68889f269b
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org> Signed-off-by: Steve French <smfrench@gmail.com>
483 lines
13 KiB
C
483 lines
13 KiB
C
/*
|
|
* SMB1 (CIFS) version specific operations
|
|
*
|
|
* Copyright (c) 2012, Jeff Layton <jlayton@redhat.com>
|
|
*
|
|
* This library is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License v2 as published
|
|
* by the Free Software Foundation.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
|
|
* the GNU Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public License
|
|
* along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*/
|
|
|
|
#include "cifsglob.h"
|
|
#include "cifsproto.h"
|
|
#include "cifs_debug.h"
|
|
#include "cifspdu.h"
|
|
|
|
/*
|
|
* An NT cancel request header looks just like the original request except:
|
|
*
|
|
* The Command is SMB_COM_NT_CANCEL
|
|
* The WordCount is zeroed out
|
|
* The ByteCount is zeroed out
|
|
*
|
|
* This function mangles an existing request buffer into a
|
|
* SMB_COM_NT_CANCEL request and then sends it.
|
|
*/
|
|
static int
|
|
send_nt_cancel(struct TCP_Server_Info *server, void *buf,
|
|
struct mid_q_entry *mid)
|
|
{
|
|
int rc = 0;
|
|
struct smb_hdr *in_buf = (struct smb_hdr *)buf;
|
|
|
|
/* -4 for RFC1001 length and +2 for BCC field */
|
|
in_buf->smb_buf_length = cpu_to_be32(sizeof(struct smb_hdr) - 4 + 2);
|
|
in_buf->Command = SMB_COM_NT_CANCEL;
|
|
in_buf->WordCount = 0;
|
|
put_bcc(0, in_buf);
|
|
|
|
mutex_lock(&server->srv_mutex);
|
|
rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
|
|
if (rc) {
|
|
mutex_unlock(&server->srv_mutex);
|
|
return rc;
|
|
}
|
|
rc = smb_send(server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
|
|
mutex_unlock(&server->srv_mutex);
|
|
|
|
cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
|
|
in_buf->Mid, rc);
|
|
|
|
return rc;
|
|
}
|
|
|
|
static bool
|
|
cifs_compare_fids(struct cifsFileInfo *ob1, struct cifsFileInfo *ob2)
|
|
{
|
|
return ob1->netfid == ob2->netfid;
|
|
}
|
|
|
|
static unsigned int
|
|
cifs_read_data_offset(char *buf)
|
|
{
|
|
READ_RSP *rsp = (READ_RSP *)buf;
|
|
return le16_to_cpu(rsp->DataOffset);
|
|
}
|
|
|
|
static unsigned int
|
|
cifs_read_data_length(char *buf)
|
|
{
|
|
READ_RSP *rsp = (READ_RSP *)buf;
|
|
return (le16_to_cpu(rsp->DataLengthHigh) << 16) +
|
|
le16_to_cpu(rsp->DataLength);
|
|
}
|
|
|
|
static struct mid_q_entry *
|
|
cifs_find_mid(struct TCP_Server_Info *server, char *buffer)
|
|
{
|
|
struct smb_hdr *buf = (struct smb_hdr *)buffer;
|
|
struct mid_q_entry *mid;
|
|
|
|
spin_lock(&GlobalMid_Lock);
|
|
list_for_each_entry(mid, &server->pending_mid_q, qhead) {
|
|
if (mid->mid == buf->Mid &&
|
|
mid->mid_state == MID_REQUEST_SUBMITTED &&
|
|
le16_to_cpu(mid->command) == buf->Command) {
|
|
spin_unlock(&GlobalMid_Lock);
|
|
return mid;
|
|
}
|
|
}
|
|
spin_unlock(&GlobalMid_Lock);
|
|
return NULL;
|
|
}
|
|
|
|
static void
|
|
cifs_add_credits(struct TCP_Server_Info *server, const unsigned int add,
|
|
const int optype)
|
|
{
|
|
spin_lock(&server->req_lock);
|
|
server->credits += add;
|
|
server->in_flight--;
|
|
spin_unlock(&server->req_lock);
|
|
wake_up(&server->request_q);
|
|
}
|
|
|
|
static void
|
|
cifs_set_credits(struct TCP_Server_Info *server, const int val)
|
|
{
|
|
spin_lock(&server->req_lock);
|
|
server->credits = val;
|
|
server->oplocks = val > 1 ? enable_oplocks : false;
|
|
spin_unlock(&server->req_lock);
|
|
}
|
|
|
|
static int *
|
|
cifs_get_credits_field(struct TCP_Server_Info *server, const int optype)
|
|
{
|
|
return &server->credits;
|
|
}
|
|
|
|
static unsigned int
|
|
cifs_get_credits(struct mid_q_entry *mid)
|
|
{
|
|
return 1;
|
|
}
|
|
|
|
/*
|
|
* Find a free multiplex id (SMB mid). Otherwise there could be
|
|
* mid collisions which might cause problems, demultiplexing the
|
|
* wrong response to this request. Multiplex ids could collide if
|
|
* one of a series requests takes much longer than the others, or
|
|
* if a very large number of long lived requests (byte range
|
|
* locks or FindNotify requests) are pending. No more than
|
|
* 64K-1 requests can be outstanding at one time. If no
|
|
* mids are available, return zero. A future optimization
|
|
* could make the combination of mids and uid the key we use
|
|
* to demultiplex on (rather than mid alone).
|
|
* In addition to the above check, the cifs demultiplex
|
|
* code already used the command code as a secondary
|
|
* check of the frame and if signing is negotiated the
|
|
* response would be discarded if the mid were the same
|
|
* but the signature was wrong. Since the mid is not put in the
|
|
* pending queue until later (when it is about to be dispatched)
|
|
* we do have to limit the number of outstanding requests
|
|
* to somewhat less than 64K-1 although it is hard to imagine
|
|
* so many threads being in the vfs at one time.
|
|
*/
|
|
static __u64
|
|
cifs_get_next_mid(struct TCP_Server_Info *server)
|
|
{
|
|
__u64 mid = 0;
|
|
__u16 last_mid, cur_mid;
|
|
bool collision;
|
|
|
|
spin_lock(&GlobalMid_Lock);
|
|
|
|
/* mid is 16 bit only for CIFS/SMB */
|
|
cur_mid = (__u16)((server->CurrentMid) & 0xffff);
|
|
/* we do not want to loop forever */
|
|
last_mid = cur_mid;
|
|
cur_mid++;
|
|
|
|
/*
|
|
* This nested loop looks more expensive than it is.
|
|
* In practice the list of pending requests is short,
|
|
* fewer than 50, and the mids are likely to be unique
|
|
* on the first pass through the loop unless some request
|
|
* takes longer than the 64 thousand requests before it
|
|
* (and it would also have to have been a request that
|
|
* did not time out).
|
|
*/
|
|
while (cur_mid != last_mid) {
|
|
struct mid_q_entry *mid_entry;
|
|
unsigned int num_mids;
|
|
|
|
collision = false;
|
|
if (cur_mid == 0)
|
|
cur_mid++;
|
|
|
|
num_mids = 0;
|
|
list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
|
|
++num_mids;
|
|
if (mid_entry->mid == cur_mid &&
|
|
mid_entry->mid_state == MID_REQUEST_SUBMITTED) {
|
|
/* This mid is in use, try a different one */
|
|
collision = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* if we have more than 32k mids in the list, then something
|
|
* is very wrong. Possibly a local user is trying to DoS the
|
|
* box by issuing long-running calls and SIGKILL'ing them. If
|
|
* we get to 2^16 mids then we're in big trouble as this
|
|
* function could loop forever.
|
|
*
|
|
* Go ahead and assign out the mid in this situation, but force
|
|
* an eventual reconnect to clean out the pending_mid_q.
|
|
*/
|
|
if (num_mids > 32768)
|
|
server->tcpStatus = CifsNeedReconnect;
|
|
|
|
if (!collision) {
|
|
mid = (__u64)cur_mid;
|
|
server->CurrentMid = mid;
|
|
break;
|
|
}
|
|
cur_mid++;
|
|
}
|
|
spin_unlock(&GlobalMid_Lock);
|
|
return mid;
|
|
}
|
|
|
|
/*
|
|
return codes:
|
|
0 not a transact2, or all data present
|
|
>0 transact2 with that much data missing
|
|
-EINVAL invalid transact2
|
|
*/
|
|
static int
|
|
check2ndT2(char *buf)
|
|
{
|
|
struct smb_hdr *pSMB = (struct smb_hdr *)buf;
|
|
struct smb_t2_rsp *pSMBt;
|
|
int remaining;
|
|
__u16 total_data_size, data_in_this_rsp;
|
|
|
|
if (pSMB->Command != SMB_COM_TRANSACTION2)
|
|
return 0;
|
|
|
|
/* check for plausible wct, bcc and t2 data and parm sizes */
|
|
/* check for parm and data offset going beyond end of smb */
|
|
if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
|
|
cFYI(1, "invalid transact2 word count");
|
|
return -EINVAL;
|
|
}
|
|
|
|
pSMBt = (struct smb_t2_rsp *)pSMB;
|
|
|
|
total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
|
|
data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
|
|
|
|
if (total_data_size == data_in_this_rsp)
|
|
return 0;
|
|
else if (total_data_size < data_in_this_rsp) {
|
|
cFYI(1, "total data %d smaller than data in frame %d",
|
|
total_data_size, data_in_this_rsp);
|
|
return -EINVAL;
|
|
}
|
|
|
|
remaining = total_data_size - data_in_this_rsp;
|
|
|
|
cFYI(1, "missing %d bytes from transact2, check next response",
|
|
remaining);
|
|
if (total_data_size > CIFSMaxBufSize) {
|
|
cERROR(1, "TotalDataSize %d is over maximum buffer %d",
|
|
total_data_size, CIFSMaxBufSize);
|
|
return -EINVAL;
|
|
}
|
|
return remaining;
|
|
}
|
|
|
|
static int
|
|
coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
|
|
{
|
|
struct smb_t2_rsp *pSMBs = (struct smb_t2_rsp *)second_buf;
|
|
struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)target_hdr;
|
|
char *data_area_of_tgt;
|
|
char *data_area_of_src;
|
|
int remaining;
|
|
unsigned int byte_count, total_in_tgt;
|
|
__u16 tgt_total_cnt, src_total_cnt, total_in_src;
|
|
|
|
src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount);
|
|
tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
|
|
|
|
if (tgt_total_cnt != src_total_cnt)
|
|
cFYI(1, "total data count of primary and secondary t2 differ "
|
|
"source=%hu target=%hu", src_total_cnt, tgt_total_cnt);
|
|
|
|
total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
|
|
|
|
remaining = tgt_total_cnt - total_in_tgt;
|
|
|
|
if (remaining < 0) {
|
|
cFYI(1, "Server sent too much data. tgt_total_cnt=%hu "
|
|
"total_in_tgt=%hu", tgt_total_cnt, total_in_tgt);
|
|
return -EPROTO;
|
|
}
|
|
|
|
if (remaining == 0) {
|
|
/* nothing to do, ignore */
|
|
cFYI(1, "no more data remains");
|
|
return 0;
|
|
}
|
|
|
|
total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount);
|
|
if (remaining < total_in_src)
|
|
cFYI(1, "transact2 2nd response contains too much data");
|
|
|
|
/* find end of first SMB data area */
|
|
data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
|
|
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
|
|
|
|
/* validate target area */
|
|
data_area_of_src = (char *)&pSMBs->hdr.Protocol +
|
|
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
|
|
|
|
data_area_of_tgt += total_in_tgt;
|
|
|
|
total_in_tgt += total_in_src;
|
|
/* is the result too big for the field? */
|
|
if (total_in_tgt > USHRT_MAX) {
|
|
cFYI(1, "coalesced DataCount too large (%u)", total_in_tgt);
|
|
return -EPROTO;
|
|
}
|
|
put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount);
|
|
|
|
/* fix up the BCC */
|
|
byte_count = get_bcc(target_hdr);
|
|
byte_count += total_in_src;
|
|
/* is the result too big for the field? */
|
|
if (byte_count > USHRT_MAX) {
|
|
cFYI(1, "coalesced BCC too large (%u)", byte_count);
|
|
return -EPROTO;
|
|
}
|
|
put_bcc(byte_count, target_hdr);
|
|
|
|
byte_count = be32_to_cpu(target_hdr->smb_buf_length);
|
|
byte_count += total_in_src;
|
|
/* don't allow buffer to overflow */
|
|
if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
|
|
cFYI(1, "coalesced BCC exceeds buffer size (%u)", byte_count);
|
|
return -ENOBUFS;
|
|
}
|
|
target_hdr->smb_buf_length = cpu_to_be32(byte_count);
|
|
|
|
/* copy second buffer into end of first buffer */
|
|
memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
|
|
|
|
if (remaining != total_in_src) {
|
|
/* more responses to go */
|
|
cFYI(1, "waiting for more secondary responses");
|
|
return 1;
|
|
}
|
|
|
|
/* we are done */
|
|
cFYI(1, "found the last secondary response");
|
|
return 0;
|
|
}
|
|
|
|
static bool
|
|
cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server,
|
|
char *buf, int malformed)
|
|
{
|
|
if (malformed)
|
|
return false;
|
|
if (check2ndT2(buf) <= 0)
|
|
return false;
|
|
mid->multiRsp = true;
|
|
if (mid->resp_buf) {
|
|
/* merge response - fix up 1st*/
|
|
malformed = coalesce_t2(buf, mid->resp_buf);
|
|
if (malformed > 0)
|
|
return true;
|
|
/* All parts received or packet is malformed. */
|
|
mid->multiEnd = true;
|
|
dequeue_mid(mid, malformed);
|
|
return true;
|
|
}
|
|
if (!server->large_buf) {
|
|
/*FIXME: switch to already allocated largebuf?*/
|
|
cERROR(1, "1st trans2 resp needs bigbuf");
|
|
} else {
|
|
/* Have first buffer */
|
|
mid->resp_buf = buf;
|
|
mid->large_buf = true;
|
|
server->bigbuf = NULL;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
static bool
|
|
cifs_need_neg(struct TCP_Server_Info *server)
|
|
{
|
|
return server->maxBuf == 0;
|
|
}
|
|
|
|
static int
|
|
cifs_negotiate(const unsigned int xid, struct cifs_ses *ses)
|
|
{
|
|
int rc;
|
|
rc = CIFSSMBNegotiate(xid, ses);
|
|
if (rc == -EAGAIN) {
|
|
/* retry only once on 1st time connection */
|
|
set_credits(ses->server, 1);
|
|
rc = CIFSSMBNegotiate(xid, ses);
|
|
if (rc == -EAGAIN)
|
|
rc = -EHOSTDOWN;
|
|
}
|
|
return rc;
|
|
}
|
|
|
|
static void
|
|
cifs_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
|
|
{
|
|
CIFSSMBQFSDeviceInfo(xid, tcon);
|
|
CIFSSMBQFSAttributeInfo(xid, tcon);
|
|
}
|
|
|
|
static int
|
|
cifs_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon,
|
|
struct cifs_sb_info *cifs_sb, const char *full_path)
|
|
{
|
|
int rc;
|
|
FILE_ALL_INFO *file_info;
|
|
|
|
file_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
|
|
if (file_info == NULL)
|
|
return -ENOMEM;
|
|
|
|
rc = CIFSSMBQPathInfo(xid, tcon, full_path, file_info,
|
|
0 /* not legacy */, cifs_sb->local_nls,
|
|
cifs_sb->mnt_cifs_flags &
|
|
CIFS_MOUNT_MAP_SPECIAL_CHR);
|
|
|
|
if (rc == -EOPNOTSUPP || rc == -EINVAL)
|
|
rc = SMBQueryInformation(xid, tcon, full_path, file_info,
|
|
cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
|
|
CIFS_MOUNT_MAP_SPECIAL_CHR);
|
|
kfree(file_info);
|
|
return rc;
|
|
}
|
|
|
|
struct smb_version_operations smb1_operations = {
|
|
.send_cancel = send_nt_cancel,
|
|
.compare_fids = cifs_compare_fids,
|
|
.setup_request = cifs_setup_request,
|
|
.check_receive = cifs_check_receive,
|
|
.add_credits = cifs_add_credits,
|
|
.set_credits = cifs_set_credits,
|
|
.get_credits_field = cifs_get_credits_field,
|
|
.get_credits = cifs_get_credits,
|
|
.get_next_mid = cifs_get_next_mid,
|
|
.read_data_offset = cifs_read_data_offset,
|
|
.read_data_length = cifs_read_data_length,
|
|
.map_error = map_smb_to_linux_error,
|
|
.find_mid = cifs_find_mid,
|
|
.check_message = checkSMB,
|
|
.dump_detail = cifs_dump_detail,
|
|
.is_oplock_break = is_valid_oplock_break,
|
|
.check_trans2 = cifs_check_trans2,
|
|
.need_neg = cifs_need_neg,
|
|
.negotiate = cifs_negotiate,
|
|
.sess_setup = CIFS_SessSetup,
|
|
.logoff = CIFSSMBLogoff,
|
|
.tree_connect = CIFSTCon,
|
|
.tree_disconnect = CIFSSMBTDis,
|
|
.get_dfs_refer = CIFSGetDFSRefer,
|
|
.qfs_tcon = cifs_qfs_tcon,
|
|
.is_path_accessible = cifs_is_path_accessible,
|
|
};
|
|
|
|
struct smb_version_values smb1_values = {
|
|
.version_string = SMB1_VERSION_STRING,
|
|
.large_lock_type = LOCKING_ANDX_LARGE_FILES,
|
|
.exclusive_lock_type = 0,
|
|
.shared_lock_type = LOCKING_ANDX_SHARED_LOCK,
|
|
.unlock_lock_type = 0,
|
|
.header_size = sizeof(struct smb_hdr),
|
|
.max_header_size = MAX_CIFS_HDR_SIZE,
|
|
.read_rsp_size = sizeof(READ_RSP),
|
|
.lock_cmd = cpu_to_le16(SMB_COM_LOCKING_ANDX),
|
|
};
|