fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2007
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <asm/uaccess.h>
  37 #include <asm/processor.h>
  38 #include "cifspdu.h"
  39 #include "cifsglob.h"
  40 #include "cifsproto.h"
  41 #include "cifs_unicode.h"
  42 #include "cifs_debug.h"
  43 #include "cifs_fs_sb.h"
  44 #include "ntlmssp.h"
  45 #include "nterr.h"
  46 #include "rfc1002pdu.h"
  47 #include "cn_cifs.h"
  48
  49 #define CIFS_PORT 445
  50 #define RFC1001_PORT 139
  51
  52 static DECLARE_COMPLETION(cifsd_complete);
  53
  54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  55                          unsigned char *p24);
  56
  57 extern mempool_t *cifs_req_poolp;
  58
  59 struct smb_vol {
  60         char *username;
  61         char *password;
  62         char *domainname;
  63         char *UNC;
  64         char *UNCip;
  65         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  66         char *iocharset;  /* local code page for mapping to and from Unicode */
  67         char source_rfc1001_name[16]; /* netbios name of client */
  68         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  69         uid_t linux_uid;
  70         gid_t linux_gid;
  71         mode_t file_mode;
  72         mode_t dir_mode;
  73         unsigned secFlg;
  74         unsigned rw:1;
  75         unsigned retry:1;
  76         unsigned intr:1;
  77         unsigned setuids:1;
  78         unsigned override_uid:1;
  79         unsigned override_gid:1;
  80         unsigned noperm:1;
  81         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  82         unsigned cifs_acl:1;
  83         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  84         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  85         unsigned direct_io:1;
  86         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  87         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  88         unsigned sfu_emul:1;
  89         unsigned nullauth:1; /* attempt to authenticate with null user */
  90         unsigned nocase;     /* request case insensitive filenames */
  91         unsigned nobrl;      /* disable sending byte range locks to srv */
  92         unsigned int rsize;
  93         unsigned int wsize;
  94         unsigned int sockopt;
  95         unsigned short int port;
  96         char *prepath;
  97 };
  98
  99 static int ipv4_connect(struct sockaddr_in *psin_server,
 100                         struct socket **csocket,
 101                         char *netb_name,
 102                         char *server_netb_name);
 103 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 104                         struct socket **csocket);
 105
 106
 107         /*
 108          * cifs tcp session reconnection
 109          *
 110          * mark tcp session as reconnecting so temporarily locked
 111          * mark all smb sessions as reconnecting for tcp session
 112          * reconnect tcp session
 113          * wake up waiters on reconnection? - (not needed currently)
 114          */
 115
 116 static int
 117 cifs_reconnect(struct TCP_Server_Info *server)
 118 {
 119         int rc = 0;
 120         struct list_head *tmp;
 121         struct cifsSesInfo *ses;
 122         struct cifsTconInfo *tcon;
 123         struct mid_q_entry *mid_entry;
 124
 125         spin_lock(&GlobalMid_Lock);
 126         if ( kthread_should_stop() ) {
 127                 /* the demux thread will exit normally
 128                 next time through the loop */
 129                 spin_unlock(&GlobalMid_Lock);
 130                 return rc;
 131         } else
 132                 server->tcpStatus = CifsNeedReconnect;
 133         spin_unlock(&GlobalMid_Lock);
 134         server->maxBuf = 0;
 135
 136         cFYI(1, ("Reconnecting tcp session"));
 137
 138         /* before reconnecting the tcp session, mark the smb session (uid)
 139                 and the tid bad so they are not used until reconnected */
 140         read_lock(&GlobalSMBSeslock);
 141         list_for_each(tmp, &GlobalSMBSessionList) {
 142                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 143                 if (ses->server) {
 144                         if (ses->server == server) {
 145                                 ses->status = CifsNeedReconnect;
 146                                 ses->ipc_tid = 0;
 147                         }
 148                 }
 149                 /* else tcp and smb sessions need reconnection */
 150         }
 151         list_for_each(tmp, &GlobalTreeConnectionList) {
 152                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 153                 if ((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 154                         tcon->tidStatus = CifsNeedReconnect;
 155                 }
 156         }
 157         read_unlock(&GlobalSMBSeslock);
 158         /* do not want to be sending data on a socket we are freeing */
 159         down(&server->tcpSem);
 160         if (server->ssocket) {
 161                 cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 162                         server->ssocket->flags));
 163                 server->ssocket->ops->shutdown(server->ssocket, SEND_SHUTDOWN);
 164                 cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
 165                         server->ssocket->state,
 166                         server->ssocket->flags));
 167                 sock_release(server->ssocket);
 168                 server->ssocket = NULL;
 169         }
 170
 171         spin_lock(&GlobalMid_Lock);
 172         list_for_each(tmp, &server->pending_mid_q) {
 173                 mid_entry = list_entry(tmp, struct
 174                                         mid_q_entry,
 175                                         qhead);
 176                 if (mid_entry) {
 177                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 178                                 /* Mark other intransit requests as needing
 179                                    retry so we do not immediately mark the
 180                                    session bad again (ie after we reconnect
 181                                    below) as they timeout too */
 182                                 mid_entry->midState = MID_RETRY_NEEDED;
 183                         }
 184                 }
 185         }
 186         spin_unlock(&GlobalMid_Lock);
 187         up(&server->tcpSem);
 188
 189         while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
 190                 try_to_freeze();
 191                 if (server->protocolType == IPV6) {
 192                         rc = ipv6_connect(&server->addr.sockAddr6,
 193                                           &server->ssocket);
 194                 } else {
 195                         rc = ipv4_connect(&server->addr.sockAddr,
 196                                         &server->ssocket,
 197                                         server->workstation_RFC1001_name,
 198                                         server->server_RFC1001_name);
 199                 }
 200                 if (rc) {
 201                         cFYI(1, ("reconnect error %d", rc));
 202                         msleep(3000);
 203                 } else {
 204                         atomic_inc(&tcpSesReconnectCount);
 205                         spin_lock(&GlobalMid_Lock);
 206                         if ( !kthread_should_stop() )
 207                                 server->tcpStatus = CifsGood;
 208                         server->sequence_number = 0;
 209                         spin_unlock(&GlobalMid_Lock);
 210         /*              atomic_set(&server->inFlight,0);*/
 211                         wake_up(&server->response_q);
 212                 }
 213         }
 214         return rc;
 215 }
 216
 217 /*
 218         return codes:
 219                 0       not a transact2, or all data present
 220                 >0      transact2 with that much data missing
 221                 -EINVAL = invalid transact2
 222
 223  */
 224 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 225 {
 226         struct smb_t2_rsp *pSMBt;
 227         int total_data_size;
 228         int data_in_this_rsp;
 229         int remaining;
 230
 231         if (pSMB->Command != SMB_COM_TRANSACTION2)
 232                 return 0;
 233
 234         /* check for plausible wct, bcc and t2 data and parm sizes */
 235         /* check for parm and data offset going beyond end of smb */
 236         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 237                 cFYI(1, ("invalid transact2 word count"));
 238                 return -EINVAL;
 239         }
 240
 241         pSMBt = (struct smb_t2_rsp *)pSMB;
 242
 243         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 244         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 245
 246         remaining = total_data_size - data_in_this_rsp;
 247
 248         if (remaining == 0)
 249                 return 0;
 250         else if (remaining < 0) {
 251                 cFYI(1, ("total data %d smaller than data in frame %d",
 252                         total_data_size, data_in_this_rsp));
 253                 return -EINVAL;
 254         } else {
 255                 cFYI(1, ("missing %d bytes from transact2, check next response",
 256                         remaining));
 257                 if (total_data_size > maxBufSize) {
 258                         cERROR(1, ("TotalDataSize %d is over maximum buffer %d",
 259                                 total_data_size, maxBufSize));
 260                         return -EINVAL;
 261                 }
 262                 return remaining;
 263         }
 264 }
 265
 266 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 267 {
 268         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 269         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 270         int total_data_size;
 271         int total_in_buf;
 272         int remaining;
 273         int total_in_buf2;
 274         char *data_area_of_target;
 275         char *data_area_of_buf2;
 276         __u16 byte_count;
 277
 278         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 279
 280         if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 281                 cFYI(1, ("total data sizes of primary and secondary t2 differ"));
 282         }
 283
 284         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 285
 286         remaining = total_data_size - total_in_buf;
 287
 288         if (remaining < 0)
 289                 return -EINVAL;
 290
 291         if (remaining == 0) /* nothing to do, ignore */
 292                 return 0;
 293
 294         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 295         if (remaining < total_in_buf2) {
 296                 cFYI(1, ("transact2 2nd response contains too much data"));
 297         }
 298
 299         /* find end of first SMB data area */
 300         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 301                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 302         /* validate target area */
 303
 304         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 305                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 306
 307         data_area_of_target += total_in_buf;
 308
 309         /* copy second buffer into end of first buffer */
 310         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 311         total_in_buf += total_in_buf2;
 312         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 313         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 314         byte_count += total_in_buf2;
 315         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 316
 317         byte_count = pTargetSMB->smb_buf_length;
 318         byte_count += total_in_buf2;
 319
 320         /* BB also add check that we are not beyond maximum buffer size */
 321
 322         pTargetSMB->smb_buf_length = byte_count;
 323
 324         if (remaining == total_in_buf2) {
 325                 cFYI(1, ("found the last secondary response"));
 326                 return 0; /* we are done */
 327         } else /* more responses to go */
 328                 return 1;
 329
 330 }
 331
 332 static int
 333 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 334 {
 335         int length;
 336         unsigned int pdu_length, total_read;
 337         struct smb_hdr *smb_buffer = NULL;
 338         struct smb_hdr *bigbuf = NULL;
 339         struct smb_hdr *smallbuf = NULL;
 340         struct msghdr smb_msg;
 341         struct kvec iov;
 342         struct socket *csocket = server->ssocket;
 343         struct list_head *tmp;
 344         struct cifsSesInfo *ses;
 345         struct task_struct *task_to_wake = NULL;
 346         struct mid_q_entry *mid_entry;
 347         char temp;
 348         int isLargeBuf = FALSE;
 349         int isMultiRsp;
 350         int reconnect;
 351
 352         current->flags |= PF_MEMALLOC;
 353         server->tsk = current;  /* save process info to wake at shutdown */
 354         cFYI(1, ("Demultiplex PID: %d", current->pid));
 355         write_lock(&GlobalSMBSeslock);
 356         atomic_inc(&tcpSesAllocCount);
 357         length = tcpSesAllocCount.counter;
 358         write_unlock(&GlobalSMBSeslock);
 359         complete(&cifsd_complete);
 360         if (length  > 1) {
 361                 mempool_resize(cifs_req_poolp,
 362                         length + cifs_min_rcv,
 363                         GFP_KERNEL);
 364         }
 365
 366         while (!kthread_should_stop()) {
 367                 if (try_to_freeze())
 368                         continue;
 369                 if (bigbuf == NULL) {
 370                         bigbuf = cifs_buf_get();
 371                         if (!bigbuf) {
 372                                 cERROR(1, ("No memory for large SMB response"));
 373                                 msleep(3000);
 374                                 /* retry will check if exiting */
 375                                 continue;
 376                         }
 377                 } else if (isLargeBuf) {
 378                         /* we are reusing a dirty large buf, clear its start */
 379                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 380                 }
 381
 382                 if (smallbuf == NULL) {
 383                         smallbuf = cifs_small_buf_get();
 384                         if (!smallbuf) {
 385                                 cERROR(1, ("No memory for SMB response"));
 386                                 msleep(1000);
 387                                 /* retry will check if exiting */
 388                                 continue;
 389                         }
 390                         /* beginning of smb buffer is cleared in our buf_get */
 391                 } else /* if existing small buf clear beginning */
 392                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 393
 394                 isLargeBuf = FALSE;
 395                 isMultiRsp = FALSE;
 396                 smb_buffer = smallbuf;
 397                 iov.iov_base = smb_buffer;
 398                 iov.iov_len = 4;
 399                 smb_msg.msg_control = NULL;
 400                 smb_msg.msg_controllen = 0;
 401                 length =
 402                     kernel_recvmsg(csocket, &smb_msg,
 403                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 404
 405                 if ( kthread_should_stop() ) {
 406                         break;
 407                 } else if (server->tcpStatus == CifsNeedReconnect) {
 408                         cFYI(1, ("Reconnect after server stopped responding"));
 409                         cifs_reconnect(server);
 410                         cFYI(1, ("call to reconnect done"));
 411                         csocket = server->ssocket;
 412                         continue;
 413                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 414                         msleep(1); /* minimum sleep to prevent looping
 415                                 allowing socket to clear and app threads to set
 416                                 tcpStatus CifsNeedReconnect if server hung */
 417                         continue;
 418                 } else if (length <= 0) {
 419                         if (server->tcpStatus == CifsNew) {
 420                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 421                                 /* some servers kill the TCP session rather than
 422                                    returning an SMB negprot error, in which
 423                                    case reconnecting here is not going to help,
 424                                    and so simply return error to mount */
 425                                 break;
 426                         }
 427                         if (!try_to_freeze() && (length == -EINTR)) {
 428                                 cFYI(1, ("cifsd thread killed"));
 429                                 break;
 430                         }
 431                         cFYI(1, ("Reconnect after unexpected peek error %d",
 432                                 length));
 433                         cifs_reconnect(server);
 434                         csocket = server->ssocket;
 435                         wake_up(&server->response_q);
 436                         continue;
 437                 } else if (length < 4) {
 438                         cFYI(1,
 439                             ("Frame under four bytes received (%d bytes long)",
 440                               length));
 441                         cifs_reconnect(server);
 442                         csocket = server->ssocket;
 443                         wake_up(&server->response_q);
 444                         continue;
 445                 }
 446
 447                 /* The right amount was read from socket - 4 bytes */
 448                 /* so we can now interpret the length field */
 449
 450                 /* the first byte big endian of the length field,
 451                 is actually not part of the length but the type
 452                 with the most common, zero, as regular data */
 453                 temp = *((char *) smb_buffer);
 454
 455                 /* Note that FC 1001 length is big endian on the wire,
 456                 but we convert it here so it is always manipulated
 457                 as host byte order */
 458                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 459                 smb_buffer->smb_buf_length = pdu_length;
 460
 461                 cFYI(1, ("rfc1002 length 0x%x", pdu_length+4));
 462
 463                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 464                         continue;
 465                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 466                         cFYI(1, ("Good RFC 1002 session rsp"));
 467                         continue;
 468                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 469                         /* we get this from Windows 98 instead of
 470                            an error on SMB negprot response */
 471                         cFYI(1, ("Negative RFC1002 Session Response Error 0x%x)",
 472                                 pdu_length));
 473                         if (server->tcpStatus == CifsNew) {
 474                                 /* if nack on negprot (rather than
 475                                 ret of smb negprot error) reconnecting
 476                                 not going to help, ret error to mount */
 477                                 break;
 478                         } else {
 479                                 /* give server a second to
 480                                 clean up before reconnect attempt */
 481                                 msleep(1000);
 482                                 /* always try 445 first on reconnect
 483                                 since we get NACK on some if we ever
 484                                 connected to port 139 (the NACK is
 485                                 since we do not begin with RFC1001
 486                                 session initialize frame) */
 487                                 server->addr.sockAddr.sin_port =
 488                                         htons(CIFS_PORT);
 489                                 cifs_reconnect(server);
 490                                 csocket = server->ssocket;
 491                                 wake_up(&server->response_q);
 492                                 continue;
 493                         }
 494                 } else if (temp != (char) 0) {
 495                         cERROR(1, ("Unknown RFC 1002 frame"));
 496                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 497                                       length);
 498                         cifs_reconnect(server);
 499                         csocket = server->ssocket;
 500                         continue;
 501                 }
 502
 503                 /* else we have an SMB response */
 504                 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 505                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 506                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 507                                         length, pdu_length+4));
 508                         cifs_reconnect(server);
 509                         csocket = server->ssocket;
 510                         wake_up(&server->response_q);
 511                         continue;
 512                 }
 513
 514                 /* else length ok */
 515                 reconnect = 0;
 516
 517                 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 518                         isLargeBuf = TRUE;
 519                         memcpy(bigbuf, smallbuf, 4);
 520                         smb_buffer = bigbuf;
 521                 }
 522                 length = 0;
 523                 iov.iov_base = 4 + (char *)smb_buffer;
 524                 iov.iov_len = pdu_length;
 525                 for (total_read = 0; total_read < pdu_length;
 526                      total_read += length) {
 527                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 528                                                 pdu_length - total_read, 0);
 529                         if ( kthread_should_stop() ||
 530                             (length == -EINTR)) {
 531                                 /* then will exit */
 532                                 reconnect = 2;
 533                                 break;
 534                         } else if (server->tcpStatus == CifsNeedReconnect) {
 535                                 cifs_reconnect(server);
 536                                 csocket = server->ssocket;
 537                                 /* Reconnect wakes up rspns q */
 538                                 /* Now we will reread sock */
 539                                 reconnect = 1;
 540                                 break;
 541                         } else if ((length == -ERESTARTSYS) ||
 542                                    (length == -EAGAIN)) {
 543                                 msleep(1); /* minimum sleep to prevent looping,
 544                                               allowing socket to clear and app
 545                                               threads to set tcpStatus
 546                                               CifsNeedReconnect if server hung*/
 547                                 continue;
 548                         } else if (length <= 0) {
 549                                 cERROR(1, ("Received no data, expecting %d",
 550                                               pdu_length - total_read));
 551                                 cifs_reconnect(server);
 552                                 csocket = server->ssocket;
 553                                 reconnect = 1;
 554                                 break;
 555                         }
 556                 }
 557                 if (reconnect == 2)
 558                         break;
 559                 else if (reconnect == 1)
 560                         continue;
 561
 562                 length += 4; /* account for rfc1002 hdr */
 563
 564
 565                 dump_smb(smb_buffer, length);
 566                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 567                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 568                         continue;
 569                 }
 570
 571
 572                 task_to_wake = NULL;
 573                 spin_lock(&GlobalMid_Lock);
 574                 list_for_each(tmp, &server->pending_mid_q) {
 575                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 576
 577                         if ((mid_entry->mid == smb_buffer->Mid) &&
 578                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 579                             (mid_entry->command == smb_buffer->Command)) {
 580                                 if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
 581                                         /* We have a multipart transact2 resp */
 582                                         isMultiRsp = TRUE;
 583                                         if (mid_entry->resp_buf) {
 584                                                 /* merge response - fix up 1st*/
 585                                                 if (coalesce_t2(smb_buffer,
 586                                                         mid_entry->resp_buf)) {
 587                                                         mid_entry->multiRsp = 1;
 588                                                         break;
 589                                                 } else {
 590                                                         /* all parts received */
 591                                                         mid_entry->multiEnd = 1;
 592                                                         goto multi_t2_fnd;
 593                                                 }
 594                                         } else {
 595                                                 if (!isLargeBuf) {
 596                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 597                                         /* BB maybe we can fix this up,  switch
 598                                            to already allocated large buffer? */
 599                                                 } else {
 600                                                         /* Have first buffer */
 601                                                         mid_entry->resp_buf =
 602                                                                  smb_buffer;
 603                                                         mid_entry->largeBuf = 1;
 604                                                         bigbuf = NULL;
 605                                                 }
 606                                         }
 607                                         break;
 608                                 }
 609                                 mid_entry->resp_buf = smb_buffer;
 610                                 if (isLargeBuf)
 611                                         mid_entry->largeBuf = 1;
 612                                 else
 613                                         mid_entry->largeBuf = 0;
 614 multi_t2_fnd:
 615                                 task_to_wake = mid_entry->tsk;
 616                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 617 #ifdef CONFIG_CIFS_STATS2
 618                                 mid_entry->when_received = jiffies;
 619 #endif
 620                                 /* so we do not time out requests to  server
 621                                 which is still responding (since server could
 622                                 be busy but not dead) */
 623                                 server->lstrp = jiffies;
 624                                 break;
 625                         }
 626                 }
 627                 spin_unlock(&GlobalMid_Lock);
 628                 if (task_to_wake) {
 629                         /* Was previous buf put in mpx struct for multi-rsp? */
 630                         if (!isMultiRsp) {
 631                                 /* smb buffer will be freed by user thread */
 632                                 if (isLargeBuf) {
 633                                         bigbuf = NULL;
 634                                 } else
 635                                         smallbuf = NULL;
 636                         }
 637                         wake_up_process(task_to_wake);
 638                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 639                     && (isMultiRsp == FALSE)) {
 640                         cERROR(1, ("No task to wake, unknown frame received! "
 641                                    "NumMids %d", midCount.counter));
 642                         cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
 643                                       sizeof(struct smb_hdr));
 644 #ifdef CONFIG_CIFS_DEBUG2
 645                         cifs_dump_detail(smb_buffer);
 646                         cifs_dump_mids(server);
 647 #endif /* CIFS_DEBUG2 */
 648
 649                 }
 650         } /* end while !EXITING */
 651
 652         spin_lock(&GlobalMid_Lock);
 653         server->tcpStatus = CifsExiting;
 654         server->tsk = NULL;
 655         /* check if we have blocked requests that need to free */
 656         /* Note that cifs_max_pending is normally 50, but
 657         can be set at module install time to as little as two */
 658         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 659                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 660         /* We do not want to set the max_pending too low or we
 661         could end up with the counter going negative */
 662         spin_unlock(&GlobalMid_Lock);
 663         /* Although there should not be any requests blocked on
 664         this queue it can not hurt to be paranoid and try to wake up requests
 665         that may haven been blocked when more than 50 at time were on the wire
 666         to the same server - they now will see the session is in exit state
 667         and get out of SendReceive.  */
 668         wake_up_all(&server->request_q);
 669         /* give those requests time to exit */
 670         msleep(125);
 671
 672         if (server->ssocket) {
 673                 sock_release(csocket);
 674                 server->ssocket = NULL;
 675         }
 676         /* buffer usuallly freed in free_mid - need to free it here on exit */
 677         if (bigbuf != NULL)
 678                 cifs_buf_release(bigbuf);
 679         if (smallbuf != NULL)
 680                 cifs_small_buf_release(smallbuf);
 681
 682         read_lock(&GlobalSMBSeslock);
 683         if (list_empty(&server->pending_mid_q)) {
 684                 /* loop through server session structures attached to this and
 685                     mark them dead */
 686                 list_for_each(tmp, &GlobalSMBSessionList) {
 687                         ses =
 688                             list_entry(tmp, struct cifsSesInfo,
 689                                        cifsSessionList);
 690                         if (ses->server == server) {
 691                                 ses->status = CifsExiting;
 692                                 ses->server = NULL;
 693                         }
 694                 }
 695                 read_unlock(&GlobalSMBSeslock);
 696         } else {
 697                 /* although we can not zero the server struct pointer yet,
 698                 since there are active requests which may depnd on them,
 699                 mark the corresponding SMB sessions as exiting too */
 700                 list_for_each(tmp, &GlobalSMBSessionList) {
 701                         ses = list_entry(tmp, struct cifsSesInfo,
 702                                          cifsSessionList);
 703                         if (ses->server == server) {
 704                                 ses->status = CifsExiting;
 705                         }
 706                 }
 707
 708                 spin_lock(&GlobalMid_Lock);
 709                 list_for_each(tmp, &server->pending_mid_q) {
 710                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 711                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 712                                 cFYI(1, ("Clearing Mid 0x%x - waking up ",
 713                                          mid_entry->mid));
 714                                 task_to_wake = mid_entry->tsk;
 715                                 if (task_to_wake) {
 716                                         wake_up_process(task_to_wake);
 717                                 }
 718                         }
 719                 }
 720                 spin_unlock(&GlobalMid_Lock);
 721                 read_unlock(&GlobalSMBSeslock);
 722                 /* 1/8th of sec is more than enough time for them to exit */
 723                 msleep(125);
 724         }
 725
 726         if (!list_empty(&server->pending_mid_q)) {
 727                 /* mpx threads have not exited yet give them
 728                 at least the smb send timeout time for long ops */
 729                 /* due to delays on oplock break requests, we need
 730                 to wait at least 45 seconds before giving up
 731                 on a request getting a response and going ahead
 732                 and killing cifsd */
 733                 cFYI(1, ("Wait for exit from demultiplex thread"));
 734                 msleep(46000);
 735                 /* if threads still have not exited they are probably never
 736                 coming home not much else we can do but free the memory */
 737         }
 738
 739         write_lock(&GlobalSMBSeslock);
 740         atomic_dec(&tcpSesAllocCount);
 741         length = tcpSesAllocCount.counter;
 742
 743         /* last chance to mark ses pointers invalid
 744         if there are any pointing to this (e.g
 745         if a crazy root user tried to kill cifsd
 746         kernel thread explicitly this might happen) */
 747         list_for_each(tmp, &GlobalSMBSessionList) {
 748                 ses = list_entry(tmp, struct cifsSesInfo,
 749                                 cifsSessionList);
 750                 if (ses->server == server) {
 751                         ses->server = NULL;
 752                 }
 753         }
 754         write_unlock(&GlobalSMBSeslock);
 755
 756         kfree(server);
 757         if (length  > 0) {
 758                 mempool_resize(cifs_req_poolp,
 759                         length + cifs_min_rcv,
 760                         GFP_KERNEL);
 761         }
 762
 763         return 0;
 764 }
 765
 766 static int
 767 cifs_parse_mount_options(char *options, const char *devname,
 768                          struct smb_vol *vol)
 769 {
 770         char *value;
 771         char *data;
 772         unsigned int  temp_len, i, j;
 773         char separator[2];
 774
 775         separator[0] = ',';
 776         separator[1] = 0;
 777
 778         if (Local_System_Name[0] != 0)
 779                 memcpy(vol->source_rfc1001_name, Local_System_Name, 15);
 780         else {
 781                 char *nodename = utsname()->nodename;
 782                 int n = strnlen(nodename, 15);
 783                 memset(vol->source_rfc1001_name, 0x20, 15);
 784                 for (i = 0; i < n; i++) {
 785                         /* does not have to be perfect mapping since field is
 786                         informational, only used for servers that do not support
 787                         port 445 and it can be overridden at mount time */
 788                         vol->source_rfc1001_name[i] = toupper(nodename[i]);
 789                 }
 790         }
 791         vol->source_rfc1001_name[15] = 0;
 792         /* null target name indicates to use *SMBSERVR default called name
 793            if we end up sending RFC1001 session initialize */
 794         vol->target_rfc1001_name[0] = 0;
 795         vol->linux_uid = current->uid;  /* current->euid instead? */
 796         vol->linux_gid = current->gid;
 797         vol->dir_mode = S_IRWXUGO;
 798         /* 2767 perms indicate mandatory locking support */
 799         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 800
 801         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 802         vol->rw = TRUE;
 803         /* default is always to request posix paths. */
 804         vol->posix_paths = 1;
 805
 806         if (!options)
 807                 return 1;
 808
 809         if (strncmp(options, "sep=", 4) == 0) {
 810                 if (options[4] != 0) {
 811                         separator[0] = options[4];
 812                         options += 5;
 813                 } else {
 814                         cFYI(1, ("Null separator not allowed"));
 815                 }
 816         }
 817
 818         while ((data = strsep(&options, separator)) != NULL) {
 819                 if (!*data)
 820                         continue;
 821                 if ((value = strchr(data, '=')) != NULL)
 822                         *value++ = '\0';
 823
 824                 /* Have to parse this before we parse for "user" */
 825                 if (strnicmp(data, "user_xattr", 10) == 0) {
 826                         vol->no_xattr = 0;
 827                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 828                         vol->no_xattr = 1;
 829                 } else if (strnicmp(data, "user", 4) == 0) {
 830                         if (!value) {
 831                                 printk(KERN_WARNING
 832                                        "CIFS: invalid or missing username\n");
 833                                 return 1;       /* needs_arg; */
 834                         } else if (!*value) {
 835                                 /* null user, ie anonymous, authentication */
 836                                 vol->nullauth = 1;
 837                         }
 838                         if (strnlen(value, 200) < 200) {
 839                                 vol->username = value;
 840                         } else {
 841                                 printk(KERN_WARNING "CIFS: username too long\n");
 842                                 return 1;
 843                         }
 844                 } else if (strnicmp(data, "pass", 4) == 0) {
 845                         if (!value) {
 846                                 vol->password = NULL;
 847                                 continue;
 848                         } else if (value[0] == 0) {
 849                                 /* check if string begins with double comma
 850                                    since that would mean the password really
 851                                    does start with a comma, and would not
 852                                    indicate an empty string */
 853                                 if (value[1] != separator[0]) {
 854                                         vol->password = NULL;
 855                                         continue;
 856                                 }
 857                         }
 858                         temp_len = strlen(value);
 859                         /* removed password length check, NTLM passwords
 860                                 can be arbitrarily long */
 861
 862                         /* if comma in password, the string will be
 863                         prematurely null terminated.  Commas in password are
 864                         specified across the cifs mount interface by a double
 865                         comma ie ,, and a comma used as in other cases ie ','
 866                         as a parameter delimiter/separator is single and due
 867                         to the strsep above is temporarily zeroed. */
 868
 869                         /* NB: password legally can have multiple commas and
 870                         the only illegal character in a password is null */
 871
 872                         if ((value[temp_len] == 0) &&
 873                             (value[temp_len+1] == separator[0])) {
 874                                 /* reinsert comma */
 875                                 value[temp_len] = separator[0];
 876                                 temp_len += 2;  /* move after second comma */
 877                                 while (value[temp_len] != 0)  {
 878                                         if (value[temp_len] == separator[0]) {
 879                                                 if (value[temp_len+1] ==
 880                                                      separator[0]) {
 881                                                 /* skip second comma */
 882                                                         temp_len++;
 883                                                 } else {
 884                                                 /* single comma indicating start
 885                                                          of next parm */
 886                                                         break;
 887                                                 }
 888                                         }
 889                                         temp_len++;
 890                                 }
 891                                 if (value[temp_len] == 0) {
 892                                         options = NULL;
 893                                 } else {
 894                                         value[temp_len] = 0;
 895                                         /* point option to start of next parm */
 896                                         options = value + temp_len + 1;
 897                                 }
 898                                 /* go from value to value + temp_len condensing
 899                                 double commas to singles. Note that this ends up
 900                                 allocating a few bytes too many, which is ok */
 901                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 902                                 if (vol->password == NULL) {
 903                                         printk(KERN_WARNING "CIFS: no memory "
 904                                                             "for password\n");
 905                                         return 1;
 906                                 }
 907                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
 908                                         vol->password[j] = value[i];
 909                                         if (value[i] == separator[0]
 910                                                 && value[i+1] == separator[0]) {
 911                                                 /* skip second comma */
 912                                                 i++;
 913                                         }
 914                                 }
 915                                 vol->password[j] = 0;
 916                         } else {
 917                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 918                                 if (vol->password == NULL) {
 919                                         printk(KERN_WARNING "CIFS: no memory "
 920                                                             "for password\n");
 921                                         return 1;
 922                                 }
 923                                 strcpy(vol->password, value);
 924                         }
 925                 } else if (strnicmp(data, "ip", 2) == 0) {
 926                         if (!value || !*value) {
 927                                 vol->UNCip = NULL;
 928                         } else if (strnlen(value, 35) < 35) {
 929                                 vol->UNCip = value;
 930                         } else {
 931                                 printk(KERN_WARNING "CIFS: ip address "
 932                                                     "too long\n");
 933                                 return 1;
 934                         }
 935                 } else if (strnicmp(data, "sec", 3) == 0) {
 936                         if (!value || !*value) {
 937                                 cERROR(1, ("no security value specified"));
 938                                 continue;
 939                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 940                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 941                                         CIFSSEC_MUST_SIGN;
 942                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 943                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 944                                         CIFSSEC_MAY_KRB5; */
 945                                 cERROR(1, ("Krb5 cifs privacy not supported"));
 946                                 return 1;
 947                         } else if (strnicmp(value, "krb5", 4) == 0) {
 948                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 949                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 950                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 951                                         CIFSSEC_MUST_SIGN;
 952                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 953                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 954                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 955                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 956                                         CIFSSEC_MUST_SIGN;
 957                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 958                                 /* ntlm is default so can be turned off too */
 959                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 960                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 961                                 /* BB is there a better way to do this? */
 962                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 963 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 964                         } else if (strnicmp(value, "lanman", 6) == 0) {
 965                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 966 #endif
 967                         } else if (strnicmp(value, "none", 4) == 0) {
 968                                 vol->nullauth = 1;
 969                         } else {
 970                                 cERROR(1, ("bad security option: %s", value));
 971                                 return 1;
 972                         }
 973                 } else if ((strnicmp(data, "unc", 3) == 0)
 974                            || (strnicmp(data, "target", 6) == 0)
 975                            || (strnicmp(data, "path", 4) == 0)) {
 976                         if (!value || !*value) {
 977                                 printk(KERN_WARNING "CIFS: invalid path to "
 978                                                     "network resource\n");
 979                                 return 1;       /* needs_arg; */
 980                         }
 981                         if ((temp_len = strnlen(value, 300)) < 300) {
 982                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
 983                                 if (vol->UNC == NULL)
 984                                         return 1;
 985                                 strcpy(vol->UNC, value);
 986                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 987                                         vol->UNC[0] = '\\';
 988                                         vol->UNC[1] = '\\';
 989                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 990                                         printk(KERN_WARNING
 991                                                "CIFS: UNC Path does not begin "
 992                                                "with // or \\\\ \n");
 993                                         return 1;
 994                                 }
 995                         } else {
 996                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 997                                 return 1;
 998                         }
 999                 } else if ((strnicmp(data, "domain", 3) == 0)
1000                            || (strnicmp(data, "workgroup", 5) == 0)) {
1001                         if (!value || !*value) {
1002                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1003                                 return 1;       /* needs_arg; */
1004                         }
1005                         /* BB are there cases in which a comma can be valid in
1006                         a domain name and need special handling? */
1007                         if (strnlen(value, 256) < 256) {
1008                                 vol->domainname = value;
1009                                 cFYI(1, ("Domain name set"));
1010                         } else {
1011                                 printk(KERN_WARNING "CIFS: domain name too "
1012                                                     "long\n");
1013                                 return 1;
1014                         }
1015                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1016                         if (!value || !*value) {
1017                                 printk(KERN_WARNING
1018                                         "CIFS: invalid path prefix\n");
1019                                 return 1;       /* needs_argument */
1020                         }
1021                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1022                                 if (value[0] != '/')
1023                                         temp_len++;  /* missing leading slash */
1024                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1025                                 if (vol->prepath == NULL)
1026                                         return 1;
1027                                 if (value[0] != '/') {
1028                                         vol->prepath[0] = '/';
1029                                         strcpy(vol->prepath+1, value);
1030                                 } else
1031                                         strcpy(vol->prepath, value);
1032                                 cFYI(1, ("prefix path %s", vol->prepath));
1033                         } else {
1034                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1035                                 return 1;
1036                         }
1037                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1038                         if (!value || !*value) {
1039                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1040                                 return 1;       /* needs_arg; */
1041                         }
1042                         if (strnlen(value, 65) < 65) {
1043                                 if (strnicmp(value, "default", 7))
1044                                         vol->iocharset = value;
1045                                 /* if iocharset not set then load_nls_default
1046                                    is used by caller */
1047                                 cFYI(1, ("iocharset set to %s", value));
1048                         } else {
1049                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1050                                 return 1;
1051                         }
1052                 } else if (strnicmp(data, "uid", 3) == 0) {
1053                         if (value && *value) {
1054                                 vol->linux_uid =
1055                                         simple_strtoul(value, &value, 0);
1056                                 vol->override_uid = 1;
1057                         }
1058                 } else if (strnicmp(data, "gid", 3) == 0) {
1059                         if (value && *value) {
1060                                 vol->linux_gid =
1061                                         simple_strtoul(value, &value, 0);
1062                                 vol->override_gid = 1;
1063                         }
1064                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1065                         if (value && *value) {
1066                                 vol->file_mode =
1067                                         simple_strtoul(value, &value, 0);
1068                         }
1069                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1070                         if (value && *value) {
1071                                 vol->dir_mode =
1072                                         simple_strtoul(value, &value, 0);
1073                         }
1074                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1075                         if (value && *value) {
1076                                 vol->dir_mode =
1077                                         simple_strtoul(value, &value, 0);
1078                         }
1079                 } else if (strnicmp(data, "port", 4) == 0) {
1080                         if (value && *value) {
1081                                 vol->port =
1082                                         simple_strtoul(value, &value, 0);
1083                         }
1084                 } else if (strnicmp(data, "rsize", 5) == 0) {
1085                         if (value && *value) {
1086                                 vol->rsize =
1087                                         simple_strtoul(value, &value, 0);
1088                         }
1089                 } else if (strnicmp(data, "wsize", 5) == 0) {
1090                         if (value && *value) {
1091                                 vol->wsize =
1092                                         simple_strtoul(value, &value, 0);
1093                         }
1094                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1095                         if (value && *value) {
1096                                 vol->sockopt =
1097                                         simple_strtoul(value, &value, 0);
1098                         }
1099                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1100                         if (!value || !*value || (*value == ' ')) {
1101                                 cFYI(1, ("invalid (empty) netbiosname specified"));
1102                         } else {
1103                                 memset(vol->source_rfc1001_name, 0x20, 15);
1104                                 for (i = 0; i < 15; i++) {
1105                                 /* BB are there cases in which a comma can be
1106                                 valid in this workstation netbios name (and need
1107                                 special handling)? */
1108
1109                                 /* We do not uppercase netbiosname for user */
1110                                         if (value[i] == 0)
1111                                                 break;
1112                                         else
1113                                                 vol->source_rfc1001_name[i] =
1114                                                                 value[i];
1115                                 }
1116                                 /* The string has 16th byte zero still from
1117                                 set at top of the function  */
1118                                 if ((i == 15) && (value[i] != 0))
1119                                         printk(KERN_WARNING "CIFS: netbiosname"
1120                                                 " longer than 15 truncated.\n");
1121                         }
1122                 } else if (strnicmp(data, "servern", 7) == 0) {
1123                         /* servernetbiosname specified override *SMBSERVER */
1124                         if (!value || !*value || (*value == ' ')) {
1125                                 cFYI(1, ("empty server netbiosname specified"));
1126                         } else {
1127                                 /* last byte, type, is 0x20 for servr type */
1128                                 memset(vol->target_rfc1001_name, 0x20, 16);
1129
1130                                 for (i = 0; i < 15; i++) {
1131                                 /* BB are there cases in which a comma can be
1132                                    valid in this workstation netbios name
1133                                    (and need special handling)? */
1134
1135                                 /* user or mount helper must uppercase
1136                                    the netbiosname */
1137                                         if (value[i] == 0)
1138                                                 break;
1139                                         else
1140                                                 vol->target_rfc1001_name[i] =
1141                                                                 value[i];
1142                                 }
1143                                 /* The string has 16th byte zero still from
1144                                    set at top of the function  */
1145                                 if ((i == 15) && (value[i] != 0))
1146                                         printk(KERN_WARNING "CIFS: server net"
1147                                         "biosname longer than 15 truncated.\n");
1148                         }
1149                 } else if (strnicmp(data, "credentials", 4) == 0) {
1150                         /* ignore */
1151                 } else if (strnicmp(data, "version", 3) == 0) {
1152                         /* ignore */
1153                 } else if (strnicmp(data, "guest", 5) == 0) {
1154                         /* ignore */
1155                 } else if (strnicmp(data, "rw", 2) == 0) {
1156                         vol->rw = TRUE;
1157                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1158                                    (strnicmp(data, "nosuid", 6) == 0) ||
1159                                    (strnicmp(data, "exec", 4) == 0) ||
1160                                    (strnicmp(data, "noexec", 6) == 0) ||
1161                                    (strnicmp(data, "nodev", 5) == 0) ||
1162                                    (strnicmp(data, "noauto", 6) == 0) ||
1163                                    (strnicmp(data, "dev", 3) == 0)) {
1164                         /*  The mount tool or mount.cifs helper (if present)
1165                             uses these opts to set flags, and the flags are read
1166                             by the kernel vfs layer before we get here (ie
1167                             before read super) so there is no point trying to
1168                             parse these options again and set anything and it
1169                             is ok to just ignore them */
1170                         continue;
1171                 } else if (strnicmp(data, "ro", 2) == 0) {
1172                         vol->rw = FALSE;
1173                 } else if (strnicmp(data, "hard", 4) == 0) {
1174                         vol->retry = 1;
1175                 } else if (strnicmp(data, "soft", 4) == 0) {
1176                         vol->retry = 0;
1177                 } else if (strnicmp(data, "perm", 4) == 0) {
1178                         vol->noperm = 0;
1179                 } else if (strnicmp(data, "noperm", 6) == 0) {
1180                         vol->noperm = 1;
1181                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1182                         vol->remap = 1;
1183                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1184                         vol->remap = 0;
1185                 } else if (strnicmp(data, "sfu", 3) == 0) {
1186                         vol->sfu_emul = 1;
1187                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1188                         vol->sfu_emul = 0;
1189                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1190                         vol->posix_paths = 1;
1191                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1192                         vol->posix_paths = 0;
1193                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1194                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1195                         vol->nocase = 1;
1196                 } else if (strnicmp(data, "brl", 3) == 0) {
1197                         vol->nobrl =  0;
1198                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1199                            (strnicmp(data, "nolock", 6) == 0)) {
1200                         vol->nobrl =  1;
1201                         /* turn off mandatory locking in mode
1202                         if remote locking is turned off since the
1203                         local vfs will do advisory */
1204                         if (vol->file_mode ==
1205                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1206                                 vol->file_mode = S_IALLUGO;
1207                 } else if (strnicmp(data, "setuids", 7) == 0) {
1208                         vol->setuids = 1;
1209                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1210                         vol->setuids = 0;
1211                 } else if (strnicmp(data, "nohard", 6) == 0) {
1212                         vol->retry = 0;
1213                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1214                         vol->retry = 1;
1215                 } else if (strnicmp(data, "nointr", 6) == 0) {
1216                         vol->intr = 0;
1217                 } else if (strnicmp(data, "intr", 4) == 0) {
1218                         vol->intr = 1;
1219                 } else if (strnicmp(data, "serverino", 7) == 0) {
1220                         vol->server_ino = 1;
1221                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1222                         vol->server_ino = 0;
1223                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1224                         vol->cifs_acl = 1;
1225                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1226                         vol->cifs_acl = 0;
1227                 } else if (strnicmp(data, "acl", 3) == 0) {
1228                         vol->no_psx_acl = 0;
1229                 } else if (strnicmp(data, "noacl", 5) == 0) {
1230                         vol->no_psx_acl = 1;
1231                 } else if (strnicmp(data, "sign", 4) == 0) {
1232                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1233 /*              } else if (strnicmp(data, "seal",4) == 0) {
1234                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1235                 } else if (strnicmp(data, "direct", 6) == 0) {
1236                         vol->direct_io = 1;
1237                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1238                         vol->direct_io = 1;
1239                 } else if (strnicmp(data, "in6_addr", 8) == 0) {
1240                         if (!value || !*value) {
1241                                 vol->in6_addr = NULL;
1242                         } else if (strnlen(value, 49) == 48) {
1243                                 vol->in6_addr = value;
1244                         } else {
1245                                 printk(KERN_WARNING "CIFS: ip v6 address not "
1246                                                     "48 characters long\n");
1247                                 return 1;
1248                         }
1249                 } else if (strnicmp(data, "noac", 4) == 0) {
1250                         printk(KERN_WARNING "CIFS: Mount option noac not "
1251                                 "supported. Instead set "
1252                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1253                 } else
1254                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1255                                                 data);
1256         }
1257         if (vol->UNC == NULL) {
1258                 if (devname == NULL) {
1259                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1260                                                 "target\n");
1261                         return 1;
1262                 }
1263                 if ((temp_len = strnlen(devname, 300)) < 300) {
1264                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1265                         if (vol->UNC == NULL)
1266                                 return 1;
1267                         strcpy(vol->UNC, devname);
1268                         if (strncmp(vol->UNC, "//", 2) == 0) {
1269                                 vol->UNC[0] = '\\';
1270                                 vol->UNC[1] = '\\';
1271                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1272                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1273                                                     "begin with // or \\\\ \n");
1274                                 return 1;
1275                         }
1276                 } else {
1277                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1278                         return 1;
1279                 }
1280         }
1281         if (vol->UNCip == NULL)
1282                 vol->UNCip = &vol->UNC[2];
1283
1284         return 0;
1285 }
1286
1287 static struct cifsSesInfo *
1288 cifs_find_tcp_session(struct in_addr *target_ip_addr,
1289                 struct in6_addr *target_ip6_addr,
1290                  char *userName, struct TCP_Server_Info **psrvTcp)
1291 {
1292         struct list_head *tmp;
1293         struct cifsSesInfo *ses;
1294         *psrvTcp = NULL;
1295         read_lock(&GlobalSMBSeslock);
1296
1297         list_for_each(tmp, &GlobalSMBSessionList) {
1298                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1299                 if (ses->server) {
1300                         if ((target_ip_addr &&
1301                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1302                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1303                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1304                                         target_ip6_addr, sizeof(*target_ip6_addr)))) {
1305                                 /* BB lock server and tcp session and increment
1306                                       use count here?? */
1307
1308                                 /* found a match on the TCP session */
1309                                 *psrvTcp = ses->server;
1310
1311                                 /* BB check if reconnection needed */
1312                                 if (strncmp
1313                                     (ses->userName, userName,
1314                                      MAX_USERNAME_SIZE) == 0){
1315                                         read_unlock(&GlobalSMBSeslock);
1316                                         /* Found exact match on both TCP and
1317                                            SMB sessions */
1318                                         return ses;
1319                                 }
1320                         }
1321                 }
1322                 /* else tcp and smb sessions need reconnection */
1323         }
1324         read_unlock(&GlobalSMBSeslock);
1325         return NULL;
1326 }
1327
1328 static struct cifsTconInfo *
1329 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1330 {
1331         struct list_head *tmp;
1332         struct cifsTconInfo *tcon;
1333
1334         read_lock(&GlobalSMBSeslock);
1335         list_for_each(tmp, &GlobalTreeConnectionList) {
1336                 cFYI(1, ("Next tcon"));
1337                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1338                 if (tcon->ses) {
1339                         if (tcon->ses->server) {
1340                                 cFYI(1,
1341                                      ("old ip addr: %x == new ip %x ?",
1342                                       tcon->ses->server->addr.sockAddr.sin_addr.
1343                                       s_addr, new_target_ip_addr));
1344                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1345                                     s_addr == new_target_ip_addr) {
1346         /* BB lock tcon, server and tcp session and increment use count here? */
1347                                         /* found a match on the TCP session */
1348                                         /* BB check if reconnection needed */
1349                                         cFYI(1,
1350                                               ("IP match, old UNC: %s new: %s",
1351                                               tcon->treeName, uncName));
1352                                         if (strncmp
1353                                             (tcon->treeName, uncName,
1354                                              MAX_TREE_SIZE) == 0) {
1355                                                 cFYI(1,
1356                                                      ("and old usr: %s new: %s",
1357                                                       tcon->treeName, uncName));
1358                                                 if (strncmp
1359                                                     (tcon->ses->userName,
1360                                                      userName,
1361                                                      MAX_USERNAME_SIZE) == 0) {
1362                                                         read_unlock(&GlobalSMBSeslock);
1363                                                         /* matched smb session
1364                                                         (user name */
1365                                                         return tcon;
1366                                                 }
1367                                         }
1368                                 }
1369                         }
1370                 }
1371         }
1372         read_unlock(&GlobalSMBSeslock);
1373         return NULL;
1374 }
1375
1376 int
1377 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1378                     const char *old_path, const struct nls_table *nls_codepage,
1379                     int remap)
1380 {
1381         unsigned char *referrals = NULL;
1382         unsigned int num_referrals;
1383         int rc = 0;
1384
1385         rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
1386                         &num_referrals, &referrals, remap);
1387
1388         /* BB Add in code to: if valid refrl, if not ip address contact
1389                 the helper that resolves tcp names, mount to it, try to
1390                 tcon to it unmount it if fail */
1391
1392         kfree(referrals);
1393
1394         return rc;
1395 }
1396
1397 int
1398 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
1399              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
1400              unsigned char **preferrals, int remap)
1401 {
1402         char *temp_unc;
1403         int rc = 0;
1404
1405         *pnum_referrals = 0;
1406
1407         if (pSesInfo->ipc_tid == 0) {
1408                 temp_unc = kmalloc(2 /* for slashes */ +
1409                         strnlen(pSesInfo->serverName,
1410                                 SERVER_NAME_LEN_WITH_NULL * 2)
1411                                  + 1 + 4 /* slash IPC$ */  + 2,
1412                                 GFP_KERNEL);
1413                 if (temp_unc == NULL)
1414                         return -ENOMEM;
1415                 temp_unc[0] = '\\';
1416                 temp_unc[1] = '\\';
1417                 strcpy(temp_unc + 2, pSesInfo->serverName);
1418                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1419                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1420                 cFYI(1,
1421                      ("CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid));
1422                 kfree(temp_unc);
1423         }
1424         if (rc == 0)
1425                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1426                                      pnum_referrals, nls_codepage, remap);
1427
1428         return rc;
1429 }
1430
1431 /* See RFC1001 section 14 on representation of Netbios names */
1432 static void rfc1002mangle(char *target, char *source, unsigned int length)
1433 {
1434         unsigned int i, j;
1435
1436         for (i = 0, j = 0; i < (length); i++) {
1437                 /* mask a nibble at a time and encode */
1438                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1439                 target[j+1] = 'A' + (0x0F & source[i]);
1440                 j += 2;
1441         }
1442
1443 }
1444
1445
1446 static int
1447 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1448              char *netbios_name, char *target_name)
1449 {
1450         int rc = 0;
1451         int connected = 0;
1452         __be16 orig_port = 0;
1453
1454         if (*csocket == NULL) {
1455                 rc = sock_create_kern(PF_INET, SOCK_STREAM,
1456                                       IPPROTO_TCP, csocket);
1457                 if (rc < 0) {
1458                         cERROR(1, ("Error %d creating socket", rc));
1459                         *csocket = NULL;
1460                         return rc;
1461                 } else {
1462                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1463                         cFYI(1, ("Socket created"));
1464                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1465                 }
1466         }
1467
1468         psin_server->sin_family = AF_INET;
1469         if (psin_server->sin_port) { /* user overrode default port */
1470                 rc = (*csocket)->ops->connect(*csocket,
1471                                 (struct sockaddr *) psin_server,
1472                                 sizeof (struct sockaddr_in), 0);
1473                 if (rc >= 0)
1474                         connected = 1;
1475         }
1476
1477         if (!connected) {
1478                 /* save original port so we can retry user specified port
1479                         later if fall back ports fail this time  */
1480                 orig_port = psin_server->sin_port;
1481
1482                 /* do not retry on the same port we just failed on */
1483                 if (psin_server->sin_port != htons(CIFS_PORT)) {
1484                         psin_server->sin_port = htons(CIFS_PORT);
1485
1486                         rc = (*csocket)->ops->connect(*csocket,
1487                                         (struct sockaddr *) psin_server,
1488                                         sizeof (struct sockaddr_in), 0);
1489                         if (rc >= 0)
1490                                 connected = 1;
1491                 }
1492         }
1493         if (!connected) {
1494                 psin_server->sin_port = htons(RFC1001_PORT);
1495                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1496                                               psin_server,
1497                                               sizeof (struct sockaddr_in), 0);
1498                 if (rc >= 0)
1499                         connected = 1;
1500         }
1501
1502         /* give up here - unless we want to retry on different
1503                 protocol families some day */
1504         if (!connected) {
1505                 if (orig_port)
1506                         psin_server->sin_port = orig_port;
1507                 cFYI(1, ("Error %d connecting to server via ipv4", rc));
1508                 sock_release(*csocket);
1509                 *csocket = NULL;
1510                 return rc;
1511         }
1512         /* Eventually check for other socket options to change from
1513                 the default. sock_setsockopt not used because it expects
1514                 user space buffer */
1515          cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
1516                  (*csocket)->sk->sk_sndbuf,
1517                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1518         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1519         /* make the bufsizes depend on wsize/rsize and max requests */
1520         if ((*csocket)->sk->sk_sndbuf < (200 * 1024))
1521                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1522         if ((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1523                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1524
1525         /* send RFC1001 sessinit */
1526         if (psin_server->sin_port == htons(RFC1001_PORT)) {
1527                 /* some servers require RFC1001 sessinit before sending
1528                 negprot - BB check reconnection in case where second
1529                 sessinit is sent but no second negprot */
1530                 struct rfc1002_session_packet *ses_init_buf;
1531                 struct smb_hdr *smb_buf;
1532                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
1533                                        GFP_KERNEL);
1534                 if (ses_init_buf) {
1535                         ses_init_buf->trailer.session_req.called_len = 32;
1536                         if (target_name && (target_name[0] != 0)) {
1537                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1538                                         target_name, 16);
1539                         } else {
1540                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1541                                         DEFAULT_CIFS_CALLED_NAME, 16);
1542                         }
1543
1544                         ses_init_buf->trailer.session_req.calling_len = 32;
1545                         /* calling name ends in null (byte 16) from old smb
1546                         convention. */
1547                         if (netbios_name && (netbios_name[0] != 0)) {
1548                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1549                                         netbios_name, 16);
1550                         } else {
1551                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1552                                         "LINUX_CIFS_CLNT", 16);
1553                         }
1554                         ses_init_buf->trailer.session_req.scope1 = 0;
1555                         ses_init_buf->trailer.session_req.scope2 = 0;
1556                         smb_buf = (struct smb_hdr *)ses_init_buf;
1557                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1558                         smb_buf->smb_buf_length = 0x81000044;
1559                         rc = smb_send(*csocket, smb_buf, 0x44,
1560                                 (struct sockaddr *)psin_server);
1561                         kfree(ses_init_buf);
1562                         msleep(1); /* RFC1001 layer in at least one server
1563                                       requires very short break before negprot
1564                                       presumably because not expecting negprot
1565                                       to follow so fast.  This is a simple
1566                                       solution that works without
1567                                       complicating the code and causes no
1568                                       significant slowing down on mount
1569                                       for everyone else */
1570                 }
1571                 /* else the negprot may still work without this
1572                 even though malloc failed */
1573
1574         }
1575
1576         return rc;
1577 }
1578
1579 static int
1580 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1581 {
1582         int rc = 0;
1583         int connected = 0;
1584         __be16 orig_port = 0;
1585
1586         if (*csocket == NULL) {
1587                 rc = sock_create_kern(PF_INET6, SOCK_STREAM,
1588                                       IPPROTO_TCP, csocket);
1589                 if (rc < 0) {
1590                         cERROR(1, ("Error %d creating ipv6 socket", rc));
1591                         *csocket = NULL;
1592                         return rc;
1593                 } else {
1594                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1595                          cFYI(1, ("ipv6 Socket created"));
1596                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1597                 }
1598         }
1599
1600         psin_server->sin6_family = AF_INET6;
1601
1602         if (psin_server->sin6_port) { /* user overrode default port */
1603                 rc = (*csocket)->ops->connect(*csocket,
1604                                 (struct sockaddr *) psin_server,
1605                                 sizeof (struct sockaddr_in6), 0);
1606                 if (rc >= 0)
1607                         connected = 1;
1608         }
1609
1610         if (!connected) {
1611                 /* save original port so we can retry user specified port
1612                         later if fall back ports fail this time  */
1613
1614                 orig_port = psin_server->sin6_port;
1615                 /* do not retry on the same port we just failed on */
1616                 if (psin_server->sin6_port != htons(CIFS_PORT)) {
1617                         psin_server->sin6_port = htons(CIFS_PORT);
1618
1619                         rc = (*csocket)->ops->connect(*csocket,
1620                                         (struct sockaddr *) psin_server,
1621                                         sizeof (struct sockaddr_in6), 0);
1622                         if (rc >= 0)
1623                                 connected = 1;
1624                 }
1625         }
1626         if (!connected) {
1627                 psin_server->sin6_port = htons(RFC1001_PORT);
1628                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1629                                  psin_server, sizeof (struct sockaddr_in6), 0);
1630                 if (rc >= 0)
1631                         connected = 1;
1632         }
1633
1634         /* give up here - unless we want to retry on different
1635                 protocol families some day */
1636         if (!connected) {
1637                 if (orig_port)
1638                         psin_server->sin6_port = orig_port;
1639                 cFYI(1, ("Error %d connecting to server via ipv6", rc));
1640                 sock_release(*csocket);
1641                 *csocket = NULL;
1642                 return rc;
1643         }
1644         /* Eventually check for other socket options to change from
1645                 the default. sock_setsockopt not used because it expects
1646                 user space buffer */
1647         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1648
1649         return rc;
1650 }
1651
1652 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
1653                           struct super_block *sb, struct smb_vol *vol_info)
1654 {
1655         /* if we are reconnecting then should we check to see if
1656          * any requested capabilities changed locally e.g. via
1657          * remount but we can not do much about it here
1658          * if they have (even if we could detect it by the following)
1659          * Perhaps we could add a backpointer to array of sb from tcon
1660          * or if we change to make all sb to same share the same
1661          * sb as NFS - then we only have one backpointer to sb.
1662          * What if we wanted to mount the server share twice once with
1663          * and once without posixacls or posix paths? */
1664         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1665
1666
1667         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
1668                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1669
1670                 /* check for reconnect case in which we do not
1671                    want to change the mount behavior if we can avoid it */
1672                 if (vol_info == NULL) {
1673                         /* turn off POSIX ACL and PATHNAMES if not set
1674                            originally at mount time */
1675                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1676                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1677                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1678                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1679
1680
1681
1682
1683                 }
1684
1685                 cap &= CIFS_UNIX_CAP_MASK;
1686                 if (vol_info && vol_info->no_psx_acl)
1687                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1688                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
1689                         cFYI(1, ("negotiated posix acl support"));
1690                         if (sb)
1691                                 sb->s_flags |= MS_POSIXACL;
1692                 }
1693
1694                 if (vol_info && vol_info->posix_paths == 0)
1695                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1696                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1697                         cFYI(1, ("negotiate posix pathnames"));
1698                         if (sb)
1699                                 CIFS_SB(sb)->mnt_cifs_flags |=
1700                                         CIFS_MOUNT_POSIX_PATHS;
1701                 }
1702
1703                 /* We might be setting the path sep back to a different
1704                 form if we are reconnecting and the server switched its
1705                 posix path capability for this share */
1706                 if (sb && (CIFS_SB(sb)->prepathlen > 0))
1707                         CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1708
1709                 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
1710                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
1711                                 CIFS_SB(sb)->rsize = 127 * 1024;
1712 #ifdef CONFIG_CIFS_DEBUG2
1713                                 cFYI(1, ("larger reads not supported by srv"));
1714 #endif
1715                         }
1716                 }
1717
1718
1719                 cFYI(1, ("Negotiate caps 0x%x", (int)cap));
1720 #ifdef CONFIG_CIFS_DEBUG2
1721                 if (cap & CIFS_UNIX_FCNTL_CAP)
1722                         cFYI(1, ("FCNTL cap"));
1723                 if (cap & CIFS_UNIX_EXTATTR_CAP)
1724                         cFYI(1, ("EXTATTR cap"));
1725                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1726                         cFYI(1, ("POSIX path cap"));
1727                 if (cap & CIFS_UNIX_XATTR_CAP)
1728                         cFYI(1, ("XATTR cap"));
1729                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
1730                         cFYI(1, ("POSIX ACL cap"));
1731                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
1732                         cFYI(1, ("very large read cap"));
1733                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
1734                         cFYI(1, ("very large write cap"));
1735 #endif /* CIFS_DEBUG2 */
1736                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1737                         cFYI(1, ("setting capabilities failed"));
1738                 }
1739         }
1740 }
1741
1742 int
1743 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1744            char *mount_data, const char *devname)
1745 {
1746         int rc = 0;
1747         int xid;
1748         int address_type = AF_INET;
1749         struct socket *csocket = NULL;
1750         struct sockaddr_in sin_server;
1751         struct sockaddr_in6 sin_server6;
1752         struct smb_vol volume_info;
1753         struct cifsSesInfo *pSesInfo = NULL;
1754         struct cifsSesInfo *existingCifsSes = NULL;
1755         struct cifsTconInfo *tcon = NULL;
1756         struct TCP_Server_Info *srvTcp = NULL;
1757
1758         xid = GetXid();
1759
1760 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1761
1762         memset(&volume_info, 0, sizeof(struct smb_vol));
1763         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1764                 kfree(volume_info.UNC);
1765                 kfree(volume_info.password);
1766                 kfree(volume_info.prepath);
1767                 FreeXid(xid);
1768                 return -EINVAL;
1769         }
1770
1771         if (volume_info.nullauth) {
1772                 cFYI(1, ("null user"));
1773                 volume_info.username = NULL;
1774         } else if (volume_info.username) {
1775                 /* BB fixme parse for domain name here */
1776                 cFYI(1, ("Username: %s", volume_info.username));
1777         } else {
1778                 cifserror("No username specified");
1779         /* In userspace mount helper we can get user name from alternate
1780            locations such as env variables and files on disk */
1781                 kfree(volume_info.UNC);
1782                 kfree(volume_info.password);
1783                 kfree(volume_info.prepath);
1784                 FreeXid(xid);
1785                 return -EINVAL;
1786         }
1787
1788         if (volume_info.UNCip && volume_info.UNC) {
1789                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
1790                                     &sin_server.sin_addr.s_addr);
1791
1792                 if (rc <= 0) {
1793                         /* not ipv4 address, try ipv6 */
1794                         rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
1795                                             &sin_server6.sin6_addr.in6_u);
1796                         if (rc > 0)
1797                                 address_type = AF_INET6;
1798                 } else {
1799                         address_type = AF_INET;
1800                 }
1801
1802                 if (rc <= 0) {
1803                         /* we failed translating address */
1804                         kfree(volume_info.UNC);
1805                         kfree(volume_info.password);
1806                         kfree(volume_info.prepath);
1807                         FreeXid(xid);
1808                         return -EINVAL;
1809                 }
1810
1811                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1812                 /* success */
1813                 rc = 0;
1814         } else if (volume_info.UNCip) {
1815                 /* BB using ip addr as server name to connect to the
1816                    DFS root below */
1817                 cERROR(1, ("Connecting to DFS root not implemented yet"));
1818                 kfree(volume_info.UNC);
1819                 kfree(volume_info.password);
1820                 kfree(volume_info.prepath);
1821                 FreeXid(xid);
1822                 return -EINVAL;
1823         } else /* which servers DFS root would we conect to */ {
1824                 cERROR(1,
1825                        ("CIFS mount error: No UNC path (e.g. -o "
1826                         "unc=//192.168.1.100/public) specified"));
1827                 kfree(volume_info.UNC);
1828                 kfree(volume_info.password);
1829                 kfree(volume_info.prepath);
1830                 FreeXid(xid);
1831                 return -EINVAL;
1832         }
1833
1834         /* this is needed for ASCII cp to Unicode converts */
1835         if (volume_info.iocharset == NULL) {
1836                 cifs_sb->local_nls = load_nls_default();
1837         /* load_nls_default can not return null */
1838         } else {
1839                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1840                 if (cifs_sb->local_nls == NULL) {
1841                         cERROR(1, ("CIFS mount error: iocharset %s not found",
1842                                  volume_info.iocharset));
1843                         kfree(volume_info.UNC);
1844                         kfree(volume_info.password);
1845                         kfree(volume_info.prepath);
1846                         FreeXid(xid);
1847                         return -ELIBACC;
1848                 }
1849         }
1850
1851         if (address_type == AF_INET)
1852                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1853                         NULL /* no ipv6 addr */,
1854                         volume_info.username, &srvTcp);
1855         else if (address_type == AF_INET6) {
1856                 cFYI(1, ("looking for ipv6 address"));
1857                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1858                         &sin_server6.sin6_addr,
1859                         volume_info.username, &srvTcp);
1860         } else {
1861                 kfree(volume_info.UNC);
1862                 kfree(volume_info.password);
1863                 kfree(volume_info.prepath);
1864                 FreeXid(xid);
1865                 return -EINVAL;
1866         }
1867
1868         if (srvTcp) {
1869                 cFYI(1, ("Existing tcp session with server found"));
1870         } else {        /* create socket */
1871                 if (volume_info.port)
1872                         sin_server.sin_port = htons(volume_info.port);
1873                 else
1874                         sin_server.sin_port = 0;
1875                 if (address_type == AF_INET6) {
1876                         cFYI(1, ("attempting ipv6 connect"));
1877                         /* BB should we allow ipv6 on port 139? */
1878                         /* other OS never observed in Wild doing 139 with v6 */
1879                         rc = ipv6_connect(&sin_server6, &csocket);
1880                 } else
1881                         rc = ipv4_connect(&sin_server, &csocket,
1882                                   volume_info.source_rfc1001_name,
1883                                   volume_info.target_rfc1001_name);
1884                 if (rc < 0) {
1885                         cERROR(1, ("Error connecting to IPv4 socket. "
1886                                    "Aborting operation"));
1887                         if (csocket != NULL)
1888                                 sock_release(csocket);
1889                         kfree(volume_info.UNC);
1890                         kfree(volume_info.password);
1891                         kfree(volume_info.prepath);
1892                         FreeXid(xid);
1893                         return rc;
1894                 }
1895
1896                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1897                 if (srvTcp == NULL) {
1898                         rc = -ENOMEM;
1899                         sock_release(csocket);
1900                         kfree(volume_info.UNC);
1901                         kfree(volume_info.password);
1902                         kfree(volume_info.prepath);
1903                         FreeXid(xid);
1904                         return rc;
1905                 } else {
1906                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1907                         memcpy(&srvTcp->addr.sockAddr, &sin_server,
1908                                 sizeof (struct sockaddr_in));
1909                         atomic_set(&srvTcp->inFlight, 0);
1910                         /* BB Add code for ipv6 case too */
1911                         srvTcp->ssocket = csocket;
1912                         srvTcp->protocolType = IPV4;
1913                         init_waitqueue_head(&srvTcp->response_q);
1914                         init_waitqueue_head(&srvTcp->request_q);
1915                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1916                         /* at this point we are the only ones with the pointer
1917                         to the struct since the kernel thread not created yet
1918                         so no need to spinlock this init of tcpStatus */
1919                         srvTcp->tcpStatus = CifsNew;
1920                         init_MUTEX(&srvTcp->tcpSem);
1921                         srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1922                         if ( IS_ERR(srvTcp->tsk) ) {
1923                                 rc = PTR_ERR(srvTcp->tsk);
1924                                 cERROR(1, ("error %d create cifsd thread", rc));
1925                                 srvTcp->tsk = NULL;
1926                                 sock_release(csocket);
1927                                 kfree(volume_info.UNC);
1928                                 kfree(volume_info.password);
1929                                 kfree(volume_info.prepath);
1930                                 FreeXid(xid);
1931                                 return rc;
1932                         }
1933                         wait_for_completion(&cifsd_complete);
1934                         rc = 0;
1935                         memcpy(srvTcp->workstation_RFC1001_name,
1936                                 volume_info.source_rfc1001_name, 16);
1937                         memcpy(srvTcp->server_RFC1001_name,
1938                                 volume_info.target_rfc1001_name, 16);
1939                         srvTcp->sequence_number = 0;
1940                 }
1941         }
1942
1943         if (existingCifsSes) {
1944                 pSesInfo = existingCifsSes;
1945                 cFYI(1, ("Existing smb sess found"));
1946                 kfree(volume_info.password);
1947                 /* volume_info.UNC freed at end of function */
1948         } else if (!rc) {
1949                 cFYI(1, ("Existing smb sess not found"));
1950                 pSesInfo = sesInfoAlloc();
1951                 if (pSesInfo == NULL)
1952                         rc = -ENOMEM;
1953                 else {
1954                         pSesInfo->server = srvTcp;
1955                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1956                                 NIPQUAD(sin_server.sin_addr.s_addr));
1957                 }
1958
1959                 if (!rc) {
1960                         /* volume_info.password freed at unmount */
1961                         if (volume_info.password)
1962                                 pSesInfo->password = volume_info.password;
1963                         if (volume_info.username)
1964                                 strncpy(pSesInfo->userName,
1965                                         volume_info.username,
1966                                         MAX_USERNAME_SIZE);
1967                         if (volume_info.domainname) {
1968                                 int len = strlen(volume_info.domainname);
1969                                 pSesInfo->domainName =
1970                                         kmalloc(len + 1, GFP_KERNEL);
1971                                 if (pSesInfo->domainName)
1972                                         strcpy(pSesInfo->domainName,
1973                                                 volume_info.domainname);
1974                         }
1975                         pSesInfo->linux_uid = volume_info.linux_uid;
1976                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1977                         down(&pSesInfo->sesSem);
1978                         /* BB FIXME need to pass vol->secFlgs BB */
1979                         rc = cifs_setup_session(xid, pSesInfo,
1980                                                 cifs_sb->local_nls);
1981                         up(&pSesInfo->sesSem);
1982                         if (!rc)
1983                                 atomic_inc(&srvTcp->socketUseCount);
1984                 } else
1985                         kfree(volume_info.password);
1986         }
1987
1988         /* search for existing tcon to this server share */
1989         if (!rc) {
1990                 if (volume_info.rsize > CIFSMaxBufSize) {
1991                         cERROR(1, ("rsize %d too large, using MaxBufSize",
1992                                 volume_info.rsize));
1993                         cifs_sb->rsize = CIFSMaxBufSize;
1994                 } else if ((volume_info.rsize) &&
1995                                 (volume_info.rsize <= CIFSMaxBufSize))
1996                         cifs_sb->rsize = volume_info.rsize;
1997                 else /* default */
1998                         cifs_sb->rsize = CIFSMaxBufSize;
1999
2000                 if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2001                         cERROR(1, ("wsize %d too large, using 4096 instead",
2002                                   volume_info.wsize));
2003                         cifs_sb->wsize = 4096;
2004                 } else if (volume_info.wsize)
2005                         cifs_sb->wsize = volume_info.wsize;
2006                 else
2007                         cifs_sb->wsize =
2008                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2009                                         127*1024);
2010                         /* old default of CIFSMaxBufSize was too small now
2011                            that SMB Write2 can send multiple pages in kvec.
2012                            RFC1001 does not describe what happens when frame
2013                            bigger than 128K is sent so use that as max in
2014                            conjunction with 52K kvec constraint on arch with 4K
2015                            page size  */
2016
2017                 if (cifs_sb->rsize < 2048) {
2018                         cifs_sb->rsize = 2048;
2019                         /* Windows ME may prefer this */
2020                         cFYI(1, ("readsize set to minimum: 2048"));
2021                 }
2022                 /* calculate prepath */
2023                 cifs_sb->prepath = volume_info.prepath;
2024                 if (cifs_sb->prepath) {
2025                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2026                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
2027                         volume_info.prepath = NULL;
2028                 } else
2029                         cifs_sb->prepathlen = 0;
2030                 cifs_sb->mnt_uid = volume_info.linux_uid;
2031                 cifs_sb->mnt_gid = volume_info.linux_gid;
2032                 cifs_sb->mnt_file_mode = volume_info.file_mode;
2033                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
2034                 cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
2035                         cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
2036
2037                 if (volume_info.noperm)
2038                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2039                 if (volume_info.setuids)
2040                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2041                 if (volume_info.server_ino)
2042                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2043                 if (volume_info.remap)
2044                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2045                 if (volume_info.no_xattr)
2046                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2047                 if (volume_info.sfu_emul)
2048                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2049                 if (volume_info.nobrl)
2050                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2051                 if (volume_info.cifs_acl)
2052                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2053                 if (volume_info.override_uid)
2054                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2055                 if (volume_info.override_gid)
2056                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2057                 if (volume_info.direct_io) {
2058                         cFYI(1, ("mounting share using direct i/o"));
2059                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2060                 }
2061
2062                 tcon =
2063                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
2064                              volume_info.username);
2065                 if (tcon) {
2066                         cFYI(1, ("Found match on UNC path"));
2067                         /* we can have only one retry value for a connection
2068                            to a share so for resources mounted more than once
2069                            to the same server share the last value passed in
2070                            for the retry flag is used */
2071                         tcon->retry = volume_info.retry;
2072                         tcon->nocase = volume_info.nocase;
2073                 } else {
2074                         tcon = tconInfoAlloc();
2075                         if (tcon == NULL)
2076                                 rc = -ENOMEM;
2077                         else {
2078                                 /* check for null share name ie connecting to
2079                                  * dfs root */
2080
2081                                 /* BB check if this works for exactly length
2082                                  * three strings */
2083                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2084                                     && (strchr(volume_info.UNC + 3, '/') ==
2085                                         NULL)) {
2086                                         rc = connect_to_dfs_path(xid, pSesInfo,
2087                                                 "", cifs_sb->local_nls,
2088                                                 cifs_sb->mnt_cifs_flags &
2089                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2090                                         kfree(volume_info.UNC);
2091                                         FreeXid(xid);
2092                                         return -ENODEV;
2093                                 } else {
2094                                         /* BB Do we need to wrap sesSem around
2095                                          * this TCon call and Unix SetFS as
2096                                          * we do on SessSetup and reconnect? */
2097                                         rc = CIFSTCon(xid, pSesInfo,
2098                                                 volume_info.UNC,
2099                                                 tcon, cifs_sb->local_nls);
2100                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
2101                                 }
2102                                 if (!rc) {
2103                                         atomic_inc(&pSesInfo->inUse);
2104                                         tcon->retry = volume_info.retry;
2105                                         tcon->nocase = volume_info.nocase;
2106                                 }
2107                         }
2108                 }
2109         }
2110         if (pSesInfo) {
2111                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2112                         sb->s_maxbytes = (u64) 1 << 63;
2113                 } else
2114                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2115         }
2116
2117         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2118         sb->s_time_gran = 100;
2119
2120 /* on error free sesinfo and tcon struct if needed */
2121         if (rc) {
2122                 /* if session setup failed, use count is zero but
2123                 we still need to free cifsd thread */
2124                 if (atomic_read(&srvTcp->socketUseCount) == 0) {
2125                         spin_lock(&GlobalMid_Lock);
2126                         srvTcp->tcpStatus = CifsExiting;
2127                         spin_unlock(&GlobalMid_Lock);
2128                         if (srvTcp->tsk) {
2129                                 struct task_struct *tsk;
2130                                 /* If we could verify that kthread_stop would
2131                                    always wake up processes blocked in
2132                                    tcp in recv_mesg then we could remove the
2133                                    send_sig call */
2134                                 force_sig(SIGKILL, srvTcp->tsk);
2135                                 tsk = srvTcp->tsk;
2136                                 if (tsk)
2137                                         kthread_stop(tsk);
2138                         }
2139                 }
2140                  /* If find_unc succeeded then rc == 0 so we can not end */
2141                 if (tcon)  /* up accidently freeing someone elses tcon struct */
2142                         tconInfoFree(tcon);
2143                 if (existingCifsSes == NULL) {
2144                         if (pSesInfo) {
2145                                 if ((pSesInfo->server) &&
2146                                     (pSesInfo->status == CifsGood)) {
2147                                         int temp_rc;
2148                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2149                                         /* if the socketUseCount is now zero */
2150                                         if ((temp_rc == -ESHUTDOWN) &&
2151                                             (pSesInfo->server) &&
2152                                             (pSesInfo->server->tsk)) {
2153                                                 struct task_struct *tsk;
2154                                                 force_sig(SIGKILL,
2155                                                         pSesInfo->server->tsk);
2156                                                 tsk = pSesInfo->server->tsk;
2157                                                 if (tsk)
2158                                                         kthread_stop(tsk);
2159                                         }
2160                                 } else
2161                                         cFYI(1, ("No session or bad tcon"));
2162                                 sesInfoFree(pSesInfo);
2163                                 /* pSesInfo = NULL; */
2164                         }
2165                 }
2166         } else {
2167                 atomic_inc(&tcon->useCount);
2168                 cifs_sb->tcon = tcon;
2169                 tcon->ses = pSesInfo;
2170
2171                 /* do not care if following two calls succeed - informational */
2172                 CIFSSMBQFSDeviceInfo(xid, tcon);
2173                 CIFSSMBQFSAttributeInfo(xid, tcon);
2174
2175                 /* tell server which Unix caps we support */
2176                 if (tcon->ses->capabilities & CAP_UNIX)
2177                         reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2178                 else if (cifs_sb->rsize > (1024 * 127)) {
2179                         cifs_sb->rsize = 1024 * 127;
2180 #ifdef CONFIG_CIFS_DEBUG2
2181                         cFYI(1, ("no very large read support, rsize 127K"));
2182 #endif
2183
2184                 }
2185                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2186                         cifs_sb->wsize = min(cifs_sb->wsize,
2187                                              (tcon->ses->server->maxBuf -
2188                                               MAX_CIFS_HDR_SIZE));
2189                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2190                         cifs_sb->rsize = min(cifs_sb->rsize,
2191                                              (tcon->ses->server->maxBuf -
2192                                               MAX_CIFS_HDR_SIZE));
2193         }
2194
2195         /* volume_info.password is freed above when existing session found
2196         (in which case it is not needed anymore) but when new sesion is created
2197         the password ptr is put in the new session structure (in which case the
2198         password will be freed at unmount time) */
2199         kfree(volume_info.UNC);
2200         kfree(volume_info.prepath);
2201         FreeXid(xid);
2202         return rc;
2203 }
2204
2205 static int
2206 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2207               char session_key[CIFS_SESS_KEY_SIZE],
2208               const struct nls_table *nls_codepage)
2209 {
2210         struct smb_hdr *smb_buffer;
2211         struct smb_hdr *smb_buffer_response;
2212         SESSION_SETUP_ANDX *pSMB;
2213         SESSION_SETUP_ANDX *pSMBr;
2214         char *bcc_ptr;
2215         char *user;
2216         char *domain;
2217         int rc = 0;
2218         int remaining_words = 0;
2219         int bytes_returned = 0;
2220         int len;
2221         __u32 capabilities;
2222         __u16 count;
2223
2224         cFYI(1, ("In sesssetup"));
2225         if (ses == NULL)
2226                 return -EINVAL;
2227         user = ses->userName;
2228         domain = ses->domainName;
2229         smb_buffer = cifs_buf_get();
2230         if (smb_buffer == NULL) {
2231                 return -ENOMEM;
2232         }
2233         smb_buffer_response = smb_buffer;
2234         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2235
2236         /* send SMBsessionSetup here */
2237         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2238                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2239
2240         smb_buffer->Mid = GetNextMid(ses->server);
2241         pSMB->req_no_secext.AndXCommand = 0xFF;
2242         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2243         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2244
2245         if (ses->server->secMode &
2246                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2247                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2248
2249         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2250                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2251         if (ses->capabilities & CAP_UNICODE) {
2252                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2253                 capabilities |= CAP_UNICODE;
2254         }
2255         if (ses->capabilities & CAP_STATUS32) {
2256                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2257                 capabilities |= CAP_STATUS32;
2258         }
2259         if (ses->capabilities & CAP_DFS) {
2260                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2261                 capabilities |= CAP_DFS;
2262         }
2263         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2264
2265         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2266                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2267
2268         pSMB->req_no_secext.CaseSensitivePasswordLength =
2269             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2270         bcc_ptr = pByteArea(smb_buffer);
2271         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2272         bcc_ptr += CIFS_SESS_KEY_SIZE;
2273         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2274         bcc_ptr += CIFS_SESS_KEY_SIZE;
2275
2276         if (ses->capabilities & CAP_UNICODE) {
2277                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2278                         *bcc_ptr = 0;
2279                         bcc_ptr++;
2280                 }
2281                 if (user == NULL)
2282                         bytes_returned = 0; /* skip null user */
2283                 else
2284                         bytes_returned =
2285                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2286                                         nls_codepage);
2287                 /* convert number of 16 bit words to bytes */
2288                 bcc_ptr += 2 * bytes_returned;
2289                 bcc_ptr += 2;   /* trailing null */
2290                 if (domain == NULL)
2291                         bytes_returned =
2292                             cifs_strtoUCS((__le16 *) bcc_ptr,
2293                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2294                 else
2295                         bytes_returned =
2296                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2297                                           nls_codepage);
2298                 bcc_ptr += 2 * bytes_returned;
2299                 bcc_ptr += 2;
2300                 bytes_returned =
2301                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2302                                   32, nls_codepage);
2303                 bcc_ptr += 2 * bytes_returned;
2304                 bytes_returned =
2305                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2306                                   32, nls_codepage);
2307                 bcc_ptr += 2 * bytes_returned;
2308                 bcc_ptr += 2;
2309                 bytes_returned =
2310                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2311                                   64, nls_codepage);
2312                 bcc_ptr += 2 * bytes_returned;
2313                 bcc_ptr += 2;
2314         } else {
2315                 if (user != NULL) {
2316                     strncpy(bcc_ptr, user, 200);
2317                     bcc_ptr += strnlen(user, 200);
2318                 }
2319                 *bcc_ptr = 0;
2320                 bcc_ptr++;
2321                 if (domain == NULL) {
2322                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2323                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2324                 } else {
2325                         strncpy(bcc_ptr, domain, 64);
2326                         bcc_ptr += strnlen(domain, 64);
2327                         *bcc_ptr = 0;
2328                         bcc_ptr++;
2329                 }
2330                 strcpy(bcc_ptr, "Linux version ");
2331                 bcc_ptr += strlen("Linux version ");
2332                 strcpy(bcc_ptr, utsname()->release);
2333                 bcc_ptr += strlen(utsname()->release) + 1;
2334                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2335                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2336         }
2337         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2338         smb_buffer->smb_buf_length += count;
2339         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2340
2341         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2342                          &bytes_returned, 1);
2343         if (rc) {
2344 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2345         } else if ((smb_buffer_response->WordCount == 3)
2346                    || (smb_buffer_response->WordCount == 4)) {
2347                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2348                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2349                 if (action & GUEST_LOGIN)
2350                         cFYI(1, (" Guest login")); /* BB mark SesInfo struct? */
2351                 ses->Suid = smb_buffer_response->Uid; /* UID left in wire format
2352                                                          (little endian) */
2353                 cFYI(1, ("UID = %d ", ses->Suid));
2354         /* response can have either 3 or 4 word count - Samba sends 3 */
2355                 bcc_ptr = pByteArea(smb_buffer_response);
2356                 if ((pSMBr->resp.hdr.WordCount == 3)
2357                     || ((pSMBr->resp.hdr.WordCount == 4)
2358                         && (blob_len < pSMBr->resp.ByteCount))) {
2359                         if (pSMBr->resp.hdr.WordCount == 4)
2360                                 bcc_ptr += blob_len;
2361
2362                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2363                                 if ((long) (bcc_ptr) % 2) {
2364                                         remaining_words =
2365                                             (BCC(smb_buffer_response) - 1) / 2;
2366                                         /* Unicode strings must be word
2367                                            aligned */
2368                                         bcc_ptr++;
2369                                 } else {
2370                                         remaining_words =
2371                                                 BCC(smb_buffer_response) / 2;
2372                                 }
2373                                 len =
2374                                     UniStrnlen((wchar_t *) bcc_ptr,
2375                                                remaining_words - 1);
2376 /* We look for obvious messed up bcc or strings in response so we do not go off
2377    the end since (at least) WIN2K and Windows XP have a major bug in not null
2378    terminating last Unicode string in response  */
2379                                 if (ses->serverOS)
2380                                         kfree(ses->serverOS);
2381                                 ses->serverOS = kzalloc(2 * (len + 1),
2382                                                         GFP_KERNEL);
2383                                 if (ses->serverOS == NULL)
2384                                         goto sesssetup_nomem;
2385                                 cifs_strfromUCS_le(ses->serverOS,
2386                                                    (__le16 *)bcc_ptr,
2387                                                    len, nls_codepage);
2388                                 bcc_ptr += 2 * (len + 1);
2389                                 remaining_words -= len + 1;
2390                                 ses->serverOS[2 * len] = 0;
2391                                 ses->serverOS[1 + (2 * len)] = 0;
2392                                 if (remaining_words > 0) {
2393                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2394                                                          remaining_words-1);
2395                                         kfree(ses->serverNOS);
2396                                         ses->serverNOS = kzalloc(2 * (len + 1),
2397                                                                  GFP_KERNEL);
2398                                         if (ses->serverNOS == NULL)
2399                                                 goto sesssetup_nomem;
2400                                         cifs_strfromUCS_le(ses->serverNOS,
2401                                                            (__le16 *)bcc_ptr,
2402                                                            len, nls_codepage);
2403                                         bcc_ptr += 2 * (len + 1);
2404                                         ses->serverNOS[2 * len] = 0;
2405                                         ses->serverNOS[1 + (2 * len)] = 0;
2406                                         if (strncmp(ses->serverNOS,
2407                                                 "NT LAN Manager 4", 16) == 0) {
2408                                                 cFYI(1, ("NT4 server"));
2409                                                 ses->flags |= CIFS_SES_NT4;
2410                                         }
2411                                         remaining_words -= len + 1;
2412                                         if (remaining_words > 0) {
2413                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2414                                 /* last string is not always null terminated
2415                                    (for e.g. for Windows XP & 2000) */
2416                                                 if (ses->serverDomain)
2417                                                         kfree(ses->serverDomain);
2418                                                 ses->serverDomain =
2419                                                     kzalloc(2*(len+1),
2420                                                             GFP_KERNEL);
2421                                                 if (ses->serverDomain == NULL)
2422                                                         goto sesssetup_nomem;
2423                                                 cifs_strfromUCS_le(ses->serverDomain,
2424                                                         (__le16 *)bcc_ptr,
2425                                                         len, nls_codepage);
2426                                                 bcc_ptr += 2 * (len + 1);
2427                                                 ses->serverDomain[2*len] = 0;
2428                                                 ses->serverDomain[1+(2*len)] = 0;
2429                                         } else { /* else no more room so create
2430                                                   dummy domain string */
2431                                                 if (ses->serverDomain)
2432                                                         kfree(ses->serverDomain);
2433                                                 ses->serverDomain =
2434                                                         kzalloc(2, GFP_KERNEL);
2435                                         }
2436                                 } else { /* no room so create dummy domain
2437                                             and NOS string */
2438
2439                                         /* if these kcallocs fail not much we
2440                                            can do, but better to not fail the
2441                                            sesssetup itself */
2442                                         kfree(ses->serverDomain);
2443                                         ses->serverDomain =
2444                                             kzalloc(2, GFP_KERNEL);
2445                                         kfree(ses->serverNOS);
2446                                         ses->serverNOS =
2447                                             kzalloc(2, GFP_KERNEL);
2448                                 }
2449                         } else {        /* ASCII */
2450                                 len = strnlen(bcc_ptr, 1024);
2451                                 if (((long) bcc_ptr + len) - (long)
2452                                     pByteArea(smb_buffer_response)
2453                                             <= BCC(smb_buffer_response)) {
2454                                         kfree(ses->serverOS);
2455                                         ses->serverOS = kzalloc(len + 1,
2456                                                                 GFP_KERNEL);
2457                                         if (ses->serverOS == NULL)
2458                                                 goto sesssetup_nomem;
2459                                         strncpy(ses->serverOS, bcc_ptr, len);
2460
2461                                         bcc_ptr += len;
2462                                         /* null terminate the string */
2463                                         bcc_ptr[0] = 0;
2464                                         bcc_ptr++;
2465
2466                                         len = strnlen(bcc_ptr, 1024);
2467                                         kfree(ses->serverNOS);
2468                                         ses->serverNOS = kzalloc(len + 1,
2469                                                                  GFP_KERNEL);
2470                                         if (ses->serverNOS == NULL)
2471                                                 goto sesssetup_nomem;
2472                                         strncpy(ses->serverNOS, bcc_ptr, len);
2473                                         bcc_ptr += len;
2474                                         bcc_ptr[0] = 0;
2475                                         bcc_ptr++;
2476
2477                                         len = strnlen(bcc_ptr, 1024);
2478                                         if (ses->serverDomain)
2479                                                 kfree(ses->serverDomain);
2480                                         ses->serverDomain = kzalloc(len + 1,
2481                                                                     GFP_KERNEL);
2482                                         if (ses->serverDomain == NULL)
2483                                                 goto sesssetup_nomem;
2484                                         strncpy(ses->serverDomain, bcc_ptr,
2485                                                 len);
2486                                         bcc_ptr += len;
2487                                         bcc_ptr[0] = 0;
2488                                         bcc_ptr++;
2489                                 } else
2490                                         cFYI(1,
2491                                              ("Variable field of length %d "
2492                                                 "extends beyond end of smb ",
2493                                               len));
2494                         }
2495                 } else {
2496                         cERROR(1,
2497                                (" Security Blob Length extends beyond "
2498                                 "end of SMB"));
2499                 }
2500         } else {
2501                 cERROR(1,
2502                        (" Invalid Word count %d: ",
2503                         smb_buffer_response->WordCount));
2504                 rc = -EIO;
2505         }
2506 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2507                            since that could make reconnection harder, and
2508                            reconnection might be needed to free memory */
2509         if (smb_buffer)
2510                 cifs_buf_release(smb_buffer);
2511
2512         return rc;
2513 }
2514
2515 static int
2516 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2517                               struct cifsSesInfo *ses, int *pNTLMv2_flag,
2518                               const struct nls_table *nls_codepage)
2519 {
2520         struct smb_hdr *smb_buffer;
2521         struct smb_hdr *smb_buffer_response;
2522         SESSION_SETUP_ANDX *pSMB;
2523         SESSION_SETUP_ANDX *pSMBr;
2524         char *bcc_ptr;
2525         char *domain;
2526         int rc = 0;
2527         int remaining_words = 0;
2528         int bytes_returned = 0;
2529         int len;
2530         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2531         PNEGOTIATE_MESSAGE SecurityBlob;
2532         PCHALLENGE_MESSAGE SecurityBlob2;
2533         __u32 negotiate_flags, capabilities;
2534         __u16 count;
2535
2536         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2537         if (ses == NULL)
2538                 return -EINVAL;
2539         domain = ses->domainName;
2540         *pNTLMv2_flag = FALSE;
2541         smb_buffer = cifs_buf_get();
2542         if (smb_buffer == NULL) {
2543                 return -ENOMEM;
2544         }
2545         smb_buffer_response = smb_buffer;
2546         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2547         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2548
2549         /* send SMBsessionSetup here */
2550         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2551                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2552
2553         smb_buffer->Mid = GetNextMid(ses->server);
2554         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2555         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2556
2557         pSMB->req.AndXCommand = 0xFF;
2558         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2559         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2560
2561         if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2562                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2563
2564         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2565             CAP_EXTENDED_SECURITY;
2566         if (ses->capabilities & CAP_UNICODE) {
2567                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2568                 capabilities |= CAP_UNICODE;
2569         }
2570         if (ses->capabilities & CAP_STATUS32) {
2571                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2572                 capabilities |= CAP_STATUS32;
2573         }
2574         if (ses->capabilities & CAP_DFS) {
2575                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2576                 capabilities |= CAP_DFS;
2577         }
2578         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2579
2580         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2581         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2582         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2583         SecurityBlob->MessageType = NtLmNegotiate;
2584         negotiate_flags =
2585             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2586             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2587             NTLMSSP_NEGOTIATE_56 |
2588             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2589         if (sign_CIFS_PDUs)
2590                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2591 /*      if (ntlmv2_support)
2592                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2593         /* setup pointers to domain name and workstation name */
2594         bcc_ptr += SecurityBlobLength;
2595
2596         SecurityBlob->WorkstationName.Buffer = 0;
2597         SecurityBlob->WorkstationName.Length = 0;
2598         SecurityBlob->WorkstationName.MaximumLength = 0;
2599
2600         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2601         along with username on auth request (ie the response to challenge) */
2602         SecurityBlob->DomainName.Buffer = 0;
2603         SecurityBlob->DomainName.Length = 0;
2604         SecurityBlob->DomainName.MaximumLength = 0;
2605         if (ses->capabilities & CAP_UNICODE) {
2606                 if ((long) bcc_ptr % 2) {
2607                         *bcc_ptr = 0;
2608                         bcc_ptr++;
2609                 }
2610
2611                 bytes_returned =
2612                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2613                                   32, nls_codepage);
2614                 bcc_ptr += 2 * bytes_returned;
2615                 bytes_returned =
2616                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2617                                   nls_codepage);
2618                 bcc_ptr += 2 * bytes_returned;
2619                 bcc_ptr += 2;   /* null terminate Linux version */
2620                 bytes_returned =
2621                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2622                                   64, nls_codepage);
2623                 bcc_ptr += 2 * bytes_returned;
2624                 *(bcc_ptr + 1) = 0;
2625                 *(bcc_ptr + 2) = 0;
2626                 bcc_ptr += 2;   /* null terminate network opsys string */
2627                 *(bcc_ptr + 1) = 0;
2628                 *(bcc_ptr + 2) = 0;
2629                 bcc_ptr += 2;   /* null domain */
2630         } else {                /* ASCII */
2631                 strcpy(bcc_ptr, "Linux version ");
2632                 bcc_ptr += strlen("Linux version ");
2633                 strcpy(bcc_ptr, utsname()->release);
2634                 bcc_ptr += strlen(utsname()->release) + 1;
2635                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2636                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2637                 bcc_ptr++;      /* empty domain field */
2638                 *bcc_ptr = 0;
2639         }
2640         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2641         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2642         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2643         smb_buffer->smb_buf_length += count;
2644         pSMB->req.ByteCount = cpu_to_le16(count);
2645
2646         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2647                          &bytes_returned, 1);
2648
2649         if (smb_buffer_response->Status.CifsError ==
2650             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2651                 rc = 0;
2652
2653         if (rc) {
2654 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2655         } else if ((smb_buffer_response->WordCount == 3)
2656                    || (smb_buffer_response->WordCount == 4)) {
2657                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2658                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2659
2660                 if (action & GUEST_LOGIN)
2661                         cFYI(1, (" Guest login"));
2662         /* Do we want to set anything in SesInfo struct when guest login? */
2663
2664                 bcc_ptr = pByteArea(smb_buffer_response);
2665         /* response can have either 3 or 4 word count - Samba sends 3 */
2666
2667                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2668                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2669                         cFYI(1,
2670                              ("Unexpected NTLMSSP message type received %d",
2671                               SecurityBlob2->MessageType));
2672                 } else if (ses) {
2673                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2674                         cFYI(1, ("UID = %d", ses->Suid));
2675                         if ((pSMBr->resp.hdr.WordCount == 3)
2676                             || ((pSMBr->resp.hdr.WordCount == 4)
2677                                 && (blob_len <
2678                                     pSMBr->resp.ByteCount))) {
2679
2680                                 if (pSMBr->resp.hdr.WordCount == 4) {
2681                                         bcc_ptr += blob_len;
2682                                         cFYI(1, ("Security Blob Length %d",
2683                                               blob_len));
2684                                 }
2685
2686                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2687
2688                                 memcpy(ses->server->cryptKey,
2689                                        SecurityBlob2->Challenge,
2690                                        CIFS_CRYPTO_KEY_SIZE);
2691                                 if (SecurityBlob2->NegotiateFlags &
2692                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2693                                         *pNTLMv2_flag = TRUE;
2694
2695                                 if ((SecurityBlob2->NegotiateFlags &
2696                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2697                                         || (sign_CIFS_PDUs > 1))
2698                                                 ses->server->secMode |=
2699                                                         SECMODE_SIGN_REQUIRED;
2700                                 if ((SecurityBlob2->NegotiateFlags &
2701                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2702                                                 ses->server->secMode |=
2703                                                         SECMODE_SIGN_ENABLED;
2704
2705                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2706                                         if ((long) (bcc_ptr) % 2) {
2707                                                 remaining_words =
2708                                                     (BCC(smb_buffer_response)
2709                                                      - 1) / 2;
2710                                          /* Must word align unicode strings */
2711                                                 bcc_ptr++;
2712                                         } else {
2713                                                 remaining_words =
2714                                                     BCC
2715                                                     (smb_buffer_response) / 2;
2716                                         }
2717                                         len =
2718                                             UniStrnlen((wchar_t *) bcc_ptr,
2719                                                        remaining_words - 1);
2720 /* We look for obvious messed up bcc or strings in response so we do not go off
2721    the end since (at least) WIN2K and Windows XP have a major bug in not null
2722    terminating last Unicode string in response  */
2723                                         if (ses->serverOS)
2724                                                 kfree(ses->serverOS);
2725                                         ses->serverOS =
2726                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2727                                         cifs_strfromUCS_le(ses->serverOS,
2728                                                            (__le16 *)
2729                                                            bcc_ptr, len,
2730                                                            nls_codepage);
2731                                         bcc_ptr += 2 * (len + 1);
2732                                         remaining_words -= len + 1;
2733                                         ses->serverOS[2 * len] = 0;
2734                                         ses->serverOS[1 + (2 * len)] = 0;
2735                                         if (remaining_words > 0) {
2736                                                 len = UniStrnlen((wchar_t *)
2737                                                                  bcc_ptr,
2738                                                                  remaining_words
2739                                                                  - 1);
2740                                                 kfree(ses->serverNOS);
2741                                                 ses->serverNOS =
2742                                                     kzalloc(2 * (len + 1),
2743                                                             GFP_KERNEL);
2744                                                 cifs_strfromUCS_le(ses->
2745                                                                    serverNOS,
2746                                                                    (__le16 *)
2747                                                                    bcc_ptr,
2748                                                                    len,
2749                                                                    nls_codepage);
2750                                                 bcc_ptr += 2 * (len + 1);
2751                                                 ses->serverNOS[2 * len] = 0;
2752                                                 ses->serverNOS[1 +
2753                                                                (2 * len)] = 0;
2754                                                 remaining_words -= len + 1;
2755                                                 if (remaining_words > 0) {
2756                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2757                                 /* last string not always null terminated
2758                                    (for e.g. for Windows XP & 2000) */
2759                                                         kfree(ses->serverDomain);
2760                                                         ses->serverDomain =
2761                                                             kzalloc(2 *
2762                                                                     (len +
2763                                                                      1),
2764                                                                     GFP_KERNEL);
2765                                                         cifs_strfromUCS_le
2766                                                             (ses->serverDomain,
2767                                                              (__le16 *)bcc_ptr,
2768                                                              len, nls_codepage);
2769                                                         bcc_ptr +=
2770                                                             2 * (len + 1);
2771                                                         ses->serverDomain[2*len]
2772                                                             = 0;
2773                                                         ses->serverDomain
2774                                                                 [1 + (2 * len)]
2775                                                             = 0;
2776                                                 } /* else no more room so create dummy domain string */
2777                                                 else {
2778                                                         kfree(ses->serverDomain);
2779                                                         ses->serverDomain =
2780                                                             kzalloc(2,
2781                                                                     GFP_KERNEL);
2782                                                 }
2783                                         } else {        /* no room so create dummy domain and NOS string */
2784                                                 kfree(ses->serverDomain);
2785                                                 ses->serverDomain =
2786                                                     kzalloc(2, GFP_KERNEL);
2787                                                 kfree(ses->serverNOS);
2788                                                 ses->serverNOS =
2789                                                     kzalloc(2, GFP_KERNEL);
2790                                         }
2791                                 } else {        /* ASCII */
2792                                         len = strnlen(bcc_ptr, 1024);
2793                                         if (((long) bcc_ptr + len) - (long)
2794                                             pByteArea(smb_buffer_response)
2795                                             <= BCC(smb_buffer_response)) {
2796                                                 if (ses->serverOS)
2797                                                         kfree(ses->serverOS);
2798                                                 ses->serverOS =
2799                                                     kzalloc(len + 1,
2800                                                             GFP_KERNEL);
2801                                                 strncpy(ses->serverOS,
2802                                                         bcc_ptr, len);
2803
2804                                                 bcc_ptr += len;
2805                                                 bcc_ptr[0] = 0; /* null terminate string */
2806                                                 bcc_ptr++;
2807
2808                                                 len = strnlen(bcc_ptr, 1024);
2809                                                 kfree(ses->serverNOS);
2810                                                 ses->serverNOS =
2811                                                     kzalloc(len + 1,
2812                                                             GFP_KERNEL);
2813                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2814                                                 bcc_ptr += len;
2815                                                 bcc_ptr[0] = 0;
2816                                                 bcc_ptr++;
2817
2818                                                 len = strnlen(bcc_ptr, 1024);
2819                                                 kfree(ses->serverDomain);
2820                                                 ses->serverDomain =
2821                                                     kzalloc(len + 1,
2822                                                             GFP_KERNEL);
2823                                                 strncpy(ses->serverDomain,
2824                                                         bcc_ptr, len);
2825                                                 bcc_ptr += len;
2826                                                 bcc_ptr[0] = 0;
2827                                                 bcc_ptr++;
2828                                         } else
2829                                                 cFYI(1,
2830                                                      ("Variable field of length %d extends beyond end of smb",
2831                                                       len));
2832                                 }
2833                         } else {
2834                                 cERROR(1, ("Security Blob Length extends beyond"
2835                                            " end of SMB"));
2836                         }
2837                 } else {
2838                         cERROR(1, ("No session structure passed in."));
2839                 }
2840         } else {
2841                 cERROR(1,
2842                        (" Invalid Word count %d:",
2843                         smb_buffer_response->WordCount));
2844                 rc = -EIO;
2845         }
2846
2847         if (smb_buffer)
2848                 cifs_buf_release(smb_buffer);
2849
2850         return rc;
2851 }
2852 static int
2853 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2854                 char *ntlm_session_key, int ntlmv2_flag,
2855                 const struct nls_table *nls_codepage)
2856 {
2857         struct smb_hdr *smb_buffer;
2858         struct smb_hdr *smb_buffer_response;
2859         SESSION_SETUP_ANDX *pSMB;
2860         SESSION_SETUP_ANDX *pSMBr;
2861         char *bcc_ptr;
2862         char *user;
2863         char *domain;
2864         int rc = 0;
2865         int remaining_words = 0;
2866         int bytes_returned = 0;
2867         int len;
2868         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2869         PAUTHENTICATE_MESSAGE SecurityBlob;
2870         __u32 negotiate_flags, capabilities;
2871         __u16 count;
2872
2873         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2874         if (ses == NULL)
2875                 return -EINVAL;
2876         user = ses->userName;
2877         domain = ses->domainName;
2878         smb_buffer = cifs_buf_get();
2879         if (smb_buffer == NULL) {
2880                 return -ENOMEM;
2881         }
2882         smb_buffer_response = smb_buffer;
2883         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2884         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2885
2886         /* send SMBsessionSetup here */
2887         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2888                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2889
2890         smb_buffer->Mid = GetNextMid(ses->server);
2891         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2892         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2893         pSMB->req.AndXCommand = 0xFF;
2894         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2895         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2896
2897         pSMB->req.hdr.Uid = ses->Suid;
2898
2899         if (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2900                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2901
2902         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2903             CAP_EXTENDED_SECURITY;
2904         if (ses->capabilities & CAP_UNICODE) {
2905                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2906                 capabilities |= CAP_UNICODE;
2907         }
2908         if (ses->capabilities & CAP_STATUS32) {
2909                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2910                 capabilities |= CAP_STATUS32;
2911         }
2912         if (ses->capabilities & CAP_DFS) {
2913                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2914                 capabilities |= CAP_DFS;
2915         }
2916         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2917
2918         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2919         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2920         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2921         SecurityBlob->MessageType = NtLmAuthenticate;
2922         bcc_ptr += SecurityBlobLength;
2923         negotiate_flags =
2924             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2925             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2926             0x80000000 | NTLMSSP_NEGOTIATE_128;
2927         if (sign_CIFS_PDUs)
2928                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2929         if (ntlmv2_flag)
2930                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2931
2932 /* setup pointers to domain name and workstation name */
2933
2934         SecurityBlob->WorkstationName.Buffer = 0;
2935         SecurityBlob->WorkstationName.Length = 0;
2936         SecurityBlob->WorkstationName.MaximumLength = 0;
2937         SecurityBlob->SessionKey.Length = 0;
2938         SecurityBlob->SessionKey.MaximumLength = 0;
2939         SecurityBlob->SessionKey.Buffer = 0;
2940
2941         SecurityBlob->LmChallengeResponse.Length = 0;
2942         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2943         SecurityBlob->LmChallengeResponse.Buffer = 0;
2944
2945         SecurityBlob->NtChallengeResponse.Length =
2946             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2947         SecurityBlob->NtChallengeResponse.MaximumLength =
2948             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2949         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2950         SecurityBlob->NtChallengeResponse.Buffer =
2951             cpu_to_le32(SecurityBlobLength);
2952         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2953         bcc_ptr += CIFS_SESS_KEY_SIZE;
2954
2955         if (ses->capabilities & CAP_UNICODE) {
2956                 if (domain == NULL) {
2957                         SecurityBlob->DomainName.Buffer = 0;
2958                         SecurityBlob->DomainName.Length = 0;
2959                         SecurityBlob->DomainName.MaximumLength = 0;
2960                 } else {
2961                         __u16 len =
2962                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2963                                           nls_codepage);
2964                         len *= 2;
2965                         SecurityBlob->DomainName.MaximumLength =
2966                             cpu_to_le16(len);
2967                         SecurityBlob->DomainName.Buffer =
2968                             cpu_to_le32(SecurityBlobLength);
2969                         bcc_ptr += len;
2970                         SecurityBlobLength += len;
2971                         SecurityBlob->DomainName.Length =
2972                             cpu_to_le16(len);
2973                 }
2974                 if (user == NULL) {
2975                         SecurityBlob->UserName.Buffer = 0;
2976                         SecurityBlob->UserName.Length = 0;
2977                         SecurityBlob->UserName.MaximumLength = 0;
2978                 } else {
2979                         __u16 len =
2980                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2981                                           nls_codepage);
2982                         len *= 2;
2983                         SecurityBlob->UserName.MaximumLength =
2984                             cpu_to_le16(len);
2985                         SecurityBlob->UserName.Buffer =
2986                             cpu_to_le32(SecurityBlobLength);
2987                         bcc_ptr += len;
2988                         SecurityBlobLength += len;
2989                         SecurityBlob->UserName.Length =
2990                             cpu_to_le16(len);
2991                 }
2992
2993                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2994                    SecurityBlob->WorkstationName.Length *= 2;
2995                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2996                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2997                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2998                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2999                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
3000
3001                 if ((long) bcc_ptr % 2) {
3002                         *bcc_ptr = 0;
3003                         bcc_ptr++;
3004                 }
3005                 bytes_returned =
3006                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
3007                                   32, nls_codepage);
3008                 bcc_ptr += 2 * bytes_returned;
3009                 bytes_returned =
3010                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
3011                                   nls_codepage);
3012                 bcc_ptr += 2 * bytes_returned;
3013                 bcc_ptr += 2;   /* null term version string */
3014                 bytes_returned =
3015                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
3016                                   64, nls_codepage);
3017                 bcc_ptr += 2 * bytes_returned;
3018                 *(bcc_ptr + 1) = 0;
3019                 *(bcc_ptr + 2) = 0;
3020                 bcc_ptr += 2;   /* null terminate network opsys string */
3021                 *(bcc_ptr + 1) = 0;
3022                 *(bcc_ptr + 2) = 0;
3023                 bcc_ptr += 2;   /* null domain */
3024         } else {                /* ASCII */
3025                 if (domain == NULL) {
3026                         SecurityBlob->DomainName.Buffer = 0;
3027                         SecurityBlob->DomainName.Length = 0;
3028                         SecurityBlob->DomainName.MaximumLength = 0;
3029                 } else {
3030                         __u16 len;
3031                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
3032                         strncpy(bcc_ptr, domain, 63);
3033                         len = strnlen(domain, 64);
3034                         SecurityBlob->DomainName.MaximumLength =
3035                             cpu_to_le16(len);
3036                         SecurityBlob->DomainName.Buffer =
3037                             cpu_to_le32(SecurityBlobLength);
3038                         bcc_ptr += len;
3039                         SecurityBlobLength += len;
3040                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
3041                 }
3042                 if (user == NULL) {
3043                         SecurityBlob->UserName.Buffer = 0;
3044                         SecurityBlob->UserName.Length = 0;
3045                         SecurityBlob->UserName.MaximumLength = 0;
3046                 } else {
3047                         __u16 len;
3048                         strncpy(bcc_ptr, user, 63);
3049                         len = strnlen(user, 64);
3050                         SecurityBlob->UserName.MaximumLength =
3051                             cpu_to_le16(len);
3052                         SecurityBlob->UserName.Buffer =
3053                             cpu_to_le32(SecurityBlobLength);
3054                         bcc_ptr += len;
3055                         SecurityBlobLength += len;
3056                         SecurityBlob->UserName.Length = cpu_to_le16(len);
3057                 }
3058                 /* BB fill in our workstation name if known BB */
3059
3060                 strcpy(bcc_ptr, "Linux version ");
3061                 bcc_ptr += strlen("Linux version ");
3062                 strcpy(bcc_ptr, utsname()->release);
3063                 bcc_ptr += strlen(utsname()->release) + 1;
3064                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
3065                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
3066                 bcc_ptr++;      /* null domain */
3067                 *bcc_ptr = 0;
3068         }
3069         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
3070         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
3071         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
3072         smb_buffer->smb_buf_length += count;
3073         pSMB->req.ByteCount = cpu_to_le16(count);
3074
3075         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
3076                          &bytes_returned, 1);
3077         if (rc) {
3078 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
3079         } else if ((smb_buffer_response->WordCount == 3)
3080                    || (smb_buffer_response->WordCount == 4)) {
3081                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
3082                 __u16 blob_len =
3083                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
3084                 if (action & GUEST_LOGIN)
3085                         cFYI(1, (" Guest login")); /* BB Should we set anything
3086                                                          in SesInfo struct ? */
3087 /*              if (SecurityBlob2->MessageType != NtLm??) {
3088                         cFYI("Unexpected message type on auth response is %d"));
3089                 } */
3090
3091                 if (ses) {
3092                         cFYI(1,
3093                              ("Check challenge UID %d vs auth response UID %d",
3094                               ses->Suid, smb_buffer_response->Uid));
3095                         /* UID left in wire format */
3096                         ses->Suid = smb_buffer_response->Uid;
3097                         bcc_ptr = pByteArea(smb_buffer_response);
3098                 /* response can have either 3 or 4 word count - Samba sends 3 */
3099                         if ((pSMBr->resp.hdr.WordCount == 3)
3100                             || ((pSMBr->resp.hdr.WordCount == 4)
3101                                 && (blob_len <
3102                                     pSMBr->resp.ByteCount))) {
3103                                 if (pSMBr->resp.hdr.WordCount == 4) {
3104                                         bcc_ptr +=
3105                                             blob_len;
3106                                         cFYI(1,
3107                                              ("Security Blob Length %d ",
3108                                               blob_len));
3109                                 }
3110
3111                                 cFYI(1,
3112                                      ("NTLMSSP response to Authenticate "));
3113
3114                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3115                                         if ((long) (bcc_ptr) % 2) {
3116                                                 remaining_words =
3117                                                     (BCC(smb_buffer_response)
3118                                                      - 1) / 2;
3119                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
3120                                         } else {
3121                                                 remaining_words = BCC(smb_buffer_response) / 2;
3122                                         }
3123                                         len =
3124                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3125 /* We look for obvious messed up bcc or strings in response so we do not go off
3126   the end since (at least) WIN2K and Windows XP have a major bug in not null
3127   terminating last Unicode string in response  */
3128                                         if (ses->serverOS)
3129                                                 kfree(ses->serverOS);
3130                                         ses->serverOS =
3131                                             kzalloc(2 * (len + 1), GFP_KERNEL);
3132                                         cifs_strfromUCS_le(ses->serverOS,
3133                                                            (__le16 *)
3134                                                            bcc_ptr, len,
3135                                                            nls_codepage);
3136                                         bcc_ptr += 2 * (len + 1);
3137                                         remaining_words -= len + 1;
3138                                         ses->serverOS[2 * len] = 0;
3139                                         ses->serverOS[1 + (2 * len)] = 0;
3140                                         if (remaining_words > 0) {
3141                                                 len = UniStrnlen((wchar_t *)
3142                                                                  bcc_ptr,
3143                                                                  remaining_words
3144                                                                  - 1);
3145                                                 kfree(ses->serverNOS);
3146                                                 ses->serverNOS =
3147                                                     kzalloc(2 * (len + 1),
3148                                                             GFP_KERNEL);
3149                                                 cifs_strfromUCS_le(ses->
3150                                                                    serverNOS,
3151                                                                    (__le16 *)
3152                                                                    bcc_ptr,
3153                                                                    len,
3154                                                                    nls_codepage);
3155                                                 bcc_ptr += 2 * (len + 1);
3156                                                 ses->serverNOS[2 * len] = 0;
3157                                                 ses->serverNOS[1+(2*len)] = 0;
3158                                                 remaining_words -= len + 1;
3159                                                 if (remaining_words > 0) {
3160                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3161      /* last string not always null terminated (e.g. for Windows XP & 2000) */
3162                                                         if (ses->serverDomain)
3163                                                                 kfree(ses->serverDomain);
3164                                                         ses->serverDomain =
3165                                                             kzalloc(2 *
3166                                                                     (len +
3167                                                                      1),
3168                                                                     GFP_KERNEL);
3169                                                         cifs_strfromUCS_le
3170                                                             (ses->
3171                                                              serverDomain,
3172                                                              (__le16 *)
3173                                                              bcc_ptr, len,
3174                                                              nls_codepage);
3175                                                         bcc_ptr +=
3176                                                             2 * (len + 1);
3177                                                         ses->
3178                                                             serverDomain[2
3179                                                                          * len]
3180                                                             = 0;
3181                                                         ses->
3182                                                             serverDomain[1
3183                                                                          +
3184                                                                          (2
3185                                                                           *
3186                                                                           len)]
3187                                                             = 0;
3188                                                 } /* else no more room so create dummy domain string */
3189                                                 else {
3190                                                         if (ses->serverDomain)
3191                                                                 kfree(ses->serverDomain);
3192                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3193                                                 }
3194                                         } else {  /* no room so create dummy domain and NOS string */
3195                                                 if (ses->serverDomain)
3196                                                         kfree(ses->serverDomain);
3197                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3198                                                 kfree(ses->serverNOS);
3199                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3200                                         }
3201                                 } else {        /* ASCII */
3202                                         len = strnlen(bcc_ptr, 1024);
3203                                         if (((long) bcc_ptr + len) -
3204                                            (long) pByteArea(smb_buffer_response)
3205                             <= BCC(smb_buffer_response)) {
3206                                                 if (ses->serverOS)
3207                                                         kfree(ses->serverOS);
3208                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3209                                                 strncpy(ses->serverOS,bcc_ptr, len);
3210
3211                                                 bcc_ptr += len;
3212                                                 bcc_ptr[0] = 0; /* null terminate the string */
3213                                                 bcc_ptr++;
3214
3215                                                 len = strnlen(bcc_ptr, 1024);
3216                                                 kfree(ses->serverNOS);
3217                                                 ses->serverNOS = kzalloc(len+1,
3218                                                                     GFP_KERNEL);
3219                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3220                                                 bcc_ptr += len;
3221                                                 bcc_ptr[0] = 0;
3222                                                 bcc_ptr++;
3223
3224                                                 len = strnlen(bcc_ptr, 1024);
3225                                                 if (ses->serverDomain)
3226                                                         kfree(ses->serverDomain);
3227                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3228                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3229                                                 bcc_ptr += len;
3230                                                 bcc_ptr[0] = 0;
3231                                                 bcc_ptr++;
3232                                         } else
3233                                                 cFYI(1,
3234                                                      ("Variable field of length %d extends beyond end of smb ",
3235                                                       len));
3236                                 }
3237                         } else {
3238                                 cERROR(1,
3239                                        (" Security Blob Length extends beyond end of SMB"));
3240                         }
3241                 } else {
3242                         cERROR(1, ("No session structure passed in."));
3243                 }
3244         } else {
3245                 cERROR(1,
3246                        (" Invalid Word count %d: ",
3247                         smb_buffer_response->WordCount));
3248                 rc = -EIO;
3249         }
3250
3251         if (smb_buffer)
3252                 cifs_buf_release(smb_buffer);
3253
3254         return rc;
3255 }
3256
3257 int
3258 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3259          const char *tree, struct cifsTconInfo *tcon,
3260          const struct nls_table *nls_codepage)
3261 {
3262         struct smb_hdr *smb_buffer;
3263         struct smb_hdr *smb_buffer_response;
3264         TCONX_REQ *pSMB;
3265         TCONX_RSP *pSMBr;
3266         unsigned char *bcc_ptr;
3267         int rc = 0;
3268         int length;
3269         __u16 count;
3270
3271         if (ses == NULL)
3272                 return -EIO;
3273
3274         smb_buffer = cifs_buf_get();
3275         if (smb_buffer == NULL) {
3276                 return -ENOMEM;
3277         }
3278         smb_buffer_response = smb_buffer;
3279
3280         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3281                         NULL /*no tid */ , 4 /*wct */ );
3282
3283         smb_buffer->Mid = GetNextMid(ses->server);
3284         smb_buffer->Uid = ses->Suid;
3285         pSMB = (TCONX_REQ *) smb_buffer;
3286         pSMBr = (TCONX_RSP *) smb_buffer_response;
3287
3288         pSMB->AndXCommand = 0xFF;
3289         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3290         bcc_ptr = &pSMB->Password[0];
3291         if ((ses->server->secMode) & SECMODE_USER) {
3292                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3293                 *bcc_ptr = 0; /* password is null byte */
3294                 bcc_ptr++;              /* skip password */
3295                 /* already aligned so no need to do it below */
3296         } else {
3297                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3298                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3299                    specified as required (when that support is added to
3300                    the vfs in the future) as only NTLM or the much
3301                    weaker LANMAN (which we do not send by default) is accepted
3302                    by Samba (not sure whether other servers allow
3303                    NTLMv2 password here) */
3304 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3305                 if ((extended_security & CIFSSEC_MAY_LANMAN) &&
3306                         (ses->server->secType == LANMAN))
3307                         calc_lanman_hash(ses, bcc_ptr);
3308                 else
3309 #endif /* CIFS_WEAK_PW_HASH */
3310                 SMBNTencrypt(ses->password,
3311                              ses->server->cryptKey,
3312                              bcc_ptr);
3313
3314                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3315                 if (ses->capabilities & CAP_UNICODE) {
3316                         /* must align unicode strings */
3317                         *bcc_ptr = 0; /* null byte password */
3318                         bcc_ptr++;
3319                 }
3320         }
3321
3322         if (ses->server->secMode &
3323                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3324                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3325
3326         if (ses->capabilities & CAP_STATUS32) {
3327                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3328         }
3329         if (ses->capabilities & CAP_DFS) {
3330                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3331         }
3332         if (ses->capabilities & CAP_UNICODE) {
3333                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3334                 length =
3335                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3336                         6 /* max utf8 char length in bytes */ *
3337                         (/* server len*/ + 256 /* share len */), nls_codepage);
3338                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3339                 bcc_ptr += 2;   /* skip trailing null */
3340         } else {                /* ASCII */
3341                 strcpy(bcc_ptr, tree);
3342                 bcc_ptr += strlen(tree) + 1;
3343         }
3344         strcpy(bcc_ptr, "?????");
3345         bcc_ptr += strlen("?????");
3346         bcc_ptr += 1;
3347         count = bcc_ptr - &pSMB->Password[0];
3348         pSMB->hdr.smb_buf_length += count;
3349         pSMB->ByteCount = cpu_to_le16(count);
3350
3351         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3352
3353         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3354         /* above now done in SendReceive */
3355         if ((rc == 0) && (tcon != NULL)) {
3356                 tcon->tidStatus = CifsGood;
3357                 tcon->tid = smb_buffer_response->Tid;
3358                 bcc_ptr = pByteArea(smb_buffer_response);
3359                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3360                 /* skip service field (NB: this field is always ASCII) */
3361                 bcc_ptr += length + 1;
3362                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3363                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3364                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3365                         if ((bcc_ptr + (2 * length)) -
3366                              pByteArea(smb_buffer_response) <=
3367                             BCC(smb_buffer_response)) {
3368                                 kfree(tcon->nativeFileSystem);
3369                                 tcon->nativeFileSystem =
3370                                     kzalloc(length + 2, GFP_KERNEL);
3371                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3372                                                    (__le16 *) bcc_ptr,
3373                                                    length, nls_codepage);
3374                                 bcc_ptr += 2 * length;
3375                                 bcc_ptr[0] = 0; /* null terminate the string */
3376                                 bcc_ptr[1] = 0;
3377                                 bcc_ptr += 2;
3378                         }
3379                         /* else do not bother copying these information fields*/
3380                 } else {
3381                         length = strnlen(bcc_ptr, 1024);
3382                         if ((bcc_ptr + length) -
3383                             pByteArea(smb_buffer_response) <=
3384                             BCC(smb_buffer_response)) {
3385                                 kfree(tcon->nativeFileSystem);
3386                                 tcon->nativeFileSystem =
3387                                     kzalloc(length + 1, GFP_KERNEL);
3388                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3389                                         length);
3390                         }
3391                         /* else do not bother copying these information fields*/
3392                 }
3393                 if ((smb_buffer_response->WordCount == 3) ||
3394                          (smb_buffer_response->WordCount == 7))
3395                         /* field is in same location */
3396                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3397                 else
3398                         tcon->Flags = 0;
3399                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3400         } else if ((rc == 0) && tcon == NULL) {
3401                 /* all we need to save for IPC$ connection */
3402                 ses->ipc_tid = smb_buffer_response->Tid;
3403         }
3404
3405         if (smb_buffer)
3406                 cifs_buf_release(smb_buffer);
3407         return rc;
3408 }
3409
3410 int
3411 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3412 {
3413         int rc = 0;
3414         int xid;
3415         struct cifsSesInfo *ses = NULL;
3416         struct task_struct *cifsd_task;
3417         char *tmp;
3418
3419         xid = GetXid();
3420
3421         if (cifs_sb->tcon) {
3422                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3423                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3424                 if (rc == -EBUSY) {
3425                         FreeXid(xid);
3426                         return 0;
3427                 }
3428                 tconInfoFree(cifs_sb->tcon);
3429                 if ((ses) && (ses->server)) {
3430                         /* save off task so we do not refer to ses later */
3431                         cifsd_task = ses->server->tsk;
3432                         cFYI(1, ("About to do SMBLogoff "));
3433                         rc = CIFSSMBLogoff(xid, ses);
3434                         if (rc == -EBUSY) {
3435                                 FreeXid(xid);
3436                                 return 0;
3437                         } else if (rc == -ESHUTDOWN) {
3438                                 cFYI(1, ("Waking up socket by sending signal"));
3439                                 if (cifsd_task) {
3440                                         force_sig(SIGKILL, cifsd_task);
3441                                         kthread_stop(cifsd_task);
3442                                 }
3443                                 rc = 0;
3444                         } /* else - we have an smb session
3445                                 left on this socket do not kill cifsd */
3446                 } else
3447                         cFYI(1, ("No session or bad tcon"));
3448         }
3449
3450         cifs_sb->tcon = NULL;
3451         tmp = cifs_sb->prepath;
3452         cifs_sb->prepathlen = 0;
3453         cifs_sb->prepath = NULL;
3454         kfree(tmp);
3455         if (ses)
3456                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3457         if (ses)
3458                 sesInfoFree(ses);
3459
3460         FreeXid(xid);
3461         return rc;      /* BB check if we should always return zero here */
3462 }
3463
3464 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3465                                            struct nls_table *nls_info)
3466 {
3467         int rc = 0;
3468         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3469         int ntlmv2_flag = FALSE;
3470         int first_time = 0;
3471
3472         /* what if server changes its buffer size after dropping the session? */
3473         if (pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3474                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3475                 if (rc == -EAGAIN) /* retry only once on 1st time connection */ {
3476                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3477                         if (rc == -EAGAIN)
3478                                 rc = -EHOSTDOWN;
3479                 }
3480                 if (rc == 0) {
3481                         spin_lock(&GlobalMid_Lock);
3482                         if (pSesInfo->server->tcpStatus != CifsExiting)
3483                                 pSesInfo->server->tcpStatus = CifsGood;
3484                         else
3485                                 rc = -EHOSTDOWN;
3486                         spin_unlock(&GlobalMid_Lock);
3487
3488                 }
3489                 first_time = 1;
3490         }
3491         if (!rc) {
3492                 pSesInfo->flags = 0;
3493                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3494                 if (linuxExtEnabled == 0)
3495                         pSesInfo->capabilities &= (~CAP_UNIX);
3496         /*      pSesInfo->sequence_number = 0;*/
3497                 cFYI(1,
3498                       ("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3499                         pSesInfo->server->secMode,
3500                         pSesInfo->server->capabilities,
3501                         pSesInfo->server->timeAdj));
3502                 if (experimEnabled < 2)
3503                         rc = CIFS_SessSetup(xid, pSesInfo,
3504                                             first_time, nls_info);
3505                 else if (extended_security
3506                                 && (pSesInfo->capabilities
3507                                         & CAP_EXTENDED_SECURITY)
3508                                 && (pSesInfo->server->secType == NTLMSSP)) {
3509                         rc = -EOPNOTSUPP;
3510                 } else if (extended_security
3511                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3512                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3513                         cFYI(1, ("NTLMSSP sesssetup"));
3514                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3515                                                 pSesInfo,
3516                                                 &ntlmv2_flag,
3517                                                 nls_info);
3518                         if (!rc) {
3519                                 if (ntlmv2_flag) {
3520                                         char *v2_response;
3521                                         cFYI(1, ("more secure NTLM ver2 hash"));
3522                                         if (CalcNTLMv2_partial_mac_key(pSesInfo,
3523                                                 nls_info)) {
3524                                                 rc = -ENOMEM;
3525                                                 goto ss_err_exit;
3526                                         } else
3527                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3528                                         if (v2_response) {
3529                                                 CalcNTLMv2_response(pSesInfo,
3530                                                                    v2_response);
3531                                 /*              if (first_time)
3532                                                   cifs_calculate_ntlmv2_mac_key(
3533                                                    pSesInfo->server->mac_signing_key,
3534                                                    response, ntlm_session_key,*/
3535                                                 kfree(v2_response);
3536                                         /* BB Put dummy sig in SessSetup PDU? */
3537                                         } else {
3538                                                 rc = -ENOMEM;
3539                                                 goto ss_err_exit;
3540                                         }
3541
3542                                 } else {
3543                                         SMBNTencrypt(pSesInfo->password,
3544                                                 pSesInfo->server->cryptKey,
3545                                                 ntlm_session_key);
3546
3547                                         if (first_time)
3548                                                 cifs_calculate_mac_key(
3549                                                         &pSesInfo->server->mac_signing_key,
3550                                                         ntlm_session_key,
3551                                                         pSesInfo->password);
3552                                 }
3553                         /* for better security the weaker lanman hash not sent
3554                            in AuthSessSetup so we no longer calculate it */
3555
3556                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3557                                         pSesInfo,
3558                                         ntlm_session_key,
3559                                         ntlmv2_flag,
3560                                         nls_info);
3561                         }
3562                 } else { /* old style NTLM 0.12 session setup */
3563                         SMBNTencrypt(pSesInfo->password,
3564                                 pSesInfo->server->cryptKey,
3565                                 ntlm_session_key);
3566
3567                         if (first_time)
3568                                 cifs_calculate_mac_key(
3569                                         &pSesInfo->server->mac_signing_key,
3570                                         ntlm_session_key, pSesInfo->password);
3571
3572                         rc = CIFSSessSetup(xid, pSesInfo,
3573                                 ntlm_session_key, nls_info);
3574                 }
3575                 if (rc) {
3576                         cERROR(1, ("Send error in SessSetup = %d", rc));
3577                 } else {
3578                         cFYI(1, ("CIFS Session Established successfully"));
3579                         pSesInfo->status = CifsGood;
3580                 }
3581         }
3582 ss_err_exit:
3583         return rc;
3584 }
3585