fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2006
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/pagevec.h>
  34 #include <linux/freezer.h>
  35 #include <asm/uaccess.h>
  36 #include <asm/processor.h>
  37 #include "cifspdu.h"
  38 #include "cifsglob.h"
  39 #include "cifsproto.h"
  40 #include "cifs_unicode.h"
  41 #include "cifs_debug.h"
  42 #include "cifs_fs_sb.h"
  43 #include "ntlmssp.h"
  44 #include "nterr.h"
  45 #include "rfc1002pdu.h"
  46 #include "cn_cifs.h"
  47
  48 #define CIFS_PORT 445
  49 #define RFC1001_PORT 139
  50
  51 static DECLARE_COMPLETION(cifsd_complete);
  52
  53 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  54                          unsigned char *p24);
  55
  56 extern mempool_t *cifs_req_poolp;
  57
  58 struct smb_vol {
  59         char *username;
  60         char *password;
  61         char *domainname;
  62         char *UNC;
  63         char *UNCip;
  64         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  65         char *iocharset;  /* local code page for mapping to and from Unicode */
  66         char source_rfc1001_name[16]; /* netbios name of client */
  67         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  68         uid_t linux_uid;
  69         gid_t linux_gid;
  70         mode_t file_mode;
  71         mode_t dir_mode;
  72         unsigned secFlg;
  73         unsigned rw:1;
  74         unsigned retry:1;
  75         unsigned intr:1;
  76         unsigned setuids:1;
  77         unsigned noperm:1;
  78         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  79         unsigned cifs_acl:1;
  80         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  81         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  82         unsigned direct_io:1;
  83         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  84         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  85         unsigned sfu_emul:1;
  86         unsigned nullauth:1; /* attempt to authenticate with null user */
  87         unsigned nocase;     /* request case insensitive filenames */
  88         unsigned nobrl;      /* disable sending byte range locks to srv */
  89         unsigned int rsize;
  90         unsigned int wsize;
  91         unsigned int sockopt;
  92         unsigned short int port;
  93         char * prepath;
  94 };
  95
  96 static int ipv4_connect(struct sockaddr_in *psin_server,
  97                         struct socket **csocket,
  98                         char * netb_name,
  99                         char * server_netb_name);
 100 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 101                         struct socket **csocket);
 102
 103
 104         /*
 105          * cifs tcp session reconnection
 106          *
 107          * mark tcp session as reconnecting so temporarily locked
 108          * mark all smb sessions as reconnecting for tcp session
 109          * reconnect tcp session
 110          * wake up waiters on reconnection? - (not needed currently)
 111          */
 112
 113 static int
 114 cifs_reconnect(struct TCP_Server_Info *server)
 115 {
 116         int rc = 0;
 117         struct list_head *tmp;
 118         struct cifsSesInfo *ses;
 119         struct cifsTconInfo *tcon;
 120         struct mid_q_entry * mid_entry;
 121
 122         spin_lock(&GlobalMid_Lock);
 123         if(server->tcpStatus == CifsExiting) {
 124                 /* the demux thread will exit normally
 125                 next time through the loop */
 126                 spin_unlock(&GlobalMid_Lock);
 127                 return rc;
 128         } else
 129                 server->tcpStatus = CifsNeedReconnect;
 130         spin_unlock(&GlobalMid_Lock);
 131         server->maxBuf = 0;
 132
 133         cFYI(1, ("Reconnecting tcp session"));
 134
 135         /* before reconnecting the tcp session, mark the smb session (uid)
 136                 and the tid bad so they are not used until reconnected */
 137         read_lock(&GlobalSMBSeslock);
 138         list_for_each(tmp, &GlobalSMBSessionList) {
 139                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 140                 if (ses->server) {
 141                         if (ses->server == server) {
 142                                 ses->status = CifsNeedReconnect;
 143                                 ses->ipc_tid = 0;
 144                         }
 145                 }
 146                 /* else tcp and smb sessions need reconnection */
 147         }
 148         list_for_each(tmp, &GlobalTreeConnectionList) {
 149                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 150                 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 151                         tcon->tidStatus = CifsNeedReconnect;
 152                 }
 153         }
 154         read_unlock(&GlobalSMBSeslock);
 155         /* do not want to be sending data on a socket we are freeing */
 156         down(&server->tcpSem);
 157         if(server->ssocket) {
 158                 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 159                         server->ssocket->flags));
 160                 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
 161                 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
 162                         server->ssocket->flags));
 163                 sock_release(server->ssocket);
 164                 server->ssocket = NULL;
 165         }
 166
 167         spin_lock(&GlobalMid_Lock);
 168         list_for_each(tmp, &server->pending_mid_q) {
 169                 mid_entry = list_entry(tmp, struct
 170                                         mid_q_entry,
 171                                         qhead);
 172                 if(mid_entry) {
 173                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
 174                                 /* Mark other intransit requests as needing
 175                                    retry so we do not immediately mark the
 176                                    session bad again (ie after we reconnect
 177                                    below) as they timeout too */
 178                                 mid_entry->midState = MID_RETRY_NEEDED;
 179                         }
 180                 }
 181         }
 182         spin_unlock(&GlobalMid_Lock);
 183         up(&server->tcpSem);
 184
 185         while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
 186         {
 187                 try_to_freeze();
 188                 if(server->protocolType == IPV6) {
 189                         rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
 190                 } else {
 191                         rc = ipv4_connect(&server->addr.sockAddr,
 192                                         &server->ssocket,
 193                                         server->workstation_RFC1001_name,
 194                                         server->server_RFC1001_name);
 195                 }
 196                 if(rc) {
 197                         cFYI(1,("reconnect error %d",rc));
 198                         msleep(3000);
 199                 } else {
 200                         atomic_inc(&tcpSesReconnectCount);
 201                         spin_lock(&GlobalMid_Lock);
 202                         if(server->tcpStatus != CifsExiting)
 203                                 server->tcpStatus = CifsGood;
 204                         server->sequence_number = 0;
 205                         spin_unlock(&GlobalMid_Lock);
 206         /*              atomic_set(&server->inFlight,0);*/
 207                         wake_up(&server->response_q);
 208                 }
 209         }
 210         return rc;
 211 }
 212
 213 /*
 214         return codes:
 215                 0       not a transact2, or all data present
 216                 >0      transact2 with that much data missing
 217                 -EINVAL = invalid transact2
 218
 219  */
 220 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
 221 {
 222         struct smb_t2_rsp * pSMBt;
 223         int total_data_size;
 224         int data_in_this_rsp;
 225         int remaining;
 226
 227         if(pSMB->Command != SMB_COM_TRANSACTION2)
 228                 return 0;
 229
 230         /* check for plausible wct, bcc and t2 data and parm sizes */
 231         /* check for parm and data offset going beyond end of smb */
 232         if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 233                 cFYI(1,("invalid transact2 word count"));
 234                 return -EINVAL;
 235         }
 236
 237         pSMBt = (struct smb_t2_rsp *)pSMB;
 238
 239         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 240         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 241
 242         remaining = total_data_size - data_in_this_rsp;
 243
 244         if(remaining == 0)
 245                 return 0;
 246         else if(remaining < 0) {
 247                 cFYI(1,("total data %d smaller than data in frame %d",
 248                         total_data_size, data_in_this_rsp));
 249                 return -EINVAL;
 250         } else {
 251                 cFYI(1,("missing %d bytes from transact2, check next response",
 252                         remaining));
 253                 if(total_data_size > maxBufSize) {
 254                         cERROR(1,("TotalDataSize %d is over maximum buffer %d",
 255                                 total_data_size,maxBufSize));
 256                         return -EINVAL;
 257                 }
 258                 return remaining;
 259         }
 260 }
 261
 262 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
 263 {
 264         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 265         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 266         int total_data_size;
 267         int total_in_buf;
 268         int remaining;
 269         int total_in_buf2;
 270         char * data_area_of_target;
 271         char * data_area_of_buf2;
 272         __u16 byte_count;
 273
 274         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 275
 276         if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 277                 cFYI(1,("total data sizes of primary and secondary t2 differ"));
 278         }
 279
 280         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 281
 282         remaining = total_data_size - total_in_buf;
 283
 284         if(remaining < 0)
 285                 return -EINVAL;
 286
 287         if(remaining == 0) /* nothing to do, ignore */
 288                 return 0;
 289
 290         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 291         if(remaining < total_in_buf2) {
 292                 cFYI(1,("transact2 2nd response contains too much data"));
 293         }
 294
 295         /* find end of first SMB data area */
 296         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 297                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 298         /* validate target area */
 299
 300         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 301                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 302
 303         data_area_of_target += total_in_buf;
 304
 305         /* copy second buffer into end of first buffer */
 306         memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
 307         total_in_buf += total_in_buf2;
 308         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 309         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 310         byte_count += total_in_buf2;
 311         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 312
 313         byte_count = pTargetSMB->smb_buf_length;
 314         byte_count += total_in_buf2;
 315
 316         /* BB also add check that we are not beyond maximum buffer size */
 317
 318         pTargetSMB->smb_buf_length = byte_count;
 319
 320         if(remaining == total_in_buf2) {
 321                 cFYI(1,("found the last secondary response"));
 322                 return 0; /* we are done */
 323         } else /* more responses to go */
 324                 return 1;
 325
 326 }
 327
 328 static int
 329 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 330 {
 331         int length;
 332         unsigned int pdu_length, total_read;
 333         struct smb_hdr *smb_buffer = NULL;
 334         struct smb_hdr *bigbuf = NULL;
 335         struct smb_hdr *smallbuf = NULL;
 336         struct msghdr smb_msg;
 337         struct kvec iov;
 338         struct socket *csocket = server->ssocket;
 339         struct list_head *tmp;
 340         struct cifsSesInfo *ses;
 341         struct task_struct *task_to_wake = NULL;
 342         struct mid_q_entry *mid_entry;
 343         char temp;
 344         int isLargeBuf = FALSE;
 345         int isMultiRsp;
 346         int reconnect;
 347
 348         daemonize("cifsd");
 349         allow_signal(SIGKILL);
 350         current->flags |= PF_MEMALLOC;
 351         server->tsk = current;  /* save process info to wake at shutdown */
 352         cFYI(1, ("Demultiplex PID: %d", current->pid));
 353         write_lock(&GlobalSMBSeslock);
 354         atomic_inc(&tcpSesAllocCount);
 355         length = tcpSesAllocCount.counter;
 356         write_unlock(&GlobalSMBSeslock);
 357         complete(&cifsd_complete);
 358         if(length  > 1) {
 359                 mempool_resize(cifs_req_poolp,
 360                         length + cifs_min_rcv,
 361                         GFP_KERNEL);
 362         }
 363
 364         while (server->tcpStatus != CifsExiting) {
 365                 if (try_to_freeze())
 366                         continue;
 367                 if (bigbuf == NULL) {
 368                         bigbuf = cifs_buf_get();
 369                         if (!bigbuf) {
 370                                 cERROR(1, ("No memory for large SMB response"));
 371                                 msleep(3000);
 372                                 /* retry will check if exiting */
 373                                 continue;
 374                         }
 375                 } else if (isLargeBuf) {
 376                         /* we are reusing a dirty large buf, clear its start */
 377                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 378                 }
 379
 380                 if (smallbuf == NULL) {
 381                         smallbuf = cifs_small_buf_get();
 382                         if (!smallbuf) {
 383                                 cERROR(1, ("No memory for SMB response"));
 384                                 msleep(1000);
 385                                 /* retry will check if exiting */
 386                                 continue;
 387                         }
 388                         /* beginning of smb buffer is cleared in our buf_get */
 389                 } else /* if existing small buf clear beginning */
 390                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 391
 392                 isLargeBuf = FALSE;
 393                 isMultiRsp = FALSE;
 394                 smb_buffer = smallbuf;
 395                 iov.iov_base = smb_buffer;
 396                 iov.iov_len = 4;
 397                 smb_msg.msg_control = NULL;
 398                 smb_msg.msg_controllen = 0;
 399                 length =
 400                     kernel_recvmsg(csocket, &smb_msg,
 401                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 402
 403                 if (server->tcpStatus == CifsExiting) {
 404                         break;
 405                 } else if (server->tcpStatus == CifsNeedReconnect) {
 406                         cFYI(1, ("Reconnect after server stopped responding"));
 407                         cifs_reconnect(server);
 408                         cFYI(1, ("call to reconnect done"));
 409                         csocket = server->ssocket;
 410                         continue;
 411                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 412                         msleep(1); /* minimum sleep to prevent looping
 413                                 allowing socket to clear and app threads to set
 414                                 tcpStatus CifsNeedReconnect if server hung */
 415                         continue;
 416                 } else if (length <= 0) {
 417                         if (server->tcpStatus == CifsNew) {
 418                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 419                                 /* some servers kill the TCP session rather than
 420                                    returning an SMB negprot error, in which
 421                                    case reconnecting here is not going to help,
 422                                    and so simply return error to mount */
 423                                 break;
 424                         }
 425                         if (!try_to_freeze() && (length == -EINTR)) {
 426                                 cFYI(1,("cifsd thread killed"));
 427                                 break;
 428                         }
 429                         cFYI(1,("Reconnect after unexpected peek error %d",
 430                                 length));
 431                         cifs_reconnect(server);
 432                         csocket = server->ssocket;
 433                         wake_up(&server->response_q);
 434                         continue;
 435                 } else if (length < 4) {
 436                         cFYI(1,
 437                             ("Frame under four bytes received (%d bytes long)",
 438                               length));
 439                         cifs_reconnect(server);
 440                         csocket = server->ssocket;
 441                         wake_up(&server->response_q);
 442                         continue;
 443                 }
 444
 445                 /* The right amount was read from socket - 4 bytes */
 446                 /* so we can now interpret the length field */
 447
 448                 /* the first byte big endian of the length field,
 449                 is actually not part of the length but the type
 450                 with the most common, zero, as regular data */
 451                 temp = *((char *) smb_buffer);
 452
 453                 /* Note that FC 1001 length is big endian on the wire,
 454                 but we convert it here so it is always manipulated
 455                 as host byte order */
 456                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 457                 smb_buffer->smb_buf_length = pdu_length;
 458
 459                 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
 460
 461                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 462                         continue;
 463                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 464                         cFYI(1,("Good RFC 1002 session rsp"));
 465                         continue;
 466                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 467                         /* we get this from Windows 98 instead of
 468                            an error on SMB negprot response */
 469                         cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
 470                                 pdu_length));
 471                         if(server->tcpStatus == CifsNew) {
 472                                 /* if nack on negprot (rather than
 473                                 ret of smb negprot error) reconnecting
 474                                 not going to help, ret error to mount */
 475                                 break;
 476                         } else {
 477                                 /* give server a second to
 478                                 clean up before reconnect attempt */
 479                                 msleep(1000);
 480                                 /* always try 445 first on reconnect
 481                                 since we get NACK on some if we ever
 482                                 connected to port 139 (the NACK is
 483                                 since we do not begin with RFC1001
 484                                 session initialize frame) */
 485                                 server->addr.sockAddr.sin_port =
 486                                         htons(CIFS_PORT);
 487                                 cifs_reconnect(server);
 488                                 csocket = server->ssocket;
 489                                 wake_up(&server->response_q);
 490                                 continue;
 491                         }
 492                 } else if (temp != (char) 0) {
 493                         cERROR(1,("Unknown RFC 1002 frame"));
 494                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 495                                       length);
 496                         cifs_reconnect(server);
 497                         csocket = server->ssocket;
 498                         continue;
 499                 }
 500
 501                 /* else we have an SMB response */
 502                 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 503                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 504                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 505                                         length, pdu_length+4));
 506                         cifs_reconnect(server);
 507                         csocket = server->ssocket;
 508                         wake_up(&server->response_q);
 509                         continue;
 510                 }
 511
 512                 /* else length ok */
 513                 reconnect = 0;
 514
 515                 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 516                         isLargeBuf = TRUE;
 517                         memcpy(bigbuf, smallbuf, 4);
 518                         smb_buffer = bigbuf;
 519                 }
 520                 length = 0;
 521                 iov.iov_base = 4 + (char *)smb_buffer;
 522                 iov.iov_len = pdu_length;
 523                 for (total_read = 0; total_read < pdu_length;
 524                      total_read += length) {
 525                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 526                                                 pdu_length - total_read, 0);
 527                         if((server->tcpStatus == CifsExiting) ||
 528                             (length == -EINTR)) {
 529                                 /* then will exit */
 530                                 reconnect = 2;
 531                                 break;
 532                         } else if (server->tcpStatus == CifsNeedReconnect) {
 533                                 cifs_reconnect(server);
 534                                 csocket = server->ssocket;
 535                                 /* Reconnect wakes up rspns q */
 536                                 /* Now we will reread sock */
 537                                 reconnect = 1;
 538                                 break;
 539                         } else if ((length == -ERESTARTSYS) ||
 540                                    (length == -EAGAIN)) {
 541                                 msleep(1); /* minimum sleep to prevent looping,
 542                                               allowing socket to clear and app
 543                                               threads to set tcpStatus
 544                                               CifsNeedReconnect if server hung*/
 545                                 continue;
 546                         } else if (length <= 0) {
 547                                 cERROR(1,("Received no data, expecting %d",
 548                                               pdu_length - total_read));
 549                                 cifs_reconnect(server);
 550                                 csocket = server->ssocket;
 551                                 reconnect = 1;
 552                                 break;
 553                         }
 554                 }
 555                 if(reconnect == 2)
 556                         break;
 557                 else if(reconnect == 1)
 558                         continue;
 559
 560                 length += 4; /* account for rfc1002 hdr */
 561
 562
 563                 dump_smb(smb_buffer, length);
 564                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 565                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 566                         continue;
 567                 }
 568
 569
 570                 task_to_wake = NULL;
 571                 spin_lock(&GlobalMid_Lock);
 572                 list_for_each(tmp, &server->pending_mid_q) {
 573                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 574
 575                         if ((mid_entry->mid == smb_buffer->Mid) &&
 576                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 577                             (mid_entry->command == smb_buffer->Command)) {
 578                                 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
 579                                         /* We have a multipart transact2 resp */
 580                                         isMultiRsp = TRUE;
 581                                         if(mid_entry->resp_buf) {
 582                                                 /* merge response - fix up 1st*/
 583                                                 if(coalesce_t2(smb_buffer,
 584                                                         mid_entry->resp_buf)) {
 585                                                         mid_entry->multiRsp = 1;
 586                                                         break;
 587                                                 } else {
 588                                                         /* all parts received */
 589                                                         mid_entry->multiEnd = 1;
 590                                                         goto multi_t2_fnd;
 591                                                 }
 592                                         } else {
 593                                                 if(!isLargeBuf) {
 594                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 595                                         /* BB maybe we can fix this up,  switch
 596                                            to already allocated large buffer? */
 597                                                 } else {
 598                                                         /* Have first buffer */
 599                                                         mid_entry->resp_buf =
 600                                                                  smb_buffer;
 601                                                         mid_entry->largeBuf = 1;
 602                                                         bigbuf = NULL;
 603                                                 }
 604                                         }
 605                                         break;
 606                                 }
 607                                 mid_entry->resp_buf = smb_buffer;
 608                                 if(isLargeBuf)
 609                                         mid_entry->largeBuf = 1;
 610                                 else
 611                                         mid_entry->largeBuf = 0;
 612 multi_t2_fnd:
 613                                 task_to_wake = mid_entry->tsk;
 614                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 615 #ifdef CONFIG_CIFS_STATS2
 616                                 mid_entry->when_received = jiffies;
 617 #endif
 618                                 /* so we do not time out requests to  server
 619                                 which is still responding (since server could
 620                                 be busy but not dead) */
 621                                 server->lstrp = jiffies;
 622                                 break;
 623                         }
 624                 }
 625                 spin_unlock(&GlobalMid_Lock);
 626                 if (task_to_wake) {
 627                         /* Was previous buf put in mpx struct for multi-rsp? */
 628                         if(!isMultiRsp) {
 629                                 /* smb buffer will be freed by user thread */
 630                                 if(isLargeBuf) {
 631                                         bigbuf = NULL;
 632                                 } else
 633                                         smallbuf = NULL;
 634                         }
 635                         wake_up_process(task_to_wake);
 636                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 637                     && (isMultiRsp == FALSE)) {
 638                         cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
 639                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
 640                                       sizeof(struct smb_hdr));
 641 #ifdef CONFIG_CIFS_DEBUG2
 642                         cifs_dump_detail(smb_buffer);
 643                         cifs_dump_mids(server);
 644 #endif /* CIFS_DEBUG2 */
 645
 646                 }
 647         } /* end while !EXITING */
 648
 649         spin_lock(&GlobalMid_Lock);
 650         server->tcpStatus = CifsExiting;
 651         server->tsk = NULL;
 652         /* check if we have blocked requests that need to free */
 653         /* Note that cifs_max_pending is normally 50, but
 654         can be set at module install time to as little as two */
 655         if(atomic_read(&server->inFlight) >= cifs_max_pending)
 656                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 657         /* We do not want to set the max_pending too low or we
 658         could end up with the counter going negative */
 659         spin_unlock(&GlobalMid_Lock);
 660         /* Although there should not be any requests blocked on
 661         this queue it can not hurt to be paranoid and try to wake up requests
 662         that may haven been blocked when more than 50 at time were on the wire
 663         to the same server - they now will see the session is in exit state
 664         and get out of SendReceive.  */
 665         wake_up_all(&server->request_q);
 666         /* give those requests time to exit */
 667         msleep(125);
 668
 669         if(server->ssocket) {
 670                 sock_release(csocket);
 671                 server->ssocket = NULL;
 672         }
 673         /* buffer usuallly freed in free_mid - need to free it here on exit */
 674         if (bigbuf != NULL)
 675                 cifs_buf_release(bigbuf);
 676         if (smallbuf != NULL)
 677                 cifs_small_buf_release(smallbuf);
 678
 679         read_lock(&GlobalSMBSeslock);
 680         if (list_empty(&server->pending_mid_q)) {
 681                 /* loop through server session structures attached to this and
 682                     mark them dead */
 683                 list_for_each(tmp, &GlobalSMBSessionList) {
 684                         ses =
 685                             list_entry(tmp, struct cifsSesInfo,
 686                                        cifsSessionList);
 687                         if (ses->server == server) {
 688                                 ses->status = CifsExiting;
 689                                 ses->server = NULL;
 690                         }
 691                 }
 692                 read_unlock(&GlobalSMBSeslock);
 693         } else {
 694                 /* although we can not zero the server struct pointer yet,
 695                 since there are active requests which may depnd on them,
 696                 mark the corresponding SMB sessions as exiting too */
 697                 list_for_each(tmp, &GlobalSMBSessionList) {
 698                         ses = list_entry(tmp, struct cifsSesInfo,
 699                                          cifsSessionList);
 700                         if (ses->server == server) {
 701                                 ses->status = CifsExiting;
 702                         }
 703                 }
 704
 705                 spin_lock(&GlobalMid_Lock);
 706                 list_for_each(tmp, &server->pending_mid_q) {
 707                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 708                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 709                                 cFYI(1,
 710                                   ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
 711                                 task_to_wake = mid_entry->tsk;
 712                                 if(task_to_wake) {
 713                                         wake_up_process(task_to_wake);
 714                                 }
 715                         }
 716                 }
 717                 spin_unlock(&GlobalMid_Lock);
 718                 read_unlock(&GlobalSMBSeslock);
 719                 /* 1/8th of sec is more than enough time for them to exit */
 720                 msleep(125);
 721         }
 722
 723         if (!list_empty(&server->pending_mid_q)) {
 724                 /* mpx threads have not exited yet give them
 725                 at least the smb send timeout time for long ops */
 726                 /* due to delays on oplock break requests, we need
 727                 to wait at least 45 seconds before giving up
 728                 on a request getting a response and going ahead
 729                 and killing cifsd */
 730                 cFYI(1, ("Wait for exit from demultiplex thread"));
 731                 msleep(46000);
 732                 /* if threads still have not exited they are probably never
 733                 coming home not much else we can do but free the memory */
 734         }
 735
 736         write_lock(&GlobalSMBSeslock);
 737         atomic_dec(&tcpSesAllocCount);
 738         length = tcpSesAllocCount.counter;
 739
 740         /* last chance to mark ses pointers invalid
 741         if there are any pointing to this (e.g
 742         if a crazy root user tried to kill cifsd
 743         kernel thread explicitly this might happen) */
 744         list_for_each(tmp, &GlobalSMBSessionList) {
 745                 ses = list_entry(tmp, struct cifsSesInfo,
 746                                 cifsSessionList);
 747                 if (ses->server == server) {
 748                         ses->server = NULL;
 749                 }
 750         }
 751         write_unlock(&GlobalSMBSeslock);
 752
 753         kfree(server);
 754         if(length  > 0) {
 755                 mempool_resize(cifs_req_poolp,
 756                         length + cifs_min_rcv,
 757                         GFP_KERNEL);
 758         }
 759
 760         complete_and_exit(&cifsd_complete, 0);
 761         return 0;
 762 }
 763
 764 static int
 765 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 766 {
 767         char *value;
 768         char *data;
 769         unsigned int  temp_len, i, j;
 770         char separator[2];
 771
 772         separator[0] = ',';
 773         separator[1] = 0;
 774
 775         if (Local_System_Name[0] != 0)
 776                 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
 777         else {
 778                 char *nodename = utsname()->nodename;
 779                 int n = strnlen(nodename,15);
 780                 memset(vol->source_rfc1001_name,0x20,15);
 781                 for(i=0 ; i < n ; i++) {
 782                         /* does not have to be perfect mapping since field is
 783                         informational, only used for servers that do not support
 784                         port 445 and it can be overridden at mount time */
 785                         vol->source_rfc1001_name[i] = toupper(nodename[i]);
 786                 }
 787         }
 788         vol->source_rfc1001_name[15] = 0;
 789         /* null target name indicates to use *SMBSERVR default called name
 790            if we end up sending RFC1001 session initialize */
 791         vol->target_rfc1001_name[0] = 0;
 792         vol->linux_uid = current->uid;  /* current->euid instead? */
 793         vol->linux_gid = current->gid;
 794         vol->dir_mode = S_IRWXUGO;
 795         /* 2767 perms indicate mandatory locking support */
 796         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 797
 798         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 799         vol->rw = TRUE;
 800         /* default is always to request posix paths. */
 801         vol->posix_paths = 1;
 802
 803         if (!options)
 804                 return 1;
 805
 806         if(strncmp(options,"sep=",4) == 0) {
 807                 if(options[4] != 0) {
 808                         separator[0] = options[4];
 809                         options += 5;
 810                 } else {
 811                         cFYI(1,("Null separator not allowed"));
 812                 }
 813         }
 814
 815         while ((data = strsep(&options, separator)) != NULL) {
 816                 if (!*data)
 817                         continue;
 818                 if ((value = strchr(data, '=')) != NULL)
 819                         *value++ = '\0';
 820
 821                 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
 822                         vol->no_xattr = 0;
 823                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
 824                         vol->no_xattr = 1;
 825                 } else if (strnicmp(data, "user", 4) == 0) {
 826                         if (!value) {
 827                                 printk(KERN_WARNING
 828                                        "CIFS: invalid or missing username\n");
 829                                 return 1;       /* needs_arg; */
 830                         } else if(!*value) {
 831                                 /* null user, ie anonymous, authentication */
 832                                 vol->nullauth = 1;
 833                         }
 834                         if (strnlen(value, 200) < 200) {
 835                                 vol->username = value;
 836                         } else {
 837                                 printk(KERN_WARNING "CIFS: username too long\n");
 838                                 return 1;
 839                         }
 840                 } else if (strnicmp(data, "pass", 4) == 0) {
 841                         if (!value) {
 842                                 vol->password = NULL;
 843                                 continue;
 844                         } else if(value[0] == 0) {
 845                                 /* check if string begins with double comma
 846                                    since that would mean the password really
 847                                    does start with a comma, and would not
 848                                    indicate an empty string */
 849                                 if(value[1] != separator[0]) {
 850                                         vol->password = NULL;
 851                                         continue;
 852                                 }
 853                         }
 854                         temp_len = strlen(value);
 855                         /* removed password length check, NTLM passwords
 856                                 can be arbitrarily long */
 857
 858                         /* if comma in password, the string will be
 859                         prematurely null terminated.  Commas in password are
 860                         specified across the cifs mount interface by a double
 861                         comma ie ,, and a comma used as in other cases ie ','
 862                         as a parameter delimiter/separator is single and due
 863                         to the strsep above is temporarily zeroed. */
 864
 865                         /* NB: password legally can have multiple commas and
 866                         the only illegal character in a password is null */
 867
 868                         if ((value[temp_len] == 0) &&
 869                             (value[temp_len+1] == separator[0])) {
 870                                 /* reinsert comma */
 871                                 value[temp_len] = separator[0];
 872                                 temp_len+=2;  /* move after the second comma */
 873                                 while(value[temp_len] != 0)  {
 874                                         if (value[temp_len] == separator[0]) {
 875                                                 if (value[temp_len+1] ==
 876                                                      separator[0]) {
 877                                                 /* skip second comma */
 878                                                         temp_len++;
 879                                                 } else {
 880                                                 /* single comma indicating start
 881                                                          of next parm */
 882                                                         break;
 883                                                 }
 884                                         }
 885                                         temp_len++;
 886                                 }
 887                                 if(value[temp_len] == 0) {
 888                                         options = NULL;
 889                                 } else {
 890                                         value[temp_len] = 0;
 891                                         /* point option to start of next parm */
 892                                         options = value + temp_len + 1;
 893                                 }
 894                                 /* go from value to value + temp_len condensing
 895                                 double commas to singles. Note that this ends up
 896                                 allocating a few bytes too many, which is ok */
 897                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 898                                 if(vol->password == NULL) {
 899                                         printk("CIFS: no memory for pass\n");
 900                                         return 1;
 901                                 }
 902                                 for(i=0,j=0;i<temp_len;i++,j++) {
 903                                         vol->password[j] = value[i];
 904                                         if(value[i] == separator[0]
 905                                                 && value[i+1] == separator[0]) {
 906                                                 /* skip second comma */
 907                                                 i++;
 908                                         }
 909                                 }
 910                                 vol->password[j] = 0;
 911                         } else {
 912                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 913                                 if(vol->password == NULL) {
 914                                         printk("CIFS: no memory for pass\n");
 915                                         return 1;
 916                                 }
 917                                 strcpy(vol->password, value);
 918                         }
 919                 } else if (strnicmp(data, "ip", 2) == 0) {
 920                         if (!value || !*value) {
 921                                 vol->UNCip = NULL;
 922                         } else if (strnlen(value, 35) < 35) {
 923                                 vol->UNCip = value;
 924                         } else {
 925                                 printk(KERN_WARNING "CIFS: ip address too long\n");
 926                                 return 1;
 927                         }
 928                 } else if (strnicmp(data, "sec", 3) == 0) {
 929                         if (!value || !*value) {
 930                                 cERROR(1,("no security value specified"));
 931                                 continue;
 932                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 933                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 934                                         CIFSSEC_MUST_SIGN;
 935                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 936                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 937                                         CIFSSEC_MAY_KRB5; */
 938                                 cERROR(1,("Krb5 cifs privacy not supported"));
 939                                 return 1;
 940                         } else if (strnicmp(value, "krb5", 4) == 0) {
 941                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 942                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 943                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 944                                         CIFSSEC_MUST_SIGN;
 945                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 946                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 947                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 948                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 949                                         CIFSSEC_MUST_SIGN;
 950                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 951                                 /* ntlm is default so can be turned off too */
 952                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 953                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 954                                 /* BB is there a better way to do this? */
 955                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 956 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 957                         } else if (strnicmp(value, "lanman", 6) == 0) {
 958                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 959 #endif
 960                         } else if (strnicmp(value, "none", 4) == 0) {
 961                                 vol->nullauth = 1;
 962                         } else {
 963                                 cERROR(1,("bad security option: %s", value));
 964                                 return 1;
 965                         }
 966                 } else if ((strnicmp(data, "unc", 3) == 0)
 967                            || (strnicmp(data, "target", 6) == 0)
 968                            || (strnicmp(data, "path", 4) == 0)) {
 969                         if (!value || !*value) {
 970                                 printk(KERN_WARNING
 971                                        "CIFS: invalid path to network resource\n");
 972                                 return 1;       /* needs_arg; */
 973                         }
 974                         if ((temp_len = strnlen(value, 300)) < 300) {
 975                                 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
 976                                 if(vol->UNC == NULL)
 977                                         return 1;
 978                                 strcpy(vol->UNC,value);
 979                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 980                                         vol->UNC[0] = '\\';
 981                                         vol->UNC[1] = '\\';
 982                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 983                                         printk(KERN_WARNING
 984                                                "CIFS: UNC Path does not begin with // or \\\\ \n");
 985                                         return 1;
 986                                 }
 987                         } else {
 988                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 989                                 return 1;
 990                         }
 991                 } else if ((strnicmp(data, "domain", 3) == 0)
 992                            || (strnicmp(data, "workgroup", 5) == 0)) {
 993                         if (!value || !*value) {
 994                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
 995                                 return 1;       /* needs_arg; */
 996                         }
 997                         /* BB are there cases in which a comma can be valid in
 998                         a domain name and need special handling? */
 999                         if (strnlen(value, 256) < 256) {
1000                                 vol->domainname = value;
1001                                 cFYI(1, ("Domain name set"));
1002                         } else {
1003                                 printk(KERN_WARNING "CIFS: domain name too long\n");
1004                                 return 1;
1005                         }
1006                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1007                         if (!value || !*value) {
1008                                 printk(KERN_WARNING
1009                                        "CIFS: invalid path prefix\n");
1010                                 return 1;       /* needs_arg; */
1011                         }
1012                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1013                                 if(value[0] != '/')
1014                                         temp_len++;  /* missing leading slash */
1015                                 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1016                                 if(vol->prepath == NULL)
1017                                         return 1;
1018                                 if(value[0] != '/') {
1019                                         vol->prepath[0] = '/';
1020                                         strcpy(vol->prepath+1,value);
1021                                 } else
1022                                         strcpy(vol->prepath,value);
1023                                 cFYI(1,("prefix path %s",vol->prepath));
1024                         } else {
1025                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1026                                 return 1;
1027                         }
1028                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1029                         if (!value || !*value) {
1030                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1031                                 return 1;       /* needs_arg; */
1032                         }
1033                         if (strnlen(value, 65) < 65) {
1034                                 if(strnicmp(value,"default",7))
1035                                         vol->iocharset = value;
1036                                 /* if iocharset not set load_nls_default used by caller */
1037                                 cFYI(1, ("iocharset set to %s",value));
1038                         } else {
1039                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1040                                 return 1;
1041                         }
1042                 } else if (strnicmp(data, "uid", 3) == 0) {
1043                         if (value && *value) {
1044                                 vol->linux_uid =
1045                                         simple_strtoul(value, &value, 0);
1046                         }
1047                 } else if (strnicmp(data, "gid", 3) == 0) {
1048                         if (value && *value) {
1049                                 vol->linux_gid =
1050                                         simple_strtoul(value, &value, 0);
1051                         }
1052                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1053                         if (value && *value) {
1054                                 vol->file_mode =
1055                                         simple_strtoul(value, &value, 0);
1056                         }
1057                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1058                         if (value && *value) {
1059                                 vol->dir_mode =
1060                                         simple_strtoul(value, &value, 0);
1061                         }
1062                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1063                         if (value && *value) {
1064                                 vol->dir_mode =
1065                                         simple_strtoul(value, &value, 0);
1066                         }
1067                 } else if (strnicmp(data, "port", 4) == 0) {
1068                         if (value && *value) {
1069                                 vol->port =
1070                                         simple_strtoul(value, &value, 0);
1071                         }
1072                 } else if (strnicmp(data, "rsize", 5) == 0) {
1073                         if (value && *value) {
1074                                 vol->rsize =
1075                                         simple_strtoul(value, &value, 0);
1076                         }
1077                 } else if (strnicmp(data, "wsize", 5) == 0) {
1078                         if (value && *value) {
1079                                 vol->wsize =
1080                                         simple_strtoul(value, &value, 0);
1081                         }
1082                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1083                         if (value && *value) {
1084                                 vol->sockopt =
1085                                         simple_strtoul(value, &value, 0);
1086                         }
1087                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1088                         if (!value || !*value || (*value == ' ')) {
1089                                 cFYI(1,("invalid (empty) netbiosname specified"));
1090                         } else {
1091                                 memset(vol->source_rfc1001_name,0x20,15);
1092                                 for(i=0;i<15;i++) {
1093                                 /* BB are there cases in which a comma can be
1094                                 valid in this workstation netbios name (and need
1095                                 special handling)? */
1096
1097                                 /* We do not uppercase netbiosname for user */
1098                                         if (value[i]==0)
1099                                                 break;
1100                                         else
1101                                                 vol->source_rfc1001_name[i] = value[i];
1102                                 }
1103                                 /* The string has 16th byte zero still from
1104                                 set at top of the function  */
1105                                 if((i==15) && (value[i] != 0))
1106                                         printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1107                         }
1108                 } else if (strnicmp(data, "servern", 7) == 0) {
1109                         /* servernetbiosname specified override *SMBSERVER */
1110                         if (!value || !*value || (*value == ' ')) {
1111                                 cFYI(1,("empty server netbiosname specified"));
1112                         } else {
1113                                 /* last byte, type, is 0x20 for servr type */
1114                                 memset(vol->target_rfc1001_name,0x20,16);
1115
1116                                 for(i=0;i<15;i++) {
1117                                 /* BB are there cases in which a comma can be
1118                                    valid in this workstation netbios name (and need
1119                                    special handling)? */
1120
1121                                 /* user or mount helper must uppercase netbiosname */
1122                                         if (value[i]==0)
1123                                                 break;
1124                                         else
1125                                                 vol->target_rfc1001_name[i] = value[i];
1126                                 }
1127                                 /* The string has 16th byte zero still from
1128                                    set at top of the function  */
1129                                 if((i==15) && (value[i] != 0))
1130                                         printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1131                         }
1132                 } else if (strnicmp(data, "credentials", 4) == 0) {
1133                         /* ignore */
1134                 } else if (strnicmp(data, "version", 3) == 0) {
1135                         /* ignore */
1136                 } else if (strnicmp(data, "guest",5) == 0) {
1137                         /* ignore */
1138                 } else if (strnicmp(data, "rw", 2) == 0) {
1139                         vol->rw = TRUE;
1140                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1141                                    (strnicmp(data, "nosuid", 6) == 0) ||
1142                                    (strnicmp(data, "exec", 4) == 0) ||
1143                                    (strnicmp(data, "noexec", 6) == 0) ||
1144                                    (strnicmp(data, "nodev", 5) == 0) ||
1145                                    (strnicmp(data, "noauto", 6) == 0) ||
1146                                    (strnicmp(data, "dev", 3) == 0)) {
1147                         /*  The mount tool or mount.cifs helper (if present)
1148                                 uses these opts to set flags, and the flags are read
1149                                 by the kernel vfs layer before we get here (ie
1150                                 before read super) so there is no point trying to
1151                                 parse these options again and set anything and it
1152                                 is ok to just ignore them */
1153                         continue;
1154                 } else if (strnicmp(data, "ro", 2) == 0) {
1155                         vol->rw = FALSE;
1156                 } else if (strnicmp(data, "hard", 4) == 0) {
1157                         vol->retry = 1;
1158                 } else if (strnicmp(data, "soft", 4) == 0) {
1159                         vol->retry = 0;
1160                 } else if (strnicmp(data, "perm", 4) == 0) {
1161                         vol->noperm = 0;
1162                 } else if (strnicmp(data, "noperm", 6) == 0) {
1163                         vol->noperm = 1;
1164                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1165                         vol->remap = 1;
1166                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1167                         vol->remap = 0;
1168                 } else if (strnicmp(data, "sfu", 3) == 0) {
1169                         vol->sfu_emul = 1;
1170                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1171                         vol->sfu_emul = 0;
1172                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1173                         vol->posix_paths = 1;
1174                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1175                         vol->posix_paths = 0;
1176                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1177                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1178                         vol->nocase = 1;
1179                 } else if (strnicmp(data, "brl", 3) == 0) {
1180                         vol->nobrl =  0;
1181                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1182                            (strnicmp(data, "nolock", 6) == 0)) {
1183                         vol->nobrl =  1;
1184                         /* turn off mandatory locking in mode
1185                         if remote locking is turned off since the
1186                         local vfs will do advisory */
1187                         if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1188                                 vol->file_mode = S_IALLUGO;
1189                 } else if (strnicmp(data, "setuids", 7) == 0) {
1190                         vol->setuids = 1;
1191                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1192                         vol->setuids = 0;
1193                 } else if (strnicmp(data, "nohard", 6) == 0) {
1194                         vol->retry = 0;
1195                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1196                         vol->retry = 1;
1197                 } else if (strnicmp(data, "nointr", 6) == 0) {
1198                         vol->intr = 0;
1199                 } else if (strnicmp(data, "intr", 4) == 0) {
1200                         vol->intr = 1;
1201                 } else if (strnicmp(data, "serverino",7) == 0) {
1202                         vol->server_ino = 1;
1203                 } else if (strnicmp(data, "noserverino",9) == 0) {
1204                         vol->server_ino = 0;
1205                 } else if (strnicmp(data, "cifsacl",7) == 0) {
1206                         vol->cifs_acl = 1;
1207                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1208                         vol->cifs_acl = 0;
1209                 } else if (strnicmp(data, "acl",3) == 0) {
1210                         vol->no_psx_acl = 0;
1211                 } else if (strnicmp(data, "noacl",5) == 0) {
1212                         vol->no_psx_acl = 1;
1213                 } else if (strnicmp(data, "sign",4) == 0) {
1214                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1215 /*              } else if (strnicmp(data, "seal",4) == 0) {
1216                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1217                 } else if (strnicmp(data, "direct",6) == 0) {
1218                         vol->direct_io = 1;
1219                 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1220                         vol->direct_io = 1;
1221                 } else if (strnicmp(data, "in6_addr",8) == 0) {
1222                         if (!value || !*value) {
1223                                 vol->in6_addr = NULL;
1224                         } else if (strnlen(value, 49) == 48) {
1225                                 vol->in6_addr = value;
1226                         } else {
1227                                 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1228                                 return 1;
1229                         }
1230                 } else if (strnicmp(data, "noac", 4) == 0) {
1231                         printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1232                 } else
1233                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1234         }
1235         if (vol->UNC == NULL) {
1236                 if(devname == NULL) {
1237                         printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1238                         return 1;
1239                 }
1240                 if ((temp_len = strnlen(devname, 300)) < 300) {
1241                         vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1242                         if(vol->UNC == NULL)
1243                                 return 1;
1244                         strcpy(vol->UNC,devname);
1245                         if (strncmp(vol->UNC, "//", 2) == 0) {
1246                                 vol->UNC[0] = '\\';
1247                                 vol->UNC[1] = '\\';
1248                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1249                                 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1250                                 return 1;
1251                         }
1252                 } else {
1253                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1254                         return 1;
1255                 }
1256         }
1257         if(vol->UNCip == NULL)
1258                 vol->UNCip = &vol->UNC[2];
1259
1260         return 0;
1261 }
1262
1263 static struct cifsSesInfo *
1264 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1265                 struct in6_addr *target_ip6_addr,
1266                  char *userName, struct TCP_Server_Info **psrvTcp)
1267 {
1268         struct list_head *tmp;
1269         struct cifsSesInfo *ses;
1270         *psrvTcp = NULL;
1271         read_lock(&GlobalSMBSeslock);
1272
1273         list_for_each(tmp, &GlobalSMBSessionList) {
1274                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1275                 if (ses->server) {
1276                         if((target_ip_addr &&
1277                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1278                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1279                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1280                                         target_ip6_addr,sizeof(*target_ip6_addr)))){
1281                                 /* BB lock server and tcp session and increment use count here?? */
1282                                 *psrvTcp = ses->server; /* found a match on the TCP session */
1283                                 /* BB check if reconnection needed */
1284                                 if (strncmp
1285                                     (ses->userName, userName,
1286                                      MAX_USERNAME_SIZE) == 0){
1287                                         read_unlock(&GlobalSMBSeslock);
1288                                         return ses;     /* found exact match on both tcp and SMB sessions */
1289                                 }
1290                         }
1291                 }
1292                 /* else tcp and smb sessions need reconnection */
1293         }
1294         read_unlock(&GlobalSMBSeslock);
1295         return NULL;
1296 }
1297
1298 static struct cifsTconInfo *
1299 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1300 {
1301         struct list_head *tmp;
1302         struct cifsTconInfo *tcon;
1303
1304         read_lock(&GlobalSMBSeslock);
1305         list_for_each(tmp, &GlobalTreeConnectionList) {
1306                 cFYI(1, ("Next tcon"));
1307                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1308                 if (tcon->ses) {
1309                         if (tcon->ses->server) {
1310                                 cFYI(1,
1311                                      ("old ip addr: %x == new ip %x ?",
1312                                       tcon->ses->server->addr.sockAddr.sin_addr.
1313                                       s_addr, new_target_ip_addr));
1314                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1315                                     s_addr == new_target_ip_addr) {
1316         /* BB lock tcon, server and tcp session and increment use count here? */
1317                                         /* found a match on the TCP session */
1318                                         /* BB check if reconnection needed */
1319                                         cFYI(1,("IP match, old UNC: %s new: %s",
1320                                               tcon->treeName, uncName));
1321                                         if (strncmp
1322                                             (tcon->treeName, uncName,
1323                                              MAX_TREE_SIZE) == 0) {
1324                                                 cFYI(1,
1325                                                      ("and old usr: %s new: %s",
1326                                                       tcon->treeName, uncName));
1327                                                 if (strncmp
1328                                                     (tcon->ses->userName,
1329                                                      userName,
1330                                                      MAX_USERNAME_SIZE) == 0) {
1331                                                         read_unlock(&GlobalSMBSeslock);
1332                                                         /* matched smb session
1333                                                         (user name */
1334                                                         return tcon;
1335                                                 }
1336                                         }
1337                                 }
1338                         }
1339                 }
1340         }
1341         read_unlock(&GlobalSMBSeslock);
1342         return NULL;
1343 }
1344
1345 int
1346 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1347                     const char *old_path, const struct nls_table *nls_codepage,
1348                     int remap)
1349 {
1350         unsigned char *referrals = NULL;
1351         unsigned int num_referrals;
1352         int rc = 0;
1353
1354         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1355                         &num_referrals, &referrals, remap);
1356
1357         /* BB Add in code to: if valid refrl, if not ip address contact
1358                 the helper that resolves tcp names, mount to it, try to
1359                 tcon to it unmount it if fail */
1360
1361         kfree(referrals);
1362
1363         return rc;
1364 }
1365
1366 int
1367 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1368                         const char *old_path, const struct nls_table *nls_codepage,
1369                         unsigned int *pnum_referrals,
1370                         unsigned char ** preferrals, int remap)
1371 {
1372         char *temp_unc;
1373         int rc = 0;
1374
1375         *pnum_referrals = 0;
1376
1377         if (pSesInfo->ipc_tid == 0) {
1378                 temp_unc = kmalloc(2 /* for slashes */ +
1379                         strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1380                                  + 1 + 4 /* slash IPC$ */  + 2,
1381                                 GFP_KERNEL);
1382                 if (temp_unc == NULL)
1383                         return -ENOMEM;
1384                 temp_unc[0] = '\\';
1385                 temp_unc[1] = '\\';
1386                 strcpy(temp_unc + 2, pSesInfo->serverName);
1387                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1388                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1389                 cFYI(1,
1390                      ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1391                 kfree(temp_unc);
1392         }
1393         if (rc == 0)
1394                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1395                                      pnum_referrals, nls_codepage, remap);
1396
1397         return rc;
1398 }
1399
1400 /* See RFC1001 section 14 on representation of Netbios names */
1401 static void rfc1002mangle(char * target,char * source, unsigned int length)
1402 {
1403         unsigned int i,j;
1404
1405         for(i=0,j=0;i<(length);i++) {
1406                 /* mask a nibble at a time and encode */
1407                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1408                 target[j+1] = 'A' + (0x0F & source[i]);
1409                 j+=2;
1410         }
1411
1412 }
1413
1414
1415 static int
1416 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1417              char * netbios_name, char * target_name)
1418 {
1419         int rc = 0;
1420         int connected = 0;
1421         __be16 orig_port = 0;
1422
1423         if(*csocket == NULL) {
1424                 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1425                 if (rc < 0) {
1426                         cERROR(1, ("Error %d creating socket",rc));
1427                         *csocket = NULL;
1428                         return rc;
1429                 } else {
1430                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1431                         cFYI(1,("Socket created"));
1432                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1433                 }
1434         }
1435
1436         psin_server->sin_family = AF_INET;
1437         if(psin_server->sin_port) { /* user overrode default port */
1438                 rc = (*csocket)->ops->connect(*csocket,
1439                                 (struct sockaddr *) psin_server,
1440                                 sizeof (struct sockaddr_in),0);
1441                 if (rc >= 0)
1442                         connected = 1;
1443         }
1444
1445         if(!connected) {
1446                 /* save original port so we can retry user specified port
1447                         later if fall back ports fail this time  */
1448                 orig_port = psin_server->sin_port;
1449
1450                 /* do not retry on the same port we just failed on */
1451                 if(psin_server->sin_port != htons(CIFS_PORT)) {
1452                         psin_server->sin_port = htons(CIFS_PORT);
1453
1454                         rc = (*csocket)->ops->connect(*csocket,
1455                                         (struct sockaddr *) psin_server,
1456                                         sizeof (struct sockaddr_in),0);
1457                         if (rc >= 0)
1458                                 connected = 1;
1459                 }
1460         }
1461         if (!connected) {
1462                 psin_server->sin_port = htons(RFC1001_PORT);
1463                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1464                                               psin_server, sizeof (struct sockaddr_in),0);
1465                 if (rc >= 0)
1466                         connected = 1;
1467         }
1468
1469         /* give up here - unless we want to retry on different
1470                 protocol families some day */
1471         if (!connected) {
1472                 if(orig_port)
1473                         psin_server->sin_port = orig_port;
1474                 cFYI(1,("Error %d connecting to server via ipv4",rc));
1475                 sock_release(*csocket);
1476                 *csocket = NULL;
1477                 return rc;
1478         }
1479         /* Eventually check for other socket options to change from
1480                 the default. sock_setsockopt not used because it expects
1481                 user space buffer */
1482          cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1483                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1484         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1485         /* make the bufsizes depend on wsize/rsize and max requests */
1486         if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1487                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1488         if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1489                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1490
1491         /* send RFC1001 sessinit */
1492         if(psin_server->sin_port == htons(RFC1001_PORT)) {
1493                 /* some servers require RFC1001 sessinit before sending
1494                 negprot - BB check reconnection in case where second
1495                 sessinit is sent but no second negprot */
1496                 struct rfc1002_session_packet * ses_init_buf;
1497                 struct smb_hdr * smb_buf;
1498                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1499                 if(ses_init_buf) {
1500                         ses_init_buf->trailer.session_req.called_len = 32;
1501                         if(target_name && (target_name[0] != 0)) {
1502                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1503                                         target_name, 16);
1504                         } else {
1505                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1506                                         DEFAULT_CIFS_CALLED_NAME,16);
1507                         }
1508
1509                         ses_init_buf->trailer.session_req.calling_len = 32;
1510                         /* calling name ends in null (byte 16) from old smb
1511                         convention. */
1512                         if(netbios_name && (netbios_name[0] !=0)) {
1513                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1514                                         netbios_name,16);
1515                         } else {
1516                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1517                                         "LINUX_CIFS_CLNT",16);
1518                         }
1519                         ses_init_buf->trailer.session_req.scope1 = 0;
1520                         ses_init_buf->trailer.session_req.scope2 = 0;
1521                         smb_buf = (struct smb_hdr *)ses_init_buf;
1522                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1523                         smb_buf->smb_buf_length = 0x81000044;
1524                         rc = smb_send(*csocket, smb_buf, 0x44,
1525                                 (struct sockaddr *)psin_server);
1526                         kfree(ses_init_buf);
1527                         msleep(1); /* RFC1001 layer in at least one server
1528                                       requires very short break before negprot
1529                                       presumably because not expecting negprot
1530                                       to follow so fast.  This is a simple
1531                                       solution that works without
1532                                       complicating the code and causes no
1533                                       significant slowing down on mount
1534                                       for everyone else */
1535                 }
1536                 /* else the negprot may still work without this
1537                 even though malloc failed */
1538
1539         }
1540
1541         return rc;
1542 }
1543
1544 static int
1545 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1546 {
1547         int rc = 0;
1548         int connected = 0;
1549         __be16 orig_port = 0;
1550
1551         if(*csocket == NULL) {
1552                 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1553                 if (rc < 0) {
1554                         cERROR(1, ("Error %d creating ipv6 socket",rc));
1555                         *csocket = NULL;
1556                         return rc;
1557                 } else {
1558                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1559                          cFYI(1,("ipv6 Socket created"));
1560                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1561                 }
1562         }
1563
1564         psin_server->sin6_family = AF_INET6;
1565
1566         if(psin_server->sin6_port) { /* user overrode default port */
1567                 rc = (*csocket)->ops->connect(*csocket,
1568                                 (struct sockaddr *) psin_server,
1569                                 sizeof (struct sockaddr_in6),0);
1570                 if (rc >= 0)
1571                         connected = 1;
1572         }
1573
1574         if(!connected) {
1575                 /* save original port so we can retry user specified port
1576                         later if fall back ports fail this time  */
1577
1578                 orig_port = psin_server->sin6_port;
1579                 /* do not retry on the same port we just failed on */
1580                 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1581                         psin_server->sin6_port = htons(CIFS_PORT);
1582
1583                         rc = (*csocket)->ops->connect(*csocket,
1584                                         (struct sockaddr *) psin_server,
1585                                         sizeof (struct sockaddr_in6),0);
1586                         if (rc >= 0)
1587                                 connected = 1;
1588                 }
1589         }
1590         if (!connected) {
1591                 psin_server->sin6_port = htons(RFC1001_PORT);
1592                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1593                                          psin_server, sizeof (struct sockaddr_in6),0);
1594                 if (rc >= 0)
1595                         connected = 1;
1596         }
1597
1598         /* give up here - unless we want to retry on different
1599                 protocol families some day */
1600         if (!connected) {
1601                 if(orig_port)
1602                         psin_server->sin6_port = orig_port;
1603                 cFYI(1,("Error %d connecting to server via ipv6",rc));
1604                 sock_release(*csocket);
1605                 *csocket = NULL;
1606                 return rc;
1607         }
1608         /* Eventually check for other socket options to change from
1609                 the default. sock_setsockopt not used because it expects
1610                 user space buffer */
1611         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1612
1613         return rc;
1614 }
1615
1616 int
1617 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1618            char *mount_data, const char *devname)
1619 {
1620         int rc = 0;
1621         int xid;
1622         int address_type = AF_INET;
1623         struct socket *csocket = NULL;
1624         struct sockaddr_in sin_server;
1625         struct sockaddr_in6 sin_server6;
1626         struct smb_vol volume_info;
1627         struct cifsSesInfo *pSesInfo = NULL;
1628         struct cifsSesInfo *existingCifsSes = NULL;
1629         struct cifsTconInfo *tcon = NULL;
1630         struct TCP_Server_Info *srvTcp = NULL;
1631
1632         xid = GetXid();
1633
1634 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1635
1636         memset(&volume_info,0,sizeof(struct smb_vol));
1637         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1638                 kfree(volume_info.UNC);
1639                 kfree(volume_info.password);
1640                 kfree(volume_info.prepath);
1641                 FreeXid(xid);
1642                 return -EINVAL;
1643         }
1644
1645         if (volume_info.username) {
1646                 /* BB fixme parse for domain name here */
1647                 cFYI(1, ("Username: %s ", volume_info.username));
1648
1649         } else if (volume_info.nullauth) {
1650                 cFYI(1,("null user"));
1651         } else {
1652                 cifserror("No username specified");
1653         /* In userspace mount helper we can get user name from alternate
1654            locations such as env variables and files on disk */
1655                 kfree(volume_info.UNC);
1656                 kfree(volume_info.password);
1657                 kfree(volume_info.prepath);
1658                 FreeXid(xid);
1659                 return -EINVAL;
1660         }
1661
1662         if (volume_info.UNCip && volume_info.UNC) {
1663                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1664
1665                 if(rc <= 0) {
1666                         /* not ipv4 address, try ipv6 */
1667                         rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1668                         if(rc > 0)
1669                                 address_type = AF_INET6;
1670                 } else {
1671                         address_type = AF_INET;
1672                 }
1673
1674                 if(rc <= 0) {
1675                         /* we failed translating address */
1676                         kfree(volume_info.UNC);
1677                         kfree(volume_info.password);
1678                         kfree(volume_info.prepath);
1679                         FreeXid(xid);
1680                         return -EINVAL;
1681                 }
1682
1683                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1684                 /* success */
1685                 rc = 0;
1686         } else if (volume_info.UNCip){
1687                 /* BB using ip addr as server name connect to the DFS root below */
1688                 cERROR(1,("Connecting to DFS root not implemented yet"));
1689                 kfree(volume_info.UNC);
1690                 kfree(volume_info.password);
1691                 kfree(volume_info.prepath);
1692                 FreeXid(xid);
1693                 return -EINVAL;
1694         } else /* which servers DFS root would we conect to */ {
1695                 cERROR(1,
1696                        ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1697                 kfree(volume_info.UNC);
1698                 kfree(volume_info.password);
1699                 kfree(volume_info.prepath);
1700                 FreeXid(xid);
1701                 return -EINVAL;
1702         }
1703
1704         /* this is needed for ASCII cp to Unicode converts */
1705         if(volume_info.iocharset == NULL) {
1706                 cifs_sb->local_nls = load_nls_default();
1707         /* load_nls_default can not return null */
1708         } else {
1709                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1710                 if(cifs_sb->local_nls == NULL) {
1711                         cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1712                         kfree(volume_info.UNC);
1713                         kfree(volume_info.password);
1714                         kfree(volume_info.prepath);
1715                         FreeXid(xid);
1716                         return -ELIBACC;
1717                 }
1718         }
1719
1720         if(address_type == AF_INET)
1721                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1722                         NULL /* no ipv6 addr */,
1723                         volume_info.username, &srvTcp);
1724         else if(address_type == AF_INET6)
1725                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1726                         &sin_server6.sin6_addr,
1727                         volume_info.username, &srvTcp);
1728         else {
1729                 kfree(volume_info.UNC);
1730                 kfree(volume_info.password);
1731                 kfree(volume_info.prepath);
1732                 FreeXid(xid);
1733                 return -EINVAL;
1734         }
1735
1736
1737         if (srvTcp) {
1738                 cFYI(1, ("Existing tcp session with server found"));
1739         } else {        /* create socket */
1740                 if(volume_info.port)
1741                         sin_server.sin_port = htons(volume_info.port);
1742                 else
1743                         sin_server.sin_port = 0;
1744                 rc = ipv4_connect(&sin_server,&csocket,
1745                                   volume_info.source_rfc1001_name,
1746                                   volume_info.target_rfc1001_name);
1747                 if (rc < 0) {
1748                         cERROR(1,
1749                                ("Error connecting to IPv4 socket. Aborting operation"));
1750                         if(csocket != NULL)
1751                                 sock_release(csocket);
1752                         kfree(volume_info.UNC);
1753                         kfree(volume_info.password);
1754                         kfree(volume_info.prepath);
1755                         FreeXid(xid);
1756                         return rc;
1757                 }
1758
1759                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1760                 if (srvTcp == NULL) {
1761                         rc = -ENOMEM;
1762                         sock_release(csocket);
1763                         kfree(volume_info.UNC);
1764                         kfree(volume_info.password);
1765                         kfree(volume_info.prepath);
1766                         FreeXid(xid);
1767                         return rc;
1768                 } else {
1769                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1770                         memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1771                         atomic_set(&srvTcp->inFlight,0);
1772                         /* BB Add code for ipv6 case too */
1773                         srvTcp->ssocket = csocket;
1774                         srvTcp->protocolType = IPV4;
1775                         init_waitqueue_head(&srvTcp->response_q);
1776                         init_waitqueue_head(&srvTcp->request_q);
1777                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1778                         /* at this point we are the only ones with the pointer
1779                         to the struct since the kernel thread not created yet
1780                         so no need to spinlock this init of tcpStatus */
1781                         srvTcp->tcpStatus = CifsNew;
1782                         init_MUTEX(&srvTcp->tcpSem);
1783                         rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1784                                       CLONE_FS | CLONE_FILES | CLONE_VM);
1785                         if(rc < 0) {
1786                                 rc = -ENOMEM;
1787                                 sock_release(csocket);
1788                                 kfree(volume_info.UNC);
1789                                 kfree(volume_info.password);
1790                                 kfree(volume_info.prepath);
1791                                 FreeXid(xid);
1792                                 return rc;
1793                         }
1794                         wait_for_completion(&cifsd_complete);
1795                         rc = 0;
1796                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1797                         memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1798                         srvTcp->sequence_number = 0;
1799                 }
1800         }
1801
1802         if (existingCifsSes) {
1803                 pSesInfo = existingCifsSes;
1804                 cFYI(1, ("Existing smb sess found"));
1805                 kfree(volume_info.password);
1806                 /* volume_info.UNC freed at end of function */
1807         } else if (!rc) {
1808                 cFYI(1, ("Existing smb sess not found"));
1809                 pSesInfo = sesInfoAlloc();
1810                 if (pSesInfo == NULL)
1811                         rc = -ENOMEM;
1812                 else {
1813                         pSesInfo->server = srvTcp;
1814                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1815                                 NIPQUAD(sin_server.sin_addr.s_addr));
1816                 }
1817
1818                 if (!rc){
1819                         /* volume_info.password freed at unmount */
1820                         if (volume_info.password)
1821                                 pSesInfo->password = volume_info.password;
1822                         if (volume_info.username)
1823                                 strncpy(pSesInfo->userName,
1824                                         volume_info.username,MAX_USERNAME_SIZE);
1825                         if (volume_info.domainname) {
1826                                 int len = strlen(volume_info.domainname);
1827                                 pSesInfo->domainName =
1828                                         kmalloc(len + 1, GFP_KERNEL);
1829                                 if(pSesInfo->domainName)
1830                                         strcpy(pSesInfo->domainName,
1831                                                 volume_info.domainname);
1832                         }
1833                         pSesInfo->linux_uid = volume_info.linux_uid;
1834                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1835                         down(&pSesInfo->sesSem);
1836                         /* BB FIXME need to pass vol->secFlgs BB */
1837                         rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1838                         up(&pSesInfo->sesSem);
1839                         if(!rc)
1840                                 atomic_inc(&srvTcp->socketUseCount);
1841                 } else
1842                         kfree(volume_info.password);
1843         }
1844
1845         /* search for existing tcon to this server share */
1846         if (!rc) {
1847                 if(volume_info.rsize > CIFSMaxBufSize) {
1848                         cERROR(1,("rsize %d too large, using MaxBufSize",
1849                                 volume_info.rsize));
1850                         cifs_sb->rsize = CIFSMaxBufSize;
1851                 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1852                         cifs_sb->rsize = volume_info.rsize;
1853                 else /* default */
1854                         cifs_sb->rsize = CIFSMaxBufSize;
1855
1856                 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1857                         cERROR(1,("wsize %d too large using 4096 instead",
1858                                   volume_info.wsize));
1859                         cifs_sb->wsize = 4096;
1860                 } else if(volume_info.wsize)
1861                         cifs_sb->wsize = volume_info.wsize;
1862                 else
1863                         cifs_sb->wsize =
1864                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1865                                         127*1024);
1866                         /* old default of CIFSMaxBufSize was too small now
1867                            that SMB Write2 can send multiple pages in kvec.
1868                            RFC1001 does not describe what happens when frame
1869                            bigger than 128K is sent so use that as max in
1870                            conjunction with 52K kvec constraint on arch with 4K
1871                            page size  */
1872
1873                 if(cifs_sb->rsize < 2048) {
1874                         cifs_sb->rsize = 2048;
1875                         /* Windows ME may prefer this */
1876                         cFYI(1,("readsize set to minimum 2048"));
1877                 }
1878                 /* calculate prepath */
1879                 cifs_sb->prepath = volume_info.prepath;
1880                 if(cifs_sb->prepath) {
1881                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1882                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1883                         volume_info.prepath = NULL;
1884                 } else
1885                         cifs_sb->prepathlen = 0;
1886                 cifs_sb->mnt_uid = volume_info.linux_uid;
1887                 cifs_sb->mnt_gid = volume_info.linux_gid;
1888                 cifs_sb->mnt_file_mode = volume_info.file_mode;
1889                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1890                 cFYI(1,("file mode: 0x%x  dir mode: 0x%x",
1891                         cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1892
1893                 if(volume_info.noperm)
1894                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1895                 if(volume_info.setuids)
1896                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1897                 if(volume_info.server_ino)
1898                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1899                 if(volume_info.remap)
1900                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1901                 if(volume_info.no_xattr)
1902                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1903                 if(volume_info.sfu_emul)
1904                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1905                 if(volume_info.nobrl)
1906                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1907                 if(volume_info.cifs_acl)
1908                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1909
1910                 if(volume_info.direct_io) {
1911                         cFYI(1,("mounting share using direct i/o"));
1912                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1913                 }
1914
1915                 tcon =
1916                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1917                              volume_info.username);
1918                 if (tcon) {
1919                         cFYI(1, ("Found match on UNC path"));
1920                         /* we can have only one retry value for a connection
1921                            to a share so for resources mounted more than once
1922                            to the same server share the last value passed in
1923                            for the retry flag is used */
1924                         tcon->retry = volume_info.retry;
1925                         tcon->nocase = volume_info.nocase;
1926                 } else {
1927                         tcon = tconInfoAlloc();
1928                         if (tcon == NULL)
1929                                 rc = -ENOMEM;
1930                         else {
1931                                 /* check for null share name ie connect to dfs root */
1932
1933                                 /* BB check if this works for exactly length three strings */
1934                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
1935                                     && (strchr(volume_info.UNC + 3, '/') ==
1936                                         NULL)) {
1937                                         rc = connect_to_dfs_path(xid, pSesInfo,
1938                                                         "", cifs_sb->local_nls,
1939                                                         cifs_sb->mnt_cifs_flags &
1940                                                           CIFS_MOUNT_MAP_SPECIAL_CHR);
1941                                         kfree(volume_info.UNC);
1942                                         FreeXid(xid);
1943                                         return -ENODEV;
1944                                 } else {
1945                                         rc = CIFSTCon(xid, pSesInfo,
1946                                                 volume_info.UNC,
1947                                                 tcon, cifs_sb->local_nls);
1948                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
1949                                 }
1950                                 if (!rc) {
1951                                         atomic_inc(&pSesInfo->inUse);
1952                                         tcon->retry = volume_info.retry;
1953                                         tcon->nocase = volume_info.nocase;
1954                                 }
1955                         }
1956                 }
1957         }
1958         if(pSesInfo) {
1959                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
1960                         sb->s_maxbytes = (u64) 1 << 63;
1961                 } else
1962                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
1963         }
1964
1965         sb->s_time_gran = 100;
1966
1967 /* on error free sesinfo and tcon struct if needed */
1968         if (rc) {
1969                 /* if session setup failed, use count is zero but
1970                 we still need to free cifsd thread */
1971                 if(atomic_read(&srvTcp->socketUseCount) == 0) {
1972                         spin_lock(&GlobalMid_Lock);
1973                         srvTcp->tcpStatus = CifsExiting;
1974                         spin_unlock(&GlobalMid_Lock);
1975                         if(srvTcp->tsk) {
1976                                 send_sig(SIGKILL,srvTcp->tsk,1);
1977                                 wait_for_completion(&cifsd_complete);
1978                         }
1979                 }
1980                  /* If find_unc succeeded then rc == 0 so we can not end */
1981                 if (tcon)  /* up accidently freeing someone elses tcon struct */
1982                         tconInfoFree(tcon);
1983                 if (existingCifsSes == NULL) {
1984                         if (pSesInfo) {
1985                                 if ((pSesInfo->server) &&
1986                                     (pSesInfo->status == CifsGood)) {
1987                                         int temp_rc;
1988                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
1989                                         /* if the socketUseCount is now zero */
1990                                         if((temp_rc == -ESHUTDOWN) &&
1991                                            (pSesInfo->server->tsk)) {
1992                                                 send_sig(SIGKILL,pSesInfo->server->tsk,1);
1993                                                 wait_for_completion(&cifsd_complete);
1994                                         }
1995                                 } else
1996                                         cFYI(1, ("No session or bad tcon"));
1997                                 sesInfoFree(pSesInfo);
1998                                 /* pSesInfo = NULL; */
1999                         }
2000                 }
2001         } else {
2002                 atomic_inc(&tcon->useCount);
2003                 cifs_sb->tcon = tcon;
2004                 tcon->ses = pSesInfo;
2005
2006                 /* do not care if following two calls succeed - informational */
2007                 CIFSSMBQFSDeviceInfo(xid, tcon);
2008                 CIFSSMBQFSAttributeInfo(xid, tcon);
2009
2010                 if (tcon->ses->capabilities & CAP_UNIX) {
2011                         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
2012                                 __u64 cap =
2013                                        le64_to_cpu(tcon->fsUnixInfo.Capability);
2014                                 cap &= CIFS_UNIX_CAP_MASK;
2015                                 if(volume_info.no_psx_acl)
2016                                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2017                                 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
2018                                         cFYI(1,("negotiated posix acl support"));
2019                                         sb->s_flags |= MS_POSIXACL;
2020                                 }
2021
2022                                 if(volume_info.posix_paths == 0)
2023                                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2024                                 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2025                                         cFYI(1,("negotiate posix pathnames"));
2026                                         cifs_sb->mnt_cifs_flags |=
2027                                                 CIFS_MOUNT_POSIX_PATHS;
2028                                 }
2029
2030                                 cFYI(1,("Negotiate caps 0x%x",(int)cap));
2031 #ifdef CONFIG_CIFS_DEBUG2
2032                                 if(cap & CIFS_UNIX_FCNTL_CAP)
2033                                         cFYI(1,("FCNTL cap"));
2034                                 if(cap & CIFS_UNIX_EXTATTR_CAP)
2035                                         cFYI(1,("EXTATTR cap"));
2036                                 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2037                                         cFYI(1,("POSIX path cap"));
2038                                 if(cap & CIFS_UNIX_XATTR_CAP)
2039                                         cFYI(1,("XATTR cap"));
2040                                 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
2041                                         cFYI(1,("POSIX ACL cap"));
2042 #endif /* CIFS_DEBUG2 */
2043                                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2044                                         cFYI(1,("setting capabilities failed"));
2045                                 }
2046                         }
2047                 }
2048                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2049                         cifs_sb->wsize = min(cifs_sb->wsize,
2050                                              (tcon->ses->server->maxBuf -
2051                                               MAX_CIFS_HDR_SIZE));
2052                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2053                         cifs_sb->rsize = min(cifs_sb->rsize,
2054                                              (tcon->ses->server->maxBuf -
2055                                               MAX_CIFS_HDR_SIZE));
2056         }
2057
2058         /* volume_info.password is freed above when existing session found
2059         (in which case it is not needed anymore) but when new sesion is created
2060         the password ptr is put in the new session structure (in which case the
2061         password will be freed at unmount time) */
2062         kfree(volume_info.UNC);
2063         kfree(volume_info.prepath);
2064         FreeXid(xid);
2065         return rc;
2066 }
2067
2068 static int
2069 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2070               char session_key[CIFS_SESS_KEY_SIZE],
2071               const struct nls_table *nls_codepage)
2072 {
2073         struct smb_hdr *smb_buffer;
2074         struct smb_hdr *smb_buffer_response;
2075         SESSION_SETUP_ANDX *pSMB;
2076         SESSION_SETUP_ANDX *pSMBr;
2077         char *bcc_ptr;
2078         char *user;
2079         char *domain;
2080         int rc = 0;
2081         int remaining_words = 0;
2082         int bytes_returned = 0;
2083         int len;
2084         __u32 capabilities;
2085         __u16 count;
2086
2087         cFYI(1, ("In sesssetup"));
2088         if(ses == NULL)
2089                 return -EINVAL;
2090         user = ses->userName;
2091         domain = ses->domainName;
2092         smb_buffer = cifs_buf_get();
2093         if (smb_buffer == NULL) {
2094                 return -ENOMEM;
2095         }
2096         smb_buffer_response = smb_buffer;
2097         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2098
2099         /* send SMBsessionSetup here */
2100         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2101                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2102
2103         smb_buffer->Mid = GetNextMid(ses->server);
2104         pSMB->req_no_secext.AndXCommand = 0xFF;
2105         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2106         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2107
2108         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2109                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2110
2111         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2112                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2113         if (ses->capabilities & CAP_UNICODE) {
2114                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2115                 capabilities |= CAP_UNICODE;
2116         }
2117         if (ses->capabilities & CAP_STATUS32) {
2118                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2119                 capabilities |= CAP_STATUS32;
2120         }
2121         if (ses->capabilities & CAP_DFS) {
2122                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2123                 capabilities |= CAP_DFS;
2124         }
2125         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2126
2127         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2128                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2129
2130         pSMB->req_no_secext.CaseSensitivePasswordLength =
2131             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2132         bcc_ptr = pByteArea(smb_buffer);
2133         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2134         bcc_ptr += CIFS_SESS_KEY_SIZE;
2135         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2136         bcc_ptr += CIFS_SESS_KEY_SIZE;
2137
2138         if (ses->capabilities & CAP_UNICODE) {
2139                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2140                         *bcc_ptr = 0;
2141                         bcc_ptr++;
2142                 }
2143                 if(user == NULL)
2144                         bytes_returned = 0; /* skip null user */
2145                 else
2146                         bytes_returned =
2147                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2148                                         nls_codepage);
2149                 /* convert number of 16 bit words to bytes */
2150                 bcc_ptr += 2 * bytes_returned;
2151                 bcc_ptr += 2;   /* trailing null */
2152                 if (domain == NULL)
2153                         bytes_returned =
2154                             cifs_strtoUCS((__le16 *) bcc_ptr,
2155                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2156                 else
2157                         bytes_returned =
2158                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2159                                           nls_codepage);
2160                 bcc_ptr += 2 * bytes_returned;
2161                 bcc_ptr += 2;
2162                 bytes_returned =
2163                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2164                                   32, nls_codepage);
2165                 bcc_ptr += 2 * bytes_returned;
2166                 bytes_returned =
2167                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2168                                   32, nls_codepage);
2169                 bcc_ptr += 2 * bytes_returned;
2170                 bcc_ptr += 2;
2171                 bytes_returned =
2172                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2173                                   64, nls_codepage);
2174                 bcc_ptr += 2 * bytes_returned;
2175                 bcc_ptr += 2;
2176         } else {
2177                 if(user != NULL) {
2178                     strncpy(bcc_ptr, user, 200);
2179                     bcc_ptr += strnlen(user, 200);
2180                 }
2181                 *bcc_ptr = 0;
2182                 bcc_ptr++;
2183                 if (domain == NULL) {
2184                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2185                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2186                 } else {
2187                         strncpy(bcc_ptr, domain, 64);
2188                         bcc_ptr += strnlen(domain, 64);
2189                         *bcc_ptr = 0;
2190                         bcc_ptr++;
2191                 }
2192                 strcpy(bcc_ptr, "Linux version ");
2193                 bcc_ptr += strlen("Linux version ");
2194                 strcpy(bcc_ptr, utsname()->release);
2195                 bcc_ptr += strlen(utsname()->release) + 1;
2196                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2197                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2198         }
2199         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2200         smb_buffer->smb_buf_length += count;
2201         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2202
2203         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2204                          &bytes_returned, 1);
2205         if (rc) {
2206 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2207         } else if ((smb_buffer_response->WordCount == 3)
2208                    || (smb_buffer_response->WordCount == 4)) {
2209                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2210                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2211                 if (action & GUEST_LOGIN)
2212                         cFYI(1, (" Guest login"));      /* do we want to mark SesInfo struct ? */
2213                 ses->Suid = smb_buffer_response->Uid;   /* UID left in wire format (le) */
2214                 cFYI(1, ("UID = %d ", ses->Suid));
2215          /* response can have either 3 or 4 word count - Samba sends 3 */
2216                 bcc_ptr = pByteArea(smb_buffer_response);
2217                 if ((pSMBr->resp.hdr.WordCount == 3)
2218                     || ((pSMBr->resp.hdr.WordCount == 4)
2219                         && (blob_len < pSMBr->resp.ByteCount))) {
2220                         if (pSMBr->resp.hdr.WordCount == 4)
2221                                 bcc_ptr += blob_len;
2222
2223                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2224                                 if ((long) (bcc_ptr) % 2) {
2225                                         remaining_words =
2226                                             (BCC(smb_buffer_response) - 1) /2;
2227                                         bcc_ptr++;      /* Unicode strings must be word aligned */
2228                                 } else {
2229                                         remaining_words =
2230                                                 BCC(smb_buffer_response) / 2;
2231                                 }
2232                                 len =
2233                                     UniStrnlen((wchar_t *) bcc_ptr,
2234                                                remaining_words - 1);
2235 /* We look for obvious messed up bcc or strings in response so we do not go off
2236    the end since (at least) WIN2K and Windows XP have a major bug in not null
2237    terminating last Unicode string in response  */
2238                                 if(ses->serverOS)
2239                                         kfree(ses->serverOS);
2240                                 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2241                                 if(ses->serverOS == NULL)
2242                                         goto sesssetup_nomem;
2243                                 cifs_strfromUCS_le(ses->serverOS,
2244                                            (__le16 *)bcc_ptr, len,nls_codepage);
2245                                 bcc_ptr += 2 * (len + 1);
2246                                 remaining_words -= len + 1;
2247                                 ses->serverOS[2 * len] = 0;
2248                                 ses->serverOS[1 + (2 * len)] = 0;
2249                                 if (remaining_words > 0) {
2250                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2251                                                          remaining_words-1);
2252                                         kfree(ses->serverNOS);
2253                                         ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2254                                         if(ses->serverNOS == NULL)
2255                                                 goto sesssetup_nomem;
2256                                         cifs_strfromUCS_le(ses->serverNOS,
2257                                                            (__le16 *)bcc_ptr,len,nls_codepage);
2258                                         bcc_ptr += 2 * (len + 1);
2259                                         ses->serverNOS[2 * len] = 0;
2260                                         ses->serverNOS[1 + (2 * len)] = 0;
2261                                         if(strncmp(ses->serverNOS,
2262                                                 "NT LAN Manager 4",16) == 0) {
2263                                                 cFYI(1,("NT4 server"));
2264                                                 ses->flags |= CIFS_SES_NT4;
2265                                         }
2266                                         remaining_words -= len + 1;
2267                                         if (remaining_words > 0) {
2268                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2269           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2270                                                 if(ses->serverDomain)
2271                                                         kfree(ses->serverDomain);
2272                                                 ses->serverDomain =
2273                                                     kzalloc(2*(len+1),GFP_KERNEL);
2274                                                 if(ses->serverDomain == NULL)
2275                                                         goto sesssetup_nomem;
2276                                                 cifs_strfromUCS_le(ses->serverDomain,
2277                                                      (__le16 *)bcc_ptr,len,nls_codepage);
2278                                                 bcc_ptr += 2 * (len + 1);
2279                                                 ses->serverDomain[2*len] = 0;
2280                                                 ses->serverDomain[1+(2*len)] = 0;
2281                                         } /* else no more room so create dummy domain string */
2282                                         else {
2283                                                 if(ses->serverDomain)
2284                                                         kfree(ses->serverDomain);
2285                                                 ses->serverDomain =
2286                                                         kzalloc(2, GFP_KERNEL);
2287                                         }
2288                                 } else {        /* no room so create dummy domain and NOS string */
2289                                         /* if these kcallocs fail not much we
2290                                            can do, but better to not fail the
2291                                            sesssetup itself */
2292                                         kfree(ses->serverDomain);
2293                                         ses->serverDomain =
2294                                             kzalloc(2, GFP_KERNEL);
2295                                         kfree(ses->serverNOS);
2296                                         ses->serverNOS =
2297                                             kzalloc(2, GFP_KERNEL);
2298                                 }
2299                         } else {        /* ASCII */
2300                                 len = strnlen(bcc_ptr, 1024);
2301                                 if (((long) bcc_ptr + len) - (long)
2302                                     pByteArea(smb_buffer_response)
2303                                             <= BCC(smb_buffer_response)) {
2304                                         kfree(ses->serverOS);
2305                                         ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2306                                         if(ses->serverOS == NULL)
2307                                                 goto sesssetup_nomem;
2308                                         strncpy(ses->serverOS,bcc_ptr, len);
2309
2310                                         bcc_ptr += len;
2311                                         bcc_ptr[0] = 0; /* null terminate the string */
2312                                         bcc_ptr++;
2313
2314                                         len = strnlen(bcc_ptr, 1024);
2315                                         kfree(ses->serverNOS);
2316                                         ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2317                                         if(ses->serverNOS == NULL)
2318                                                 goto sesssetup_nomem;
2319                                         strncpy(ses->serverNOS, bcc_ptr, len);
2320                                         bcc_ptr += len;
2321                                         bcc_ptr[0] = 0;
2322                                         bcc_ptr++;
2323
2324                                         len = strnlen(bcc_ptr, 1024);
2325                                         if(ses->serverDomain)
2326                                                 kfree(ses->serverDomain);
2327                                         ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2328                                         if(ses->serverDomain == NULL)
2329                                                 goto sesssetup_nomem;
2330                                         strncpy(ses->serverDomain, bcc_ptr, len);
2331                                         bcc_ptr += len;
2332                                         bcc_ptr[0] = 0;
2333                                         bcc_ptr++;
2334                                 } else
2335                                         cFYI(1,
2336                                              ("Variable field of length %d extends beyond end of smb ",
2337                                               len));
2338                         }
2339                 } else {
2340                         cERROR(1,
2341                                (" Security Blob Length extends beyond end of SMB"));
2342                 }
2343         } else {
2344                 cERROR(1,
2345                        (" Invalid Word count %d: ",
2346                         smb_buffer_response->WordCount));
2347                 rc = -EIO;
2348         }
2349 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2350                            since that could make reconnection harder, and
2351                            reconnection might be needed to free memory */
2352         if (smb_buffer)
2353                 cifs_buf_release(smb_buffer);
2354
2355         return rc;
2356 }
2357
2358 static int
2359 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2360                               struct cifsSesInfo *ses, int * pNTLMv2_flag,
2361                               const struct nls_table *nls_codepage)
2362 {
2363         struct smb_hdr *smb_buffer;
2364         struct smb_hdr *smb_buffer_response;
2365         SESSION_SETUP_ANDX *pSMB;
2366         SESSION_SETUP_ANDX *pSMBr;
2367         char *bcc_ptr;
2368         char *domain;
2369         int rc = 0;
2370         int remaining_words = 0;
2371         int bytes_returned = 0;
2372         int len;
2373         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2374         PNEGOTIATE_MESSAGE SecurityBlob;
2375         PCHALLENGE_MESSAGE SecurityBlob2;
2376         __u32 negotiate_flags, capabilities;
2377         __u16 count;
2378
2379         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2380         if(ses == NULL)
2381                 return -EINVAL;
2382         domain = ses->domainName;
2383         *pNTLMv2_flag = FALSE;
2384         smb_buffer = cifs_buf_get();
2385         if (smb_buffer == NULL) {
2386                 return -ENOMEM;
2387         }
2388         smb_buffer_response = smb_buffer;
2389         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2390         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2391
2392         /* send SMBsessionSetup here */
2393         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2394                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2395
2396         smb_buffer->Mid = GetNextMid(ses->server);
2397         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2398         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2399
2400         pSMB->req.AndXCommand = 0xFF;
2401         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2402         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2403
2404         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2405                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2406
2407         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2408             CAP_EXTENDED_SECURITY;
2409         if (ses->capabilities & CAP_UNICODE) {
2410                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2411                 capabilities |= CAP_UNICODE;
2412         }
2413         if (ses->capabilities & CAP_STATUS32) {
2414                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2415                 capabilities |= CAP_STATUS32;
2416         }
2417         if (ses->capabilities & CAP_DFS) {
2418                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2419                 capabilities |= CAP_DFS;
2420         }
2421         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2422
2423         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2424         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2425         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2426         SecurityBlob->MessageType = NtLmNegotiate;
2427         negotiate_flags =
2428             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2429             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2430             NTLMSSP_NEGOTIATE_56 |
2431             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2432         if(sign_CIFS_PDUs)
2433                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2434 /*      if(ntlmv2_support)
2435                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2436         /* setup pointers to domain name and workstation name */
2437         bcc_ptr += SecurityBlobLength;
2438
2439         SecurityBlob->WorkstationName.Buffer = 0;
2440         SecurityBlob->WorkstationName.Length = 0;
2441         SecurityBlob->WorkstationName.MaximumLength = 0;
2442
2443         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2444         along with username on auth request (ie the response to challenge) */
2445         SecurityBlob->DomainName.Buffer = 0;
2446         SecurityBlob->DomainName.Length = 0;
2447         SecurityBlob->DomainName.MaximumLength = 0;
2448         if (ses->capabilities & CAP_UNICODE) {
2449                 if ((long) bcc_ptr % 2) {
2450                         *bcc_ptr = 0;
2451                         bcc_ptr++;
2452                 }
2453
2454                 bytes_returned =
2455                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2456                                   32, nls_codepage);
2457                 bcc_ptr += 2 * bytes_returned;
2458                 bytes_returned =
2459                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2460                                   nls_codepage);
2461                 bcc_ptr += 2 * bytes_returned;
2462                 bcc_ptr += 2;   /* null terminate Linux version */
2463                 bytes_returned =
2464                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2465                                   64, nls_codepage);
2466                 bcc_ptr += 2 * bytes_returned;
2467                 *(bcc_ptr + 1) = 0;
2468                 *(bcc_ptr + 2) = 0;
2469                 bcc_ptr += 2;   /* null terminate network opsys string */
2470                 *(bcc_ptr + 1) = 0;
2471                 *(bcc_ptr + 2) = 0;
2472                 bcc_ptr += 2;   /* null domain */
2473         } else {                /* ASCII */
2474                 strcpy(bcc_ptr, "Linux version ");
2475                 bcc_ptr += strlen("Linux version ");
2476                 strcpy(bcc_ptr, utsname()->release);
2477                 bcc_ptr += strlen(utsname()->release) + 1;
2478                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2479                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2480                 bcc_ptr++;      /* empty domain field */
2481                 *bcc_ptr = 0;
2482         }
2483         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2484         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2485         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2486         smb_buffer->smb_buf_length += count;
2487         pSMB->req.ByteCount = cpu_to_le16(count);
2488
2489         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2490                          &bytes_returned, 1);
2491
2492         if (smb_buffer_response->Status.CifsError ==
2493             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2494                 rc = 0;
2495
2496         if (rc) {
2497 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2498         } else if ((smb_buffer_response->WordCount == 3)
2499                    || (smb_buffer_response->WordCount == 4)) {
2500                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2501                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2502
2503                 if (action & GUEST_LOGIN)
2504                         cFYI(1, (" Guest login"));
2505         /* Do we want to set anything in SesInfo struct when guest login? */
2506
2507                 bcc_ptr = pByteArea(smb_buffer_response);
2508         /* response can have either 3 or 4 word count - Samba sends 3 */
2509
2510                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2511                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2512                         cFYI(1,
2513                              ("Unexpected NTLMSSP message type received %d",
2514                               SecurityBlob2->MessageType));
2515                 } else if (ses) {
2516                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2517                         cFYI(1, ("UID = %d", ses->Suid));
2518                         if ((pSMBr->resp.hdr.WordCount == 3)
2519                             || ((pSMBr->resp.hdr.WordCount == 4)
2520                                 && (blob_len <
2521                                     pSMBr->resp.ByteCount))) {
2522
2523                                 if (pSMBr->resp.hdr.WordCount == 4) {
2524                                         bcc_ptr += blob_len;
2525                                         cFYI(1, ("Security Blob Length %d",
2526                                               blob_len));
2527                                 }
2528
2529                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2530
2531                                 memcpy(ses->server->cryptKey,
2532                                        SecurityBlob2->Challenge,
2533                                        CIFS_CRYPTO_KEY_SIZE);
2534                                 if(SecurityBlob2->NegotiateFlags &
2535                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2536                                         *pNTLMv2_flag = TRUE;
2537
2538                                 if((SecurityBlob2->NegotiateFlags &
2539                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2540                                         || (sign_CIFS_PDUs > 1))
2541                                                 ses->server->secMode |=
2542                                                         SECMODE_SIGN_REQUIRED;
2543                                 if ((SecurityBlob2->NegotiateFlags &
2544                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2545                                                 ses->server->secMode |=
2546                                                         SECMODE_SIGN_ENABLED;
2547
2548                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2549                                         if ((long) (bcc_ptr) % 2) {
2550                                                 remaining_words =
2551                                                     (BCC(smb_buffer_response)
2552                                                      - 1) / 2;
2553                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2554                                         } else {
2555                                                 remaining_words =
2556                                                     BCC
2557                                                     (smb_buffer_response) / 2;
2558                                         }
2559                                         len =
2560                                             UniStrnlen((wchar_t *) bcc_ptr,
2561                                                        remaining_words - 1);
2562 /* We look for obvious messed up bcc or strings in response so we do not go off
2563    the end since (at least) WIN2K and Windows XP have a major bug in not null
2564    terminating last Unicode string in response  */
2565                                         if(ses->serverOS)
2566                                                 kfree(ses->serverOS);
2567                                         ses->serverOS =
2568                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2569                                         cifs_strfromUCS_le(ses->serverOS,
2570                                                            (__le16 *)
2571                                                            bcc_ptr, len,
2572                                                            nls_codepage);
2573                                         bcc_ptr += 2 * (len + 1);
2574                                         remaining_words -= len + 1;
2575                                         ses->serverOS[2 * len] = 0;
2576                                         ses->serverOS[1 + (2 * len)] = 0;
2577                                         if (remaining_words > 0) {
2578                                                 len = UniStrnlen((wchar_t *)
2579                                                                  bcc_ptr,
2580                                                                  remaining_words
2581                                                                  - 1);
2582                                                 kfree(ses->serverNOS);
2583                                                 ses->serverNOS =
2584                                                     kzalloc(2 * (len + 1),
2585                                                             GFP_KERNEL);
2586                                                 cifs_strfromUCS_le(ses->
2587                                                                    serverNOS,
2588                                                                    (__le16 *)
2589                                                                    bcc_ptr,
2590                                                                    len,
2591                                                                    nls_codepage);
2592                                                 bcc_ptr += 2 * (len + 1);
2593                                                 ses->serverNOS[2 * len] = 0;
2594                                                 ses->serverNOS[1 +
2595                                                                (2 * len)] = 0;
2596                                                 remaining_words -= len + 1;
2597                                                 if (remaining_words > 0) {
2598                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2599            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2600                                                         kfree(ses->serverDomain);
2601                                                         ses->serverDomain =
2602                                                             kzalloc(2 *
2603                                                                     (len +
2604                                                                      1),
2605                                                                     GFP_KERNEL);
2606                                                         cifs_strfromUCS_le
2607                                                             (ses->serverDomain,
2608                                                              (__le16 *)bcc_ptr,
2609                                                              len, nls_codepage);
2610                                                         bcc_ptr +=
2611                                                             2 * (len + 1);
2612                                                         ses->serverDomain[2*len]
2613                                                             = 0;
2614                                                         ses->serverDomain
2615                                                                 [1 + (2 * len)]
2616                                                             = 0;
2617                                                 } /* else no more room so create dummy domain string */
2618                                                 else {
2619                                                         kfree(ses->serverDomain);
2620                                                         ses->serverDomain =
2621                                                             kzalloc(2,
2622                                                                     GFP_KERNEL);
2623                                                 }
2624                                         } else {        /* no room so create dummy domain and NOS string */
2625                                                 kfree(ses->serverDomain);
2626                                                 ses->serverDomain =
2627                                                     kzalloc(2, GFP_KERNEL);
2628                                                 kfree(ses->serverNOS);
2629                                                 ses->serverNOS =
2630                                                     kzalloc(2, GFP_KERNEL);
2631                                         }
2632                                 } else {        /* ASCII */
2633                                         len = strnlen(bcc_ptr, 1024);
2634                                         if (((long) bcc_ptr + len) - (long)
2635                                             pByteArea(smb_buffer_response)
2636                                             <= BCC(smb_buffer_response)) {
2637                                                 if(ses->serverOS)
2638                                                         kfree(ses->serverOS);
2639                                                 ses->serverOS =
2640                                                     kzalloc(len + 1,
2641                                                             GFP_KERNEL);
2642                                                 strncpy(ses->serverOS,
2643                                                         bcc_ptr, len);
2644
2645                                                 bcc_ptr += len;
2646                                                 bcc_ptr[0] = 0; /* null terminate string */
2647                                                 bcc_ptr++;
2648
2649                                                 len = strnlen(bcc_ptr, 1024);
2650                                                 kfree(ses->serverNOS);
2651                                                 ses->serverNOS =
2652                                                     kzalloc(len + 1,
2653                                                             GFP_KERNEL);
2654                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2655                                                 bcc_ptr += len;
2656                                                 bcc_ptr[0] = 0;
2657                                                 bcc_ptr++;
2658
2659                                                 len = strnlen(bcc_ptr, 1024);
2660                                                 kfree(ses->serverDomain);
2661                                                 ses->serverDomain =
2662                                                     kzalloc(len + 1,
2663                                                             GFP_KERNEL);
2664                                                 strncpy(ses->serverDomain, bcc_ptr, len);
2665                                                 bcc_ptr += len;
2666                                                 bcc_ptr[0] = 0;
2667                                                 bcc_ptr++;
2668                                         } else
2669                                                 cFYI(1,
2670                                                      ("Variable field of length %d extends beyond end of smb",
2671                                                       len));
2672                                 }
2673                         } else {
2674                                 cERROR(1,
2675                                        (" Security Blob Length extends beyond end of SMB"));
2676                         }
2677                 } else {
2678                         cERROR(1, ("No session structure passed in."));
2679                 }
2680         } else {
2681                 cERROR(1,
2682                        (" Invalid Word count %d:",
2683                         smb_buffer_response->WordCount));
2684                 rc = -EIO;
2685         }
2686
2687         if (smb_buffer)
2688                 cifs_buf_release(smb_buffer);
2689
2690         return rc;
2691 }
2692 static int
2693 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2694                 char *ntlm_session_key, int ntlmv2_flag,
2695                 const struct nls_table *nls_codepage)
2696 {
2697         struct smb_hdr *smb_buffer;
2698         struct smb_hdr *smb_buffer_response;
2699         SESSION_SETUP_ANDX *pSMB;
2700         SESSION_SETUP_ANDX *pSMBr;
2701         char *bcc_ptr;
2702         char *user;
2703         char *domain;
2704         int rc = 0;
2705         int remaining_words = 0;
2706         int bytes_returned = 0;
2707         int len;
2708         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2709         PAUTHENTICATE_MESSAGE SecurityBlob;
2710         __u32 negotiate_flags, capabilities;
2711         __u16 count;
2712
2713         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2714         if(ses == NULL)
2715                 return -EINVAL;
2716         user = ses->userName;
2717         domain = ses->domainName;
2718         smb_buffer = cifs_buf_get();
2719         if (smb_buffer == NULL) {
2720                 return -ENOMEM;
2721         }
2722         smb_buffer_response = smb_buffer;
2723         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2724         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2725
2726         /* send SMBsessionSetup here */
2727         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2728                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2729
2730         smb_buffer->Mid = GetNextMid(ses->server);
2731         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2732         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2733         pSMB->req.AndXCommand = 0xFF;
2734         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2735         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2736
2737         pSMB->req.hdr.Uid = ses->Suid;
2738
2739         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2740                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2741
2742         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2743             CAP_EXTENDED_SECURITY;
2744         if (ses->capabilities & CAP_UNICODE) {
2745                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2746                 capabilities |= CAP_UNICODE;
2747         }
2748         if (ses->capabilities & CAP_STATUS32) {
2749                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2750                 capabilities |= CAP_STATUS32;
2751         }
2752         if (ses->capabilities & CAP_DFS) {
2753                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2754                 capabilities |= CAP_DFS;
2755         }
2756         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2757
2758         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2759         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2760         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2761         SecurityBlob->MessageType = NtLmAuthenticate;
2762         bcc_ptr += SecurityBlobLength;
2763         negotiate_flags =
2764             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2765             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2766             0x80000000 | NTLMSSP_NEGOTIATE_128;
2767         if(sign_CIFS_PDUs)
2768                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2769         if(ntlmv2_flag)
2770                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2771
2772 /* setup pointers to domain name and workstation name */
2773
2774         SecurityBlob->WorkstationName.Buffer = 0;
2775         SecurityBlob->WorkstationName.Length = 0;
2776         SecurityBlob->WorkstationName.MaximumLength = 0;
2777         SecurityBlob->SessionKey.Length = 0;
2778         SecurityBlob->SessionKey.MaximumLength = 0;
2779         SecurityBlob->SessionKey.Buffer = 0;
2780
2781         SecurityBlob->LmChallengeResponse.Length = 0;
2782         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2783         SecurityBlob->LmChallengeResponse.Buffer = 0;
2784
2785         SecurityBlob->NtChallengeResponse.Length =
2786             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2787         SecurityBlob->NtChallengeResponse.MaximumLength =
2788             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2789         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2790         SecurityBlob->NtChallengeResponse.Buffer =
2791             cpu_to_le32(SecurityBlobLength);
2792         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2793         bcc_ptr += CIFS_SESS_KEY_SIZE;
2794
2795         if (ses->capabilities & CAP_UNICODE) {
2796                 if (domain == NULL) {
2797                         SecurityBlob->DomainName.Buffer = 0;
2798                         SecurityBlob->DomainName.Length = 0;
2799                         SecurityBlob->DomainName.MaximumLength = 0;
2800                 } else {
2801                         __u16 len =
2802                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2803                                           nls_codepage);
2804                         len *= 2;
2805                         SecurityBlob->DomainName.MaximumLength =
2806                             cpu_to_le16(len);
2807                         SecurityBlob->DomainName.Buffer =
2808                             cpu_to_le32(SecurityBlobLength);
2809                         bcc_ptr += len;
2810                         SecurityBlobLength += len;
2811                         SecurityBlob->DomainName.Length =
2812                             cpu_to_le16(len);
2813                 }
2814                 if (user == NULL) {
2815                         SecurityBlob->UserName.Buffer = 0;
2816                         SecurityBlob->UserName.Length = 0;
2817                         SecurityBlob->UserName.MaximumLength = 0;
2818                 } else {
2819                         __u16 len =
2820                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2821                                           nls_codepage);
2822                         len *= 2;
2823                         SecurityBlob->UserName.MaximumLength =
2824                             cpu_to_le16(len);
2825                         SecurityBlob->UserName.Buffer =
2826                             cpu_to_le32(SecurityBlobLength);
2827                         bcc_ptr += len;
2828                         SecurityBlobLength += len;
2829                         SecurityBlob->UserName.Length =
2830                             cpu_to_le16(len);
2831                 }
2832
2833                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2834                    SecurityBlob->WorkstationName.Length *= 2;
2835                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2836                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2837                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2838                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2839                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
2840
2841                 if ((long) bcc_ptr % 2) {
2842                         *bcc_ptr = 0;
2843                         bcc_ptr++;
2844                 }
2845                 bytes_returned =
2846                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2847                                   32, nls_codepage);
2848                 bcc_ptr += 2 * bytes_returned;
2849                 bytes_returned =
2850                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2851                                   nls_codepage);
2852                 bcc_ptr += 2 * bytes_returned;
2853                 bcc_ptr += 2;   /* null term version string */
2854                 bytes_returned =
2855                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2856                                   64, nls_codepage);
2857                 bcc_ptr += 2 * bytes_returned;
2858                 *(bcc_ptr + 1) = 0;
2859                 *(bcc_ptr + 2) = 0;
2860                 bcc_ptr += 2;   /* null terminate network opsys string */
2861                 *(bcc_ptr + 1) = 0;
2862                 *(bcc_ptr + 2) = 0;
2863                 bcc_ptr += 2;   /* null domain */
2864         } else {                /* ASCII */
2865                 if (domain == NULL) {
2866                         SecurityBlob->DomainName.Buffer = 0;
2867                         SecurityBlob->DomainName.Length = 0;
2868                         SecurityBlob->DomainName.MaximumLength = 0;
2869                 } else {
2870                         __u16 len;
2871                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2872                         strncpy(bcc_ptr, domain, 63);
2873                         len = strnlen(domain, 64);
2874                         SecurityBlob->DomainName.MaximumLength =
2875                             cpu_to_le16(len);
2876                         SecurityBlob->DomainName.Buffer =
2877                             cpu_to_le32(SecurityBlobLength);
2878                         bcc_ptr += len;
2879                         SecurityBlobLength += len;
2880                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
2881                 }
2882                 if (user == NULL) {
2883                         SecurityBlob->UserName.Buffer = 0;
2884                         SecurityBlob->UserName.Length = 0;
2885                         SecurityBlob->UserName.MaximumLength = 0;
2886                 } else {
2887                         __u16 len;
2888                         strncpy(bcc_ptr, user, 63);
2889                         len = strnlen(user, 64);
2890                         SecurityBlob->UserName.MaximumLength =
2891                             cpu_to_le16(len);
2892                         SecurityBlob->UserName.Buffer =
2893                             cpu_to_le32(SecurityBlobLength);
2894                         bcc_ptr += len;
2895                         SecurityBlobLength += len;
2896                         SecurityBlob->UserName.Length = cpu_to_le16(len);
2897                 }
2898                 /* BB fill in our workstation name if known BB */
2899
2900                 strcpy(bcc_ptr, "Linux version ");
2901                 bcc_ptr += strlen("Linux version ");
2902                 strcpy(bcc_ptr, utsname()->release);
2903                 bcc_ptr += strlen(utsname()->release) + 1;
2904                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2905                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2906                 bcc_ptr++;      /* null domain */
2907                 *bcc_ptr = 0;
2908         }
2909         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2910         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2911         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2912         smb_buffer->smb_buf_length += count;
2913         pSMB->req.ByteCount = cpu_to_le16(count);
2914
2915         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2916                          &bytes_returned, 1);
2917         if (rc) {
2918 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2919         } else if ((smb_buffer_response->WordCount == 3)
2920                    || (smb_buffer_response->WordCount == 4)) {
2921                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2922                 __u16 blob_len =
2923                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2924                 if (action & GUEST_LOGIN)
2925                         cFYI(1, (" Guest login"));      /* BB do we want to set anything in SesInfo struct ? */
2926 /*        if(SecurityBlob2->MessageType != NtLm??){
2927                  cFYI("Unexpected message type on auth response is %d "));
2928         } */
2929                 if (ses) {
2930                         cFYI(1,
2931                              ("Does UID on challenge %d match auth response UID %d ",
2932                               ses->Suid, smb_buffer_response->Uid));
2933                         ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2934                         bcc_ptr = pByteArea(smb_buffer_response);
2935             /* response can have either 3 or 4 word count - Samba sends 3 */
2936                         if ((pSMBr->resp.hdr.WordCount == 3)
2937                             || ((pSMBr->resp.hdr.WordCount == 4)
2938                                 && (blob_len <
2939                                     pSMBr->resp.ByteCount))) {
2940                                 if (pSMBr->resp.hdr.WordCount == 4) {
2941                                         bcc_ptr +=
2942                                             blob_len;
2943                                         cFYI(1,
2944                                              ("Security Blob Length %d ",
2945                                               blob_len));
2946                                 }
2947
2948                                 cFYI(1,
2949                                      ("NTLMSSP response to Authenticate "));
2950
2951                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2952                                         if ((long) (bcc_ptr) % 2) {
2953                                                 remaining_words =
2954                                                     (BCC(smb_buffer_response)
2955                                                      - 1) / 2;
2956                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2957                                         } else {
2958                                                 remaining_words = BCC(smb_buffer_response) / 2;
2959                                         }
2960                                         len =
2961                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
2962 /* We look for obvious messed up bcc or strings in response so we do not go off
2963   the end since (at least) WIN2K and Windows XP have a major bug in not null
2964   terminating last Unicode string in response  */
2965                                         if(ses->serverOS)
2966                                                 kfree(ses->serverOS);
2967                                         ses->serverOS =
2968                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2969                                         cifs_strfromUCS_le(ses->serverOS,
2970                                                            (__le16 *)
2971                                                            bcc_ptr, len,
2972                                                            nls_codepage);
2973                                         bcc_ptr += 2 * (len + 1);
2974                                         remaining_words -= len + 1;
2975                                         ses->serverOS[2 * len] = 0;
2976                                         ses->serverOS[1 + (2 * len)] = 0;
2977                                         if (remaining_words > 0) {
2978                                                 len = UniStrnlen((wchar_t *)
2979                                                                  bcc_ptr,
2980                                                                  remaining_words
2981                                                                  - 1);
2982                                                 kfree(ses->serverNOS);
2983                                                 ses->serverNOS =
2984                                                     kzalloc(2 * (len + 1),
2985                                                             GFP_KERNEL);
2986                                                 cifs_strfromUCS_le(ses->
2987                                                                    serverNOS,
2988                                                                    (__le16 *)
2989                                                                    bcc_ptr,
2990                                                                    len,
2991                                                                    nls_codepage);
2992                                                 bcc_ptr += 2 * (len + 1);
2993                                                 ses->serverNOS[2 * len] = 0;
2994                                                 ses->serverNOS[1+(2*len)] = 0;
2995                                                 remaining_words -= len + 1;
2996                                                 if (remaining_words > 0) {
2997                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2998      /* last string not always null terminated (e.g. for Windows XP & 2000) */
2999                                                         if(ses->serverDomain)
3000                                                                 kfree(ses->serverDomain);
3001                                                         ses->serverDomain =
3002                                                             kzalloc(2 *
3003                                                                     (len +
3004                                                                      1),
3005                                                                     GFP_KERNEL);
3006                                                         cifs_strfromUCS_le
3007                                                             (ses->
3008                                                              serverDomain,
3009                                                              (__le16 *)
3010                                                              bcc_ptr, len,
3011                                                              nls_codepage);
3012                                                         bcc_ptr +=
3013                                                             2 * (len + 1);
3014                                                         ses->
3015                                                             serverDomain[2
3016                                                                          * len]
3017                                                             = 0;
3018                                                         ses->
3019                                                             serverDomain[1
3020                                                                          +
3021                                                                          (2
3022                                                                           *
3023                                                                           len)]
3024                                                             = 0;
3025                                                 } /* else no more room so create dummy domain string */
3026                                                 else {
3027                                                         if(ses->serverDomain)
3028                                                                 kfree(ses->serverDomain);
3029                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3030                                                 }
3031                                         } else {  /* no room so create dummy domain and NOS string */
3032                                                 if(ses->serverDomain)
3033                                                         kfree(ses->serverDomain);
3034                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3035                                                 kfree(ses->serverNOS);
3036                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3037                                         }
3038                                 } else {        /* ASCII */
3039                                         len = strnlen(bcc_ptr, 1024);
3040                                         if (((long) bcc_ptr + len) -
3041                         (long) pByteArea(smb_buffer_response)
3042                             <= BCC(smb_buffer_response)) {
3043                                                 if(ses->serverOS)
3044                                                         kfree(ses->serverOS);
3045                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3046                                                 strncpy(ses->serverOS,bcc_ptr, len);
3047
3048                                                 bcc_ptr += len;
3049                                                 bcc_ptr[0] = 0; /* null terminate the string */
3050                                                 bcc_ptr++;
3051
3052                                                 len = strnlen(bcc_ptr, 1024);
3053                                                 kfree(ses->serverNOS);
3054                                                 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3055                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3056                                                 bcc_ptr += len;
3057                                                 bcc_ptr[0] = 0;
3058                                                 bcc_ptr++;
3059
3060                                                 len = strnlen(bcc_ptr, 1024);
3061                                                 if(ses->serverDomain)
3062                                                         kfree(ses->serverDomain);
3063                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3064                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3065                                                 bcc_ptr += len;
3066                                                 bcc_ptr[0] = 0;
3067                                                 bcc_ptr++;
3068                                         } else
3069                                                 cFYI(1,
3070                                                      ("Variable field of length %d extends beyond end of smb ",
3071                                                       len));
3072                                 }
3073                         } else {
3074                                 cERROR(1,
3075                                        (" Security Blob Length extends beyond end of SMB"));
3076                         }
3077                 } else {
3078                         cERROR(1, ("No session structure passed in."));
3079                 }
3080         } else {
3081                 cERROR(1,
3082                        (" Invalid Word count %d: ",
3083                         smb_buffer_response->WordCount));
3084                 rc = -EIO;
3085         }
3086
3087         if (smb_buffer)
3088                 cifs_buf_release(smb_buffer);
3089
3090         return rc;
3091 }
3092
3093 int
3094 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3095          const char *tree, struct cifsTconInfo *tcon,
3096          const struct nls_table *nls_codepage)
3097 {
3098         struct smb_hdr *smb_buffer;
3099         struct smb_hdr *smb_buffer_response;
3100         TCONX_REQ *pSMB;
3101         TCONX_RSP *pSMBr;
3102         unsigned char *bcc_ptr;
3103         int rc = 0;
3104         int length;
3105         __u16 count;
3106
3107         if (ses == NULL)
3108                 return -EIO;
3109
3110         smb_buffer = cifs_buf_get();
3111         if (smb_buffer == NULL) {
3112                 return -ENOMEM;
3113         }
3114         smb_buffer_response = smb_buffer;
3115
3116         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3117                         NULL /*no tid */ , 4 /*wct */ );
3118
3119         smb_buffer->Mid = GetNextMid(ses->server);
3120         smb_buffer->Uid = ses->Suid;
3121         pSMB = (TCONX_REQ *) smb_buffer;
3122         pSMBr = (TCONX_RSP *) smb_buffer_response;
3123
3124         pSMB->AndXCommand = 0xFF;
3125         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3126         bcc_ptr = &pSMB->Password[0];
3127         if((ses->server->secMode) & SECMODE_USER) {
3128                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3129                 *bcc_ptr = 0; /* password is null byte */
3130                 bcc_ptr++;              /* skip password */
3131                 /* already aligned so no need to do it below */
3132         } else {
3133                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3134                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3135                    specified as required (when that support is added to
3136                    the vfs in the future) as only NTLM or the much
3137                    weaker LANMAN (which we do not send by default) is accepted
3138                    by Samba (not sure whether other servers allow
3139                    NTLMv2 password here) */
3140 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3141                 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3142                         (ses->server->secType == LANMAN))
3143                         calc_lanman_hash(ses, bcc_ptr);
3144                 else
3145 #endif /* CIFS_WEAK_PW_HASH */
3146                 SMBNTencrypt(ses->password,
3147                              ses->server->cryptKey,
3148                              bcc_ptr);
3149
3150                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3151                 if(ses->capabilities & CAP_UNICODE) {
3152                         /* must align unicode strings */
3153                         *bcc_ptr = 0; /* null byte password */
3154                         bcc_ptr++;
3155                 }
3156         }
3157
3158         if(ses->server->secMode &
3159                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3160                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3161
3162         if (ses->capabilities & CAP_STATUS32) {
3163                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3164         }
3165         if (ses->capabilities & CAP_DFS) {
3166                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3167         }
3168         if (ses->capabilities & CAP_UNICODE) {
3169                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3170                 length =
3171                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3172                         6 /* max utf8 char length in bytes */ *
3173                         (/* server len*/ + 256 /* share len */), nls_codepage);
3174                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3175                 bcc_ptr += 2;   /* skip trailing null */
3176         } else {                /* ASCII */
3177                 strcpy(bcc_ptr, tree);
3178                 bcc_ptr += strlen(tree) + 1;
3179         }
3180         strcpy(bcc_ptr, "?????");
3181         bcc_ptr += strlen("?????");
3182         bcc_ptr += 1;
3183         count = bcc_ptr - &pSMB->Password[0];
3184         pSMB->hdr.smb_buf_length += count;
3185         pSMB->ByteCount = cpu_to_le16(count);
3186
3187         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3188
3189         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3190         /* above now done in SendReceive */
3191         if ((rc == 0) && (tcon != NULL)) {
3192                 tcon->tidStatus = CifsGood;
3193                 tcon->tid = smb_buffer_response->Tid;
3194                 bcc_ptr = pByteArea(smb_buffer_response);
3195                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3196         /* skip service field (NB: this field is always ASCII) */
3197                 bcc_ptr += length + 1;
3198                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3199                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3200                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3201                         if ((bcc_ptr + (2 * length)) -
3202                              pByteArea(smb_buffer_response) <=
3203                             BCC(smb_buffer_response)) {
3204                                 kfree(tcon->nativeFileSystem);
3205                                 tcon->nativeFileSystem =
3206                                     kzalloc(length + 2, GFP_KERNEL);
3207                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3208                                                    (__le16 *) bcc_ptr,
3209                                                    length, nls_codepage);
3210                                 bcc_ptr += 2 * length;
3211                                 bcc_ptr[0] = 0; /* null terminate the string */
3212                                 bcc_ptr[1] = 0;
3213                                 bcc_ptr += 2;
3214                         }
3215                         /* else do not bother copying these informational fields */
3216                 } else {
3217                         length = strnlen(bcc_ptr, 1024);
3218                         if ((bcc_ptr + length) -
3219                             pByteArea(smb_buffer_response) <=
3220                             BCC(smb_buffer_response)) {
3221                                 kfree(tcon->nativeFileSystem);
3222                                 tcon->nativeFileSystem =
3223                                     kzalloc(length + 1, GFP_KERNEL);
3224                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3225                                         length);
3226                         }
3227                         /* else do not bother copying these informational fields */
3228                 }
3229                 if((smb_buffer_response->WordCount == 3) ||
3230                          (smb_buffer_response->WordCount == 7))
3231                         /* field is in same location */
3232                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3233                 else
3234                         tcon->Flags = 0;
3235                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3236         } else if ((rc == 0) && tcon == NULL) {
3237         /* all we need to save for IPC$ connection */
3238                 ses->ipc_tid = smb_buffer_response->Tid;
3239         }
3240
3241         if (smb_buffer)
3242                 cifs_buf_release(smb_buffer);
3243         return rc;
3244 }
3245
3246 int
3247 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3248 {
3249         int rc = 0;
3250         int xid;
3251         struct cifsSesInfo *ses = NULL;
3252         struct task_struct *cifsd_task;
3253         char * tmp;
3254
3255         xid = GetXid();
3256
3257         if (cifs_sb->tcon) {
3258                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3259                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3260                 if (rc == -EBUSY) {
3261                         FreeXid(xid);
3262                         return 0;
3263                 }
3264                 tconInfoFree(cifs_sb->tcon);
3265                 if ((ses) && (ses->server)) {
3266                         /* save off task so we do not refer to ses later */
3267                         cifsd_task = ses->server->tsk;
3268                         cFYI(1, ("About to do SMBLogoff "));
3269                         rc = CIFSSMBLogoff(xid, ses);
3270                         if (rc == -EBUSY) {
3271                                 FreeXid(xid);
3272                                 return 0;
3273                         } else if (rc == -ESHUTDOWN) {
3274                                 cFYI(1,("Waking up socket by sending it signal"));
3275                                 if(cifsd_task) {
3276                                         send_sig(SIGKILL,cifsd_task,1);
3277                                         wait_for_completion(&cifsd_complete);
3278                                 }
3279                                 rc = 0;
3280                         } /* else - we have an smb session
3281                                 left on this socket do not kill cifsd */
3282                 } else
3283                         cFYI(1, ("No session or bad tcon"));
3284         }
3285
3286         cifs_sb->tcon = NULL;
3287         tmp = cifs_sb->prepath;
3288         cifs_sb->prepathlen = 0;
3289         cifs_sb->prepath = NULL;
3290         kfree(tmp);
3291         if (ses)
3292                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3293         if (ses)
3294                 sesInfoFree(ses);
3295
3296         FreeXid(xid);
3297         return rc;              /* BB check if we should always return zero here */
3298 }
3299
3300 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3301                                            struct nls_table * nls_info)
3302 {
3303         int rc = 0;
3304         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3305         int ntlmv2_flag = FALSE;
3306         int first_time = 0;
3307
3308         /* what if server changes its buffer size after dropping the session? */
3309         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3310                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3311                 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3312                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3313                         if(rc == -EAGAIN)
3314                                 rc = -EHOSTDOWN;
3315                 }
3316                 if(rc == 0) {
3317                         spin_lock(&GlobalMid_Lock);
3318                         if(pSesInfo->server->tcpStatus != CifsExiting)
3319                                 pSesInfo->server->tcpStatus = CifsGood;
3320                         else
3321                                 rc = -EHOSTDOWN;
3322                         spin_unlock(&GlobalMid_Lock);
3323
3324                 }
3325                 first_time = 1;
3326         }
3327         if (!rc) {
3328                 pSesInfo->flags = 0;
3329                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3330                 if(linuxExtEnabled == 0)
3331                         pSesInfo->capabilities &= (~CAP_UNIX);
3332         /*      pSesInfo->sequence_number = 0;*/
3333                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3334                         pSesInfo->server->secMode,
3335                         pSesInfo->server->capabilities,
3336                         pSesInfo->server->timeAdj));
3337                 if(experimEnabled < 2)
3338                         rc = CIFS_SessSetup(xid, pSesInfo,
3339                                             first_time, nls_info);
3340                 else if (extended_security
3341                                 && (pSesInfo->capabilities
3342                                         & CAP_EXTENDED_SECURITY)
3343                                 && (pSesInfo->server->secType == NTLMSSP)) {
3344                         rc = -EOPNOTSUPP;
3345                 } else if (extended_security
3346                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3347                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3348                         cFYI(1, ("NTLMSSP sesssetup"));
3349                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3350                                                 pSesInfo,
3351                                                 &ntlmv2_flag,
3352                                                 nls_info);
3353                         if (!rc) {
3354                                 if(ntlmv2_flag) {
3355                                         char * v2_response;
3356                                         cFYI(1,("more secure NTLM ver2 hash"));
3357                                         if(CalcNTLMv2_partial_mac_key(pSesInfo,
3358                                                 nls_info)) {
3359                                                 rc = -ENOMEM;
3360                                                 goto ss_err_exit;
3361                                         } else
3362                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3363                                         if(v2_response) {
3364                                                 CalcNTLMv2_response(pSesInfo,v2_response);
3365                                 /*              if(first_time)
3366                                                         cifs_calculate_ntlmv2_mac_key(
3367                                                           pSesInfo->server->mac_signing_key,
3368                                                           response, ntlm_session_key, */
3369                                                 kfree(v2_response);
3370                                         /* BB Put dummy sig in SessSetup PDU? */
3371                                         } else {
3372                                                 rc = -ENOMEM;
3373                                                 goto ss_err_exit;
3374                                         }
3375
3376                                 } else {
3377                                         SMBNTencrypt(pSesInfo->password,
3378                                                 pSesInfo->server->cryptKey,
3379                                                 ntlm_session_key);
3380
3381                                         if(first_time)
3382                                                 cifs_calculate_mac_key(
3383                                                         pSesInfo->server->mac_signing_key,
3384                                                         ntlm_session_key,
3385                                                         pSesInfo->password);
3386                                 }
3387                         /* for better security the weaker lanman hash not sent
3388                            in AuthSessSetup so we no longer calculate it */
3389
3390                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3391                                         pSesInfo,
3392                                         ntlm_session_key,
3393                                         ntlmv2_flag,
3394                                         nls_info);
3395                         }
3396                 } else { /* old style NTLM 0.12 session setup */
3397                         SMBNTencrypt(pSesInfo->password,
3398                                 pSesInfo->server->cryptKey,
3399                                 ntlm_session_key);
3400
3401                         if(first_time)
3402                                 cifs_calculate_mac_key(
3403                                         pSesInfo->server->mac_signing_key,
3404                                         ntlm_session_key, pSesInfo->password);
3405
3406                         rc = CIFSSessSetup(xid, pSesInfo,
3407                                 ntlm_session_key, nls_info);
3408                 }
3409                 if (rc) {
3410                         cERROR(1,("Send error in SessSetup = %d",rc));
3411                 } else {
3412                         cFYI(1,("CIFS Session Established successfully"));
3413                         pSesInfo->status = CifsGood;
3414                 }
3415         }
3416 ss_err_exit:
3417         return rc;
3418 }
3419