcon(tcon
);
2383 cifs_put_smb_ses(pSesInfo
);
2385 cifs_put_tcp_session(srvTcp
);
2388 cifs_sb
->tcon
= tcon
;
2390 /* do not care if following two calls succeed - informational */
2392 CIFSSMBQFSDeviceInfo(xid
, tcon
);
2393 CIFSSMBQFSAttributeInfo(xid
, tcon
);
2396 /* tell server which Unix caps we support */
2397 if (tcon
->ses
->capabilities
& CAP_UNIX
)
2398 /* reset of caps checks mount to see if unix extensions
2399 disabled for just this mount */
2400 reset_cifs_unix_caps(xid
, tcon
, sb
, volume_info
);
2402 tcon
->unix_ext
= 0; /* server does not support them */
2404 /* convert forward to back slashes in prepath here if needed */
2405 if ((cifs_sb
->mnt_cifs_flags
& CIFS_MOUNT_POSIX_PATHS
) == 0)
2406 convert_delimiter(cifs_sb
->prepath
, CIFS_DIR_SEP(cifs_sb
));
2408 if ((tcon
->unix_ext
== 0) && (cifs_sb
->rsize
> (1024 * 127))) {
2409 cifs_sb
->rsize
= 1024 * 127;
2410 cFYI(DBG2
, ("no very large read support, rsize now 127K"));
2412 if (!(tcon
->ses
->capabilities
& CAP_LARGE_WRITE_X
))
2413 cifs_sb
->wsize
= min(cifs_sb
->wsize
,
2414 (tcon
->ses
->server
->maxBuf
- MAX_CIFS_HDR_SIZE
));
2415 if (!(tcon
->ses
->capabilities
& CAP_LARGE_READ_X
))
2416 cifs_sb
->rsize
= min(cifs_sb
->rsize
,
2417 (tcon
->ses
->server
->maxBuf
- MAX_CIFS_HDR_SIZE
));
2419 /* volume_info->password is freed above when existing session found
2420 (in which case it is not needed anymore) but when new sesion is created
2421 the password ptr is put in the new session structure (in which case the
2422 password will be freed at unmount time) */
2424 /* zero out password before freeing */
2426 if (volume_info
->password
!= NULL
) {
2427 memset(volume_info
->password
, 0,
2428 strlen(volume_info
->password
));
2429 kfree(volume_info
->password
);
2431 kfree(volume_info
->UNC
);
2432 kfree(volume_info
->prepath
);
2440 CIFSSessSetup(unsigned int xid
, struct cifsSesInfo
*ses
,
2441 char session_key
[CIFS_SESS_KEY_SIZE
],
2442 const struct nls_table
*nls_codepage
)
2444 struct smb_hdr
*smb_buffer
;
2445 struct smb_hdr
*smb_buffer_response
;
2446 SESSION_SETUP_ANDX
*pSMB
;
2447 SESSION_SETUP_ANDX
*pSMBr
;
2452 int remaining_words
= 0;
2453 int bytes_returned
= 0;
2458 cFYI(1, ("In sesssetup"));
2461 user
= ses
->userName
;
2462 domain
= ses
->domainName
;
2463 smb_buffer
= cifs_buf_get();
2465 if (smb_buffer
== NULL
)
2468 smb_buffer_response
= smb_buffer
;
2469 pSMBr
= pSMB
= (SESSION_SETUP_ANDX
*) smb_buffer
;
2471 /* send SMBsessionSetup here */
2472 header_assemble(smb_buffer
, SMB_COM_SESSION_SETUP_ANDX
,
2473 NULL
/* no tCon exists yet */ , 13 /* wct */ );
2475 smb_buffer
->Mid
= GetNextMid(ses
->server
);
2476 pSMB
->req_no_secext
.AndXCommand
= 0xFF;
2477 pSMB
->req_no_secext
.MaxBufferSize
= cpu_to_le16(ses
->server
->maxBuf
);
2478 pSMB
->req_no_secext
.MaxMpxCount
= cpu_to_le16(ses
->server
->maxReq
);
2480 if (ses
->server
->secMode
&
2481 (SECMODE_SIGN_REQUIRED
| SECMODE_SIGN_ENABLED
))
2482 smb_buffer
->Flags2
|= SMBFLG2_SECURITY_SIGNATURE
;
2484 capabilities
= CAP_LARGE_FILES
| CAP_NT_SMBS
| CAP_LEVEL_II_OPLOCKS
|
2485 CAP_LARGE_WRITE_X
| CAP_LARGE_READ_X
;
2486 if (ses
->capabilities
& CAP_UNICODE
) {
2487 smb_buffer
->Flags2
|= SMBFLG2_UNICODE
;
2488 capabilities
|= CAP_UNICODE
;
2490 if (ses
->capabilities
& CAP_STATUS32
) {
2491 smb_buffer
->Flags2
|= SMBFLG2_ERR_STATUS
;
2492 capabilities
|= CAP_STATUS32
;
2494 if (ses
->capabilities
& CAP_DFS
) {
2495 smb_buffer
->Flags2
|= SMBFLG2_DFS
;
2496 capabilities
|= CAP_DFS
;
2498 pSMB
->req_no_secext
.Capabilities
= cpu_to_le32(capabilities
);
2500 pSMB
->req_no_secext
.CaseInsensitivePasswordLength
=
2501 cpu_to_le16(CIFS_SESS_KEY_SIZE
);
2503 pSMB
->req_no_secext
.CaseSensitivePasswordLength
=
2504 cpu_to_le16(CIFS_SESS_KEY_SIZE
);
2505 bcc_ptr
= pByteArea(smb_buffer
);
2506 memcpy(bcc_ptr
, (char *) session_key
, CIFS_SESS_KEY_SIZE
);
2507 bcc_ptr
+= CIFS_SESS_KEY_SIZE
;
2508 memcpy(bcc_ptr
, (char *) session_key
, CIFS_SESS_KEY_SIZE
);
2509 bcc_ptr
+= CIFS_SESS_KEY_SIZE
;
2511 if (ses
->capabilities
& CAP_UNICODE
) {
2512 if ((long) bcc_ptr
% 2) { /* must be word aligned for Unicode */
2517 bytes_returned
= 0; /* skip null user */
2520 cifs_strtoUCS((__le16
*) bcc_ptr
, user
, 100,
2522 /* convert number of 16 bit words to bytes */
2523 bcc_ptr
+= 2 * bytes_returned
;
2524 bcc_ptr
+= 2; /* trailing null */
2527 cifs_strtoUCS((__le16
*) bcc_ptr
,
2528 "CIFS_LINUX_DOM", 32, nls_codepage
);
2531 cifs_strtoUCS((__le16
*) bcc_ptr
, domain
, 64,
2533 bcc_ptr
+= 2 * bytes_returned
;
2536 cifs_strtoUCS((__le16
*) bcc_ptr
, "Linux version ",
2538 bcc_ptr
+= 2 * bytes_returned
;
2540 cifs_strtoUCS((__le16
*) bcc_ptr
, utsname()->release
,
2542 bcc_ptr
+= 2 * bytes_returned
;
2545 cifs_strtoUCS((__le16
*) bcc_ptr
, CIFS_NETWORK_OPSYS
,
2547 bcc_ptr
+= 2 * bytes_returned
;
2551 strncpy(bcc_ptr
, user
, 200);
2552 bcc_ptr
+= strnlen(user
, 200);
2556 if (domain
== NULL
) {
2557 strcpy(bcc_ptr
, "CIFS_LINUX_DOM");
2558 bcc_ptr
+= strlen("CIFS_LINUX_DOM") + 1;
2560 strncpy(bcc_ptr
, domain
, 64);
2561 bcc_ptr
+= strnlen(domain
, 64);
2565 strcpy(bcc_ptr
, "Linux version ");
2566 bcc_ptr
+= strlen("Linux version ");
2567 strcpy(bcc_ptr
, utsname()->release
);
2568 bcc_ptr
+= strlen(utsname()->release
) + 1;
2569 strcpy(bcc_ptr
, CIFS_NETWORK_OPSYS
);
2570 bcc_ptr
+= strlen(CIFS_NETWORK_OPSYS
) + 1;
2572 count
= (long) bcc_ptr
- (long) pByteArea(smb_buffer
);
2573 smb_buffer
->smb_buf_length
+= count
;
2574 pSMB
->req_no_secext
.ByteCount
= cpu_to_le16(count
);
2576 rc
= SendReceive(xid
, ses
, smb_buffer
, smb_buffer_response
,
2577 &bytes_returned
, CIFS_LONG_OP
);
2579 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2580 } else if ((smb_buffer_response
->WordCount
== 3)
2581 || (smb_buffer_response
->WordCount
== 4)) {
2582 __u16 action
= le16_to_cpu(pSMBr
->resp
.Action
);
2583 __u16 blob_len
= le16_to_cpu(pSMBr
->resp
.SecurityBlobLength
);
2584 if (action
& GUEST_LOGIN
)
2585 cFYI(1, ("Guest login")); /* BB mark SesInfo struct? */
2586 ses
->Suid
= smb_buffer_response
->Uid
; /* UID left in wire format
2588 cFYI(1, ("UID = %d ", ses
->Suid
));
2589 /* response can have either 3 or 4 word count - Samba sends 3 */
2590 bcc_ptr
= pByteArea(smb_buffer_response
);
2591 if ((pSMBr
->resp
.hdr
.WordCount
== 3)
2592 || ((pSMBr
->resp
.hdr
.WordCount
== 4)
2593 && (blob_len
< pSMBr
->resp
.ByteCount
))) {
2594 if (pSMBr
->resp
.hdr
.WordCount
== 4)
2595 bcc_ptr
+= blob_len
;
2597 if (smb_buffer
->Flags2
& SMBFLG2_UNICODE
) {
2598 if ((long) (bcc_ptr
) % 2) {
2600 (BCC(smb_buffer_response
) - 1) / 2;
2601 /* Unicode strings must be word
2606 BCC(smb_buffer_response
) / 2;
2609 UniStrnlen((wchar_t *) bcc_ptr
,
2610 remaining_words
- 1);
2611 /* We look for obvious messed up bcc or strings in response so we do not go off
2612 the end since (at least) WIN2K and Windows XP have a major bug in not null
2613 terminating last Unicode string in response */
2615 kfree(ses
->serverOS
);
2616 ses
->serverOS
= kzalloc(2 * (len
+ 1),
2618 if (ses
->serverOS
== NULL
)
2619 goto sesssetup_nomem
;
2620 cifs_strfromUCS_le(ses
->serverOS
,
2623 bcc_ptr
+= 2 * (len
+ 1);
2624 remaining_words
-= len
+ 1;
2625 ses
->serverOS
[2 * len
] = 0;
2626 ses
->serverOS
[1 + (2 * len
)] = 0;
2627 if (remaining_words
> 0) {
2628 len
= UniStrnlen((wchar_t *)bcc_ptr
,
2630 kfree(ses
->serverNOS
);
2631 ses
->serverNOS
= kzalloc(2 * (len
+ 1),
2633 if (ses
->serverNOS
== NULL
)
2634 goto sesssetup_nomem
;
2635 cifs_strfromUCS_le(ses
->serverNOS
,
2638 bcc_ptr
+= 2 * (len
+ 1);
2639 ses
->serverNOS
[2 * len
] = 0;
2640 ses
->serverNOS
[1 + (2 * len
)] = 0;
2641 if (strncmp(ses
->serverNOS
,
2642 "NT LAN Manager 4", 16) == 0) {
2643 cFYI(1, ("NT4 server"));
2644 ses
->flags
|= CIFS_SES_NT4
;
2646 remaining_words
-= len
+ 1;
2647 if (remaining_words
> 0) {
2648 len
= UniStrnlen((wchar_t *) bcc_ptr
, remaining_words
);
2649 /* last string is not always null terminated
2650 (for e.g. for Windows XP & 2000) */
2651 if (ses
->serverDomain
)
2652 kfree(ses
->serverDomain
);
2656 if (ses
->serverDomain
== NULL
)
2657 goto sesssetup_nomem
;
2658 cifs_strfromUCS_le(ses
->serverDomain
,
2661 bcc_ptr
+= 2 * (len
+ 1);
2662 ses
->serverDomain
[2*len
] = 0;
2663 ses
->serverDomain
[1+(2*len
)] = 0;
2664 } else { /* else no more room so create
2665 dummy domain string */
2666 if (ses
->serverDomain
)
2667 kfree(ses
->serverDomain
);
2669 kzalloc(2, GFP_KERNEL
);
2671 } else { /* no room so create dummy domain
2674 /* if these kcallocs fail not much we
2675 can do, but better to not fail the
2677 kfree(ses
->serverDomain
);
2679 kzalloc(2, GFP_KERNEL
);
2680 kfree(ses
->serverNOS
);
2682 kzalloc(2, GFP_KERNEL
);
2684 } else { /* ASCII */
2685 len
= strnlen(bcc_ptr
, 1024);
2686 if (((long) bcc_ptr
+ len
) - (long)
2687 pByteArea(smb_buffer_response
)
2688 <= BCC(smb_buffer_response
)) {
2689 kfree(ses
->serverOS
);
2690 ses
->serverOS
= kzalloc(len
+ 1,
2692 if (ses
->serverOS
== NULL
)
2693 goto sesssetup_nomem
;
2694 strncpy(ses
->serverOS
, bcc_ptr
, len
);
2697 /* null terminate the string */
2701 len
= strnlen(bcc_ptr
, 1024);
2702 kfree(ses
->serverNOS
);
2703 ses
->serverNOS
= kzalloc(len
+ 1,
2705 if (ses
->serverNOS
== NULL
)
2706 goto sesssetup_nomem
;
2707 strncpy(ses
->serverNOS
, bcc_ptr
, len
);
2712 len
= strnlen(bcc_ptr
, 1024);
2713 if (ses
->serverDomain
)
2714 kfree(ses
->serverDomain
);
2715 ses
->serverDomain
= kzalloc(len
+ 1,
2717 if (ses
->serverDomain
== NULL
)
2718 goto sesssetup_nomem
;
2719 strncpy(ses
->serverDomain
, bcc_ptr
,
2726 ("Variable field of length %d "
2727 "extends beyond end of smb ",
2731 cERROR(1, ("Security Blob Length extends beyond "
2735 cERROR(1, ("Invalid Word count %d: ",
2736 smb_buffer_response
->WordCount
));
2739 sesssetup_nomem
: /* do not return an error on nomem for the info strings,
2740 since that could make reconnection harder, and
2741 reconnection might be needed to free memory */
2742 cifs_buf_release(smb_buffer
);
2748 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid
,
2749 struct cifsSesInfo
*ses
, bool *pNTLMv2_flag
,
2750 const struct nls_table
*nls_codepage
)
2752 struct smb_hdr
*smb_buffer
;
2753 struct smb_hdr
*smb_buffer_response
;
2754 SESSION_SETUP_ANDX
*pSMB
;
2755 SESSION_SETUP_ANDX
*pSMBr
;
2759 int remaining_words
= 0;
2760 int bytes_returned
= 0;
2762 int SecurityBlobLength
= sizeof(NEGOTIATE_MESSAGE
);
2763 PNEGOTIATE_MESSAGE SecurityBlob
;
2764 PCHALLENGE_MESSAGE SecurityBlob2
;
2765 __u32 negotiate_flags
, capabilities
;
2768 cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2771 domain
= ses
->domainName
;
2772 *pNTLMv2_flag
= false;
2773 smb_buffer
= cifs_buf_get();
2774 if (smb_buffer
== NULL
) {
2777 smb_buffer_response
= smb_buffer
;
2778 pSMB
= (SESSION_SETUP_ANDX
*) smb_buffer
;
2779 pSMBr
= (SESSION_SETUP_ANDX
*) smb_buffer_response
;
2781 /* send SMBsessionSetup here */
2782 header_assemble(smb_buffer
, SMB_COM_SESSION_SETUP_ANDX
,
2783 NULL
/* no tCon exists yet */ , 12 /* wct */ );
2785 smb_buffer
->Mid
= GetNextMid(ses
->server
);
2786 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_EXT_SEC
;
2787 pSMB
->req
.hdr
.Flags
|= (SMBFLG_CASELESS
| SMBFLG_CANONICAL_PATH_FORMAT
);
2789 pSMB
->req
.AndXCommand
= 0xFF;
2790 pSMB
->req
.MaxBufferSize
= cpu_to_le16(ses
->server
->maxBuf
);
2791 pSMB
->req
.MaxMpxCount
= cpu_to_le16(ses
->server
->maxReq
);
2793 if (ses
->server
->secMode
& (SECMODE_SIGN_REQUIRED
| SECMODE_SIGN_ENABLED
))
2794 smb_buffer
->Flags2
|= SMBFLG2_SECURITY_SIGNATURE
;
2796 capabilities
= CAP_LARGE_FILES
| CAP_NT_SMBS
| CAP_LEVEL_II_OPLOCKS
|
2797 CAP_EXTENDED_SECURITY
;
2798 if (ses
->capabilities
& CAP_UNICODE
) {
2799 smb_buffer
->Flags2
|= SMBFLG2_UNICODE
;
2800 capabilities
|= CAP_UNICODE
;
2802 if (ses
->capabilities
& CAP_STATUS32
) {
2803 smb_buffer
->Flags2
|= SMBFLG2_ERR_STATUS
;
2804 capabilities
|= CAP_STATUS32
;
2806 if (ses
->capabilities
& CAP_DFS
) {
2807 smb_buffer
->Flags2
|= SMBFLG2_DFS
;
2808 capabilities
|= CAP_DFS
;
2810 pSMB
->req
.Capabilities
= cpu_to_le32(capabilities
);
2812 bcc_ptr
= (char *) &pSMB
->req
.SecurityBlob
;
2813 SecurityBlob
= (PNEGOTIATE_MESSAGE
) bcc_ptr
;
2814 strncpy(SecurityBlob
->Signature
, NTLMSSP_SIGNATURE
, 8);
2815 SecurityBlob
->MessageType
= NtLmNegotiate
;
2817 NTLMSSP_NEGOTIATE_UNICODE
| NTLMSSP_NEGOTIATE_OEM
|
2818 NTLMSSP_REQUEST_TARGET
| NTLMSSP_NEGOTIATE_NTLM
|
2819 NTLMSSP_NEGOTIATE_56
|
2820 /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128
;
2822 negotiate_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
2823 /* if (ntlmv2_support)
2824 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2825 /* setup pointers to domain name and workstation name */
2826 bcc_ptr
+= SecurityBlobLength
;
2828 SecurityBlob
->WorkstationName
.Buffer
= 0;
2829 SecurityBlob
->WorkstationName
.Length
= 0;
2830 SecurityBlob
->WorkstationName
.MaximumLength
= 0;
2832 /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2833 along with username on auth request (ie the response to challenge) */
2834 SecurityBlob
->DomainName
.Buffer
= 0;
2835 SecurityBlob
->DomainName
.Length
= 0;
2836 SecurityBlob
->DomainName
.MaximumLength
= 0;
2837 if (ses
->capabilities
& CAP_UNICODE
) {
2838 if ((long) bcc_ptr
% 2) {
2844 cifs_strtoUCS((__le16
*) bcc_ptr
, "Linux version ",
2846 bcc_ptr
+= 2 * bytes_returned
;
2848 cifs_strtoUCS((__le16
*) bcc_ptr
, utsname()->release
, 32,
2850 bcc_ptr
+= 2 * bytes_returned
;
2851 bcc_ptr
+= 2; /* null terminate Linux version */
2853 cifs_strtoUCS((__le16
*) bcc_ptr
, CIFS_NETWORK_OPSYS
,
2855 bcc_ptr
+= 2 * bytes_returned
;
2858 bcc_ptr
+= 2; /* null terminate network opsys string */
2861 bcc_ptr
+= 2; /* null domain */
2862 } else { /* ASCII */
2863 strcpy(bcc_ptr
, "Linux version ");
2864 bcc_ptr
+= strlen("Linux version ");
2865 strcpy(bcc_ptr
, utsname()->release
);
2866 bcc_ptr
+= strlen(utsname()->release
) + 1;
2867 strcpy(bcc_ptr
, CIFS_NETWORK_OPSYS
);
2868 bcc_ptr
+= strlen(CIFS_NETWORK_OPSYS
) + 1;
2869 bcc_ptr
++; /* empty domain field */
2872 SecurityBlob
->NegotiateFlags
= cpu_to_le32(negotiate_flags
);
2873 pSMB
->req
.SecurityBlobLength
= cpu_to_le16(SecurityBlobLength
);
2874 count
= (long) bcc_ptr
- (long) pByteArea(smb_buffer
);
2875 smb_buffer
->smb_buf_length
+= count
;
2876 pSMB
->req
.ByteCount
= cpu_to_le16(count
);
2878 rc
= SendReceive(xid
, ses
, smb_buffer
, smb_buffer_response
,
2879 &bytes_returned
, CIFS_LONG_OP
);
2881 if (smb_buffer_response
->Status
.CifsError
==
2882 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED
))
2886 /* rc = map_smb_to_linux_error(smb_buffer_response); *//* done in SendReceive now */
2887 } else if ((smb_buffer_response
->WordCount
== 3)
2888 || (smb_buffer_response
->WordCount
== 4)) {
2889 __u16 action
= le16_to_cpu(pSMBr
->resp
.Action
);
2890 __u16 blob_len
= le16_to_cpu(pSMBr
->resp
.SecurityBlobLength
);
2892 if (action
& GUEST_LOGIN
)
2893 cFYI(1, ("Guest login"));
2894 /* Do we want to set anything in SesInfo struct when guest login? */
2896 bcc_ptr
= pByteArea(smb_buffer_response
);
2897 /* response can have either 3 or 4 word count - Samba sends 3 */
2899 SecurityBlob2
= (PCHALLENGE_MESSAGE
) bcc_ptr
;
2900 if (SecurityBlob2
->MessageType
!= NtLmChallenge
) {
2901 cFYI(1, ("Unexpected NTLMSSP message type received %d",
2902 SecurityBlob2
->MessageType
));
2904 ses
->Suid
= smb_buffer_response
->Uid
; /* UID left in le format */
2905 cFYI(1, ("UID = %d", ses
->Suid
));
2906 if ((pSMBr
->resp
.hdr
.WordCount
== 3)
2907 || ((pSMBr
->resp
.hdr
.WordCount
== 4)
2909 pSMBr
->resp
.ByteCount
))) {
2911 if (pSMBr
->resp
.hdr
.WordCount
== 4) {
2912 bcc_ptr
+= blob_len
;
2913 cFYI(1, ("Security Blob Length %d",
2917 cFYI(1, ("NTLMSSP Challenge rcvd"));
2919 memcpy(ses
->server
->cryptKey
,
2920 SecurityBlob2
->Challenge
,
2921 CIFS_CRYPTO_KEY_SIZE
);
2922 if (SecurityBlob2
->NegotiateFlags
&
2923 cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2
))
2924 *pNTLMv2_flag
= true;
2926 if ((SecurityBlob2
->NegotiateFlags
&
2927 cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN
))
2928 || (sign_CIFS_PDUs
> 1))
2929 ses
->server
->secMode
|=
2930 SECMODE_SIGN_REQUIRED
;
2931 if ((SecurityBlob2
->NegotiateFlags
&
2932 cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN
)) && (sign_CIFS_PDUs
))
2933 ses
->server
->secMode
|=
2934 SECMODE_SIGN_ENABLED
;
2936 if (smb_buffer
->Flags2
& SMBFLG2_UNICODE
) {
2937 if ((long) (bcc_ptr
) % 2) {
2939 (BCC(smb_buffer_response
)
2941 /* Must word align unicode strings */
2946 (smb_buffer_response
) / 2;
2949 UniStrnlen((wchar_t *) bcc_ptr
,
2950 remaining_words
- 1);
2951 /* We look for obvious messed up bcc or strings in response so we do not go off
2952 the end since (at least) WIN2K and Windows XP have a major bug in not null
2953 terminating last Unicode string in response */
2955 kfree(ses
->serverOS
);
2957 kzalloc(2 * (len
+ 1), GFP_KERNEL
);
2958 cifs_strfromUCS_le(ses
->serverOS
,
2962 bcc_ptr
+= 2 * (len
+ 1);
2963 remaining_words
-= len
+ 1;
2964 ses
->serverOS
[2 * len
] = 0;
2965 ses
->serverOS
[1 + (2 * len
)] = 0;
2966 if (remaining_words
> 0) {
2967 len
= UniStrnlen((wchar_t *)
2971 kfree(ses
->serverNOS
);
2973 kzalloc(2 * (len
+ 1),
2975 cifs_strfromUCS_le(ses
->
2981 bcc_ptr
+= 2 * (len
+ 1);
2982 ses
->serverNOS
[2 * len
] = 0;
2985 remaining_words
-= len
+ 1;
2986 if (remaining_words
> 0) {
2987 len
= UniStrnlen((wchar_t *) bcc_ptr
, remaining_words
);
2988 /* last string not always null terminated
2989 (for e.g. for Windows XP & 2000) */
2990 kfree(ses
->serverDomain
);
3002 ses
->serverDomain
[2*len
]
3007 } /* else no more room so create dummy domain string */
3009 kfree(ses
->serverDomain
);
3014 } else { /* no room so create dummy domain and NOS string */
3015 kfree(ses
->serverDomain
);
3017 kzalloc(2, GFP_KERNEL
);
3018 kfree(ses
->serverNOS
);
3020 kzalloc(2, GFP_KERNEL
);
3022 } else { /* ASCII */
3023 len
= strnlen(bcc_ptr
, 1024);
3024 if (((long) bcc_ptr
+ len
) - (long)
3025 pByteArea(smb_buffer_response
)
3026 <= BCC(smb_buffer_response
)) {
3028 kfree(ses
->serverOS
);
3032 strncpy(ses
->serverOS
,
3036 bcc_ptr
[0] = 0; /* null terminate string */
3039 len
= strnlen(bcc_ptr
, 1024);
3040 kfree(ses
->serverNOS
);
3044 strncpy(ses
->serverNOS
, bcc_ptr
, len
);
3049 len
= strnlen(bcc_ptr
, 1024);
3050 kfree(ses
->serverDomain
);
3054 strncpy(ses
->serverDomain
,
3061 ("field of length %d "
3062 "extends beyond end of smb",
3066 cERROR(1, ("Security Blob Length extends beyond"
3070 cERROR(1, ("No session structure passed in."));
3073 cERROR(1, ("Invalid Word count %d:",
3074 smb_buffer_response
->WordCount
));
3078 cifs_buf_release(smb_buffer
);
3083 CIFSNTLMSSPAuthSessSetup(unsigned int xid
, struct cifsSesInfo
*ses
,
3084 char *ntlm_session_key
, bool ntlmv2_flag
,
3085 const struct nls_table
*nls_codepage
)
3087 struct smb_hdr
*smb_buffer
;
3088 struct smb_hdr
*smb_buffer_response
;
3089 SESSION_SETUP_ANDX
*pSMB
;
3090 SESSION_SETUP_ANDX
*pSMBr
;
3095 int remaining_words
= 0;
3096 int bytes_returned
= 0;
3098 int SecurityBlobLength
= sizeof(AUTHENTICATE_MESSAGE
);
3099 PAUTHENTICATE_MESSAGE SecurityBlob
;
3100 __u32 negotiate_flags
, capabilities
;
3103 cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
3106 user
= ses
->userName
;
3107 domain
= ses
->domainName
;
3108 smb_buffer
= cifs_buf_get();
3109 if (smb_buffer
== NULL
) {
3112 smb_buffer_response
= smb_buffer
;
3113 pSMB
= (SESSION_SETUP_ANDX
*)smb_buffer
;
3114 pSMBr
= (SESSION_SETUP_ANDX
*)smb_buffer_response
;
3116 /* send SMBsessionSetup here */
3117 header_assemble(smb_buffer
, SMB_COM_SESSION_SETUP_ANDX
,
3118 NULL
/* no tCon exists yet */ , 12 /* wct */ );
3120 smb_buffer
->Mid
= GetNextMid(ses
->server
);
3121 pSMB
->req
.hdr
.Flags
|= (SMBFLG_CASELESS
| SMBFLG_CANONICAL_PATH_FORMAT
);
3122 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_EXT_SEC
;
3123 pSMB
->req
.AndXCommand
= 0xFF;
3124 pSMB
->req
.MaxBufferSize
= cpu_to_le16(ses
->server
->maxBuf
);
3125 pSMB
->req
.MaxMpxCount
= cpu_to_le16(ses
->server
->maxReq
);
3127 pSMB
->req
.hdr
.Uid
= ses
->Suid
;
3129 if (ses
->server
->secMode
& (SECMODE_SIGN_REQUIRED
| SECMODE_SIGN_ENABLED
))
3130 smb_buffer
->Flags2
|= SMBFLG2_SECURITY_SIGNATURE
;
3132 capabilities
= CAP_LARGE_FILES
| CAP_NT_SMBS
| CAP_LEVEL_II_OPLOCKS
|
3133 CAP_EXTENDED_SECURITY
;
3134 if (ses
->capabilities
& CAP_UNICODE
) {
3135 smb_buffer
->Flags2
|= SMBFLG2_UNICODE
;
3136 capabilities
|= CAP_UNICODE
;
3138 if (ses
->capabilities
& CAP_STATUS32
) {
3139 smb_buffer
->Flags2
|= SMBFLG2_ERR_STATUS
;
3140 capabilities
|= CAP_STATUS32
;
3142 if (ses
->capabilities
& CAP_DFS
) {
3143 smb_buffer
->Flags2
|= SMBFLG2_DFS
;
3144 capabilities
|= CAP_DFS
;
3146 pSMB
->req
.Capabilities
= cpu_to_le32(capabilities
);
3148 bcc_ptr
= (char *)&pSMB
->req
.SecurityBlob
;
3149 SecurityBlob
= (PAUTHENTICATE_MESSAGE
)bcc_ptr
;
3150 strncpy(SecurityBlob
->Signature
, NTLMSSP_SIGNATURE
, 8);
3151 SecurityBlob
->MessageType
= NtLmAuthenticate
;
3152 bcc_ptr
+= SecurityBlobLength
;
3153 negotiate_flags
= NTLMSSP_NEGOTIATE_UNICODE
| NTLMSSP_REQUEST_TARGET
|
3154 NTLMSSP_NEGOTIATE_NTLM
| NTLMSSP_NEGOTIATE_TARGET_INFO
|
3155 0x80000000 | NTLMSSP_NEGOTIATE_128
;
3157 negotiate_flags
|= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN
;
3159 negotiate_flags
|= NTLMSSP_NEGOTIATE_NTLMV2
;
3161 /* setup pointers to domain name and workstation name */
3163 SecurityBlob
->WorkstationName
.Buffer
= 0;
3164 SecurityBlob
->WorkstationName
.Length
= 0;
3165 SecurityBlob
->WorkstationName
.MaximumLength
= 0;
3166 SecurityBlob
->SessionKey
.Length
= 0;
3167 SecurityBlob
->SessionKey
.MaximumLength
= 0;
3168 SecurityBlob
->SessionKey
.Buffer
= 0;
3170 SecurityBlob
->LmChallengeResponse
.Length
= 0;
3171 SecurityBlob
->LmChallengeResponse
.MaximumLength
= 0;
3172 SecurityBlob
->LmChallengeResponse
.Buffer
= 0;
3174 SecurityBlob
->NtChallengeResponse
.Length
=
3175 cpu_to_le16(CIFS_SESS_KEY_SIZE
);
3176 SecurityBlob
->NtChallengeResponse
.MaximumLength
=
3177 cpu_to_le16(CIFS_SESS_KEY_SIZE
);
3178 memcpy(bcc_ptr
, ntlm_session_key
, CIFS_SESS_KEY_SIZE
);
3179 SecurityBlob
->NtChallengeResponse
.Buffer
=
3180 cpu_to_le32(SecurityBlobLength
);
3181 SecurityBlobLength
+= CIFS_SESS_KEY_SIZE
;
3182 bcc_ptr
+= CIFS_SESS_KEY_SIZE
;
3184 if (ses
->capabilities
& CAP_UNICODE
) {
3185 if (domain
== NULL
) {
3186 SecurityBlob
->DomainName
.Buffer
= 0;
3187 SecurityBlob
->DomainName
.Length
= 0;
3188 SecurityBlob
->DomainName
.MaximumLength
= 0;
3190 __u16 ln
= cifs_strtoUCS((__le16
*) bcc_ptr
, domain
, 64,
3193 SecurityBlob
->DomainName
.MaximumLength
=
3195 SecurityBlob
->DomainName
.Buffer
=
3196 cpu_to_le32(SecurityBlobLength
);
3198 SecurityBlobLength
+= ln
;
3199 SecurityBlob
->DomainName
.Length
= cpu_to_le16(ln
);
3202 SecurityBlob
->UserName
.Buffer
= 0;
3203 SecurityBlob
->UserName
.Length
= 0;
3204 SecurityBlob
->UserName
.MaximumLength
= 0;
3206 __u16 ln
= cifs_strtoUCS((__le16
*) bcc_ptr
, user
, 64,
3209 SecurityBlob
->UserName
.MaximumLength
=
3211 SecurityBlob
->UserName
.Buffer
=
3212 cpu_to_le32(SecurityBlobLength
);
3214 SecurityBlobLength
+= ln
;
3215 SecurityBlob
->UserName
.Length
= cpu_to_le16(ln
);
3218 /* SecurityBlob->WorkstationName.Length =
3219 cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
3220 SecurityBlob->WorkstationName.Length *= 2;
3221 SecurityBlob->WorkstationName.MaximumLength =
3222 cpu_to_le16(SecurityBlob->WorkstationName.Length);
3223 SecurityBlob->WorkstationName.Buffer =
3224 cpu_to_le32(SecurityBlobLength);
3225 bcc_ptr += SecurityBlob->WorkstationName.Length;
3226 SecurityBlobLength += SecurityBlob->WorkstationName.Length;
3227 SecurityBlob->WorkstationName.Length =
3228 cpu_to_le16(SecurityBlob->WorkstationName.Length); */
3230 if ((long) bcc_ptr
% 2) {
3235 cifs_strtoUCS((__le16
*) bcc_ptr
, "Linux version ",
3237 bcc_ptr
+= 2 * bytes_returned
;
3239 cifs_strtoUCS((__le16
*) bcc_ptr
, utsname()->release
, 32,
3241 bcc_ptr
+= 2 * bytes_returned
;
3242 bcc_ptr
+= 2; /* null term version string */
3244 cifs_strtoUCS((__le16
*) bcc_ptr
, CIFS_NETWORK_OPSYS
,
3246 bcc_ptr
+= 2 * bytes_returned
;
3249 bcc_ptr
+= 2; /* null terminate network opsys string */
3252 bcc_ptr
+= 2; /* null domain */
3253 } else { /* ASCII */
3254 if (domain
== NULL
) {
3255 SecurityBlob
->DomainName
.Buffer
= 0;
3256 SecurityBlob
->DomainName
.Length
= 0;
3257 SecurityBlob
->DomainName
.MaximumLength
= 0;
3260 negotiate_flags
|= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED
;
3261 strncpy(bcc_ptr
, domain
, 63);
3262 ln
= strnlen(domain
, 64);
3263 SecurityBlob
->DomainName
.MaximumLength
=
3265 SecurityBlob
->DomainName
.Buffer
=
3266 cpu_to_le32(SecurityBlobLength
);
3268 SecurityBlobLength
+= ln
;
3269 SecurityBlob
->DomainName
.Length
= cpu_to_le16(ln
);
3272 SecurityBlob
->UserName
.Buffer
= 0;
3273 SecurityBlob
->UserName
.Length
= 0;
3274 SecurityBlob
->UserName
.MaximumLength
= 0;
3277 strncpy(bcc_ptr
, user
, 63);
3278 ln
= strnlen(user
, 64);
3279 SecurityBlob
->UserName
.MaximumLength
= cpu_to_le16(ln
);
3280 SecurityBlob
->UserName
.Buffer
=
3281 cpu_to_le32(SecurityBlobLength
);
3283 SecurityBlobLength
+= ln
;
3284 SecurityBlob
->UserName
.Length
= cpu_to_le16(ln
);
3286 /* BB fill in our workstation name if known BB */
3288 strcpy(bcc_ptr
, "Linux version ");
3289 bcc_ptr
+= strlen("Linux version ");
3290 strcpy(bcc_ptr
, utsname()->release
);
3291 bcc_ptr
+= strlen(utsname()->release
) + 1;
3292 strcpy(bcc_ptr
, CIFS_NETWORK_OPSYS
);
3293 bcc_ptr
+= strlen(CIFS_NETWORK_OPSYS
) + 1;
3294 bcc_ptr
++; /* null domain */
3297 SecurityBlob
->NegotiateFlags
= cpu_to_le32(negotiate_flags
);
3298 pSMB
->req
.SecurityBlobLength
= cpu_to_le16(SecurityBlobLength
);
3299 count
= (long) bcc_ptr
- (long) pByteArea(smb_buffer
);
3300 smb_buffer
->smb_buf_length
+= count
;
3301 pSMB
->req
.ByteCount
= cpu_to_le16(count
);
3303 rc
= SendReceive(xid
, ses
, smb_buffer
, smb_buffer_response
,
3304 &bytes_returned
, CIFS_LONG_OP
);
3306 /* rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
3307 } else if ((smb_buffer_response
->WordCount
== 3) ||
3308 (smb_buffer_response
->WordCount
== 4)) {
3309 __u16 action
= le16_to_cpu(pSMBr
->resp
.Action
);
3310 __u16 blob_len
= le16_to_cpu(pSMBr
->resp
.SecurityBlobLength
);
3311 if (action
& GUEST_LOGIN
)
3312 cFYI(1, ("Guest login")); /* BB Should we set anything
3313 in SesInfo struct ? */
3314 /* if (SecurityBlob2->MessageType != NtLm??) {
3315 cFYI("Unexpected message type on auth response is %d"));
3320 ("Check challenge UID %d vs auth response UID %d",
3321 ses
->Suid
, smb_buffer_response
->Uid
));
3322 /* UID left in wire format */
3323 ses
->Suid
= smb_buffer_response
->Uid
;
3324 bcc_ptr
= pByteArea(smb_buffer_response
);
3325 /* response can have either 3 or 4 word count - Samba sends 3 */
3326 if ((pSMBr
->resp
.hdr
.WordCount
== 3)
3327 || ((pSMBr
->resp
.hdr
.WordCount
== 4)
3329 pSMBr
->resp
.ByteCount
))) {
3330 if (pSMBr
->resp
.hdr
.WordCount
== 4) {
3334 ("Security Blob Length %d ",
3339 ("NTLMSSP response to Authenticate "));
3341 if (smb_buffer
->Flags2
& SMBFLG2_UNICODE
) {
3342 if ((long) (bcc_ptr
) % 2) {
3344 (BCC(smb_buffer_response
)
3346 bcc_ptr
++; /* Unicode strings must be word aligned */
3348 remaining_words
= BCC(smb_buffer_response
) / 2;
3350 len
= UniStrnlen((wchar_t *) bcc_ptr
,
3351 remaining_words
- 1);
3352 /* We look for obvious messed up bcc or strings in response so we do not go off
3353 the end since (at least) WIN2K and Windows XP have a major bug in not null
3354 terminating last Unicode string in response */
3356 kfree(ses
->serverOS
);
3358 kzalloc(2 * (len
+ 1), GFP_KERNEL
);
3359 cifs_strfromUCS_le(ses
->serverOS
,
3363 bcc_ptr
+= 2 * (len
+ 1);
3364 remaining_words
-= len
+ 1;
3365 ses
->serverOS
[2 * len
] = 0;
3366 ses
->serverOS
[1 + (2 * len
)] = 0;
3367 if (remaining_words
> 0) {
3368 len
= UniStrnlen((wchar_t *)
3372 kfree(ses
->serverNOS
);
3374 kzalloc(2 * (len
+ 1),
3376 cifs_strfromUCS_le(ses
->
3382 bcc_ptr
+= 2 * (len
+ 1);
3383 ses
->serverNOS
[2 * len
] = 0;
3384 ses
->serverNOS
[1+(2*len
)] = 0;
3385 remaining_words
-= len
+ 1;
3386 if (remaining_words
> 0) {
3387 len
= UniStrnlen((wchar_t *) bcc_ptr
, remaining_words
);
3388 /* last string not always null terminated (e.g. for Windows XP & 2000) */
3389 if (ses
->serverDomain
)
3390 kfree(ses
->serverDomain
);
3415 } /* else no more room so create dummy domain string */
3417 if (ses
->serverDomain
)
3418 kfree(ses
->serverDomain
);
3419 ses
->serverDomain
= kzalloc(2,GFP_KERNEL
);
3421 } else { /* no room so create dummy domain and NOS string */
3422 if (ses
->serverDomain
)
3423 kfree(ses
->serverDomain
);
3424 ses
->serverDomain
= kzalloc(2, GFP_KERNEL
);
3425 kfree(ses
->serverNOS
);
3426 ses
->serverNOS
= kzalloc(2, GFP_KERNEL
);
3428 } else { /* ASCII */
3429 len
= strnlen(bcc_ptr
, 1024);
3430 if (((long) bcc_ptr
+ len
) -
3431 (long) pByteArea(smb_buffer_response
)
3432 <= BCC(smb_buffer_response
)) {
3434 kfree(ses
->serverOS
);
3435 ses
->serverOS
= kzalloc(len
+ 1, GFP_KERNEL
);
3436 strncpy(ses
->serverOS
,bcc_ptr
, len
);
3439 bcc_ptr
[0] = 0; /* null terminate the string */
3442 len
= strnlen(bcc_ptr
, 1024);
3443 kfree(ses
->serverNOS
);
3444 ses
->serverNOS
= kzalloc(len
+1,
3446 strncpy(ses
->serverNOS
,
3452 len
= strnlen(bcc_ptr
, 1024);
3453 if (ses
->serverDomain
)
3454 kfree(ses
->serverDomain
);
3458 strncpy(ses
->serverDomain
,
3464 cFYI(1, ("field of length %d "
3465 "extends beyond end of smb ",
3469 cERROR(1, ("Security Blob extends beyond end "
3473 cERROR(1, ("No session structure passed in."));
3476 cERROR(1, ("Invalid Word count %d: ",
3477 smb_buffer_response
->WordCount
));
3481 cifs_buf_release(smb_buffer
);
3487 CIFSTCon(unsigned int xid
, struct cifsSesInfo
*ses
,
3488 const char *tree
, struct cifsTconInfo
*tcon
,
3489 const struct nls_table
*nls_codepage
)
3491 struct smb_hdr
*smb_buffer
;
3492 struct smb_hdr
*smb_buffer_response
;
3495 unsigned char *bcc_ptr
;
3503 smb_buffer
= cifs_buf_get();
3504 if (smb_buffer
== NULL
) {
3507 smb_buffer_response
= smb_buffer
;
3509 header_assemble(smb_buffer
, SMB_COM_TREE_CONNECT_ANDX
,
3510 NULL
/*no tid */ , 4 /*wct */ );
3512 smb_buffer
->Mid
= GetNextMid(ses
->server
);
3513 smb_buffer
->Uid
= ses
->Suid
;
3514 pSMB
= (TCONX_REQ
*) smb_buffer
;
3515 pSMBr
= (TCONX_RSP
*) smb_buffer_response
;
3517 pSMB
->AndXCommand
= 0xFF;
3518 pSMB
->Flags
= cpu_to_le16(TCON_EXTENDED_SECINFO
);
3519 bcc_ptr
= &pSMB
->Password
[0];
3520 if ((ses
->server
->secMode
) & SECMODE_USER
) {
3521 pSMB
->PasswordLength
= cpu_to_le16(1); /* minimum */
3522 *bcc_ptr
= 0; /* password is null byte */
3523 bcc_ptr
++; /* skip password */
3524 /* already aligned so no need to do it below */
3526 pSMB
->PasswordLength
= cpu_to_le16(CIFS_SESS_KEY_SIZE
);
3527 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3528 specified as required (when that support is added to
3529 the vfs in the future) as only NTLM or the much
3530 weaker LANMAN (which we do not send by default) is accepted
3531 by Samba (not sure whether other servers allow
3532 NTLMv2 password here) */
3533 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3534 if ((extended_security
& CIFSSEC_MAY_LANMAN
) &&
3535 (ses
->server
->secType
== LANMAN
))
3536 calc_lanman_hash(ses
->password
, ses
->server
->cryptKey
,
3537 ses
->server
->secMode
&
3538 SECMODE_PW_ENCRYPT
? true : false,
3541 #endif /* CIFS_WEAK_PW_HASH */
3542 SMBNTencrypt(ses
->password
,
3543 ses
->server
->cryptKey
,
3546 bcc_ptr
+= CIFS_SESS_KEY_SIZE
;
3547 if (ses
->capabilities
& CAP_UNICODE
) {
3548 /* must align unicode strings */
3549 *bcc_ptr
= 0; /* null byte password */
3554 if (ses
->server
->secMode
&
3555 (SECMODE_SIGN_REQUIRED
| SECMODE_SIGN_ENABLED
))
3556 smb_buffer
->Flags2
|= SMBFLG2_SECURITY_SIGNATURE
;
3558 if (ses
->capabilities
& CAP_STATUS32
) {
3559 smb_buffer
->Flags2
|= SMBFLG2_ERR_STATUS
;
3561 if (ses
->capabilities
& CAP_DFS
) {
3562 smb_buffer
->Flags2
|= SMBFLG2_DFS
;
3564 if (ses
->capabilities
& CAP_UNICODE
) {
3565 smb_buffer
->Flags2
|= SMBFLG2_UNICODE
;
3567 cifs_strtoUCS((__le16
*) bcc_ptr
, tree
,
3568 6 /* max utf8 char length in bytes */ *
3569 (/* server len*/ + 256 /* share len */), nls_codepage
);
3570 bcc_ptr
+= 2 * length
; /* convert num 16 bit words to bytes */
3571 bcc_ptr
+= 2; /* skip trailing null */
3572 } else { /* ASCII */
3573 strcpy(bcc_ptr
, tree
);
3574 bcc_ptr
+= strlen(tree
) + 1;
3576 strcpy(bcc_ptr
, "?????");
3577 bcc_ptr
+= strlen("?????");
3579 count
= bcc_ptr
- &pSMB
->Password
[0];
3580 pSMB
->hdr
.smb_buf_length
+= count
;
3581 pSMB
->ByteCount
= cpu_to_le16(count
);
3583 rc
= SendReceive(xid
, ses
, smb_buffer
, smb_buffer_response
, &length
,
3586 /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3587 /* above now done in SendReceive */
3588 if ((rc
== 0) && (tcon
!= NULL
)) {
3589 tcon
->tidStatus
= CifsGood
;
3590 tcon
->need_reconnect
= false;
3591 tcon
->tid
= smb_buffer_response
->Tid
;
3592 bcc_ptr
= pByteArea(smb_buffer_response
);
3593 length
= strnlen(bcc_ptr
, BCC(smb_buffer_response
) - 2);
3594 /* skip service field (NB: this field is always ASCII) */
3596 if ((bcc_ptr
[0] == 'I') && (bcc_ptr
[1] == 'P') &&
3597 (bcc_ptr
[2] == 'C')) {
3598 cFYI(1, ("IPC connection"));
3601 } else if (length
== 2) {
3602 if ((bcc_ptr
[0] == 'A') && (bcc_ptr
[1] == ':')) {
3603 /* the most common case */
3604 cFYI(1, ("disk share connection"));
3607 bcc_ptr
+= length
+ 1;
3608 strncpy(tcon
->treeName
, tree
, MAX_TREE_SIZE
);
3609 if (smb_buffer
->Flags2
& SMBFLG2_UNICODE
) {
3610 length
= UniStrnlen((wchar_t *) bcc_ptr
, 512);
3611 if ((bcc_ptr
+ (2 * length
)) -
3612 pByteArea(smb_buffer_response
) <=
3613 BCC(smb_buffer_response
)) {
3614 kfree(tcon
->nativeFileSystem
);
3615 tcon
->nativeFileSystem
=
3616 kzalloc(length
+ 2, GFP_KERNEL
);
3617 if (tcon
->nativeFileSystem
)
3619 tcon
->nativeFileSystem
,
3621 length
, nls_codepage
);
3622 bcc_ptr
+= 2 * length
;
3623 bcc_ptr
[0] = 0; /* null terminate the string */
3627 /* else do not bother copying these information fields*/
3629 length
= strnlen(bcc_ptr
, 1024);
3630 if ((bcc_ptr
+ length
) -
3631 pByteArea(smb_buffer_response
) <=
3632 BCC(smb_buffer_response
)) {
3633 kfree(tcon
->nativeFileSystem
);
3634 tcon
->nativeFileSystem
=
3635 kzalloc(length
+ 1, GFP_KERNEL
);
3636 if (tcon
->nativeFileSystem
)
3637 strncpy(tcon
->nativeFileSystem
, bcc_ptr
,
3640 /* else do not bother copying these information fields*/
3642 if ((smb_buffer_response
->WordCount
== 3) ||
3643 (smb_buffer_response
->WordCount
== 7))
3644 /* field is in same location */
3645 tcon
->Flags
= le16_to_cpu(pSMBr
->OptionalSupport
);
3648 cFYI(1, ("Tcon flags: 0x%x ", tcon
->Flags
));
3649 } else if ((rc
== 0) && tcon
== NULL
) {
3650 /* all we need to save for IPC$ connection */
3651 ses
->ipc_tid
= smb_buffer_response
->Tid
;
3654 cifs_buf_release(smb_buffer
);
3659 cifs_umount(struct super_block
*sb
, struct cifs_sb_info
*cifs_sb
)
3665 cifs_put_tcon(cifs_sb
->tcon
);
3667 cifs_sb
->tcon
= NULL
;
3668 tmp
= cifs_sb
->prepath
;
3669 cifs_sb
->prepathlen
= 0;
3670 cifs_sb
->prepath
= NULL
;
3676 int cifs_setup_session(unsigned int xid
, struct cifsSesInfo
*pSesInfo
,
3677 struct nls_table
*nls_info
)
3680 char ntlm_session_key
[CIFS_SESS_KEY_SIZE
];
3681 bool ntlmv2_flag
= false;
3683 struct TCP_Server_Info
*server
= pSesInfo
->server
;
3685 /* what if server changes its buffer size after dropping the session? */
3686 if (server
->maxBuf
== 0) /* no need to send on reconnect */ {
3687 rc
= CIFSSMBNegotiate(xid
, pSesInfo
);
3688 if (rc
== -EAGAIN
) {
3689 /* retry only once on 1st time connection */
3690 rc
= CIFSSMBNegotiate(xid
, pSesInfo
);
3695 spin_lock(&GlobalMid_Lock
);
3696 if (server
->tcpStatus
!= CifsExiting
)
3697 server
->tcpStatus
= CifsGood
;
3700 spin_unlock(&GlobalMid_Lock
);
3709 pSesInfo
->flags
= 0;
3710 pSesInfo
->capabilities
= server
->capabilities
;
3711 if (linuxExtEnabled
== 0)
3712 pSesInfo
->capabilities
&= (~CAP_UNIX
);
3713 /* pSesInfo->sequence_number = 0;*/
3714 cFYI(1, ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3715 server
->secMode
, server
->capabilities
, server
->timeAdj
));
3717 if (experimEnabled
< 2)
3718 rc
= CIFS_SessSetup(xid
, pSesInfo
, first_time
, nls_info
);
3719 else if (extended_security
3720 && (pSesInfo
->capabilities
& CAP_EXTENDED_SECURITY
)
3721 && (server
->secType
== NTLMSSP
)) {
3723 } else if (extended_security
3724 && (pSesInfo
->capabilities
& CAP_EXTENDED_SECURITY
)
3725 && (server
->secType
== RawNTLMSSP
)) {
3726 cFYI(1, ("NTLMSSP sesssetup"));
3727 rc
= CIFSNTLMSSPNegotiateSessSetup(xid
, pSesInfo
, &ntlmv2_flag
,
3732 cFYI(1, ("more secure NTLM ver2 hash"));
3733 if (CalcNTLMv2_partial_mac_key(pSesInfo
,
3738 v2_response
= kmalloc(16 + 64 /* blob*/,
3741 CalcNTLMv2_response(pSesInfo
,
3744 cifs_calculate_ntlmv2_mac_key */
3746 /* BB Put dummy sig in SessSetup PDU? */
3753 SMBNTencrypt(pSesInfo
->password
,
3758 cifs_calculate_mac_key(
3759 &server
->mac_signing_key
,
3761 pSesInfo
->password
);
3763 /* for better security the weaker lanman hash not sent
3764 in AuthSessSetup so we no longer calculate it */
3766 rc
= CIFSNTLMSSPAuthSessSetup(xid
, pSesInfo
,
3771 } else { /* old style NTLM 0.12 session setup */
3772 SMBNTencrypt(pSesInfo
->password
, server
->cryptKey
,
3776 cifs_calculate_mac_key(&server
->mac_signing_key
,
3778 pSesInfo
->password
);
3780 rc
= CIFSSessSetup(xid
, pSesInfo
, ntlm_session_key
, nls_info
);
3783 cERROR(1, ("Send error in SessSetup = %d", rc
));
3785 cFYI(1, ("CIFS Session Established successfully"));
3786 spin_lock(&GlobalMid_Lock
);
3787 pSesInfo
->status
= CifsGood
;
3788 pSesInfo
->need_reconnect
= false;
3789 spin_unlock(&GlobalMid_Lock
);