err.no Git - linux-2.6/blob - fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2006
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <asm/uaccess.h>
  37 #include <asm/processor.h>
  38 #include "cifspdu.h"
  39 #include "cifsglob.h"
  40 #include "cifsproto.h"
  41 #include "cifs_unicode.h"
  42 #include "cifs_debug.h"
  43 #include "cifs_fs_sb.h"
  44 #include "ntlmssp.h"
  45 #include "nterr.h"
  46 #include "rfc1002pdu.h"
  47 #include "cn_cifs.h"
  48
  49 #define CIFS_PORT 445
  50 #define RFC1001_PORT 139
  51
  52 static DECLARE_COMPLETION(cifsd_complete);
  53
  54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  55                          unsigned char *p24);
  56
  57 extern mempool_t *cifs_req_poolp;
  58
  59 struct smb_vol {
  60         char *username;
  61         char *password;
  62         char *domainname;
  63         char *UNC;
  64         char *UNCip;
  65         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  66         char *iocharset;  /* local code page for mapping to and from Unicode */
  67         char source_rfc1001_name[16]; /* netbios name of client */
  68         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  69         uid_t linux_uid;
  70         gid_t linux_gid;
  71         mode_t file_mode;
  72         mode_t dir_mode;
  73         unsigned secFlg;
  74         unsigned rw:1;
  75         unsigned retry:1;
  76         unsigned intr:1;
  77         unsigned setuids:1;
  78         unsigned noperm:1;
  79         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  80         unsigned cifs_acl:1;
  81         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  82         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  83         unsigned direct_io:1;
  84         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  85         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  86         unsigned sfu_emul:1;
  87         unsigned nullauth:1; /* attempt to authenticate with null user */
  88         unsigned nocase;     /* request case insensitive filenames */
  89         unsigned nobrl;      /* disable sending byte range locks to srv */
  90         unsigned int rsize;
  91         unsigned int wsize;
  92         unsigned int sockopt;
  93         unsigned short int port;
  94         char * prepath;
  95 };
  96
  97 static int ipv4_connect(struct sockaddr_in *psin_server,
  98                         struct socket **csocket,
  99                         char * netb_name,
 100                         char * server_netb_name);
 101 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 102                         struct socket **csocket);
 103
 104
 105         /*
 106          * cifs tcp session reconnection
 107          *
 108          * mark tcp session as reconnecting so temporarily locked
 109          * mark all smb sessions as reconnecting for tcp session
 110          * reconnect tcp session
 111          * wake up waiters on reconnection? - (not needed currently)
 112          */
 113
 114 static int
 115 cifs_reconnect(struct TCP_Server_Info *server)
 116 {
 117         int rc = 0;
 118         struct list_head *tmp;
 119         struct cifsSesInfo *ses;
 120         struct cifsTconInfo *tcon;
 121         struct mid_q_entry * mid_entry;
 122
 123         spin_lock(&GlobalMid_Lock);
 124         if( kthread_should_stop() ) {
 125                 /* the demux thread will exit normally
 126                 next time through the loop */
 127                 spin_unlock(&GlobalMid_Lock);
 128                 return rc;
 129         } else
 130                 server->tcpStatus = CifsNeedReconnect;
 131         spin_unlock(&GlobalMid_Lock);
 132         server->maxBuf = 0;
 133
 134         cFYI(1, ("Reconnecting tcp session"));
 135
 136         /* before reconnecting the tcp session, mark the smb session (uid)
 137                 and the tid bad so they are not used until reconnected */
 138         read_lock(&GlobalSMBSeslock);
 139         list_for_each(tmp, &GlobalSMBSessionList) {
 140                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 141                 if (ses->server) {
 142                         if (ses->server == server) {
 143                                 ses->status = CifsNeedReconnect;
 144                                 ses->ipc_tid = 0;
 145                         }
 146                 }
 147                 /* else tcp and smb sessions need reconnection */
 148         }
 149         list_for_each(tmp, &GlobalTreeConnectionList) {
 150                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 151                 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 152                         tcon->tidStatus = CifsNeedReconnect;
 153                 }
 154         }
 155         read_unlock(&GlobalSMBSeslock);
 156         /* do not want to be sending data on a socket we are freeing */
 157         down(&server->tcpSem);
 158         if(server->ssocket) {
 159                 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 160                         server->ssocket->flags));
 161                 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
 162                 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
 163                         server->ssocket->flags));
 164                 sock_release(server->ssocket);
 165                 server->ssocket = NULL;
 166         }
 167
 168         spin_lock(&GlobalMid_Lock);
 169         list_for_each(tmp, &server->pending_mid_q) {
 170                 mid_entry = list_entry(tmp, struct
 171                                         mid_q_entry,
 172                                         qhead);
 173                 if(mid_entry) {
 174                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
 175                                 /* Mark other intransit requests as needing
 176                                    retry so we do not immediately mark the
 177                                    session bad again (ie after we reconnect
 178                                    below) as they timeout too */
 179                                 mid_entry->midState = MID_RETRY_NEEDED;
 180                         }
 181                 }
 182         }
 183         spin_unlock(&GlobalMid_Lock);
 184         up(&server->tcpSem);
 185
 186         while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood))
 187         {
 188                 try_to_freeze();
 189                 if(server->protocolType == IPV6) {
 190                         rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
 191                 } else {
 192                         rc = ipv4_connect(&server->addr.sockAddr,
 193                                         &server->ssocket,
 194                                         server->workstation_RFC1001_name,
 195                                         server->server_RFC1001_name);
 196                 }
 197                 if(rc) {
 198                         cFYI(1,("reconnect error %d",rc));
 199                         msleep(3000);
 200                 } else {
 201                         atomic_inc(&tcpSesReconnectCount);
 202                         spin_lock(&GlobalMid_Lock);
 203                         if( !kthread_should_stop() )
 204                                 server->tcpStatus = CifsGood;
 205                         server->sequence_number = 0;
 206                         spin_unlock(&GlobalMid_Lock);
 207         /*              atomic_set(&server->inFlight,0);*/
 208                         wake_up(&server->response_q);
 209                 }
 210         }
 211         return rc;
 212 }
 213
 214 /*
 215         return codes:
 216                 0       not a transact2, or all data present
 217                 >0      transact2 with that much data missing
 218                 -EINVAL = invalid transact2
 219
 220  */
 221 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
 222 {
 223         struct smb_t2_rsp * pSMBt;
 224         int total_data_size;
 225         int data_in_this_rsp;
 226         int remaining;
 227
 228         if(pSMB->Command != SMB_COM_TRANSACTION2)
 229                 return 0;
 230
 231         /* check for plausible wct, bcc and t2 data and parm sizes */
 232         /* check for parm and data offset going beyond end of smb */
 233         if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 234                 cFYI(1,("invalid transact2 word count"));
 235                 return -EINVAL;
 236         }
 237
 238         pSMBt = (struct smb_t2_rsp *)pSMB;
 239
 240         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 241         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 242
 243         remaining = total_data_size - data_in_this_rsp;
 244
 245         if(remaining == 0)
 246                 return 0;
 247         else if(remaining < 0) {
 248                 cFYI(1,("total data %d smaller than data in frame %d",
 249                         total_data_size, data_in_this_rsp));
 250                 return -EINVAL;
 251         } else {
 252                 cFYI(1,("missing %d bytes from transact2, check next response",
 253                         remaining));
 254                 if(total_data_size > maxBufSize) {
 255                         cERROR(1,("TotalDataSize %d is over maximum buffer %d",
 256                                 total_data_size,maxBufSize));
 257                         return -EINVAL;
 258                 }
 259                 return remaining;
 260         }
 261 }
 262
 263 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
 264 {
 265         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 266         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 267         int total_data_size;
 268         int total_in_buf;
 269         int remaining;
 270         int total_in_buf2;
 271         char * data_area_of_target;
 272         char * data_area_of_buf2;
 273         __u16 byte_count;
 274
 275         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 276
 277         if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 278                 cFYI(1,("total data sizes of primary and secondary t2 differ"));
 279         }
 280
 281         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 282
 283         remaining = total_data_size - total_in_buf;
 284
 285         if(remaining < 0)
 286                 return -EINVAL;
 287
 288         if(remaining == 0) /* nothing to do, ignore */
 289                 return 0;
 290
 291         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 292         if(remaining < total_in_buf2) {
 293                 cFYI(1,("transact2 2nd response contains too much data"));
 294         }
 295
 296         /* find end of first SMB data area */
 297         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 298                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 299         /* validate target area */
 300
 301         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 302                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 303
 304         data_area_of_target += total_in_buf;
 305
 306         /* copy second buffer into end of first buffer */
 307         memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
 308         total_in_buf += total_in_buf2;
 309         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 310         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 311         byte_count += total_in_buf2;
 312         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 313
 314         byte_count = pTargetSMB->smb_buf_length;
 315         byte_count += total_in_buf2;
 316
 317         /* BB also add check that we are not beyond maximum buffer size */
 318
 319         pTargetSMB->smb_buf_length = byte_count;
 320
 321         if(remaining == total_in_buf2) {
 322                 cFYI(1,("found the last secondary response"));
 323                 return 0; /* we are done */
 324         } else /* more responses to go */
 325                 return 1;
 326
 327 }
 328
 329 static int
 330 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 331 {
 332         int length;
 333         unsigned int pdu_length, total_read;
 334         struct smb_hdr *smb_buffer = NULL;
 335         struct smb_hdr *bigbuf = NULL;
 336         struct smb_hdr *smallbuf = NULL;
 337         struct msghdr smb_msg;
 338         struct kvec iov;
 339         struct socket *csocket = server->ssocket;
 340         struct list_head *tmp;
 341         struct cifsSesInfo *ses;
 342         struct task_struct *task_to_wake = NULL;
 343         struct mid_q_entry *mid_entry;
 344         char temp;
 345         int isLargeBuf = FALSE;
 346         int isMultiRsp;
 347         int reconnect;
 348
 349         allow_signal(SIGKILL);
 350         current->flags |= PF_MEMALLOC;
 351         server->tsk = current;  /* save process info to wake at shutdown */
 352         cFYI(1, ("Demultiplex PID: %d", current->pid));
 353         write_lock(&GlobalSMBSeslock);
 354         atomic_inc(&tcpSesAllocCount);
 355         length = tcpSesAllocCount.counter;
 356         write_unlock(&GlobalSMBSeslock);
 357         complete(&cifsd_complete);
 358         if(length  > 1) {
 359                 mempool_resize(cifs_req_poolp,
 360                         length + cifs_min_rcv,
 361                         GFP_KERNEL);
 362         }
 363
 364         while (!kthread_should_stop()) {
 365                 if (try_to_freeze())
 366                         continue;
 367                 if (bigbuf == NULL) {
 368                         bigbuf = cifs_buf_get();
 369                         if (!bigbuf) {
 370                                 cERROR(1, ("No memory for large SMB response"));
 371                                 msleep(3000);
 372                                 /* retry will check if exiting */
 373                                 continue;
 374                         }
 375                 } else if (isLargeBuf) {
 376                         /* we are reusing a dirty large buf, clear its start */
 377                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 378                 }
 379
 380                 if (smallbuf == NULL) {
 381                         smallbuf = cifs_small_buf_get();
 382                         if (!smallbuf) {
 383                                 cERROR(1, ("No memory for SMB response"));
 384                                 msleep(1000);
 385                                 /* retry will check if exiting */
 386                                 continue;
 387                         }
 388                         /* beginning of smb buffer is cleared in our buf_get */
 389                 } else /* if existing small buf clear beginning */
 390                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 391
 392                 isLargeBuf = FALSE;
 393                 isMultiRsp = FALSE;
 394                 smb_buffer = smallbuf;
 395                 iov.iov_base = smb_buffer;
 396                 iov.iov_len = 4;
 397                 smb_msg.msg_control = NULL;
 398                 smb_msg.msg_controllen = 0;
 399                 length =
 400                     kernel_recvmsg(csocket, &smb_msg,
 401                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 402
 403                 if ( kthread_should_stop() ) {
 404                         break;
 405                 } else if (server->tcpStatus == CifsNeedReconnect) {
 406                         cFYI(1, ("Reconnect after server stopped responding"));
 407                         cifs_reconnect(server);
 408                         cFYI(1, ("call to reconnect done"));
 409                         csocket = server->ssocket;
 410                         continue;
 411                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 412                         msleep(1); /* minimum sleep to prevent looping
 413                                 allowing socket to clear and app threads to set
 414                                 tcpStatus CifsNeedReconnect if server hung */
 415                         continue;
 416                 } else if (length <= 0) {
 417                         if (server->tcpStatus == CifsNew) {
 418                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 419                                 /* some servers kill the TCP session rather than
 420                                    returning an SMB negprot error, in which
 421                                    case reconnecting here is not going to help,
 422                                    and so simply return error to mount */
 423                                 break;
 424                         }
 425                         if (!try_to_freeze() && (length == -EINTR)) {
 426                                 cFYI(1,("cifsd thread killed"));
 427                                 break;
 428                         }
 429                         cFYI(1,("Reconnect after unexpected peek error %d",
 430                                 length));
 431                         cifs_reconnect(server);
 432                         csocket = server->ssocket;
 433                         wake_up(&server->response_q);
 434                         continue;
 435                 } else if (length < 4) {
 436                         cFYI(1,
 437                             ("Frame under four bytes received (%d bytes long)",
 438                               length));
 439                         cifs_reconnect(server);
 440                         csocket = server->ssocket;
 441                         wake_up(&server->response_q);
 442                         continue;
 443                 }
 444
 445                 /* The right amount was read from socket - 4 bytes */
 446                 /* so we can now interpret the length field */
 447
 448                 /* the first byte big endian of the length field,
 449                 is actually not part of the length but the type
 450                 with the most common, zero, as regular data */
 451                 temp = *((char *) smb_buffer);
 452
 453                 /* Note that FC 1001 length is big endian on the wire,
 454                 but we convert it here so it is always manipulated
 455                 as host byte order */
 456                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 457                 smb_buffer->smb_buf_length = pdu_length;
 458
 459                 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
 460
 461                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 462                         continue;
 463                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 464                         cFYI(1,("Good RFC 1002 session rsp"));
 465                         continue;
 466                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 467                         /* we get this from Windows 98 instead of
 468                            an error on SMB negprot response */
 469                         cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
 470                                 pdu_length));
 471                         if(server->tcpStatus == CifsNew) {
 472                                 /* if nack on negprot (rather than
 473                                 ret of smb negprot error) reconnecting
 474                                 not going to help, ret error to mount */
 475                                 break;
 476                         } else {
 477                                 /* give server a second to
 478                                 clean up before reconnect attempt */
 479                                 msleep(1000);
 480                                 /* always try 445 first on reconnect
 481                                 since we get NACK on some if we ever
 482                                 connected to port 139 (the NACK is
 483                                 since we do not begin with RFC1001
 484                                 session initialize frame) */
 485                                 server->addr.sockAddr.sin_port =
 486                                         htons(CIFS_PORT);
 487                                 cifs_reconnect(server);
 488                                 csocket = server->ssocket;
 489                                 wake_up(&server->response_q);
 490                                 continue;
 491                         }
 492                 } else if (temp != (char) 0) {
 493                         cERROR(1,("Unknown RFC 1002 frame"));
 494                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 495                                       length);
 496                         cifs_reconnect(server);
 497                         csocket = server->ssocket;
 498                         continue;
 499                 }
 500
 501                 /* else we have an SMB response */
 502                 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 503                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 504                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 505                                         length, pdu_length+4));
 506                         cifs_reconnect(server);
 507                         csocket = server->ssocket;
 508                         wake_up(&server->response_q);
 509                         continue;
 510                 }
 511
 512                 /* else length ok */
 513                 reconnect = 0;
 514
 515                 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 516                         isLargeBuf = TRUE;
 517                         memcpy(bigbuf, smallbuf, 4);
 518                         smb_buffer = bigbuf;
 519                 }
 520                 length = 0;
 521                 iov.iov_base = 4 + (char *)smb_buffer;
 522                 iov.iov_len = pdu_length;
 523                 for (total_read = 0; total_read < pdu_length;
 524                      total_read += length) {
 525                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 526                                                 pdu_length - total_read, 0);
 527                         if( kthread_should_stop() ||
 528                             (length == -EINTR)) {
 529                                 /* then will exit */
 530                                 reconnect = 2;
 531                                 break;
 532                         } else if (server->tcpStatus == CifsNeedReconnect) {
 533                                 cifs_reconnect(server);
 534                                 csocket = server->ssocket;
 535                                 /* Reconnect wakes up rspns q */
 536                                 /* Now we will reread sock */
 537                                 reconnect = 1;
 538                                 break;
 539                         } else if ((length == -ERESTARTSYS) ||
 540                                    (length == -EAGAIN)) {
 541                                 msleep(1); /* minimum sleep to prevent looping,
 542                                               allowing socket to clear and app
 543                                               threads to set tcpStatus
 544                                               CifsNeedReconnect if server hung*/
 545                                 continue;
 546                         } else if (length <= 0) {
 547                                 cERROR(1,("Received no data, expecting %d",
 548                                               pdu_length - total_read));
 549                                 cifs_reconnect(server);
 550                                 csocket = server->ssocket;
 551                                 reconnect = 1;
 552                                 break;
 553                         }
 554                 }
 555                 if(reconnect == 2)
 556                         break;
 557                 else if(reconnect == 1)
 558                         continue;
 559
 560                 length += 4; /* account for rfc1002 hdr */
 561
 562
 563                 dump_smb(smb_buffer, length);
 564                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 565                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 566                         continue;
 567                 }
 568
 569
 570                 task_to_wake = NULL;
 571                 spin_lock(&GlobalMid_Lock);
 572                 list_for_each(tmp, &server->pending_mid_q) {
 573                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 574
 575                         if ((mid_entry->mid == smb_buffer->Mid) &&
 576                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 577                             (mid_entry->command == smb_buffer->Command)) {
 578                                 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
 579                                         /* We have a multipart transact2 resp */
 580                                         isMultiRsp = TRUE;
 581                                         if(mid_entry->resp_buf) {
 582                                                 /* merge response - fix up 1st*/
 583                                                 if(coalesce_t2(smb_buffer,
 584                                                         mid_entry->resp_buf)) {
 585                                                         mid_entry->multiRsp = 1;
 586                                                         break;
 587                                                 } else {
 588                                                         /* all parts received */
 589                                                         mid_entry->multiEnd = 1;
 590                                                         goto multi_t2_fnd;
 591                                                 }
 592                                         } else {
 593                                                 if(!isLargeBuf) {
 594                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 595                                         /* BB maybe we can fix this up,  switch
 596                                            to already allocated large buffer? */
 597                                                 } else {
 598                                                         /* Have first buffer */
 599                                                         mid_entry->resp_buf =
 600                                                                  smb_buffer;
 601                                                         mid_entry->largeBuf = 1;
 602                                                         bigbuf = NULL;
 603                                                 }
 604                                         }
 605                                         break;
 606                                 }
 607                                 mid_entry->resp_buf = smb_buffer;
 608                                 if(isLargeBuf)
 609                                         mid_entry->largeBuf = 1;
 610                                 else
 611                                         mid_entry->largeBuf = 0;
 612 multi_t2_fnd:
 613                                 task_to_wake = mid_entry->tsk;
 614                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 615 #ifdef CONFIG_CIFS_STATS2
 616                                 mid_entry->when_received = jiffies;
 617 #endif
 618                                 /* so we do not time out requests to  server
 619                                 which is still responding (since server could
 620                                 be busy but not dead) */
 621                                 server->lstrp = jiffies;
 622                                 break;
 623                         }
 624                 }
 625                 spin_unlock(&GlobalMid_Lock);
 626                 if (task_to_wake) {
 627                         /* Was previous buf put in mpx struct for multi-rsp? */
 628                         if(!isMultiRsp) {
 629                                 /* smb buffer will be freed by user thread */
 630                                 if(isLargeBuf) {
 631                                         bigbuf = NULL;
 632                                 } else
 633                                         smallbuf = NULL;
 634                         }
 635                         wake_up_process(task_to_wake);
 636                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 637                     && (isMultiRsp == FALSE)) {
 638                         cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
 639                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
 640                                       sizeof(struct smb_hdr));
 641 #ifdef CONFIG_CIFS_DEBUG2
 642                         cifs_dump_detail(smb_buffer);
 643                         cifs_dump_mids(server);
 644 #endif /* CIFS_DEBUG2 */
 645
 646                 }
 647         } /* end while !EXITING */
 648
 649         spin_lock(&GlobalMid_Lock);
 650         server->tcpStatus = CifsExiting;
 651         server->tsk = NULL;
 652         /* check if we have blocked requests that need to free */
 653         /* Note that cifs_max_pending is normally 50, but
 654         can be set at module install time to as little as two */
 655         if(atomic_read(&server->inFlight) >= cifs_max_pending)
 656                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 657         /* We do not want to set the max_pending too low or we
 658         could end up with the counter going negative */
 659         spin_unlock(&GlobalMid_Lock);
 660         /* Although there should not be any requests blocked on
 661         this queue it can not hurt to be paranoid and try to wake up requests
 662         that may haven been blocked when more than 50 at time were on the wire
 663         to the same server - they now will see the session is in exit state
 664         and get out of SendReceive.  */
 665         wake_up_all(&server->request_q);
 666         /* give those requests time to exit */
 667         msleep(125);
 668
 669         if(server->ssocket) {
 670                 sock_release(csocket);
 671                 server->ssocket = NULL;
 672         }
 673         /* buffer usuallly freed in free_mid - need to free it here on exit */
 674         if (bigbuf != NULL)
 675                 cifs_buf_release(bigbuf);
 676         if (smallbuf != NULL)
 677                 cifs_small_buf_release(smallbuf);
 678
 679         read_lock(&GlobalSMBSeslock);
 680         if (list_empty(&server->pending_mid_q)) {
 681                 /* loop through server session structures attached to this and
 682                     mark them dead */
 683                 list_for_each(tmp, &GlobalSMBSessionList) {
 684                         ses =
 685                             list_entry(tmp, struct cifsSesInfo,
 686                                        cifsSessionList);
 687                         if (ses->server == server) {
 688                                 ses->status = CifsExiting;
 689                                 ses->server = NULL;
 690                         }
 691                 }
 692                 read_unlock(&GlobalSMBSeslock);
 693         } else {
 694                 /* although we can not zero the server struct pointer yet,
 695                 since there are active requests which may depnd on them,
 696                 mark the corresponding SMB sessions as exiting too */
 697                 list_for_each(tmp, &GlobalSMBSessionList) {
 698                         ses = list_entry(tmp, struct cifsSesInfo,
 699                                          cifsSessionList);
 700                         if (ses->server == server) {
 701                                 ses->status = CifsExiting;
 702                         }
 703                 }
 704
 705                 spin_lock(&GlobalMid_Lock);
 706                 list_for_each(tmp, &server->pending_mid_q) {
 707                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 708                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 709                                 cFYI(1,
 710                                   ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
 711                                 task_to_wake = mid_entry->tsk;
 712                                 if(task_to_wake) {
 713                                         wake_up_process(task_to_wake);
 714                                 }
 715                         }
 716                 }
 717                 spin_unlock(&GlobalMid_Lock);
 718                 read_unlock(&GlobalSMBSeslock);
 719                 /* 1/8th of sec is more than enough time for them to exit */
 720                 msleep(125);
 721         }
 722
 723         if (!list_empty(&server->pending_mid_q)) {
 724                 /* mpx threads have not exited yet give them
 725                 at least the smb send timeout time for long ops */
 726                 /* due to delays on oplock break requests, we need
 727                 to wait at least 45 seconds before giving up
 728                 on a request getting a response and going ahead
 729                 and killing cifsd */
 730                 cFYI(1, ("Wait for exit from demultiplex thread"));
 731                 msleep(46000);
 732                 /* if threads still have not exited they are probably never
 733                 coming home not much else we can do but free the memory */
 734         }
 735
 736         write_lock(&GlobalSMBSeslock);
 737         atomic_dec(&tcpSesAllocCount);
 738         length = tcpSesAllocCount.counter;
 739
 740         /* last chance to mark ses pointers invalid
 741         if there are any pointing to this (e.g
 742         if a crazy root user tried to kill cifsd
 743         kernel thread explicitly this might happen) */
 744         list_for_each(tmp, &GlobalSMBSessionList) {
 745                 ses = list_entry(tmp, struct cifsSesInfo,
 746                                 cifsSessionList);
 747                 if (ses->server == server) {
 748                         ses->server = NULL;
 749                 }
 750         }
 751         write_unlock(&GlobalSMBSeslock);
 752
 753         kfree(server);
 754         if(length  > 0) {
 755                 mempool_resize(cifs_req_poolp,
 756                         length + cifs_min_rcv,
 757                         GFP_KERNEL);
 758         }
 759
 760         return 0;
 761 }
 762
 763 static int
 764 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 765 {
 766         char *value;
 767         char *data;
 768         unsigned int  temp_len, i, j;
 769         char separator[2];
 770
 771         separator[0] = ',';
 772         separator[1] = 0;
 773
 774         if (Local_System_Name[0] != 0)
 775                 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
 776         else {
 777                 char *nodename = utsname()->nodename;
 778                 int n = strnlen(nodename,15);
 779                 memset(vol->source_rfc1001_name,0x20,15);
 780                 for(i=0 ; i < n ; i++) {
 781                         /* does not have to be perfect mapping since field is
 782                         informational, only used for servers that do not support
 783                         port 445 and it can be overridden at mount time */
 784                         vol->source_rfc1001_name[i] = toupper(nodename[i]);
 785                 }
 786         }
 787         vol->source_rfc1001_name[15] = 0;
 788         /* null target name indicates to use *SMBSERVR default called name
 789            if we end up sending RFC1001 session initialize */
 790         vol->target_rfc1001_name[0] = 0;
 791         vol->linux_uid = current->uid;  /* current->euid instead? */
 792         vol->linux_gid = current->gid;
 793         vol->dir_mode = S_IRWXUGO;
 794         /* 2767 perms indicate mandatory locking support */
 795         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 796
 797         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 798         vol->rw = TRUE;
 799         /* default is always to request posix paths. */
 800         vol->posix_paths = 1;
 801
 802         if (!options)
 803                 return 1;
 804
 805         if(strncmp(options,"sep=",4) == 0) {
 806                 if(options[4] != 0) {
 807                         separator[0] = options[4];
 808                         options += 5;
 809                 } else {
 810                         cFYI(1,("Null separator not allowed"));
 811                 }
 812         }
 813
 814         while ((data = strsep(&options, separator)) != NULL) {
 815                 if (!*data)
 816                         continue;
 817                 if ((value = strchr(data, '=')) != NULL)
 818                         *value++ = '\0';
 819
 820                 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
 821                         vol->no_xattr = 0;
 822                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
 823                         vol->no_xattr = 1;
 824                 } else if (strnicmp(data, "user", 4) == 0) {
 825                         if (!value) {
 826                                 printk(KERN_WARNING
 827                                        "CIFS: invalid or missing username\n");
 828                                 return 1;       /* needs_arg; */
 829                         } else if(!*value) {
 830                                 /* null user, ie anonymous, authentication */
 831                                 vol->nullauth = 1;
 832                         }
 833                         if (strnlen(value, 200) < 200) {
 834                                 vol->username = value;
 835                         } else {
 836                                 printk(KERN_WARNING "CIFS: username too long\n");
 837                                 return 1;
 838                         }
 839                 } else if (strnicmp(data, "pass", 4) == 0) {
 840                         if (!value) {
 841                                 vol->password = NULL;
 842                                 continue;
 843                         } else if(value[0] == 0) {
 844                                 /* check if string begins with double comma
 845                                    since that would mean the password really
 846                                    does start with a comma, and would not
 847                                    indicate an empty string */
 848                                 if(value[1] != separator[0]) {
 849                                         vol->password = NULL;
 850                                         continue;
 851                                 }
 852                         }
 853                         temp_len = strlen(value);
 854                         /* removed password length check, NTLM passwords
 855                                 can be arbitrarily long */
 856
 857                         /* if comma in password, the string will be
 858                         prematurely null terminated.  Commas in password are
 859                         specified across the cifs mount interface by a double
 860                         comma ie ,, and a comma used as in other cases ie ','
 861                         as a parameter delimiter/separator is single and due
 862                         to the strsep above is temporarily zeroed. */
 863
 864                         /* NB: password legally can have multiple commas and
 865                         the only illegal character in a password is null */
 866
 867                         if ((value[temp_len] == 0) &&
 868                             (value[temp_len+1] == separator[0])) {
 869                                 /* reinsert comma */
 870                                 value[temp_len] = separator[0];
 871                                 temp_len+=2;  /* move after the second comma */
 872                                 while(value[temp_len] != 0)  {
 873                                         if (value[temp_len] == separator[0]) {
 874                                                 if (value[temp_len+1] ==
 875                                                      separator[0]) {
 876                                                 /* skip second comma */
 877                                                         temp_len++;
 878                                                 } else {
 879                                                 /* single comma indicating start
 880                                                          of next parm */
 881                                                         break;
 882                                                 }
 883                                         }
 884                                         temp_len++;
 885                                 }
 886                                 if(value[temp_len] == 0) {
 887                                         options = NULL;
 888                                 } else {
 889                                         value[temp_len] = 0;
 890                                         /* point option to start of next parm */
 891                                         options = value + temp_len + 1;
 892                                 }
 893                                 /* go from value to value + temp_len condensing
 894                                 double commas to singles. Note that this ends up
 895                                 allocating a few bytes too many, which is ok */
 896                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 897                                 if(vol->password == NULL) {
 898                                         printk("CIFS: no memory for pass\n");
 899                                         return 1;
 900                                 }
 901                                 for(i=0,j=0;i<temp_len;i++,j++) {
 902                                         vol->password[j] = value[i];
 903                                         if(value[i] == separator[0]
 904                                                 && value[i+1] == separator[0]) {
 905                                                 /* skip second comma */
 906                                                 i++;
 907                                         }
 908                                 }
 909                                 vol->password[j] = 0;
 910                         } else {
 911                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 912                                 if(vol->password == NULL) {
 913                                         printk("CIFS: no memory for pass\n");
 914                                         return 1;
 915                                 }
 916                                 strcpy(vol->password, value);
 917                         }
 918                 } else if (strnicmp(data, "ip", 2) == 0) {
 919                         if (!value || !*value) {
 920                                 vol->UNCip = NULL;
 921                         } else if (strnlen(value, 35) < 35) {
 922                                 vol->UNCip = value;
 923                         } else {
 924                                 printk(KERN_WARNING "CIFS: ip address too long\n");
 925                                 return 1;
 926                         }
 927                 } else if (strnicmp(data, "sec", 3) == 0) {
 928                         if (!value || !*value) {
 929                                 cERROR(1,("no security value specified"));
 930                                 continue;
 931                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 932                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 933                                         CIFSSEC_MUST_SIGN;
 934                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 935                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 936                                         CIFSSEC_MAY_KRB5; */
 937                                 cERROR(1,("Krb5 cifs privacy not supported"));
 938                                 return 1;
 939                         } else if (strnicmp(value, "krb5", 4) == 0) {
 940                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 941                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 942                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 943                                         CIFSSEC_MUST_SIGN;
 944                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 945                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 946                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 947                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 948                                         CIFSSEC_MUST_SIGN;
 949                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 950                                 /* ntlm is default so can be turned off too */
 951                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 952                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 953                                 /* BB is there a better way to do this? */
 954                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 955 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 956                         } else if (strnicmp(value, "lanman", 6) == 0) {
 957                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 958 #endif
 959                         } else if (strnicmp(value, "none", 4) == 0) {
 960                                 vol->nullauth = 1;
 961                         } else {
 962                                 cERROR(1,("bad security option: %s", value));
 963                                 return 1;
 964                         }
 965                 } else if ((strnicmp(data, "unc", 3) == 0)
 966                            || (strnicmp(data, "target", 6) == 0)
 967                            || (strnicmp(data, "path", 4) == 0)) {
 968                         if (!value || !*value) {
 969                                 printk(KERN_WARNING
 970                                        "CIFS: invalid path to network resource\n");
 971                                 return 1;       /* needs_arg; */
 972                         }
 973                         if ((temp_len = strnlen(value, 300)) < 300) {
 974                                 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
 975                                 if(vol->UNC == NULL)
 976                                         return 1;
 977                                 strcpy(vol->UNC,value);
 978                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 979                                         vol->UNC[0] = '\\';
 980                                         vol->UNC[1] = '\\';
 981                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 982                                         printk(KERN_WARNING
 983                                                "CIFS: UNC Path does not begin with // or \\\\ \n");
 984                                         return 1;
 985                                 }
 986                         } else {
 987                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 988                                 return 1;
 989                         }
 990                 } else if ((strnicmp(data, "domain", 3) == 0)
 991                            || (strnicmp(data, "workgroup", 5) == 0)) {
 992                         if (!value || !*value) {
 993                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
 994                                 return 1;       /* needs_arg; */
 995                         }
 996                         /* BB are there cases in which a comma can be valid in
 997                         a domain name and need special handling? */
 998                         if (strnlen(value, 256) < 256) {
 999                                 vol->domainname = value;
1000                                 cFYI(1, ("Domain name set"));
1001                         } else {
1002                                 printk(KERN_WARNING "CIFS: domain name too long\n");
1003                                 return 1;
1004                         }
1005                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1006                         if (!value || !*value) {
1007                                 printk(KERN_WARNING
1008                                        "CIFS: invalid path prefix\n");
1009                                 return 1;       /* needs_arg; */
1010                         }
1011                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1012                                 if(value[0] != '/')
1013                                         temp_len++;  /* missing leading slash */
1014                                 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1015                                 if(vol->prepath == NULL)
1016                                         return 1;
1017                                 if(value[0] != '/') {
1018                                         vol->prepath[0] = '/';
1019                                         strcpy(vol->prepath+1,value);
1020                                 } else
1021                                         strcpy(vol->prepath,value);
1022                                 cFYI(1,("prefix path %s",vol->prepath));
1023                         } else {
1024                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1025                                 return 1;
1026                         }
1027                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1028                         if (!value || !*value) {
1029                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1030                                 return 1;       /* needs_arg; */
1031                         }
1032                         if (strnlen(value, 65) < 65) {
1033                                 if(strnicmp(value,"default",7))
1034                                         vol->iocharset = value;
1035                                 /* if iocharset not set load_nls_default used by caller */
1036                                 cFYI(1, ("iocharset set to %s",value));
1037                         } else {
1038                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1039                                 return 1;
1040                         }
1041                 } else if (strnicmp(data, "uid", 3) == 0) {
1042                         if (value && *value) {
1043                                 vol->linux_uid =
1044                                         simple_strtoul(value, &value, 0);
1045                         }
1046                 } else if (strnicmp(data, "gid", 3) == 0) {
1047                         if (value && *value) {
1048                                 vol->linux_gid =
1049                                         simple_strtoul(value, &value, 0);
1050                         }
1051                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1052                         if (value && *value) {
1053                                 vol->file_mode =
1054                                         simple_strtoul(value, &value, 0);
1055                         }
1056                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1057                         if (value && *value) {
1058                                 vol->dir_mode =
1059                                         simple_strtoul(value, &value, 0);
1060                         }
1061                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1062                         if (value && *value) {
1063                                 vol->dir_mode =
1064                                         simple_strtoul(value, &value, 0);
1065                         }
1066                 } else if (strnicmp(data, "port", 4) == 0) {
1067                         if (value && *value) {
1068                                 vol->port =
1069                                         simple_strtoul(value, &value, 0);
1070                         }
1071                 } else if (strnicmp(data, "rsize", 5) == 0) {
1072                         if (value && *value) {
1073                                 vol->rsize =
1074                                         simple_strtoul(value, &value, 0);
1075                         }
1076                 } else if (strnicmp(data, "wsize", 5) == 0) {
1077                         if (value && *value) {
1078                                 vol->wsize =
1079                                         simple_strtoul(value, &value, 0);
1080                         }
1081                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1082                         if (value && *value) {
1083                                 vol->sockopt =
1084                                         simple_strtoul(value, &value, 0);
1085                         }
1086                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1087                         if (!value || !*value || (*value == ' ')) {
1088                                 cFYI(1,("invalid (empty) netbiosname specified"));
1089                         } else {
1090                                 memset(vol->source_rfc1001_name,0x20,15);
1091                                 for(i=0;i<15;i++) {
1092                                 /* BB are there cases in which a comma can be
1093                                 valid in this workstation netbios name (and need
1094                                 special handling)? */
1095
1096                                 /* We do not uppercase netbiosname for user */
1097                                         if (value[i]==0)
1098                                                 break;
1099                                         else
1100                                                 vol->source_rfc1001_name[i] = value[i];
1101                                 }
1102                                 /* The string has 16th byte zero still from
1103                                 set at top of the function  */
1104                                 if((i==15) && (value[i] != 0))
1105                                         printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1106                         }
1107                 } else if (strnicmp(data, "servern", 7) == 0) {
1108                         /* servernetbiosname specified override *SMBSERVER */
1109                         if (!value || !*value || (*value == ' ')) {
1110                                 cFYI(1,("empty server netbiosname specified"));
1111                         } else {
1112                                 /* last byte, type, is 0x20 for servr type */
1113                                 memset(vol->target_rfc1001_name,0x20,16);
1114
1115                                 for(i=0;i<15;i++) {
1116                                 /* BB are there cases in which a comma can be
1117                                    valid in this workstation netbios name (and need
1118                                    special handling)? */
1119
1120                                 /* user or mount helper must uppercase netbiosname */
1121                                         if (value[i]==0)
1122                                                 break;
1123                                         else
1124                                                 vol->target_rfc1001_name[i] = value[i];
1125                                 }
1126                                 /* The string has 16th byte zero still from
1127                                    set at top of the function  */
1128                                 if((i==15) && (value[i] != 0))
1129                                         printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1130                         }
1131                 } else if (strnicmp(data, "credentials", 4) == 0) {
1132                         /* ignore */
1133                 } else if (strnicmp(data, "version", 3) == 0) {
1134                         /* ignore */
1135                 } else if (strnicmp(data, "guest",5) == 0) {
1136                         /* ignore */
1137                 } else if (strnicmp(data, "rw", 2) == 0) {
1138                         vol->rw = TRUE;
1139                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1140                                    (strnicmp(data, "nosuid", 6) == 0) ||
1141                                    (strnicmp(data, "exec", 4) == 0) ||
1142                                    (strnicmp(data, "noexec", 6) == 0) ||
1143                                    (strnicmp(data, "nodev", 5) == 0) ||
1144                                    (strnicmp(data, "noauto", 6) == 0) ||
1145                                    (strnicmp(data, "dev", 3) == 0)) {
1146                         /*  The mount tool or mount.cifs helper (if present)
1147                                 uses these opts to set flags, and the flags are read
1148                                 by the kernel vfs layer before we get here (ie
1149                                 before read super) so there is no point trying to
1150                                 parse these options again and set anything and it
1151                                 is ok to just ignore them */
1152                         continue;
1153                 } else if (strnicmp(data, "ro", 2) == 0) {
1154                         vol->rw = FALSE;
1155                 } else if (strnicmp(data, "hard", 4) == 0) {
1156                         vol->retry = 1;
1157                 } else if (strnicmp(data, "soft", 4) == 0) {
1158                         vol->retry = 0;
1159                 } else if (strnicmp(data, "perm", 4) == 0) {
1160                         vol->noperm = 0;
1161                 } else if (strnicmp(data, "noperm", 6) == 0) {
1162                         vol->noperm = 1;
1163                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1164                         vol->remap = 1;
1165                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1166                         vol->remap = 0;
1167                 } else if (strnicmp(data, "sfu", 3) == 0) {
1168                         vol->sfu_emul = 1;
1169                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1170                         vol->sfu_emul = 0;
1171                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1172                         vol->posix_paths = 1;
1173                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1174                         vol->posix_paths = 0;
1175                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1176                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1177                         vol->nocase = 1;
1178                 } else if (strnicmp(data, "brl", 3) == 0) {
1179                         vol->nobrl =  0;
1180                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1181                            (strnicmp(data, "nolock", 6) == 0)) {
1182                         vol->nobrl =  1;
1183                         /* turn off mandatory locking in mode
1184                         if remote locking is turned off since the
1185                         local vfs will do advisory */
1186                         if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1187                                 vol->file_mode = S_IALLUGO;
1188                 } else if (strnicmp(data, "setuids", 7) == 0) {
1189                         vol->setuids = 1;
1190                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1191                         vol->setuids = 0;
1192                 } else if (strnicmp(data, "nohard", 6) == 0) {
1193                         vol->retry = 0;
1194                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1195                         vol->retry = 1;
1196                 } else if (strnicmp(data, "nointr", 6) == 0) {
1197                         vol->intr = 0;
1198                 } else if (strnicmp(data, "intr", 4) == 0) {
1199                         vol->intr = 1;
1200                 } else if (strnicmp(data, "serverino",7) == 0) {
1201                         vol->server_ino = 1;
1202                 } else if (strnicmp(data, "noserverino",9) == 0) {
1203                         vol->server_ino = 0;
1204                 } else if (strnicmp(data, "cifsacl",7) == 0) {
1205                         vol->cifs_acl = 1;
1206                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1207                         vol->cifs_acl = 0;
1208                 } else if (strnicmp(data, "acl",3) == 0) {
1209                         vol->no_psx_acl = 0;
1210                 } else if (strnicmp(data, "noacl",5) == 0) {
1211                         vol->no_psx_acl = 1;
1212                 } else if (strnicmp(data, "sign",4) == 0) {
1213                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1214 /*              } else if (strnicmp(data, "seal",4) == 0) {
1215                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1216                 } else if (strnicmp(data, "direct",6) == 0) {
1217                         vol->direct_io = 1;
1218                 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1219                         vol->direct_io = 1;
1220                 } else if (strnicmp(data, "in6_addr",8) == 0) {
1221                         if (!value || !*value) {
1222                                 vol->in6_addr = NULL;
1223                         } else if (strnlen(value, 49) == 48) {
1224                                 vol->in6_addr = value;
1225                         } else {
1226                                 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1227                                 return 1;
1228                         }
1229                 } else if (strnicmp(data, "noac", 4) == 0) {
1230                         printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1231                 } else
1232                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1233         }
1234         if (vol->UNC == NULL) {
1235                 if(devname == NULL) {
1236                         printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1237                         return 1;
1238                 }
1239                 if ((temp_len = strnlen(devname, 300)) < 300) {
1240                         vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1241                         if(vol->UNC == NULL)
1242                                 return 1;
1243                         strcpy(vol->UNC,devname);
1244                         if (strncmp(vol->UNC, "//", 2) == 0) {
1245                                 vol->UNC[0] = '\\';
1246                                 vol->UNC[1] = '\\';
1247                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1248                                 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1249                                 return 1;
1250                         }
1251                 } else {
1252                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1253                         return 1;
1254                 }
1255         }
1256         if(vol->UNCip == NULL)
1257                 vol->UNCip = &vol->UNC[2];
1258
1259         return 0;
1260 }
1261
1262 static struct cifsSesInfo *
1263 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1264                 struct in6_addr *target_ip6_addr,
1265                  char *userName, struct TCP_Server_Info **psrvTcp)
1266 {
1267         struct list_head *tmp;
1268         struct cifsSesInfo *ses;
1269         *psrvTcp = NULL;
1270         read_lock(&GlobalSMBSeslock);
1271
1272         list_for_each(tmp, &GlobalSMBSessionList) {
1273                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1274                 if (ses->server) {
1275                         if((target_ip_addr &&
1276                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1277                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1278                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1279                                         target_ip6_addr,sizeof(*target_ip6_addr)))){
1280                                 /* BB lock server and tcp session and increment use count here?? */
1281                                 *psrvTcp = ses->server; /* found a match on the TCP session */
1282                                 /* BB check if reconnection needed */
1283                                 if (strncmp
1284                                     (ses->userName, userName,
1285                                      MAX_USERNAME_SIZE) == 0){
1286                                         read_unlock(&GlobalSMBSeslock);
1287                                         return ses;     /* found exact match on both tcp and SMB sessions */
1288                                 }
1289                         }
1290                 }
1291                 /* else tcp and smb sessions need reconnection */
1292         }
1293         read_unlock(&GlobalSMBSeslock);
1294         return NULL;
1295 }
1296
1297 static struct cifsTconInfo *
1298 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1299 {
1300         struct list_head *tmp;
1301         struct cifsTconInfo *tcon;
1302
1303         read_lock(&GlobalSMBSeslock);
1304         list_for_each(tmp, &GlobalTreeConnectionList) {
1305                 cFYI(1, ("Next tcon"));
1306                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1307                 if (tcon->ses) {
1308                         if (tcon->ses->server) {
1309                                 cFYI(1,
1310                                      ("old ip addr: %x == new ip %x ?",
1311                                       tcon->ses->server->addr.sockAddr.sin_addr.
1312                                       s_addr, new_target_ip_addr));
1313                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1314                                     s_addr == new_target_ip_addr) {
1315         /* BB lock tcon, server and tcp session and increment use count here? */
1316                                         /* found a match on the TCP session */
1317                                         /* BB check if reconnection needed */
1318                                         cFYI(1,("IP match, old UNC: %s new: %s",
1319                                               tcon->treeName, uncName));
1320                                         if (strncmp
1321                                             (tcon->treeName, uncName,
1322                                              MAX_TREE_SIZE) == 0) {
1323                                                 cFYI(1,
1324                                                      ("and old usr: %s new: %s",
1325                                                       tcon->treeName, uncName));
1326                                                 if (strncmp
1327                                                     (tcon->ses->userName,
1328                                                      userName,
1329                                                      MAX_USERNAME_SIZE) == 0) {
1330                                                         read_unlock(&GlobalSMBSeslock);
1331                                                         /* matched smb session
1332                                                         (user name */
1333                                                         return tcon;
1334                                                 }
1335                                         }
1336                                 }
1337                         }
1338                 }
1339         }
1340         read_unlock(&GlobalSMBSeslock);
1341         return NULL;
1342 }
1343
1344 int
1345 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1346                     const char *old_path, const struct nls_table *nls_codepage,
1347                     int remap)
1348 {
1349         unsigned char *referrals = NULL;
1350         unsigned int num_referrals;
1351         int rc = 0;
1352
1353         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1354                         &num_referrals, &referrals, remap);
1355
1356         /* BB Add in code to: if valid refrl, if not ip address contact
1357                 the helper that resolves tcp names, mount to it, try to
1358                 tcon to it unmount it if fail */
1359
1360         kfree(referrals);
1361
1362         return rc;
1363 }
1364
1365 int
1366 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1367                         const char *old_path, const struct nls_table *nls_codepage,
1368                         unsigned int *pnum_referrals,
1369                         unsigned char ** preferrals, int remap)
1370 {
1371         char *temp_unc;
1372         int rc = 0;
1373
1374         *pnum_referrals = 0;
1375
1376         if (pSesInfo->ipc_tid == 0) {
1377                 temp_unc = kmalloc(2 /* for slashes */ +
1378                         strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1379                                  + 1 + 4 /* slash IPC$ */  + 2,
1380                                 GFP_KERNEL);
1381                 if (temp_unc == NULL)
1382                         return -ENOMEM;
1383                 temp_unc[0] = '\\';
1384                 temp_unc[1] = '\\';
1385                 strcpy(temp_unc + 2, pSesInfo->serverName);
1386                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1387                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1388                 cFYI(1,
1389                      ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1390                 kfree(temp_unc);
1391         }
1392         if (rc == 0)
1393                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1394                                      pnum_referrals, nls_codepage, remap);
1395
1396         return rc;
1397 }
1398
1399 /* See RFC1001 section 14 on representation of Netbios names */
1400 static void rfc1002mangle(char * target,char * source, unsigned int length)
1401 {
1402         unsigned int i,j;
1403
1404         for(i=0,j=0;i<(length);i++) {
1405                 /* mask a nibble at a time and encode */
1406                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1407                 target[j+1] = 'A' + (0x0F & source[i]);
1408                 j+=2;
1409         }
1410
1411 }
1412
1413
1414 static int
1415 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1416              char * netbios_name, char * target_name)
1417 {
1418         int rc = 0;
1419         int connected = 0;
1420         __be16 orig_port = 0;
1421
1422         if(*csocket == NULL) {
1423                 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1424                 if (rc < 0) {
1425                         cERROR(1, ("Error %d creating socket",rc));
1426                         *csocket = NULL;
1427                         return rc;
1428                 } else {
1429                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1430                         cFYI(1,("Socket created"));
1431                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1432                 }
1433         }
1434
1435         psin_server->sin_family = AF_INET;
1436         if(psin_server->sin_port) { /* user overrode default port */
1437                 rc = (*csocket)->ops->connect(*csocket,
1438                                 (struct sockaddr *) psin_server,
1439                                 sizeof (struct sockaddr_in),0);
1440                 if (rc >= 0)
1441                         connected = 1;
1442         }
1443
1444         if(!connected) {
1445                 /* save original port so we can retry user specified port
1446                         later if fall back ports fail this time  */
1447                 orig_port = psin_server->sin_port;
1448
1449                 /* do not retry on the same port we just failed on */
1450                 if(psin_server->sin_port != htons(CIFS_PORT)) {
1451                         psin_server->sin_port = htons(CIFS_PORT);
1452
1453                         rc = (*csocket)->ops->connect(*csocket,
1454                                         (struct sockaddr *) psin_server,
1455                                         sizeof (struct sockaddr_in),0);
1456                         if (rc >= 0)
1457                                 connected = 1;
1458                 }
1459         }
1460         if (!connected) {
1461                 psin_server->sin_port = htons(RFC1001_PORT);
1462                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1463                                               psin_server, sizeof (struct sockaddr_in),0);
1464                 if (rc >= 0)
1465                         connected = 1;
1466         }
1467
1468         /* give up here - unless we want to retry on different
1469                 protocol families some day */
1470         if (!connected) {
1471                 if(orig_port)
1472                         psin_server->sin_port = orig_port;
1473                 cFYI(1,("Error %d connecting to server via ipv4",rc));
1474                 sock_release(*csocket);
1475                 *csocket = NULL;
1476                 return rc;
1477         }
1478         /* Eventually check for other socket options to change from
1479                 the default. sock_setsockopt not used because it expects
1480                 user space buffer */
1481          cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1482                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1483         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1484         /* make the bufsizes depend on wsize/rsize and max requests */
1485         if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1486                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1487         if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1488                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1489
1490         /* send RFC1001 sessinit */
1491         if(psin_server->sin_port == htons(RFC1001_PORT)) {
1492                 /* some servers require RFC1001 sessinit before sending
1493                 negprot - BB check reconnection in case where second
1494                 sessinit is sent but no second negprot */
1495                 struct rfc1002_session_packet * ses_init_buf;
1496                 struct smb_hdr * smb_buf;
1497                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1498                 if(ses_init_buf) {
1499                         ses_init_buf->trailer.session_req.called_len = 32;
1500                         if(target_name && (target_name[0] != 0)) {
1501                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1502                                         target_name, 16);
1503                         } else {
1504                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1505                                         DEFAULT_CIFS_CALLED_NAME,16);
1506                         }
1507
1508                         ses_init_buf->trailer.session_req.calling_len = 32;
1509                         /* calling name ends in null (byte 16) from old smb
1510                         convention. */
1511                         if(netbios_name && (netbios_name[0] !=0)) {
1512                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1513                                         netbios_name,16);
1514                         } else {
1515                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1516                                         "LINUX_CIFS_CLNT",16);
1517                         }
1518                         ses_init_buf->trailer.session_req.scope1 = 0;
1519                         ses_init_buf->trailer.session_req.scope2 = 0;
1520                         smb_buf = (struct smb_hdr *)ses_init_buf;
1521                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1522                         smb_buf->smb_buf_length = 0x81000044;
1523                         rc = smb_send(*csocket, smb_buf, 0x44,
1524                                 (struct sockaddr *)psin_server);
1525                         kfree(ses_init_buf);
1526                         msleep(1); /* RFC1001 layer in at least one server
1527                                       requires very short break before negprot
1528                                       presumably because not expecting negprot
1529                                       to follow so fast.  This is a simple
1530                                       solution that works without
1531                                       complicating the code and causes no
1532                                       significant slowing down on mount
1533                                       for everyone else */
1534                 }
1535                 /* else the negprot may still work without this
1536                 even though malloc failed */
1537
1538         }
1539
1540         return rc;
1541 }
1542
1543 static int
1544 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1545 {
1546         int rc = 0;
1547         int connected = 0;
1548         __be16 orig_port = 0;
1549
1550         if(*csocket == NULL) {
1551                 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1552                 if (rc < 0) {
1553                         cERROR(1, ("Error %d creating ipv6 socket",rc));
1554                         *csocket = NULL;
1555                         return rc;
1556                 } else {
1557                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1558                          cFYI(1,("ipv6 Socket created"));
1559                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1560                 }
1561         }
1562
1563         psin_server->sin6_family = AF_INET6;
1564
1565         if(psin_server->sin6_port) { /* user overrode default port */
1566                 rc = (*csocket)->ops->connect(*csocket,
1567                                 (struct sockaddr *) psin_server,
1568                                 sizeof (struct sockaddr_in6),0);
1569                 if (rc >= 0)
1570                         connected = 1;
1571         }
1572
1573         if(!connected) {
1574                 /* save original port so we can retry user specified port
1575                         later if fall back ports fail this time  */
1576
1577                 orig_port = psin_server->sin6_port;
1578                 /* do not retry on the same port we just failed on */
1579                 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1580                         psin_server->sin6_port = htons(CIFS_PORT);
1581
1582                         rc = (*csocket)->ops->connect(*csocket,
1583                                         (struct sockaddr *) psin_server,
1584                                         sizeof (struct sockaddr_in6),0);
1585                         if (rc >= 0)
1586                                 connected = 1;
1587                 }
1588         }
1589         if (!connected) {
1590                 psin_server->sin6_port = htons(RFC1001_PORT);
1591                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1592                                          psin_server, sizeof (struct sockaddr_in6),0);
1593                 if (rc >= 0)
1594                         connected = 1;
1595         }
1596
1597         /* give up here - unless we want to retry on different
1598                 protocol families some day */
1599         if (!connected) {
1600                 if(orig_port)
1601                         psin_server->sin6_port = orig_port;
1602                 cFYI(1,("Error %d connecting to server via ipv6",rc));
1603                 sock_release(*csocket);
1604                 *csocket = NULL;
1605                 return rc;
1606         }
1607         /* Eventually check for other socket options to change from
1608                 the default. sock_setsockopt not used because it expects
1609                 user space buffer */
1610         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1611
1612         return rc;
1613 }
1614
1615 void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1616                           struct super_block * sb, struct smb_vol * vol_info)
1617 {
1618         /* if we are reconnecting then should we check to see if
1619          * any requested capabilities changed locally e.g. via
1620          * remount but we can not do much about it here
1621          * if they have (even if we could detect it by the following)
1622          * Perhaps we could add a backpointer to array of sb from tcon
1623          * or if we change to make all sb to same share the same
1624          * sb as NFS - then we only have one backpointer to sb.
1625          * What if we wanted to mount the server share twice once with
1626          * and once without posixacls or posix paths? */
1627         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1628
1629
1630         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1631                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1632
1633                 /* check for reconnect case in which we do not
1634                    want to change the mount behavior if we can avoid it */
1635                 if(vol_info == NULL) {
1636                         /* turn off POSIX ACL and PATHNAMES if not set
1637                            originally at mount time */
1638                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1639                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1640                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1641                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1642
1643
1644
1645
1646                 }
1647
1648                 cap &= CIFS_UNIX_CAP_MASK;
1649                 if(vol_info && vol_info->no_psx_acl)
1650                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1651                 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1652                         cFYI(1,("negotiated posix acl support"));
1653                         if(sb)
1654                                 sb->s_flags |= MS_POSIXACL;
1655                 }
1656
1657                 if(vol_info && vol_info->posix_paths == 0)
1658                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1659                 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1660                         cFYI(1,("negotiate posix pathnames"));
1661                         if(sb)
1662                                 CIFS_SB(sb)->mnt_cifs_flags |=
1663                                         CIFS_MOUNT_POSIX_PATHS;
1664                 }
1665
1666                 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1667 #ifdef CONFIG_CIFS_DEBUG2
1668                 if(cap & CIFS_UNIX_FCNTL_CAP)
1669                         cFYI(1,("FCNTL cap"));
1670                 if(cap & CIFS_UNIX_EXTATTR_CAP)
1671                         cFYI(1,("EXTATTR cap"));
1672                 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1673                         cFYI(1,("POSIX path cap"));
1674                 if(cap & CIFS_UNIX_XATTR_CAP)
1675                         cFYI(1,("XATTR cap"));
1676                 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1677                         cFYI(1,("POSIX ACL cap"));
1678 #endif /* CIFS_DEBUG2 */
1679                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1680                         cFYI(1,("setting capabilities failed"));
1681                 }
1682         }
1683 }
1684
1685 int
1686 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1687            char *mount_data, const char *devname)
1688 {
1689         int rc = 0;
1690         int xid;
1691         int address_type = AF_INET;
1692         struct socket *csocket = NULL;
1693         struct sockaddr_in sin_server;
1694         struct sockaddr_in6 sin_server6;
1695         struct smb_vol volume_info;
1696         struct cifsSesInfo *pSesInfo = NULL;
1697         struct cifsSesInfo *existingCifsSes = NULL;
1698         struct cifsTconInfo *tcon = NULL;
1699         struct TCP_Server_Info *srvTcp = NULL;
1700
1701         xid = GetXid();
1702
1703 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1704
1705         memset(&volume_info,0,sizeof(struct smb_vol));
1706         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1707                 kfree(volume_info.UNC);
1708                 kfree(volume_info.password);
1709                 kfree(volume_info.prepath);
1710                 FreeXid(xid);
1711                 return -EINVAL;
1712         }
1713
1714         if (volume_info.username) {
1715                 /* BB fixme parse for domain name here */
1716                 cFYI(1, ("Username: %s ", volume_info.username));
1717
1718         } else if (volume_info.nullauth) {
1719                 cFYI(1,("null user"));
1720         } else {
1721                 cifserror("No username specified");
1722         /* In userspace mount helper we can get user name from alternate
1723            locations such as env variables and files on disk */
1724                 kfree(volume_info.UNC);
1725                 kfree(volume_info.password);
1726                 kfree(volume_info.prepath);
1727                 FreeXid(xid);
1728                 return -EINVAL;
1729         }
1730
1731         if (volume_info.UNCip && volume_info.UNC) {
1732                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1733
1734                 if(rc <= 0) {
1735                         /* not ipv4 address, try ipv6 */
1736                         rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1737                         if(rc > 0)
1738                                 address_type = AF_INET6;
1739                 } else {
1740                         address_type = AF_INET;
1741                 }
1742
1743                 if(rc <= 0) {
1744                         /* we failed translating address */
1745                         kfree(volume_info.UNC);
1746                         kfree(volume_info.password);
1747                         kfree(volume_info.prepath);
1748                         FreeXid(xid);
1749                         return -EINVAL;
1750                 }
1751
1752                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1753                 /* success */
1754                 rc = 0;
1755         } else if (volume_info.UNCip){
1756                 /* BB using ip addr as server name connect to the DFS root below */
1757                 cERROR(1,("Connecting to DFS root not implemented yet"));
1758                 kfree(volume_info.UNC);
1759                 kfree(volume_info.password);
1760                 kfree(volume_info.prepath);
1761                 FreeXid(xid);
1762                 return -EINVAL;
1763         } else /* which servers DFS root would we conect to */ {
1764                 cERROR(1,
1765                        ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1766                 kfree(volume_info.UNC);
1767                 kfree(volume_info.password);
1768                 kfree(volume_info.prepath);
1769                 FreeXid(xid);
1770                 return -EINVAL;
1771         }
1772
1773         /* this is needed for ASCII cp to Unicode converts */
1774         if(volume_info.iocharset == NULL) {
1775                 cifs_sb->local_nls = load_nls_default();
1776         /* load_nls_default can not return null */
1777         } else {
1778                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1779                 if(cifs_sb->local_nls == NULL) {
1780                         cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1781                         kfree(volume_info.UNC);
1782                         kfree(volume_info.password);
1783                         kfree(volume_info.prepath);
1784                         FreeXid(xid);
1785                         return -ELIBACC;
1786                 }
1787         }
1788
1789         if(address_type == AF_INET)
1790                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1791                         NULL /* no ipv6 addr */,
1792                         volume_info.username, &srvTcp);
1793         else if(address_type == AF_INET6) {
1794                 cFYI(1,("looking for ipv6 address"));
1795                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1796                         &sin_server6.sin6_addr,
1797                         volume_info.username, &srvTcp);
1798         } else {
1799                 kfree(volume_info.UNC);
1800                 kfree(volume_info.password);
1801                 kfree(volume_info.prepath);
1802                 FreeXid(xid);
1803                 return -EINVAL;
1804         }
1805
1806
1807         if (srvTcp) {
1808                 cFYI(1, ("Existing tcp session with server found"));
1809         } else {        /* create socket */
1810                 if(volume_info.port)
1811                         sin_server.sin_port = htons(volume_info.port);
1812                 else
1813                         sin_server.sin_port = 0;
1814                 if (address_type == AF_INET6) {
1815                         cFYI(1,("attempting ipv6 connect"));
1816                         /* BB should we allow ipv6 on port 139? */
1817                         /* other OS never observed in Wild doing 139 with v6 */
1818                         rc = ipv6_connect(&sin_server6,&csocket);
1819                 } else
1820                         rc = ipv4_connect(&sin_server,&csocket,
1821                                   volume_info.source_rfc1001_name,
1822                                   volume_info.target_rfc1001_name);
1823                 if (rc < 0) {
1824                         cERROR(1,
1825                                ("Error connecting to IPv4 socket. Aborting operation"));
1826                         if(csocket != NULL)
1827                                 sock_release(csocket);
1828                         kfree(volume_info.UNC);
1829                         kfree(volume_info.password);
1830                         kfree(volume_info.prepath);
1831                         FreeXid(xid);
1832                         return rc;
1833                 }
1834
1835                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1836                 if (srvTcp == NULL) {
1837                         rc = -ENOMEM;
1838                         sock_release(csocket);
1839                         kfree(volume_info.UNC);
1840                         kfree(volume_info.password);
1841                         kfree(volume_info.prepath);
1842                         FreeXid(xid);
1843                         return rc;
1844                 } else {
1845                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1846                         memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1847                         atomic_set(&srvTcp->inFlight,0);
1848                         /* BB Add code for ipv6 case too */
1849                         srvTcp->ssocket = csocket;
1850                         srvTcp->protocolType = IPV4;
1851                         init_waitqueue_head(&srvTcp->response_q);
1852                         init_waitqueue_head(&srvTcp->request_q);
1853                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1854                         /* at this point we are the only ones with the pointer
1855                         to the struct since the kernel thread not created yet
1856                         so no need to spinlock this init of tcpStatus */
1857                         srvTcp->tcpStatus = CifsNew;
1858                         init_MUTEX(&srvTcp->tcpSem);
1859                         srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1860                         if( IS_ERR(srvTcp->tsk) ) {
1861                                 rc = PTR_ERR(srvTcp->tsk);
1862                                 cERROR(1,("error %d create cifsd thread", rc));
1863                                 srvTcp->tsk = NULL;
1864                                 sock_release(csocket);
1865                                 kfree(volume_info.UNC);
1866                                 kfree(volume_info.password);
1867                                 kfree(volume_info.prepath);
1868                                 FreeXid(xid);
1869                                 return rc;
1870                         }
1871                         wait_for_completion(&cifsd_complete);
1872                         rc = 0;
1873                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1874                         memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1875                         srvTcp->sequence_number = 0;
1876                 }
1877         }
1878
1879         if (existingCifsSes) {
1880                 pSesInfo = existingCifsSes;
1881                 cFYI(1, ("Existing smb sess found"));
1882                 kfree(volume_info.password);
1883                 /* volume_info.UNC freed at end of function */
1884         } else if (!rc) {
1885                 cFYI(1, ("Existing smb sess not found"));
1886                 pSesInfo = sesInfoAlloc();
1887                 if (pSesInfo == NULL)
1888                         rc = -ENOMEM;
1889                 else {
1890                         pSesInfo->server = srvTcp;
1891                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1892                                 NIPQUAD(sin_server.sin_addr.s_addr));
1893                 }
1894
1895                 if (!rc){
1896                         /* volume_info.password freed at unmount */
1897                         if (volume_info.password)
1898                                 pSesInfo->password = volume_info.password;
1899                         if (volume_info.username)
1900                                 strncpy(pSesInfo->userName,
1901                                         volume_info.username,MAX_USERNAME_SIZE);
1902                         if (volume_info.domainname) {
1903                                 int len = strlen(volume_info.domainname);
1904                                 pSesInfo->domainName =
1905                                         kmalloc(len + 1, GFP_KERNEL);
1906                                 if(pSesInfo->domainName)
1907                                         strcpy(pSesInfo->domainName,
1908                                                 volume_info.domainname);
1909                         }
1910                         pSesInfo->linux_uid = volume_info.linux_uid;
1911                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1912                         down(&pSesInfo->sesSem);
1913                         /* BB FIXME need to pass vol->secFlgs BB */
1914                         rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1915                         up(&pSesInfo->sesSem);
1916                         if(!rc)
1917                                 atomic_inc(&srvTcp->socketUseCount);
1918                 } else
1919                         kfree(volume_info.password);
1920         }
1921
1922         /* search for existing tcon to this server share */
1923         if (!rc) {
1924                 if(volume_info.rsize > CIFSMaxBufSize) {
1925                         cERROR(1,("rsize %d too large, using MaxBufSize",
1926                                 volume_info.rsize));
1927                         cifs_sb->rsize = CIFSMaxBufSize;
1928                 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1929                         cifs_sb->rsize = volume_info.rsize;
1930                 else /* default */
1931                         cifs_sb->rsize = CIFSMaxBufSize;
1932
1933                 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1934                         cERROR(1,("wsize %d too large using 4096 instead",
1935                                   volume_info.wsize));
1936                         cifs_sb->wsize = 4096;
1937                 } else if(volume_info.wsize)
1938                         cifs_sb->wsize = volume_info.wsize;
1939                 else
1940                         cifs_sb->wsize =
1941                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1942                                         127*1024);
1943                         /* old default of CIFSMaxBufSize was too small now
1944                            that SMB Write2 can send multiple pages in kvec.
1945                            RFC1001 does not describe what happens when frame
1946                            bigger than 128K is sent so use that as max in
1947                            conjunction with 52K kvec constraint on arch with 4K
1948                            page size  */
1949
1950                 if(cifs_sb->rsize < 2048) {
1951                         cifs_sb->rsize = 2048;
1952                         /* Windows ME may prefer this */
1953                         cFYI(1,("readsize set to minimum 2048"));
1954                 }
1955                 /* calculate prepath */
1956                 cifs_sb->prepath = volume_info.prepath;
1957                 if(cifs_sb->prepath) {
1958                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1959                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1960                         volume_info.prepath = NULL;
1961                 } else
1962                         cifs_sb->prepathlen = 0;
1963                 cifs_sb->mnt_uid = volume_info.linux_uid;
1964                 cifs_sb->mnt_gid = volume_info.linux_gid;
1965                 cifs_sb->mnt_file_mode = volume_info.file_mode;
1966                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1967                 cFYI(1,("file mode: 0x%x  dir mode: 0x%x",
1968                         cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1969
1970                 if(volume_info.noperm)
1971                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1972                 if(volume_info.setuids)
1973                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1974                 if(volume_info.server_ino)
1975                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1976                 if(volume_info.remap)
1977                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1978                 if(volume_info.no_xattr)
1979                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1980                 if(volume_info.sfu_emul)
1981                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1982                 if(volume_info.nobrl)
1983                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1984                 if(volume_info.cifs_acl)
1985                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1986
1987                 if(volume_info.direct_io) {
1988                         cFYI(1,("mounting share using direct i/o"));
1989                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1990                 }
1991
1992                 tcon =
1993                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
1994                              volume_info.username);
1995                 if (tcon) {
1996                         cFYI(1, ("Found match on UNC path"));
1997                         /* we can have only one retry value for a connection
1998                            to a share so for resources mounted more than once
1999                            to the same server share the last value passed in
2000                            for the retry flag is used */
2001                         tcon->retry = volume_info.retry;
2002                         tcon->nocase = volume_info.nocase;
2003                 } else {
2004                         tcon = tconInfoAlloc();
2005                         if (tcon == NULL)
2006                                 rc = -ENOMEM;
2007                         else {
2008                                 /* check for null share name ie connecting to
2009                                  * dfs root */
2010
2011                                 /* BB check if this works for exactly length
2012                                  * three strings */
2013                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2014                                     && (strchr(volume_info.UNC + 3, '/') ==
2015                                         NULL)) {
2016                                         rc = connect_to_dfs_path(xid, pSesInfo,
2017                                                 "", cifs_sb->local_nls,
2018                                                 cifs_sb->mnt_cifs_flags &
2019                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2020                                         kfree(volume_info.UNC);
2021                                         FreeXid(xid);
2022                                         return -ENODEV;
2023                                 } else {
2024                                         /* BB Do we need to wrap sesSem around
2025                                          * this TCon call and Unix SetFS as
2026                                          * we do on SessSetup and reconnect? */
2027                                         rc = CIFSTCon(xid, pSesInfo,
2028                                                 volume_info.UNC,
2029                                                 tcon, cifs_sb->local_nls);
2030                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
2031                                 }
2032                                 if (!rc) {
2033                                         atomic_inc(&pSesInfo->inUse);
2034                                         tcon->retry = volume_info.retry;
2035                                         tcon->nocase = volume_info.nocase;
2036                                 }
2037                         }
2038                 }
2039         }
2040         if(pSesInfo) {
2041                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2042                         sb->s_maxbytes = (u64) 1 << 63;
2043                 } else
2044                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2045         }
2046
2047         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2048         sb->s_time_gran = 100;
2049
2050 /* on error free sesinfo and tcon struct if needed */
2051         if (rc) {
2052                 /* if session setup failed, use count is zero but
2053                 we still need to free cifsd thread */
2054                 if(atomic_read(&srvTcp->socketUseCount) == 0) {
2055                         spin_lock(&GlobalMid_Lock);
2056                         srvTcp->tcpStatus = CifsExiting;
2057                         spin_unlock(&GlobalMid_Lock);
2058                         if(srvTcp->tsk) {
2059                                 send_sig(SIGKILL,srvTcp->tsk,1);
2060                                 kthread_stop(srvTcp->tsk);
2061                         }
2062                 }
2063                  /* If find_unc succeeded then rc == 0 so we can not end */
2064                 if (tcon)  /* up accidently freeing someone elses tcon struct */
2065                         tconInfoFree(tcon);
2066                 if (existingCifsSes == NULL) {
2067                         if (pSesInfo) {
2068                                 if ((pSesInfo->server) &&
2069                                     (pSesInfo->status == CifsGood)) {
2070                                         int temp_rc;
2071                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2072                                         /* if the socketUseCount is now zero */
2073                                         if((temp_rc == -ESHUTDOWN) &&
2074                                            (pSesInfo->server) && (pSesInfo->server->tsk)) {
2075                                                 send_sig(SIGKILL,pSesInfo->server->tsk,1);
2076                                                 kthread_stop(pSesInfo->server->tsk);
2077                                         }
2078                                 } else
2079                                         cFYI(1, ("No session or bad tcon"));
2080                                 sesInfoFree(pSesInfo);
2081                                 /* pSesInfo = NULL; */
2082                         }
2083                 }
2084         } else {
2085                 atomic_inc(&tcon->useCount);
2086                 cifs_sb->tcon = tcon;
2087                 tcon->ses = pSesInfo;
2088
2089                 /* do not care if following two calls succeed - informational */
2090                 CIFSSMBQFSDeviceInfo(xid, tcon);
2091                 CIFSSMBQFSAttributeInfo(xid, tcon);
2092
2093                 /* tell server which Unix caps we support */
2094                 if (tcon->ses->capabilities & CAP_UNIX)
2095                         reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2096
2097                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2098                         cifs_sb->wsize = min(cifs_sb->wsize,
2099                                              (tcon->ses->server->maxBuf -
2100                                               MAX_CIFS_HDR_SIZE));
2101                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2102                         cifs_sb->rsize = min(cifs_sb->rsize,
2103                                              (tcon->ses->server->maxBuf -
2104                                               MAX_CIFS_HDR_SIZE));
2105         }
2106
2107         /* volume_info.password is freed above when existing session found
2108         (in which case it is not needed anymore) but when new sesion is created
2109         the password ptr is put in the new session structure (in which case the
2110         password will be freed at unmount time) */
2111         kfree(volume_info.UNC);
2112         kfree(volume_info.prepath);
2113         FreeXid(xid);
2114         return rc;
2115 }
2116
2117 static int
2118 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2119               char session_key[CIFS_SESS_KEY_SIZE],
2120               const struct nls_table *nls_codepage)
2121 {
2122         struct smb_hdr *smb_buffer;
2123         struct smb_hdr *smb_buffer_response;
2124         SESSION_SETUP_ANDX *pSMB;
2125         SESSION_SETUP_ANDX *pSMBr;
2126         char *bcc_ptr;
2127         char *user;
2128         char *domain;
2129         int rc = 0;
2130         int remaining_words = 0;
2131         int bytes_returned = 0;
2132         int len;
2133         __u32 capabilities;
2134         __u16 count;
2135
2136         cFYI(1, ("In sesssetup"));
2137         if(ses == NULL)
2138                 return -EINVAL;
2139         user = ses->userName;
2140         domain = ses->domainName;
2141         smb_buffer = cifs_buf_get();
2142         if (smb_buffer == NULL) {
2143                 return -ENOMEM;
2144         }
2145         smb_buffer_response = smb_buffer;
2146         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2147
2148         /* send SMBsessionSetup here */
2149         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2150                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2151
2152         smb_buffer->Mid = GetNextMid(ses->server);
2153         pSMB->req_no_secext.AndXCommand = 0xFF;
2154         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2155         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2156
2157         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2158                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2159
2160         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2161                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2162         if (ses->capabilities & CAP_UNICODE) {
2163                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2164                 capabilities |= CAP_UNICODE;
2165         }
2166         if (ses->capabilities & CAP_STATUS32) {
2167                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2168                 capabilities |= CAP_STATUS32;
2169         }
2170         if (ses->capabilities & CAP_DFS) {
2171                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2172                 capabilities |= CAP_DFS;
2173         }
2174         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2175
2176         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2177                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2178
2179         pSMB->req_no_secext.CaseSensitivePasswordLength =
2180             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2181         bcc_ptr = pByteArea(smb_buffer);
2182         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2183         bcc_ptr += CIFS_SESS_KEY_SIZE;
2184         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2185         bcc_ptr += CIFS_SESS_KEY_SIZE;
2186
2187         if (ses->capabilities & CAP_UNICODE) {
2188                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2189                         *bcc_ptr = 0;
2190                         bcc_ptr++;
2191                 }
2192                 if(user == NULL)
2193                         bytes_returned = 0; /* skip null user */
2194                 else
2195                         bytes_returned =
2196                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2197                                         nls_codepage);
2198                 /* convert number of 16 bit words to bytes */
2199                 bcc_ptr += 2 * bytes_returned;
2200                 bcc_ptr += 2;   /* trailing null */
2201                 if (domain == NULL)
2202                         bytes_returned =
2203                             cifs_strtoUCS((__le16 *) bcc_ptr,
2204                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2205                 else
2206                         bytes_returned =
2207                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2208                                           nls_codepage);
2209                 bcc_ptr += 2 * bytes_returned;
2210                 bcc_ptr += 2;
2211                 bytes_returned =
2212                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2213                                   32, nls_codepage);
2214                 bcc_ptr += 2 * bytes_returned;
2215                 bytes_returned =
2216                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2217                                   32, nls_codepage);
2218                 bcc_ptr += 2 * bytes_returned;
2219                 bcc_ptr += 2;
2220                 bytes_returned =
2221                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2222                                   64, nls_codepage);
2223                 bcc_ptr += 2 * bytes_returned;
2224                 bcc_ptr += 2;
2225         } else {
2226                 if(user != NULL) {
2227                     strncpy(bcc_ptr, user, 200);
2228                     bcc_ptr += strnlen(user, 200);
2229                 }
2230                 *bcc_ptr = 0;
2231                 bcc_ptr++;
2232                 if (domain == NULL) {
2233                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2234                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2235                 } else {
2236                         strncpy(bcc_ptr, domain, 64);
2237                         bcc_ptr += strnlen(domain, 64);
2238                         *bcc_ptr = 0;
2239                         bcc_ptr++;
2240                 }
2241                 strcpy(bcc_ptr, "Linux version ");
2242                 bcc_ptr += strlen("Linux version ");
2243                 strcpy(bcc_ptr, utsname()->release);
2244                 bcc_ptr += strlen(utsname()->release) + 1;
2245                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2246                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2247         }
2248         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2249         smb_buffer->smb_buf_length += count;
2250         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2251
2252         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2253                          &bytes_returned, 1);
2254         if (rc) {
2255 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2256         } else if ((smb_buffer_response->WordCount == 3)
2257                    || (smb_buffer_response->WordCount == 4)) {
2258                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2259                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2260                 if (action & GUEST_LOGIN)
2261                         cFYI(1, (" Guest login"));      /* do we want to mark SesInfo struct ? */
2262                 ses->Suid = smb_buffer_response->Uid;   /* UID left in wire format (le) */
2263                 cFYI(1, ("UID = %d ", ses->Suid));
2264          /* response can have either 3 or 4 word count - Samba sends 3 */
2265                 bcc_ptr = pByteArea(smb_buffer_response);
2266                 if ((pSMBr->resp.hdr.WordCount == 3)
2267                     || ((pSMBr->resp.hdr.WordCount == 4)
2268                         && (blob_len < pSMBr->resp.ByteCount))) {
2269                         if (pSMBr->resp.hdr.WordCount == 4)
2270                                 bcc_ptr += blob_len;
2271
2272                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2273                                 if ((long) (bcc_ptr) % 2) {
2274                                         remaining_words =
2275                                             (BCC(smb_buffer_response) - 1) /2;
2276                                         bcc_ptr++;      /* Unicode strings must be word aligned */
2277                                 } else {
2278                                         remaining_words =
2279                                                 BCC(smb_buffer_response) / 2;
2280                                 }
2281                                 len =
2282                                     UniStrnlen((wchar_t *) bcc_ptr,
2283                                                remaining_words - 1);
2284 /* We look for obvious messed up bcc or strings in response so we do not go off
2285    the end since (at least) WIN2K and Windows XP have a major bug in not null
2286    terminating last Unicode string in response  */
2287                                 if(ses->serverOS)
2288                                         kfree(ses->serverOS);
2289                                 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2290                                 if(ses->serverOS == NULL)
2291                                         goto sesssetup_nomem;
2292                                 cifs_strfromUCS_le(ses->serverOS,
2293                                            (__le16 *)bcc_ptr, len,nls_codepage);
2294                                 bcc_ptr += 2 * (len + 1);
2295                                 remaining_words -= len + 1;
2296                                 ses->serverOS[2 * len] = 0;
2297                                 ses->serverOS[1 + (2 * len)] = 0;
2298                                 if (remaining_words > 0) {
2299                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2300                                                          remaining_words-1);
2301                                         kfree(ses->serverNOS);
2302                                         ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2303                                         if(ses->serverNOS == NULL)
2304                                                 goto sesssetup_nomem;
2305                                         cifs_strfromUCS_le(ses->serverNOS,
2306                                                            (__le16 *)bcc_ptr,len,nls_codepage);
2307                                         bcc_ptr += 2 * (len + 1);
2308                                         ses->serverNOS[2 * len] = 0;
2309                                         ses->serverNOS[1 + (2 * len)] = 0;
2310                                         if(strncmp(ses->serverNOS,
2311                                                 "NT LAN Manager 4",16) == 0) {
2312                                                 cFYI(1,("NT4 server"));
2313                                                 ses->flags |= CIFS_SES_NT4;
2314                                         }
2315                                         remaining_words -= len + 1;
2316                                         if (remaining_words > 0) {
2317                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2318           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2319                                                 if(ses->serverDomain)
2320                                                         kfree(ses->serverDomain);
2321                                                 ses->serverDomain =
2322                                                     kzalloc(2*(len+1),GFP_KERNEL);
2323                                                 if(ses->serverDomain == NULL)
2324                                                         goto sesssetup_nomem;
2325                                                 cifs_strfromUCS_le(ses->serverDomain,
2326                                                      (__le16 *)bcc_ptr,len,nls_codepage);
2327                                                 bcc_ptr += 2 * (len + 1);
2328                                                 ses->serverDomain[2*len] = 0;
2329                                                 ses->serverDomain[1+(2*len)] = 0;
2330                                         } /* else no more room so create dummy domain string */
2331                                         else {
2332                                                 if(ses->serverDomain)
2333                                                         kfree(ses->serverDomain);
2334                                                 ses->serverDomain =
2335                                                         kzalloc(2, GFP_KERNEL);
2336                                         }
2337                                 } else {        /* no room so create dummy domain and NOS string */
2338                                         /* if these kcallocs fail not much we
2339                                            can do, but better to not fail the
2340                                            sesssetup itself */
2341                                         kfree(ses->serverDomain);
2342                                         ses->serverDomain =
2343                                             kzalloc(2, GFP_KERNEL);
2344                                         kfree(ses->serverNOS);
2345                                         ses->serverNOS =
2346                                             kzalloc(2, GFP_KERNEL);
2347                                 }
2348                         } else {        /* ASCII */
2349                                 len = strnlen(bcc_ptr, 1024);
2350                                 if (((long) bcc_ptr + len) - (long)
2351                                     pByteArea(smb_buffer_response)
2352                                             <= BCC(smb_buffer_response)) {
2353                                         kfree(ses->serverOS);
2354                                         ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2355                                         if(ses->serverOS == NULL)
2356                                                 goto sesssetup_nomem;
2357                                         strncpy(ses->serverOS,bcc_ptr, len);
2358
2359                                         bcc_ptr += len;
2360                                         bcc_ptr[0] = 0; /* null terminate the string */
2361                                         bcc_ptr++;
2362
2363                                         len = strnlen(bcc_ptr, 1024);
2364                                         kfree(ses->serverNOS);
2365                                         ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2366                                         if(ses->serverNOS == NULL)
2367                                                 goto sesssetup_nomem;
2368                                         strncpy(ses->serverNOS, bcc_ptr, len);
2369                                         bcc_ptr += len;
2370                                         bcc_ptr[0] = 0;
2371                                         bcc_ptr++;
2372
2373                                         len = strnlen(bcc_ptr, 1024);
2374                                         if(ses->serverDomain)
2375                                                 kfree(ses->serverDomain);
2376                                         ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2377                                         if(ses->serverDomain == NULL)
2378                                                 goto sesssetup_nomem;
2379                                         strncpy(ses->serverDomain, bcc_ptr, len);
2380                                         bcc_ptr += len;
2381                                         bcc_ptr[0] = 0;
2382                                         bcc_ptr++;
2383                                 } else
2384                                         cFYI(1,
2385                                              ("Variable field of length %d extends beyond end of smb ",
2386                                               len));
2387                         }
2388                 } else {
2389                         cERROR(1,
2390                                (" Security Blob Length extends beyond end of SMB"));
2391                 }
2392         } else {
2393                 cERROR(1,
2394                        (" Invalid Word count %d: ",
2395                         smb_buffer_response->WordCount));
2396                 rc = -EIO;
2397         }
2398 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2399                            since that could make reconnection harder, and
2400                            reconnection might be needed to free memory */
2401         if (smb_buffer)
2402                 cifs_buf_release(smb_buffer);
2403
2404         return rc;
2405 }
2406
2407 static int
2408 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2409                               struct cifsSesInfo *ses, int * pNTLMv2_flag,
2410                               const struct nls_table *nls_codepage)
2411 {
2412         struct smb_hdr *smb_buffer;
2413         struct smb_hdr *smb_buffer_response;
2414         SESSION_SETUP_ANDX *pSMB;
2415         SESSION_SETUP_ANDX *pSMBr;
2416         char *bcc_ptr;
2417         char *domain;
2418         int rc = 0;
2419         int remaining_words = 0;
2420         int bytes_returned = 0;
2421         int len;
2422         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2423         PNEGOTIATE_MESSAGE SecurityBlob;
2424         PCHALLENGE_MESSAGE SecurityBlob2;
2425         __u32 negotiate_flags, capabilities;
2426         __u16 count;
2427
2428         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2429         if(ses == NULL)
2430                 return -EINVAL;
2431         domain = ses->domainName;
2432         *pNTLMv2_flag = FALSE;
2433         smb_buffer = cifs_buf_get();
2434         if (smb_buffer == NULL) {
2435                 return -ENOMEM;
2436         }
2437         smb_buffer_response = smb_buffer;
2438         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2439         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2440
2441         /* send SMBsessionSetup here */
2442         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2443                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2444
2445         smb_buffer->Mid = GetNextMid(ses->server);
2446         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2447         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2448
2449         pSMB->req.AndXCommand = 0xFF;
2450         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2451         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2452
2453         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2454                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2455
2456         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2457             CAP_EXTENDED_SECURITY;
2458         if (ses->capabilities & CAP_UNICODE) {
2459                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2460                 capabilities |= CAP_UNICODE;
2461         }
2462         if (ses->capabilities & CAP_STATUS32) {
2463                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2464                 capabilities |= CAP_STATUS32;
2465         }
2466         if (ses->capabilities & CAP_DFS) {
2467                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2468                 capabilities |= CAP_DFS;
2469         }
2470         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2471
2472         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2473         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2474         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2475         SecurityBlob->MessageType = NtLmNegotiate;
2476         negotiate_flags =
2477             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2478             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2479             NTLMSSP_NEGOTIATE_56 |
2480             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2481         if(sign_CIFS_PDUs)
2482                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2483 /*      if(ntlmv2_support)
2484                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2485         /* setup pointers to domain name and workstation name */
2486         bcc_ptr += SecurityBlobLength;
2487
2488         SecurityBlob->WorkstationName.Buffer = 0;
2489         SecurityBlob->WorkstationName.Length = 0;
2490         SecurityBlob->WorkstationName.MaximumLength = 0;
2491
2492         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2493         along with username on auth request (ie the response to challenge) */
2494         SecurityBlob->DomainName.Buffer = 0;
2495         SecurityBlob->DomainName.Length = 0;
2496         SecurityBlob->DomainName.MaximumLength = 0;
2497         if (ses->capabilities & CAP_UNICODE) {
2498                 if ((long) bcc_ptr % 2) {
2499                         *bcc_ptr = 0;
2500                         bcc_ptr++;
2501                 }
2502
2503                 bytes_returned =
2504                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2505                                   32, nls_codepage);
2506                 bcc_ptr += 2 * bytes_returned;
2507                 bytes_returned =
2508                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2509                                   nls_codepage);
2510                 bcc_ptr += 2 * bytes_returned;
2511                 bcc_ptr += 2;   /* null terminate Linux version */
2512                 bytes_returned =
2513                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2514                                   64, nls_codepage);
2515                 bcc_ptr += 2 * bytes_returned;
2516                 *(bcc_ptr + 1) = 0;
2517                 *(bcc_ptr + 2) = 0;
2518                 bcc_ptr += 2;   /* null terminate network opsys string */
2519                 *(bcc_ptr + 1) = 0;
2520                 *(bcc_ptr + 2) = 0;
2521                 bcc_ptr += 2;   /* null domain */
2522         } else {                /* ASCII */
2523                 strcpy(bcc_ptr, "Linux version ");
2524                 bcc_ptr += strlen("Linux version ");
2525                 strcpy(bcc_ptr, utsname()->release);
2526                 bcc_ptr += strlen(utsname()->release) + 1;
2527                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2528                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2529                 bcc_ptr++;      /* empty domain field */
2530                 *bcc_ptr = 0;
2531         }
2532         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2533         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2534         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2535         smb_buffer->smb_buf_length += count;
2536         pSMB->req.ByteCount = cpu_to_le16(count);
2537
2538         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2539                          &bytes_returned, 1);
2540
2541         if (smb_buffer_response->Status.CifsError ==
2542             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2543                 rc = 0;
2544
2545         if (rc) {
2546 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2547         } else if ((smb_buffer_response->WordCount == 3)
2548                    || (smb_buffer_response->WordCount == 4)) {
2549                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2550                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2551
2552                 if (action & GUEST_LOGIN)
2553                         cFYI(1, (" Guest login"));
2554         /* Do we want to set anything in SesInfo struct when guest login? */
2555
2556                 bcc_ptr = pByteArea(smb_buffer_response);
2557         /* response can have either 3 or 4 word count - Samba sends 3 */
2558
2559                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2560                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2561                         cFYI(1,
2562                              ("Unexpected NTLMSSP message type received %d",
2563                               SecurityBlob2->MessageType));
2564                 } else if (ses) {
2565                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2566                         cFYI(1, ("UID = %d", ses->Suid));
2567                         if ((pSMBr->resp.hdr.WordCount == 3)
2568                             || ((pSMBr->resp.hdr.WordCount == 4)
2569                                 && (blob_len <
2570                                     pSMBr->resp.ByteCount))) {
2571
2572                                 if (pSMBr->resp.hdr.WordCount == 4) {
2573                                         bcc_ptr += blob_len;
2574                                         cFYI(1, ("Security Blob Length %d",
2575                                               blob_len));
2576                                 }
2577
2578                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2579
2580                                 memcpy(ses->server->cryptKey,
2581                                        SecurityBlob2->Challenge,
2582                                        CIFS_CRYPTO_KEY_SIZE);
2583                                 if(SecurityBlob2->NegotiateFlags &
2584                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2585                                         *pNTLMv2_flag = TRUE;
2586
2587                                 if((SecurityBlob2->NegotiateFlags &
2588                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2589                                         || (sign_CIFS_PDUs > 1))
2590                                                 ses->server->secMode |=
2591                                                         SECMODE_SIGN_REQUIRED;
2592                                 if ((SecurityBlob2->NegotiateFlags &
2593                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2594                                                 ses->server->secMode |=
2595                                                         SECMODE_SIGN_ENABLED;
2596
2597                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2598                                         if ((long) (bcc_ptr) % 2) {
2599                                                 remaining_words =
2600                                                     (BCC(smb_buffer_response)
2601                                                      - 1) / 2;
2602                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2603                                         } else {
2604                                                 remaining_words =
2605                                                     BCC
2606                                                     (smb_buffer_response) / 2;
2607                                         }
2608                                         len =
2609                                             UniStrnlen((wchar_t *) bcc_ptr,
2610                                                        remaining_words - 1);
2611 /* We look for obvious messed up bcc or strings in response so we do not go off
2612    the end since (at least) WIN2K and Windows XP have a major bug in not null
2613    terminating last Unicode string in response  */
2614                                         if(ses->serverOS)
2615                                                 kfree(ses->serverOS);
2616                                         ses->serverOS =
2617                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2618                                         cifs_strfromUCS_le(ses->serverOS,
2619                                                            (__le16 *)
2620                                                            bcc_ptr, len,
2621                                                            nls_codepage);
2622                                         bcc_ptr += 2 * (len + 1);
2623                                         remaining_words -= len + 1;
2624                                         ses->serverOS[2 * len] = 0;
2625                                         ses->serverOS[1 + (2 * len)] = 0;
2626                                         if (remaining_words > 0) {
2627                                                 len = UniStrnlen((wchar_t *)
2628                                                                  bcc_ptr,
2629                                                                  remaining_words
2630                                                                  - 1);
2631                                                 kfree(ses->serverNOS);
2632                                                 ses->serverNOS =
2633                                                     kzalloc(2 * (len + 1),
2634                                                             GFP_KERNEL);
2635                                                 cifs_strfromUCS_le(ses->
2636                                                                    serverNOS,
2637                                                                    (__le16 *)
2638                                                                    bcc_ptr,
2639                                                                    len,
2640                                                                    nls_codepage);
2641                                                 bcc_ptr += 2 * (len + 1);
2642                                                 ses->serverNOS[2 * len] = 0;
2643                                                 ses->serverNOS[1 +
2644                                                                (2 * len)] = 0;
2645                                                 remaining_words -= len + 1;
2646                                                 if (remaining_words > 0) {
2647                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2648            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2649                                                         kfree(ses->serverDomain);
2650                                                         ses->serverDomain =
2651                                                             kzalloc(2 *
2652                                                                     (len +
2653                                                                      1),
2654                                                                     GFP_KERNEL);
2655                                                         cifs_strfromUCS_le
2656                                                             (ses->serverDomain,
2657                                                              (__le16 *)bcc_ptr,
2658                                                              len, nls_codepage);
2659                                                         bcc_ptr +=
2660                                                             2 * (len + 1);
2661                                                         ses->serverDomain[2*len]
2662                                                             = 0;
2663                                                         ses->serverDomain
2664                                                                 [1 + (2 * len)]
2665                                                             = 0;
2666                                                 } /* else no more room so create dummy domain string */
2667                                                 else {
2668                                                         kfree(ses->serverDomain);
2669                                                         ses->serverDomain =
2670                                                             kzalloc(2,
2671                                                                     GFP_KERNEL);
2672                                                 }
2673                                         } else {        /* no room so create dummy domain and NOS string */
2674                                                 kfree(ses->serverDomain);
2675                                                 ses->serverDomain =
2676                                                     kzalloc(2, GFP_KERNEL);
2677                                                 kfree(ses->serverNOS);
2678                                                 ses->serverNOS =
2679                                                     kzalloc(2, GFP_KERNEL);
2680                                         }
2681                                 } else {        /* ASCII */
2682                                         len = strnlen(bcc_ptr, 1024);
2683                                         if (((long) bcc_ptr + len) - (long)
2684                                             pByteArea(smb_buffer_response)
2685                                             <= BCC(smb_buffer_response)) {
2686                                                 if(ses->serverOS)
2687                                                         kfree(ses->serverOS);
2688                                                 ses->serverOS =
2689                                                     kzalloc(len + 1,
2690                                                             GFP_KERNEL);
2691                                                 strncpy(ses->serverOS,
2692                                                         bcc_ptr, len);
2693
2694                                                 bcc_ptr += len;
2695                                                 bcc_ptr[0] = 0; /* null terminate string */
2696                                                 bcc_ptr++;
2697
2698                                                 len = strnlen(bcc_ptr, 1024);
2699                                                 kfree(ses->serverNOS);
2700                                                 ses->serverNOS =
2701                                                     kzalloc(len + 1,
2702                                                             GFP_KERNEL);
2703                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2704                                                 bcc_ptr += len;
2705                                                 bcc_ptr[0] = 0;
2706                                                 bcc_ptr++;
2707
2708                                                 len = strnlen(bcc_ptr, 1024);
2709                                                 kfree(ses->serverDomain);
2710                                                 ses->serverDomain =
2711                                                     kzalloc(len + 1,
2712                                                             GFP_KERNEL);
2713                                                 strncpy(ses->serverDomain, bcc_ptr, len);
2714                                                 bcc_ptr += len;
2715                                                 bcc_ptr[0] = 0;
2716                                                 bcc_ptr++;
2717                                         } else
2718                                                 cFYI(1,
2719                                                      ("Variable field of length %d extends beyond end of smb",
2720                                                       len));
2721                                 }
2722                         } else {
2723                                 cERROR(1,
2724                                        (" Security Blob Length extends beyond end of SMB"));
2725                         }
2726                 } else {
2727                         cERROR(1, ("No session structure passed in."));
2728                 }
2729         } else {
2730                 cERROR(1,
2731                        (" Invalid Word count %d:",
2732                         smb_buffer_response->WordCount));
2733                 rc = -EIO;
2734         }
2735
2736         if (smb_buffer)
2737                 cifs_buf_release(smb_buffer);
2738
2739         return rc;
2740 }
2741 static int
2742 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2743                 char *ntlm_session_key, int ntlmv2_flag,
2744                 const struct nls_table *nls_codepage)
2745 {
2746         struct smb_hdr *smb_buffer;
2747         struct smb_hdr *smb_buffer_response;
2748         SESSION_SETUP_ANDX *pSMB;
2749         SESSION_SETUP_ANDX *pSMBr;
2750         char *bcc_ptr;
2751         char *user;
2752         char *domain;
2753         int rc = 0;
2754         int remaining_words = 0;
2755         int bytes_returned = 0;
2756         int len;
2757         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2758         PAUTHENTICATE_MESSAGE SecurityBlob;
2759         __u32 negotiate_flags, capabilities;
2760         __u16 count;
2761
2762         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2763         if(ses == NULL)
2764                 return -EINVAL;
2765         user = ses->userName;
2766         domain = ses->domainName;
2767         smb_buffer = cifs_buf_get();
2768         if (smb_buffer == NULL) {
2769                 return -ENOMEM;
2770         }
2771         smb_buffer_response = smb_buffer;
2772         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2773         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2774
2775         /* send SMBsessionSetup here */
2776         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2777                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2778
2779         smb_buffer->Mid = GetNextMid(ses->server);
2780         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2781         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2782         pSMB->req.AndXCommand = 0xFF;
2783         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2784         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2785
2786         pSMB->req.hdr.Uid = ses->Suid;
2787
2788         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2789                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2790
2791         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2792             CAP_EXTENDED_SECURITY;
2793         if (ses->capabilities & CAP_UNICODE) {
2794                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2795                 capabilities |= CAP_UNICODE;
2796         }
2797         if (ses->capabilities & CAP_STATUS32) {
2798                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2799                 capabilities |= CAP_STATUS32;
2800         }
2801         if (ses->capabilities & CAP_DFS) {
2802                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2803                 capabilities |= CAP_DFS;
2804         }
2805         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2806
2807         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2808         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2809         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2810         SecurityBlob->MessageType = NtLmAuthenticate;
2811         bcc_ptr += SecurityBlobLength;
2812         negotiate_flags =
2813             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2814             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2815             0x80000000 | NTLMSSP_NEGOTIATE_128;
2816         if(sign_CIFS_PDUs)
2817                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2818         if(ntlmv2_flag)
2819                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2820
2821 /* setup pointers to domain name and workstation name */
2822
2823         SecurityBlob->WorkstationName.Buffer = 0;
2824         SecurityBlob->WorkstationName.Length = 0;
2825         SecurityBlob->WorkstationName.MaximumLength = 0;
2826         SecurityBlob->SessionKey.Length = 0;
2827         SecurityBlob->SessionKey.MaximumLength = 0;
2828         SecurityBlob->SessionKey.Buffer = 0;
2829
2830         SecurityBlob->LmChallengeResponse.Length = 0;
2831         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2832         SecurityBlob->LmChallengeResponse.Buffer = 0;
2833
2834         SecurityBlob->NtChallengeResponse.Length =
2835             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2836         SecurityBlob->NtChallengeResponse.MaximumLength =
2837             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2838         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2839         SecurityBlob->NtChallengeResponse.Buffer =
2840             cpu_to_le32(SecurityBlobLength);
2841         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2842         bcc_ptr += CIFS_SESS_KEY_SIZE;
2843
2844         if (ses->capabilities & CAP_UNICODE) {
2845                 if (domain == NULL) {
2846                         SecurityBlob->DomainName.Buffer = 0;
2847                         SecurityBlob->DomainName.Length = 0;
2848                         SecurityBlob->DomainName.MaximumLength = 0;
2849                 } else {
2850                         __u16 len =
2851                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2852                                           nls_codepage);
2853                         len *= 2;
2854                         SecurityBlob->DomainName.MaximumLength =
2855                             cpu_to_le16(len);
2856                         SecurityBlob->DomainName.Buffer =
2857                             cpu_to_le32(SecurityBlobLength);
2858                         bcc_ptr += len;
2859                         SecurityBlobLength += len;
2860                         SecurityBlob->DomainName.Length =
2861                             cpu_to_le16(len);
2862                 }
2863                 if (user == NULL) {
2864                         SecurityBlob->UserName.Buffer = 0;
2865                         SecurityBlob->UserName.Length = 0;
2866                         SecurityBlob->UserName.MaximumLength = 0;
2867                 } else {
2868                         __u16 len =
2869                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2870                                           nls_codepage);
2871                         len *= 2;
2872                         SecurityBlob->UserName.MaximumLength =
2873                             cpu_to_le16(len);
2874                         SecurityBlob->UserName.Buffer =
2875                             cpu_to_le32(SecurityBlobLength);
2876                         bcc_ptr += len;
2877                         SecurityBlobLength += len;
2878                         SecurityBlob->UserName.Length =
2879                             cpu_to_le16(len);
2880                 }
2881
2882                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2883                    SecurityBlob->WorkstationName.Length *= 2;
2884                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2885                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2886                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2887                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2888                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
2889
2890                 if ((long) bcc_ptr % 2) {
2891                         *bcc_ptr = 0;
2892                         bcc_ptr++;
2893                 }
2894                 bytes_returned =
2895                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2896                                   32, nls_codepage);
2897                 bcc_ptr += 2 * bytes_returned;
2898                 bytes_returned =
2899                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2900                                   nls_codepage);
2901                 bcc_ptr += 2 * bytes_returned;
2902                 bcc_ptr += 2;   /* null term version string */
2903                 bytes_returned =
2904                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2905                                   64, nls_codepage);
2906                 bcc_ptr += 2 * bytes_returned;
2907                 *(bcc_ptr + 1) = 0;
2908                 *(bcc_ptr + 2) = 0;
2909                 bcc_ptr += 2;   /* null terminate network opsys string */
2910                 *(bcc_ptr + 1) = 0;
2911                 *(bcc_ptr + 2) = 0;
2912                 bcc_ptr += 2;   /* null domain */
2913         } else {                /* ASCII */
2914                 if (domain == NULL) {
2915                         SecurityBlob->DomainName.Buffer = 0;
2916                         SecurityBlob->DomainName.Length = 0;
2917                         SecurityBlob->DomainName.MaximumLength = 0;
2918                 } else {
2919                         __u16 len;
2920                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2921                         strncpy(bcc_ptr, domain, 63);
2922                         len = strnlen(domain, 64);
2923                         SecurityBlob->DomainName.MaximumLength =
2924                             cpu_to_le16(len);
2925                         SecurityBlob->DomainName.Buffer =
2926                             cpu_to_le32(SecurityBlobLength);
2927                         bcc_ptr += len;
2928                         SecurityBlobLength += len;
2929                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
2930                 }
2931                 if (user == NULL) {
2932                         SecurityBlob->UserName.Buffer = 0;
2933                         SecurityBlob->UserName.Length = 0;
2934                         SecurityBlob->UserName.MaximumLength = 0;
2935                 } else {
2936                         __u16 len;
2937                         strncpy(bcc_ptr, user, 63);
2938                         len = strnlen(user, 64);
2939                         SecurityBlob->UserName.MaximumLength =
2940                             cpu_to_le16(len);
2941                         SecurityBlob->UserName.Buffer =
2942                             cpu_to_le32(SecurityBlobLength);
2943                         bcc_ptr += len;
2944                         SecurityBlobLength += len;
2945                         SecurityBlob->UserName.Length = cpu_to_le16(len);
2946                 }
2947                 /* BB fill in our workstation name if known BB */
2948
2949                 strcpy(bcc_ptr, "Linux version ");
2950                 bcc_ptr += strlen("Linux version ");
2951                 strcpy(bcc_ptr, utsname()->release);
2952                 bcc_ptr += strlen(utsname()->release) + 1;
2953                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2954                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2955                 bcc_ptr++;      /* null domain */
2956                 *bcc_ptr = 0;
2957         }
2958         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2959         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2960         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2961         smb_buffer->smb_buf_length += count;
2962         pSMB->req.ByteCount = cpu_to_le16(count);
2963
2964         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2965                          &bytes_returned, 1);
2966         if (rc) {
2967 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2968         } else if ((smb_buffer_response->WordCount == 3)
2969                    || (smb_buffer_response->WordCount == 4)) {
2970                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2971                 __u16 blob_len =
2972                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2973                 if (action & GUEST_LOGIN)
2974                         cFYI(1, (" Guest login"));      /* BB do we want to set anything in SesInfo struct ? */
2975 /*        if(SecurityBlob2->MessageType != NtLm??){
2976                  cFYI("Unexpected message type on auth response is %d "));
2977         } */
2978                 if (ses) {
2979                         cFYI(1,
2980                              ("Does UID on challenge %d match auth response UID %d ",
2981                               ses->Suid, smb_buffer_response->Uid));
2982                         ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2983                         bcc_ptr = pByteArea(smb_buffer_response);
2984             /* response can have either 3 or 4 word count - Samba sends 3 */
2985                         if ((pSMBr->resp.hdr.WordCount == 3)
2986                             || ((pSMBr->resp.hdr.WordCount == 4)
2987                                 && (blob_len <
2988                                     pSMBr->resp.ByteCount))) {
2989                                 if (pSMBr->resp.hdr.WordCount == 4) {
2990                                         bcc_ptr +=
2991                                             blob_len;
2992                                         cFYI(1,
2993                                              ("Security Blob Length %d ",
2994                                               blob_len));
2995                                 }
2996
2997                                 cFYI(1,
2998                                      ("NTLMSSP response to Authenticate "));
2999
3000                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3001                                         if ((long) (bcc_ptr) % 2) {
3002                                                 remaining_words =
3003                                                     (BCC(smb_buffer_response)
3004                                                      - 1) / 2;
3005                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
3006                                         } else {
3007                                                 remaining_words = BCC(smb_buffer_response) / 2;
3008                                         }
3009                                         len =
3010                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3011 /* We look for obvious messed up bcc or strings in response so we do not go off
3012   the end since (at least) WIN2K and Windows XP have a major bug in not null
3013   terminating last Unicode string in response  */
3014                                         if(ses->serverOS)
3015                                                 kfree(ses->serverOS);
3016                                         ses->serverOS =
3017                                             kzalloc(2 * (len + 1), GFP_KERNEL);
3018                                         cifs_strfromUCS_le(ses->serverOS,
3019                                                            (__le16 *)
3020                                                            bcc_ptr, len,
3021                                                            nls_codepage);
3022                                         bcc_ptr += 2 * (len + 1);
3023                                         remaining_words -= len + 1;
3024                                         ses->serverOS[2 * len] = 0;
3025                                         ses->serverOS[1 + (2 * len)] = 0;
3026                                         if (remaining_words > 0) {
3027                                                 len = UniStrnlen((wchar_t *)
3028                                                                  bcc_ptr,
3029                                                                  remaining_words
3030                                                                  - 1);
3031                                                 kfree(ses->serverNOS);
3032                                                 ses->serverNOS =
3033                                                     kzalloc(2 * (len + 1),
3034                                                             GFP_KERNEL);
3035                                                 cifs_strfromUCS_le(ses->
3036                                                                    serverNOS,
3037                                                                    (__le16 *)
3038                                                                    bcc_ptr,
3039                                                                    len,
3040                                                                    nls_codepage);
3041                                                 bcc_ptr += 2 * (len + 1);
3042                                                 ses->serverNOS[2 * len] = 0;
3043                                                 ses->serverNOS[1+(2*len)] = 0;
3044                                                 remaining_words -= len + 1;
3045                                                 if (remaining_words > 0) {
3046                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3047      /* last string not always null terminated (e.g. for Windows XP & 2000) */
3048                                                         if(ses->serverDomain)
3049                                                                 kfree(ses->serverDomain);
3050                                                         ses->serverDomain =
3051                                                             kzalloc(2 *
3052                                                                     (len +
3053                                                                      1),
3054                                                                     GFP_KERNEL);
3055                                                         cifs_strfromUCS_le
3056                                                             (ses->
3057                                                              serverDomain,
3058                                                              (__le16 *)
3059                                                              bcc_ptr, len,
3060                                                              nls_codepage);
3061                                                         bcc_ptr +=
3062                                                             2 * (len + 1);
3063                                                         ses->
3064                                                             serverDomain[2
3065                                                                          * len]
3066                                                             = 0;
3067                                                         ses->
3068                                                             serverDomain[1
3069                                                                          +
3070                                                                          (2
3071                                                                           *
3072                                                                           len)]
3073                                                             = 0;
3074                                                 } /* else no more room so create dummy domain string */
3075                                                 else {
3076                                                         if(ses->serverDomain)
3077                                                                 kfree(ses->serverDomain);
3078                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3079                                                 }
3080                                         } else {  /* no room so create dummy domain and NOS string */
3081                                                 if(ses->serverDomain)
3082                                                         kfree(ses->serverDomain);
3083                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3084                                                 kfree(ses->serverNOS);
3085                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3086                                         }
3087                                 } else {        /* ASCII */
3088                                         len = strnlen(bcc_ptr, 1024);
3089                                         if (((long) bcc_ptr + len) -
3090                         (long) pByteArea(smb_buffer_response)
3091                             <= BCC(smb_buffer_response)) {
3092                                                 if(ses->serverOS)
3093                                                         kfree(ses->serverOS);
3094                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3095                                                 strncpy(ses->serverOS,bcc_ptr, len);
3096
3097                                                 bcc_ptr += len;
3098                                                 bcc_ptr[0] = 0; /* null terminate the string */
3099                                                 bcc_ptr++;
3100
3101                                                 len = strnlen(bcc_ptr, 1024);
3102                                                 kfree(ses->serverNOS);
3103                                                 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3104                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3105                                                 bcc_ptr += len;
3106                                                 bcc_ptr[0] = 0;
3107                                                 bcc_ptr++;
3108
3109                                                 len = strnlen(bcc_ptr, 1024);
3110                                                 if(ses->serverDomain)
3111                                                         kfree(ses->serverDomain);
3112                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3113                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3114                                                 bcc_ptr += len;
3115                                                 bcc_ptr[0] = 0;
3116                                                 bcc_ptr++;
3117                                         } else
3118                                                 cFYI(1,
3119                                                      ("Variable field of length %d extends beyond end of smb ",
3120                                                       len));
3121                                 }
3122                         } else {
3123                                 cERROR(1,
3124                                        (" Security Blob Length extends beyond end of SMB"));
3125                         }
3126                 } else {
3127                         cERROR(1, ("No session structure passed in."));
3128                 }
3129         } else {
3130                 cERROR(1,
3131                        (" Invalid Word count %d: ",
3132                         smb_buffer_response->WordCount));
3133                 rc = -EIO;
3134         }
3135
3136         if (smb_buffer)
3137                 cifs_buf_release(smb_buffer);
3138
3139         return rc;
3140 }
3141
3142 int
3143 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3144          const char *tree, struct cifsTconInfo *tcon,
3145          const struct nls_table *nls_codepage)
3146 {
3147         struct smb_hdr *smb_buffer;
3148         struct smb_hdr *smb_buffer_response;
3149         TCONX_REQ *pSMB;
3150         TCONX_RSP *pSMBr;
3151         unsigned char *bcc_ptr;
3152         int rc = 0;
3153         int length;
3154         __u16 count;
3155
3156         if (ses == NULL)
3157                 return -EIO;
3158
3159         smb_buffer = cifs_buf_get();
3160         if (smb_buffer == NULL) {
3161                 return -ENOMEM;
3162         }
3163         smb_buffer_response = smb_buffer;
3164
3165         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3166                         NULL /*no tid */ , 4 /*wct */ );
3167
3168         smb_buffer->Mid = GetNextMid(ses->server);
3169         smb_buffer->Uid = ses->Suid;
3170         pSMB = (TCONX_REQ *) smb_buffer;
3171         pSMBr = (TCONX_RSP *) smb_buffer_response;
3172
3173         pSMB->AndXCommand = 0xFF;
3174         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3175         bcc_ptr = &pSMB->Password[0];
3176         if((ses->server->secMode) & SECMODE_USER) {
3177                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3178                 *bcc_ptr = 0; /* password is null byte */
3179                 bcc_ptr++;              /* skip password */
3180                 /* already aligned so no need to do it below */
3181         } else {
3182                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3183                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3184                    specified as required (when that support is added to
3185                    the vfs in the future) as only NTLM or the much
3186                    weaker LANMAN (which we do not send by default) is accepted
3187                    by Samba (not sure whether other servers allow
3188                    NTLMv2 password here) */
3189 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3190                 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3191                         (ses->server->secType == LANMAN))
3192                         calc_lanman_hash(ses, bcc_ptr);
3193                 else
3194 #endif /* CIFS_WEAK_PW_HASH */
3195                 SMBNTencrypt(ses->password,
3196                              ses->server->cryptKey,
3197                              bcc_ptr);
3198
3199                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3200                 if(ses->capabilities & CAP_UNICODE) {
3201                         /* must align unicode strings */
3202                         *bcc_ptr = 0; /* null byte password */
3203                         bcc_ptr++;
3204                 }
3205         }
3206
3207         if(ses->server->secMode &
3208                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3209                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3210
3211         if (ses->capabilities & CAP_STATUS32) {
3212                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3213         }
3214         if (ses->capabilities & CAP_DFS) {
3215                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3216         }
3217         if (ses->capabilities & CAP_UNICODE) {
3218                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3219                 length =
3220                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3221                         6 /* max utf8 char length in bytes */ *
3222                         (/* server len*/ + 256 /* share len */), nls_codepage);
3223                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3224                 bcc_ptr += 2;   /* skip trailing null */
3225         } else {                /* ASCII */
3226                 strcpy(bcc_ptr, tree);
3227                 bcc_ptr += strlen(tree) + 1;
3228         }
3229         strcpy(bcc_ptr, "?????");
3230         bcc_ptr += strlen("?????");
3231         bcc_ptr += 1;
3232         count = bcc_ptr - &pSMB->Password[0];
3233         pSMB->hdr.smb_buf_length += count;
3234         pSMB->ByteCount = cpu_to_le16(count);
3235
3236         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3237
3238         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3239         /* above now done in SendReceive */
3240         if ((rc == 0) && (tcon != NULL)) {
3241                 tcon->tidStatus = CifsGood;
3242                 tcon->tid = smb_buffer_response->Tid;
3243                 bcc_ptr = pByteArea(smb_buffer_response);
3244                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3245         /* skip service field (NB: this field is always ASCII) */
3246                 bcc_ptr += length + 1;
3247                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3248                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3249                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3250                         if ((bcc_ptr + (2 * length)) -
3251                              pByteArea(smb_buffer_response) <=
3252                             BCC(smb_buffer_response)) {
3253                                 kfree(tcon->nativeFileSystem);
3254                                 tcon->nativeFileSystem =
3255                                     kzalloc(length + 2, GFP_KERNEL);
3256                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3257                                                    (__le16 *) bcc_ptr,
3258                                                    length, nls_codepage);
3259                                 bcc_ptr += 2 * length;
3260                                 bcc_ptr[0] = 0; /* null terminate the string */
3261                                 bcc_ptr[1] = 0;
3262                                 bcc_ptr += 2;
3263                         }
3264                         /* else do not bother copying these informational fields */
3265                 } else {
3266                         length = strnlen(bcc_ptr, 1024);
3267                         if ((bcc_ptr + length) -
3268                             pByteArea(smb_buffer_response) <=
3269                             BCC(smb_buffer_response)) {
3270                                 kfree(tcon->nativeFileSystem);
3271                                 tcon->nativeFileSystem =
3272                                     kzalloc(length + 1, GFP_KERNEL);
3273                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3274                                         length);
3275                         }
3276                         /* else do not bother copying these informational fields */
3277                 }
3278                 if((smb_buffer_response->WordCount == 3) ||
3279                          (smb_buffer_response->WordCount == 7))
3280                         /* field is in same location */
3281                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3282                 else
3283                         tcon->Flags = 0;
3284                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3285         } else if ((rc == 0) && tcon == NULL) {
3286         /* all we need to save for IPC$ connection */
3287                 ses->ipc_tid = smb_buffer_response->Tid;
3288         }
3289
3290         if (smb_buffer)
3291                 cifs_buf_release(smb_buffer);
3292         return rc;
3293 }
3294
3295 int
3296 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3297 {
3298         int rc = 0;
3299         int xid;
3300         struct cifsSesInfo *ses = NULL;
3301         struct task_struct *cifsd_task;
3302         char * tmp;
3303
3304         xid = GetXid();
3305
3306         if (cifs_sb->tcon) {
3307                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3308                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3309                 if (rc == -EBUSY) {
3310                         FreeXid(xid);
3311                         return 0;
3312                 }
3313                 tconInfoFree(cifs_sb->tcon);
3314                 if ((ses) && (ses->server)) {
3315                         /* save off task so we do not refer to ses later */
3316                         cifsd_task = ses->server->tsk;
3317                         cFYI(1, ("About to do SMBLogoff "));
3318                         rc = CIFSSMBLogoff(xid, ses);
3319                         if (rc == -EBUSY) {
3320                                 FreeXid(xid);
3321                                 return 0;
3322                         } else if (rc == -ESHUTDOWN) {
3323                                 cFYI(1,("Waking up socket by sending it signal"));
3324                                 if(cifsd_task) {
3325                                         send_sig(SIGKILL,cifsd_task,1);
3326                                         kthread_stop(cifsd_task);
3327                                 }
3328                                 rc = 0;
3329                         } /* else - we have an smb session
3330                                 left on this socket do not kill cifsd */
3331                 } else
3332                         cFYI(1, ("No session or bad tcon"));
3333         }
3334
3335         cifs_sb->tcon = NULL;
3336         tmp = cifs_sb->prepath;
3337         cifs_sb->prepathlen = 0;
3338         cifs_sb->prepath = NULL;
3339         kfree(tmp);
3340         if (ses)
3341                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3342         if (ses)
3343                 sesInfoFree(ses);
3344
3345         FreeXid(xid);
3346         return rc;              /* BB check if we should always return zero here */
3347 }
3348
3349 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3350                                            struct nls_table * nls_info)
3351 {
3352         int rc = 0;
3353         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3354         int ntlmv2_flag = FALSE;
3355         int first_time = 0;
3356
3357         /* what if server changes its buffer size after dropping the session? */
3358         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3359                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3360                 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3361                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3362                         if(rc == -EAGAIN)
3363                                 rc = -EHOSTDOWN;
3364                 }
3365                 if(rc == 0) {
3366                         spin_lock(&GlobalMid_Lock);
3367                         if(pSesInfo->server->tcpStatus != CifsExiting)
3368                                 pSesInfo->server->tcpStatus = CifsGood;
3369                         else
3370                                 rc = -EHOSTDOWN;
3371                         spin_unlock(&GlobalMid_Lock);
3372
3373                 }
3374                 first_time = 1;
3375         }
3376         if (!rc) {
3377                 pSesInfo->flags = 0;
3378                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3379                 if(linuxExtEnabled == 0)
3380                         pSesInfo->capabilities &= (~CAP_UNIX);
3381         /*      pSesInfo->sequence_number = 0;*/
3382                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3383                         pSesInfo->server->secMode,
3384                         pSesInfo->server->capabilities,
3385                         pSesInfo->server->timeAdj));
3386                 if(experimEnabled < 2)
3387                         rc = CIFS_SessSetup(xid, pSesInfo,
3388                                             first_time, nls_info);
3389                 else if (extended_security
3390                                 && (pSesInfo->capabilities
3391                                         & CAP_EXTENDED_SECURITY)
3392                                 && (pSesInfo->server->secType == NTLMSSP)) {
3393                         rc = -EOPNOTSUPP;
3394                 } else if (extended_security
3395                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3396                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3397                         cFYI(1, ("NTLMSSP sesssetup"));
3398                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3399                                                 pSesInfo,
3400                                                 &ntlmv2_flag,
3401                                                 nls_info);
3402                         if (!rc) {
3403                                 if(ntlmv2_flag) {
3404                                         char * v2_response;
3405                                         cFYI(1,("more secure NTLM ver2 hash"));
3406                                         if(CalcNTLMv2_partial_mac_key(pSesInfo,
3407                                                 nls_info)) {
3408                                                 rc = -ENOMEM;
3409                                                 goto ss_err_exit;
3410                                         } else
3411                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3412                                         if(v2_response) {
3413                                                 CalcNTLMv2_response(pSesInfo,v2_response);
3414                                 /*              if(first_time)
3415                                                         cifs_calculate_ntlmv2_mac_key(
3416                                                           pSesInfo->server->mac_signing_key,
3417                                                           response, ntlm_session_key, */
3418                                                 kfree(v2_response);
3419                                         /* BB Put dummy sig in SessSetup PDU? */
3420                                         } else {
3421                                                 rc = -ENOMEM;
3422                                                 goto ss_err_exit;
3423                                         }
3424
3425                                 } else {
3426                                         SMBNTencrypt(pSesInfo->password,
3427                                                 pSesInfo->server->cryptKey,
3428                                                 ntlm_session_key);
3429
3430                                         if(first_time)
3431                                                 cifs_calculate_mac_key(
3432                                                         pSesInfo->server->mac_signing_key,
3433                                                         ntlm_session_key,
3434                                                         pSesInfo->password);
3435                                 }
3436                         /* for better security the weaker lanman hash not sent
3437                            in AuthSessSetup so we no longer calculate it */
3438
3439                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3440                                         pSesInfo,
3441                                         ntlm_session_key,
3442                                         ntlmv2_flag,
3443                                         nls_info);
3444                         }
3445                 } else { /* old style NTLM 0.12 session setup */
3446                         SMBNTencrypt(pSesInfo->password,
3447                                 pSesInfo->server->cryptKey,
3448                                 ntlm_session_key);
3449
3450                         if(first_time)
3451                                 cifs_calculate_mac_key(
3452                                         pSesInfo->server->mac_signing_key,
3453                                         ntlm_session_key, pSesInfo->password);
3454
3455                         rc = CIFSSessSetup(xid, pSesInfo,
3456                                 ntlm_session_key, nls_info);
3457                 }
3458                 if (rc) {
3459                         cERROR(1,("Send error in SessSetup = %d",rc));
3460                 } else {
3461                         cFYI(1,("CIFS Session Established successfully"));
3462                         pSesInfo->status = CifsGood;
3463                 }
3464         }
3465 ss_err_exit:
3466         return rc;
3467 }
3468