2 * SMB1 (CIFS) version specific operations
4 * Copyright (c) 2012, Jeff Layton <jlayton@redhat.com>
6 * This library is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License v2 as published
8 * by the Free Software Foundation.
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
13 * the GNU Lesser General Public License for more details.
15 * You should have received a copy of the GNU Lesser General Public License
16 * along with this library; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 #include "cifsproto.h"
22 #include "cifs_debug.h"
26 * An NT cancel request header looks just like the original request except:
28 * The Command is SMB_COM_NT_CANCEL
29 * The WordCount is zeroed out
30 * The ByteCount is zeroed out
32 * This function mangles an existing request buffer into a
33 * SMB_COM_NT_CANCEL request and then sends it.
36 send_nt_cancel(struct TCP_Server_Info
*server
, void *buf
,
37 struct mid_q_entry
*mid
)
40 struct smb_hdr
*in_buf
= (struct smb_hdr
*)buf
;
42 /* -4 for RFC1001 length and +2 for BCC field */
43 in_buf
->smb_buf_length
= cpu_to_be32(sizeof(struct smb_hdr
) - 4 + 2);
44 in_buf
->Command
= SMB_COM_NT_CANCEL
;
45 in_buf
->WordCount
= 0;
48 mutex_lock(&server
->srv_mutex
);
49 rc
= cifs_sign_smb(in_buf
, server
, &mid
->sequence_number
);
51 mutex_unlock(&server
->srv_mutex
);
54 rc
= smb_send(server
, in_buf
, be32_to_cpu(in_buf
->smb_buf_length
));
55 mutex_unlock(&server
->srv_mutex
);
57 cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
64 cifs_compare_fids(struct cifsFileInfo
*ob1
, struct cifsFileInfo
*ob2
)
66 return ob1
->netfid
== ob2
->netfid
;
70 cifs_read_data_offset(char *buf
)
72 READ_RSP
*rsp
= (READ_RSP
*)buf
;
73 return le16_to_cpu(rsp
->DataOffset
);
77 cifs_read_data_length(char *buf
)
79 READ_RSP
*rsp
= (READ_RSP
*)buf
;
80 return (le16_to_cpu(rsp
->DataLengthHigh
) << 16) +
81 le16_to_cpu(rsp
->DataLength
);
84 static struct mid_q_entry
*
85 cifs_find_mid(struct TCP_Server_Info
*server
, char *buffer
)
87 struct smb_hdr
*buf
= (struct smb_hdr
*)buffer
;
88 struct mid_q_entry
*mid
;
90 spin_lock(&GlobalMid_Lock
);
91 list_for_each_entry(mid
, &server
->pending_mid_q
, qhead
) {
92 if (mid
->mid
== buf
->Mid
&&
93 mid
->mid_state
== MID_REQUEST_SUBMITTED
&&
94 le16_to_cpu(mid
->command
) == buf
->Command
) {
95 spin_unlock(&GlobalMid_Lock
);
99 spin_unlock(&GlobalMid_Lock
);
104 cifs_add_credits(struct TCP_Server_Info
*server
, const unsigned int add
,
107 spin_lock(&server
->req_lock
);
108 server
->credits
+= add
;
110 spin_unlock(&server
->req_lock
);
111 wake_up(&server
->request_q
);
115 cifs_set_credits(struct TCP_Server_Info
*server
, const int val
)
117 spin_lock(&server
->req_lock
);
118 server
->credits
= val
;
119 server
->oplocks
= val
> 1 ? enable_oplocks
: false;
120 spin_unlock(&server
->req_lock
);
124 cifs_get_credits_field(struct TCP_Server_Info
*server
, const int optype
)
126 return &server
->credits
;
130 cifs_get_credits(struct mid_q_entry
*mid
)
136 * Find a free multiplex id (SMB mid). Otherwise there could be
137 * mid collisions which might cause problems, demultiplexing the
138 * wrong response to this request. Multiplex ids could collide if
139 * one of a series requests takes much longer than the others, or
140 * if a very large number of long lived requests (byte range
141 * locks or FindNotify requests) are pending. No more than
142 * 64K-1 requests can be outstanding at one time. If no
143 * mids are available, return zero. A future optimization
144 * could make the combination of mids and uid the key we use
145 * to demultiplex on (rather than mid alone).
146 * In addition to the above check, the cifs demultiplex
147 * code already used the command code as a secondary
148 * check of the frame and if signing is negotiated the
149 * response would be discarded if the mid were the same
150 * but the signature was wrong. Since the mid is not put in the
151 * pending queue until later (when it is about to be dispatched)
152 * we do have to limit the number of outstanding requests
153 * to somewhat less than 64K-1 although it is hard to imagine
154 * so many threads being in the vfs at one time.
157 cifs_get_next_mid(struct TCP_Server_Info
*server
)
160 __u16 last_mid
, cur_mid
;
163 spin_lock(&GlobalMid_Lock
);
165 /* mid is 16 bit only for CIFS/SMB */
166 cur_mid
= (__u16
)((server
->CurrentMid
) & 0xffff);
167 /* we do not want to loop forever */
172 * This nested loop looks more expensive than it is.
173 * In practice the list of pending requests is short,
174 * fewer than 50, and the mids are likely to be unique
175 * on the first pass through the loop unless some request
176 * takes longer than the 64 thousand requests before it
177 * (and it would also have to have been a request that
180 while (cur_mid
!= last_mid
) {
181 struct mid_q_entry
*mid_entry
;
182 unsigned int num_mids
;
189 list_for_each_entry(mid_entry
, &server
->pending_mid_q
, qhead
) {
191 if (mid_entry
->mid
== cur_mid
&&
192 mid_entry
->mid_state
== MID_REQUEST_SUBMITTED
) {
193 /* This mid is in use, try a different one */
200 * if we have more than 32k mids in the list, then something
201 * is very wrong. Possibly a local user is trying to DoS the
202 * box by issuing long-running calls and SIGKILL'ing them. If
203 * we get to 2^16 mids then we're in big trouble as this
204 * function could loop forever.
206 * Go ahead and assign out the mid in this situation, but force
207 * an eventual reconnect to clean out the pending_mid_q.
209 if (num_mids
> 32768)
210 server
->tcpStatus
= CifsNeedReconnect
;
213 mid
= (__u64
)cur_mid
;
214 server
->CurrentMid
= mid
;
219 spin_unlock(&GlobalMid_Lock
);
225 0 not a transact2, or all data present
226 >0 transact2 with that much data missing
227 -EINVAL invalid transact2
230 check2ndT2(char *buf
)
232 struct smb_hdr
*pSMB
= (struct smb_hdr
*)buf
;
233 struct smb_t2_rsp
*pSMBt
;
235 __u16 total_data_size
, data_in_this_rsp
;
237 if (pSMB
->Command
!= SMB_COM_TRANSACTION2
)
240 /* check for plausible wct, bcc and t2 data and parm sizes */
241 /* check for parm and data offset going beyond end of smb */
242 if (pSMB
->WordCount
!= 10) { /* coalesce_t2 depends on this */
243 cFYI(1, "invalid transact2 word count");
247 pSMBt
= (struct smb_t2_rsp
*)pSMB
;
249 total_data_size
= get_unaligned_le16(&pSMBt
->t2_rsp
.TotalDataCount
);
250 data_in_this_rsp
= get_unaligned_le16(&pSMBt
->t2_rsp
.DataCount
);
252 if (total_data_size
== data_in_this_rsp
)
254 else if (total_data_size
< data_in_this_rsp
) {
255 cFYI(1, "total data %d smaller than data in frame %d",
256 total_data_size
, data_in_this_rsp
);
260 remaining
= total_data_size
- data_in_this_rsp
;
262 cFYI(1, "missing %d bytes from transact2, check next response",
264 if (total_data_size
> CIFSMaxBufSize
) {
265 cERROR(1, "TotalDataSize %d is over maximum buffer %d",
266 total_data_size
, CIFSMaxBufSize
);
273 coalesce_t2(char *second_buf
, struct smb_hdr
*target_hdr
)
275 struct smb_t2_rsp
*pSMBs
= (struct smb_t2_rsp
*)second_buf
;
276 struct smb_t2_rsp
*pSMBt
= (struct smb_t2_rsp
*)target_hdr
;
277 char *data_area_of_tgt
;
278 char *data_area_of_src
;
280 unsigned int byte_count
, total_in_tgt
;
281 __u16 tgt_total_cnt
, src_total_cnt
, total_in_src
;
283 src_total_cnt
= get_unaligned_le16(&pSMBs
->t2_rsp
.TotalDataCount
);
284 tgt_total_cnt
= get_unaligned_le16(&pSMBt
->t2_rsp
.TotalDataCount
);
286 if (tgt_total_cnt
!= src_total_cnt
)
287 cFYI(1, "total data count of primary and secondary t2 differ "
288 "source=%hu target=%hu", src_total_cnt
, tgt_total_cnt
);
290 total_in_tgt
= get_unaligned_le16(&pSMBt
->t2_rsp
.DataCount
);
292 remaining
= tgt_total_cnt
- total_in_tgt
;
295 cFYI(1, "Server sent too much data. tgt_total_cnt=%hu "
296 "total_in_tgt=%hu", tgt_total_cnt
, total_in_tgt
);
300 if (remaining
== 0) {
301 /* nothing to do, ignore */
302 cFYI(1, "no more data remains");
306 total_in_src
= get_unaligned_le16(&pSMBs
->t2_rsp
.DataCount
);
307 if (remaining
< total_in_src
)
308 cFYI(1, "transact2 2nd response contains too much data");
310 /* find end of first SMB data area */
311 data_area_of_tgt
= (char *)&pSMBt
->hdr
.Protocol
+
312 get_unaligned_le16(&pSMBt
->t2_rsp
.DataOffset
);
314 /* validate target area */
315 data_area_of_src
= (char *)&pSMBs
->hdr
.Protocol
+
316 get_unaligned_le16(&pSMBs
->t2_rsp
.DataOffset
);
318 data_area_of_tgt
+= total_in_tgt
;
320 total_in_tgt
+= total_in_src
;
321 /* is the result too big for the field? */
322 if (total_in_tgt
> USHRT_MAX
) {
323 cFYI(1, "coalesced DataCount too large (%u)", total_in_tgt
);
326 put_unaligned_le16(total_in_tgt
, &pSMBt
->t2_rsp
.DataCount
);
329 byte_count
= get_bcc(target_hdr
);
330 byte_count
+= total_in_src
;
331 /* is the result too big for the field? */
332 if (byte_count
> USHRT_MAX
) {
333 cFYI(1, "coalesced BCC too large (%u)", byte_count
);
336 put_bcc(byte_count
, target_hdr
);
338 byte_count
= be32_to_cpu(target_hdr
->smb_buf_length
);
339 byte_count
+= total_in_src
;
340 /* don't allow buffer to overflow */
341 if (byte_count
> CIFSMaxBufSize
+ MAX_CIFS_HDR_SIZE
- 4) {
342 cFYI(1, "coalesced BCC exceeds buffer size (%u)", byte_count
);
345 target_hdr
->smb_buf_length
= cpu_to_be32(byte_count
);
347 /* copy second buffer into end of first buffer */
348 memcpy(data_area_of_tgt
, data_area_of_src
, total_in_src
);
350 if (remaining
!= total_in_src
) {
351 /* more responses to go */
352 cFYI(1, "waiting for more secondary responses");
357 cFYI(1, "found the last secondary response");
362 cifs_check_trans2(struct mid_q_entry
*mid
, struct TCP_Server_Info
*server
,
363 char *buf
, int malformed
)
367 if (check2ndT2(buf
) <= 0)
369 mid
->multiRsp
= true;
371 /* merge response - fix up 1st*/
372 malformed
= coalesce_t2(buf
, mid
->resp_buf
);
375 /* All parts received or packet is malformed. */
376 mid
->multiEnd
= true;
377 dequeue_mid(mid
, malformed
);
380 if (!server
->large_buf
) {
381 /*FIXME: switch to already allocated largebuf?*/
382 cERROR(1, "1st trans2 resp needs bigbuf");
384 /* Have first buffer */
386 mid
->large_buf
= true;
387 server
->bigbuf
= NULL
;
393 cifs_need_neg(struct TCP_Server_Info
*server
)
395 return server
->maxBuf
== 0;
399 cifs_negotiate(const unsigned int xid
, struct cifs_ses
*ses
)
402 rc
= CIFSSMBNegotiate(xid
, ses
);
404 /* retry only once on 1st time connection */
405 set_credits(ses
->server
, 1);
406 rc
= CIFSSMBNegotiate(xid
, ses
);
413 struct smb_version_operations smb1_operations
= {
414 .send_cancel
= send_nt_cancel
,
415 .compare_fids
= cifs_compare_fids
,
416 .setup_request
= cifs_setup_request
,
417 .check_receive
= cifs_check_receive
,
418 .add_credits
= cifs_add_credits
,
419 .set_credits
= cifs_set_credits
,
420 .get_credits_field
= cifs_get_credits_field
,
421 .get_credits
= cifs_get_credits
,
422 .get_next_mid
= cifs_get_next_mid
,
423 .read_data_offset
= cifs_read_data_offset
,
424 .read_data_length
= cifs_read_data_length
,
425 .map_error
= map_smb_to_linux_error
,
426 .find_mid
= cifs_find_mid
,
427 .check_message
= checkSMB
,
428 .dump_detail
= cifs_dump_detail
,
429 .is_oplock_break
= is_valid_oplock_break
,
430 .check_trans2
= cifs_check_trans2
,
431 .need_neg
= cifs_need_neg
,
432 .negotiate
= cifs_negotiate
,
435 struct smb_version_values smb1_values
= {
436 .version_string
= SMB1_VERSION_STRING
,
437 .large_lock_type
= LOCKING_ANDX_LARGE_FILES
,
438 .exclusive_lock_type
= 0,
439 .shared_lock_type
= LOCKING_ANDX_SHARED_LOCK
,
440 .unlock_lock_type
= 0,
441 .header_size
= sizeof(struct smb_hdr
),
442 .max_header_size
= MAX_CIFS_HDR_SIZE
,
443 .read_rsp_size
= sizeof(READ_RSP
),