SAFE public projects git trees. - safe/jmp/linux-2.6/blob - fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2006
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/ipv6.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <asm/uaccess.h>
  37 #include <asm/processor.h>
  38 #include "cifspdu.h"
  39 #include "cifsglob.h"
  40 #include "cifsproto.h"
  41 #include "cifs_unicode.h"
  42 #include "cifs_debug.h"
  43 #include "cifs_fs_sb.h"
  44 #include "ntlmssp.h"
  45 #include "nterr.h"
  46 #include "rfc1002pdu.h"
  47 #include "cn_cifs.h"
  48
  49 #define CIFS_PORT 445
  50 #define RFC1001_PORT 139
  51
  52 static DECLARE_COMPLETION(cifsd_complete);
  53
  54 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  55                          unsigned char *p24);
  56
  57 extern mempool_t *cifs_req_poolp;
  58
  59 struct smb_vol {
  60         char *username;
  61         char *password;
  62         char *domainname;
  63         char *UNC;
  64         char *UNCip;
  65         char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
  66         char *iocharset;  /* local code page for mapping to and from Unicode */
  67         char source_rfc1001_name[16]; /* netbios name of client */
  68         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
  69         uid_t linux_uid;
  70         gid_t linux_gid;
  71         mode_t file_mode;
  72         mode_t dir_mode;
  73         unsigned secFlg;
  74         unsigned rw:1;
  75         unsigned retry:1;
  76         unsigned intr:1;
  77         unsigned setuids:1;
  78         unsigned noperm:1;
  79         unsigned no_psx_acl:1; /* set if posix acl support should be disabled */
  80         unsigned cifs_acl:1;
  81         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  82         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
  83         unsigned direct_io:1;
  84         unsigned remap:1;   /* set to remap seven reserved chars in filenames */
  85         unsigned posix_paths:1;   /* unset to not ask for posix pathnames. */
  86         unsigned sfu_emul:1;
  87         unsigned nullauth:1; /* attempt to authenticate with null user */
  88         unsigned nocase;     /* request case insensitive filenames */
  89         unsigned nobrl;      /* disable sending byte range locks to srv */
  90         unsigned int rsize;
  91         unsigned int wsize;
  92         unsigned int sockopt;
  93         unsigned short int port;
  94         char * prepath;
  95 };
  96
  97 static int ipv4_connect(struct sockaddr_in *psin_server,
  98                         struct socket **csocket,
  99                         char * netb_name,
 100                         char * server_netb_name);
 101 static int ipv6_connect(struct sockaddr_in6 *psin_server,
 102                         struct socket **csocket);
 103
 104
 105         /*
 106          * cifs tcp session reconnection
 107          *
 108          * mark tcp session as reconnecting so temporarily locked
 109          * mark all smb sessions as reconnecting for tcp session
 110          * reconnect tcp session
 111          * wake up waiters on reconnection? - (not needed currently)
 112          */
 113
 114 static int
 115 cifs_reconnect(struct TCP_Server_Info *server)
 116 {
 117         int rc = 0;
 118         struct list_head *tmp;
 119         struct cifsSesInfo *ses;
 120         struct cifsTconInfo *tcon;
 121         struct mid_q_entry * mid_entry;
 122
 123         spin_lock(&GlobalMid_Lock);
 124         if( kthread_should_stop() ) {
 125                 /* the demux thread will exit normally
 126                 next time through the loop */
 127                 spin_unlock(&GlobalMid_Lock);
 128                 return rc;
 129         } else
 130                 server->tcpStatus = CifsNeedReconnect;
 131         spin_unlock(&GlobalMid_Lock);
 132         server->maxBuf = 0;
 133
 134         cFYI(1, ("Reconnecting tcp session"));
 135
 136         /* before reconnecting the tcp session, mark the smb session (uid)
 137                 and the tid bad so they are not used until reconnected */
 138         read_lock(&GlobalSMBSeslock);
 139         list_for_each(tmp, &GlobalSMBSessionList) {
 140                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 141                 if (ses->server) {
 142                         if (ses->server == server) {
 143                                 ses->status = CifsNeedReconnect;
 144                                 ses->ipc_tid = 0;
 145                         }
 146                 }
 147                 /* else tcp and smb sessions need reconnection */
 148         }
 149         list_for_each(tmp, &GlobalTreeConnectionList) {
 150                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
 151                 if((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
 152                         tcon->tidStatus = CifsNeedReconnect;
 153                 }
 154         }
 155         read_unlock(&GlobalSMBSeslock);
 156         /* do not want to be sending data on a socket we are freeing */
 157         down(&server->tcpSem);
 158         if(server->ssocket) {
 159                 cFYI(1,("State: 0x%x Flags: 0x%lx", server->ssocket->state,
 160                         server->ssocket->flags));
 161                 server->ssocket->ops->shutdown(server->ssocket,SEND_SHUTDOWN);
 162                 cFYI(1,("Post shutdown state: 0x%x Flags: 0x%lx", server->ssocket->state,
 163                         server->ssocket->flags));
 164                 sock_release(server->ssocket);
 165                 server->ssocket = NULL;
 166         }
 167
 168         spin_lock(&GlobalMid_Lock);
 169         list_for_each(tmp, &server->pending_mid_q) {
 170                 mid_entry = list_entry(tmp, struct
 171                                         mid_q_entry,
 172                                         qhead);
 173                 if(mid_entry) {
 174                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
 175                                 /* Mark other intransit requests as needing
 176                                    retry so we do not immediately mark the
 177                                    session bad again (ie after we reconnect
 178                                    below) as they timeout too */
 179                                 mid_entry->midState = MID_RETRY_NEEDED;
 180                         }
 181                 }
 182         }
 183         spin_unlock(&GlobalMid_Lock);
 184         up(&server->tcpSem);
 185
 186         while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood))
 187         {
 188                 try_to_freeze();
 189                 if(server->protocolType == IPV6) {
 190                         rc = ipv6_connect(&server->addr.sockAddr6,&server->ssocket);
 191                 } else {
 192                         rc = ipv4_connect(&server->addr.sockAddr,
 193                                         &server->ssocket,
 194                                         server->workstation_RFC1001_name,
 195                                         server->server_RFC1001_name);
 196                 }
 197                 if(rc) {
 198                         cFYI(1,("reconnect error %d",rc));
 199                         msleep(3000);
 200                 } else {
 201                         atomic_inc(&tcpSesReconnectCount);
 202                         spin_lock(&GlobalMid_Lock);
 203                         if( !kthread_should_stop() )
 204                                 server->tcpStatus = CifsGood;
 205                         server->sequence_number = 0;
 206                         spin_unlock(&GlobalMid_Lock);
 207         /*              atomic_set(&server->inFlight,0);*/
 208                         wake_up(&server->response_q);
 209                 }
 210         }
 211         return rc;
 212 }
 213
 214 /*
 215         return codes:
 216                 0       not a transact2, or all data present
 217                 >0      transact2 with that much data missing
 218                 -EINVAL = invalid transact2
 219
 220  */
 221 static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
 222 {
 223         struct smb_t2_rsp * pSMBt;
 224         int total_data_size;
 225         int data_in_this_rsp;
 226         int remaining;
 227
 228         if(pSMB->Command != SMB_COM_TRANSACTION2)
 229                 return 0;
 230
 231         /* check for plausible wct, bcc and t2 data and parm sizes */
 232         /* check for parm and data offset going beyond end of smb */
 233         if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 234                 cFYI(1,("invalid transact2 word count"));
 235                 return -EINVAL;
 236         }
 237
 238         pSMBt = (struct smb_t2_rsp *)pSMB;
 239
 240         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 241         data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 242
 243         remaining = total_data_size - data_in_this_rsp;
 244
 245         if(remaining == 0)
 246                 return 0;
 247         else if(remaining < 0) {
 248                 cFYI(1,("total data %d smaller than data in frame %d",
 249                         total_data_size, data_in_this_rsp));
 250                 return -EINVAL;
 251         } else {
 252                 cFYI(1,("missing %d bytes from transact2, check next response",
 253                         remaining));
 254                 if(total_data_size > maxBufSize) {
 255                         cERROR(1,("TotalDataSize %d is over maximum buffer %d",
 256                                 total_data_size,maxBufSize));
 257                         return -EINVAL;
 258                 }
 259                 return remaining;
 260         }
 261 }
 262
 263 static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
 264 {
 265         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 266         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 267         int total_data_size;
 268         int total_in_buf;
 269         int remaining;
 270         int total_in_buf2;
 271         char * data_area_of_target;
 272         char * data_area_of_buf2;
 273         __u16 byte_count;
 274
 275         total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
 276
 277         if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
 278                 cFYI(1,("total data sizes of primary and secondary t2 differ"));
 279         }
 280
 281         total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
 282
 283         remaining = total_data_size - total_in_buf;
 284
 285         if(remaining < 0)
 286                 return -EINVAL;
 287
 288         if(remaining == 0) /* nothing to do, ignore */
 289                 return 0;
 290
 291         total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
 292         if(remaining < total_in_buf2) {
 293                 cFYI(1,("transact2 2nd response contains too much data"));
 294         }
 295
 296         /* find end of first SMB data area */
 297         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 298                                 le16_to_cpu(pSMBt->t2_rsp.DataOffset);
 299         /* validate target area */
 300
 301         data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
 302                                         le16_to_cpu(pSMB2->t2_rsp.DataOffset);
 303
 304         data_area_of_target += total_in_buf;
 305
 306         /* copy second buffer into end of first buffer */
 307         memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
 308         total_in_buf += total_in_buf2;
 309         pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
 310         byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
 311         byte_count += total_in_buf2;
 312         BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
 313
 314         byte_count = pTargetSMB->smb_buf_length;
 315         byte_count += total_in_buf2;
 316
 317         /* BB also add check that we are not beyond maximum buffer size */
 318
 319         pTargetSMB->smb_buf_length = byte_count;
 320
 321         if(remaining == total_in_buf2) {
 322                 cFYI(1,("found the last secondary response"));
 323                 return 0; /* we are done */
 324         } else /* more responses to go */
 325                 return 1;
 326
 327 }
 328
 329 static int
 330 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 331 {
 332         int length;
 333         unsigned int pdu_length, total_read;
 334         struct smb_hdr *smb_buffer = NULL;
 335         struct smb_hdr *bigbuf = NULL;
 336         struct smb_hdr *smallbuf = NULL;
 337         struct msghdr smb_msg;
 338         struct kvec iov;
 339         struct socket *csocket = server->ssocket;
 340         struct list_head *tmp;
 341         struct cifsSesInfo *ses;
 342         struct task_struct *task_to_wake = NULL;
 343         struct mid_q_entry *mid_entry;
 344         char temp;
 345         int isLargeBuf = FALSE;
 346         int isMultiRsp;
 347         int reconnect;
 348
 349         allow_signal(SIGKILL);
 350         current->flags |= PF_MEMALLOC;
 351         server->tsk = current;  /* save process info to wake at shutdown */
 352         cFYI(1, ("Demultiplex PID: %d", current->pid));
 353         write_lock(&GlobalSMBSeslock);
 354         atomic_inc(&tcpSesAllocCount);
 355         length = tcpSesAllocCount.counter;
 356         write_unlock(&GlobalSMBSeslock);
 357         complete(&cifsd_complete);
 358         if(length  > 1) {
 359                 mempool_resize(cifs_req_poolp,
 360                         length + cifs_min_rcv,
 361                         GFP_KERNEL);
 362         }
 363
 364         while (!kthread_should_stop()) {
 365                 if (try_to_freeze())
 366                         continue;
 367                 if (bigbuf == NULL) {
 368                         bigbuf = cifs_buf_get();
 369                         if (!bigbuf) {
 370                                 cERROR(1, ("No memory for large SMB response"));
 371                                 msleep(3000);
 372                                 /* retry will check if exiting */
 373                                 continue;
 374                         }
 375                 } else if (isLargeBuf) {
 376                         /* we are reusing a dirty large buf, clear its start */
 377                         memset(bigbuf, 0, sizeof (struct smb_hdr));
 378                 }
 379
 380                 if (smallbuf == NULL) {
 381                         smallbuf = cifs_small_buf_get();
 382                         if (!smallbuf) {
 383                                 cERROR(1, ("No memory for SMB response"));
 384                                 msleep(1000);
 385                                 /* retry will check if exiting */
 386                                 continue;
 387                         }
 388                         /* beginning of smb buffer is cleared in our buf_get */
 389                 } else /* if existing small buf clear beginning */
 390                         memset(smallbuf, 0, sizeof (struct smb_hdr));
 391
 392                 isLargeBuf = FALSE;
 393                 isMultiRsp = FALSE;
 394                 smb_buffer = smallbuf;
 395                 iov.iov_base = smb_buffer;
 396                 iov.iov_len = 4;
 397                 smb_msg.msg_control = NULL;
 398                 smb_msg.msg_controllen = 0;
 399                 length =
 400                     kernel_recvmsg(csocket, &smb_msg,
 401                                  &iov, 1, 4, 0 /* BB see socket.h flags */);
 402
 403                 if ( kthread_should_stop() ) {
 404                         break;
 405                 } else if (server->tcpStatus == CifsNeedReconnect) {
 406                         cFYI(1, ("Reconnect after server stopped responding"));
 407                         cifs_reconnect(server);
 408                         cFYI(1, ("call to reconnect done"));
 409                         csocket = server->ssocket;
 410                         continue;
 411                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
 412                         msleep(1); /* minimum sleep to prevent looping
 413                                 allowing socket to clear and app threads to set
 414                                 tcpStatus CifsNeedReconnect if server hung */
 415                         continue;
 416                 } else if (length <= 0) {
 417                         if (server->tcpStatus == CifsNew) {
 418                                 cFYI(1, ("tcp session abend after SMBnegprot"));
 419                                 /* some servers kill the TCP session rather than
 420                                    returning an SMB negprot error, in which
 421                                    case reconnecting here is not going to help,
 422                                    and so simply return error to mount */
 423                                 break;
 424                         }
 425                         if (!try_to_freeze() && (length == -EINTR)) {
 426                                 cFYI(1,("cifsd thread killed"));
 427                                 break;
 428                         }
 429                         cFYI(1,("Reconnect after unexpected peek error %d",
 430                                 length));
 431                         cifs_reconnect(server);
 432                         csocket = server->ssocket;
 433                         wake_up(&server->response_q);
 434                         continue;
 435                 } else if (length < 4) {
 436                         cFYI(1,
 437                             ("Frame under four bytes received (%d bytes long)",
 438                               length));
 439                         cifs_reconnect(server);
 440                         csocket = server->ssocket;
 441                         wake_up(&server->response_q);
 442                         continue;
 443                 }
 444
 445                 /* The right amount was read from socket - 4 bytes */
 446                 /* so we can now interpret the length field */
 447
 448                 /* the first byte big endian of the length field,
 449                 is actually not part of the length but the type
 450                 with the most common, zero, as regular data */
 451                 temp = *((char *) smb_buffer);
 452
 453                 /* Note that FC 1001 length is big endian on the wire,
 454                 but we convert it here so it is always manipulated
 455                 as host byte order */
 456                 pdu_length = ntohl(smb_buffer->smb_buf_length);
 457                 smb_buffer->smb_buf_length = pdu_length;
 458
 459                 cFYI(1,("rfc1002 length 0x%x)", pdu_length+4));
 460
 461                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 462                         continue;
 463                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 464                         cFYI(1,("Good RFC 1002 session rsp"));
 465                         continue;
 466                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 467                         /* we get this from Windows 98 instead of
 468                            an error on SMB negprot response */
 469                         cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
 470                                 pdu_length));
 471                         if(server->tcpStatus == CifsNew) {
 472                                 /* if nack on negprot (rather than
 473                                 ret of smb negprot error) reconnecting
 474                                 not going to help, ret error to mount */
 475                                 break;
 476                         } else {
 477                                 /* give server a second to
 478                                 clean up before reconnect attempt */
 479                                 msleep(1000);
 480                                 /* always try 445 first on reconnect
 481                                 since we get NACK on some if we ever
 482                                 connected to port 139 (the NACK is
 483                                 since we do not begin with RFC1001
 484                                 session initialize frame) */
 485                                 server->addr.sockAddr.sin_port =
 486                                         htons(CIFS_PORT);
 487                                 cifs_reconnect(server);
 488                                 csocket = server->ssocket;
 489                                 wake_up(&server->response_q);
 490                                 continue;
 491                         }
 492                 } else if (temp != (char) 0) {
 493                         cERROR(1,("Unknown RFC 1002 frame"));
 494                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 495                                       length);
 496                         cifs_reconnect(server);
 497                         csocket = server->ssocket;
 498                         continue;
 499                 }
 500
 501                 /* else we have an SMB response */
 502                 if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 503                             (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
 504                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
 505                                         length, pdu_length+4));
 506                         cifs_reconnect(server);
 507                         csocket = server->ssocket;
 508                         wake_up(&server->response_q);
 509                         continue;
 510                 }
 511
 512                 /* else length ok */
 513                 reconnect = 0;
 514
 515                 if(pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 516                         isLargeBuf = TRUE;
 517                         memcpy(bigbuf, smallbuf, 4);
 518                         smb_buffer = bigbuf;
 519                 }
 520                 length = 0;
 521                 iov.iov_base = 4 + (char *)smb_buffer;
 522                 iov.iov_len = pdu_length;
 523                 for (total_read = 0; total_read < pdu_length;
 524                      total_read += length) {
 525                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 526                                                 pdu_length - total_read, 0);
 527                         if( kthread_should_stop() ||
 528                             (length == -EINTR)) {
 529                                 /* then will exit */
 530                                 reconnect = 2;
 531                                 break;
 532                         } else if (server->tcpStatus == CifsNeedReconnect) {
 533                                 cifs_reconnect(server);
 534                                 csocket = server->ssocket;
 535                                 /* Reconnect wakes up rspns q */
 536                                 /* Now we will reread sock */
 537                                 reconnect = 1;
 538                                 break;
 539                         } else if ((length == -ERESTARTSYS) ||
 540                                    (length == -EAGAIN)) {
 541                                 msleep(1); /* minimum sleep to prevent looping,
 542                                               allowing socket to clear and app
 543                                               threads to set tcpStatus
 544                                               CifsNeedReconnect if server hung*/
 545                                 continue;
 546                         } else if (length <= 0) {
 547                                 cERROR(1,("Received no data, expecting %d",
 548                                               pdu_length - total_read));
 549                                 cifs_reconnect(server);
 550                                 csocket = server->ssocket;
 551                                 reconnect = 1;
 552                                 break;
 553                         }
 554                 }
 555                 if(reconnect == 2)
 556                         break;
 557                 else if(reconnect == 1)
 558                         continue;
 559
 560                 length += 4; /* account for rfc1002 hdr */
 561
 562
 563                 dump_smb(smb_buffer, length);
 564                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 565                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 566                         continue;
 567                 }
 568
 569
 570                 task_to_wake = NULL;
 571                 spin_lock(&GlobalMid_Lock);
 572                 list_for_each(tmp, &server->pending_mid_q) {
 573                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 574
 575                         if ((mid_entry->mid == smb_buffer->Mid) &&
 576                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 577                             (mid_entry->command == smb_buffer->Command)) {
 578                                 if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
 579                                         /* We have a multipart transact2 resp */
 580                                         isMultiRsp = TRUE;
 581                                         if(mid_entry->resp_buf) {
 582                                                 /* merge response - fix up 1st*/
 583                                                 if(coalesce_t2(smb_buffer,
 584                                                         mid_entry->resp_buf)) {
 585                                                         mid_entry->multiRsp = 1;
 586                                                         break;
 587                                                 } else {
 588                                                         /* all parts received */
 589                                                         mid_entry->multiEnd = 1;
 590                                                         goto multi_t2_fnd;
 591                                                 }
 592                                         } else {
 593                                                 if(!isLargeBuf) {
 594                                                         cERROR(1,("1st trans2 resp needs bigbuf"));
 595                                         /* BB maybe we can fix this up,  switch
 596                                            to already allocated large buffer? */
 597                                                 } else {
 598                                                         /* Have first buffer */
 599                                                         mid_entry->resp_buf =
 600                                                                  smb_buffer;
 601                                                         mid_entry->largeBuf = 1;
 602                                                         bigbuf = NULL;
 603                                                 }
 604                                         }
 605                                         break;
 606                                 }
 607                                 mid_entry->resp_buf = smb_buffer;
 608                                 if(isLargeBuf)
 609                                         mid_entry->largeBuf = 1;
 610                                 else
 611                                         mid_entry->largeBuf = 0;
 612 multi_t2_fnd:
 613                                 task_to_wake = mid_entry->tsk;
 614                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 615 #ifdef CONFIG_CIFS_STATS2
 616                                 mid_entry->when_received = jiffies;
 617 #endif
 618                                 /* so we do not time out requests to  server
 619                                 which is still responding (since server could
 620                                 be busy but not dead) */
 621                                 server->lstrp = jiffies;
 622                                 break;
 623                         }
 624                 }
 625                 spin_unlock(&GlobalMid_Lock);
 626                 if (task_to_wake) {
 627                         /* Was previous buf put in mpx struct for multi-rsp? */
 628                         if(!isMultiRsp) {
 629                                 /* smb buffer will be freed by user thread */
 630                                 if(isLargeBuf) {
 631                                         bigbuf = NULL;
 632                                 } else
 633                                         smallbuf = NULL;
 634                         }
 635                         wake_up_process(task_to_wake);
 636                 } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
 637                     && (isMultiRsp == FALSE)) {
 638                         cERROR(1, ("No task to wake, unknown frame rcvd! NumMids %d", midCount.counter));
 639                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
 640                                       sizeof(struct smb_hdr));
 641 #ifdef CONFIG_CIFS_DEBUG2
 642                         cifs_dump_detail(smb_buffer);
 643                         cifs_dump_mids(server);
 644 #endif /* CIFS_DEBUG2 */
 645
 646                 }
 647         } /* end while !EXITING */
 648
 649         spin_lock(&GlobalMid_Lock);
 650         server->tcpStatus = CifsExiting;
 651         server->tsk = NULL;
 652         /* check if we have blocked requests that need to free */
 653         /* Note that cifs_max_pending is normally 50, but
 654         can be set at module install time to as little as two */
 655         if(atomic_read(&server->inFlight) >= cifs_max_pending)
 656                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 657         /* We do not want to set the max_pending too low or we
 658         could end up with the counter going negative */
 659         spin_unlock(&GlobalMid_Lock);
 660         /* Although there should not be any requests blocked on
 661         this queue it can not hurt to be paranoid and try to wake up requests
 662         that may haven been blocked when more than 50 at time were on the wire
 663         to the same server - they now will see the session is in exit state
 664         and get out of SendReceive.  */
 665         wake_up_all(&server->request_q);
 666         /* give those requests time to exit */
 667         msleep(125);
 668
 669         if(server->ssocket) {
 670                 sock_release(csocket);
 671                 server->ssocket = NULL;
 672         }
 673         /* buffer usuallly freed in free_mid - need to free it here on exit */
 674         if (bigbuf != NULL)
 675                 cifs_buf_release(bigbuf);
 676         if (smallbuf != NULL)
 677                 cifs_small_buf_release(smallbuf);
 678
 679         read_lock(&GlobalSMBSeslock);
 680         if (list_empty(&server->pending_mid_q)) {
 681                 /* loop through server session structures attached to this and
 682                     mark them dead */
 683                 list_for_each(tmp, &GlobalSMBSessionList) {
 684                         ses =
 685                             list_entry(tmp, struct cifsSesInfo,
 686                                        cifsSessionList);
 687                         if (ses->server == server) {
 688                                 ses->status = CifsExiting;
 689                                 ses->server = NULL;
 690                         }
 691                 }
 692                 read_unlock(&GlobalSMBSeslock);
 693         } else {
 694                 /* although we can not zero the server struct pointer yet,
 695                 since there are active requests which may depnd on them,
 696                 mark the corresponding SMB sessions as exiting too */
 697                 list_for_each(tmp, &GlobalSMBSessionList) {
 698                         ses = list_entry(tmp, struct cifsSesInfo,
 699                                          cifsSessionList);
 700                         if (ses->server == server) {
 701                                 ses->status = CifsExiting;
 702                         }
 703                 }
 704
 705                 spin_lock(&GlobalMid_Lock);
 706                 list_for_each(tmp, &server->pending_mid_q) {
 707                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 708                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
 709                                 cFYI(1,
 710                                   ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
 711                                 task_to_wake = mid_entry->tsk;
 712                                 if(task_to_wake) {
 713                                         wake_up_process(task_to_wake);
 714                                 }
 715                         }
 716                 }
 717                 spin_unlock(&GlobalMid_Lock);
 718                 read_unlock(&GlobalSMBSeslock);
 719                 /* 1/8th of sec is more than enough time for them to exit */
 720                 msleep(125);
 721         }
 722
 723         if (!list_empty(&server->pending_mid_q)) {
 724                 /* mpx threads have not exited yet give them
 725                 at least the smb send timeout time for long ops */
 726                 /* due to delays on oplock break requests, we need
 727                 to wait at least 45 seconds before giving up
 728                 on a request getting a response and going ahead
 729                 and killing cifsd */
 730                 cFYI(1, ("Wait for exit from demultiplex thread"));
 731                 msleep(46000);
 732                 /* if threads still have not exited they are probably never
 733                 coming home not much else we can do but free the memory */
 734         }
 735
 736         write_lock(&GlobalSMBSeslock);
 737         atomic_dec(&tcpSesAllocCount);
 738         length = tcpSesAllocCount.counter;
 739
 740         /* last chance to mark ses pointers invalid
 741         if there are any pointing to this (e.g
 742         if a crazy root user tried to kill cifsd
 743         kernel thread explicitly this might happen) */
 744         list_for_each(tmp, &GlobalSMBSessionList) {
 745                 ses = list_entry(tmp, struct cifsSesInfo,
 746                                 cifsSessionList);
 747                 if (ses->server == server) {
 748                         ses->server = NULL;
 749                 }
 750         }
 751         write_unlock(&GlobalSMBSeslock);
 752
 753         kfree(server);
 754         if(length  > 0) {
 755                 mempool_resize(cifs_req_poolp,
 756                         length + cifs_min_rcv,
 757                         GFP_KERNEL);
 758         }
 759
 760         return 0;
 761 }
 762
 763 static int
 764 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 765 {
 766         char *value;
 767         char *data;
 768         unsigned int  temp_len, i, j;
 769         char separator[2];
 770
 771         separator[0] = ',';
 772         separator[1] = 0;
 773
 774         if (Local_System_Name[0] != 0)
 775                 memcpy(vol->source_rfc1001_name, Local_System_Name,15);
 776         else {
 777                 char *nodename = utsname()->nodename;
 778                 int n = strnlen(nodename,15);
 779                 memset(vol->source_rfc1001_name,0x20,15);
 780                 for(i=0 ; i < n ; i++) {
 781                         /* does not have to be perfect mapping since field is
 782                         informational, only used for servers that do not support
 783                         port 445 and it can be overridden at mount time */
 784                         vol->source_rfc1001_name[i] = toupper(nodename[i]);
 785                 }
 786         }
 787         vol->source_rfc1001_name[15] = 0;
 788         /* null target name indicates to use *SMBSERVR default called name
 789            if we end up sending RFC1001 session initialize */
 790         vol->target_rfc1001_name[0] = 0;
 791         vol->linux_uid = current->uid;  /* current->euid instead? */
 792         vol->linux_gid = current->gid;
 793         vol->dir_mode = S_IRWXUGO;
 794         /* 2767 perms indicate mandatory locking support */
 795         vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
 796
 797         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 798         vol->rw = TRUE;
 799         /* default is always to request posix paths. */
 800         vol->posix_paths = 1;
 801
 802         if (!options)
 803                 return 1;
 804
 805         if(strncmp(options,"sep=",4) == 0) {
 806                 if(options[4] != 0) {
 807                         separator[0] = options[4];
 808                         options += 5;
 809                 } else {
 810                         cFYI(1,("Null separator not allowed"));
 811                 }
 812         }
 813
 814         while ((data = strsep(&options, separator)) != NULL) {
 815                 if (!*data)
 816                         continue;
 817                 if ((value = strchr(data, '=')) != NULL)
 818                         *value++ = '\0';
 819
 820                 if (strnicmp(data, "user_xattr",10) == 0) {/*parse before user*/
 821                         vol->no_xattr = 0;
 822                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
 823                         vol->no_xattr = 1;
 824                 } else if (strnicmp(data, "user", 4) == 0) {
 825                         if (!value) {
 826                                 printk(KERN_WARNING
 827                                        "CIFS: invalid or missing username\n");
 828                                 return 1;       /* needs_arg; */
 829                         } else if(!*value) {
 830                                 /* null user, ie anonymous, authentication */
 831                                 vol->nullauth = 1;
 832                         }
 833                         if (strnlen(value, 200) < 200) {
 834                                 vol->username = value;
 835                         } else {
 836                                 printk(KERN_WARNING "CIFS: username too long\n");
 837                                 return 1;
 838                         }
 839                 } else if (strnicmp(data, "pass", 4) == 0) {
 840                         if (!value) {
 841                                 vol->password = NULL;
 842                                 continue;
 843                         } else if(value[0] == 0) {
 844                                 /* check if string begins with double comma
 845                                    since that would mean the password really
 846                                    does start with a comma, and would not
 847                                    indicate an empty string */
 848                                 if(value[1] != separator[0]) {
 849                                         vol->password = NULL;
 850                                         continue;
 851                                 }
 852                         }
 853                         temp_len = strlen(value);
 854                         /* removed password length check, NTLM passwords
 855                                 can be arbitrarily long */
 856
 857                         /* if comma in password, the string will be
 858                         prematurely null terminated.  Commas in password are
 859                         specified across the cifs mount interface by a double
 860                         comma ie ,, and a comma used as in other cases ie ','
 861                         as a parameter delimiter/separator is single and due
 862                         to the strsep above is temporarily zeroed. */
 863
 864                         /* NB: password legally can have multiple commas and
 865                         the only illegal character in a password is null */
 866
 867                         if ((value[temp_len] == 0) &&
 868                             (value[temp_len+1] == separator[0])) {
 869                                 /* reinsert comma */
 870                                 value[temp_len] = separator[0];
 871                                 temp_len+=2;  /* move after the second comma */
 872                                 while(value[temp_len] != 0)  {
 873                                         if (value[temp_len] == separator[0]) {
 874                                                 if (value[temp_len+1] ==
 875                                                      separator[0]) {
 876                                                 /* skip second comma */
 877                                                         temp_len++;
 878                                                 } else {
 879                                                 /* single comma indicating start
 880                                                          of next parm */
 881                                                         break;
 882                                                 }
 883                                         }
 884                                         temp_len++;
 885                                 }
 886                                 if(value[temp_len] == 0) {
 887                                         options = NULL;
 888                                 } else {
 889                                         value[temp_len] = 0;
 890                                         /* point option to start of next parm */
 891                                         options = value + temp_len + 1;
 892                                 }
 893                                 /* go from value to value + temp_len condensing
 894                                 double commas to singles. Note that this ends up
 895                                 allocating a few bytes too many, which is ok */
 896                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 897                                 if(vol->password == NULL) {
 898                                         printk("CIFS: no memory for pass\n");
 899                                         return 1;
 900                                 }
 901                                 for(i=0,j=0;i<temp_len;i++,j++) {
 902                                         vol->password[j] = value[i];
 903                                         if(value[i] == separator[0]
 904                                                 && value[i+1] == separator[0]) {
 905                                                 /* skip second comma */
 906                                                 i++;
 907                                         }
 908                                 }
 909                                 vol->password[j] = 0;
 910                         } else {
 911                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 912                                 if(vol->password == NULL) {
 913                                         printk("CIFS: no memory for pass\n");
 914                                         return 1;
 915                                 }
 916                                 strcpy(vol->password, value);
 917                         }
 918                 } else if (strnicmp(data, "ip", 2) == 0) {
 919                         if (!value || !*value) {
 920                                 vol->UNCip = NULL;
 921                         } else if (strnlen(value, 35) < 35) {
 922                                 vol->UNCip = value;
 923                         } else {
 924                                 printk(KERN_WARNING "CIFS: ip address too long\n");
 925                                 return 1;
 926                         }
 927                 } else if (strnicmp(data, "sec", 3) == 0) {
 928                         if (!value || !*value) {
 929                                 cERROR(1,("no security value specified"));
 930                                 continue;
 931                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 932                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 933                                         CIFSSEC_MUST_SIGN;
 934                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 935                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 936                                         CIFSSEC_MAY_KRB5; */
 937                                 cERROR(1,("Krb5 cifs privacy not supported"));
 938                                 return 1;
 939                         } else if (strnicmp(value, "krb5", 4) == 0) {
 940                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 941                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 942                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 943                                         CIFSSEC_MUST_SIGN;
 944                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 945                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 946                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 947                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 948                                         CIFSSEC_MUST_SIGN;
 949                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 950                                 /* ntlm is default so can be turned off too */
 951                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 952                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 953                                 /* BB is there a better way to do this? */
 954                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 955 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 956                         } else if (strnicmp(value, "lanman", 6) == 0) {
 957                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 958 #endif
 959                         } else if (strnicmp(value, "none", 4) == 0) {
 960                                 vol->nullauth = 1;
 961                         } else {
 962                                 cERROR(1,("bad security option: %s", value));
 963                                 return 1;
 964                         }
 965                 } else if ((strnicmp(data, "unc", 3) == 0)
 966                            || (strnicmp(data, "target", 6) == 0)
 967                            || (strnicmp(data, "path", 4) == 0)) {
 968                         if (!value || !*value) {
 969                                 printk(KERN_WARNING
 970                                        "CIFS: invalid path to network resource\n");
 971                                 return 1;       /* needs_arg; */
 972                         }
 973                         if ((temp_len = strnlen(value, 300)) < 300) {
 974                                 vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
 975                                 if(vol->UNC == NULL)
 976                                         return 1;
 977                                 strcpy(vol->UNC,value);
 978                                 if (strncmp(vol->UNC, "//", 2) == 0) {
 979                                         vol->UNC[0] = '\\';
 980                                         vol->UNC[1] = '\\';
 981                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
 982                                         printk(KERN_WARNING
 983                                                "CIFS: UNC Path does not begin with // or \\\\ \n");
 984                                         return 1;
 985                                 }
 986                         } else {
 987                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
 988                                 return 1;
 989                         }
 990                 } else if ((strnicmp(data, "domain", 3) == 0)
 991                            || (strnicmp(data, "workgroup", 5) == 0)) {
 992                         if (!value || !*value) {
 993                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
 994                                 return 1;       /* needs_arg; */
 995                         }
 996                         /* BB are there cases in which a comma can be valid in
 997                         a domain name and need special handling? */
 998                         if (strnlen(value, 256) < 256) {
 999                                 vol->domainname = value;
1000                                 cFYI(1, ("Domain name set"));
1001                         } else {
1002                                 printk(KERN_WARNING "CIFS: domain name too long\n");
1003                                 return 1;
1004                         }
1005                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1006                         if (!value || !*value) {
1007                                 printk(KERN_WARNING
1008                                        "CIFS: invalid path prefix\n");
1009                                 return 1;       /* needs_arg; */
1010                         }
1011                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1012                                 if(value[0] != '/')
1013                                         temp_len++;  /* missing leading slash */
1014                                 vol->prepath = kmalloc(temp_len+1,GFP_KERNEL);
1015                                 if(vol->prepath == NULL)
1016                                         return 1;
1017                                 if(value[0] != '/') {
1018                                         vol->prepath[0] = '/';
1019                                         strcpy(vol->prepath+1,value);
1020                                 } else
1021                                         strcpy(vol->prepath,value);
1022                                 cFYI(1,("prefix path %s",vol->prepath));
1023                         } else {
1024                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1025                                 return 1;
1026                         }
1027                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1028                         if (!value || !*value) {
1029                                 printk(KERN_WARNING "CIFS: invalid iocharset specified\n");
1030                                 return 1;       /* needs_arg; */
1031                         }
1032                         if (strnlen(value, 65) < 65) {
1033                                 if(strnicmp(value,"default",7))
1034                                         vol->iocharset = value;
1035                                 /* if iocharset not set load_nls_default used by caller */
1036                                 cFYI(1, ("iocharset set to %s",value));
1037                         } else {
1038                                 printk(KERN_WARNING "CIFS: iocharset name too long.\n");
1039                                 return 1;
1040                         }
1041                 } else if (strnicmp(data, "uid", 3) == 0) {
1042                         if (value && *value) {
1043                                 vol->linux_uid =
1044                                         simple_strtoul(value, &value, 0);
1045                         }
1046                 } else if (strnicmp(data, "gid", 3) == 0) {
1047                         if (value && *value) {
1048                                 vol->linux_gid =
1049                                         simple_strtoul(value, &value, 0);
1050                         }
1051                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1052                         if (value && *value) {
1053                                 vol->file_mode =
1054                                         simple_strtoul(value, &value, 0);
1055                         }
1056                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1057                         if (value && *value) {
1058                                 vol->dir_mode =
1059                                         simple_strtoul(value, &value, 0);
1060                         }
1061                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1062                         if (value && *value) {
1063                                 vol->dir_mode =
1064                                         simple_strtoul(value, &value, 0);
1065                         }
1066                 } else if (strnicmp(data, "port", 4) == 0) {
1067                         if (value && *value) {
1068                                 vol->port =
1069                                         simple_strtoul(value, &value, 0);
1070                         }
1071                 } else if (strnicmp(data, "rsize", 5) == 0) {
1072                         if (value && *value) {
1073                                 vol->rsize =
1074                                         simple_strtoul(value, &value, 0);
1075                         }
1076                 } else if (strnicmp(data, "wsize", 5) == 0) {
1077                         if (value && *value) {
1078                                 vol->wsize =
1079                                         simple_strtoul(value, &value, 0);
1080                         }
1081                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1082                         if (value && *value) {
1083                                 vol->sockopt =
1084                                         simple_strtoul(value, &value, 0);
1085                         }
1086                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1087                         if (!value || !*value || (*value == ' ')) {
1088                                 cFYI(1,("invalid (empty) netbiosname specified"));
1089                         } else {
1090                                 memset(vol->source_rfc1001_name,0x20,15);
1091                                 for(i=0;i<15;i++) {
1092                                 /* BB are there cases in which a comma can be
1093                                 valid in this workstation netbios name (and need
1094                                 special handling)? */
1095
1096                                 /* We do not uppercase netbiosname for user */
1097                                         if (value[i]==0)
1098                                                 break;
1099                                         else
1100                                                 vol->source_rfc1001_name[i] = value[i];
1101                                 }
1102                                 /* The string has 16th byte zero still from
1103                                 set at top of the function  */
1104                                 if((i==15) && (value[i] != 0))
1105                                         printk(KERN_WARNING "CIFS: netbiosname longer than 15 truncated.\n");
1106                         }
1107                 } else if (strnicmp(data, "servern", 7) == 0) {
1108                         /* servernetbiosname specified override *SMBSERVER */
1109                         if (!value || !*value || (*value == ' ')) {
1110                                 cFYI(1,("empty server netbiosname specified"));
1111                         } else {
1112                                 /* last byte, type, is 0x20 for servr type */
1113                                 memset(vol->target_rfc1001_name,0x20,16);
1114
1115                                 for(i=0;i<15;i++) {
1116                                 /* BB are there cases in which a comma can be
1117                                    valid in this workstation netbios name (and need
1118                                    special handling)? */
1119
1120                                 /* user or mount helper must uppercase netbiosname */
1121                                         if (value[i]==0)
1122                                                 break;
1123                                         else
1124                                                 vol->target_rfc1001_name[i] = value[i];
1125                                 }
1126                                 /* The string has 16th byte zero still from
1127                                    set at top of the function  */
1128                                 if((i==15) && (value[i] != 0))
1129                                         printk(KERN_WARNING "CIFS: server netbiosname longer than 15 truncated.\n");
1130                         }
1131                 } else if (strnicmp(data, "credentials", 4) == 0) {
1132                         /* ignore */
1133                 } else if (strnicmp(data, "version", 3) == 0) {
1134                         /* ignore */
1135                 } else if (strnicmp(data, "guest",5) == 0) {
1136                         /* ignore */
1137                 } else if (strnicmp(data, "rw", 2) == 0) {
1138                         vol->rw = TRUE;
1139                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1140                                    (strnicmp(data, "nosuid", 6) == 0) ||
1141                                    (strnicmp(data, "exec", 4) == 0) ||
1142                                    (strnicmp(data, "noexec", 6) == 0) ||
1143                                    (strnicmp(data, "nodev", 5) == 0) ||
1144                                    (strnicmp(data, "noauto", 6) == 0) ||
1145                                    (strnicmp(data, "dev", 3) == 0)) {
1146                         /*  The mount tool or mount.cifs helper (if present)
1147                                 uses these opts to set flags, and the flags are read
1148                                 by the kernel vfs layer before we get here (ie
1149                                 before read super) so there is no point trying to
1150                                 parse these options again and set anything and it
1151                                 is ok to just ignore them */
1152                         continue;
1153                 } else if (strnicmp(data, "ro", 2) == 0) {
1154                         vol->rw = FALSE;
1155                 } else if (strnicmp(data, "hard", 4) == 0) {
1156                         vol->retry = 1;
1157                 } else if (strnicmp(data, "soft", 4) == 0) {
1158                         vol->retry = 0;
1159                 } else if (strnicmp(data, "perm", 4) == 0) {
1160                         vol->noperm = 0;
1161                 } else if (strnicmp(data, "noperm", 6) == 0) {
1162                         vol->noperm = 1;
1163                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1164                         vol->remap = 1;
1165                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1166                         vol->remap = 0;
1167                 } else if (strnicmp(data, "sfu", 3) == 0) {
1168                         vol->sfu_emul = 1;
1169                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1170                         vol->sfu_emul = 0;
1171                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1172                         vol->posix_paths = 1;
1173                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1174                         vol->posix_paths = 0;
1175                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1176                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1177                         vol->nocase = 1;
1178                 } else if (strnicmp(data, "brl", 3) == 0) {
1179                         vol->nobrl =  0;
1180                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1181                            (strnicmp(data, "nolock", 6) == 0)) {
1182                         vol->nobrl =  1;
1183                         /* turn off mandatory locking in mode
1184                         if remote locking is turned off since the
1185                         local vfs will do advisory */
1186                         if(vol->file_mode == (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1187                                 vol->file_mode = S_IALLUGO;
1188                 } else if (strnicmp(data, "setuids", 7) == 0) {
1189                         vol->setuids = 1;
1190                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1191                         vol->setuids = 0;
1192                 } else if (strnicmp(data, "nohard", 6) == 0) {
1193                         vol->retry = 0;
1194                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1195                         vol->retry = 1;
1196                 } else if (strnicmp(data, "nointr", 6) == 0) {
1197                         vol->intr = 0;
1198                 } else if (strnicmp(data, "intr", 4) == 0) {
1199                         vol->intr = 1;
1200                 } else if (strnicmp(data, "serverino",7) == 0) {
1201                         vol->server_ino = 1;
1202                 } else if (strnicmp(data, "noserverino",9) == 0) {
1203                         vol->server_ino = 0;
1204                 } else if (strnicmp(data, "cifsacl",7) == 0) {
1205                         vol->cifs_acl = 1;
1206                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1207                         vol->cifs_acl = 0;
1208                 } else if (strnicmp(data, "acl",3) == 0) {
1209                         vol->no_psx_acl = 0;
1210                 } else if (strnicmp(data, "noacl",5) == 0) {
1211                         vol->no_psx_acl = 1;
1212                 } else if (strnicmp(data, "sign",4) == 0) {
1213                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1214 /*              } else if (strnicmp(data, "seal",4) == 0) {
1215                         vol->secFlg |= CIFSSEC_MUST_SEAL; */
1216                 } else if (strnicmp(data, "direct",6) == 0) {
1217                         vol->direct_io = 1;
1218                 } else if (strnicmp(data, "forcedirectio",13) == 0) {
1219                         vol->direct_io = 1;
1220                 } else if (strnicmp(data, "in6_addr",8) == 0) {
1221                         if (!value || !*value) {
1222                                 vol->in6_addr = NULL;
1223                         } else if (strnlen(value, 49) == 48) {
1224                                 vol->in6_addr = value;
1225                         } else {
1226                                 printk(KERN_WARNING "CIFS: ip v6 address not 48 characters long\n");
1227                                 return 1;
1228                         }
1229                 } else if (strnicmp(data, "noac", 4) == 0) {
1230                         printk(KERN_WARNING "CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
1231                 } else
1232                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",data);
1233         }
1234         if (vol->UNC == NULL) {
1235                 if(devname == NULL) {
1236                         printk(KERN_WARNING "CIFS: Missing UNC name for mount target\n");
1237                         return 1;
1238                 }
1239                 if ((temp_len = strnlen(devname, 300)) < 300) {
1240                         vol->UNC = kmalloc(temp_len+1,GFP_KERNEL);
1241                         if(vol->UNC == NULL)
1242                                 return 1;
1243                         strcpy(vol->UNC,devname);
1244                         if (strncmp(vol->UNC, "//", 2) == 0) {
1245                                 vol->UNC[0] = '\\';
1246                                 vol->UNC[1] = '\\';
1247                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1248                                 printk(KERN_WARNING "CIFS: UNC Path does not begin with // or \\\\ \n");
1249                                 return 1;
1250                         }
1251                 } else {
1252                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1253                         return 1;
1254                 }
1255         }
1256         if(vol->UNCip == NULL)
1257                 vol->UNCip = &vol->UNC[2];
1258
1259         return 0;
1260 }
1261
1262 static struct cifsSesInfo *
1263 cifs_find_tcp_session(struct in_addr * target_ip_addr,
1264                 struct in6_addr *target_ip6_addr,
1265                  char *userName, struct TCP_Server_Info **psrvTcp)
1266 {
1267         struct list_head *tmp;
1268         struct cifsSesInfo *ses;
1269         *psrvTcp = NULL;
1270         read_lock(&GlobalSMBSeslock);
1271
1272         list_for_each(tmp, &GlobalSMBSessionList) {
1273                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
1274                 if (ses->server) {
1275                         if((target_ip_addr &&
1276                                 (ses->server->addr.sockAddr.sin_addr.s_addr
1277                                   == target_ip_addr->s_addr)) || (target_ip6_addr
1278                                 && memcmp(&ses->server->addr.sockAddr6.sin6_addr,
1279                                         target_ip6_addr,sizeof(*target_ip6_addr)))){
1280                                 /* BB lock server and tcp session and increment use count here?? */
1281                                 *psrvTcp = ses->server; /* found a match on the TCP session */
1282                                 /* BB check if reconnection needed */
1283                                 if (strncmp
1284                                     (ses->userName, userName,
1285                                      MAX_USERNAME_SIZE) == 0){
1286                                         read_unlock(&GlobalSMBSeslock);
1287                                         return ses;     /* found exact match on both tcp and SMB sessions */
1288                                 }
1289                         }
1290                 }
1291                 /* else tcp and smb sessions need reconnection */
1292         }
1293         read_unlock(&GlobalSMBSeslock);
1294         return NULL;
1295 }
1296
1297 static struct cifsTconInfo *
1298 find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
1299 {
1300         struct list_head *tmp;
1301         struct cifsTconInfo *tcon;
1302
1303         read_lock(&GlobalSMBSeslock);
1304         list_for_each(tmp, &GlobalTreeConnectionList) {
1305                 cFYI(1, ("Next tcon"));
1306                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
1307                 if (tcon->ses) {
1308                         if (tcon->ses->server) {
1309                                 cFYI(1,
1310                                      ("old ip addr: %x == new ip %x ?",
1311                                       tcon->ses->server->addr.sockAddr.sin_addr.
1312                                       s_addr, new_target_ip_addr));
1313                                 if (tcon->ses->server->addr.sockAddr.sin_addr.
1314                                     s_addr == new_target_ip_addr) {
1315         /* BB lock tcon, server and tcp session and increment use count here? */
1316                                         /* found a match on the TCP session */
1317                                         /* BB check if reconnection needed */
1318                                         cFYI(1,("IP match, old UNC: %s new: %s",
1319                                               tcon->treeName, uncName));
1320                                         if (strncmp
1321                                             (tcon->treeName, uncName,
1322                                              MAX_TREE_SIZE) == 0) {
1323                                                 cFYI(1,
1324                                                      ("and old usr: %s new: %s",
1325                                                       tcon->treeName, uncName));
1326                                                 if (strncmp
1327                                                     (tcon->ses->userName,
1328                                                      userName,
1329                                                      MAX_USERNAME_SIZE) == 0) {
1330                                                         read_unlock(&GlobalSMBSeslock);
1331                                                         /* matched smb session
1332                                                         (user name */
1333                                                         return tcon;
1334                                                 }
1335                                         }
1336                                 }
1337                         }
1338                 }
1339         }
1340         read_unlock(&GlobalSMBSeslock);
1341         return NULL;
1342 }
1343
1344 int
1345 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1346                     const char *old_path, const struct nls_table *nls_codepage,
1347                     int remap)
1348 {
1349         unsigned char *referrals = NULL;
1350         unsigned int num_referrals;
1351         int rc = 0;
1352
1353         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage,
1354                         &num_referrals, &referrals, remap);
1355
1356         /* BB Add in code to: if valid refrl, if not ip address contact
1357                 the helper that resolves tcp names, mount to it, try to
1358                 tcon to it unmount it if fail */
1359
1360         kfree(referrals);
1361
1362         return rc;
1363 }
1364
1365 int
1366 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
1367                         const char *old_path, const struct nls_table *nls_codepage,
1368                         unsigned int *pnum_referrals,
1369                         unsigned char ** preferrals, int remap)
1370 {
1371         char *temp_unc;
1372         int rc = 0;
1373
1374         *pnum_referrals = 0;
1375
1376         if (pSesInfo->ipc_tid == 0) {
1377                 temp_unc = kmalloc(2 /* for slashes */ +
1378                         strnlen(pSesInfo->serverName,SERVER_NAME_LEN_WITH_NULL * 2)
1379                                  + 1 + 4 /* slash IPC$ */  + 2,
1380                                 GFP_KERNEL);
1381                 if (temp_unc == NULL)
1382                         return -ENOMEM;
1383                 temp_unc[0] = '\\';
1384                 temp_unc[1] = '\\';
1385                 strcpy(temp_unc + 2, pSesInfo->serverName);
1386                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
1387                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
1388                 cFYI(1,
1389                      ("CIFS Tcon rc = %d ipc_tid = %d", rc,pSesInfo->ipc_tid));
1390                 kfree(temp_unc);
1391         }
1392         if (rc == 0)
1393                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
1394                                      pnum_referrals, nls_codepage, remap);
1395
1396         return rc;
1397 }
1398
1399 /* See RFC1001 section 14 on representation of Netbios names */
1400 static void rfc1002mangle(char * target,char * source, unsigned int length)
1401 {
1402         unsigned int i,j;
1403
1404         for(i=0,j=0;i<(length);i++) {
1405                 /* mask a nibble at a time and encode */
1406                 target[j] = 'A' + (0x0F & (source[i] >> 4));
1407                 target[j+1] = 'A' + (0x0F & source[i]);
1408                 j+=2;
1409         }
1410
1411 }
1412
1413
1414 static int
1415 ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
1416              char * netbios_name, char * target_name)
1417 {
1418         int rc = 0;
1419         int connected = 0;
1420         __be16 orig_port = 0;
1421
1422         if(*csocket == NULL) {
1423                 rc = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, csocket);
1424                 if (rc < 0) {
1425                         cERROR(1, ("Error %d creating socket",rc));
1426                         *csocket = NULL;
1427                         return rc;
1428                 } else {
1429                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1430                         cFYI(1,("Socket created"));
1431                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1432                 }
1433         }
1434
1435         psin_server->sin_family = AF_INET;
1436         if(psin_server->sin_port) { /* user overrode default port */
1437                 rc = (*csocket)->ops->connect(*csocket,
1438                                 (struct sockaddr *) psin_server,
1439                                 sizeof (struct sockaddr_in),0);
1440                 if (rc >= 0)
1441                         connected = 1;
1442         }
1443
1444         if(!connected) {
1445                 /* save original port so we can retry user specified port
1446                         later if fall back ports fail this time  */
1447                 orig_port = psin_server->sin_port;
1448
1449                 /* do not retry on the same port we just failed on */
1450                 if(psin_server->sin_port != htons(CIFS_PORT)) {
1451                         psin_server->sin_port = htons(CIFS_PORT);
1452
1453                         rc = (*csocket)->ops->connect(*csocket,
1454                                         (struct sockaddr *) psin_server,
1455                                         sizeof (struct sockaddr_in),0);
1456                         if (rc >= 0)
1457                                 connected = 1;
1458                 }
1459         }
1460         if (!connected) {
1461                 psin_server->sin_port = htons(RFC1001_PORT);
1462                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1463                                               psin_server, sizeof (struct sockaddr_in),0);
1464                 if (rc >= 0)
1465                         connected = 1;
1466         }
1467
1468         /* give up here - unless we want to retry on different
1469                 protocol families some day */
1470         if (!connected) {
1471                 if(orig_port)
1472                         psin_server->sin_port = orig_port;
1473                 cFYI(1,("Error %d connecting to server via ipv4",rc));
1474                 sock_release(*csocket);
1475                 *csocket = NULL;
1476                 return rc;
1477         }
1478         /* Eventually check for other socket options to change from
1479                 the default. sock_setsockopt not used because it expects
1480                 user space buffer */
1481          cFYI(1,("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",(*csocket)->sk->sk_sndbuf,
1482                  (*csocket)->sk->sk_rcvbuf, (*csocket)->sk->sk_rcvtimeo));
1483         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1484         /* make the bufsizes depend on wsize/rsize and max requests */
1485         if((*csocket)->sk->sk_sndbuf < (200 * 1024))
1486                 (*csocket)->sk->sk_sndbuf = 200 * 1024;
1487         if((*csocket)->sk->sk_rcvbuf < (140 * 1024))
1488                 (*csocket)->sk->sk_rcvbuf = 140 * 1024;
1489
1490         /* send RFC1001 sessinit */
1491         if(psin_server->sin_port == htons(RFC1001_PORT)) {
1492                 /* some servers require RFC1001 sessinit before sending
1493                 negprot - BB check reconnection in case where second
1494                 sessinit is sent but no second negprot */
1495                 struct rfc1002_session_packet * ses_init_buf;
1496                 struct smb_hdr * smb_buf;
1497                 ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
1498                 if(ses_init_buf) {
1499                         ses_init_buf->trailer.session_req.called_len = 32;
1500                         if(target_name && (target_name[0] != 0)) {
1501                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1502                                         target_name, 16);
1503                         } else {
1504                                 rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
1505                                         DEFAULT_CIFS_CALLED_NAME,16);
1506                         }
1507
1508                         ses_init_buf->trailer.session_req.calling_len = 32;
1509                         /* calling name ends in null (byte 16) from old smb
1510                         convention. */
1511                         if(netbios_name && (netbios_name[0] !=0)) {
1512                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1513                                         netbios_name,16);
1514                         } else {
1515                                 rfc1002mangle(ses_init_buf->trailer.session_req.calling_name,
1516                                         "LINUX_CIFS_CLNT",16);
1517                         }
1518                         ses_init_buf->trailer.session_req.scope1 = 0;
1519                         ses_init_buf->trailer.session_req.scope2 = 0;
1520                         smb_buf = (struct smb_hdr *)ses_init_buf;
1521                         /* sizeof RFC1002_SESSION_REQUEST with no scope */
1522                         smb_buf->smb_buf_length = 0x81000044;
1523                         rc = smb_send(*csocket, smb_buf, 0x44,
1524                                 (struct sockaddr *)psin_server);
1525                         kfree(ses_init_buf);
1526                         msleep(1); /* RFC1001 layer in at least one server
1527                                       requires very short break before negprot
1528                                       presumably because not expecting negprot
1529                                       to follow so fast.  This is a simple
1530                                       solution that works without
1531                                       complicating the code and causes no
1532                                       significant slowing down on mount
1533                                       for everyone else */
1534                 }
1535                 /* else the negprot may still work without this
1536                 even though malloc failed */
1537
1538         }
1539
1540         return rc;
1541 }
1542
1543 static int
1544 ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
1545 {
1546         int rc = 0;
1547         int connected = 0;
1548         __be16 orig_port = 0;
1549
1550         if(*csocket == NULL) {
1551                 rc = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, csocket);
1552                 if (rc < 0) {
1553                         cERROR(1, ("Error %d creating ipv6 socket",rc));
1554                         *csocket = NULL;
1555                         return rc;
1556                 } else {
1557                 /* BB other socket options to set KEEPALIVE, NODELAY? */
1558                          cFYI(1,("ipv6 Socket created"));
1559                         (*csocket)->sk->sk_allocation = GFP_NOFS;
1560                 }
1561         }
1562
1563         psin_server->sin6_family = AF_INET6;
1564
1565         if(psin_server->sin6_port) { /* user overrode default port */
1566                 rc = (*csocket)->ops->connect(*csocket,
1567                                 (struct sockaddr *) psin_server,
1568                                 sizeof (struct sockaddr_in6),0);
1569                 if (rc >= 0)
1570                         connected = 1;
1571         }
1572
1573         if(!connected) {
1574                 /* save original port so we can retry user specified port
1575                         later if fall back ports fail this time  */
1576
1577                 orig_port = psin_server->sin6_port;
1578                 /* do not retry on the same port we just failed on */
1579                 if(psin_server->sin6_port != htons(CIFS_PORT)) {
1580                         psin_server->sin6_port = htons(CIFS_PORT);
1581
1582                         rc = (*csocket)->ops->connect(*csocket,
1583                                         (struct sockaddr *) psin_server,
1584                                         sizeof (struct sockaddr_in6),0);
1585                         if (rc >= 0)
1586                                 connected = 1;
1587                 }
1588         }
1589         if (!connected) {
1590                 psin_server->sin6_port = htons(RFC1001_PORT);
1591                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
1592                                          psin_server, sizeof (struct sockaddr_in6),0);
1593                 if (rc >= 0)
1594                         connected = 1;
1595         }
1596
1597         /* give up here - unless we want to retry on different
1598                 protocol families some day */
1599         if (!connected) {
1600                 if(orig_port)
1601                         psin_server->sin6_port = orig_port;
1602                 cFYI(1,("Error %d connecting to server via ipv6",rc));
1603                 sock_release(*csocket);
1604                 *csocket = NULL;
1605                 return rc;
1606         }
1607         /* Eventually check for other socket options to change from
1608                 the default. sock_setsockopt not used because it expects
1609                 user space buffer */
1610         (*csocket)->sk->sk_rcvtimeo = 7 * HZ;
1611
1612         return rc;
1613 }
1614
1615 void reset_cifs_unix_caps(int xid, struct cifsTconInfo * tcon,
1616                           struct super_block * sb, struct smb_vol * vol_info)
1617 {
1618         /* if we are reconnecting then should we check to see if
1619          * any requested capabilities changed locally e.g. via
1620          * remount but we can not do much about it here
1621          * if they have (even if we could detect it by the following)
1622          * Perhaps we could add a backpointer to array of sb from tcon
1623          * or if we change to make all sb to same share the same
1624          * sb as NFS - then we only have one backpointer to sb.
1625          * What if we wanted to mount the server share twice once with
1626          * and once without posixacls or posix paths? */
1627         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1628
1629
1630         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
1631                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
1632
1633                 /* check for reconnect case in which we do not
1634                    want to change the mount behavior if we can avoid it */
1635                 if(vol_info == NULL) {
1636                         /* turn off POSIX ACL and PATHNAMES if not set
1637                            originally at mount time */
1638                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
1639                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1640                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0)
1641                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1642
1643
1644
1645
1646                 }
1647
1648                 cap &= CIFS_UNIX_CAP_MASK;
1649                 if(vol_info && vol_info->no_psx_acl)
1650                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
1651                 else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
1652                         cFYI(1,("negotiated posix acl support"));
1653                         if(sb)
1654                                 sb->s_flags |= MS_POSIXACL;
1655                 }
1656
1657                 if(vol_info && vol_info->posix_paths == 0)
1658                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
1659                 else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
1660                         cFYI(1,("negotiate posix pathnames"));
1661                         if(sb)
1662                                 CIFS_SB(sb)->mnt_cifs_flags |=
1663                                         CIFS_MOUNT_POSIX_PATHS;
1664                 }
1665
1666                 /* We might be setting the path sep back to a different
1667                 form if we are reconnecting and the server switched its
1668                 posix path capability for this share */
1669                 if(CIFS_SB(sb)->prepathlen > 0)
1670                         CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
1671
1672                 cFYI(1,("Negotiate caps 0x%x",(int)cap));
1673 #ifdef CONFIG_CIFS_DEBUG2
1674                 if(cap & CIFS_UNIX_FCNTL_CAP)
1675                         cFYI(1,("FCNTL cap"));
1676                 if(cap & CIFS_UNIX_EXTATTR_CAP)
1677                         cFYI(1,("EXTATTR cap"));
1678                 if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
1679                         cFYI(1,("POSIX path cap"));
1680                 if(cap & CIFS_UNIX_XATTR_CAP)
1681                         cFYI(1,("XATTR cap"));
1682                 if(cap & CIFS_UNIX_POSIX_ACL_CAP)
1683                         cFYI(1,("POSIX ACL cap"));
1684 #endif /* CIFS_DEBUG2 */
1685                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
1686                         cFYI(1,("setting capabilities failed"));
1687                 }
1688         }
1689 }
1690
1691 int
1692 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
1693            char *mount_data, const char *devname)
1694 {
1695         int rc = 0;
1696         int xid;
1697         int address_type = AF_INET;
1698         struct socket *csocket = NULL;
1699         struct sockaddr_in sin_server;
1700         struct sockaddr_in6 sin_server6;
1701         struct smb_vol volume_info;
1702         struct cifsSesInfo *pSesInfo = NULL;
1703         struct cifsSesInfo *existingCifsSes = NULL;
1704         struct cifsTconInfo *tcon = NULL;
1705         struct TCP_Server_Info *srvTcp = NULL;
1706
1707         xid = GetXid();
1708
1709 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
1710
1711         memset(&volume_info,0,sizeof(struct smb_vol));
1712         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
1713                 kfree(volume_info.UNC);
1714                 kfree(volume_info.password);
1715                 kfree(volume_info.prepath);
1716                 FreeXid(xid);
1717                 return -EINVAL;
1718         }
1719
1720         if (volume_info.username) {
1721                 /* BB fixme parse for domain name here */
1722                 cFYI(1, ("Username: %s ", volume_info.username));
1723
1724         } else if (volume_info.nullauth) {
1725                 cFYI(1,("null user"));
1726         } else {
1727                 cifserror("No username specified");
1728         /* In userspace mount helper we can get user name from alternate
1729            locations such as env variables and files on disk */
1730                 kfree(volume_info.UNC);
1731                 kfree(volume_info.password);
1732                 kfree(volume_info.prepath);
1733                 FreeXid(xid);
1734                 return -EINVAL;
1735         }
1736
1737         if (volume_info.UNCip && volume_info.UNC) {
1738                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,&sin_server.sin_addr.s_addr);
1739
1740                 if(rc <= 0) {
1741                         /* not ipv4 address, try ipv6 */
1742                         rc = cifs_inet_pton(AF_INET6,volume_info.UNCip,&sin_server6.sin6_addr.in6_u);
1743                         if(rc > 0)
1744                                 address_type = AF_INET6;
1745                 } else {
1746                         address_type = AF_INET;
1747                 }
1748
1749                 if(rc <= 0) {
1750                         /* we failed translating address */
1751                         kfree(volume_info.UNC);
1752                         kfree(volume_info.password);
1753                         kfree(volume_info.prepath);
1754                         FreeXid(xid);
1755                         return -EINVAL;
1756                 }
1757
1758                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
1759                 /* success */
1760                 rc = 0;
1761         } else if (volume_info.UNCip){
1762                 /* BB using ip addr as server name connect to the DFS root below */
1763                 cERROR(1,("Connecting to DFS root not implemented yet"));
1764                 kfree(volume_info.UNC);
1765                 kfree(volume_info.password);
1766                 kfree(volume_info.prepath);
1767                 FreeXid(xid);
1768                 return -EINVAL;
1769         } else /* which servers DFS root would we conect to */ {
1770                 cERROR(1,
1771                        ("CIFS mount error: No UNC path (e.g. -o unc=//192.168.1.100/public) specified"));
1772                 kfree(volume_info.UNC);
1773                 kfree(volume_info.password);
1774                 kfree(volume_info.prepath);
1775                 FreeXid(xid);
1776                 return -EINVAL;
1777         }
1778
1779         /* this is needed for ASCII cp to Unicode converts */
1780         if(volume_info.iocharset == NULL) {
1781                 cifs_sb->local_nls = load_nls_default();
1782         /* load_nls_default can not return null */
1783         } else {
1784                 cifs_sb->local_nls = load_nls(volume_info.iocharset);
1785                 if(cifs_sb->local_nls == NULL) {
1786                         cERROR(1,("CIFS mount error: iocharset %s not found",volume_info.iocharset));
1787                         kfree(volume_info.UNC);
1788                         kfree(volume_info.password);
1789                         kfree(volume_info.prepath);
1790                         FreeXid(xid);
1791                         return -ELIBACC;
1792                 }
1793         }
1794
1795         if(address_type == AF_INET)
1796                 existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
1797                         NULL /* no ipv6 addr */,
1798                         volume_info.username, &srvTcp);
1799         else if(address_type == AF_INET6) {
1800                 cFYI(1,("looking for ipv6 address"));
1801                 existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
1802                         &sin_server6.sin6_addr,
1803                         volume_info.username, &srvTcp);
1804         } else {
1805                 kfree(volume_info.UNC);
1806                 kfree(volume_info.password);
1807                 kfree(volume_info.prepath);
1808                 FreeXid(xid);
1809                 return -EINVAL;
1810         }
1811
1812
1813         if (srvTcp) {
1814                 cFYI(1, ("Existing tcp session with server found"));
1815         } else {        /* create socket */
1816                 if(volume_info.port)
1817                         sin_server.sin_port = htons(volume_info.port);
1818                 else
1819                         sin_server.sin_port = 0;
1820                 if (address_type == AF_INET6) {
1821                         cFYI(1,("attempting ipv6 connect"));
1822                         /* BB should we allow ipv6 on port 139? */
1823                         /* other OS never observed in Wild doing 139 with v6 */
1824                         rc = ipv6_connect(&sin_server6,&csocket);
1825                 } else
1826                         rc = ipv4_connect(&sin_server,&csocket,
1827                                   volume_info.source_rfc1001_name,
1828                                   volume_info.target_rfc1001_name);
1829                 if (rc < 0) {
1830                         cERROR(1,
1831                                ("Error connecting to IPv4 socket. Aborting operation"));
1832                         if(csocket != NULL)
1833                                 sock_release(csocket);
1834                         kfree(volume_info.UNC);
1835                         kfree(volume_info.password);
1836                         kfree(volume_info.prepath);
1837                         FreeXid(xid);
1838                         return rc;
1839                 }
1840
1841                 srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
1842                 if (srvTcp == NULL) {
1843                         rc = -ENOMEM;
1844                         sock_release(csocket);
1845                         kfree(volume_info.UNC);
1846                         kfree(volume_info.password);
1847                         kfree(volume_info.prepath);
1848                         FreeXid(xid);
1849                         return rc;
1850                 } else {
1851                         memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
1852                         memcpy(&srvTcp->addr.sockAddr, &sin_server, sizeof (struct sockaddr_in));
1853                         atomic_set(&srvTcp->inFlight,0);
1854                         /* BB Add code for ipv6 case too */
1855                         srvTcp->ssocket = csocket;
1856                         srvTcp->protocolType = IPV4;
1857                         init_waitqueue_head(&srvTcp->response_q);
1858                         init_waitqueue_head(&srvTcp->request_q);
1859                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
1860                         /* at this point we are the only ones with the pointer
1861                         to the struct since the kernel thread not created yet
1862                         so no need to spinlock this init of tcpStatus */
1863                         srvTcp->tcpStatus = CifsNew;
1864                         init_MUTEX(&srvTcp->tcpSem);
1865                         srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
1866                         if( IS_ERR(srvTcp->tsk) ) {
1867                                 rc = PTR_ERR(srvTcp->tsk);
1868                                 cERROR(1,("error %d create cifsd thread", rc));
1869                                 srvTcp->tsk = NULL;
1870                                 sock_release(csocket);
1871                                 kfree(volume_info.UNC);
1872                                 kfree(volume_info.password);
1873                                 kfree(volume_info.prepath);
1874                                 FreeXid(xid);
1875                                 return rc;
1876                         }
1877                         wait_for_completion(&cifsd_complete);
1878                         rc = 0;
1879                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
1880                         memcpy(srvTcp->server_RFC1001_name, volume_info.target_rfc1001_name,16);
1881                         srvTcp->sequence_number = 0;
1882                 }
1883         }
1884
1885         if (existingCifsSes) {
1886                 pSesInfo = existingCifsSes;
1887                 cFYI(1, ("Existing smb sess found"));
1888                 kfree(volume_info.password);
1889                 /* volume_info.UNC freed at end of function */
1890         } else if (!rc) {
1891                 cFYI(1, ("Existing smb sess not found"));
1892                 pSesInfo = sesInfoAlloc();
1893                 if (pSesInfo == NULL)
1894                         rc = -ENOMEM;
1895                 else {
1896                         pSesInfo->server = srvTcp;
1897                         sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
1898                                 NIPQUAD(sin_server.sin_addr.s_addr));
1899                 }
1900
1901                 if (!rc){
1902                         /* volume_info.password freed at unmount */
1903                         if (volume_info.password)
1904                                 pSesInfo->password = volume_info.password;
1905                         if (volume_info.username)
1906                                 strncpy(pSesInfo->userName,
1907                                         volume_info.username,MAX_USERNAME_SIZE);
1908                         if (volume_info.domainname) {
1909                                 int len = strlen(volume_info.domainname);
1910                                 pSesInfo->domainName =
1911                                         kmalloc(len + 1, GFP_KERNEL);
1912                                 if(pSesInfo->domainName)
1913                                         strcpy(pSesInfo->domainName,
1914                                                 volume_info.domainname);
1915                         }
1916                         pSesInfo->linux_uid = volume_info.linux_uid;
1917                         pSesInfo->overrideSecFlg = volume_info.secFlg;
1918                         down(&pSesInfo->sesSem);
1919                         /* BB FIXME need to pass vol->secFlgs BB */
1920                         rc = cifs_setup_session(xid,pSesInfo, cifs_sb->local_nls);
1921                         up(&pSesInfo->sesSem);
1922                         if(!rc)
1923                                 atomic_inc(&srvTcp->socketUseCount);
1924                 } else
1925                         kfree(volume_info.password);
1926         }
1927
1928         /* search for existing tcon to this server share */
1929         if (!rc) {
1930                 if(volume_info.rsize > CIFSMaxBufSize) {
1931                         cERROR(1,("rsize %d too large, using MaxBufSize",
1932                                 volume_info.rsize));
1933                         cifs_sb->rsize = CIFSMaxBufSize;
1934                 } else if((volume_info.rsize) && (volume_info.rsize <= CIFSMaxBufSize))
1935                         cifs_sb->rsize = volume_info.rsize;
1936                 else /* default */
1937                         cifs_sb->rsize = CIFSMaxBufSize;
1938
1939                 if(volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
1940                         cERROR(1,("wsize %d too large using 4096 instead",
1941                                   volume_info.wsize));
1942                         cifs_sb->wsize = 4096;
1943                 } else if(volume_info.wsize)
1944                         cifs_sb->wsize = volume_info.wsize;
1945                 else
1946                         cifs_sb->wsize =
1947                                 min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
1948                                         127*1024);
1949                         /* old default of CIFSMaxBufSize was too small now
1950                            that SMB Write2 can send multiple pages in kvec.
1951                            RFC1001 does not describe what happens when frame
1952                            bigger than 128K is sent so use that as max in
1953                            conjunction with 52K kvec constraint on arch with 4K
1954                            page size  */
1955
1956                 if(cifs_sb->rsize < 2048) {
1957                         cifs_sb->rsize = 2048;
1958                         /* Windows ME may prefer this */
1959                         cFYI(1,("readsize set to minimum 2048"));
1960                 }
1961                 /* calculate prepath */
1962                 cifs_sb->prepath = volume_info.prepath;
1963                 if(cifs_sb->prepath) {
1964                         cifs_sb->prepathlen = strlen(cifs_sb->prepath);
1965                         cifs_sb->prepath[0] = CIFS_DIR_SEP(cifs_sb);
1966                         volume_info.prepath = NULL;
1967                 } else
1968                         cifs_sb->prepathlen = 0;
1969                 cifs_sb->mnt_uid = volume_info.linux_uid;
1970                 cifs_sb->mnt_gid = volume_info.linux_gid;
1971                 cifs_sb->mnt_file_mode = volume_info.file_mode;
1972                 cifs_sb->mnt_dir_mode = volume_info.dir_mode;
1973                 cFYI(1,("file mode: 0x%x  dir mode: 0x%x",
1974                         cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
1975
1976                 if(volume_info.noperm)
1977                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
1978                 if(volume_info.setuids)
1979                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
1980                 if(volume_info.server_ino)
1981                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
1982                 if(volume_info.remap)
1983                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
1984                 if(volume_info.no_xattr)
1985                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
1986                 if(volume_info.sfu_emul)
1987                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
1988                 if(volume_info.nobrl)
1989                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
1990                 if(volume_info.cifs_acl)
1991                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
1992
1993                 if(volume_info.direct_io) {
1994                         cFYI(1,("mounting share using direct i/o"));
1995                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
1996                 }
1997
1998                 tcon =
1999                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
2000                              volume_info.username);
2001                 if (tcon) {
2002                         cFYI(1, ("Found match on UNC path"));
2003                         /* we can have only one retry value for a connection
2004                            to a share so for resources mounted more than once
2005                            to the same server share the last value passed in
2006                            for the retry flag is used */
2007                         tcon->retry = volume_info.retry;
2008                         tcon->nocase = volume_info.nocase;
2009                 } else {
2010                         tcon = tconInfoAlloc();
2011                         if (tcon == NULL)
2012                                 rc = -ENOMEM;
2013                         else {
2014                                 /* check for null share name ie connecting to
2015                                  * dfs root */
2016
2017                                 /* BB check if this works for exactly length
2018                                  * three strings */
2019                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
2020                                     && (strchr(volume_info.UNC + 3, '/') ==
2021                                         NULL)) {
2022                                         rc = connect_to_dfs_path(xid, pSesInfo,
2023                                                 "", cifs_sb->local_nls,
2024                                                 cifs_sb->mnt_cifs_flags &
2025                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2026                                         kfree(volume_info.UNC);
2027                                         FreeXid(xid);
2028                                         return -ENODEV;
2029                                 } else {
2030                                         /* BB Do we need to wrap sesSem around
2031                                          * this TCon call and Unix SetFS as
2032                                          * we do on SessSetup and reconnect? */
2033                                         rc = CIFSTCon(xid, pSesInfo,
2034                                                 volume_info.UNC,
2035                                                 tcon, cifs_sb->local_nls);
2036                                         cFYI(1, ("CIFS Tcon rc = %d", rc));
2037                                 }
2038                                 if (!rc) {
2039                                         atomic_inc(&pSesInfo->inUse);
2040                                         tcon->retry = volume_info.retry;
2041                                         tcon->nocase = volume_info.nocase;
2042                                 }
2043                         }
2044                 }
2045         }
2046         if(pSesInfo) {
2047                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
2048                         sb->s_maxbytes = (u64) 1 << 63;
2049                 } else
2050                         sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
2051         }
2052
2053         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2054         sb->s_time_gran = 100;
2055
2056 /* on error free sesinfo and tcon struct if needed */
2057         if (rc) {
2058                 /* if session setup failed, use count is zero but
2059                 we still need to free cifsd thread */
2060                 if(atomic_read(&srvTcp->socketUseCount) == 0) {
2061                         spin_lock(&GlobalMid_Lock);
2062                         srvTcp->tcpStatus = CifsExiting;
2063                         spin_unlock(&GlobalMid_Lock);
2064                         if(srvTcp->tsk) {
2065                                 send_sig(SIGKILL,srvTcp->tsk,1);
2066                                 kthread_stop(srvTcp->tsk);
2067                         }
2068                 }
2069                  /* If find_unc succeeded then rc == 0 so we can not end */
2070                 if (tcon)  /* up accidently freeing someone elses tcon struct */
2071                         tconInfoFree(tcon);
2072                 if (existingCifsSes == NULL) {
2073                         if (pSesInfo) {
2074                                 if ((pSesInfo->server) &&
2075                                     (pSesInfo->status == CifsGood)) {
2076                                         int temp_rc;
2077                                         temp_rc = CIFSSMBLogoff(xid, pSesInfo);
2078                                         /* if the socketUseCount is now zero */
2079                                         if((temp_rc == -ESHUTDOWN) &&
2080                                            (pSesInfo->server) && (pSesInfo->server->tsk)) {
2081                                                 send_sig(SIGKILL,pSesInfo->server->tsk,1);
2082                                                 kthread_stop(pSesInfo->server->tsk);
2083                                         }
2084                                 } else
2085                                         cFYI(1, ("No session or bad tcon"));
2086                                 sesInfoFree(pSesInfo);
2087                                 /* pSesInfo = NULL; */
2088                         }
2089                 }
2090         } else {
2091                 atomic_inc(&tcon->useCount);
2092                 cifs_sb->tcon = tcon;
2093                 tcon->ses = pSesInfo;
2094
2095                 /* do not care if following two calls succeed - informational */
2096                 CIFSSMBQFSDeviceInfo(xid, tcon);
2097                 CIFSSMBQFSAttributeInfo(xid, tcon);
2098
2099                 /* tell server which Unix caps we support */
2100                 if (tcon->ses->capabilities & CAP_UNIX)
2101                         reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
2102
2103                 if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2104                         cifs_sb->wsize = min(cifs_sb->wsize,
2105                                              (tcon->ses->server->maxBuf -
2106                                               MAX_CIFS_HDR_SIZE));
2107                 if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2108                         cifs_sb->rsize = min(cifs_sb->rsize,
2109                                              (tcon->ses->server->maxBuf -
2110                                               MAX_CIFS_HDR_SIZE));
2111         }
2112
2113         /* volume_info.password is freed above when existing session found
2114         (in which case it is not needed anymore) but when new sesion is created
2115         the password ptr is put in the new session structure (in which case the
2116         password will be freed at unmount time) */
2117         kfree(volume_info.UNC);
2118         kfree(volume_info.prepath);
2119         FreeXid(xid);
2120         return rc;
2121 }
2122
2123 static int
2124 CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2125               char session_key[CIFS_SESS_KEY_SIZE],
2126               const struct nls_table *nls_codepage)
2127 {
2128         struct smb_hdr *smb_buffer;
2129         struct smb_hdr *smb_buffer_response;
2130         SESSION_SETUP_ANDX *pSMB;
2131         SESSION_SETUP_ANDX *pSMBr;
2132         char *bcc_ptr;
2133         char *user;
2134         char *domain;
2135         int rc = 0;
2136         int remaining_words = 0;
2137         int bytes_returned = 0;
2138         int len;
2139         __u32 capabilities;
2140         __u16 count;
2141
2142         cFYI(1, ("In sesssetup"));
2143         if(ses == NULL)
2144                 return -EINVAL;
2145         user = ses->userName;
2146         domain = ses->domainName;
2147         smb_buffer = cifs_buf_get();
2148         if (smb_buffer == NULL) {
2149                 return -ENOMEM;
2150         }
2151         smb_buffer_response = smb_buffer;
2152         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2153
2154         /* send SMBsessionSetup here */
2155         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2156                         NULL /* no tCon exists yet */ , 13 /* wct */ );
2157
2158         smb_buffer->Mid = GetNextMid(ses->server);
2159         pSMB->req_no_secext.AndXCommand = 0xFF;
2160         pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2161         pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2162
2163         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2164                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2165
2166         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2167                 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
2168         if (ses->capabilities & CAP_UNICODE) {
2169                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2170                 capabilities |= CAP_UNICODE;
2171         }
2172         if (ses->capabilities & CAP_STATUS32) {
2173                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2174                 capabilities |= CAP_STATUS32;
2175         }
2176         if (ses->capabilities & CAP_DFS) {
2177                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2178                 capabilities |= CAP_DFS;
2179         }
2180         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
2181
2182         pSMB->req_no_secext.CaseInsensitivePasswordLength =
2183                 cpu_to_le16(CIFS_SESS_KEY_SIZE);
2184
2185         pSMB->req_no_secext.CaseSensitivePasswordLength =
2186             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2187         bcc_ptr = pByteArea(smb_buffer);
2188         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2189         bcc_ptr += CIFS_SESS_KEY_SIZE;
2190         memcpy(bcc_ptr, (char *) session_key, CIFS_SESS_KEY_SIZE);
2191         bcc_ptr += CIFS_SESS_KEY_SIZE;
2192
2193         if (ses->capabilities & CAP_UNICODE) {
2194                 if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */
2195                         *bcc_ptr = 0;
2196                         bcc_ptr++;
2197                 }
2198                 if(user == NULL)
2199                         bytes_returned = 0; /* skip null user */
2200                 else
2201                         bytes_returned =
2202                                 cifs_strtoUCS((__le16 *) bcc_ptr, user, 100,
2203                                         nls_codepage);
2204                 /* convert number of 16 bit words to bytes */
2205                 bcc_ptr += 2 * bytes_returned;
2206                 bcc_ptr += 2;   /* trailing null */
2207                 if (domain == NULL)
2208                         bytes_returned =
2209                             cifs_strtoUCS((__le16 *) bcc_ptr,
2210                                           "CIFS_LINUX_DOM", 32, nls_codepage);
2211                 else
2212                         bytes_returned =
2213                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2214                                           nls_codepage);
2215                 bcc_ptr += 2 * bytes_returned;
2216                 bcc_ptr += 2;
2217                 bytes_returned =
2218                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2219                                   32, nls_codepage);
2220                 bcc_ptr += 2 * bytes_returned;
2221                 bytes_returned =
2222                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release,
2223                                   32, nls_codepage);
2224                 bcc_ptr += 2 * bytes_returned;
2225                 bcc_ptr += 2;
2226                 bytes_returned =
2227                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2228                                   64, nls_codepage);
2229                 bcc_ptr += 2 * bytes_returned;
2230                 bcc_ptr += 2;
2231         } else {
2232                 if(user != NULL) {
2233                     strncpy(bcc_ptr, user, 200);
2234                     bcc_ptr += strnlen(user, 200);
2235                 }
2236                 *bcc_ptr = 0;
2237                 bcc_ptr++;
2238                 if (domain == NULL) {
2239                         strcpy(bcc_ptr, "CIFS_LINUX_DOM");
2240                         bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;
2241                 } else {
2242                         strncpy(bcc_ptr, domain, 64);
2243                         bcc_ptr += strnlen(domain, 64);
2244                         *bcc_ptr = 0;
2245                         bcc_ptr++;
2246                 }
2247                 strcpy(bcc_ptr, "Linux version ");
2248                 bcc_ptr += strlen("Linux version ");
2249                 strcpy(bcc_ptr, utsname()->release);
2250                 bcc_ptr += strlen(utsname()->release) + 1;
2251                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2252                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2253         }
2254         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2255         smb_buffer->smb_buf_length += count;
2256         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
2257
2258         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2259                          &bytes_returned, 1);
2260         if (rc) {
2261 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
2262         } else if ((smb_buffer_response->WordCount == 3)
2263                    || (smb_buffer_response->WordCount == 4)) {
2264                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2265                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2266                 if (action & GUEST_LOGIN)
2267                         cFYI(1, (" Guest login"));      /* do we want to mark SesInfo struct ? */
2268                 ses->Suid = smb_buffer_response->Uid;   /* UID left in wire format (le) */
2269                 cFYI(1, ("UID = %d ", ses->Suid));
2270          /* response can have either 3 or 4 word count - Samba sends 3 */
2271                 bcc_ptr = pByteArea(smb_buffer_response);
2272                 if ((pSMBr->resp.hdr.WordCount == 3)
2273                     || ((pSMBr->resp.hdr.WordCount == 4)
2274                         && (blob_len < pSMBr->resp.ByteCount))) {
2275                         if (pSMBr->resp.hdr.WordCount == 4)
2276                                 bcc_ptr += blob_len;
2277
2278                         if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2279                                 if ((long) (bcc_ptr) % 2) {
2280                                         remaining_words =
2281                                             (BCC(smb_buffer_response) - 1) /2;
2282                                         bcc_ptr++;      /* Unicode strings must be word aligned */
2283                                 } else {
2284                                         remaining_words =
2285                                                 BCC(smb_buffer_response) / 2;
2286                                 }
2287                                 len =
2288                                     UniStrnlen((wchar_t *) bcc_ptr,
2289                                                remaining_words - 1);
2290 /* We look for obvious messed up bcc or strings in response so we do not go off
2291    the end since (at least) WIN2K and Windows XP have a major bug in not null
2292    terminating last Unicode string in response  */
2293                                 if(ses->serverOS)
2294                                         kfree(ses->serverOS);
2295                                 ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
2296                                 if(ses->serverOS == NULL)
2297                                         goto sesssetup_nomem;
2298                                 cifs_strfromUCS_le(ses->serverOS,
2299                                            (__le16 *)bcc_ptr, len,nls_codepage);
2300                                 bcc_ptr += 2 * (len + 1);
2301                                 remaining_words -= len + 1;
2302                                 ses->serverOS[2 * len] = 0;
2303                                 ses->serverOS[1 + (2 * len)] = 0;
2304                                 if (remaining_words > 0) {
2305                                         len = UniStrnlen((wchar_t *)bcc_ptr,
2306                                                          remaining_words-1);
2307                                         kfree(ses->serverNOS);
2308                                         ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
2309                                         if(ses->serverNOS == NULL)
2310                                                 goto sesssetup_nomem;
2311                                         cifs_strfromUCS_le(ses->serverNOS,
2312                                                            (__le16 *)bcc_ptr,len,nls_codepage);
2313                                         bcc_ptr += 2 * (len + 1);
2314                                         ses->serverNOS[2 * len] = 0;
2315                                         ses->serverNOS[1 + (2 * len)] = 0;
2316                                         if(strncmp(ses->serverNOS,
2317                                                 "NT LAN Manager 4",16) == 0) {
2318                                                 cFYI(1,("NT4 server"));
2319                                                 ses->flags |= CIFS_SES_NT4;
2320                                         }
2321                                         remaining_words -= len + 1;
2322                                         if (remaining_words > 0) {
2323                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2324           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2325                                                 if(ses->serverDomain)
2326                                                         kfree(ses->serverDomain);
2327                                                 ses->serverDomain =
2328                                                     kzalloc(2*(len+1),GFP_KERNEL);
2329                                                 if(ses->serverDomain == NULL)
2330                                                         goto sesssetup_nomem;
2331                                                 cifs_strfromUCS_le(ses->serverDomain,
2332                                                      (__le16 *)bcc_ptr,len,nls_codepage);
2333                                                 bcc_ptr += 2 * (len + 1);
2334                                                 ses->serverDomain[2*len] = 0;
2335                                                 ses->serverDomain[1+(2*len)] = 0;
2336                                         } /* else no more room so create dummy domain string */
2337                                         else {
2338                                                 if(ses->serverDomain)
2339                                                         kfree(ses->serverDomain);
2340                                                 ses->serverDomain =
2341                                                         kzalloc(2, GFP_KERNEL);
2342                                         }
2343                                 } else {        /* no room so create dummy domain and NOS string */
2344                                         /* if these kcallocs fail not much we
2345                                            can do, but better to not fail the
2346                                            sesssetup itself */
2347                                         kfree(ses->serverDomain);
2348                                         ses->serverDomain =
2349                                             kzalloc(2, GFP_KERNEL);
2350                                         kfree(ses->serverNOS);
2351                                         ses->serverNOS =
2352                                             kzalloc(2, GFP_KERNEL);
2353                                 }
2354                         } else {        /* ASCII */
2355                                 len = strnlen(bcc_ptr, 1024);
2356                                 if (((long) bcc_ptr + len) - (long)
2357                                     pByteArea(smb_buffer_response)
2358                                             <= BCC(smb_buffer_response)) {
2359                                         kfree(ses->serverOS);
2360                                         ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
2361                                         if(ses->serverOS == NULL)
2362                                                 goto sesssetup_nomem;
2363                                         strncpy(ses->serverOS,bcc_ptr, len);
2364
2365                                         bcc_ptr += len;
2366                                         bcc_ptr[0] = 0; /* null terminate the string */
2367                                         bcc_ptr++;
2368
2369                                         len = strnlen(bcc_ptr, 1024);
2370                                         kfree(ses->serverNOS);
2371                                         ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
2372                                         if(ses->serverNOS == NULL)
2373                                                 goto sesssetup_nomem;
2374                                         strncpy(ses->serverNOS, bcc_ptr, len);
2375                                         bcc_ptr += len;
2376                                         bcc_ptr[0] = 0;
2377                                         bcc_ptr++;
2378
2379                                         len = strnlen(bcc_ptr, 1024);
2380                                         if(ses->serverDomain)
2381                                                 kfree(ses->serverDomain);
2382                                         ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
2383                                         if(ses->serverDomain == NULL)
2384                                                 goto sesssetup_nomem;
2385                                         strncpy(ses->serverDomain, bcc_ptr, len);
2386                                         bcc_ptr += len;
2387                                         bcc_ptr[0] = 0;
2388                                         bcc_ptr++;
2389                                 } else
2390                                         cFYI(1,
2391                                              ("Variable field of length %d extends beyond end of smb ",
2392                                               len));
2393                         }
2394                 } else {
2395                         cERROR(1,
2396                                (" Security Blob Length extends beyond end of SMB"));
2397                 }
2398         } else {
2399                 cERROR(1,
2400                        (" Invalid Word count %d: ",
2401                         smb_buffer_response->WordCount));
2402                 rc = -EIO;
2403         }
2404 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
2405                            since that could make reconnection harder, and
2406                            reconnection might be needed to free memory */
2407         if (smb_buffer)
2408                 cifs_buf_release(smb_buffer);
2409
2410         return rc;
2411 }
2412
2413 static int
2414 CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
2415                               struct cifsSesInfo *ses, int * pNTLMv2_flag,
2416                               const struct nls_table *nls_codepage)
2417 {
2418         struct smb_hdr *smb_buffer;
2419         struct smb_hdr *smb_buffer_response;
2420         SESSION_SETUP_ANDX *pSMB;
2421         SESSION_SETUP_ANDX *pSMBr;
2422         char *bcc_ptr;
2423         char *domain;
2424         int rc = 0;
2425         int remaining_words = 0;
2426         int bytes_returned = 0;
2427         int len;
2428         int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
2429         PNEGOTIATE_MESSAGE SecurityBlob;
2430         PCHALLENGE_MESSAGE SecurityBlob2;
2431         __u32 negotiate_flags, capabilities;
2432         __u16 count;
2433
2434         cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
2435         if(ses == NULL)
2436                 return -EINVAL;
2437         domain = ses->domainName;
2438         *pNTLMv2_flag = FALSE;
2439         smb_buffer = cifs_buf_get();
2440         if (smb_buffer == NULL) {
2441                 return -ENOMEM;
2442         }
2443         smb_buffer_response = smb_buffer;
2444         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2445         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2446
2447         /* send SMBsessionSetup here */
2448         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2449                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2450
2451         smb_buffer->Mid = GetNextMid(ses->server);
2452         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2453         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2454
2455         pSMB->req.AndXCommand = 0xFF;
2456         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2457         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2458
2459         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2460                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2461
2462         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2463             CAP_EXTENDED_SECURITY;
2464         if (ses->capabilities & CAP_UNICODE) {
2465                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2466                 capabilities |= CAP_UNICODE;
2467         }
2468         if (ses->capabilities & CAP_STATUS32) {
2469                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2470                 capabilities |= CAP_STATUS32;
2471         }
2472         if (ses->capabilities & CAP_DFS) {
2473                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2474                 capabilities |= CAP_DFS;
2475         }
2476         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2477
2478         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2479         SecurityBlob = (PNEGOTIATE_MESSAGE) bcc_ptr;
2480         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2481         SecurityBlob->MessageType = NtLmNegotiate;
2482         negotiate_flags =
2483             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
2484             NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
2485             NTLMSSP_NEGOTIATE_56 |
2486             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
2487         if(sign_CIFS_PDUs)
2488                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
2489 /*      if(ntlmv2_support)
2490                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;*/
2491         /* setup pointers to domain name and workstation name */
2492         bcc_ptr += SecurityBlobLength;
2493
2494         SecurityBlob->WorkstationName.Buffer = 0;
2495         SecurityBlob->WorkstationName.Length = 0;
2496         SecurityBlob->WorkstationName.MaximumLength = 0;
2497
2498         /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
2499         along with username on auth request (ie the response to challenge) */
2500         SecurityBlob->DomainName.Buffer = 0;
2501         SecurityBlob->DomainName.Length = 0;
2502         SecurityBlob->DomainName.MaximumLength = 0;
2503         if (ses->capabilities & CAP_UNICODE) {
2504                 if ((long) bcc_ptr % 2) {
2505                         *bcc_ptr = 0;
2506                         bcc_ptr++;
2507                 }
2508
2509                 bytes_returned =
2510                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2511                                   32, nls_codepage);
2512                 bcc_ptr += 2 * bytes_returned;
2513                 bytes_returned =
2514                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2515                                   nls_codepage);
2516                 bcc_ptr += 2 * bytes_returned;
2517                 bcc_ptr += 2;   /* null terminate Linux version */
2518                 bytes_returned =
2519                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2520                                   64, nls_codepage);
2521                 bcc_ptr += 2 * bytes_returned;
2522                 *(bcc_ptr + 1) = 0;
2523                 *(bcc_ptr + 2) = 0;
2524                 bcc_ptr += 2;   /* null terminate network opsys string */
2525                 *(bcc_ptr + 1) = 0;
2526                 *(bcc_ptr + 2) = 0;
2527                 bcc_ptr += 2;   /* null domain */
2528         } else {                /* ASCII */
2529                 strcpy(bcc_ptr, "Linux version ");
2530                 bcc_ptr += strlen("Linux version ");
2531                 strcpy(bcc_ptr, utsname()->release);
2532                 bcc_ptr += strlen(utsname()->release) + 1;
2533                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2534                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2535                 bcc_ptr++;      /* empty domain field */
2536                 *bcc_ptr = 0;
2537         }
2538         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2539         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2540         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2541         smb_buffer->smb_buf_length += count;
2542         pSMB->req.ByteCount = cpu_to_le16(count);
2543
2544         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2545                          &bytes_returned, 1);
2546
2547         if (smb_buffer_response->Status.CifsError ==
2548             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
2549                 rc = 0;
2550
2551         if (rc) {
2552 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2553         } else if ((smb_buffer_response->WordCount == 3)
2554                    || (smb_buffer_response->WordCount == 4)) {
2555                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2556                 __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2557
2558                 if (action & GUEST_LOGIN)
2559                         cFYI(1, (" Guest login"));
2560         /* Do we want to set anything in SesInfo struct when guest login? */
2561
2562                 bcc_ptr = pByteArea(smb_buffer_response);
2563         /* response can have either 3 or 4 word count - Samba sends 3 */
2564
2565                 SecurityBlob2 = (PCHALLENGE_MESSAGE) bcc_ptr;
2566                 if (SecurityBlob2->MessageType != NtLmChallenge) {
2567                         cFYI(1,
2568                              ("Unexpected NTLMSSP message type received %d",
2569                               SecurityBlob2->MessageType));
2570                 } else if (ses) {
2571                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */
2572                         cFYI(1, ("UID = %d", ses->Suid));
2573                         if ((pSMBr->resp.hdr.WordCount == 3)
2574                             || ((pSMBr->resp.hdr.WordCount == 4)
2575                                 && (blob_len <
2576                                     pSMBr->resp.ByteCount))) {
2577
2578                                 if (pSMBr->resp.hdr.WordCount == 4) {
2579                                         bcc_ptr += blob_len;
2580                                         cFYI(1, ("Security Blob Length %d",
2581                                               blob_len));
2582                                 }
2583
2584                                 cFYI(1, ("NTLMSSP Challenge rcvd"));
2585
2586                                 memcpy(ses->server->cryptKey,
2587                                        SecurityBlob2->Challenge,
2588                                        CIFS_CRYPTO_KEY_SIZE);
2589                                 if(SecurityBlob2->NegotiateFlags &
2590                                         cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
2591                                         *pNTLMv2_flag = TRUE;
2592
2593                                 if((SecurityBlob2->NegotiateFlags &
2594                                         cpu_to_le32(NTLMSSP_NEGOTIATE_ALWAYS_SIGN))
2595                                         || (sign_CIFS_PDUs > 1))
2596                                                 ses->server->secMode |=
2597                                                         SECMODE_SIGN_REQUIRED;
2598                                 if ((SecurityBlob2->NegotiateFlags &
2599                                         cpu_to_le32(NTLMSSP_NEGOTIATE_SIGN)) && (sign_CIFS_PDUs))
2600                                                 ses->server->secMode |=
2601                                                         SECMODE_SIGN_ENABLED;
2602
2603                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
2604                                         if ((long) (bcc_ptr) % 2) {
2605                                                 remaining_words =
2606                                                     (BCC(smb_buffer_response)
2607                                                      - 1) / 2;
2608                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
2609                                         } else {
2610                                                 remaining_words =
2611                                                     BCC
2612                                                     (smb_buffer_response) / 2;
2613                                         }
2614                                         len =
2615                                             UniStrnlen((wchar_t *) bcc_ptr,
2616                                                        remaining_words - 1);
2617 /* We look for obvious messed up bcc or strings in response so we do not go off
2618    the end since (at least) WIN2K and Windows XP have a major bug in not null
2619    terminating last Unicode string in response  */
2620                                         if(ses->serverOS)
2621                                                 kfree(ses->serverOS);
2622                                         ses->serverOS =
2623                                             kzalloc(2 * (len + 1), GFP_KERNEL);
2624                                         cifs_strfromUCS_le(ses->serverOS,
2625                                                            (__le16 *)
2626                                                            bcc_ptr, len,
2627                                                            nls_codepage);
2628                                         bcc_ptr += 2 * (len + 1);
2629                                         remaining_words -= len + 1;
2630                                         ses->serverOS[2 * len] = 0;
2631                                         ses->serverOS[1 + (2 * len)] = 0;
2632                                         if (remaining_words > 0) {
2633                                                 len = UniStrnlen((wchar_t *)
2634                                                                  bcc_ptr,
2635                                                                  remaining_words
2636                                                                  - 1);
2637                                                 kfree(ses->serverNOS);
2638                                                 ses->serverNOS =
2639                                                     kzalloc(2 * (len + 1),
2640                                                             GFP_KERNEL);
2641                                                 cifs_strfromUCS_le(ses->
2642                                                                    serverNOS,
2643                                                                    (__le16 *)
2644                                                                    bcc_ptr,
2645                                                                    len,
2646                                                                    nls_codepage);
2647                                                 bcc_ptr += 2 * (len + 1);
2648                                                 ses->serverNOS[2 * len] = 0;
2649                                                 ses->serverNOS[1 +
2650                                                                (2 * len)] = 0;
2651                                                 remaining_words -= len + 1;
2652                                                 if (remaining_words > 0) {
2653                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
2654            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
2655                                                         kfree(ses->serverDomain);
2656                                                         ses->serverDomain =
2657                                                             kzalloc(2 *
2658                                                                     (len +
2659                                                                      1),
2660                                                                     GFP_KERNEL);
2661                                                         cifs_strfromUCS_le
2662                                                             (ses->serverDomain,
2663                                                              (__le16 *)bcc_ptr,
2664                                                              len, nls_codepage);
2665                                                         bcc_ptr +=
2666                                                             2 * (len + 1);
2667                                                         ses->serverDomain[2*len]
2668                                                             = 0;
2669                                                         ses->serverDomain
2670                                                                 [1 + (2 * len)]
2671                                                             = 0;
2672                                                 } /* else no more room so create dummy domain string */
2673                                                 else {
2674                                                         kfree(ses->serverDomain);
2675                                                         ses->serverDomain =
2676                                                             kzalloc(2,
2677                                                                     GFP_KERNEL);
2678                                                 }
2679                                         } else {        /* no room so create dummy domain and NOS string */
2680                                                 kfree(ses->serverDomain);
2681                                                 ses->serverDomain =
2682                                                     kzalloc(2, GFP_KERNEL);
2683                                                 kfree(ses->serverNOS);
2684                                                 ses->serverNOS =
2685                                                     kzalloc(2, GFP_KERNEL);
2686                                         }
2687                                 } else {        /* ASCII */
2688                                         len = strnlen(bcc_ptr, 1024);
2689                                         if (((long) bcc_ptr + len) - (long)
2690                                             pByteArea(smb_buffer_response)
2691                                             <= BCC(smb_buffer_response)) {
2692                                                 if(ses->serverOS)
2693                                                         kfree(ses->serverOS);
2694                                                 ses->serverOS =
2695                                                     kzalloc(len + 1,
2696                                                             GFP_KERNEL);
2697                                                 strncpy(ses->serverOS,
2698                                                         bcc_ptr, len);
2699
2700                                                 bcc_ptr += len;
2701                                                 bcc_ptr[0] = 0; /* null terminate string */
2702                                                 bcc_ptr++;
2703
2704                                                 len = strnlen(bcc_ptr, 1024);
2705                                                 kfree(ses->serverNOS);
2706                                                 ses->serverNOS =
2707                                                     kzalloc(len + 1,
2708                                                             GFP_KERNEL);
2709                                                 strncpy(ses->serverNOS, bcc_ptr, len);
2710                                                 bcc_ptr += len;
2711                                                 bcc_ptr[0] = 0;
2712                                                 bcc_ptr++;
2713
2714                                                 len = strnlen(bcc_ptr, 1024);
2715                                                 kfree(ses->serverDomain);
2716                                                 ses->serverDomain =
2717                                                     kzalloc(len + 1,
2718                                                             GFP_KERNEL);
2719                                                 strncpy(ses->serverDomain, bcc_ptr, len);
2720                                                 bcc_ptr += len;
2721                                                 bcc_ptr[0] = 0;
2722                                                 bcc_ptr++;
2723                                         } else
2724                                                 cFYI(1,
2725                                                      ("Variable field of length %d extends beyond end of smb",
2726                                                       len));
2727                                 }
2728                         } else {
2729                                 cERROR(1,
2730                                        (" Security Blob Length extends beyond end of SMB"));
2731                         }
2732                 } else {
2733                         cERROR(1, ("No session structure passed in."));
2734                 }
2735         } else {
2736                 cERROR(1,
2737                        (" Invalid Word count %d:",
2738                         smb_buffer_response->WordCount));
2739                 rc = -EIO;
2740         }
2741
2742         if (smb_buffer)
2743                 cifs_buf_release(smb_buffer);
2744
2745         return rc;
2746 }
2747 static int
2748 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
2749                 char *ntlm_session_key, int ntlmv2_flag,
2750                 const struct nls_table *nls_codepage)
2751 {
2752         struct smb_hdr *smb_buffer;
2753         struct smb_hdr *smb_buffer_response;
2754         SESSION_SETUP_ANDX *pSMB;
2755         SESSION_SETUP_ANDX *pSMBr;
2756         char *bcc_ptr;
2757         char *user;
2758         char *domain;
2759         int rc = 0;
2760         int remaining_words = 0;
2761         int bytes_returned = 0;
2762         int len;
2763         int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
2764         PAUTHENTICATE_MESSAGE SecurityBlob;
2765         __u32 negotiate_flags, capabilities;
2766         __u16 count;
2767
2768         cFYI(1, ("In NTLMSSPSessSetup (Authenticate)"));
2769         if(ses == NULL)
2770                 return -EINVAL;
2771         user = ses->userName;
2772         domain = ses->domainName;
2773         smb_buffer = cifs_buf_get();
2774         if (smb_buffer == NULL) {
2775                 return -ENOMEM;
2776         }
2777         smb_buffer_response = smb_buffer;
2778         pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
2779         pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
2780
2781         /* send SMBsessionSetup here */
2782         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
2783                         NULL /* no tCon exists yet */ , 12 /* wct */ );
2784
2785         smb_buffer->Mid = GetNextMid(ses->server);
2786         pSMB->req.hdr.Flags |= (SMBFLG_CASELESS | SMBFLG_CANONICAL_PATH_FORMAT);
2787         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
2788         pSMB->req.AndXCommand = 0xFF;
2789         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
2790         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
2791
2792         pSMB->req.hdr.Uid = ses->Suid;
2793
2794         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
2795                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
2796
2797         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
2798             CAP_EXTENDED_SECURITY;
2799         if (ses->capabilities & CAP_UNICODE) {
2800                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
2801                 capabilities |= CAP_UNICODE;
2802         }
2803         if (ses->capabilities & CAP_STATUS32) {
2804                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
2805                 capabilities |= CAP_STATUS32;
2806         }
2807         if (ses->capabilities & CAP_DFS) {
2808                 smb_buffer->Flags2 |= SMBFLG2_DFS;
2809                 capabilities |= CAP_DFS;
2810         }
2811         pSMB->req.Capabilities = cpu_to_le32(capabilities);
2812
2813         bcc_ptr = (char *) &pSMB->req.SecurityBlob;
2814         SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
2815         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
2816         SecurityBlob->MessageType = NtLmAuthenticate;
2817         bcc_ptr += SecurityBlobLength;
2818         negotiate_flags =
2819             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
2820             NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
2821             0x80000000 | NTLMSSP_NEGOTIATE_128;
2822         if(sign_CIFS_PDUs)
2823                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
2824         if(ntlmv2_flag)
2825                 negotiate_flags |= NTLMSSP_NEGOTIATE_NTLMV2;
2826
2827 /* setup pointers to domain name and workstation name */
2828
2829         SecurityBlob->WorkstationName.Buffer = 0;
2830         SecurityBlob->WorkstationName.Length = 0;
2831         SecurityBlob->WorkstationName.MaximumLength = 0;
2832         SecurityBlob->SessionKey.Length = 0;
2833         SecurityBlob->SessionKey.MaximumLength = 0;
2834         SecurityBlob->SessionKey.Buffer = 0;
2835
2836         SecurityBlob->LmChallengeResponse.Length = 0;
2837         SecurityBlob->LmChallengeResponse.MaximumLength = 0;
2838         SecurityBlob->LmChallengeResponse.Buffer = 0;
2839
2840         SecurityBlob->NtChallengeResponse.Length =
2841             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2842         SecurityBlob->NtChallengeResponse.MaximumLength =
2843             cpu_to_le16(CIFS_SESS_KEY_SIZE);
2844         memcpy(bcc_ptr, ntlm_session_key, CIFS_SESS_KEY_SIZE);
2845         SecurityBlob->NtChallengeResponse.Buffer =
2846             cpu_to_le32(SecurityBlobLength);
2847         SecurityBlobLength += CIFS_SESS_KEY_SIZE;
2848         bcc_ptr += CIFS_SESS_KEY_SIZE;
2849
2850         if (ses->capabilities & CAP_UNICODE) {
2851                 if (domain == NULL) {
2852                         SecurityBlob->DomainName.Buffer = 0;
2853                         SecurityBlob->DomainName.Length = 0;
2854                         SecurityBlob->DomainName.MaximumLength = 0;
2855                 } else {
2856                         __u16 len =
2857                             cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
2858                                           nls_codepage);
2859                         len *= 2;
2860                         SecurityBlob->DomainName.MaximumLength =
2861                             cpu_to_le16(len);
2862                         SecurityBlob->DomainName.Buffer =
2863                             cpu_to_le32(SecurityBlobLength);
2864                         bcc_ptr += len;
2865                         SecurityBlobLength += len;
2866                         SecurityBlob->DomainName.Length =
2867                             cpu_to_le16(len);
2868                 }
2869                 if (user == NULL) {
2870                         SecurityBlob->UserName.Buffer = 0;
2871                         SecurityBlob->UserName.Length = 0;
2872                         SecurityBlob->UserName.MaximumLength = 0;
2873                 } else {
2874                         __u16 len =
2875                             cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
2876                                           nls_codepage);
2877                         len *= 2;
2878                         SecurityBlob->UserName.MaximumLength =
2879                             cpu_to_le16(len);
2880                         SecurityBlob->UserName.Buffer =
2881                             cpu_to_le32(SecurityBlobLength);
2882                         bcc_ptr += len;
2883                         SecurityBlobLength += len;
2884                         SecurityBlob->UserName.Length =
2885                             cpu_to_le16(len);
2886                 }
2887
2888                 /* SecurityBlob->WorkstationName.Length = cifs_strtoUCS((__le16 *) bcc_ptr, "AMACHINE",64, nls_codepage);
2889                    SecurityBlob->WorkstationName.Length *= 2;
2890                    SecurityBlob->WorkstationName.MaximumLength = cpu_to_le16(SecurityBlob->WorkstationName.Length);
2891                    SecurityBlob->WorkstationName.Buffer = cpu_to_le32(SecurityBlobLength);
2892                    bcc_ptr += SecurityBlob->WorkstationName.Length;
2893                    SecurityBlobLength += SecurityBlob->WorkstationName.Length;
2894                    SecurityBlob->WorkstationName.Length = cpu_to_le16(SecurityBlob->WorkstationName.Length);  */
2895
2896                 if ((long) bcc_ptr % 2) {
2897                         *bcc_ptr = 0;
2898                         bcc_ptr++;
2899                 }
2900                 bytes_returned =
2901                     cifs_strtoUCS((__le16 *) bcc_ptr, "Linux version ",
2902                                   32, nls_codepage);
2903                 bcc_ptr += 2 * bytes_returned;
2904                 bytes_returned =
2905                     cifs_strtoUCS((__le16 *) bcc_ptr, utsname()->release, 32,
2906                                   nls_codepage);
2907                 bcc_ptr += 2 * bytes_returned;
2908                 bcc_ptr += 2;   /* null term version string */
2909                 bytes_returned =
2910                     cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
2911                                   64, nls_codepage);
2912                 bcc_ptr += 2 * bytes_returned;
2913                 *(bcc_ptr + 1) = 0;
2914                 *(bcc_ptr + 2) = 0;
2915                 bcc_ptr += 2;   /* null terminate network opsys string */
2916                 *(bcc_ptr + 1) = 0;
2917                 *(bcc_ptr + 2) = 0;
2918                 bcc_ptr += 2;   /* null domain */
2919         } else {                /* ASCII */
2920                 if (domain == NULL) {
2921                         SecurityBlob->DomainName.Buffer = 0;
2922                         SecurityBlob->DomainName.Length = 0;
2923                         SecurityBlob->DomainName.MaximumLength = 0;
2924                 } else {
2925                         __u16 len;
2926                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
2927                         strncpy(bcc_ptr, domain, 63);
2928                         len = strnlen(domain, 64);
2929                         SecurityBlob->DomainName.MaximumLength =
2930                             cpu_to_le16(len);
2931                         SecurityBlob->DomainName.Buffer =
2932                             cpu_to_le32(SecurityBlobLength);
2933                         bcc_ptr += len;
2934                         SecurityBlobLength += len;
2935                         SecurityBlob->DomainName.Length = cpu_to_le16(len);
2936                 }
2937                 if (user == NULL) {
2938                         SecurityBlob->UserName.Buffer = 0;
2939                         SecurityBlob->UserName.Length = 0;
2940                         SecurityBlob->UserName.MaximumLength = 0;
2941                 } else {
2942                         __u16 len;
2943                         strncpy(bcc_ptr, user, 63);
2944                         len = strnlen(user, 64);
2945                         SecurityBlob->UserName.MaximumLength =
2946                             cpu_to_le16(len);
2947                         SecurityBlob->UserName.Buffer =
2948                             cpu_to_le32(SecurityBlobLength);
2949                         bcc_ptr += len;
2950                         SecurityBlobLength += len;
2951                         SecurityBlob->UserName.Length = cpu_to_le16(len);
2952                 }
2953                 /* BB fill in our workstation name if known BB */
2954
2955                 strcpy(bcc_ptr, "Linux version ");
2956                 bcc_ptr += strlen("Linux version ");
2957                 strcpy(bcc_ptr, utsname()->release);
2958                 bcc_ptr += strlen(utsname()->release) + 1;
2959                 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
2960                 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
2961                 bcc_ptr++;      /* null domain */
2962                 *bcc_ptr = 0;
2963         }
2964         SecurityBlob->NegotiateFlags = cpu_to_le32(negotiate_flags);
2965         pSMB->req.SecurityBlobLength = cpu_to_le16(SecurityBlobLength);
2966         count = (long) bcc_ptr - (long) pByteArea(smb_buffer);
2967         smb_buffer->smb_buf_length += count;
2968         pSMB->req.ByteCount = cpu_to_le16(count);
2969
2970         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
2971                          &bytes_returned, 1);
2972         if (rc) {
2973 /*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
2974         } else if ((smb_buffer_response->WordCount == 3)
2975                    || (smb_buffer_response->WordCount == 4)) {
2976                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
2977                 __u16 blob_len =
2978                     le16_to_cpu(pSMBr->resp.SecurityBlobLength);
2979                 if (action & GUEST_LOGIN)
2980                         cFYI(1, (" Guest login"));      /* BB do we want to set anything in SesInfo struct ? */
2981 /*        if(SecurityBlob2->MessageType != NtLm??){
2982                  cFYI("Unexpected message type on auth response is %d "));
2983         } */
2984                 if (ses) {
2985                         cFYI(1,
2986                              ("Does UID on challenge %d match auth response UID %d ",
2987                               ses->Suid, smb_buffer_response->Uid));
2988                         ses->Suid = smb_buffer_response->Uid; /* UID left in wire format */
2989                         bcc_ptr = pByteArea(smb_buffer_response);
2990             /* response can have either 3 or 4 word count - Samba sends 3 */
2991                         if ((pSMBr->resp.hdr.WordCount == 3)
2992                             || ((pSMBr->resp.hdr.WordCount == 4)
2993                                 && (blob_len <
2994                                     pSMBr->resp.ByteCount))) {
2995                                 if (pSMBr->resp.hdr.WordCount == 4) {
2996                                         bcc_ptr +=
2997                                             blob_len;
2998                                         cFYI(1,
2999                                              ("Security Blob Length %d ",
3000                                               blob_len));
3001                                 }
3002
3003                                 cFYI(1,
3004                                      ("NTLMSSP response to Authenticate "));
3005
3006                                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3007                                         if ((long) (bcc_ptr) % 2) {
3008                                                 remaining_words =
3009                                                     (BCC(smb_buffer_response)
3010                                                      - 1) / 2;
3011                                                 bcc_ptr++;      /* Unicode strings must be word aligned */
3012                                         } else {
3013                                                 remaining_words = BCC(smb_buffer_response) / 2;
3014                                         }
3015                                         len =
3016                                             UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
3017 /* We look for obvious messed up bcc or strings in response so we do not go off
3018   the end since (at least) WIN2K and Windows XP have a major bug in not null
3019   terminating last Unicode string in response  */
3020                                         if(ses->serverOS)
3021                                                 kfree(ses->serverOS);
3022                                         ses->serverOS =
3023                                             kzalloc(2 * (len + 1), GFP_KERNEL);
3024                                         cifs_strfromUCS_le(ses->serverOS,
3025                                                            (__le16 *)
3026                                                            bcc_ptr, len,
3027                                                            nls_codepage);
3028                                         bcc_ptr += 2 * (len + 1);
3029                                         remaining_words -= len + 1;
3030                                         ses->serverOS[2 * len] = 0;
3031                                         ses->serverOS[1 + (2 * len)] = 0;
3032                                         if (remaining_words > 0) {
3033                                                 len = UniStrnlen((wchar_t *)
3034                                                                  bcc_ptr,
3035                                                                  remaining_words
3036                                                                  - 1);
3037                                                 kfree(ses->serverNOS);
3038                                                 ses->serverNOS =
3039                                                     kzalloc(2 * (len + 1),
3040                                                             GFP_KERNEL);
3041                                                 cifs_strfromUCS_le(ses->
3042                                                                    serverNOS,
3043                                                                    (__le16 *)
3044                                                                    bcc_ptr,
3045                                                                    len,
3046                                                                    nls_codepage);
3047                                                 bcc_ptr += 2 * (len + 1);
3048                                                 ses->serverNOS[2 * len] = 0;
3049                                                 ses->serverNOS[1+(2*len)] = 0;
3050                                                 remaining_words -= len + 1;
3051                                                 if (remaining_words > 0) {
3052                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
3053      /* last string not always null terminated (e.g. for Windows XP & 2000) */
3054                                                         if(ses->serverDomain)
3055                                                                 kfree(ses->serverDomain);
3056                                                         ses->serverDomain =
3057                                                             kzalloc(2 *
3058                                                                     (len +
3059                                                                      1),
3060                                                                     GFP_KERNEL);
3061                                                         cifs_strfromUCS_le
3062                                                             (ses->
3063                                                              serverDomain,
3064                                                              (__le16 *)
3065                                                              bcc_ptr, len,
3066                                                              nls_codepage);
3067                                                         bcc_ptr +=
3068                                                             2 * (len + 1);
3069                                                         ses->
3070                                                             serverDomain[2
3071                                                                          * len]
3072                                                             = 0;
3073                                                         ses->
3074                                                             serverDomain[1
3075                                                                          +
3076                                                                          (2
3077                                                                           *
3078                                                                           len)]
3079                                                             = 0;
3080                                                 } /* else no more room so create dummy domain string */
3081                                                 else {
3082                                                         if(ses->serverDomain)
3083                                                                 kfree(ses->serverDomain);
3084                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
3085                                                 }
3086                                         } else {  /* no room so create dummy domain and NOS string */
3087                                                 if(ses->serverDomain)
3088                                                         kfree(ses->serverDomain);
3089                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
3090                                                 kfree(ses->serverNOS);
3091                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
3092                                         }
3093                                 } else {        /* ASCII */
3094                                         len = strnlen(bcc_ptr, 1024);
3095                                         if (((long) bcc_ptr + len) -
3096                         (long) pByteArea(smb_buffer_response)
3097                             <= BCC(smb_buffer_response)) {
3098                                                 if(ses->serverOS)
3099                                                         kfree(ses->serverOS);
3100                                                 ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
3101                                                 strncpy(ses->serverOS,bcc_ptr, len);
3102
3103                                                 bcc_ptr += len;
3104                                                 bcc_ptr[0] = 0; /* null terminate the string */
3105                                                 bcc_ptr++;
3106
3107                                                 len = strnlen(bcc_ptr, 1024);
3108                                                 kfree(ses->serverNOS);
3109                                                 ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
3110                                                 strncpy(ses->serverNOS, bcc_ptr, len);
3111                                                 bcc_ptr += len;
3112                                                 bcc_ptr[0] = 0;
3113                                                 bcc_ptr++;
3114
3115                                                 len = strnlen(bcc_ptr, 1024);
3116                                                 if(ses->serverDomain)
3117                                                         kfree(ses->serverDomain);
3118                                                 ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
3119                                                 strncpy(ses->serverDomain, bcc_ptr, len);
3120                                                 bcc_ptr += len;
3121                                                 bcc_ptr[0] = 0;
3122                                                 bcc_ptr++;
3123                                         } else
3124                                                 cFYI(1,
3125                                                      ("Variable field of length %d extends beyond end of smb ",
3126                                                       len));
3127                                 }
3128                         } else {
3129                                 cERROR(1,
3130                                        (" Security Blob Length extends beyond end of SMB"));
3131                         }
3132                 } else {
3133                         cERROR(1, ("No session structure passed in."));
3134                 }
3135         } else {
3136                 cERROR(1,
3137                        (" Invalid Word count %d: ",
3138                         smb_buffer_response->WordCount));
3139                 rc = -EIO;
3140         }
3141
3142         if (smb_buffer)
3143                 cifs_buf_release(smb_buffer);
3144
3145         return rc;
3146 }
3147
3148 int
3149 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
3150          const char *tree, struct cifsTconInfo *tcon,
3151          const struct nls_table *nls_codepage)
3152 {
3153         struct smb_hdr *smb_buffer;
3154         struct smb_hdr *smb_buffer_response;
3155         TCONX_REQ *pSMB;
3156         TCONX_RSP *pSMBr;
3157         unsigned char *bcc_ptr;
3158         int rc = 0;
3159         int length;
3160         __u16 count;
3161
3162         if (ses == NULL)
3163                 return -EIO;
3164
3165         smb_buffer = cifs_buf_get();
3166         if (smb_buffer == NULL) {
3167                 return -ENOMEM;
3168         }
3169         smb_buffer_response = smb_buffer;
3170
3171         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3172                         NULL /*no tid */ , 4 /*wct */ );
3173
3174         smb_buffer->Mid = GetNextMid(ses->server);
3175         smb_buffer->Uid = ses->Suid;
3176         pSMB = (TCONX_REQ *) smb_buffer;
3177         pSMBr = (TCONX_RSP *) smb_buffer_response;
3178
3179         pSMB->AndXCommand = 0xFF;
3180         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3181         bcc_ptr = &pSMB->Password[0];
3182         if((ses->server->secMode) & SECMODE_USER) {
3183                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3184                 *bcc_ptr = 0; /* password is null byte */
3185                 bcc_ptr++;              /* skip password */
3186                 /* already aligned so no need to do it below */
3187         } else {
3188                 pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
3189                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3190                    specified as required (when that support is added to
3191                    the vfs in the future) as only NTLM or the much
3192                    weaker LANMAN (which we do not send by default) is accepted
3193                    by Samba (not sure whether other servers allow
3194                    NTLMv2 password here) */
3195 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3196                 if((extended_security & CIFSSEC_MAY_LANMAN) &&
3197                         (ses->server->secType == LANMAN))
3198                         calc_lanman_hash(ses, bcc_ptr);
3199                 else
3200 #endif /* CIFS_WEAK_PW_HASH */
3201                 SMBNTencrypt(ses->password,
3202                              ses->server->cryptKey,
3203                              bcc_ptr);
3204
3205                 bcc_ptr += CIFS_SESS_KEY_SIZE;
3206                 if(ses->capabilities & CAP_UNICODE) {
3207                         /* must align unicode strings */
3208                         *bcc_ptr = 0; /* null byte password */
3209                         bcc_ptr++;
3210                 }
3211         }
3212
3213         if(ses->server->secMode &
3214                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3215                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3216
3217         if (ses->capabilities & CAP_STATUS32) {
3218                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3219         }
3220         if (ses->capabilities & CAP_DFS) {
3221                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3222         }
3223         if (ses->capabilities & CAP_UNICODE) {
3224                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3225                 length =
3226                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3227                         6 /* max utf8 char length in bytes */ *
3228                         (/* server len*/ + 256 /* share len */), nls_codepage);
3229                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3230                 bcc_ptr += 2;   /* skip trailing null */
3231         } else {                /* ASCII */
3232                 strcpy(bcc_ptr, tree);
3233                 bcc_ptr += strlen(tree) + 1;
3234         }
3235         strcpy(bcc_ptr, "?????");
3236         bcc_ptr += strlen("?????");
3237         bcc_ptr += 1;
3238         count = bcc_ptr - &pSMB->Password[0];
3239         pSMB->hdr.smb_buf_length += count;
3240         pSMB->ByteCount = cpu_to_le16(count);
3241
3242         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
3243
3244         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
3245         /* above now done in SendReceive */
3246         if ((rc == 0) && (tcon != NULL)) {
3247                 tcon->tidStatus = CifsGood;
3248                 tcon->tid = smb_buffer_response->Tid;
3249                 bcc_ptr = pByteArea(smb_buffer_response);
3250                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
3251         /* skip service field (NB: this field is always ASCII) */
3252                 bcc_ptr += length + 1;
3253                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3254                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
3255                         length = UniStrnlen((wchar_t *) bcc_ptr, 512);
3256                         if ((bcc_ptr + (2 * length)) -
3257                              pByteArea(smb_buffer_response) <=
3258                             BCC(smb_buffer_response)) {
3259                                 kfree(tcon->nativeFileSystem);
3260                                 tcon->nativeFileSystem =
3261                                     kzalloc(length + 2, GFP_KERNEL);
3262                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
3263                                                    (__le16 *) bcc_ptr,
3264                                                    length, nls_codepage);
3265                                 bcc_ptr += 2 * length;
3266                                 bcc_ptr[0] = 0; /* null terminate the string */
3267                                 bcc_ptr[1] = 0;
3268                                 bcc_ptr += 2;
3269                         }
3270                         /* else do not bother copying these informational fields */
3271                 } else {
3272                         length = strnlen(bcc_ptr, 1024);
3273                         if ((bcc_ptr + length) -
3274                             pByteArea(smb_buffer_response) <=
3275                             BCC(smb_buffer_response)) {
3276                                 kfree(tcon->nativeFileSystem);
3277                                 tcon->nativeFileSystem =
3278                                     kzalloc(length + 1, GFP_KERNEL);
3279                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
3280                                         length);
3281                         }
3282                         /* else do not bother copying these informational fields */
3283                 }
3284                 if((smb_buffer_response->WordCount == 3) ||
3285                          (smb_buffer_response->WordCount == 7))
3286                         /* field is in same location */
3287                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3288                 else
3289                         tcon->Flags = 0;
3290                 cFYI(1, ("Tcon flags: 0x%x ", tcon->Flags));
3291         } else if ((rc == 0) && tcon == NULL) {
3292         /* all we need to save for IPC$ connection */
3293                 ses->ipc_tid = smb_buffer_response->Tid;
3294         }
3295
3296         if (smb_buffer)
3297                 cifs_buf_release(smb_buffer);
3298         return rc;
3299 }
3300
3301 int
3302 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3303 {
3304         int rc = 0;
3305         int xid;
3306         struct cifsSesInfo *ses = NULL;
3307         struct task_struct *cifsd_task;
3308         char * tmp;
3309
3310         xid = GetXid();
3311
3312         if (cifs_sb->tcon) {
3313                 ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
3314                 rc = CIFSSMBTDis(xid, cifs_sb->tcon);
3315                 if (rc == -EBUSY) {
3316                         FreeXid(xid);
3317                         return 0;
3318                 }
3319                 tconInfoFree(cifs_sb->tcon);
3320                 if ((ses) && (ses->server)) {
3321                         /* save off task so we do not refer to ses later */
3322                         cifsd_task = ses->server->tsk;
3323                         cFYI(1, ("About to do SMBLogoff "));
3324                         rc = CIFSSMBLogoff(xid, ses);
3325                         if (rc == -EBUSY) {
3326                                 FreeXid(xid);
3327                                 return 0;
3328                         } else if (rc == -ESHUTDOWN) {
3329                                 cFYI(1,("Waking up socket by sending it signal"));
3330                                 if(cifsd_task) {
3331                                         send_sig(SIGKILL,cifsd_task,1);
3332                                         kthread_stop(cifsd_task);
3333                                 }
3334                                 rc = 0;
3335                         } /* else - we have an smb session
3336                                 left on this socket do not kill cifsd */
3337                 } else
3338                         cFYI(1, ("No session or bad tcon"));
3339         }
3340
3341         cifs_sb->tcon = NULL;
3342         tmp = cifs_sb->prepath;
3343         cifs_sb->prepathlen = 0;
3344         cifs_sb->prepath = NULL;
3345         kfree(tmp);
3346         if (ses)
3347                 schedule_timeout_interruptible(msecs_to_jiffies(500));
3348         if (ses)
3349                 sesInfoFree(ses);
3350
3351         FreeXid(xid);
3352         return rc;              /* BB check if we should always return zero here */
3353 }
3354
3355 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3356                                            struct nls_table * nls_info)
3357 {
3358         int rc = 0;
3359         char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3360         int ntlmv2_flag = FALSE;
3361         int first_time = 0;
3362
3363         /* what if server changes its buffer size after dropping the session? */
3364         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
3365                 rc = CIFSSMBNegotiate(xid, pSesInfo);
3366                 if(rc == -EAGAIN) /* retry only once on 1st time connection */ {
3367                         rc = CIFSSMBNegotiate(xid, pSesInfo);
3368                         if(rc == -EAGAIN)
3369                                 rc = -EHOSTDOWN;
3370                 }
3371                 if(rc == 0) {
3372                         spin_lock(&GlobalMid_Lock);
3373                         if(pSesInfo->server->tcpStatus != CifsExiting)
3374                                 pSesInfo->server->tcpStatus = CifsGood;
3375                         else
3376                                 rc = -EHOSTDOWN;
3377                         spin_unlock(&GlobalMid_Lock);
3378
3379                 }
3380                 first_time = 1;
3381         }
3382         if (!rc) {
3383                 pSesInfo->flags = 0;
3384                 pSesInfo->capabilities = pSesInfo->server->capabilities;
3385                 if(linuxExtEnabled == 0)
3386                         pSesInfo->capabilities &= (~CAP_UNIX);
3387         /*      pSesInfo->sequence_number = 0;*/
3388                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3389                         pSesInfo->server->secMode,
3390                         pSesInfo->server->capabilities,
3391                         pSesInfo->server->timeAdj));
3392                 if(experimEnabled < 2)
3393                         rc = CIFS_SessSetup(xid, pSesInfo,
3394                                             first_time, nls_info);
3395                 else if (extended_security
3396                                 && (pSesInfo->capabilities
3397                                         & CAP_EXTENDED_SECURITY)
3398                                 && (pSesInfo->server->secType == NTLMSSP)) {
3399                         rc = -EOPNOTSUPP;
3400                 } else if (extended_security
3401                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
3402                            && (pSesInfo->server->secType == RawNTLMSSP)) {
3403                         cFYI(1, ("NTLMSSP sesssetup"));
3404                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
3405                                                 pSesInfo,
3406                                                 &ntlmv2_flag,
3407                                                 nls_info);
3408                         if (!rc) {
3409                                 if(ntlmv2_flag) {
3410                                         char * v2_response;
3411                                         cFYI(1,("more secure NTLM ver2 hash"));
3412                                         if(CalcNTLMv2_partial_mac_key(pSesInfo,
3413                                                 nls_info)) {
3414                                                 rc = -ENOMEM;
3415                                                 goto ss_err_exit;
3416                                         } else
3417                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
3418                                         if(v2_response) {
3419                                                 CalcNTLMv2_response(pSesInfo,v2_response);
3420                                 /*              if(first_time)
3421                                                         cifs_calculate_ntlmv2_mac_key(
3422                                                           pSesInfo->server->mac_signing_key,
3423                                                           response, ntlm_session_key, */
3424                                                 kfree(v2_response);
3425                                         /* BB Put dummy sig in SessSetup PDU? */
3426                                         } else {
3427                                                 rc = -ENOMEM;
3428                                                 goto ss_err_exit;
3429                                         }
3430
3431                                 } else {
3432                                         SMBNTencrypt(pSesInfo->password,
3433                                                 pSesInfo->server->cryptKey,
3434                                                 ntlm_session_key);
3435
3436                                         if(first_time)
3437                                                 cifs_calculate_mac_key(
3438                                                         pSesInfo->server->mac_signing_key,
3439                                                         ntlm_session_key,
3440                                                         pSesInfo->password);
3441                                 }
3442                         /* for better security the weaker lanman hash not sent
3443                            in AuthSessSetup so we no longer calculate it */
3444
3445                                 rc = CIFSNTLMSSPAuthSessSetup(xid,
3446                                         pSesInfo,
3447                                         ntlm_session_key,
3448                                         ntlmv2_flag,
3449                                         nls_info);
3450                         }
3451                 } else { /* old style NTLM 0.12 session setup */
3452                         SMBNTencrypt(pSesInfo->password,
3453                                 pSesInfo->server->cryptKey,
3454                                 ntlm_session_key);
3455
3456                         if(first_time)
3457                                 cifs_calculate_mac_key(
3458                                         pSesInfo->server->mac_signing_key,
3459                                         ntlm_session_key, pSesInfo->password);
3460
3461                         rc = CIFSSessSetup(xid, pSesInfo,
3462                                 ntlm_session_key, nls_info);
3463                 }
3464                 if (rc) {
3465                         cERROR(1,("Send error in SessSetup = %d",rc));
3466                 } else {
3467                         cFYI(1,("CIFS Session Established successfully"));
3468                         pSesInfo->status = CifsGood;
3469                 }
3470         }
3471 ss_err_exit:
3472         return rc;
3473 }
3474