fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2006
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/pagevec.h>
  34 #include <asm/uaccess.h>
  35 #include <asm/processor.h>
  36 #include "cifspdu.h"
  37 #include "cifsglob.h"
  38 #include "cifsproto.h"
  39 #include "cifs_unicode.h"
  40 #include "cifs_debug.h"
  41 #include "cifs_fs_sb.h"
  42 #include "ntlmssp.h"
  43 #include "nterr.h"
  44 #include "rfc1002pdu.h"
  45 #include "cn_cifs.h"
  46
  47 #define CIFS_PORT 445
  48 #define RFC1001_PORT 139
  49
  50 static DECLARE_COMPLETION(cifsd_complete);
  51
  52 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  53                          unsigned char *p24);
  54
  55 extern mempool_t *cifs_req_poolp;
  56
  57 struct smb_vol {
  58         char *username;
  59         char *password;
  60         char *domainname;
  61         char *UNC;
  62         char *UNCip;
  63         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  64         char *iocharset;  /* local code page for mapping to and from Unicode */
  65         char source_rfc1001_name[16]; /* netbios name of client */
  66         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  67         uid_t linux_uid;
  68         gid_t linux_gid;
  69         mode_t file_mode;
  70         mode_t dir_mode;
  71         unsigned secFlg;
  72         unsigned rw:1;
  73         unsigned retry:1;
  74         unsigned intr:1;
  75         unsigned setuids:1;
  76         unsigned noperm:1;
  77         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  78         unsigned cifs_acl:1;
  79         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  80         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  81         unsigned direct_io:1;
  82         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  83         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  84         unsigned sfu_emul:1;
  85         unsigned nullauth:1; /* attempt to authenticate with null user */
  86         unsigned nocase;     /* request case insensitive filenames */
  87         unsigned nobrl;      /* disable sending byte range locks to srv */
  88         unsigned int rsize;
  89         unsigned int wsize;
  90         unsigned int sockopt;
  91         unsigned short int port;
  92         char * prepath;
  93 };
  94
  95 static int ipv4_connect(struct sockaddr_in *psin_server,
  96                         struct socket **csocket,
  97                         char * netb_name,
  98                         char * server_netb_name);
  99 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 100                         struct socket **csocket);
 101
 102
 103         /*
 104          * cifs tcp session reconnection
 105          *
 106          * mark tcp session as reconnecting so temporarily locked
 107          * mark all smb sessions as reconnecting for tcp session
 108          * reconnect tcp session
 109          * wake up waiters on reconnection? - (not needed currently)
 110          */
 111
 112 int
 113 cifs_reconnect(struct TCP_Server_Info *server)
 114 {
 115         int rc = 0;
 116         struct list_head *tmp;
 117         struct cifsSesInfo *ses;
 118         struct cifsTconInfo *tcon;
 119         struct mid_q_entry * mid_entry;
 120
 121         spin_lock(&GlobalMid_Lock);
 122         if(server->tcpStatus == CifsExiting) {
 123                 /* the demux thread will exit normally
 124                 next time through the loop */
 125                 spin_unlock(&GlobalMid_Lock);
 126                 return rc;
 127         } else
 128                 server->tcpStatus = CifsNeedReconnect;
 129         spin_unlock(&GlobalMid_Lock);
 130         server->maxBuf = 0;
 131
 132         cFYI(1, ("Reconnecting tcp session"));
 133
 134         /* before reconnecting the tcp session, mark the smb session (uid)
 135                 and the tid bad so they are not used until reconnected */
 136         read_lock(&GlobalSMBSeslock);
 137         list_for_each(tmp, &GlobalSMBSessionList) {
 138                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 139                 if (ses->server) {
 140                         if (ses->server == server) {
 141                                 ses->status = CifsNeedReconnect;
 142                                 ses->ipc_tid = 0;
 143                         }
 144                 }
 145                 /* else tcp and smb sessions need reconnection */
 146         }
 147         list_for_each(tmp, &GlobalTreeConnectionList) {
 148                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 149                 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 150                         tcon->tidStatus = CifsNeedReconnect;
 151                 }
 152         }
 153         read_unlock(&GlobalSMBSeslock);
 154         /* do not want to be sending data on a socket we are freeing */
 155         down(&server->tcpSem);
 156         if(server->ssocket) {
 157                 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 158                         server->ssocket->flags));
 159                 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
 160                 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
 161                         server->ssocket->flags));
 162                 sock_release(server->ssocket);
 163                 server->ssocket = NULL;
 164         }
 165
 166         spin_lock(&GlobalMid_Lock);
 167         list_for_each(tmp, &server->pending_mid_q) {
 168                 mid_entry = list_entry(tmp, struct
 169                                         mid_q_entry,
 170                                         qhead);
 171                 if(mid_entry) {
 172                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
 173                                 /* Mark other intransit requests as needing
 174                                    retry so we do not immediately mark the
 175                                    session bad again (ie after we reconnect
 176                                    below) as they timeout too */
 177                                 mid_entry->midState = MID_RETRY_NEEDED;
 178                         }
 179                 }
 180         }
 181         spin_unlock(&GlobalMid_Lock);
 182         up(&server->tcpSem);
 183
 184         while ((server->tcpStatus != CifsExiting) && (server->tcpStatus != CifsGood))
 185         {
 186                 try_to_freeze();
 187                 if(server->protocolType == IPV6) {
 188                         rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
 189                 } else {
 190                         rc = ipv4_connect(&server->addr.sockAddr,
 191                                         &server->ssocket,
 192                                         server->workstation_RFC1001_name,
 193                                         server->server_RFC1001_name);
 194                 }
 195                 if(rc) {
 196                         cFYI(1,("reconnect error %d",rc));
 197                         msleep(3000);
 198                 } else {
 199                         atomic_inc(&tcpSesReconnectCount);
 200                         spin_lock(&GlobalMid_Lock);
 201                         if(server->tcpStatus != CifsExiting)
 202                                 server->tcpStatus = CifsGood;
 203                         server->sequence_number = 0;
 204                         spin_unlock(&GlobalMid_Lock);
 205         /*              atomic_set(&server->inFlight,0);*/
 206                         wake_up(&server->response_q);
 207                 }
 208         }
 209         return rc;
 210 }
 211
 212 /*
 213         return codes:
 214                 0       not a transact2, or all data present
 215                 >0      transact2 with that much data missing
 216                 -EINVAL = invalid transact2
 217
 218  */
 219 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
 220 {
 221         struct smb_t2_rsp * pSMBt;
 222         int total_data_size;
 223         int data_in_this_rsp;
 224         int remaining;
 225
 226         if(pSMB->Command != SMB_COM_TRANSACTION2)
 227                 return 0;
 228
 229         /* check for plausible wct, bcc and t2 data and parm sizes */
 230         /* check for parm and data offset going beyond end of smb */
 231         if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 232                 cFYI(1,("invalid transact2 word count"));
 233                 return -EINVAL;
 234         }
 235
 236         pSMBt = (struct smb_t2_rsp *)pSMB;
 237
 238         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 239         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 240
 241         remaining = total_data_size - data_in_this_rsp;
 242
 243         if(remaining == 0)
 244                 return 0;
 245         else if(remaining < 0) {
 246                 cFYI(1,("total data %d smaller than data in frame %d",
 247                         total_data_size, data_in_this_rsp));
 248                 return -EINVAL;
 249         } else {
 250                 cFYI(1,("missing %d bytes from transact2, check next response",
 251                         remaining));
 252                 if(total_data_size > maxBufSize) {
 253                         cERROR(1,("TotalDataSize %d is over maximum buffer %d",
 254                                 total_data_size,maxBufSize));
 255                         return -EINVAL;
 256                 }
 257                 return remaining;
 258         }
 259 }
 260
 261 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
 262 {
 263         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 264         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 265         int total_data_size;
 266         int total_in_buf;
 267         int remaining;
 268         int total_in_buf2;
 269         char * data_area_of_target;
 270         char * data_area_of_buf2;
 271         __u16 byte_count;
 272
 273         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 274
 275         if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 276                 cFYI(1,("total data sizes of primary and secondary t2 differ"));
 277         }
 278
 279         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 280
 281         remaining = total_data_size - total_in_buf;
 282
 283         if(remaining < 0)
 284                 return -EINVAL;
 285
 286         if(remaining == 0) /* nothing to do, ignore */
 287                 return 0;
 288
 289         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 290         if(remaining < total_in_buf2) {
 291                 cFYI(1,("transact2 2nd response contains too much data"));
 292         }
 293
 294         /* find end of first SMB data area */
 295         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 296                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 297         /* validate target area */
 298
 299         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 300                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 301
 302         data_area_of_target += total_in_buf;
 303
 304         /* copy second buffer into end of first buffer */
 305         memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
 306         total_in_buf += total_in_buf2;
 307         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 308         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 309         byte_count += total_in_buf2;
 310         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 311
 312         byte_count = pTargetSMB->smb_buf_length;
 313         byte_count += total_in_buf2;
 314
 315         /* BB also add check that we are not beyond maximum buffer size */
 316
 317         pTargetSMB->smb_buf_length = byte_count;
 318
 319         if(remaining == total_in_buf2) {
 320                 cFYI(1,("found the last secondary response"));
 321                 return 0; /* we are done */
 322         } else /* more responses to go */
 323                 return 1;
 324
 325 }
 326
 327 static int
 328 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 329 {
 330         int length;
 331         unsigned int pdu_length, total_read;
 332         struct smb_hdr *smb_buffer = NULL;
 333         struct smb_hdr *bigbuf = NULL;
 334         struct smb_hdr *smallbuf = NULL;
 335         struct msghdr smb_msg;
 336         struct kvec iov;
 337         struct socket *csocket = server->ssocket;
 338         struct list_head *tmp;
 339         struct cifsSesInfo *ses;
 340         struct task_struct *task_to_wake = NULL;
 341         struct mid_q_entry *mid_entry;
 342         char temp;
 343         int isLargeBuf = FALSE;
 344         int isMultiRsp;
 345         int reconnect;
 346
 347         daemonize("cifsd");
 348         allow_signal(SIGKILL);
 349         current->flags |= PF_MEMALLOC;
 350         server->tsk = current;  /* save process info to wake at shutdown */
 351         cFYI(1, ("Demultiplex PID: %d", current->pid));
 352         write_lock(&GlobalSMBSeslock);
 353         atomic_inc(&tcpSesAllocCount);
 354         length = tcpSesAllocCount.counter;
 355         write_unlock(&GlobalSMBSeslock);
 356         complete(&cifsd_complete);
 357         if(length  > 1) {
 358                 mempool_resize(cifs_req_poolp,
 359                         length + cifs_min_rcv,
 360                         GFP_KERNEL);
 361         }
 362
 363         while (server->tcpStatus != CifsExiting) {
 364                 if (try_to_freeze())
 365                         continue;
 366                 if (bigbuf == NULL) {
 367                         bigbuf = cifs_buf_get();
 368                         if (!bigbuf) {
 369                                 cERROR(1, ("No memory for large SMB response"));
 370                                 msleep(3000);
 371                                 /* retry will check if exiting */
 372                                 continue;
 373                         }
 374                 } else if (isLargeBuf) {
 375                         /* we are reusing a dirty large buf, clear its start */
 376                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 377                 }
 378
 379                 if (smallbuf == NULL) {
 380                         smallbuf = cifs_small_buf_get();
 381                         if (!smallbuf) {
 382                                 cERROR(1, ("No memory for SMB response"));
 383                                 msleep(1000);
 384                                 /* retry will check if exiting */
 385                                 continue;
 386                         }
 387                         /* beginning of smb buffer is cleared in our buf_get */
 388                 } else /* if existing small buf clear beginning */
 389                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 390
 391                 isLargeBuf = FALSE;
 392                 isMultiRsp = FALSE;
 393                 smb_buffer = smallbuf;
 394                 iov.iov_base = smb_buffer;
 395                 iov.iov_len = 4;
 396                 smb_msg.msg_control = NULL;
 397                 smb_msg.msg_controllen = 0;
 398                 length =
 399                     kernel_recvmsg(csocket, &smb_msg,
 400                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 401
 402                 if (server->tcpStatus == CifsExiting) {
 403                         break;
 404                 } else if (server->tcpStatus == CifsNeedReconnect) {
 405                         cFYI(1, ("Reconnect after server stopped responding"));
 406                         cifs_reconnect(server);
 407                         cFYI(1, ("call to reconnect done"));
 408                         csocket = server->ssocket;
 409                         continue;
 410                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 411                         msleep(1); /* minimum sleep to prevent looping
 412                                 allowing socket to clear and app threads to set
 413                                 tcpStatus CifsNeedReconnect if server hung */
 414                         continue;
 415                 } else if (length <= 0) {
 416                         if (server->tcpStatus == CifsNew) {
 417                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 418                                 /* some servers kill the TCP session rather than
 419                                    returning an SMB negprot error, in which
 420                                    case reconnecting here is not going to help,
 421                                    and so simply return error to mount */
 422                                 break;
 423                         }
 424                         if (!try_to_freeze() && (length == -EINTR)) {
 425                                 cFYI(1,("cifsd thread killed"));
 426                                 break;
 427                         }
 428                         cFYI(1,("Reconnect after unexpected peek error %d",
 429                                 length));
 430                         cifs_reconnect(server);
 431                         csocket = server->ssocket;
 432                         wake_up(&server->response_q);
 433                         continue;
 434                 } else if (length < 4) {
 435                         cFYI(1,
 436                             ("Frame under four bytes received (%d bytes long)",
 437                               length));
 438                         cifs_reconnect(server);
 439                         csocket = server->ssocket;
 440                         wake_up(&server->response_q);
 441                         continue;
 442                 }
 443
 444                 /* The right amount was read from socket - 4 bytes */
 445                 /* so we can now interpret the length field */
 446
 447                 /* the first byte big endian of the length field,
 448                 is actually not part of the length but the type
 449                 with the most common, zero, as regular data */
 450                 temp = *((char *) smb_buffer);
 451
 452                 /* Note that FC 1001 length is big endian on the wire,
 453                 but we convert it here so it is always manipulated
 454                 as host byte order */
 455                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 456                 smb_buffer->smb_buf_length = pdu_length;
 457
 458                 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
 459
 460                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 461                         continue;
 462                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 463                         cFYI(1,("Good RFC 1002 session rsp"));
 464                         continue;
 465                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 466                         /* we get this from Windows 98 instead of
 467                            an error on SMB negprot response */
 468                         cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
 469                                 pdu_length));
 470                         if(server->tcpStatus == CifsNew) {
 471                                 /* if nack on negprot (rather than
 472                                 ret of smb negprot error) reconnecting
 473                                 not going to help, ret error to mount */
 474                                 break;
 475                         } else {
 476                                 /* give server a second to
 477                                 clean up before reconnect attempt */
 478                                 msleep(1000);
 479                                 /* always try 445 first on reconnect
 480                                 since we get NACK on some if we ever
 481                                 connected to port 139 (the NACK is
 482                                 since we do not begin with RFC1001
 483                                 session initialize frame) */
 484                                 server->addr.sockAddr.sin_port =
 485                                         htons(CIFS_PORT);
 486                                 cifs_reconnect(server);
 487                                 csocket = server->ssocket;
 488                                 wake_up(&server->response_q);
 489                                 continue;
 490                         }
 491                 } else if (temp != (char) 0) {
 492                         cERROR(1,("Unknown RFC 1002 frame"));
 493                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 494                                       length);
 495                         cifs_reconnect(server);
 496                         csocket = server->ssocket;
 497                         continue;
 498                 }
 499
 500                 /* else we have an SMB response */
 501                 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 502                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 503                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 504                                         length, pdu_length+4));
 505                         cifs_reconnect(server);
 506                         csocket = server->ssocket;
 507                         wake_up(&server->response_q);
 508                         continue;
 509                 }
 510
 511                 /* else length ok */
 512                 reconnect = 0;
 513
 514                 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 515                         isLargeBuf = TRUE;
 516                         memcpy(bigbuf, smallbuf, 4);
 517                         smb_buffer = bigbuf;
 518                 }
 519                 length = 0;
 520                 iov.iov_base = 4 + (char *)smb_buffer;
 521                 iov.iov_len = pdu_length;
 522                 for (total_read = 0; total_read < pdu_length;
 523                      total_read += length) {
 524                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 525                                                 pdu_length - total_read, 0);
 526                         if((server->tcpStatus == CifsExiting) ||
 527                             (length == -EINTR)) {
 528                                 /* then will exit */
 529                                 reconnect = 2;
 530                                 break;
 531                         } else if (server->tcpStatus == CifsNeedReconnect) {
 532                                 cifs_reconnect(server);
 533                                 csocket = server->ssocket;
 534                                 /* Reconnect wakes up rspns q */
 535                                 /* Now we will reread sock */
 536                                 reconnect = 1;
 537                                 break;
 538                         } else if ((length == -ERESTARTSYS) ||
 539                                    (length == -EAGAIN)) {
 540                                 msleep(1); /* minimum sleep to prevent looping,
 541                                               allowing socket to clear and app
 542                                               threads to set tcpStatus
 543                                               CifsNeedReconnect if server hung*/
 544                                 continue;
 545                         } else if (length <= 0) {
 546                                 cERROR(1,("Received no data, expecting %d",
 547                                               pdu_length - total_read));
 548                                 cifs_reconnect(server);
 549                                 csocket = server->ssocket;
 550                                 reconnect = 1;
 551                                 break;
 552                         }
 553                 }
 554                 if(reconnect == 2)
 555                         break;
 556                 else if(reconnect == 1)
 557                         continue;
 558
 559                 length += 4; /* account for rfc1002 hdr */
 560
 561
 562                 dump_smb(smb_buffer, length);
 563                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 564                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 565                         continue;
 566                 }
 567
 568
 569                 task_to_wake = NULL;
 570                 spin_lock(&GlobalMid_Lock);
 571                 list_for_each(tmp, &server->pending_mid_q) {
 572                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 573
 574                         if ((mid_entry->mid == smb_buffer->Mid) &&
 575                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 576                             (mid_entry->command == smb_buffer->Command)) {
 577                                 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
 578                                         /* We have a multipart transact2 resp */
 579                                         isMultiRsp = TRUE;
 580                                         if(mid_entry->resp_buf) {
 581                                                 /* merge response - fix up 1st*/
 582                                                 if(coalesce_t2(smb_buffer,
 583                                                         mid_entry->resp_buf)) {
 584                                                         mid_entry->multiRsp = 1;
 585                                                         break;
 586                                                 } else {
 587                                                         /* all parts received */
 588                                                         mid_entry->multiEnd = 1;
 589                                                         goto multi_t2_fnd;
 590                                                 }
 591                                         } else {
 592                                                 if(!isLargeBuf) {
 593                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 594                                         /* BB maybe we can fix this up,  switch
 595                                            to already allocated large buffer? */
 596                                                 } else {
 597                                                         /* Have first buffer */
 598                                                         mid_entry->resp_buf =
 599                                                                  smb_buffer;
 600                                                         mid_entry->largeBuf = 1;
 601                                                         bigbuf = NULL;
 602                                                 }
 603                                         }
 604                                         break;
 605                                 }
 606                                 mid_entry->resp_buf = smb_buffer;
 607                                 if(isLargeBuf)
 608                                         mid_entry->largeBuf = 1;
 609                                 else
 610                                         mid_entry->largeBuf = 0;
 611 multi_t2_fnd:
 612                                 task_to_wake = mid_entry->tsk;
 613                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 614 #ifdef CONFIG_CIFS_STATS2
 615                                 mid_entry->when_received = jiffies;
 616 #endif
 617                                 /* so we do not time out requests to  server
 618                                 which is still responding (since server could
 619                                 be busy but not dead) */
 620                                 server->lstrp = jiffies;
 621                                 break;
 622                         }
 623                 }
 624                 spin_unlock(&GlobalMid_Lock);
 625                 if (task_to_wake) {
 626                         /* Was previous buf put in mpx struct for multi-rsp? */
 627                         if(!isMultiRsp) {
 628                                 /* smb buffer will be freed by user thread */
 629                                 if(isLargeBuf) {
 630                                         bigbuf = NULL;
 631                                 } else
 632                                         smallbuf = NULL;
 633                         }
 634                         wake_up_process(task_to_wake);
 635                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 636                     && (isMultiRsp == FALSE)) {
 637                         cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
 638                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
 639                                       sizeof(struct smb_hdr));
 640 #ifdef CONFIG_CIFS_DEBUG2
 641                         cifs_dump_detail(smb_buffer);
 642                         cifs_dump_mids(server);
 643 #endif /* CIFS_DEBUG2 */
 644
 645                 }
 646         } /* end while !EXITING */
 647
 648         spin_lock(&GlobalMid_Lock);
 649         server->tcpStatus = CifsExiting;
 650         server->tsk = NULL;
 651         /* check if we have blocked requests that need to free */
 652         /* Note that cifs_max_pending is normally 50, but
 653         can be set at module install time to as little as two */
 654         if(atomic_read(&server->inFlight) >= cifs_max_pending)
 655                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 656         /* We do not want to set the max_pending too low or we
 657         could end up with the counter going negative */
 658         spin_unlock(&GlobalMid_Lock);
 659         /* Although there should not be any requests blocked on
 660         this queue it can not hurt to be paranoid and try to wake up requests
 661         that may haven been blocked when more than 50 at time were on the wire
 662         to the same server - they now will see the session is in exit state
 663         and get out of SendReceive.  */
 664         wake_up_all(&server->request_q);
 665         /* give those requests time to exit */
 666         msleep(125);
 667
 668         if(server->ssocket) {
 669                 sock_release(csocket);
 670                 server->ssocket = NULL;
 671         }
 672         /* buffer usuallly freed in free_mid - need to free it here on exit */
 673         if (bigbuf != NULL)
 674                 cifs_buf_release(bigbuf);
 675         if (smallbuf != NULL)
 676                 cifs_small_buf_release(smallbuf);
 677
 678         read_lock(&GlobalSMBSeslock);
 679         if (list_empty(&server->pending_mid_q)) {
 680                 /* loop through server session structures attached to this and
 681                     mark them dead */
 682                 list_for_each(tmp, &GlobalSMBSessionList) {
 683                         ses =
 684                             list_entry(tmp, struct cifsSesInfo,
 685                                        cifsSessionList);
 686                         if (ses->server == server) {
 687                                 ses->status = CifsExiting;
 688                                 ses->server = NULL;
 689                         }
 690                 }
 691                 read_unlock(&GlobalSMBSeslock);
 692         } else {
 693                 /* although we can not zero the server struct pointer yet,
 694                 since there are active requests which may depnd on them,
 695                 mark the corresponding SMB sessions as exiting too */
 696                 list_for_each(tmp, &GlobalSMBSessionList) {
 697                         ses = list_entry(tmp, struct cifsSesInfo,
 698                                          cifsSessionList);
 699                         if (ses->server == server) {
 700                                 ses->status = CifsExiting;
 701                         }
 702                 }
 703
 704                 spin_lock(&GlobalMid_Lock);
 705                 list_for_each(tmp, &server->pending_mid_q) {
 706                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 707                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 708                                 cFYI(1,
 709                                   ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
 710                                 task_to_wake = mid_entry->tsk;
 711                                 if(task_to_wake) {
 712                                         wake_up_process(task_to_wake);
 713                                 }
 714                         }
 715                 }
 716                 spin_unlock(&GlobalMid_Lock);
 717                 read_unlock(&GlobalSMBSeslock);
 718                 /* 1/8th of sec is more than enough time for them to exit */
 719                 msleep(125);
 720         }
 721
 722         if (!list_empty(&server->pending_mid_q)) {
 723                 /* mpx threads have not exited yet give them
 724                 at least the smb send timeout time for long ops */
 725                 /* due to delays on oplock break requests, we need
 726                 to wait at least 45 seconds before giving up
 727                 on a request getting a response and going ahead
 728                 and killing cifsd */
 729                 cFYI(1, ("Wait for exit from demultiplex thread"));
 730                 msleep(46000);
 731                 /* if threads still have not exited they are probably never
 732                 coming home not much else we can do but free the memory */
 733         }
 734
 735         write_lock(&GlobalSMBSeslock);
 736         atomic_dec(&tcpSesAllocCount);
 737         length = tcpSesAllocCount.counter;
 738
 739         /* last chance to mark ses pointers invalid
 740         if there are any pointing to this (e.g
 741         if a crazy root user tried to kill cifsd
 742         kernel thread explicitly this might happen) */
 743         list_for_each(tmp, &GlobalSMBSessionList) {
 744                 ses = list_entry(tmp, struct cifsSesInfo,
 745                                 cifsSessionList);
 746                 if (ses->server == server) {
 747                         ses->server = NULL;
 748                 }
 749         }
 750         write_unlock(&GlobalSMBSeslock);
 751
 752         kfree(server);
 753         if(length  > 0) {
 754                 mempool_resize(cifs_req_poolp,
 755                         length + cifs_min_rcv,
 756                         GFP_KERNEL);
 757         }
 758
 759         complete_and_exit(&cifsd_complete, 0);
 760         return 0;
 761 }
 762
 763 static int
 764 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 765 {
 766         char *value;
 767         char *data;
 768         unsigned int  temp_len, i, j;
 769         char separator[2];
 770
 771         separator[0] = ',';
 772         separator[1] = 0;
 773
 774         memset(vol->source_rfc1001_name,0x20,15);
 775         for(i=0;i < strnlen(system_utsname.nodename,15);i++) {
 776                 /* does not have to be a perfect mapping since the field is
 777                 informational, only used for servers that do not support
 778                 port 445 and it can be overridden at mount time */
 779                 vol->source_rfc1001_name[i] =
 780                         toupper(system_utsname.nodename[i]);
 781         }
 782         vol->source_rfc1001_name[15] = 0;
 783         /* null target name indicates to use *SMBSERVR default called name
 784            if we end up sending RFC1001 session initialize */
 785         vol->target_rfc1001_name[0] = 0;
 786         vol->linux_uid = current->uid;  /* current->euid instead? */
 787         vol->linux_gid = current->gid;
 788         vol->dir_mode = S_IRWXUGO;
 789         /* 2767 perms indicate mandatory locking support */
 790         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 791
 792         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 793         vol->rw = TRUE;
 794         /* default is always to request posix paths. */
 795         vol->posix_paths = 1;
 796
 797         if (!options)
 798                 return 1;
 799
 800         if(strncmp(options,"sep=",4) == 0) {
 801                 if(options[4] != 0) {
 802                         separator[0] = options[4];
 803                         options += 5;
 804                 } else {
 805                         cFYI(1,("Null separator not allowed"));
 806                 }
 807         }
 808
 809         while ((data = strsep(&options, separator)) != NULL) {
 810                 if (!*data)
 811                         continue;
 812                 if ((value = strchr(data, '=')) != NULL)
 813                         *value++ = '\0';
 814
 815                 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
 816                         vol->no_xattr = 0;
 817                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
 818                         vol->no_xattr = 1;
 819                 } else if (strnicmp(data, "user", 4) == 0) {
 820                         if (!value || !*value) {
 821                                 printk(KERN_WARNING
 822                                        "CIFS: invalid or missing username\n");
 823                                 return 1;       /* needs_arg; */
 824                         }
 825                         if (strnlen(value, 200) < 200) {
 826                                 vol->username = value;
 827                         } else {
 828                                 printk(KERN_WARNING "CIFS: username too long\n");
 829                                 return 1;
 830                         }
 831                 } else if (strnicmp(data, "pass", 4) == 0) {
 832                         if (!value) {
 833                                 vol->password = NULL;
 834                                 continue;
 835                         } else if(value[0] == 0) {
 836                                 /* check if string begins with double comma
 837                                    since that would mean the password really
 838                                    does start with a comma, and would not
 839                                    indicate an empty string */
 840                                 if(value[1] != separator[0]) {
 841                                         vol->password = NULL;
 842                                         continue;
 843                                 }
 844                         }
 845                         temp_len = strlen(value);
 846                         /* removed password length check, NTLM passwords
 847                                 can be arbitrarily long */
 848
 849                         /* if comma in password, the string will be
 850                         prematurely null terminated.  Commas in password are
 851                         specified across the cifs mount interface by a double
 852                         comma ie ,, and a comma used as in other cases ie ','
 853                         as a parameter delimiter/separator is single and due
 854                         to the strsep above is temporarily zeroed. */
 855
 856                         /* NB: password legally can have multiple commas and
 857                         the only illegal character in a password is null */
 858
 859                         if ((value[temp_len] == 0) &&
 860                             (value[temp_len+1] == separator[0])) {
 861                                 /* reinsert comma */
 862                                 value[temp_len] = separator[0];
 863                                 temp_len+=2;  /* move after the second comma */
 864                                 while(value[temp_len] != 0)  {
 865                                         if (value[temp_len] == separator[0]) {
 866                                                 if (value[temp_len+1] ==
 867                                                      separator[0]) {
 868                                                 /* skip second comma */
 869                                                         temp_len++;
 870                                                 } else {
 871                                                 /* single comma indicating start
 872                                                          of next parm */
 873                                                         break;
 874                                                 }
 875                                         }
 876                                         temp_len++;
 877                                 }
 878                                 if(value[temp_len] == 0) {
 879                                         options = NULL;
 880                                 } else {
 881                                         value[temp_len] = 0;
 882                                         /* point option to start of next parm */
 883                                         options = value + temp_len + 1;
 884                                 }
 885                                 /* go from value to value + temp_len condensing
 886                                 double commas to singles. Note that this ends up
 887                                 allocating a few bytes too many, which is ok */
 888                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 889                                 if(vol->password == NULL) {
 890                                         printk("CIFS: no memory for pass\n");
 891                                         return 1;
 892                                 }
 893                                 for(i=0,j=0;i<temp_len;i++,j++) {
 894                                         vol->password[j] = value[i];
 895                                         if(value[i] == separator[0]
 896                                                 && value[i+1] == separator[0]) {
 897                                                 /* skip second comma */
 898                                                 i++;
 899                                         }
 900                                 }
 901                                 vol->password[j] = 0;
 902                         } else {
 903                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 904                                 if(vol->password == NULL) {
 905                                         printk("CIFS: no memory for pass\n");
 906                                         return 1;
 907                                 }
 908                                 strcpy(vol->password, value);
 909                         }
 910                 } else if (strnicmp(data, "ip", 2) == 0) {
 911                         if (!value || !*value) {
 912                                 vol->UNCip = NULL;
 913                         } else if (strnlen(value, 35) < 35) {
 914                                 vol->UNCip = value;
 915                         } else {
 916                                 printk(KERN_WARNING "CIFS: ip address too long\n");
 917                                 return 1;
 918                         }
 919                 } else if (strnicmp(data, "sec", 3) == 0) {
 920                         if (!value || !*value) {
 921                                 cERROR(1,("no security value specified"));
 922                                 continue;
 923                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 924                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 925                                         CIFSSEC_MUST_SIGN;
 926                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 927                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 928                                         CIFSSEC_MAY_KRB5; */
 929                                 cERROR(1,("Krb5 cifs privacy not supported"));
 930                                 return 1;
 931                         } else if (strnicmp(value, "krb5", 4) == 0) {
 932                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 933                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 934                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 935                                         CIFSSEC_MUST_SIGN;
 936                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 937                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 938                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 939                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 940                                         CIFSSEC_MUST_SIGN;
 941                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 942                                 /* ntlm is default so can be turned off too */
 943                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 944                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 945                                 /* BB is there a better way to do this? */
 946                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 947 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 948                         } else if (strnicmp(value, "lanman", 6) == 0) {
 949                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 950 #endif
 951                         } else if (strnicmp(value, "none", 4) == 0) {
 952                                 vol->nullauth = 1;
 953                         } else {
 954                                 cERROR(1,("bad security option: %s", value));
 955                                 return 1;
 956                         }
 957                 } else if ((strnicmp(data, "unc", 3) == 0)
 958                            || (strnicmp(data, "target", 6) == 0)
 959                            || (strnicmp(data, "path", 4) == 0)) {
 960                         if (!value || !*value) {
 961                                 printk(KERN_WARNING
 962                                        "CIFS: invalid path to network resource\n");
 963                                 return 1;       /* needs_arg; */
 964                         }
 965                         if ((temp_len = strnlen(value, 300)) < 300) {
 966                                 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
 967                                 if(vol->UNC == NULL)
 968                                         return 1;
 969                                 strcpy(vol->UNC,value);
 970                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 971                                         vol->UNC[0] = '\\';
 972                                         vol->UNC[1] = '\\';
 973                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 974                                         printk(KERN_WARNING
 975                                                "CIFS: UNC Path does not begin with // or \\\\ \n");
 976                                         return 1;
 977                                 }
 978                         } else {
 979                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 980                                 return 1;
 981                         }
 982                 } else if ((strnicmp(data, "domain", 3) == 0)
 983                            || (strnicmp(data, "workgroup", 5) == 0)) {
 984                         if (!value || !*value) {
 985                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
 986                                 return 1;       /* needs_arg; */
 987                         }
 988                         /* BB are there cases in which a comma can be valid in
 989                         a domain name and need special handling? */
 990                         if (strnlen(value, 256) < 256) {
 991                                 vol->domainname = value;
 992                                 cFYI(1, ("Domain name set"));
 993                         } else {
 994                                 printk(KERN_WARNING "CIFS: domain name too long\n");
 995                                 return 1;
 996                         }
 997                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
 998                         if (!value || !*value) {
 999                                 printk(KERN_WARNING
1000                                        "CIFS: invalid path prefix\n");
1001                                 return 1;       /* needs_arg; */
1002                         }
1003                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1004                                 if(value[0] != '/')
1005                                         temp_len++;  /* missing leading slash */
1006                                 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1007                                 if(vol->prepath == NULL)
1008                                         return 1;
1009                                 if(value[0] != '/') {
1010                                         vol->prepath[0] = '/';
1011                                         strcpy(vol->prepath+1,value);
1012                                 } else
1013                                         strcpy(vol->prepath,value);
1014                                 cFYI(1,("prefix path %s",vol->prepath));
1015                         } else {
1016                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1017                                 return 1;
1018                         }
1019                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1020                         if (!value || !*value) {
1021                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1022                                 return 1;       /* needs_arg; */
1023                         }
1024                         if (strnlen(value, 65) < 65) {
1025                                 if(strnicmp(value,"default",7))
1026                                         vol->iocharset = value;
1027                                 /* if iocharset not set load_nls_default used by caller */
1028                                 cFYI(1, ("iocharset set to %s",value));
1029                         } else {
1030                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1031                                 return 1;
1032                         }
1033                 } else if (strnicmp(data, "uid", 3) == 0) {
1034                         if (value && *value) {
1035                                 vol->linux_uid =
1036                                         simple_strtoul(value, &value, 0);
1037                         }
1038                 } else if (strnicmp(data, "gid", 3) == 0) {
1039                         if (value && *value) {
1040                                 vol->linux_gid =
1041                                         simple_strtoul(value, &value, 0);
1042                         }
1043                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1044                         if (value && *value) {
1045                                 vol->file_mode =
1046                                         simple_strtoul(value, &value, 0);
1047                         }
1048                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1049                         if (value && *value) {
1050                                 vol->dir_mode =
1051                                         simple_strtoul(value, &value, 0);
1052                         }
1053                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1054                         if (value && *value) {
1055                                 vol->dir_mode =
1056                                         simple_strtoul(value, &value, 0);
1057                         }
1058                 } else if (strnicmp(data, "port", 4) == 0) {
1059                         if (value && *value) {
1060                                 vol->port =
1061                                         simple_strtoul(value, &value, 0);
1062                         }
1063                 } else if (strnicmp(data, "rsize", 5) == 0) {
1064                         if (value && *value) {
1065                                 vol->rsize =
1066                                         simple_strtoul(value, &value, 0);
1067                         }
1068                 } else if (strnicmp(data, "wsize", 5) == 0) {
1069                         if (value && *value) {
1070                                 vol->wsize =
1071                                         simple_strtoul(value, &value, 0);
1072                         }
1073                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1074                         if (value && *value) {
1075                                 vol->sockopt =
1076                                         simple_strtoul(value, &value, 0);
1077                         }
1078                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1079                         if (!value || !*value || (*value == ' ')) {
1080                                 cFYI(1,("invalid (empty) netbiosname specified"));
1081                         } else {
1082                                 memset(vol->source_rfc1001_name,0x20,15);
1083                                 for(i=0;i<15;i++) {
1084                                 /* BB are there cases in which a comma can be
1085                                 valid in this workstation netbios name (and need
1086                                 special handling)? */
1087
1088                                 /* We do not uppercase netbiosname for user */
1089                                         if (value[i]==0)
1090                                                 break;
1091                                         else
1092                                                 vol->source_rfc1001_name[i] = value[i];
1093                                 }
1094                                 /* The string has 16th byte zero still from
1095                                 set at top of the function  */
1096                                 if((i==15) && (value[i] != 0))
1097                                         printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1098                         }
1099                 } else if (strnicmp(data, "servern", 7) == 0) {
1100                         /* servernetbiosname specified override *SMBSERVER */
1101                         if (!value || !*value || (*value == ' ')) {
1102                                 cFYI(1,("empty server netbiosname specified"));
1103                         } else {
1104                                 /* last byte, type, is 0x20 for servr type */
1105                                 memset(vol->target_rfc1001_name,0x20,16);
1106
1107                                 for(i=0;i<15;i++) {
1108                                 /* BB are there cases in which a comma can be
1109                                    valid in this workstation netbios name (and need
1110                                    special handling)? */
1111
1112                                 /* user or mount helper must uppercase netbiosname */
1113                                         if (value[i]==0)
1114                                                 break;
1115                                         else
1116                                                 vol->target_rfc1001_name[i] = value[i];
1117                                 }
1118                                 /* The string has 16th byte zero still from
1119                                    set at top of the function  */
1120                                 if((i==15) && (value[i] != 0))
1121                                         printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1122                         }
1123                 } else if (strnicmp(data, "credentials", 4) == 0) {
1124                         /* ignore */
1125                 } else if (strnicmp(data, "version", 3) == 0) {
1126                         /* ignore */
1127                 } else if (strnicmp(data, "guest",5) == 0) {
1128                         /* ignore */
1129                 } else if (strnicmp(data, "rw", 2) == 0) {
1130                         vol->rw = TRUE;
1131                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1132                                    (strnicmp(data, "nosuid", 6) == 0) ||
1133                                    (strnicmp(data, "exec", 4) == 0) ||
1134                                    (strnicmp(data, "noexec", 6) == 0) ||
1135                                    (strnicmp(data, "nodev", 5) == 0) ||
1136                                    (strnicmp(data, "noauto", 6) == 0) ||
1137                                    (strnicmp(data, "dev", 3) == 0)) {
1138                         /*  The mount tool or mount.cifs helper (if present)
1139                                 uses these opts to set flags, and the flags are read
1140                                 by the kernel vfs layer before we get here (ie
1141                                 before read super) so there is no point trying to
1142                                 parse these options again and set anything and it
1143                                 is ok to just ignore them */
1144                         continue;
1145                 } else if (strnicmp(data, "ro", 2) == 0) {
1146                         vol->rw = FALSE;
1147                 } else if (strnicmp(data, "hard", 4) == 0) {
1148                         vol->retry = 1;
1149                 } else if (strnicmp(data, "soft", 4) == 0) {
1150                         vol->retry = 0;
1151                 } else if (strnicmp(data, "perm", 4) == 0) {
1152                         vol->noperm = 0;
1153                 } else if (strnicmp(data, "noperm", 6) == 0) {
1154                         vol->noperm = 1;
1155                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1156                         vol->remap = 1;
1157                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1158                         vol->remap = 0;
1159                 } else if (strnicmp(data, "sfu", 3) == 0) {
1160                         vol->sfu_emul = 1;
1161                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1162                         vol->sfu_emul = 0;
1163                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1164                         vol->posix_paths = 1;
1165                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1166                         vol->posix_paths = 0;
1167                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1168                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1169                         vol->nocase = 1;
1170                 } else if (strnicmp(data, "brl", 3) == 0) {
1171                         vol->nobrl =  0;
1172                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1173                            (strnicmp(data, "nolock", 6) == 0)) {
1174                         vol->nobrl =  1;
1175                         /* turn off mandatory locking in mode
1176                         if remote locking is turned off since the
1177                         local vfs will do advisory */
1178                         if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1179                                 vol->file_mode = S_IALLUGO;
1180                 } else if (strnicmp(data, "setuids", 7) == 0) {
1181                         vol->setuids = 1;
1182                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1183                         vol->setuids = 0;
1184                 } else if (strnicmp(data, "nohard", 6) == 0) {
1185                         vol->retry = 0;
1186                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1187                         vol->retry = 1;
1188                 } else if (strnicmp(data, "nointr", 6) == 0) {
1189                         vol->intr = 0;
1190                 } else if (strnicmp(data, "intr", 4) == 0) {
1191                         vol->intr = 1;
1192                 } else if (strnicmp(data, "serverino",7) == 0) {
1193                         vol->server_ino = 1;
1194                 } else if (strnicmp(data, "noserverino",9) == 0) {
1195                         vol->server_ino = 0;
1196                 } else if (strnicmp(data, "cifsacl",7) == 0) {
1197                         vol->cifs_acl = 1;
1198                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1199                         vol->cifs_acl = 0;
1200                 } else if (strnicmp(data, "acl",3) == 0) {
1201                         vol->no_psx_acl = 0;
1202                 } else if (strnicmp(data, "noacl",5) == 0) {
1203                         vol->no_psx_acl = 1;
1204                 } else if (strnicmp(data, "sign",4) == 0) {
1205                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1206 /*              } else if (strnicmp(data, "seal",4) == 0) {
1207                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1208                 } else if (strnicmp(data, "direct",6) == 0) {
1209                         vol->direct_io = 1;
1210                 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1211                         vol->direct_io = 1;
1212                 } else if (strnicmp(data, "in6_addr",8) == 0) {
1213                         if (!value || !*value) {
1214                                 vol->in6_addr = NULL;
1215                         } else if (strnlen(value, 49) == 48) {
1216                                 vol->in6_addr = value;
1217                         } else {
1218                                 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1219                                 return 1;
1220                         }
1221                 } else if (strnicmp(data, "noac", 4) == 0) {
1222                         printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1223                 } else
1224                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1225         }
1226         if (vol->UNC == NULL) {
1227                 if(devname == NULL) {
1228                         printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1229                         return 1;
1230                 }
1231                 if ((temp_len = strnlen(devname, 300)) < 300) {
1232                         vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1233                         if(vol->UNC == NULL)
1234                                 return 1;
1235                         strcpy(vol->UNC,devname);
1236                         if (strncmp(vol->UNC, "//", 2) == 0) {
1237                                 vol->UNC[0] = '\\';
1238                                 vol->UNC[1] = '\\';
1239                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1240                                 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1241                                 return 1;
1242                         }
1243                 } else {
1244                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1245                         return 1;
1246                 }
1247         }
1248         if(vol->UNCip == NULL)
1249                 vol->UNCip = &vol->UNC[2];
1250
1251         return 0;
1252 }
1253
1254 static struct cifsSesInfo *
1255 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1256                 struct in6_addr *target_ip6_addr,
1257                  char *userName, struct TCP_Server_Info **psrvTcp)
1258 {
1259         struct list_head *tmp;
1260         struct cifsSesInfo *ses;
1261         *psrvTcp = NULL;
1262         read_lock(&GlobalSMBSeslock);
1263
1264         list_for_each(tmp, &GlobalSMBSessionList) {
1265                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1266                 if (ses->server) {
1267                         if((target_ip_addr &&
1268                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1269                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1270                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1271                                         target_ip6_addr,sizeof(*target_ip6_addr)))){
1272                                 /* BB lock server and tcp session and increment use count here?? */
1273                                 *psrvTcp = ses->server; /* found a match on the TCP session */
1274                                 /* BB check if reconnection needed */
1275                                 if (strncmp
1276                                     (ses->userName, userName,
1277                                      MAX_USERNAME_SIZE) == 0){
1278                                         read_unlock(&GlobalSMBSeslock);
1279                                         return ses;     /* found exact match on both tcp and SMB sessions */
1280                                 }
1281                         }
1282                 }
1283                 /* else tcp and smb sessions need reconnection */
1284         }
1285         read_unlock(&GlobalSMBSeslock);
1286         return NULL;
1287 }
1288
1289 static struct cifsTconInfo *
1290 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1291 {
1292         struct list_head *tmp;
1293         struct cifsTconInfo *tcon;
1294
1295         read_lock(&GlobalSMBSeslock);
1296         list_for_each(tmp, &GlobalTreeConnectionList) {
1297                 cFYI(1, ("Next tcon"));
1298                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1299                 if (tcon->ses) {
1300                         if (tcon->ses->server) {
1301                                 cFYI(1,
1302                                      ("old ip addr: %x == new ip %x ?",
1303                                       tcon->ses->server->addr.sockAddr.sin_addr.
1304                                       s_addr, new_target_ip_addr));
1305                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1306                                     s_addr == new_target_ip_addr) {
1307         /* BB lock tcon, server and tcp session and increment use count here? */
1308                                         /* found a match on the TCP session */
1309                                         /* BB check if reconnection needed */
1310                                         cFYI(1,("IP match, old UNC: %s new: %s",
1311                                               tcon->treeName, uncName));
1312                                         if (strncmp
1313                                             (tcon->treeName, uncName,
1314                                              MAX_TREE_SIZE) == 0) {
1315                                                 cFYI(1,
1316                                                      ("and old usr: %s new: %s",
1317                                                       tcon->treeName, uncName));
1318                                                 if (strncmp
1319                                                     (tcon->ses->userName,
1320                                                      userName,
1321                                                      MAX_USERNAME_SIZE) == 0) {
1322                                                         read_unlock(&GlobalSMBSeslock);
1323                                                         /* matched smb session
1324                                                         (user name */
1325                                                         return tcon;
1326                                                 }
1327                                         }
1328                                 }
1329                         }
1330                 }
1331         }
1332         read_unlock(&GlobalSMBSeslock);
1333         return NULL;
1334 }
1335
1336 int
1337 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1338                     const char *old_path, const struct nls_table *nls_codepage,
1339                     int remap)
1340 {
1341         unsigned char *referrals = NULL;
1342         unsigned int num_referrals;
1343         int rc = 0;
1344
1345         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1346                         &num_referrals, &referrals, remap);
1347
1348         /* BB Add in code to: if valid refrl, if not ip address contact
1349                 the helper that resolves tcp names, mount to it, try to
1350                 tcon to it unmount it if fail */
1351
1352         kfree(referrals);
1353
1354         return rc;
1355 }
1356
1357 int
1358 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1359                         const char *old_path, const struct nls_table *nls_codepage,
1360                         unsigned int *pnum_referrals,
1361                         unsigned char ** preferrals, int remap)
1362 {
1363         char *temp_unc;
1364         int rc = 0;
1365
1366         *pnum_referrals = 0;
1367
1368         if (pSesInfo->ipc_tid == 0) {
1369                 temp_unc = kmalloc(2 /* for slashes */ +
1370                         strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1371                                  + 1 + 4 /* slash IPC$ */  + 2,
1372                                 GFP_KERNEL);
1373                 if (temp_unc == NULL)
1374                         return -ENOMEM;
1375                 temp_unc[0] = '\\';
1376                 temp_unc[1] = '\\';
1377                 strcpy(temp_unc + 2, pSesInfo->serverName);
1378                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1379                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1380                 cFYI(1,
1381                      ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1382                 kfree(temp_unc);
1383         }
1384         if (rc == 0)
1385                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1386                                      pnum_referrals, nls_codepage, remap);
1387
1388         return rc;
1389 }
1390
1391 /* See RFC1001 section 14 on representation of Netbios names */
1392 static void rfc1002mangle(char * target,char * source, unsigned int length)
1393 {
1394         unsigned int i,j;
1395
1396         for(i=0,j=0;i<(length);i++) {
1397                 /* mask a nibble at a time and encode */
1398                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1399                 target[j+1] = 'A' + (0x0F & source[i]);
1400                 j+=2;
1401         }
1402
1403 }
1404
1405
1406 static int
1407 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1408              char * netbios_name, char * target_name)
1409 {
1410         int rc = 0;
1411         int connected = 0;
1412         __be16 orig_port = 0;
1413
1414         if(*csocket == NULL) {
1415                 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1416                 if (rc < 0) {
1417                         cERROR(1, ("Error %d creating socket",rc));
1418                         *csocket = NULL;
1419                         return rc;
1420                 } else {
1421                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1422                         cFYI(1,("Socket created"));
1423                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1424                 }
1425         }
1426
1427         psin_server->sin_family = AF_INET;
1428         if(psin_server->sin_port) { /* user overrode default port */
1429                 rc = (*csocket)->ops->connect(*csocket,
1430                                 (struct sockaddr *) psin_server,
1431                                 sizeof (struct sockaddr_in),0);
1432                 if (rc >= 0)
1433                         connected = 1;
1434         }
1435
1436         if(!connected) {
1437                 /* save original port so we can retry user specified port
1438                         later if fall back ports fail this time  */
1439                 orig_port = psin_server->sin_port;
1440
1441                 /* do not retry on the same port we just failed on */
1442                 if(psin_server->sin_port != htons(CIFS_PORT)) {
1443                         psin_server->sin_port = htons(CIFS_PORT);
1444
1445                         rc = (*csocket)->ops->connect(*csocket,
1446                                         (struct sockaddr *) psin_server,
1447                                         sizeof (struct sockaddr_in),0);
1448                         if (rc >= 0)
1449                                 connected = 1;
1450                 }
1451         }
1452         if (!connected) {
1453                 psin_server->sin_port = htons(RFC1001_PORT);
1454                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1455                                               psin_server, sizeof (struct sockaddr_in),0);
1456                 if (rc >= 0)
1457                         connected = 1;
1458         }
1459
1460         /* give up here - unless we want to retry on different
1461                 protocol families some day */
1462         if (!connected) {
1463                 if(orig_port)
1464                         psin_server->sin_port = orig_port;
1465                 cFYI(1,("Error %d connecting to server via ipv4",rc));
1466                 sock_release(*csocket);
1467                 *csocket = NULL;
1468                 return rc;
1469         }
1470         /* Eventually check for other socket options to change from
1471                 the default. sock_setsockopt not used because it expects
1472                 user space buffer */
1473          cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1474                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1475         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1476         /* make the bufsizes depend on wsize/rsize and max requests */
1477         if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1478                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1479         if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1480                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1481
1482         /* send RFC1001 sessinit */
1483         if(psin_server->sin_port == htons(RFC1001_PORT)) {
1484                 /* some servers require RFC1001 sessinit before sending
1485                 negprot - BB check reconnection in case where second
1486                 sessinit is sent but no second negprot */
1487                 struct rfc1002_session_packet * ses_init_buf;
1488                 struct smb_hdr * smb_buf;
1489                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1490                 if(ses_init_buf) {
1491                         ses_init_buf->trailer.session_req.called_len = 32;
1492                         if(target_name && (target_name[0] != 0)) {
1493                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1494                                         target_name, 16);
1495                         } else {
1496                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1497                                         DEFAULT_CIFS_CALLED_NAME,16);
1498                         }
1499
1500                         ses_init_buf->trailer.session_req.calling_len = 32;
1501                         /* calling name ends in null (byte 16) from old smb
1502                         convention. */
1503                         if(netbios_name && (netbios_name[0] !=0)) {
1504                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1505                                         netbios_name,16);
1506                         } else {
1507                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1508                                         "LINUX_CIFS_CLNT",16);
1509                         }
1510                         ses_init_buf->trailer.session_req.scope1 = 0;
1511                         ses_init_buf->trailer.session_req.scope2 = 0;
1512                         smb_buf = (struct smb_hdr *)ses_init_buf;
1513                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1514                         smb_buf->smb_buf_length = 0x81000044;
1515                         rc = smb_send(*csocket, smb_buf, 0x44,
1516                                 (struct sockaddr *)psin_server);
1517                         kfree(ses_init_buf);
1518                         msleep(1); /* RFC1001 layer in at least one server
1519                                       requires very short break before negprot
1520                                       presumably because not expecting negprot
1521                                       to follow so fast.  This is a simple
1522                                       solution that works without
1523                                       complicating the code and causes no
1524                                       significant slowing down on mount
1525                                       for everyone else */
1526                 }
1527                 /* else the negprot may still work without this
1528                 even though malloc failed */
1529
1530         }
1531
1532         return rc;
1533 }
1534
1535 static int
1536 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1537 {
1538         int rc = 0;
1539         int connected = 0;
1540         __be16 orig_port = 0;
1541
1542         if(*csocket == NULL) {
1543                 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1544                 if (rc < 0) {
1545                         cERROR(1, ("Error %d creating ipv6 socket",rc));
1546                         *csocket = NULL;
1547                         return rc;
1548                 } else {
1549                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1550                          cFYI(1,("ipv6 Socket created"));
1551                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1552                 }
1553         }
1554
1555         psin_server->sin6_family = AF_INET6;
1556
1557         if(psin_server->sin6_port) { /* user overrode default port */
1558                 rc = (*csocket)->ops->connect(*csocket,
1559                                 (struct sockaddr *) psin_server,
1560                                 sizeof (struct sockaddr_in6),0);
1561                 if (rc >= 0)
1562                         connected = 1;
1563         }
1564
1565         if(!connected) {
1566                 /* save original port so we can retry user specified port
1567                         later if fall back ports fail this time  */
1568
1569                 orig_port = psin_server->sin6_port;
1570                 /* do not retry on the same port we just failed on */
1571                 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1572                         psin_server->sin6_port = htons(CIFS_PORT);
1573
1574                         rc = (*csocket)->ops->connect(*csocket,
1575                                         (struct sockaddr *) psin_server,
1576                                         sizeof (struct sockaddr_in6),0);
1577                         if (rc >= 0)
1578                                 connected = 1;
1579                 }
1580         }
1581         if (!connected) {
1582                 psin_server->sin6_port = htons(RFC1001_PORT);
1583                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1584                                          psin_server, sizeof (struct sockaddr_in6),0);
1585                 if (rc >= 0)
1586                         connected = 1;
1587         }
1588
1589         /* give up here - unless we want to retry on different
1590                 protocol families some day */
1591         if (!connected) {
1592                 if(orig_port)
1593                         psin_server->sin6_port = orig_port;
1594                 cFYI(1,("Error %d connecting to server via ipv6",rc));
1595                 sock_release(*csocket);
1596                 *csocket = NULL;
1597                 return rc;
1598         }
1599         /* Eventually check for other socket options to change from
1600                 the default. sock_setsockopt not used because it expects
1601                 user space buffer */
1602         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1603
1604         return rc;
1605 }
1606
1607 int
1608 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1609            char *mount_data, const char *devname)
1610 {
1611         int rc = 0;
1612         int xid;
1613         int address_type = AF_INET;
1614         struct socket *csocket = NULL;
1615         struct sockaddr_in sin_server;
1616         struct sockaddr_in6 sin_server6;
1617         struct smb_vol volume_info;
1618         struct cifsSesInfo *pSesInfo = NULL;
1619         struct cifsSesInfo *existingCifsSes = NULL;
1620         struct cifsTconInfo *tcon = NULL;
1621         struct TCP_Server_Info *srvTcp = NULL;
1622
1623         xid = GetXid();
1624
1625 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1626
1627         memset(&volume_info,0,sizeof(struct smb_vol));
1628         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1629                 kfree(volume_info.UNC);
1630                 kfree(volume_info.password);
1631                 kfree(volume_info.prepath);
1632                 FreeXid(xid);
1633                 return -EINVAL;
1634         }
1635
1636         if (volume_info.username) {
1637                 /* BB fixme parse for domain name here */
1638                 cFYI(1, ("Username: %s ", volume_info.username));
1639
1640         } else {
1641                 cifserror("No username specified");
1642         /* In userspace mount helper we can get user name from alternate
1643            locations such as env variables and files on disk */
1644                 kfree(volume_info.UNC);
1645                 kfree(volume_info.password);
1646                 kfree(volume_info.prepath);
1647                 FreeXid(xid);
1648                 return -EINVAL;
1649         }
1650
1651         if (volume_info.UNCip && volume_info.UNC) {
1652                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1653
1654                 if(rc <= 0) {
1655                         /* not ipv4 address, try ipv6 */
1656                         rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1657                         if(rc > 0)
1658                                 address_type = AF_INET6;
1659                 } else {
1660                         address_type = AF_INET;
1661                 }
1662
1663                 if(rc <= 0) {
1664                         /* we failed translating address */
1665                         kfree(volume_info.UNC);
1666                         kfree(volume_info.password);
1667                         kfree(volume_info.prepath);
1668                         FreeXid(xid);
1669                         return -EINVAL;
1670                 }
1671
1672                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1673                 /* success */
1674                 rc = 0;
1675         } else if (volume_info.UNCip){
1676                 /* BB using ip addr as server name connect to the DFS root below */
1677                 cERROR(1,("Connecting to DFS root not implemented yet"));
1678                 kfree(volume_info.UNC);
1679                 kfree(volume_info.password);
1680                 kfree(volume_info.prepath);
1681                 FreeXid(xid);
1682                 return -EINVAL;
1683         } else /* which servers DFS root would we conect to */ {
1684                 cERROR(1,
1685                        ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1686                 kfree(volume_info.UNC);
1687                 kfree(volume_info.password);
1688                 kfree(volume_info.prepath);
1689                 FreeXid(xid);
1690                 return -EINVAL;
1691         }
1692
1693         /* this is needed for ASCII cp to Unicode converts */
1694         if(volume_info.iocharset == NULL) {
1695                 cifs_sb->local_nls = load_nls_default();
1696         /* load_nls_default can not return null */
1697         } else {
1698                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1699                 if(cifs_sb->local_nls == NULL) {
1700                         cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1701                         kfree(volume_info.UNC);
1702                         kfree(volume_info.password);
1703                         kfree(volume_info.prepath);
1704                         FreeXid(xid);
1705                         return -ELIBACC;
1706                 }
1707         }
1708
1709         if(address_type == AF_INET)
1710                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1711                         NULL /* no ipv6 addr */,
1712                         volume_info.username, &srvTcp);
1713         else if(address_type == AF_INET6)
1714                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1715                         &sin_server6.sin6_addr,
1716                         volume_info.username, &srvTcp);
1717         else {
1718                 kfree(volume_info.UNC);
1719                 kfree(volume_info.password);
1720                 kfree(volume_info.prepath);
1721                 FreeXid(xid);
1722                 return -EINVAL;
1723         }
1724
1725
1726         if (srvTcp) {
1727                 cFYI(1, ("Existing tcp session with server found"));
1728         } else {        /* create socket */
1729                 if(volume_info.port)
1730                         sin_server.sin_port = htons(volume_info.port);
1731                 else
1732                         sin_server.sin_port = 0;
1733                 rc = ipv4_connect(&sin_server,&csocket,
1734                                   volume_info.source_rfc1001_name,
1735                                   volume_info.target_rfc1001_name);
1736                 if (rc < 0) {
1737                         cERROR(1,
1738                                ("Error connecting to IPv4 socket. Aborting operation"));
1739                         if(csocket != NULL)
1740                                 sock_release(csocket);
1741                         kfree(volume_info.UNC);
1742                         kfree(volume_info.password);
1743                         kfree(volume_info.prepath);
1744                         FreeXid(xid);
1745                         return rc;
1746                 }
1747
1748                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1749                 if (srvTcp == NULL) {
1750                         rc = -ENOMEM;
1751                         sock_release(csocket);
1752                         kfree(volume_info.UNC);
1753                         kfree(volume_info.password);
1754                         kfree(volume_info.prepath);
1755                         FreeXid(xid);
1756                         return rc;
1757                 } else {
1758                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1759                         memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1760                         atomic_set(&srvTcp->inFlight,0);
1761                         /* BB Add code for ipv6 case too */
1762                         srvTcp->ssocket = csocket;
1763                         srvTcp->protocolType = IPV4;
1764                         init_waitqueue_head(&srvTcp->response_q);
1765                         init_waitqueue_head(&srvTcp->request_q);
1766                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1767                         /* at this point we are the only ones with the pointer
1768                         to the struct since the kernel thread not created yet
1769                         so no need to spinlock this init of tcpStatus */
1770                         srvTcp->tcpStatus = CifsNew;
1771                         init_MUTEX(&srvTcp->tcpSem);
1772                         rc = (int)kernel_thread((void *)(void *)cifs_demultiplex_thread, srvTcp,
1773                                       CLONE_FS | CLONE_FILES | CLONE_VM);
1774                         if(rc < 0) {
1775                                 rc = -ENOMEM;
1776                                 sock_release(csocket);
1777                                 kfree(volume_info.UNC);
1778                                 kfree(volume_info.password);
1779                                 kfree(volume_info.prepath);
1780                                 FreeXid(xid);
1781                                 return rc;
1782                         }
1783                         wait_for_completion(&cifsd_complete);
1784                         rc = 0;
1785                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1786                         memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1787                         srvTcp->sequence_number = 0;
1788                 }
1789         }
1790
1791         if (existingCifsSes) {
1792                 pSesInfo = existingCifsSes;
1793                 cFYI(1, ("Existing smb sess found"));
1794                 kfree(volume_info.password);
1795                 /* volume_info.UNC freed at end of function */
1796         } else if (!rc) {
1797                 cFYI(1, ("Existing smb sess not found"));
1798                 pSesInfo = sesInfoAlloc();
1799                 if (pSesInfo == NULL)
1800                         rc = -ENOMEM;
1801                 else {
1802                         pSesInfo->server = srvTcp;
1803                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1804                                 NIPQUAD(sin_server.sin_addr.s_addr));
1805                 }
1806
1807                 if (!rc){
1808                         /* volume_info.password freed at unmount */
1809                         if (volume_info.password)
1810                                 pSesInfo->password = volume_info.password;
1811                         if (volume_info.username)
1812                                 strncpy(pSesInfo->userName,
1813                                         volume_info.username,MAX_USERNAME_SIZE);
1814                         if (volume_info.domainname) {
1815                                 int len = strlen(volume_info.domainname);
1816                                 pSesInfo->domainName =
1817                                         kmalloc(len + 1, GFP_KERNEL);
1818                                 if(pSesInfo->domainName)
1819                                         strcpy(pSesInfo->domainName,
1820                                                 volume_info.domainname);
1821                         }
1822                         pSesInfo->linux_uid = volume_info.linux_uid;
1823                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1824                         down(&pSesInfo->sesSem);
1825                         /* BB FIXME need to pass vol->secFlgs BB */
1826                         rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1827                         up(&pSesInfo->sesSem);
1828                         if(!rc)
1829                                 atomic_inc(&srvTcp->socketUseCount);
1830                 } else
1831                         kfree(volume_info.password);
1832         }
1833
1834         /* search for existing tcon to this server share */
1835         if (!rc) {
1836                 if(volume_info.rsize > CIFSMaxBufSize) {
1837                         cERROR(1,("rsize %d too large, using MaxBufSize",
1838                                 volume_info.rsize));
1839                         cifs_sb->rsize = CIFSMaxBufSize;
1840                 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1841                         cifs_sb->rsize = volume_info.rsize;
1842                 else /* default */
1843                         cifs_sb->rsize = CIFSMaxBufSize;
1844
1845                 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1846                         cERROR(1,("wsize %d too large using 4096 instead",
1847                                   volume_info.wsize));
1848                         cifs_sb->wsize = 4096;
1849                 } else if(volume_info.wsize)
1850                         cifs_sb->wsize = volume_info.wsize;
1851                 else
1852                         cifs_sb->wsize =
1853                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1854                                         127*1024);
1855                         /* old default of CIFSMaxBufSize was too small now
1856                            that SMB Write2 can send multiple pages in kvec.
1857                            RFC1001 does not describe what happens when frame
1858                            bigger than 128K is sent so use that as max in
1859                            conjunction with 52K kvec constraint on arch with 4K
1860                            page size  */
1861
1862                 if(cifs_sb->rsize < 2048) {
1863                         cifs_sb->rsize = 2048;
1864                         /* Windows ME may prefer this */
1865                         cFYI(1,("readsize set to minimum 2048"));
1866                 }
1867                 /* calculate prepath */
1868                 cifs_sb->prepath = volume_info.prepath;
1869                 if(cifs_sb->prepath) {
1870                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1871                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1872                         volume_info.prepath = NULL;
1873                 } else
1874                         cifs_sb->prepathlen = 0;
1875                 cifs_sb->mnt_uid = volume_info.linux_uid;
1876                 cifs_sb->mnt_gid = volume_info.linux_gid;
1877                 cifs_sb->mnt_file_mode = volume_info.file_mode;
1878                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1879                 cFYI(1,("file mode: 0x%x  dir mode: 0x%x",
1880                         cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1881
1882                 if(volume_info.noperm)
1883                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1884                 if(volume_info.setuids)
1885                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1886                 if(volume_info.server_ino)
1887                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1888                 if(volume_info.remap)
1889                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1890                 if(volume_info.no_xattr)
1891                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1892                 if(volume_info.sfu_emul)
1893                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1894                 if(volume_info.nobrl)
1895                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1896                 if(volume_info.cifs_acl)
1897                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1898
1899                 if(volume_info.direct_io) {
1900                         cFYI(1,("mounting share using direct i/o"));
1901                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1902                 }
1903
1904                 tcon =
1905                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1906                              volume_info.username);
1907                 if (tcon) {
1908                         cFYI(1, ("Found match on UNC path"));
1909                         /* we can have only one retry value for a connection
1910                            to a share so for resources mounted more than once
1911                            to the same server share the last value passed in
1912                            for the retry flag is used */
1913                         tcon->retry = volume_info.retry;
1914                         tcon->nocase = volume_info.nocase;
1915                 } else {
1916                         tcon = tconInfoAlloc();
1917                         if (tcon == NULL)
1918                                 rc = -ENOMEM;
1919                         else {
1920                                 /* check for null share name ie connect to dfs root */
1921
1922                                 /* BB check if this works for exactly length three strings */
1923                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
1924                                     && (strchr(volume_info.UNC + 3, '/') ==
1925                                         NULL)) {
1926                                         rc = connect_to_dfs_path(xid, pSesInfo,
1927                                                         "", cifs_sb->local_nls,
1928                                                         cifs_sb->mnt_cifs_flags &
1929                                                           CIFS_MOUNT_MAP_SPECIAL_CHR);
1930                                         kfree(volume_info.UNC);
1931                                         FreeXid(xid);
1932                                         return -ENODEV;
1933                                 } else {
1934                                         rc = CIFSTCon(xid, pSesInfo,
1935                                                 volume_info.UNC,
1936                                                 tcon, cifs_sb->local_nls);
1937                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
1938                                 }
1939                                 if (!rc) {
1940                                         atomic_inc(&pSesInfo->inUse);
1941                                         tcon->retry = volume_info.retry;
1942                                         tcon->nocase = volume_info.nocase;
1943                                 }
1944                         }
1945                 }
1946         }
1947         if(pSesInfo) {
1948                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
1949                         sb->s_maxbytes = (u64) 1 << 63;
1950                 } else
1951                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
1952         }
1953
1954         sb->s_time_gran = 100;
1955
1956 /* on error free sesinfo and tcon struct if needed */
1957         if (rc) {
1958                 /* if session setup failed, use count is zero but
1959                 we still need to free cifsd thread */
1960                 if(atomic_read(&srvTcp->socketUseCount) == 0) {
1961                         spin_lock(&GlobalMid_Lock);
1962                         srvTcp->tcpStatus = CifsExiting;
1963                         spin_unlock(&GlobalMid_Lock);
1964                         if(srvTcp->tsk) {
1965                                 send_sig(SIGKILL,srvTcp->tsk,1);
1966                                 wait_for_completion(&cifsd_complete);
1967                         }
1968                 }
1969                  /* If find_unc succeeded then rc == 0 so we can not end */
1970                 if (tcon)  /* up accidently freeing someone elses tcon struct */
1971                         tconInfoFree(tcon);
1972                 if (existingCifsSes == NULL) {
1973                         if (pSesInfo) {
1974                                 if ((pSesInfo->server) &&
1975                                     (pSesInfo->status == CifsGood)) {
1976                                         int temp_rc;
1977                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
1978                                         /* if the socketUseCount is now zero */
1979                                         if((temp_rc == -ESHUTDOWN) &&
1980                                            (pSesInfo->server->tsk)) {
1981                                                 send_sig(SIGKILL,pSesInfo->server->tsk,1);
1982                                                 wait_for_completion(&cifsd_complete);
1983                                         }
1984                                 } else
1985                                         cFYI(1, ("No session or bad tcon"));
1986                                 sesInfoFree(pSesInfo);
1987                                 /* pSesInfo = NULL; */
1988                         }
1989                 }
1990         } else {
1991                 atomic_inc(&tcon->useCount);
1992                 cifs_sb->tcon = tcon;
1993                 tcon->ses = pSesInfo;
1994
1995                 /* do not care if following two calls succeed - informational */
1996                 CIFSSMBQFSDeviceInfo(xid, tcon);
1997                 CIFSSMBQFSAttributeInfo(xid, tcon);
1998
1999                 if (tcon->ses->capabilities & CAP_UNIX) {
2000                         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
2001                                 __u64 cap =
2002                                        le64_to_cpu(tcon->fsUnixInfo.Capability);
2003                                 cap &= CIFS_UNIX_CAP_MASK;
2004                                 if(volume_info.no_psx_acl)
2005                                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2006                                 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
2007                                         cFYI(1,("negotiated posix acl support"));
2008                                         sb->s_flags |= MS_POSIXACL;
2009                                 }
2010
2011                                 if(volume_info.posix_paths == 0)
2012                                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2013                                 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2014                                         cFYI(1,("negotiate posix pathnames"));
2015                                         cifs_sb->mnt_cifs_flags |=
2016                                                 CIFS_MOUNT_POSIX_PATHS;
2017                                 }
2018
2019                                 cFYI(1,("Negotiate caps 0x%x",(int)cap));
2020 #ifdef CONFIG_CIFS_DEBUG2
2021                                 if(cap & CIFS_UNIX_FCNTL_CAP)
2022                                         cFYI(1,("FCNTL cap"));
2023                                 if(cap & CIFS_UNIX_EXTATTR_CAP)
2024                                         cFYI(1,("EXTATTR cap"));
2025                                 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2026                                         cFYI(1,("POSIX path cap"));
2027                                 if(cap & CIFS_UNIX_XATTR_CAP)
2028                                         cFYI(1,("XATTR cap"));
2029                                 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
2030                                         cFYI(1,("POSIX ACL cap"));
2031 #endif /* CIFS_DEBUG2 */
2032                                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2033                                         cFYI(1,("setting capabilities failed"));
2034                                 }
2035                         }
2036                 }
2037                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2038                         cifs_sb->wsize = min(cifs_sb->wsize,
2039                                              (tcon->ses->server->maxBuf -
2040                                               MAX_CIFS_HDR_SIZE));
2041                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2042                         cifs_sb->rsize = min(cifs_sb->rsize,
2043                                              (tcon->ses->server->maxBuf -
2044                                               MAX_CIFS_HDR_SIZE));
2045         }
2046
2047         /* volume_info.password is freed above when existing session found
2048         (in which case it is not needed anymore) but when new sesion is created
2049         the password ptr is put in the new session structure (in which case the
2050         password will be freed at unmount time) */
2051         kfree(volume_info.UNC);
2052         kfree(volume_info.prepath);
2053         FreeXid(xid);
2054         return rc;
2055 }
2056
2057 static int
2058 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2059               char session_key[CIFS_SESS_KEY_SIZE],
2060               const struct nls_table *nls_codepage)
2061 {
2062         struct smb_hdr *smb_buffer;
2063         struct smb_hdr *smb_buffer_response;
2064         SESSION_SETUP_ANDX *pSMB;
2065         SESSION_SETUP_ANDX *pSMBr;
2066         char *bcc_ptr;
2067         char *user;
2068         char *domain;
2069         int rc = 0;
2070         int remaining_words = 0;
2071         int bytes_returned = 0;
2072         int len;
2073         __u32 capabilities;
2074         __u16 count;
2075
2076         cFYI(1, ("In sesssetup"));
2077         if(ses == NULL)
2078                 return -EINVAL;
2079         user = ses->userName;
2080         domain = ses->domainName;
2081         smb_buffer = cifs_buf_get();
2082         if (smb_buffer == NULL) {
2083                 return -ENOMEM;
2084         }
2085         smb_buffer_response = smb_buffer;
2086         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2087
2088         /* send SMBsessionSetup here */
2089         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2090                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2091
2092         smb_buffer->Mid = GetNextMid(ses->server);
2093         pSMB->req_no_secext.AndXCommand = 0xFF;
2094         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2095         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2096
2097         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2098                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2099
2100         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2101                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2102         if (ses->capabilities & CAP_UNICODE) {
2103                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2104                 capabilities |= CAP_UNICODE;
2105         }
2106         if (ses->capabilities & CAP_STATUS32) {
2107                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2108                 capabilities |= CAP_STATUS32;
2109         }
2110         if (ses->capabilities & CAP_DFS) {
2111                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2112                 capabilities |= CAP_DFS;
2113         }
2114         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2115
2116         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2117                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2118
2119         pSMB->req_no_secext.CaseSensitivePasswordLength =
2120             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2121         bcc_ptr = pByteArea(smb_buffer);
2122         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2123         bcc_ptr += CIFS_SESS_KEY_SIZE;
2124         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2125         bcc_ptr += CIFS_SESS_KEY_SIZE;
2126
2127         if (ses->capabilities & CAP_UNICODE) {
2128                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2129                         *bcc_ptr = 0;
2130                         bcc_ptr++;
2131                 }
2132                 if(user == NULL)
2133                         bytes_returned = 0; /* skip null user */
2134                 else
2135                         bytes_returned =
2136                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2137                                         nls_codepage);
2138                 /* convert number of 16 bit words to bytes */
2139                 bcc_ptr += 2 * bytes_returned;
2140                 bcc_ptr += 2;   /* trailing null */
2141                 if (domain == NULL)
2142                         bytes_returned =
2143                             cifs_strtoUCS((__le16 *) bcc_ptr,
2144                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2145                 else
2146                         bytes_returned =
2147                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2148                                           nls_codepage);
2149                 bcc_ptr += 2 * bytes_returned;
2150                 bcc_ptr += 2;
2151                 bytes_returned =
2152                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2153                                   32, nls_codepage);
2154                 bcc_ptr += 2 * bytes_returned;
2155                 bytes_returned =
2156                     cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release,
2157                                   32, nls_codepage);
2158                 bcc_ptr += 2 * bytes_returned;
2159                 bcc_ptr += 2;
2160                 bytes_returned =
2161                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2162                                   64, nls_codepage);
2163                 bcc_ptr += 2 * bytes_returned;
2164                 bcc_ptr += 2;
2165         } else {
2166                 if(user != NULL) {
2167                     strncpy(bcc_ptr, user, 200);
2168                     bcc_ptr += strnlen(user, 200);
2169                 }
2170                 *bcc_ptr = 0;
2171                 bcc_ptr++;
2172                 if (domain == NULL) {
2173                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2174                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2175                 } else {
2176                         strncpy(bcc_ptr, domain, 64);
2177                         bcc_ptr += strnlen(domain, 64);
2178                         *bcc_ptr = 0;
2179                         bcc_ptr++;
2180                 }
2181                 strcpy(bcc_ptr, "Linux version ");
2182                 bcc_ptr += strlen("Linux version ");
2183                 strcpy(bcc_ptr, system_utsname.release);
2184                 bcc_ptr += strlen(system_utsname.release) + 1;
2185                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2186                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2187         }
2188         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2189         smb_buffer->smb_buf_length += count;
2190         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2191
2192         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2193                          &bytes_returned, 1);
2194         if (rc) {
2195 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2196         } else if ((smb_buffer_response->WordCount == 3)
2197                    || (smb_buffer_response->WordCount == 4)) {
2198                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2199                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2200                 if (action & GUEST_LOGIN)
2201                         cFYI(1, (" Guest login"));      /* do we want to mark SesInfo struct ? */
2202                 ses->Suid = smb_buffer_response->Uid;   /* UID left in wire format (le) */
2203                 cFYI(1, ("UID = %d ", ses->Suid));
2204          /* response can have either 3 or 4 word count - Samba sends 3 */
2205                 bcc_ptr = pByteArea(smb_buffer_response);
2206                 if ((pSMBr->resp.hdr.WordCount == 3)
2207                     || ((pSMBr->resp.hdr.WordCount == 4)
2208                         && (blob_len < pSMBr->resp.ByteCount))) {
2209                         if (pSMBr->resp.hdr.WordCount == 4)
2210                                 bcc_ptr += blob_len;
2211
2212                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2213                                 if ((long) (bcc_ptr) % 2) {
2214                                         remaining_words =
2215                                             (BCC(smb_buffer_response) - 1) /2;
2216                                         bcc_ptr++;      /* Unicode strings must be word aligned */
2217                                 } else {
2218                                         remaining_words =
2219                                                 BCC(smb_buffer_response) / 2;
2220                                 }
2221                                 len =
2222                                     UniStrnlen((wchar_t *) bcc_ptr,
2223                                                remaining_words - 1);
2224 /* We look for obvious messed up bcc or strings in response so we do not go off
2225    the end since (at least) WIN2K and Windows XP have a major bug in not null
2226    terminating last Unicode string in response  */
2227                                 if(ses->serverOS)
2228                                         kfree(ses->serverOS);
2229                                 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2230                                 if(ses->serverOS == NULL)
2231                                         goto sesssetup_nomem;
2232                                 cifs_strfromUCS_le(ses->serverOS,
2233                                            (__le16 *)bcc_ptr, len,nls_codepage);
2234                                 bcc_ptr += 2 * (len + 1);
2235                                 remaining_words -= len + 1;
2236                                 ses->serverOS[2 * len] = 0;
2237                                 ses->serverOS[1 + (2 * len)] = 0;
2238                                 if (remaining_words > 0) {
2239                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2240                                                          remaining_words-1);
2241                                         kfree(ses->serverNOS);
2242                                         ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2243                                         if(ses->serverNOS == NULL)
2244                                                 goto sesssetup_nomem;
2245                                         cifs_strfromUCS_le(ses->serverNOS,
2246                                                            (__le16 *)bcc_ptr,len,nls_codepage);
2247                                         bcc_ptr += 2 * (len + 1);
2248                                         ses->serverNOS[2 * len] = 0;
2249                                         ses->serverNOS[1 + (2 * len)] = 0;
2250                                         if(strncmp(ses->serverNOS,
2251                                                 "NT LAN Manager 4",16) == 0) {
2252                                                 cFYI(1,("NT4 server"));
2253                                                 ses->flags |= CIFS_SES_NT4;
2254                                         }
2255                                         remaining_words -= len + 1;
2256                                         if (remaining_words > 0) {
2257                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2258           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2259                                                 if(ses->serverDomain)
2260                                                         kfree(ses->serverDomain);
2261                                                 ses->serverDomain =
2262                                                     kzalloc(2*(len+1),GFP_KERNEL);
2263                                                 if(ses->serverDomain == NULL)
2264                                                         goto sesssetup_nomem;
2265                                                 cifs_strfromUCS_le(ses->serverDomain,
2266                                                      (__le16 *)bcc_ptr,len,nls_codepage);
2267                                                 bcc_ptr += 2 * (len + 1);
2268                                                 ses->serverDomain[2*len] = 0;
2269                                                 ses->serverDomain[1+(2*len)] = 0;
2270                                         } /* else no more room so create dummy domain string */
2271                                         else {
2272                                                 if(ses->serverDomain)
2273                                                         kfree(ses->serverDomain);
2274                                                 ses->serverDomain =
2275                                                         kzalloc(2, GFP_KERNEL);
2276                                         }
2277                                 } else {        /* no room so create dummy domain and NOS string */
2278                                         /* if these kcallocs fail not much we
2279                                            can do, but better to not fail the
2280                                            sesssetup itself */
2281                                         kfree(ses->serverDomain);
2282                                         ses->serverDomain =
2283                                             kzalloc(2, GFP_KERNEL);
2284                                         kfree(ses->serverNOS);
2285                                         ses->serverNOS =
2286                                             kzalloc(2, GFP_KERNEL);
2287                                 }
2288                         } else {        /* ASCII */
2289                                 len = strnlen(bcc_ptr, 1024);
2290                                 if (((long) bcc_ptr + len) - (long)
2291                                     pByteArea(smb_buffer_response)
2292                                             <= BCC(smb_buffer_response)) {
2293                                         kfree(ses->serverOS);
2294                                         ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2295                                         if(ses->serverOS == NULL)
2296                                                 goto sesssetup_nomem;
2297                                         strncpy(ses->serverOS,bcc_ptr, len);
2298
2299                                         bcc_ptr += len;
2300                                         bcc_ptr[0] = 0; /* null terminate the string */
2301                                         bcc_ptr++;
2302
2303                                         len = strnlen(bcc_ptr, 1024);
2304                                         kfree(ses->serverNOS);
2305                                         ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2306                                         if(ses->serverNOS == NULL)
2307                                                 goto sesssetup_nomem;
2308                                         strncpy(ses->serverNOS, bcc_ptr, len);
2309                                         bcc_ptr += len;
2310                                         bcc_ptr[0] = 0;
2311                                         bcc_ptr++;
2312
2313                                         len = strnlen(bcc_ptr, 1024);
2314                                         if(ses->serverDomain)
2315                                                 kfree(ses->serverDomain);
2316                                         ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2317                                         if(ses->serverDomain == NULL)
2318                                                 goto sesssetup_nomem;
2319                                         strncpy(ses->serverDomain, bcc_ptr, len);
2320                                         bcc_ptr += len;
2321                                         bcc_ptr[0] = 0;
2322                                         bcc_ptr++;
2323                                 } else
2324                                         cFYI(1,
2325                                              ("Variable field of length %d extends beyond end of smb ",
2326                                               len));
2327                         }
2328                 } else {
2329                         cERROR(1,
2330                                (" Security Blob Length extends beyond end of SMB"));
2331                 }
2332         } else {
2333                 cERROR(1,
2334                        (" Invalid Word count %d: ",
2335                         smb_buffer_response->WordCount));
2336                 rc = -EIO;
2337         }
2338 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2339                            since that could make reconnection harder, and
2340                            reconnection might be needed to free memory */
2341         if (smb_buffer)
2342                 cifs_buf_release(smb_buffer);
2343
2344         return rc;
2345 }
2346
2347 static int
2348 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2349                               struct cifsSesInfo *ses, int * pNTLMv2_flag,
2350                               const struct nls_table *nls_codepage)
2351 {
2352         struct smb_hdr *smb_buffer;
2353         struct smb_hdr *smb_buffer_response;
2354         SESSION_SETUP_ANDX *pSMB;
2355         SESSION_SETUP_ANDX *pSMBr;
2356         char *bcc_ptr;
2357         char *domain;
2358         int rc = 0;
2359         int remaining_words = 0;
2360         int bytes_returned = 0;
2361         int len;
2362         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2363         PNEGOTIATE_MESSAGE SecurityBlob;
2364         PCHALLENGE_MESSAGE SecurityBlob2;
2365         __u32 negotiate_flags, capabilities;
2366         __u16 count;
2367
2368         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2369         if(ses == NULL)
2370                 return -EINVAL;
2371         domain = ses->domainName;
2372         *pNTLMv2_flag = FALSE;
2373         smb_buffer = cifs_buf_get();
2374         if (smb_buffer == NULL) {
2375                 return -ENOMEM;
2376         }
2377         smb_buffer_response = smb_buffer;
2378         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2379         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2380
2381         /* send SMBsessionSetup here */
2382         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2383                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2384
2385         smb_buffer->Mid = GetNextMid(ses->server);
2386         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2387         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2388
2389         pSMB->req.AndXCommand = 0xFF;
2390         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2391         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2392
2393         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2394                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2395
2396         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2397             CAP_EXTENDED_SECURITY;
2398         if (ses->capabilities & CAP_UNICODE) {
2399                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2400                 capabilities |= CAP_UNICODE;
2401         }
2402         if (ses->capabilities & CAP_STATUS32) {
2403                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2404                 capabilities |= CAP_STATUS32;
2405         }
2406         if (ses->capabilities & CAP_DFS) {
2407                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2408                 capabilities |= CAP_DFS;
2409         }
2410         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2411
2412         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2413         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2414         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2415         SecurityBlob->MessageType = NtLmNegotiate;
2416         negotiate_flags =
2417             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2418             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2419             NTLMSSP_NEGOTIATE_56 |
2420             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2421         if(sign_CIFS_PDUs)
2422                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2423 /*      if(ntlmv2_support)
2424                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2425         /* setup pointers to domain name and workstation name */
2426         bcc_ptr += SecurityBlobLength;
2427
2428         SecurityBlob->WorkstationName.Buffer = 0;
2429         SecurityBlob->WorkstationName.Length = 0;
2430         SecurityBlob->WorkstationName.MaximumLength = 0;
2431
2432         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2433         along with username on auth request (ie the response to challenge) */
2434         SecurityBlob->DomainName.Buffer = 0;
2435         SecurityBlob->DomainName.Length = 0;
2436         SecurityBlob->DomainName.MaximumLength = 0;
2437         if (ses->capabilities & CAP_UNICODE) {
2438                 if ((long) bcc_ptr % 2) {
2439                         *bcc_ptr = 0;
2440                         bcc_ptr++;
2441                 }
2442
2443                 bytes_returned =
2444                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2445                                   32, nls_codepage);
2446                 bcc_ptr += 2 * bytes_returned;
2447                 bytes_returned =
2448                     cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2449                                   nls_codepage);
2450                 bcc_ptr += 2 * bytes_returned;
2451                 bcc_ptr += 2;   /* null terminate Linux version */
2452                 bytes_returned =
2453                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2454                                   64, nls_codepage);
2455                 bcc_ptr += 2 * bytes_returned;
2456                 *(bcc_ptr + 1) = 0;
2457                 *(bcc_ptr + 2) = 0;
2458                 bcc_ptr += 2;   /* null terminate network opsys string */
2459                 *(bcc_ptr + 1) = 0;
2460                 *(bcc_ptr + 2) = 0;
2461                 bcc_ptr += 2;   /* null domain */
2462         } else {                /* ASCII */
2463                 strcpy(bcc_ptr, "Linux version ");
2464                 bcc_ptr += strlen("Linux version ");
2465                 strcpy(bcc_ptr, system_utsname.release);
2466                 bcc_ptr += strlen(system_utsname.release) + 1;
2467                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2468                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2469                 bcc_ptr++;      /* empty domain field */
2470                 *bcc_ptr = 0;
2471         }
2472         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2473         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2474         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2475         smb_buffer->smb_buf_length += count;
2476         pSMB->req.ByteCount = cpu_to_le16(count);
2477
2478         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2479                          &bytes_returned, 1);
2480
2481         if (smb_buffer_response->Status.CifsError ==
2482             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2483                 rc = 0;
2484
2485         if (rc) {
2486 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2487         } else if ((smb_buffer_response->WordCount == 3)
2488                    || (smb_buffer_response->WordCount == 4)) {
2489                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2490                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2491
2492                 if (action & GUEST_LOGIN)
2493                         cFYI(1, (" Guest login"));
2494         /* Do we want to set anything in SesInfo struct when guest login? */
2495
2496                 bcc_ptr = pByteArea(smb_buffer_response);
2497         /* response can have either 3 or 4 word count - Samba sends 3 */
2498
2499                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2500                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2501                         cFYI(1,
2502                              ("Unexpected NTLMSSP message type received %d",
2503                               SecurityBlob2->MessageType));
2504                 } else if (ses) {
2505                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2506                         cFYI(1, ("UID = %d", ses->Suid));
2507                         if ((pSMBr->resp.hdr.WordCount == 3)
2508                             || ((pSMBr->resp.hdr.WordCount == 4)
2509                                 && (blob_len <
2510                                     pSMBr->resp.ByteCount))) {
2511
2512                                 if (pSMBr->resp.hdr.WordCount == 4) {
2513                                         bcc_ptr += blob_len;
2514                                         cFYI(1, ("Security Blob Length %d",
2515                                               blob_len));
2516                                 }
2517
2518                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2519
2520                                 memcpy(ses->server->cryptKey,
2521                                        SecurityBlob2->Challenge,
2522                                        CIFS_CRYPTO_KEY_SIZE);
2523                                 if(SecurityBlob2->NegotiateFlags &
2524                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2525                                         *pNTLMv2_flag = TRUE;
2526
2527                                 if((SecurityBlob2->NegotiateFlags &
2528                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2529                                         || (sign_CIFS_PDUs > 1))
2530                                                 ses->server->secMode |=
2531                                                         SECMODE_SIGN_REQUIRED;
2532                                 if ((SecurityBlob2->NegotiateFlags &
2533                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2534                                                 ses->server->secMode |=
2535                                                         SECMODE_SIGN_ENABLED;
2536
2537                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2538                                         if ((long) (bcc_ptr) % 2) {
2539                                                 remaining_words =
2540                                                     (BCC(smb_buffer_response)
2541                                                      - 1) / 2;
2542                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2543                                         } else {
2544                                                 remaining_words =
2545                                                     BCC
2546                                                     (smb_buffer_response) / 2;
2547                                         }
2548                                         len =
2549                                             UniStrnlen((wchar_t *) bcc_ptr,
2550                                                        remaining_words - 1);
2551 /* We look for obvious messed up bcc or strings in response so we do not go off
2552    the end since (at least) WIN2K and Windows XP have a major bug in not null
2553    terminating last Unicode string in response  */
2554                                         if(ses->serverOS)
2555                                                 kfree(ses->serverOS);
2556                                         ses->serverOS =
2557                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2558                                         cifs_strfromUCS_le(ses->serverOS,
2559                                                            (__le16 *)
2560                                                            bcc_ptr, len,
2561                                                            nls_codepage);
2562                                         bcc_ptr += 2 * (len + 1);
2563                                         remaining_words -= len + 1;
2564                                         ses->serverOS[2 * len] = 0;
2565                                         ses->serverOS[1 + (2 * len)] = 0;
2566                                         if (remaining_words > 0) {
2567                                                 len = UniStrnlen((wchar_t *)
2568                                                                  bcc_ptr,
2569                                                                  remaining_words
2570                                                                  - 1);
2571                                                 kfree(ses->serverNOS);
2572                                                 ses->serverNOS =
2573                                                     kzalloc(2 * (len + 1),
2574                                                             GFP_KERNEL);
2575                                                 cifs_strfromUCS_le(ses->
2576                                                                    serverNOS,
2577                                                                    (__le16 *)
2578                                                                    bcc_ptr,
2579                                                                    len,
2580                                                                    nls_codepage);
2581                                                 bcc_ptr += 2 * (len + 1);
2582                                                 ses->serverNOS[2 * len] = 0;
2583                                                 ses->serverNOS[1 +
2584                                                                (2 * len)] = 0;
2585                                                 remaining_words -= len + 1;
2586                                                 if (remaining_words > 0) {
2587                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2588            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2589                                                         kfree(ses->serverDomain);
2590                                                         ses->serverDomain =
2591                                                             kzalloc(2 *
2592                                                                     (len +
2593                                                                      1),
2594                                                                     GFP_KERNEL);
2595                                                         cifs_strfromUCS_le
2596                                                             (ses->serverDomain,
2597                                                              (__le16 *)bcc_ptr,
2598                                                              len, nls_codepage);
2599                                                         bcc_ptr +=
2600                                                             2 * (len + 1);
2601                                                         ses->serverDomain[2*len]
2602                                                             = 0;
2603                                                         ses->serverDomain
2604                                                                 [1 + (2 * len)]
2605                                                             = 0;
2606                                                 } /* else no more room so create dummy domain string */
2607                                                 else {
2608                                                         kfree(ses->serverDomain);
2609                                                         ses->serverDomain =
2610                                                             kzalloc(2,
2611                                                                     GFP_KERNEL);
2612                                                 }
2613                                         } else {        /* no room so create dummy domain and NOS string */
2614                                                 kfree(ses->serverDomain);
2615                                                 ses->serverDomain =
2616                                                     kzalloc(2, GFP_KERNEL);
2617                                                 kfree(ses->serverNOS);
2618                                                 ses->serverNOS =
2619                                                     kzalloc(2, GFP_KERNEL);
2620                                         }
2621                                 } else {        /* ASCII */
2622                                         len = strnlen(bcc_ptr, 1024);
2623                                         if (((long) bcc_ptr + len) - (long)
2624                                             pByteArea(smb_buffer_response)
2625                                             <= BCC(smb_buffer_response)) {
2626                                                 if(ses->serverOS)
2627                                                         kfree(ses->serverOS);
2628                                                 ses->serverOS =
2629                                                     kzalloc(len + 1,
2630                                                             GFP_KERNEL);
2631                                                 strncpy(ses->serverOS,
2632                                                         bcc_ptr, len);
2633
2634                                                 bcc_ptr += len;
2635                                                 bcc_ptr[0] = 0; /* null terminate string */
2636                                                 bcc_ptr++;
2637
2638                                                 len = strnlen(bcc_ptr, 1024);
2639                                                 kfree(ses->serverNOS);
2640                                                 ses->serverNOS =
2641                                                     kzalloc(len + 1,
2642                                                             GFP_KERNEL);
2643                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2644                                                 bcc_ptr += len;
2645                                                 bcc_ptr[0] = 0;
2646                                                 bcc_ptr++;
2647
2648                                                 len = strnlen(bcc_ptr, 1024);
2649                                                 kfree(ses->serverDomain);
2650                                                 ses->serverDomain =
2651                                                     kzalloc(len + 1,
2652                                                             GFP_KERNEL);
2653                                                 strncpy(ses->serverDomain, bcc_ptr, len);
2654                                                 bcc_ptr += len;
2655                                                 bcc_ptr[0] = 0;
2656                                                 bcc_ptr++;
2657                                         } else
2658                                                 cFYI(1,
2659                                                      ("Variable field of length %d extends beyond end of smb",
2660                                                       len));
2661                                 }
2662                         } else {
2663                                 cERROR(1,
2664                                        (" Security Blob Length extends beyond end of SMB"));
2665                         }
2666                 } else {
2667                         cERROR(1, ("No session structure passed in."));
2668                 }
2669         } else {
2670                 cERROR(1,
2671                        (" Invalid Word count %d:",
2672                         smb_buffer_response->WordCount));
2673                 rc = -EIO;
2674         }
2675
2676         if (smb_buffer)
2677                 cifs_buf_release(smb_buffer);
2678
2679         return rc;
2680 }
2681 static int
2682 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2683                 char *ntlm_session_key, int ntlmv2_flag,
2684                 const struct nls_table *nls_codepage)
2685 {
2686         struct smb_hdr *smb_buffer;
2687         struct smb_hdr *smb_buffer_response;
2688         SESSION_SETUP_ANDX *pSMB;
2689         SESSION_SETUP_ANDX *pSMBr;
2690         char *bcc_ptr;
2691         char *user;
2692         char *domain;
2693         int rc = 0;
2694         int remaining_words = 0;
2695         int bytes_returned = 0;
2696         int len;
2697         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2698         PAUTHENTICATE_MESSAGE SecurityBlob;
2699         __u32 negotiate_flags, capabilities;
2700         __u16 count;
2701
2702         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2703         if(ses == NULL)
2704                 return -EINVAL;
2705         user = ses->userName;
2706         domain = ses->domainName;
2707         smb_buffer = cifs_buf_get();
2708         if (smb_buffer == NULL) {
2709                 return -ENOMEM;
2710         }
2711         smb_buffer_response = smb_buffer;
2712         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2713         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2714
2715         /* send SMBsessionSetup here */
2716         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2717                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2718
2719         smb_buffer->Mid = GetNextMid(ses->server);
2720         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2721         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2722         pSMB->req.AndXCommand = 0xFF;
2723         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2724         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2725
2726         pSMB->req.hdr.Uid = ses->Suid;
2727
2728         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2729                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2730
2731         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2732             CAP_EXTENDED_SECURITY;
2733         if (ses->capabilities & CAP_UNICODE) {
2734                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2735                 capabilities |= CAP_UNICODE;
2736         }
2737         if (ses->capabilities & CAP_STATUS32) {
2738                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2739                 capabilities |= CAP_STATUS32;
2740         }
2741         if (ses->capabilities & CAP_DFS) {
2742                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2743                 capabilities |= CAP_DFS;
2744         }
2745         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2746
2747         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2748         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2749         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2750         SecurityBlob->MessageType = NtLmAuthenticate;
2751         bcc_ptr += SecurityBlobLength;
2752         negotiate_flags =
2753             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2754             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2755             0x80000000 | NTLMSSP_NEGOTIATE_128;
2756         if(sign_CIFS_PDUs)
2757                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2758         if(ntlmv2_flag)
2759                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2760
2761 /* setup pointers to domain name and workstation name */
2762
2763         SecurityBlob->WorkstationName.Buffer = 0;
2764         SecurityBlob->WorkstationName.Length = 0;
2765         SecurityBlob->WorkstationName.MaximumLength = 0;
2766         SecurityBlob->SessionKey.Length = 0;
2767         SecurityBlob->SessionKey.MaximumLength = 0;
2768         SecurityBlob->SessionKey.Buffer = 0;
2769
2770         SecurityBlob->LmChallengeResponse.Length = 0;
2771         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2772         SecurityBlob->LmChallengeResponse.Buffer = 0;
2773
2774         SecurityBlob->NtChallengeResponse.Length =
2775             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2776         SecurityBlob->NtChallengeResponse.MaximumLength =
2777             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2778         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2779         SecurityBlob->NtChallengeResponse.Buffer =
2780             cpu_to_le32(SecurityBlobLength);
2781         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2782         bcc_ptr += CIFS_SESS_KEY_SIZE;
2783
2784         if (ses->capabilities & CAP_UNICODE) {
2785                 if (domain == NULL) {
2786                         SecurityBlob->DomainName.Buffer = 0;
2787                         SecurityBlob->DomainName.Length = 0;
2788                         SecurityBlob->DomainName.MaximumLength = 0;
2789                 } else {
2790                         __u16 len =
2791                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2792                                           nls_codepage);
2793                         len *= 2;
2794                         SecurityBlob->DomainName.MaximumLength =
2795                             cpu_to_le16(len);
2796                         SecurityBlob->DomainName.Buffer =
2797                             cpu_to_le32(SecurityBlobLength);
2798                         bcc_ptr += len;
2799                         SecurityBlobLength += len;
2800                         SecurityBlob->DomainName.Length =
2801                             cpu_to_le16(len);
2802                 }
2803                 if (user == NULL) {
2804                         SecurityBlob->UserName.Buffer = 0;
2805                         SecurityBlob->UserName.Length = 0;
2806                         SecurityBlob->UserName.MaximumLength = 0;
2807                 } else {
2808                         __u16 len =
2809                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2810                                           nls_codepage);
2811                         len *= 2;
2812                         SecurityBlob->UserName.MaximumLength =
2813                             cpu_to_le16(len);
2814                         SecurityBlob->UserName.Buffer =
2815                             cpu_to_le32(SecurityBlobLength);
2816                         bcc_ptr += len;
2817                         SecurityBlobLength += len;
2818                         SecurityBlob->UserName.Length =
2819                             cpu_to_le16(len);
2820                 }
2821
2822                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2823                    SecurityBlob->WorkstationName.Length *= 2;
2824                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2825                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2826                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2827                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2828                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
2829
2830                 if ((long) bcc_ptr % 2) {
2831                         *bcc_ptr = 0;
2832                         bcc_ptr++;
2833                 }
2834                 bytes_returned =
2835                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2836                                   32, nls_codepage);
2837                 bcc_ptr += 2 * bytes_returned;
2838                 bytes_returned =
2839                     cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release, 32,
2840                                   nls_codepage);
2841                 bcc_ptr += 2 * bytes_returned;
2842                 bcc_ptr += 2;   /* null term version string */
2843                 bytes_returned =
2844                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2845                                   64, nls_codepage);
2846                 bcc_ptr += 2 * bytes_returned;
2847                 *(bcc_ptr + 1) = 0;
2848                 *(bcc_ptr + 2) = 0;
2849                 bcc_ptr += 2;   /* null terminate network opsys string */
2850                 *(bcc_ptr + 1) = 0;
2851                 *(bcc_ptr + 2) = 0;
2852                 bcc_ptr += 2;   /* null domain */
2853         } else {                /* ASCII */
2854                 if (domain == NULL) {
2855                         SecurityBlob->DomainName.Buffer = 0;
2856                         SecurityBlob->DomainName.Length = 0;
2857                         SecurityBlob->DomainName.MaximumLength = 0;
2858                 } else {
2859                         __u16 len;
2860                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2861                         strncpy(bcc_ptr, domain, 63);
2862                         len = strnlen(domain, 64);
2863                         SecurityBlob->DomainName.MaximumLength =
2864                             cpu_to_le16(len);
2865                         SecurityBlob->DomainName.Buffer =
2866                             cpu_to_le32(SecurityBlobLength);
2867                         bcc_ptr += len;
2868                         SecurityBlobLength += len;
2869                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
2870                 }
2871                 if (user == NULL) {
2872                         SecurityBlob->UserName.Buffer = 0;
2873                         SecurityBlob->UserName.Length = 0;
2874                         SecurityBlob->UserName.MaximumLength = 0;
2875                 } else {
2876                         __u16 len;
2877                         strncpy(bcc_ptr, user, 63);
2878                         len = strnlen(user, 64);
2879                         SecurityBlob->UserName.MaximumLength =
2880                             cpu_to_le16(len);
2881                         SecurityBlob->UserName.Buffer =
2882                             cpu_to_le32(SecurityBlobLength);
2883                         bcc_ptr += len;
2884                         SecurityBlobLength += len;
2885                         SecurityBlob->UserName.Length = cpu_to_le16(len);
2886                 }
2887                 /* BB fill in our workstation name if known BB */
2888
2889                 strcpy(bcc_ptr, "Linux version ");
2890                 bcc_ptr += strlen("Linux version ");
2891                 strcpy(bcc_ptr, system_utsname.release);
2892                 bcc_ptr += strlen(system_utsname.release) + 1;
2893                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2894                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2895                 bcc_ptr++;      /* null domain */
2896                 *bcc_ptr = 0;
2897         }
2898         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2899         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2900         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2901         smb_buffer->smb_buf_length += count;
2902         pSMB->req.ByteCount = cpu_to_le16(count);
2903
2904         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2905                          &bytes_returned, 1);
2906         if (rc) {
2907 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2908         } else if ((smb_buffer_response->WordCount == 3)
2909                    || (smb_buffer_response->WordCount == 4)) {
2910                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2911                 __u16 blob_len =
2912                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2913                 if (action & GUEST_LOGIN)
2914                         cFYI(1, (" Guest login"));      /* BB do we want to set anything in SesInfo struct ? */
2915 /*        if(SecurityBlob2->MessageType != NtLm??){
2916                  cFYI("Unexpected message type on auth response is %d "));
2917         } */
2918                 if (ses) {
2919                         cFYI(1,
2920                              ("Does UID on challenge %d match auth response UID %d ",
2921                               ses->Suid, smb_buffer_response->Uid));
2922                         ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2923                         bcc_ptr = pByteArea(smb_buffer_response);
2924             /* response can have either 3 or 4 word count - Samba sends 3 */
2925                         if ((pSMBr->resp.hdr.WordCount == 3)
2926                             || ((pSMBr->resp.hdr.WordCount == 4)
2927                                 && (blob_len <
2928                                     pSMBr->resp.ByteCount))) {
2929                                 if (pSMBr->resp.hdr.WordCount == 4) {
2930                                         bcc_ptr +=
2931                                             blob_len;
2932                                         cFYI(1,
2933                                              ("Security Blob Length %d ",
2934                                               blob_len));
2935                                 }
2936
2937                                 cFYI(1,
2938                                      ("NTLMSSP response to Authenticate "));
2939
2940                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2941                                         if ((long) (bcc_ptr) % 2) {
2942                                                 remaining_words =
2943                                                     (BCC(smb_buffer_response)
2944                                                      - 1) / 2;
2945                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2946                                         } else {
2947                                                 remaining_words = BCC(smb_buffer_response) / 2;
2948                                         }
2949                                         len =
2950                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
2951 /* We look for obvious messed up bcc or strings in response so we do not go off
2952   the end since (at least) WIN2K and Windows XP have a major bug in not null
2953   terminating last Unicode string in response  */
2954                                         if(ses->serverOS)
2955                                                 kfree(ses->serverOS);
2956                                         ses->serverOS =
2957                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2958                                         cifs_strfromUCS_le(ses->serverOS,
2959                                                            (__le16 *)
2960                                                            bcc_ptr, len,
2961                                                            nls_codepage);
2962                                         bcc_ptr += 2 * (len + 1);
2963                                         remaining_words -= len + 1;
2964                                         ses->serverOS[2 * len] = 0;
2965                                         ses->serverOS[1 + (2 * len)] = 0;
2966                                         if (remaining_words > 0) {
2967                                                 len = UniStrnlen((wchar_t *)
2968                                                                  bcc_ptr,
2969                                                                  remaining_words
2970                                                                  - 1);
2971                                                 kfree(ses->serverNOS);
2972                                                 ses->serverNOS =
2973                                                     kzalloc(2 * (len + 1),
2974                                                             GFP_KERNEL);
2975                                                 cifs_strfromUCS_le(ses->
2976                                                                    serverNOS,
2977                                                                    (__le16 *)
2978                                                                    bcc_ptr,
2979                                                                    len,
2980                                                                    nls_codepage);
2981                                                 bcc_ptr += 2 * (len + 1);
2982                                                 ses->serverNOS[2 * len] = 0;
2983                                                 ses->serverNOS[1+(2*len)] = 0;
2984                                                 remaining_words -= len + 1;
2985                                                 if (remaining_words > 0) {
2986                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2987      /* last string not always null terminated (e.g. for Windows XP & 2000) */
2988                                                         if(ses->serverDomain)
2989                                                                 kfree(ses->serverDomain);
2990                                                         ses->serverDomain =
2991                                                             kzalloc(2 *
2992                                                                     (len +
2993                                                                      1),
2994                                                                     GFP_KERNEL);
2995                                                         cifs_strfromUCS_le
2996                                                             (ses->
2997                                                              serverDomain,
2998                                                              (__le16 *)
2999                                                              bcc_ptr, len,
3000                                                              nls_codepage);
3001                                                         bcc_ptr +=
3002                                                             2 * (len + 1);
3003                                                         ses->
3004                                                             serverDomain[2
3005                                                                          * len]
3006                                                             = 0;
3007                                                         ses->
3008                                                             serverDomain[1
3009                                                                          +
3010                                                                          (2
3011                                                                           *
3012                                                                           len)]
3013                                                             = 0;
3014                                                 } /* else no more room so create dummy domain string */
3015                                                 else {
3016                                                         if(ses->serverDomain)
3017                                                                 kfree(ses->serverDomain);
3018                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3019                                                 }
3020                                         } else {  /* no room so create dummy domain and NOS string */
3021                                                 if(ses->serverDomain)
3022                                                         kfree(ses->serverDomain);
3023                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3024                                                 kfree(ses->serverNOS);
3025                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3026                                         }
3027                                 } else {        /* ASCII */
3028                                         len = strnlen(bcc_ptr, 1024);
3029                                         if (((long) bcc_ptr + len) -
3030                         (long) pByteArea(smb_buffer_response)
3031                             <= BCC(smb_buffer_response)) {
3032                                                 if(ses->serverOS)
3033                                                         kfree(ses->serverOS);
3034                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3035                                                 strncpy(ses->serverOS,bcc_ptr, len);
3036
3037                                                 bcc_ptr += len;
3038                                                 bcc_ptr[0] = 0; /* null terminate the string */
3039                                                 bcc_ptr++;
3040
3041                                                 len = strnlen(bcc_ptr, 1024);
3042                                                 kfree(ses->serverNOS);
3043                                                 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3044                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3045                                                 bcc_ptr += len;
3046                                                 bcc_ptr[0] = 0;
3047                                                 bcc_ptr++;
3048
3049                                                 len = strnlen(bcc_ptr, 1024);
3050                                                 if(ses->serverDomain)
3051                                                         kfree(ses->serverDomain);
3052                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3053                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3054                                                 bcc_ptr += len;
3055                                                 bcc_ptr[0] = 0;
3056                                                 bcc_ptr++;
3057                                         } else
3058                                                 cFYI(1,
3059                                                      ("Variable field of length %d extends beyond end of smb ",
3060                                                       len));
3061                                 }
3062                         } else {
3063                                 cERROR(1,
3064                                        (" Security Blob Length extends beyond end of SMB"));
3065                         }
3066                 } else {
3067                         cERROR(1, ("No session structure passed in."));
3068                 }
3069         } else {
3070                 cERROR(1,
3071                        (" Invalid Word count %d: ",
3072                         smb_buffer_response->WordCount));
3073                 rc = -EIO;
3074         }
3075
3076         if (smb_buffer)
3077                 cifs_buf_release(smb_buffer);
3078
3079         return rc;
3080 }
3081
3082 int
3083 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3084          const char *tree, struct cifsTconInfo *tcon,
3085          const struct nls_table *nls_codepage)
3086 {
3087         struct smb_hdr *smb_buffer;
3088         struct smb_hdr *smb_buffer_response;
3089         TCONX_REQ *pSMB;
3090         TCONX_RSP *pSMBr;
3091         unsigned char *bcc_ptr;
3092         int rc = 0;
3093         int length;
3094         __u16 count;
3095
3096         if (ses == NULL)
3097                 return -EIO;
3098
3099         smb_buffer = cifs_buf_get();
3100         if (smb_buffer == NULL) {
3101                 return -ENOMEM;
3102         }
3103         smb_buffer_response = smb_buffer;
3104
3105         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3106                         NULL /*no tid */ , 4 /*wct */ );
3107
3108         smb_buffer->Mid = GetNextMid(ses->server);
3109         smb_buffer->Uid = ses->Suid;
3110         pSMB = (TCONX_REQ *) smb_buffer;
3111         pSMBr = (TCONX_RSP *) smb_buffer_response;
3112
3113         pSMB->AndXCommand = 0xFF;
3114         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3115         bcc_ptr = &pSMB->Password[0];
3116         if((ses->server->secMode) & SECMODE_USER) {
3117                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3118                 *bcc_ptr = 0; /* password is null byte */
3119                 bcc_ptr++;              /* skip password */
3120                 /* already aligned so no need to do it below */
3121         } else {
3122                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3123                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3124                    specified as required (when that support is added to
3125                    the vfs in the future) as only NTLM or the much
3126                    weaker LANMAN (which we do not send by default) is accepted
3127                    by Samba (not sure whether other servers allow
3128                    NTLMv2 password here) */
3129 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3130                 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3131                         (ses->server->secType == LANMAN))
3132                         calc_lanman_hash(ses, bcc_ptr);
3133                 else
3134 #endif /* CIFS_WEAK_PW_HASH */
3135                 SMBNTencrypt(ses->password,
3136                              ses->server->cryptKey,
3137                              bcc_ptr);
3138
3139                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3140                 if(ses->capabilities & CAP_UNICODE) {
3141                         /* must align unicode strings */
3142                         *bcc_ptr = 0; /* null byte password */
3143                         bcc_ptr++;
3144                 }
3145         }
3146
3147         if(ses->server->secMode &
3148                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3149                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3150
3151         if (ses->capabilities & CAP_STATUS32) {
3152                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3153         }
3154         if (ses->capabilities & CAP_DFS) {
3155                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3156         }
3157         if (ses->capabilities & CAP_UNICODE) {
3158                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3159                 length =
3160                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3161                         6 /* max utf8 char length in bytes */ *
3162                         (/* server len*/ + 256 /* share len */), nls_codepage);
3163                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3164                 bcc_ptr += 2;   /* skip trailing null */
3165         } else {                /* ASCII */
3166                 strcpy(bcc_ptr, tree);
3167                 bcc_ptr += strlen(tree) + 1;
3168         }
3169         strcpy(bcc_ptr, "?????");
3170         bcc_ptr += strlen("?????");
3171         bcc_ptr += 1;
3172         count = bcc_ptr - &pSMB->Password[0];
3173         pSMB->hdr.smb_buf_length += count;
3174         pSMB->ByteCount = cpu_to_le16(count);
3175
3176         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3177
3178         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3179         /* above now done in SendReceive */
3180         if ((rc == 0) && (tcon != NULL)) {
3181                 tcon->tidStatus = CifsGood;
3182                 tcon->tid = smb_buffer_response->Tid;
3183                 bcc_ptr = pByteArea(smb_buffer_response);
3184                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3185         /* skip service field (NB: this field is always ASCII) */
3186                 bcc_ptr += length + 1;
3187                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3188                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3189                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3190                         if ((bcc_ptr + (2 * length)) -
3191                              pByteArea(smb_buffer_response) <=
3192                             BCC(smb_buffer_response)) {
3193                                 kfree(tcon->nativeFileSystem);
3194                                 tcon->nativeFileSystem =
3195                                     kzalloc(length + 2, GFP_KERNEL);
3196                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3197                                                    (__le16 *) bcc_ptr,
3198                                                    length, nls_codepage);
3199                                 bcc_ptr += 2 * length;
3200                                 bcc_ptr[0] = 0; /* null terminate the string */
3201                                 bcc_ptr[1] = 0;
3202                                 bcc_ptr += 2;
3203                         }
3204                         /* else do not bother copying these informational fields */
3205                 } else {
3206                         length = strnlen(bcc_ptr, 1024);
3207                         if ((bcc_ptr + length) -
3208                             pByteArea(smb_buffer_response) <=
3209                             BCC(smb_buffer_response)) {
3210                                 kfree(tcon->nativeFileSystem);
3211                                 tcon->nativeFileSystem =
3212                                     kzalloc(length + 1, GFP_KERNEL);
3213                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3214                                         length);
3215                         }
3216                         /* else do not bother copying these informational fields */
3217                 }
3218                 if(smb_buffer_response->WordCount == 3)
3219                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3220                 else
3221                         tcon->Flags = 0;
3222                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3223         } else if ((rc == 0) && tcon == NULL) {
3224         /* all we need to save for IPC$ connection */
3225                 ses->ipc_tid = smb_buffer_response->Tid;
3226         }
3227
3228         if (smb_buffer)
3229                 cifs_buf_release(smb_buffer);
3230         return rc;
3231 }
3232
3233 int
3234 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3235 {
3236         int rc = 0;
3237         int xid;
3238         struct cifsSesInfo *ses = NULL;
3239         struct task_struct *cifsd_task;
3240         char * tmp;
3241
3242         xid = GetXid();
3243
3244         if (cifs_sb->tcon) {
3245                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3246                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3247                 if (rc == -EBUSY) {
3248                         FreeXid(xid);
3249                         return 0;
3250                 }
3251                 tconInfoFree(cifs_sb->tcon);
3252                 if ((ses) && (ses->server)) {
3253                         /* save off task so we do not refer to ses later */
3254                         cifsd_task = ses->server->tsk;
3255                         cFYI(1, ("About to do SMBLogoff "));
3256                         rc = CIFSSMBLogoff(xid, ses);
3257                         if (rc == -EBUSY) {
3258                                 FreeXid(xid);
3259                                 return 0;
3260                         } else if (rc == -ESHUTDOWN) {
3261                                 cFYI(1,("Waking up socket by sending it signal"));
3262                                 if(cifsd_task) {
3263                                         send_sig(SIGKILL,cifsd_task,1);
3264                                         wait_for_completion(&cifsd_complete);
3265                                 }
3266                                 rc = 0;
3267                         } /* else - we have an smb session
3268                                 left on this socket do not kill cifsd */
3269                 } else
3270                         cFYI(1, ("No session or bad tcon"));
3271         }
3272
3273         cifs_sb->tcon = NULL;
3274         tmp = cifs_sb->prepath;
3275         cifs_sb->prepathlen = 0;
3276         cifs_sb->prepath = NULL;
3277         kfree(tmp);
3278         if (ses)
3279                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3280         if (ses)
3281                 sesInfoFree(ses);
3282
3283         FreeXid(xid);
3284         return rc;              /* BB check if we should always return zero here */
3285 }
3286
3287 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3288                                            struct nls_table * nls_info)
3289 {
3290         int rc = 0;
3291         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3292         int ntlmv2_flag = FALSE;
3293         int first_time = 0;
3294
3295         /* what if server changes its buffer size after dropping the session? */
3296         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3297                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3298                 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3299                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3300                         if(rc == -EAGAIN)
3301                                 rc = -EHOSTDOWN;
3302                 }
3303                 if(rc == 0) {
3304                         spin_lock(&GlobalMid_Lock);
3305                         if(pSesInfo->server->tcpStatus != CifsExiting)
3306                                 pSesInfo->server->tcpStatus = CifsGood;
3307                         else
3308                                 rc = -EHOSTDOWN;
3309                         spin_unlock(&GlobalMid_Lock);
3310
3311                 }
3312                 first_time = 1;
3313         }
3314         if (!rc) {
3315                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3316                 if(linuxExtEnabled == 0)
3317                         pSesInfo->capabilities &= (~CAP_UNIX);
3318         /*      pSesInfo->sequence_number = 0;*/
3319                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x Time Zone: %d",
3320                         pSesInfo->server->secMode,
3321                         pSesInfo->server->capabilities,
3322                         pSesInfo->server->timeZone));
3323                 if(experimEnabled < 2)
3324                         rc = CIFS_SessSetup(xid, pSesInfo,
3325                                             first_time, nls_info);
3326                 else if (extended_security
3327                                 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3328                                 && (pSesInfo->server->secType == NTLMSSP)) {
3329                         rc = -EOPNOTSUPP;
3330                 } else if (extended_security
3331                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3332                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3333                         cFYI(1, ("NTLMSSP sesssetup"));
3334                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3335                                                 pSesInfo,
3336                                                 &ntlmv2_flag,
3337                                                 nls_info);
3338                         if (!rc) {
3339                                 if(ntlmv2_flag) {
3340                                         char * v2_response;
3341                                         cFYI(1,("Can use more secure NTLM version 2 password hash"));
3342                                         if(CalcNTLMv2_partial_mac_key(pSesInfo,
3343                                                 nls_info)) {
3344                                                 rc = -ENOMEM;
3345                                                 goto ss_err_exit;
3346                                         } else
3347                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3348                                         if(v2_response) {
3349                                                 CalcNTLMv2_response(pSesInfo,v2_response);
3350                                 /*              if(first_time)
3351                                                         cifs_calculate_ntlmv2_mac_key(
3352                                                           pSesInfo->server->mac_signing_key,
3353                                                           response, ntlm_session_key, */
3354                                                 kfree(v2_response);
3355                                         /* BB Put dummy sig in SessSetup PDU? */
3356                                         } else {
3357                                                 rc = -ENOMEM;
3358                                                 goto ss_err_exit;
3359                                         }
3360
3361                                 } else {
3362                                         SMBNTencrypt(pSesInfo->password,
3363                                                 pSesInfo->server->cryptKey,
3364                                                 ntlm_session_key);
3365
3366                                         if(first_time)
3367                                                 cifs_calculate_mac_key(
3368                                                         pSesInfo->server->mac_signing_key,
3369                                                         ntlm_session_key,
3370                                                         pSesInfo->password);
3371                                 }
3372                         /* for better security the weaker lanman hash not sent
3373                            in AuthSessSetup so we no longer calculate it */
3374
3375                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3376                                         pSesInfo,
3377                                         ntlm_session_key,
3378                                         ntlmv2_flag,
3379                                         nls_info);
3380                         }
3381                 } else { /* old style NTLM 0.12 session setup */
3382                         SMBNTencrypt(pSesInfo->password,
3383                                 pSesInfo->server->cryptKey,
3384                                 ntlm_session_key);
3385
3386                         if(first_time)
3387                                 cifs_calculate_mac_key(
3388                                         pSesInfo->server->mac_signing_key,
3389                                         ntlm_session_key, pSesInfo->password);
3390
3391                         rc = CIFSSessSetup(xid, pSesInfo,
3392                                 ntlm_session_key, nls_info);
3393                 }
3394                 if (rc) {
3395                         cERROR(1,("Send error in SessSetup = %d",rc));
3396                 } else {
3397                         cFYI(1,("CIFS Session Established successfully"));
3398                         pSesInfo->status = CifsGood;
3399                 }
3400         }
3401 ss_err_exit:
3402         return rc;
3403 }
3404