?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Retry the join with the short name
[Samba.git] / source3 / smbd / lanman.c
blob8c49b433b0cd888c98dee80f1d09a8476ec652df
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "../librpc/gen_ndr/ndr_samr_c.h"
32 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
33 #include "rpc_client/cli_spoolss.h"
34 #include "rpc_client/init_spoolss.h"
35 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
36 #include "../librpc/gen_ndr/srv_samr.h"
37 #include "../librpc/gen_ndr/srv_srvsvc.h"
38 #include "../librpc/gen_ndr/rap.h"
39 #include "../lib/util/binsearch.h"
40 #include "../libcli/auth/libcli_auth.h"
41 #include "rpc_client/init_lsa.h"
42 #include "rpc_server/rpc_ncacn_np.h"
43 #include "../libcli/security/security.h"
44 #include "printing.h"
45 #include "passdb/machine_sid.h"
46 #include "auth.h"
47
48 #ifdef CHECK_TYPES
49 #undef CHECK_TYPES
50 #endif
51 #define CHECK_TYPES 0
52
53 #define NERR_Success 0
54 #define NERR_badpass 86
55 #define NERR_notsupported 50
56
57 #define NERR_BASE (2100)
58 #define NERR_BufTooSmall (NERR_BASE+23)
59 #define NERR_JobNotFound (NERR_BASE+51)
60 #define NERR_DestNotFound (NERR_BASE+52)
61
62 #define ACCESS_READ 0x01
63 #define ACCESS_WRITE 0x02
64 #define ACCESS_CREATE 0x04
65
66 #define SHPWLEN 8 /* share password length */
67
68 /* Limit size of ipc replies */
69
70 static char *smb_realloc_limit(void *ptr, size_t size)
71 {
72 char *val;
73
74 size = MAX((size),4*1024);
75 val = (char *)SMB_REALLOC(ptr,size);
76 if (val) {
77 memset(val,'\0',size);
78 }
79 return val;
80 }
81
82 static bool api_Unsupported(struct smbd_server_connection *sconn,
83 connection_struct *conn, uint16 vuid,
84 char *param, int tpscnt,
85 char *data, int tdscnt,
86 int mdrcnt, int mprcnt,
87 char **rdata, char **rparam,
88 int *rdata_len, int *rparam_len);
89
90 static bool api_TooSmall(struct smbd_server_connection *sconn,
91 connection_struct *conn, uint16 vuid, char *param, char *data,
92 int mdrcnt, int mprcnt,
93 char **rdata, char **rparam,
94 int *rdata_len, int *rparam_len);
95
96
97 static int CopyExpanded(connection_struct *conn,
98 int snum, char **dst, char *src, int *p_space_remaining)
99 {
100 TALLOC_CTX *ctx = talloc_tos();
101 char *buf = NULL;
102 int l;
103
104 if (!src || !dst || !p_space_remaining || !(*dst) ||
105 *p_space_remaining <= 0) {
106 return 0;
107 }
108
109 buf = talloc_strdup(ctx, src);
110 if (!buf) {
111 *p_space_remaining = 0;
112 return 0;
113 }
114 buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
115 if (!buf) {
116 *p_space_remaining = 0;
117 return 0;
118 }
119 buf = talloc_sub_advanced(ctx,
120 lp_servicename(SNUM(conn)),
121 conn->session_info->unix_name,
122 conn->connectpath,
123 conn->session_info->utok.gid,
124 conn->session_info->sanitized_username,
125 conn->session_info->info3->base.domain.string,
126 buf);
127 if (!buf) {
128 *p_space_remaining = 0;
129 return 0;
130 }
131 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
132 if (l == -1) {
133 return 0;
134 }
135 (*dst) += l;
136 (*p_space_remaining) -= l;
137 return l;
138 }
139
140 static int CopyAndAdvance(char **dst, char *src, int *n)
141 {
142 int l;
143 if (!src || !dst || !n || !(*dst)) {
144 return 0;
145 }
146 l = push_ascii(*dst,src,*n, STR_TERMINATE);
147 if (l == -1) {
148 return 0;
149 }
150 (*dst) += l;
151 (*n) -= l;
152 return l;
153 }
154
155 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
156 {
157 TALLOC_CTX *ctx = talloc_tos();
158 char *buf = NULL;
159 if (!s) {
160 return 0;
161 }
162 buf = talloc_strdup(ctx,s);
163 if (!buf) {
164 return 0;
165 }
166 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
167 if (!buf) {
168 return 0;
169 }
170 buf = talloc_sub_advanced(ctx,
171 lp_servicename(SNUM(conn)),
172 conn->session_info->unix_name,
173 conn->connectpath,
174 conn->session_info->utok.gid,
175 conn->session_info->sanitized_username,
176 conn->session_info->info3->base.domain.string,
177 buf);
178 if (!buf) {
179 return 0;
180 }
181 return strlen(buf) + 1;
182 }
183
184 /*******************************************************************
185 Check a API string for validity when we only need to check the prefix.
186 ******************************************************************/
187
188 static bool prefix_ok(const char *str, const char *prefix)
189 {
190 return(strncmp(str,prefix,strlen(prefix)) == 0);
191 }
192
193 struct pack_desc {
194 const char *format; /* formatstring for structure */
195 const char *subformat; /* subformat for structure */
196 char *base; /* baseaddress of buffer */
197 int buflen; /* remaining size for fixed part; on init: length of base */
198 int subcount; /* count of substructures */
199 char *structbuf; /* pointer into buffer for remaining fixed part */
200 int stringlen; /* remaining size for variable part */
201 char *stringbuf; /* pointer into buffer for remaining variable part */
202 int neededlen; /* total needed size */
203 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
204 const char *curpos; /* current position; pointer into format or subformat */
205 int errcode;
206 };
207
208 static int get_counter(const char **p)
209 {
210 int i, n;
211 if (!p || !(*p)) {
212 return 1;
213 }
214 if (!isdigit((int)**p)) {
215 return 1;
216 }
217 for (n = 0;;) {
218 i = **p;
219 if (isdigit(i)) {
220 n = 10 * n + (i - '0');
221 } else {
222 return n;
223 }
224 (*p)++;
225 }
226 }
227
228 static int getlen(const char *p)
229 {
230 int n = 0;
231 if (!p) {
232 return 0;
233 }
234
235 while (*p) {
236 switch( *p++ ) {
237 case 'W': /* word (2 byte) */
238 n += 2;
239 break;
240 case 'K': /* status word? (2 byte) */
241 n += 2;
242 break;
243 case 'N': /* count of substructures (word) at end */
244 n += 2;
245 break;
246 case 'D': /* double word (4 byte) */
247 case 'z': /* offset to zero terminated string (4 byte) */
248 case 'l': /* offset to user data (4 byte) */
249 n += 4;
250 break;
251 case 'b': /* offset to data (with counter) (4 byte) */
252 n += 4;
253 get_counter(&p);
254 break;
255 case 'B': /* byte (with optional counter) */
256 n += get_counter(&p);
257 break;
258 }
259 }
260 return n;
261 }
262
263 static bool init_package(struct pack_desc *p, int count, int subcount)
264 {
265 int n = p->buflen;
266 int i;
267
268 if (!p->format || !p->base) {
269 return False;
270 }
271
272 i = count * getlen(p->format);
273 if (p->subformat) {
274 i += subcount * getlen(p->subformat);
275 }
276 p->structbuf = p->base;
277 p->neededlen = 0;
278 p->usedlen = 0;
279 p->subcount = 0;
280 p->curpos = p->format;
281 if (i > n) {
282 p->neededlen = i;
283 i = n = 0;
284 #if 0
285 /*
286 * This is the old error code we used. Aparently
287 * WinNT/2k systems return ERRbuftoosmall (2123) and
288 * OS/2 needs this. I'm leaving this here so we can revert
289 * if needed. JRA.
290 */
291 p->errcode = ERRmoredata;
292 #else
293 p->errcode = ERRbuftoosmall;
294 #endif
295 } else {
296 p->errcode = NERR_Success;
297 }
298 p->buflen = i;
299 n -= i;
300 p->stringbuf = p->base + i;
301 p->stringlen = n;
302 return (p->errcode == NERR_Success);
303 }
304
305 static int package(struct pack_desc *p, ...)
306 {
307 va_list args;
308 int needed=0, stringneeded;
309 const char *str=NULL;
310 int is_string=0, stringused;
311 int32 temp;
312
313 va_start(args,p);
314
315 if (!*p->curpos) {
316 if (!p->subcount) {
317 p->curpos = p->format;
318 } else {
319 p->curpos = p->subformat;
320 p->subcount--;
321 }
322 }
323 #if CHECK_TYPES
324 str = va_arg(args,char*);
325 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
326 #endif
327 stringneeded = -1;
328
329 if (!p->curpos) {
330 va_end(args);
331 return 0;
332 }
333
334 switch( *p->curpos++ ) {
335 case 'W': /* word (2 byte) */
336 needed = 2;
337 temp = va_arg(args,int);
338 if (p->buflen >= needed) {
339 SSVAL(p->structbuf,0,temp);
340 }
341 break;
342 case 'K': /* status word? (2 byte) */
343 needed = 2;
344 temp = va_arg(args,int);
345 if (p->buflen >= needed) {
346 SSVAL(p->structbuf,0,temp);
347 }
348 break;
349 case 'N': /* count of substructures (word) at end */
350 needed = 2;
351 p->subcount = va_arg(args,int);
352 if (p->buflen >= needed) {
353 SSVAL(p->structbuf,0,p->subcount);
354 }
355 break;
356 case 'D': /* double word (4 byte) */
357 needed = 4;
358 temp = va_arg(args,int);
359 if (p->buflen >= needed) {
360 SIVAL(p->structbuf,0,temp);
361 }
362 break;
363 case 'B': /* byte (with optional counter) */
364 needed = get_counter(&p->curpos);
365 {
366 char *s = va_arg(args,char*);
367 if (p->buflen >= needed) {
368 StrnCpy(p->structbuf,s?s:"",needed-1);
369 }
370 }
371 break;
372 case 'z': /* offset to zero terminated string (4 byte) */
373 str = va_arg(args,char*);
374 stringneeded = (str ? strlen(str)+1 : 0);
375 is_string = 1;
376 break;
377 case 'l': /* offset to user data (4 byte) */
378 str = va_arg(args,char*);
379 stringneeded = va_arg(args,int);
380 is_string = 0;
381 break;
382 case 'b': /* offset to data (with counter) (4 byte) */
383 str = va_arg(args,char*);
384 stringneeded = get_counter(&p->curpos);
385 is_string = 0;
386 break;
387 }
388
389 va_end(args);
390 if (stringneeded >= 0) {
391 needed = 4;
392 if (p->buflen >= needed) {
393 stringused = stringneeded;
394 if (stringused > p->stringlen) {
395 stringused = (is_string ? p->stringlen : 0);
396 if (p->errcode == NERR_Success) {
397 p->errcode = ERRmoredata;
398 }
399 }
400 if (!stringused) {
401 SIVAL(p->structbuf,0,0);
402 } else {
403 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
404 memcpy(p->stringbuf,str?str:"",stringused);
405 if (is_string) {
406 p->stringbuf[stringused-1] = '\0';
407 }
408 p->stringbuf += stringused;
409 p->stringlen -= stringused;
410 p->usedlen += stringused;
411 }
412 }
413 p->neededlen += stringneeded;
414 }
415
416 p->neededlen += needed;
417 if (p->buflen >= needed) {
418 p->structbuf += needed;
419 p->buflen -= needed;
420 p->usedlen += needed;
421 } else {
422 if (p->errcode == NERR_Success) {
423 p->errcode = ERRmoredata;
424 }
425 }
426 return 1;
427 }
428
429 #if CHECK_TYPES
430 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
431 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
432 #else
433 #define PACK(desc,t,v) package(desc,v)
434 #define PACKl(desc,t,v,l) package(desc,v,l)
435 #endif
436
437 static void PACKI(struct pack_desc* desc, const char *t,int v)
438 {
439 PACK(desc,t,v);
440 }
441
442 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
443 {
444 PACK(desc,t,v);
445 }
446
447 /****************************************************************************
448 Get a print queue.
449 ****************************************************************************/
450
451 static void PackDriverData(struct pack_desc* desc)
452 {
453 char drivdata[4+4+32];
454 SIVAL(drivdata,0,sizeof drivdata); /* cb */
455 SIVAL(drivdata,4,1000); /* lVersion */
456 memset(drivdata+8,0,32); /* szDeviceName */
457 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
458 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
459 }
460
461 static int check_printq_info(struct pack_desc* desc,
462 unsigned int uLevel, char *id1, char *id2)
463 {
464 desc->subformat = NULL;
465 switch( uLevel ) {
466 case 0:
467 desc->format = "B13";
468 break;
469 case 1:
470 desc->format = "B13BWWWzzzzzWW";
471 break;
472 case 2:
473 desc->format = "B13BWWWzzzzzWN";
474 desc->subformat = "WB21BB16B10zWWzDDz";
475 break;
476 case 3:
477 desc->format = "zWWWWzzzzWWzzl";
478 break;
479 case 4:
480 desc->format = "zWWWWzzzzWNzzl";
481 desc->subformat = "WWzWWDDzz";
482 break;
483 case 5:
484 desc->format = "z";
485 break;
486 case 51:
487 desc->format = "K";
488 break;
489 case 52:
490 desc->format = "WzzzzzzzzN";
491 desc->subformat = "z";
492 break;
493 default:
494 DEBUG(0,("check_printq_info: invalid level %d\n",
495 uLevel ));
496 return False;
497 }
498 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
499 DEBUG(0,("check_printq_info: invalid format %s\n",
500 id1 ? id1 : "<NULL>" ));
501 return False;
502 }
503 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
504 DEBUG(0,("check_printq_info: invalid subformat %s\n",
505 id2 ? id2 : "<NULL>" ));
506 return False;
507 }
508 return True;
509 }
510
511
512 #define RAP_JOB_STATUS_QUEUED 0
513 #define RAP_JOB_STATUS_PAUSED 1
514 #define RAP_JOB_STATUS_SPOOLING 2
515 #define RAP_JOB_STATUS_PRINTING 3
516 #define RAP_JOB_STATUS_PRINTED 4
517
518 #define RAP_QUEUE_STATUS_PAUSED 1
519 #define RAP_QUEUE_STATUS_ERROR 2
520
521 /* turn a print job status into a on the wire status
522 */
523 static int printj_spoolss_status(int v)
524 {
525 if (v == JOB_STATUS_QUEUED)
526 return RAP_JOB_STATUS_QUEUED;
527 if (v & JOB_STATUS_PAUSED)
528 return RAP_JOB_STATUS_PAUSED;
529 if (v & JOB_STATUS_SPOOLING)
530 return RAP_JOB_STATUS_SPOOLING;
531 if (v & JOB_STATUS_PRINTING)
532 return RAP_JOB_STATUS_PRINTING;
533 return 0;
534 }
535
536 /* turn a print queue status into a on the wire status
537 */
538 static int printq_spoolss_status(int v)
539 {
540 if (v == PRINTER_STATUS_OK)
541 return 0;
542 if (v & PRINTER_STATUS_PAUSED)
543 return RAP_QUEUE_STATUS_PAUSED;
544 return RAP_QUEUE_STATUS_ERROR;
545 }
546
547 static void fill_spoolss_printjob_info(int uLevel,
548 struct pack_desc *desc,
549 struct spoolss_JobInfo2 *info2,
550 int n)
551 {
552 time_t t = spoolss_Time_to_time_t(&info2->submitted);
553
554 /* the client expects localtime */
555 t -= get_time_zone(t);
556
557 PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
558 if (uLevel == 1) {
559 PACKS(desc,"B21", info2->user_name); /* szUserName */
560 PACKS(desc,"B",""); /* pad */
561 PACKS(desc,"B16",""); /* szNotifyName */
562 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
563 PACKS(desc,"z",""); /* pszParms */
564 PACKI(desc,"W",n+1); /* uPosition */
565 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
566 PACKS(desc,"z",""); /* pszStatus */
567 PACKI(desc,"D", t); /* ulSubmitted */
568 PACKI(desc,"D", info2->size); /* ulSize */
569 PACKS(desc,"z", info2->document_name); /* pszComment */
570 }
571 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
572 PACKI(desc,"W", info2->priority); /* uPriority */
573 PACKS(desc,"z", info2->user_name); /* pszUserName */
574 PACKI(desc,"W",n+1); /* uPosition */
575 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
576 PACKI(desc,"D",t); /* ulSubmitted */
577 PACKI(desc,"D", info2->size); /* ulSize */
578 PACKS(desc,"z","Samba"); /* pszComment */
579 PACKS(desc,"z", info2->document_name); /* pszDocument */
580 if (uLevel == 3) {
581 PACKS(desc,"z",""); /* pszNotifyName */
582 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
583 PACKS(desc,"z",""); /* pszParms */
584 PACKS(desc,"z",""); /* pszStatus */
585 PACKS(desc,"z", info2->printer_name); /* pszQueue */
586 PACKS(desc,"z","lpd"); /* pszQProcName */
587 PACKS(desc,"z",""); /* pszQProcParms */
588 PACKS(desc,"z","NULL"); /* pszDriverName */
589 PackDriverData(desc); /* pDriverData */
590 PACKS(desc,"z",""); /* pszPrinterName */
591 } else if (uLevel == 4) { /* OS2 */
592 PACKS(desc,"z",""); /* pszSpoolFileName */
593 PACKS(desc,"z",""); /* pszPortName */
594 PACKS(desc,"z",""); /* pszStatus */
595 PACKI(desc,"D",0); /* ulPagesSpooled */
596 PACKI(desc,"D",0); /* ulPagesSent */
597 PACKI(desc,"D",0); /* ulPagesPrinted */
598 PACKI(desc,"D",0); /* ulTimePrinted */
599 PACKI(desc,"D",0); /* ulExtendJobStatus */
600 PACKI(desc,"D",0); /* ulStartPage */
601 PACKI(desc,"D",0); /* ulEndPage */
602 }
603 }
604 }
605
606 /********************************************************************
607 Respond to the DosPrintQInfo command with a level of 52
608 This is used to get printer driver information for Win9x clients
609 ********************************************************************/
610 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
611 struct pack_desc* desc, int count,
612 const char *printer_name)
613 {
614 int i;
615 fstring location;
616 trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
617 trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
618 trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
619
620 PACKI(desc, "W", 0x0400); /* don't know */
621 PACKS(desc, "z", driver->driver_name); /* long printer name */
622 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
623 PACKS(desc, "z", driver->data_file); /* Datafile name */
624 PACKS(desc, "z", driver->monitor_name); /* language monitor */
625
626 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
627 standard_sub_basic( "", "", location, sizeof(location)-1 );
628 PACKS(desc,"z", location); /* share to retrieve files */
629
630 PACKS(desc,"z", driver->default_datatype); /* default data type */
631 PACKS(desc,"z", driver->help_file); /* helpfile name */
632 PACKS(desc,"z", driver->driver_path); /* driver name */
633
634 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
635 DEBUG(3,("Driver: %s:\n",driver->driver_path));
636 DEBUG(3,("Data File: %s:\n",driver->data_file));
637 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
638 DEBUG(3,("Driver Location: %s:\n",location));
639 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
640 DEBUG(3,("Help File: %s:\n",driver->help_file));
641 PACKI(desc,"N",count); /* number of files to copy */
642
643 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
644 {
645 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
646 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
647 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
648 }
649
650 /* sanity check */
651 if ( i != count )
652 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
653 count, i));
654
655 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
656
657 desc->errcode=NERR_Success;
658
659 }
660
661 static const char *strip_unc(const char *unc)
662 {
663 char *p;
664
665 if (unc == NULL) {
666 return NULL;
667 }
668
669 if ((p = strrchr(unc, '\\')) != NULL) {
670 return p+1;
671 }
672
673 return unc;
674 }
675
676 static void fill_printq_info(int uLevel,
677 struct pack_desc* desc,
678 int count,
679 union spoolss_JobInfo *job_info,
680 struct spoolss_DriverInfo3 *driver_info,
681 struct spoolss_PrinterInfo2 *printer_info)
682 {
683 switch (uLevel) {
684 case 0:
685 case 1:
686 case 2:
687 PACKS(desc,"B13", strip_unc(printer_info->printername));
688 break;
689 case 3:
690 case 4:
691 case 5:
692 PACKS(desc,"z", strip_unc(printer_info->printername));
693 break;
694 case 51:
695 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
696 break;
697 }
698
699 if (uLevel == 1 || uLevel == 2) {
700 PACKS(desc,"B",""); /* alignment */
701 PACKI(desc,"W",5); /* priority */
702 PACKI(desc,"W",0); /* start time */
703 PACKI(desc,"W",0); /* until time */
704 PACKS(desc,"z",""); /* pSepFile */
705 PACKS(desc,"z","lpd"); /* pPrProc */
706 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
707 PACKS(desc,"z",""); /* pParms */
708 if (printer_info->printername == NULL) {
709 PACKS(desc,"z","UNKNOWN PRINTER");
710 PACKI(desc,"W",LPSTAT_ERROR);
711 } else {
712 PACKS(desc,"z", printer_info->comment);
713 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
714 }
715 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
716 }
717
718 if (uLevel == 3 || uLevel == 4) {
719 PACKI(desc,"W",5); /* uPriority */
720 PACKI(desc,"W",0); /* uStarttime */
721 PACKI(desc,"W",0); /* uUntiltime */
722 PACKI(desc,"W",5); /* pad1 */
723 PACKS(desc,"z",""); /* pszSepFile */
724 PACKS(desc,"z","WinPrint"); /* pszPrProc */
725 PACKS(desc,"z",NULL); /* pszParms */
726 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
727 /* "don't ask" that it's done this way to fix corrupted
728 Win9X/ME printer comments. */
729 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
730 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
731 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
732 PACKS(desc,"z", printer_info->drivername); /* pszDriverName */
733 PackDriverData(desc); /* pDriverData */
734 }
735
736 if (uLevel == 2 || uLevel == 4) {
737 int i;
738 for (i = 0; i < count; i++) {
739 fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
740 }
741 }
742
743 if (uLevel==52)
744 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
745 }
746
747 /* This function returns the number of files for a given driver */
748 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
749 {
750 int result = 0;
751
752 /* count the number of files */
753 while (driver->dependent_files && *driver->dependent_files[result])
754 result++;
755
756 return result;
757 }
758
759 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
760 connection_struct *conn, uint16 vuid,
761 char *param, int tpscnt,
762 char *data, int tdscnt,
763 int mdrcnt,int mprcnt,
764 char **rdata,char **rparam,
765 int *rdata_len,int *rparam_len)
766 {
767 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
768 char *str2 = skip_string(param,tpscnt,str1);
769 char *p = skip_string(param,tpscnt,str2);
770 char *QueueName = p;
771 unsigned int uLevel;
772 uint32_t count = 0;
773 char *str3;
774 struct pack_desc desc;
775 char* tmpdata=NULL;
776
777 WERROR werr = WERR_OK;
778 TALLOC_CTX *mem_ctx = talloc_tos();
779 NTSTATUS status;
780 struct rpc_pipe_client *cli = NULL;
781 struct dcerpc_binding_handle *b = NULL;
782 struct policy_handle handle;
783 struct spoolss_DevmodeContainer devmode_ctr;
784 union spoolss_DriverInfo driver_info;
785 union spoolss_JobInfo *job_info = NULL;
786 union spoolss_PrinterInfo printer_info;
787
788 if (!str1 || !str2 || !p) {
789 return False;
790 }
791 memset((char *)&desc,'\0',sizeof(desc));
792
793 p = skip_string(param,tpscnt,p);
794 if (!p) {
795 return False;
796 }
797 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
798 str3 = get_safe_str_ptr(param,tpscnt,p,4);
799 /* str3 may be null here and is checked in check_printq_info(). */
800
801 /* remove any trailing username */
802 if ((p = strchr_m(QueueName,'%')))
803 *p = 0;
804
805 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
806
807 /* check it's a supported varient */
808 if (!prefix_ok(str1,"zWrLh"))
809 return False;
810 if (!check_printq_info(&desc,uLevel,str2,str3)) {
811 /*
812 * Patch from Scott Moomaw <scott@bridgewater.edu>
813 * to return the 'invalid info level' error if an
814 * unknown level was requested.
815 */
816 *rdata_len = 0;
817 *rparam_len = 6;
818 *rparam = smb_realloc_limit(*rparam,*rparam_len);
819 if (!*rparam) {
820 return False;
821 }
822 SSVALS(*rparam,0,ERRunknownlevel);
823 SSVAL(*rparam,2,0);
824 SSVAL(*rparam,4,0);
825 return(True);
826 }
827
828 ZERO_STRUCT(handle);
829
830 if (QueueName == NULL || (strlen(QueueName) < 1)) {
831 desc.errcode = W_ERROR_V(WERR_INVALID_PARAM);
832 goto out;
833 }
834
835 status = rpc_pipe_open_interface(conn,
836 &ndr_table_spoolss.syntax_id,
837 conn->session_info,
838 &conn->sconn->client_id,
839 conn->sconn->msg_ctx,
840 &cli);
841 if (!NT_STATUS_IS_OK(status)) {
842 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
843 nt_errstr(status)));
844 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
845 goto out;
846 }
847 b = cli->binding_handle;
848
849 ZERO_STRUCT(devmode_ctr);
850
851 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
852 QueueName,
853 "RAW",
854 devmode_ctr,
855 PRINTER_ACCESS_USE,
856 &handle,
857 &werr);
858 if (!NT_STATUS_IS_OK(status)) {
859 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
860 goto out;
861 }
862 if (!W_ERROR_IS_OK(werr)) {
863 desc.errcode = W_ERROR_V(werr);
864 goto out;
865 }
866
867 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
868 &handle,
869 2,
870 0,
871 &printer_info);
872 if (!W_ERROR_IS_OK(werr)) {
873 desc.errcode = W_ERROR_V(werr);
874 goto out;
875 }
876
877 if (uLevel==52) {
878 uint32_t server_major_version;
879 uint32_t server_minor_version;
880
881 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
882 &handle,
883 "Windows 4.0",
884 3, /* level */
885 0,
886 0, /* version */
887 0,
888 &driver_info,
889 &server_major_version,
890 &server_minor_version);
891 if (!W_ERROR_IS_OK(werr)) {
892 desc.errcode = W_ERROR_V(werr);
893 goto out;
894 }
895
896 count = get_printerdrivernumber(&driver_info.info3);
897 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
898 } else {
899 uint32_t num_jobs;
900 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
901 &handle,
902 0, /* firstjob */
903 0xff, /* numjobs */
904 2, /* level */
905 0, /* offered */
906 &num_jobs,
907 &job_info);
908 if (!W_ERROR_IS_OK(werr)) {
909 desc.errcode = W_ERROR_V(werr);
910 goto out;
911 }
912
913 count = num_jobs;
914 }
915
916 if (mdrcnt > 0) {
917 *rdata = smb_realloc_limit(*rdata,mdrcnt);
918 if (!*rdata) {
919 return False;
920 }
921 desc.base = *rdata;
922 desc.buflen = mdrcnt;
923 } else {
924 /*
925 * Don't return data but need to get correct length
926 * init_package will return wrong size if buflen=0
927 */
928 desc.buflen = getlen(desc.format);
929 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
930 }
931
932 if (init_package(&desc,1,count)) {
933 desc.subcount = count;
934 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
935 }
936
937 *rdata_len = desc.usedlen;
938
939 /*
940 * We must set the return code to ERRbuftoosmall
941 * in order to support lanman style printing with Win NT/2k
942 * clients --jerry
943 */
944 if (!mdrcnt && lp_disable_spoolss())
945 desc.errcode = ERRbuftoosmall;
946
947 out:
948 if (b && is_valid_policy_hnd(&handle)) {
949 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
950 }
951
952 *rdata_len = desc.usedlen;
953 *rparam_len = 6;
954 *rparam = smb_realloc_limit(*rparam,*rparam_len);
955 if (!*rparam) {
956 SAFE_FREE(tmpdata);
957 return False;
958 }
959 SSVALS(*rparam,0,desc.errcode);
960 SSVAL(*rparam,2,0);
961 SSVAL(*rparam,4,desc.neededlen);
962
963 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
964
965 SAFE_FREE(tmpdata);
966
967 return(True);
968 }
969
970 /****************************************************************************
971 View list of all print jobs on all queues.
972 ****************************************************************************/
973
974 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
975 connection_struct *conn, uint16 vuid,
976 char *param, int tpscnt,
977 char *data, int tdscnt,
978 int mdrcnt, int mprcnt,
979 char **rdata, char** rparam,
980 int *rdata_len, int *rparam_len)
981 {
982 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
983 char *output_format1 = skip_string(param,tpscnt,param_format);
984 char *p = skip_string(param,tpscnt,output_format1);
985 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
986 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
987 int i;
988 struct pack_desc desc;
989 int *subcntarr = NULL;
990 int queuecnt = 0, subcnt = 0, succnt = 0;
991
992 WERROR werr = WERR_OK;
993 TALLOC_CTX *mem_ctx = talloc_tos();
994 NTSTATUS status;
995 struct rpc_pipe_client *cli = NULL;
996 struct dcerpc_binding_handle *b = NULL;
997 struct spoolss_DevmodeContainer devmode_ctr;
998 uint32_t num_printers;
999 union spoolss_PrinterInfo *printer_info;
1000 union spoolss_DriverInfo *driver_info;
1001 union spoolss_JobInfo **job_info;
1002
1003 if (!param_format || !output_format1 || !p) {
1004 return False;
1005 }
1006
1007 memset((char *)&desc,'\0',sizeof(desc));
1008
1009 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1010
1011 if (!prefix_ok(param_format,"WrLeh")) {
1012 return False;
1013 }
1014 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1015 /*
1016 * Patch from Scott Moomaw <scott@bridgewater.edu>
1017 * to return the 'invalid info level' error if an
1018 * unknown level was requested.
1019 */
1020 *rdata_len = 0;
1021 *rparam_len = 6;
1022 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1023 if (!*rparam) {
1024 return False;
1025 }
1026 SSVALS(*rparam,0,ERRunknownlevel);
1027 SSVAL(*rparam,2,0);
1028 SSVAL(*rparam,4,0);
1029 return(True);
1030 }
1031
1032 status = rpc_pipe_open_interface(conn,
1033 &ndr_table_spoolss.syntax_id,
1034 conn->session_info,
1035 &conn->sconn->client_id,
1036 conn->sconn->msg_ctx,
1037 &cli);
1038 if (!NT_STATUS_IS_OK(status)) {
1039 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1040 nt_errstr(status)));
1041 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1042 goto out;
1043 }
1044 b = cli->binding_handle;
1045
1046 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1047 PRINTER_ENUM_LOCAL,
1048 cli->srv_name_slash,
1049 2,
1050 0,
1051 &num_printers,
1052 &printer_info);
1053 if (!W_ERROR_IS_OK(werr)) {
1054 desc.errcode = W_ERROR_V(werr);
1055 goto out;
1056 }
1057
1058 queuecnt = num_printers;
1059
1060 job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1061 if (job_info == NULL) {
1062 goto err;
1063 }
1064
1065 driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1066 if (driver_info == NULL) {
1067 goto err;
1068 }
1069
1070 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1071 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1072 goto err;
1073 }
1074
1075 if (mdrcnt > 0) {
1076 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1077 if (!*rdata) {
1078 goto err;
1079 }
1080 }
1081 desc.base = *rdata;
1082 desc.buflen = mdrcnt;
1083
1084 subcnt = 0;
1085 for (i = 0; i < num_printers; i++) {
1086
1087 uint32_t num_jobs;
1088 struct policy_handle handle;
1089 const char *printername;
1090
1091 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1092 if (printername == NULL) {
1093 goto err;
1094 }
1095
1096 ZERO_STRUCT(handle);
1097 ZERO_STRUCT(devmode_ctr);
1098
1099 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1100 printername,
1101 "RAW",
1102 devmode_ctr,
1103 PRINTER_ACCESS_USE,
1104 &handle,
1105 &werr);
1106 if (!NT_STATUS_IS_OK(status)) {
1107 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1108 goto out;
1109 }
1110 if (!W_ERROR_IS_OK(werr)) {
1111 desc.errcode = W_ERROR_V(werr);
1112 goto out;
1113 }
1114
1115 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1116 &handle,
1117 0, /* firstjob */
1118 0xff, /* numjobs */
1119 2, /* level */
1120 0, /* offered */
1121 &num_jobs,
1122 &job_info[i]);
1123 if (!W_ERROR_IS_OK(werr)) {
1124 desc.errcode = W_ERROR_V(werr);
1125 goto out;
1126 }
1127
1128 if (uLevel==52) {
1129 uint32_t server_major_version;
1130 uint32_t server_minor_version;
1131
1132 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1133 &handle,
1134 "Windows 4.0",
1135 3, /* level */
1136 0,
1137 0, /* version */
1138 0,
1139 &driver_info[i],
1140 &server_major_version,
1141 &server_minor_version);
1142 if (!W_ERROR_IS_OK(werr)) {
1143 desc.errcode = W_ERROR_V(werr);
1144 goto out;
1145 }
1146 }
1147
1148 subcntarr[i] = num_jobs;
1149 subcnt += subcntarr[i];
1150
1151 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1152 }
1153
1154 if (init_package(&desc,queuecnt,subcnt)) {
1155 for (i = 0; i < num_printers; i++) {
1156 fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1157 if (desc.errcode == NERR_Success) {
1158 succnt = i;
1159 }
1160 }
1161 }
1162
1163 SAFE_FREE(subcntarr);
1164 out:
1165 *rdata_len = desc.usedlen;
1166 *rparam_len = 8;
1167 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1168 if (!*rparam) {
1169 goto err;
1170 }
1171 SSVALS(*rparam,0,desc.errcode);
1172 SSVAL(*rparam,2,0);
1173 SSVAL(*rparam,4,succnt);
1174 SSVAL(*rparam,6,queuecnt);
1175
1176 return True;
1177
1178 err:
1179
1180 SAFE_FREE(subcntarr);
1181
1182 return False;
1183 }
1184
1185 /****************************************************************************
1186 Get info level for a server list query.
1187 ****************************************************************************/
1188
1189 static bool check_session_info(int uLevel, char* id)
1190 {
1191 switch( uLevel ) {
1192 case 0:
1193 if (strcmp(id,"B16") != 0) {
1194 return False;
1195 }
1196 break;
1197 case 1:
1198 if (strcmp(id,"B16BBDz") != 0) {
1199 return False;
1200 }
1201 break;
1202 default:
1203 return False;
1204 }
1205 return True;
1206 }
1207
1208 struct srv_info_struct {
1209 fstring name;
1210 uint32 type;
1211 fstring comment;
1212 fstring domain;
1213 bool server_added;
1214 };
1215
1216 /*******************************************************************
1217 Get server info lists from the files saved by nmbd. Return the
1218 number of entries.
1219 ******************************************************************/
1220
1221 static int get_session_info(uint32 servertype,
1222 struct srv_info_struct **servers,
1223 const char *domain)
1224 {
1225 int count=0;
1226 int alloced=0;
1227 char **lines;
1228 bool local_list_only;
1229 int i;
1230
1231 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1232 if (!lines) {
1233 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1234 return 0;
1235 }
1236
1237 /* request for everything is code for request all servers */
1238 if (servertype == SV_TYPE_ALL) {
1239 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1240 }
1241
1242 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1243
1244 DEBUG(4,("Servertype search: %8x\n",servertype));
1245
1246 for (i=0;lines[i];i++) {
1247 fstring stype;
1248 struct srv_info_struct *s;
1249 const char *ptr = lines[i];
1250 bool ok = True;
1251 TALLOC_CTX *frame = NULL;
1252 char *p;
1253
1254 if (!*ptr) {
1255 continue;
1256 }
1257
1258 if (count == alloced) {
1259 alloced += 10;
1260 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1261 if (!*servers) {
1262 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1263 TALLOC_FREE(lines);
1264 return 0;
1265 }
1266 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1267 }
1268 s = &(*servers)[count];
1269
1270 frame = talloc_stackframe();
1271 s->name[0] = '\0';
1272 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1273 TALLOC_FREE(frame);
1274 continue;
1275 }
1276 fstrcpy(s->name, p);
1277
1278 stype[0] = '\0';
1279 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1280 TALLOC_FREE(frame);
1281 continue;
1282 }
1283 fstrcpy(stype, p);
1284
1285 s->comment[0] = '\0';
1286 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1287 TALLOC_FREE(frame);
1288 continue;
1289 }
1290 fstrcpy(s->comment, p);
1291 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1292
1293 s->domain[0] = '\0';
1294 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1295 /* this allows us to cope with an old nmbd */
1296 fstrcpy(s->domain,lp_workgroup());
1297 } else {
1298 fstrcpy(s->domain, p);
1299 }
1300 TALLOC_FREE(frame);
1301
1302 if (sscanf(stype,"%X",&s->type) != 1) {
1303 DEBUG(4,("r:host file "));
1304 ok = False;
1305 }
1306
1307 /* Filter the servers/domains we return based on what was asked for. */
1308
1309 /* Check to see if we are being asked for a local list only. */
1310 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1311 DEBUG(4,("r: local list only"));
1312 ok = False;
1313 }
1314
1315 /* doesn't match up: don't want it */
1316 if (!(servertype & s->type)) {
1317 DEBUG(4,("r:serv type "));
1318 ok = False;
1319 }
1320
1321 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1322 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1323 DEBUG(4,("s: dom mismatch "));
1324 ok = False;
1325 }
1326
1327 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1328 ok = False;
1329 }
1330
1331 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1332 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1333
1334 if (ok) {
1335 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1336 s->name, s->type, s->comment, s->domain));
1337 s->server_added = True;
1338 count++;
1339 } else {
1340 DEBUG(4,("%20s %8x %25s %15s\n",
1341 s->name, s->type, s->comment, s->domain));
1342 }
1343 }
1344
1345 TALLOC_FREE(lines);
1346 return count;
1347 }
1348
1349 /*******************************************************************
1350 Fill in a server info structure.
1351 ******************************************************************/
1352
1353 static int fill_srv_info(struct srv_info_struct *service,
1354 int uLevel, char **buf, int *buflen,
1355 char **stringbuf, int *stringspace, char *baseaddr)
1356 {
1357 int struct_len;
1358 char* p;
1359 char* p2;
1360 int l2;
1361 int len;
1362
1363 switch (uLevel) {
1364 case 0:
1365 struct_len = 16;
1366 break;
1367 case 1:
1368 struct_len = 26;
1369 break;
1370 default:
1371 return -1;
1372 }
1373
1374 if (!buf) {
1375 len = 0;
1376 switch (uLevel) {
1377 case 1:
1378 len = strlen(service->comment)+1;
1379 break;
1380 }
1381
1382 *buflen = struct_len;
1383 *stringspace = len;
1384 return struct_len + len;
1385 }
1386
1387 len = struct_len;
1388 p = *buf;
1389 if (*buflen < struct_len) {
1390 return -1;
1391 }
1392 if (stringbuf) {
1393 p2 = *stringbuf;
1394 l2 = *stringspace;
1395 } else {
1396 p2 = p + struct_len;
1397 l2 = *buflen - struct_len;
1398 }
1399 if (!baseaddr) {
1400 baseaddr = p;
1401 }
1402
1403 switch (uLevel) {
1404 case 0:
1405 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1406 break;
1407
1408 case 1:
1409 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1410 SIVAL(p,18,service->type);
1411 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1412 len += CopyAndAdvance(&p2,service->comment,&l2);
1413 break;
1414 }
1415
1416 if (stringbuf) {
1417 *buf = p + struct_len;
1418 *buflen -= struct_len;
1419 *stringbuf = p2;
1420 *stringspace = l2;
1421 } else {
1422 *buf = p2;
1423 *buflen -= len;
1424 }
1425 return len;
1426 }
1427
1428
1429 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1430 {
1431 return StrCaseCmp(s1->name,s2->name);
1432 }
1433
1434 /****************************************************************************
1435 View list of servers available (or possibly domains). The info is
1436 extracted from lists saved by nmbd on the local host.
1437 ****************************************************************************/
1438
1439 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1440 connection_struct *conn, uint16 vuid,
1441 char *param, int tpscnt,
1442 char *data, int tdscnt,
1443 int mdrcnt, int mprcnt, char **rdata,
1444 char **rparam, int *rdata_len, int *rparam_len)
1445 {
1446 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1447 char *str2 = skip_string(param,tpscnt,str1);
1448 char *p = skip_string(param,tpscnt,str2);
1449 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1450 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1451 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1452 char *p2;
1453 int data_len, fixed_len, string_len;
1454 int f_len = 0, s_len = 0;
1455 struct srv_info_struct *servers=NULL;
1456 int counted=0,total=0;
1457 int i,missed;
1458 fstring domain;
1459 bool domain_request;
1460 bool local_request;
1461
1462 if (!str1 || !str2 || !p) {
1463 return False;
1464 }
1465
1466 /* If someone sets all the bits they don't really mean to set
1467 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1468 known servers. */
1469
1470 if (servertype == SV_TYPE_ALL) {
1471 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1472 }
1473
1474 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1475 any other bit (they may just set this bit on its own) they
1476 want all the locally seen servers. However this bit can be
1477 set on its own so set the requested servers to be
1478 ALL - DOMAIN_ENUM. */
1479
1480 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1481 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1482 }
1483
1484 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1485 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1486
1487 p += 8;
1488
1489 if (!prefix_ok(str1,"WrLehD")) {
1490 return False;
1491 }
1492 if (!check_session_info(uLevel,str2)) {
1493 return False;
1494 }
1495
1496 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1497 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1498 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1499
1500 if (strcmp(str1, "WrLehDz") == 0) {
1501 if (skip_string(param,tpscnt,p) == NULL) {
1502 return False;
1503 }
1504 pull_ascii_fstring(domain, p);
1505 } else {
1506 fstrcpy(domain, lp_workgroup());
1507 }
1508
1509 DEBUG(4, ("domain [%s]\n", domain));
1510
1511 if (lp_browse_list()) {
1512 total = get_session_info(servertype,&servers,domain);
1513 }
1514
1515 data_len = fixed_len = string_len = 0;
1516 missed = 0;
1517
1518 TYPESAFE_QSORT(servers, total, srv_comp);
1519
1520 {
1521 char *lastname=NULL;
1522
1523 for (i=0;i<total;i++) {
1524 struct srv_info_struct *s = &servers[i];
1525
1526 if (lastname && strequal(lastname,s->name)) {
1527 continue;
1528 }
1529 lastname = s->name;
1530 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1531 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1532 i, s->name, s->type, s->comment, s->domain));
1533
1534 if (data_len < buf_len) {
1535 counted++;
1536 fixed_len += f_len;
1537 string_len += s_len;
1538 } else {
1539 missed++;
1540 }
1541 }
1542 }
1543
1544 *rdata_len = fixed_len + string_len;
1545 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1546 if (!*rdata) {
1547 return False;
1548 }
1549
1550 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1551 p = *rdata;
1552 f_len = fixed_len;
1553 s_len = string_len;
1554
1555 {
1556 char *lastname=NULL;
1557 int count2 = counted;
1558
1559 for (i = 0; i < total && count2;i++) {
1560 struct srv_info_struct *s = &servers[i];
1561
1562 if (lastname && strequal(lastname,s->name)) {
1563 continue;
1564 }
1565 lastname = s->name;
1566 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1567 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1568 i, s->name, s->type, s->comment, s->domain));
1569 count2--;
1570 }
1571 }
1572
1573 *rparam_len = 8;
1574 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1575 if (!*rparam) {
1576 return False;
1577 }
1578 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1579 SSVAL(*rparam,2,0);
1580 SSVAL(*rparam,4,counted);
1581 SSVAL(*rparam,6,counted+missed);
1582
1583 SAFE_FREE(servers);
1584
1585 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1586 domain,uLevel,counted,counted+missed));
1587
1588 return True;
1589 }
1590
1591 static int srv_name_match(const char *n1, const char *n2)
1592 {
1593 /*
1594 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1595 *
1596 * In Windows, FirstNameToReturn need not be an exact match:
1597 * the server will return a list of servers that exist on
1598 * the network greater than or equal to the FirstNameToReturn.
1599 */
1600 int ret = StrCaseCmp(n1, n2);
1601
1602 if (ret <= 0) {
1603 return 0;
1604 }
1605
1606 return ret;
1607 }
1608
1609 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1610 connection_struct *conn, uint16 vuid,
1611 char *param, int tpscnt,
1612 char *data, int tdscnt,
1613 int mdrcnt, int mprcnt, char **rdata,
1614 char **rparam, int *rdata_len, int *rparam_len)
1615 {
1616 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1617 char *str2 = skip_string(param,tpscnt,str1);
1618 char *p = skip_string(param,tpscnt,str2);
1619 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1620 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1621 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1622 char *p2;
1623 int data_len, fixed_len, string_len;
1624 int f_len = 0, s_len = 0;
1625 struct srv_info_struct *servers=NULL;
1626 int counted=0,first=0,total=0;
1627 int i,missed;
1628 fstring domain;
1629 fstring first_name;
1630 bool domain_request;
1631 bool local_request;
1632
1633 if (!str1 || !str2 || !p) {
1634 return False;
1635 }
1636
1637 /* If someone sets all the bits they don't really mean to set
1638 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1639 known servers. */
1640
1641 if (servertype == SV_TYPE_ALL) {
1642 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1643 }
1644
1645 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1646 any other bit (they may just set this bit on its own) they
1647 want all the locally seen servers. However this bit can be
1648 set on its own so set the requested servers to be
1649 ALL - DOMAIN_ENUM. */
1650
1651 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1652 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1653 }
1654
1655 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1656 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1657
1658 p += 8;
1659
1660 if (strcmp(str1, "WrLehDzz") != 0) {
1661 return false;
1662 }
1663 if (!check_session_info(uLevel,str2)) {
1664 return False;
1665 }
1666
1667 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1668 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1669 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1670
1671 if (skip_string(param,tpscnt,p) == NULL) {
1672 return False;
1673 }
1674 pull_ascii_fstring(domain, p);
1675 if (domain[0] == '\0') {
1676 fstrcpy(domain, lp_workgroup());
1677 }
1678 p = skip_string(param,tpscnt,p);
1679 if (skip_string(param,tpscnt,p) == NULL) {
1680 return False;
1681 }
1682 pull_ascii_fstring(first_name, p);
1683
1684 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1685 domain, first_name));
1686
1687 if (lp_browse_list()) {
1688 total = get_session_info(servertype,&servers,domain);
1689 }
1690
1691 data_len = fixed_len = string_len = 0;
1692 missed = 0;
1693
1694 TYPESAFE_QSORT(servers, total, srv_comp);
1695
1696 if (first_name[0] != '\0') {
1697 struct srv_info_struct *first_server = NULL;
1698
1699 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1700 srv_name_match, first_server);
1701 if (first_server) {
1702 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1703 /*
1704 * The binary search may not find the exact match
1705 * so we need to search backward to find the first match
1706 *
1707 * This implements the strange matching windows
1708 * implements. (see the comment in srv_name_match().
1709 */
1710 for (;first > 0;) {
1711 int ret;
1712 ret = StrCaseCmp(first_name,
1713 servers[first-1].name);
1714 if (ret > 0) {
1715 break;
1716 }
1717 first--;
1718 }
1719 } else {
1720 /* we should return no entries */
1721 first = total;
1722 }
1723 }
1724
1725 {
1726 char *lastname=NULL;
1727
1728 for (i=first;i<total;i++) {
1729 struct srv_info_struct *s = &servers[i];
1730
1731 if (lastname && strequal(lastname,s->name)) {
1732 continue;
1733 }
1734 lastname = s->name;
1735 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1736 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1737 i, s->name, s->type, s->comment, s->domain));
1738
1739 if (data_len < buf_len) {
1740 counted++;
1741 fixed_len += f_len;
1742 string_len += s_len;
1743 } else {
1744 missed++;
1745 }
1746 }
1747 }
1748
1749 *rdata_len = fixed_len + string_len;
1750 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1751 if (!*rdata) {
1752 return False;
1753 }
1754
1755 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1756 p = *rdata;
1757 f_len = fixed_len;
1758 s_len = string_len;
1759
1760 {
1761 char *lastname=NULL;
1762 int count2 = counted;
1763
1764 for (i = first; i < total && count2;i++) {
1765 struct srv_info_struct *s = &servers[i];
1766
1767 if (lastname && strequal(lastname,s->name)) {
1768 continue;
1769 }
1770 lastname = s->name;
1771 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1772 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1773 i, s->name, s->type, s->comment, s->domain));
1774 count2--;
1775 }
1776 }
1777
1778 *rparam_len = 8;
1779 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1780 if (!*rparam) {
1781 return False;
1782 }
1783 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1784 SSVAL(*rparam,2,0);
1785 SSVAL(*rparam,4,counted);
1786 SSVAL(*rparam,6,counted+missed);
1787
1788 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1789 domain,uLevel,first,first_name,
1790 first < total ? servers[first].name : "",
1791 counted,counted+missed));
1792
1793 SAFE_FREE(servers);
1794
1795 return True;
1796 }
1797
1798 /****************************************************************************
1799 command 0x34 - suspected of being a "Lookup Names" stub api
1800 ****************************************************************************/
1801
1802 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1803 connection_struct *conn, uint16 vuid,
1804 char *param, int tpscnt,
1805 char *data, int tdscnt,
1806 int mdrcnt, int mprcnt, char **rdata,
1807 char **rparam, int *rdata_len, int *rparam_len)
1808 {
1809 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1810 char *str2 = skip_string(param,tpscnt,str1);
1811 char *p = skip_string(param,tpscnt,str2);
1812 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1813 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1814 int counted=0;
1815 int missed=0;
1816
1817 if (!str1 || !str2 || !p) {
1818 return False;
1819 }
1820
1821 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1822 str1, str2, p, uLevel, buf_len));
1823
1824 if (!prefix_ok(str1,"zWrLeh")) {
1825 return False;
1826 }
1827
1828 *rdata_len = 0;
1829
1830 *rparam_len = 8;
1831 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1832 if (!*rparam) {
1833 return False;
1834 }
1835
1836 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1837 SSVAL(*rparam,2,0);
1838 SSVAL(*rparam,4,counted);
1839 SSVAL(*rparam,6,counted+missed);
1840
1841 return True;
1842 }
1843
1844 /****************************************************************************
1845 get info about a share
1846 ****************************************************************************/
1847
1848 static bool check_share_info(int uLevel, char* id)
1849 {
1850 switch( uLevel ) {
1851 case 0:
1852 if (strcmp(id,"B13") != 0) {
1853 return False;
1854 }
1855 break;
1856 case 1:
1857 /* Level-2 descriptor is allowed (and ignored) */
1858 if (strcmp(id,"B13BWz") != 0 &&
1859 strcmp(id,"B13BWzWWWzB9B") != 0) {
1860 return False;
1861 }
1862 break;
1863 case 2:
1864 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1865 return False;
1866 }
1867 break;
1868 case 91:
1869 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1870 return False;
1871 }
1872 break;
1873 default:
1874 return False;
1875 }
1876 return True;
1877 }
1878
1879 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1880 char** buf, int* buflen,
1881 char** stringbuf, int* stringspace, char* baseaddr)
1882 {
1883 int struct_len;
1884 char* p;
1885 char* p2;
1886 int l2;
1887 int len;
1888
1889 switch( uLevel ) {
1890 case 0:
1891 struct_len = 13;
1892 break;
1893 case 1:
1894 struct_len = 20;
1895 break;
1896 case 2:
1897 struct_len = 40;
1898 break;
1899 case 91:
1900 struct_len = 68;
1901 break;
1902 default:
1903 return -1;
1904 }
1905
1906 if (!buf) {
1907 len = 0;
1908
1909 if (uLevel > 0) {
1910 len += StrlenExpanded(conn,snum,lp_comment(snum));
1911 }
1912 if (uLevel > 1) {
1913 len += strlen(lp_pathname(snum)) + 1;
1914 }
1915 if (buflen) {
1916 *buflen = struct_len;
1917 }
1918 if (stringspace) {
1919 *stringspace = len;
1920 }
1921 return struct_len + len;
1922 }
1923
1924 len = struct_len;
1925 p = *buf;
1926 if ((*buflen) < struct_len) {
1927 return -1;
1928 }
1929
1930 if (stringbuf) {
1931 p2 = *stringbuf;
1932 l2 = *stringspace;
1933 } else {
1934 p2 = p + struct_len;
1935 l2 = (*buflen) - struct_len;
1936 }
1937
1938 if (!baseaddr) {
1939 baseaddr = p;
1940 }
1941
1942 push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1943
1944 if (uLevel > 0) {
1945 int type;
1946
1947 SCVAL(p,13,0);
1948 type = STYPE_DISKTREE;
1949 if (lp_print_ok(snum)) {
1950 type = STYPE_PRINTQ;
1951 }
1952 if (strequal("IPC",lp_fstype(snum))) {
1953 type = STYPE_IPC;
1954 }
1955 SSVAL(p,14,type); /* device type */
1956 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1957 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1958 }
1959
1960 if (uLevel > 1) {
1961 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1962 SSVALS(p,22,-1); /* max uses */
1963 SSVAL(p,24,1); /* current uses */
1964 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1965 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1966 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1967 }
1968
1969 if (uLevel > 2) {
1970 memset(p+40,0,SHPWLEN+2);
1971 SSVAL(p,50,0);
1972 SIVAL(p,52,0);
1973 SSVAL(p,56,0);
1974 SSVAL(p,58,0);
1975 SIVAL(p,60,0);
1976 SSVAL(p,64,0);
1977 SSVAL(p,66,0);
1978 }
1979
1980 if (stringbuf) {
1981 (*buf) = p + struct_len;
1982 (*buflen) -= struct_len;
1983 (*stringbuf) = p2;
1984 (*stringspace) = l2;
1985 } else {
1986 (*buf) = p2;
1987 (*buflen) -= len;
1988 }
1989
1990 return len;
1991 }
1992
1993 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
1994 connection_struct *conn,uint16 vuid,
1995 char *param, int tpscnt,
1996 char *data, int tdscnt,
1997 int mdrcnt,int mprcnt,
1998 char **rdata,char **rparam,
1999 int *rdata_len,int *rparam_len)
2000 {
2001 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2002 char *str2 = skip_string(param,tpscnt,str1);
2003 char *netname_in = skip_string(param,tpscnt,str2);
2004 char *netname = NULL;
2005 char *p = skip_string(param,tpscnt,netname);
2006 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2007 int snum;
2008
2009 if (!str1 || !str2 || !netname || !p) {
2010 return False;
2011 }
2012
2013 snum = find_service(talloc_tos(), netname_in, &netname);
2014 if (snum < 0 || !netname) {
2015 return False;
2016 }
2017
2018 /* check it's a supported varient */
2019 if (!prefix_ok(str1,"zWrLh")) {
2020 return False;
2021 }
2022 if (!check_share_info(uLevel,str2)) {
2023 return False;
2024 }
2025
2026 *rdata = smb_realloc_limit(*rdata,mdrcnt);
2027 if (!*rdata) {
2028 return False;
2029 }
2030 p = *rdata;
2031 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2032 if (*rdata_len < 0) {
2033 return False;
2034 }
2035
2036 *rparam_len = 6;
2037 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2038 if (!*rparam) {
2039 return False;
2040 }
2041 SSVAL(*rparam,0,NERR_Success);
2042 SSVAL(*rparam,2,0); /* converter word */
2043 SSVAL(*rparam,4,*rdata_len);
2044
2045 return True;
2046 }
2047
2048 /****************************************************************************
2049 View the list of available shares.
2050
2051 This function is the server side of the NetShareEnum() RAP call.
2052 It fills the return buffer with share names and share comments.
2053 Note that the return buffer normally (in all known cases) allows only
2054 twelve byte strings for share names (plus one for a nul terminator).
2055 Share names longer than 12 bytes must be skipped.
2056 ****************************************************************************/
2057
2058 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2059 connection_struct *conn, uint16 vuid,
2060 char *param, int tpscnt,
2061 char *data, int tdscnt,
2062 int mdrcnt,
2063 int mprcnt,
2064 char **rdata,
2065 char **rparam,
2066 int *rdata_len,
2067 int *rparam_len )
2068 {
2069 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2070 char *str2 = skip_string(param,tpscnt,str1);
2071 char *p = skip_string(param,tpscnt,str2);
2072 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2073 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2074 char *p2;
2075 int count = 0;
2076 int total=0,counted=0;
2077 bool missed = False;
2078 int i;
2079 int data_len, fixed_len, string_len;
2080 int f_len = 0, s_len = 0;
2081
2082 if (!str1 || !str2 || !p) {
2083 return False;
2084 }
2085
2086 if (!prefix_ok(str1,"WrLeh")) {
2087 return False;
2088 }
2089 if (!check_share_info(uLevel,str2)) {
2090 return False;
2091 }
2092
2093 /* Ensure all the usershares are loaded. */
2094 become_root();
2095 load_registry_shares();
2096 count = load_usershare_shares();
2097 unbecome_root();
2098
2099 data_len = fixed_len = string_len = 0;
2100 for (i=0;i<count;i++) {
2101 fstring servicename_dos;
2102 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2103 continue;
2104 }
2105 push_ascii_fstring(servicename_dos, lp_servicename(i));
2106 /* Maximum name length = 13. */
2107 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2108 total++;
2109 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2110 if (data_len < buf_len) {
2111 counted++;
2112 fixed_len += f_len;
2113 string_len += s_len;
2114 } else {
2115 missed = True;
2116 }
2117 }
2118 }
2119
2120 *rdata_len = fixed_len + string_len;
2121 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2122 if (!*rdata) {
2123 return False;
2124 }
2125
2126 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2127 p = *rdata;
2128 f_len = fixed_len;
2129 s_len = string_len;
2130
2131 for( i = 0; i < count; i++ ) {
2132 fstring servicename_dos;
2133 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2134 continue;
2135 }
2136
2137 push_ascii_fstring(servicename_dos, lp_servicename(i));
2138 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2139 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2140 break;
2141 }
2142 }
2143 }
2144
2145 *rparam_len = 8;
2146 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2147 if (!*rparam) {
2148 return False;
2149 }
2150 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2151 SSVAL(*rparam,2,0);
2152 SSVAL(*rparam,4,counted);
2153 SSVAL(*rparam,6,total);
2154
2155 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2156 counted,total,uLevel,
2157 buf_len,*rdata_len,mdrcnt));
2158
2159 return True;
2160 }
2161
2162 /****************************************************************************
2163 Add a share
2164 ****************************************************************************/
2165
2166 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2167 connection_struct *conn,uint16 vuid,
2168 char *param, int tpscnt,
2169 char *data, int tdscnt,
2170 int mdrcnt,int mprcnt,
2171 char **rdata,char **rparam,
2172 int *rdata_len,int *rparam_len)
2173 {
2174 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2175 char *str2 = skip_string(param,tpscnt,str1);
2176 char *p = skip_string(param,tpscnt,str2);
2177 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2178 fstring sharename;
2179 fstring comment;
2180 char *pathname = NULL;
2181 unsigned int offset;
2182 int res = ERRunsup;
2183 size_t converted_size;
2184
2185 WERROR werr = WERR_OK;
2186 TALLOC_CTX *mem_ctx = talloc_tos();
2187 NTSTATUS status;
2188 struct rpc_pipe_client *cli = NULL;
2189 union srvsvc_NetShareInfo info;
2190 struct srvsvc_NetShareInfo2 info2;
2191 struct dcerpc_binding_handle *b;
2192
2193 if (!str1 || !str2 || !p) {
2194 return False;
2195 }
2196
2197 /* check it's a supported varient */
2198 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2199 return False;
2200 }
2201 if (!check_share_info(uLevel,str2)) {
2202 return False;
2203 }
2204 if (uLevel != 2) {
2205 return False;
2206 }
2207
2208 /* Do we have a string ? */
2209 if (skip_string(data,mdrcnt,data) == NULL) {
2210 return False;
2211 }
2212 pull_ascii_fstring(sharename,data);
2213
2214 if (mdrcnt < 28) {
2215 return False;
2216 }
2217
2218 /* only support disk share adds */
2219 if (SVAL(data,14)!=STYPE_DISKTREE) {
2220 return False;
2221 }
2222
2223 offset = IVAL(data, 16);
2224 if (offset >= mdrcnt) {
2225 res = ERRinvalidparam;
2226 goto out;
2227 }
2228
2229 /* Do we have a string ? */
2230 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2231 return False;
2232 }
2233 pull_ascii_fstring(comment, offset? (data+offset) : "");
2234
2235 offset = IVAL(data, 26);
2236
2237 if (offset >= mdrcnt) {
2238 res = ERRinvalidparam;
2239 goto out;
2240 }
2241
2242 /* Do we have a string ? */
2243 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2244 return False;
2245 }
2246
2247 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2248 offset ? (data+offset) : "", &converted_size))
2249 {
2250 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2251 strerror(errno)));
2252 }
2253
2254 if (!pathname) {
2255 return false;
2256 }
2257
2258 status = rpc_pipe_open_internal(mem_ctx, &ndr_table_srvsvc.syntax_id,
2259 conn->session_info,
2260 &conn->sconn->client_id,
2261 conn->sconn->msg_ctx,
2262 &cli);
2263 if (!NT_STATUS_IS_OK(status)) {
2264 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2265 nt_errstr(status)));
2266 res = W_ERROR_V(ntstatus_to_werror(status));
2267 goto out;
2268 }
2269
2270 b = cli->binding_handle;
2271
2272 info2.name = sharename;
2273 info2.type = STYPE_DISKTREE;
2274 info2.comment = comment;
2275 info2.permissions = 0;
2276 info2.max_users = 0;
2277 info2.current_users = 0;
2278 info2.path = pathname;
2279 info2.password = NULL;
2280
2281 info.info2 = &info2;
2282
2283 status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2284 cli->srv_name_slash,
2285 2,
2286 &info,
2287 NULL,
2288 &werr);
2289 if (!NT_STATUS_IS_OK(status)) {
2290 res = W_ERROR_V(ntstatus_to_werror(status));
2291 goto out;
2292 }
2293 if (!W_ERROR_IS_OK(werr)) {
2294 res = W_ERROR_V(werr);
2295 goto out;
2296 }
2297
2298 *rparam_len = 6;
2299 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2300 if (!*rparam) {
2301 return False;
2302 }
2303 SSVAL(*rparam,0,NERR_Success);
2304 SSVAL(*rparam,2,0); /* converter word */
2305 SSVAL(*rparam,4,*rdata_len);
2306 *rdata_len = 0;
2307
2308 return True;
2309
2310 out:
2311
2312 *rparam_len = 4;
2313 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2314 if (!*rparam) {
2315 return False;
2316 }
2317 *rdata_len = 0;
2318 SSVAL(*rparam,0,res);
2319 SSVAL(*rparam,2,0);
2320 return True;
2321 }
2322
2323 /****************************************************************************
2324 view list of groups available
2325 ****************************************************************************/
2326
2327 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2328 connection_struct *conn,uint16 vuid,
2329 char *param, int tpscnt,
2330 char *data, int tdscnt,
2331 int mdrcnt,int mprcnt,
2332 char **rdata,char **rparam,
2333 int *rdata_len,int *rparam_len)
2334 {
2335 int i;
2336 int errflags=0;
2337 int resume_context, cli_buf_size;
2338 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2339 char *str2 = skip_string(param,tpscnt,str1);
2340 char *p = skip_string(param,tpscnt,str2);
2341
2342 uint32_t num_groups;
2343 uint32_t resume_handle;
2344 struct rpc_pipe_client *samr_pipe;
2345 struct policy_handle samr_handle, domain_handle;
2346 NTSTATUS status, result;
2347 struct dcerpc_binding_handle *b;
2348
2349 if (!str1 || !str2 || !p) {
2350 return False;
2351 }
2352
2353 if (strcmp(str1,"WrLeh") != 0) {
2354 return False;
2355 }
2356
2357 /* parameters
2358 * W-> resume context (number of users to skip)
2359 * r -> return parameter pointer to receive buffer
2360 * L -> length of receive buffer
2361 * e -> return parameter number of entries
2362 * h -> return parameter total number of users
2363 */
2364
2365 if (strcmp("B21",str2) != 0) {
2366 return False;
2367 }
2368
2369 status = rpc_pipe_open_internal(
2370 talloc_tos(), &ndr_table_samr.syntax_id,
2371 conn->session_info, &conn->sconn->client_id,
2372 conn->sconn->msg_ctx, &samr_pipe);
2373 if (!NT_STATUS_IS_OK(status)) {
2374 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2375 nt_errstr(status)));
2376 return false;
2377 }
2378
2379 b = samr_pipe->binding_handle;
2380
2381 status = dcerpc_samr_Connect2(b, talloc_tos(), global_myname(),
2382 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2383 &result);
2384 if (!NT_STATUS_IS_OK(status)) {
2385 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2386 nt_errstr(status)));
2387 return false;
2388 }
2389 if (!NT_STATUS_IS_OK(result)) {
2390 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2391 nt_errstr(result)));
2392 return false;
2393 }
2394
2395 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2396 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2397 get_global_sam_sid(), &domain_handle,
2398 &result);
2399 if (!NT_STATUS_IS_OK(status)) {
2400 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2401 nt_errstr(status)));
2402 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2403 return false;
2404 }
2405 if (!NT_STATUS_IS_OK(result)) {
2406 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2407 nt_errstr(result)));
2408 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2409 return false;
2410 }
2411
2412 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2413 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2414 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2415 "%d\n", resume_context, cli_buf_size));
2416
2417 *rdata_len = cli_buf_size;
2418 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2419 if (!*rdata) {
2420 return False;
2421 }
2422
2423 p = *rdata;
2424
2425 errflags = NERR_Success;
2426 num_groups = 0;
2427 resume_handle = 0;
2428
2429 while (true) {
2430 struct samr_SamArray *sam_entries;
2431 uint32_t num_entries;
2432
2433 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2434 &domain_handle,
2435 &resume_handle,
2436 &sam_entries, 1,
2437 &num_entries,
2438 &result);
2439 if (!NT_STATUS_IS_OK(status)) {
2440 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2441 "%s\n", nt_errstr(status)));
2442 break;
2443 }
2444 if (!NT_STATUS_IS_OK(result)) {
2445 status = result;
2446 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2447 "%s\n", nt_errstr(result)));
2448 break;
2449 }
2450
2451 if (num_entries == 0) {
2452 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2453 "no entries -- done\n"));
2454 break;
2455 }
2456
2457 for(i=0; i<num_entries; i++) {
2458 const char *name;
2459
2460 name = sam_entries->entries[i].name.string;
2461
2462 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2463 /* set overflow error */
2464 DEBUG(3,("overflow on entry %d group %s\n", i,
2465 name));
2466 errflags=234;
2467 break;
2468 }
2469
2470 /* truncate the name at 21 chars. */
2471 memset(p, 0, 21);
2472 strlcpy(p, name, 21);
2473 DEBUG(10,("adding entry %d group %s\n", i, p));
2474 p += 21;
2475 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2476 * idea why... */
2477 num_groups += 1;
2478 }
2479
2480 if (errflags != NERR_Success) {
2481 break;
2482 }
2483
2484 TALLOC_FREE(sam_entries);
2485 }
2486
2487 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2488 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2489
2490 *rdata_len = PTR_DIFF(p,*rdata);
2491
2492 *rparam_len = 8;
2493 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2494 if (!*rparam) {
2495 return False;
2496 }
2497 SSVAL(*rparam, 0, errflags);
2498 SSVAL(*rparam, 2, 0); /* converter word */
2499 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2500 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2501
2502 return(True);
2503 }
2504
2505 /*******************************************************************
2506 Get groups that a user is a member of.
2507 ******************************************************************/
2508
2509 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2510 connection_struct *conn,uint16 vuid,
2511 char *param, int tpscnt,
2512 char *data, int tdscnt,
2513 int mdrcnt,int mprcnt,
2514 char **rdata,char **rparam,
2515 int *rdata_len,int *rparam_len)
2516 {
2517 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2518 char *str2 = skip_string(param,tpscnt,str1);
2519 char *UserName = skip_string(param,tpscnt,str2);
2520 char *p = skip_string(param,tpscnt,UserName);
2521 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2522 const char *level_string;
2523 int count=0;
2524 bool ret = False;
2525 uint32_t i;
2526 char *endp = NULL;
2527
2528 struct rpc_pipe_client *samr_pipe;
2529 struct policy_handle samr_handle, domain_handle, user_handle;
2530 struct lsa_String name;
2531 struct lsa_Strings names;
2532 struct samr_Ids type, rid;
2533 struct samr_RidWithAttributeArray *rids;
2534 NTSTATUS status, result;
2535 struct dcerpc_binding_handle *b;
2536
2537 if (!str1 || !str2 || !UserName || !p) {
2538 return False;
2539 }
2540
2541 *rparam_len = 8;
2542 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2543 if (!*rparam) {
2544 return False;
2545 }
2546
2547 /* check it's a supported varient */
2548
2549 if ( strcmp(str1,"zWrLeh") != 0 )
2550 return False;
2551
2552 switch( uLevel ) {
2553 case 0:
2554 level_string = "B21";
2555 break;
2556 default:
2557 return False;
2558 }
2559
2560 if (strcmp(level_string,str2) != 0)
2561 return False;
2562
2563 *rdata_len = mdrcnt + 1024;
2564 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2565 if (!*rdata) {
2566 return False;
2567 }
2568
2569 SSVAL(*rparam,0,NERR_Success);
2570 SSVAL(*rparam,2,0); /* converter word */
2571
2572 p = *rdata;
2573 endp = *rdata + *rdata_len;
2574
2575 status = rpc_pipe_open_internal(
2576 talloc_tos(), &ndr_table_samr.syntax_id,
2577 conn->session_info, &conn->sconn->client_id,
2578 conn->sconn->msg_ctx, &samr_pipe);
2579 if (!NT_STATUS_IS_OK(status)) {
2580 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2581 nt_errstr(status)));
2582 return false;
2583 }
2584
2585 b = samr_pipe->binding_handle;
2586
2587 status = dcerpc_samr_Connect2(b, talloc_tos(), global_myname(),
2588 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2589 &result);
2590 if (!NT_STATUS_IS_OK(status)) {
2591 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2592 nt_errstr(status)));
2593 return false;
2594 }
2595 if (!NT_STATUS_IS_OK(result)) {
2596 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2597 nt_errstr(result)));
2598 return false;
2599 }
2600
2601 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2602 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2603 get_global_sam_sid(), &domain_handle,
2604 &result);
2605 if (!NT_STATUS_IS_OK(status)) {
2606 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2607 nt_errstr(status)));
2608 goto close_sam;
2609 }
2610 if (!NT_STATUS_IS_OK(result)) {
2611 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2612 nt_errstr(result)));
2613 goto close_sam;
2614 }
2615
2616 name.string = UserName;
2617
2618 status = dcerpc_samr_LookupNames(b, talloc_tos(),
2619 &domain_handle, 1, &name,
2620 &rid, &type,
2621 &result);
2622 if (!NT_STATUS_IS_OK(status)) {
2623 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2624 nt_errstr(status)));
2625 goto close_domain;
2626 }
2627 if (!NT_STATUS_IS_OK(result)) {
2628 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2629 nt_errstr(result)));
2630 goto close_domain;
2631 }
2632
2633 if (type.ids[0] != SID_NAME_USER) {
2634 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2635 sid_type_lookup(type.ids[0])));
2636 goto close_domain;
2637 }
2638
2639 status = dcerpc_samr_OpenUser(b, talloc_tos(),
2640 &domain_handle,
2641 SAMR_USER_ACCESS_GET_GROUPS,
2642 rid.ids[0], &user_handle,
2643 &result);
2644 if (!NT_STATUS_IS_OK(status)) {
2645 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2646 nt_errstr(status)));
2647 goto close_domain;
2648 }
2649 if (!NT_STATUS_IS_OK(result)) {
2650 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2651 nt_errstr(result)));
2652 goto close_domain;
2653 }
2654
2655 status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2656 &user_handle, &rids,
2657 &result);
2658 if (!NT_STATUS_IS_OK(status)) {
2659 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2660 nt_errstr(status)));
2661 goto close_user;
2662 }
2663 if (!NT_STATUS_IS_OK(result)) {
2664 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2665 nt_errstr(result)));
2666 goto close_user;
2667 }
2668
2669 for (i=0; i<rids->count; i++) {
2670
2671 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2672 &domain_handle,
2673 1, &rids->rids[i].rid,
2674 &names, &type,
2675 &result);
2676 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2677 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2678 p += 21;
2679 count++;
2680 }
2681 }
2682
2683 *rdata_len = PTR_DIFF(p,*rdata);
2684
2685 SSVAL(*rparam,4,count); /* is this right?? */
2686 SSVAL(*rparam,6,count); /* is this right?? */
2687
2688 ret = True;
2689
2690 close_user:
2691 dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2692 close_domain:
2693 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2694 close_sam:
2695 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2696
2697 return ret;
2698 }
2699
2700 /*******************************************************************
2701 Get all users.
2702 ******************************************************************/
2703
2704 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2705 connection_struct *conn, uint16 vuid,
2706 char *param, int tpscnt,
2707 char *data, int tdscnt,
2708 int mdrcnt,int mprcnt,
2709 char **rdata,char **rparam,
2710 int *rdata_len,int *rparam_len)
2711 {
2712 int count_sent=0;
2713 int num_users=0;
2714 int errflags=0;
2715 int i, resume_context, cli_buf_size;
2716 uint32_t resume_handle;
2717
2718 struct rpc_pipe_client *samr_pipe;
2719 struct policy_handle samr_handle, domain_handle;
2720 NTSTATUS status, result;
2721
2722 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2723 char *str2 = skip_string(param,tpscnt,str1);
2724 char *p = skip_string(param,tpscnt,str2);
2725 char *endp = NULL;
2726
2727 struct dcerpc_binding_handle *b;
2728
2729 if (!str1 || !str2 || !p) {
2730 return False;
2731 }
2732
2733 if (strcmp(str1,"WrLeh") != 0)
2734 return False;
2735 /* parameters
2736 * W-> resume context (number of users to skip)
2737 * r -> return parameter pointer to receive buffer
2738 * L -> length of receive buffer
2739 * e -> return parameter number of entries
2740 * h -> return parameter total number of users
2741 */
2742
2743 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2744 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2745 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2746 resume_context, cli_buf_size));
2747
2748 *rparam_len = 8;
2749 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2750 if (!*rparam) {
2751 return False;
2752 }
2753
2754 /* check it's a supported varient */
2755 if (strcmp("B21",str2) != 0)
2756 return False;
2757
2758 *rdata_len = cli_buf_size;
2759 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2760 if (!*rdata) {
2761 return False;
2762 }
2763
2764 p = *rdata;
2765 endp = *rdata + *rdata_len;
2766
2767 status = rpc_pipe_open_internal(
2768 talloc_tos(), &ndr_table_samr.syntax_id,
2769 conn->session_info, &conn->sconn->client_id,
2770 conn->sconn->msg_ctx, &samr_pipe);
2771 if (!NT_STATUS_IS_OK(status)) {
2772 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2773 nt_errstr(status)));
2774 return false;
2775 }
2776
2777 b = samr_pipe->binding_handle;
2778
2779 status = dcerpc_samr_Connect2(b, talloc_tos(), global_myname(),
2780 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2781 &result);
2782 if (!NT_STATUS_IS_OK(status)) {
2783 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2784 nt_errstr(status)));
2785 return false;
2786 }
2787 if (!NT_STATUS_IS_OK(result)) {
2788 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2789 nt_errstr(result)));
2790 return false;
2791 }
2792
2793 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2794 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2795 get_global_sam_sid(), &domain_handle,
2796 &result);
2797 if (!NT_STATUS_IS_OK(status)) {
2798 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2799 nt_errstr(status)));
2800 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2801 return false;
2802 }
2803 if (!NT_STATUS_IS_OK(result)) {
2804 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2805 nt_errstr(result)));
2806 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2807 return false;
2808 }
2809
2810 errflags=NERR_Success;
2811
2812 resume_handle = 0;
2813
2814 while (true) {
2815 struct samr_SamArray *sam_entries;
2816 uint32_t num_entries;
2817
2818 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2819 &domain_handle,
2820 &resume_handle,
2821 0, &sam_entries, 1,
2822 &num_entries,
2823 &result);
2824
2825 if (!NT_STATUS_IS_OK(status)) {
2826 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2827 "%s\n", nt_errstr(status)));
2828 break;
2829 }
2830 if (!NT_STATUS_IS_OK(result)) {
2831 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2832 "%s\n", nt_errstr(result)));
2833 break;
2834 }
2835
2836 if (num_entries == 0) {
2837 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2838 "no entries -- done\n"));
2839 break;
2840 }
2841
2842 for (i=0; i<num_entries; i++) {
2843 const char *name;
2844
2845 name = sam_entries->entries[i].name.string;
2846
2847 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2848 &&(strlen(name)<=21)) {
2849 strlcpy(p,name,PTR_DIFF(endp,p));
2850 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2851 "username %s\n",count_sent,p));
2852 p += 21;
2853 count_sent++;
2854 } else {
2855 /* set overflow error */
2856 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2857 "username %s\n",count_sent,name));
2858 errflags=234;
2859 break;
2860 }
2861 }
2862
2863 if (errflags != NERR_Success) {
2864 break;
2865 }
2866
2867 TALLOC_FREE(sam_entries);
2868 }
2869
2870 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2871 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2872
2873 *rdata_len = PTR_DIFF(p,*rdata);
2874
2875 SSVAL(*rparam,0,errflags);
2876 SSVAL(*rparam,2,0); /* converter word */
2877 SSVAL(*rparam,4,count_sent); /* is this right?? */
2878 SSVAL(*rparam,6,num_users); /* is this right?? */
2879
2880 return True;
2881 }
2882
2883 /****************************************************************************
2884 Get the time of day info.
2885 ****************************************************************************/
2886
2887 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2888 connection_struct *conn,uint16 vuid,
2889 char *param, int tpscnt,
2890 char *data, int tdscnt,
2891 int mdrcnt,int mprcnt,
2892 char **rdata,char **rparam,
2893 int *rdata_len,int *rparam_len)
2894 {
2895 struct tm *t;
2896 time_t unixdate = time(NULL);
2897 char *p;
2898
2899 *rparam_len = 4;
2900 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2901 if (!*rparam) {
2902 return False;
2903 }
2904
2905 *rdata_len = 21;
2906 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2907 if (!*rdata) {
2908 return False;
2909 }
2910
2911 SSVAL(*rparam,0,NERR_Success);
2912 SSVAL(*rparam,2,0); /* converter word */
2913
2914 p = *rdata;
2915
2916 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2917 by NT in a "net time" operation,
2918 it seems to ignore the one below */
2919
2920 /* the client expects to get localtime, not GMT, in this bit
2921 (I think, this needs testing) */
2922 t = localtime(&unixdate);
2923 if (!t) {
2924 return False;
2925 }
2926
2927 SIVAL(p,4,0); /* msecs ? */
2928 SCVAL(p,8,t->tm_hour);
2929 SCVAL(p,9,t->tm_min);
2930 SCVAL(p,10,t->tm_sec);
2931 SCVAL(p,11,0); /* hundredths of seconds */
2932 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2933 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2934 SCVAL(p,16,t->tm_mday);
2935 SCVAL(p,17,t->tm_mon + 1);
2936 SSVAL(p,18,1900+t->tm_year);
2937 SCVAL(p,20,t->tm_wday);
2938
2939 return True;
2940 }
2941
2942 /****************************************************************************
2943 Set the user password.
2944 *****************************************************************************/
2945
2946 static bool api_SetUserPassword(struct smbd_server_connection *sconn,
2947 connection_struct *conn,uint16 vuid,
2948 char *param, int tpscnt,
2949 char *data, int tdscnt,
2950 int mdrcnt,int mprcnt,
2951 char **rdata,char **rparam,
2952 int *rdata_len,int *rparam_len)
2953 {
2954 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2955 char *p = NULL;
2956 fstring user;
2957 fstring pass1,pass2;
2958 TALLOC_CTX *mem_ctx = talloc_tos();
2959 NTSTATUS status, result;
2960 struct rpc_pipe_client *cli = NULL;
2961 struct policy_handle connect_handle, domain_handle, user_handle;
2962 struct lsa_String domain_name;
2963 struct dom_sid2 *domain_sid;
2964 struct lsa_String names;
2965 struct samr_Ids rids;
2966 struct samr_Ids types;
2967 struct samr_Password old_lm_hash;
2968 struct samr_Password new_lm_hash;
2969 int errcode = NERR_badpass;
2970 uint32_t rid;
2971 int encrypted;
2972 int min_pwd_length;
2973 struct dcerpc_binding_handle *b = NULL;
2974
2975 /* Skip 2 strings. */
2976 p = skip_string(param,tpscnt,np);
2977 p = skip_string(param,tpscnt,p);
2978
2979 if (!np || !p) {
2980 return False;
2981 }
2982
2983 /* Do we have a string ? */
2984 if (skip_string(param,tpscnt,p) == NULL) {
2985 return False;
2986 }
2987 pull_ascii_fstring(user,p);
2988
2989 p = skip_string(param,tpscnt,p);
2990 if (!p) {
2991 return False;
2992 }
2993
2994 memset(pass1,'\0',sizeof(pass1));
2995 memset(pass2,'\0',sizeof(pass2));
2996 /*
2997 * We use 31 here not 32 as we're checking
2998 * the last byte we want to access is safe.
2999 */
3000 if (!is_offset_safe(param,tpscnt,p,31)) {
3001 return False;
3002 }
3003 memcpy(pass1,p,16);
3004 memcpy(pass2,p+16,16);
3005
3006 encrypted = get_safe_SVAL(param,tpscnt,p+32,0,-1);
3007 if (encrypted == -1) {
3008 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3009 goto out;
3010 }
3011
3012 min_pwd_length = get_safe_SVAL(param,tpscnt,p+34,0,-1);
3013 if (min_pwd_length == -1) {
3014 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3015 goto out;
3016 }
3017
3018 *rparam_len = 4;
3019 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3020 if (!*rparam) {
3021 return False;
3022 }
3023
3024 *rdata_len = 0;
3025
3026 DEBUG(3,("Set password for <%s> (encrypted: %d, min_pwd_length: %d)\n",
3027 user, encrypted, min_pwd_length));
3028
3029 ZERO_STRUCT(connect_handle);
3030 ZERO_STRUCT(domain_handle);
3031 ZERO_STRUCT(user_handle);
3032
3033 status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
3034 conn->session_info,
3035 &conn->sconn->client_id,
3036 conn->sconn->msg_ctx,
3037 &cli);
3038 if (!NT_STATUS_IS_OK(status)) {
3039 DEBUG(0,("api_SetUserPassword: could not connect to samr: %s\n",
3040 nt_errstr(status)));
3041 errcode = W_ERROR_V(ntstatus_to_werror(status));
3042 goto out;
3043 }
3044
3045 b = cli->binding_handle;
3046
3047 status = dcerpc_samr_Connect2(b, mem_ctx,
3048 global_myname(),
3049 SAMR_ACCESS_CONNECT_TO_SERVER |
3050 SAMR_ACCESS_ENUM_DOMAINS |
3051 SAMR_ACCESS_LOOKUP_DOMAIN,
3052 &connect_handle,
3053 &result);
3054 if (!NT_STATUS_IS_OK(status)) {
3055 errcode = W_ERROR_V(ntstatus_to_werror(status));
3056 goto out;
3057 }
3058 if (!NT_STATUS_IS_OK(result)) {
3059 errcode = W_ERROR_V(ntstatus_to_werror(result));
3060 goto out;
3061 }
3062
3063 init_lsa_String(&domain_name, get_global_sam_name());
3064
3065 status = dcerpc_samr_LookupDomain(b, mem_ctx,
3066 &connect_handle,
3067 &domain_name,
3068 &domain_sid,
3069 &result);
3070 if (!NT_STATUS_IS_OK(status)) {
3071 errcode = W_ERROR_V(ntstatus_to_werror(status));
3072 goto out;
3073 }
3074 if (!NT_STATUS_IS_OK(result)) {
3075 errcode = W_ERROR_V(ntstatus_to_werror(result));
3076 goto out;
3077 }
3078
3079 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3080 &connect_handle,
3081 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
3082 domain_sid,
3083 &domain_handle,
3084 &result);
3085 if (!NT_STATUS_IS_OK(status)) {
3086 errcode = W_ERROR_V(ntstatus_to_werror(status));
3087 goto out;
3088 }
3089 if (!NT_STATUS_IS_OK(result)) {
3090 errcode = W_ERROR_V(ntstatus_to_werror(result));
3091 goto out;
3092 }
3093
3094 init_lsa_String(&names, user);
3095
3096 status = dcerpc_samr_LookupNames(b, mem_ctx,
3097 &domain_handle,
3098 1,
3099 &names,
3100 &rids,
3101 &types,
3102 &result);
3103 if (!NT_STATUS_IS_OK(status)) {
3104 errcode = W_ERROR_V(ntstatus_to_werror(status));
3105 goto out;
3106 }
3107 if (!NT_STATUS_IS_OK(result)) {
3108 errcode = W_ERROR_V(ntstatus_to_werror(result));
3109 goto out;
3110 }
3111
3112 if (rids.count != 1) {
3113 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
3114 goto out;
3115 }
3116 if (rids.count != types.count) {
3117 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3118 goto out;
3119 }
3120 if (types.ids[0] != SID_NAME_USER) {
3121 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3122 goto out;
3123 }
3124
3125 rid = rids.ids[0];
3126
3127 status = dcerpc_samr_OpenUser(b, mem_ctx,
3128 &domain_handle,
3129 SAMR_USER_ACCESS_CHANGE_PASSWORD,
3130 rid,
3131 &user_handle,
3132 &result);
3133 if (!NT_STATUS_IS_OK(status)) {
3134 errcode = W_ERROR_V(ntstatus_to_werror(status));
3135 goto out;
3136 }
3137 if (!NT_STATUS_IS_OK(result)) {
3138 errcode = W_ERROR_V(ntstatus_to_werror(result));
3139 goto out;
3140 }
3141
3142 if (encrypted == 0) {
3143 E_deshash(pass1, old_lm_hash.hash);
3144 E_deshash(pass2, new_lm_hash.hash);
3145 } else {
3146 ZERO_STRUCT(old_lm_hash);
3147 ZERO_STRUCT(new_lm_hash);
3148 memcpy(old_lm_hash.hash, pass1, MIN(strlen(pass1), 16));
3149 memcpy(new_lm_hash.hash, pass1, MIN(strlen(pass2), 16));
3150 }
3151
3152 status = dcerpc_samr_ChangePasswordUser(b, mem_ctx,
3153 &user_handle,
3154 true, /* lm_present */
3155 &old_lm_hash,
3156 &new_lm_hash,
3157 false, /* nt_present */
3158 NULL, /* old_nt_crypted */
3159 NULL, /* new_nt_crypted */
3160 false, /* cross1_present */
3161 NULL, /* nt_cross */
3162 false, /* cross2_present */
3163 NULL, /* lm_cross */
3164 &result);
3165 if (!NT_STATUS_IS_OK(status)) {
3166 errcode = W_ERROR_V(ntstatus_to_werror(status));
3167 goto out;
3168 }
3169 if (!NT_STATUS_IS_OK(result)) {
3170 errcode = W_ERROR_V(ntstatus_to_werror(result));
3171 goto out;
3172 }
3173
3174 errcode = NERR_Success;
3175 out:
3176
3177 if (b && is_valid_policy_hnd(&user_handle)) {
3178 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
3179 }
3180 if (b && is_valid_policy_hnd(&domain_handle)) {
3181 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
3182 }
3183 if (b && is_valid_policy_hnd(&connect_handle)) {
3184 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
3185 }
3186
3187 memset((char *)pass1,'\0',sizeof(fstring));
3188 memset((char *)pass2,'\0',sizeof(fstring));
3189
3190 SSVAL(*rparam,0,errcode);
3191 SSVAL(*rparam,2,0); /* converter word */
3192 return(True);
3193 }
3194
3195 /****************************************************************************
3196 Set the user password (SamOEM version - gets plaintext).
3197 ****************************************************************************/
3198
3199 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
3200 connection_struct *conn,uint16 vuid,
3201 char *param, int tpscnt,
3202 char *data, int tdscnt,
3203 int mdrcnt,int mprcnt,
3204 char **rdata,char **rparam,
3205 int *rdata_len,int *rparam_len)
3206 {
3207 fstring user;
3208 char *p = get_safe_str_ptr(param,tpscnt,param,2);
3209
3210 TALLOC_CTX *mem_ctx = talloc_tos();
3211 NTSTATUS status, result;
3212 struct rpc_pipe_client *cli = NULL;
3213 struct lsa_AsciiString server, account;
3214 struct samr_CryptPassword password;
3215 struct samr_Password hash;
3216 int errcode = NERR_badpass;
3217 int bufsize;
3218 struct dcerpc_binding_handle *b;
3219
3220 *rparam_len = 4;
3221 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3222 if (!*rparam) {
3223 return False;
3224 }
3225
3226 if (!p) {
3227 return False;
3228 }
3229 *rdata_len = 0;
3230
3231 SSVAL(*rparam,0,NERR_badpass);
3232
3233 /*
3234 * Check the parameter definition is correct.
3235 */
3236
3237 /* Do we have a string ? */
3238 if (skip_string(param,tpscnt,p) == 0) {
3239 return False;
3240 }
3241 if(!strequal(p, "zsT")) {
3242 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
3243 return False;
3244 }
3245 p = skip_string(param, tpscnt, p);
3246 if (!p) {
3247 return False;
3248 }
3249
3250 /* Do we have a string ? */
3251 if (skip_string(param,tpscnt,p) == 0) {
3252 return False;
3253 }
3254 if(!strequal(p, "B516B16")) {
3255 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3256 return False;
3257 }
3258 p = skip_string(param,tpscnt,p);
3259 if (!p) {
3260 return False;
3261 }
3262 /* Do we have a string ? */
3263 if (skip_string(param,tpscnt,p) == 0) {
3264 return False;
3265 }
3266 p += pull_ascii_fstring(user,p);
3267
3268 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3269
3270 if (tdscnt != 532) {
3271 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3272 goto out;
3273 }
3274
3275 bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3276 if (bufsize != 532) {
3277 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3278 goto out;
3279 }
3280
3281 memcpy(password.data, data, 516);
3282 memcpy(hash.hash, data+516, 16);
3283
3284 status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
3285 conn->session_info,
3286 &conn->sconn->client_id,
3287 conn->sconn->msg_ctx,
3288 &cli);
3289 if (!NT_STATUS_IS_OK(status)) {
3290 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3291 nt_errstr(status)));
3292 errcode = W_ERROR_V(ntstatus_to_werror(status));
3293 goto out;
3294 }
3295
3296 b = cli->binding_handle;
3297
3298 init_lsa_AsciiString(&server, global_myname());
3299 init_lsa_AsciiString(&account, user);
3300
3301 status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3302 &server,
3303 &account,
3304 &password,
3305 &hash,
3306 &result);
3307 if (!NT_STATUS_IS_OK(status)) {
3308 errcode = W_ERROR_V(ntstatus_to_werror(status));
3309 goto out;
3310 }
3311 if (!NT_STATUS_IS_OK(result)) {
3312 errcode = W_ERROR_V(ntstatus_to_werror(result));
3313 goto out;
3314 }
3315
3316 errcode = NERR_Success;
3317 out:
3318 SSVAL(*rparam,0,errcode);
3319 SSVAL(*rparam,2,0); /* converter word */
3320
3321 return(True);
3322 }
3323
3324 /****************************************************************************
3325 delete a print job
3326 Form: <W> <>
3327 ****************************************************************************/
3328
3329 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3330 connection_struct *conn,uint16 vuid,
3331 char *param, int tpscnt,
3332 char *data, int tdscnt,
3333 int mdrcnt,int mprcnt,
3334 char **rdata,char **rparam,
3335 int *rdata_len,int *rparam_len)
3336 {
3337 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3338 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3339 char *str2 = skip_string(param,tpscnt,str1);
3340 char *p = skip_string(param,tpscnt,str2);
3341 uint32 jobid;
3342 fstring sharename;
3343 int errcode;
3344 WERROR werr = WERR_OK;
3345
3346 TALLOC_CTX *mem_ctx = talloc_tos();
3347 NTSTATUS status;
3348 struct rpc_pipe_client *cli = NULL;
3349 struct dcerpc_binding_handle *b = NULL;
3350 struct policy_handle handle;
3351 struct spoolss_DevmodeContainer devmode_ctr;
3352 enum spoolss_JobControl command;
3353
3354 if (!str1 || !str2 || !p) {
3355 return False;
3356 }
3357 /*
3358 * We use 1 here not 2 as we're checking
3359 * the last byte we want to access is safe.
3360 */
3361 if (!is_offset_safe(param,tpscnt,p,1)) {
3362 return False;
3363 }
3364 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3365 return False;
3366
3367 /* check it's a supported varient */
3368 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3369 return(False);
3370
3371 *rparam_len = 4;
3372 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3373 if (!*rparam) {
3374 return False;
3375 }
3376 *rdata_len = 0;
3377
3378 ZERO_STRUCT(handle);
3379
3380 status = rpc_pipe_open_interface(conn,
3381 &ndr_table_spoolss.syntax_id,
3382 conn->session_info,
3383 &conn->sconn->client_id,
3384 conn->sconn->msg_ctx,
3385 &cli);
3386 if (!NT_STATUS_IS_OK(status)) {
3387 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3388 nt_errstr(status)));
3389 errcode = W_ERROR_V(ntstatus_to_werror(status));
3390 goto out;
3391 }
3392 b = cli->binding_handle;
3393
3394 ZERO_STRUCT(devmode_ctr);
3395
3396 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3397 sharename,
3398 "RAW",
3399 devmode_ctr,
3400 JOB_ACCESS_ADMINISTER,
3401 &handle,
3402 &werr);
3403 if (!NT_STATUS_IS_OK(status)) {
3404 errcode = W_ERROR_V(ntstatus_to_werror(status));
3405 goto out;
3406 }
3407 if (!W_ERROR_IS_OK(werr)) {
3408 errcode = W_ERROR_V(werr);
3409 goto out;
3410 }
3411
3412 /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3413 * and NERR_DestNotFound if share did not exist */
3414
3415 errcode = NERR_Success;
3416
3417 switch (function) {
3418 case 81: /* delete */
3419 command = SPOOLSS_JOB_CONTROL_DELETE;
3420 break;
3421 case 82: /* pause */
3422 command = SPOOLSS_JOB_CONTROL_PAUSE;
3423 break;
3424 case 83: /* resume */
3425 command = SPOOLSS_JOB_CONTROL_RESUME;
3426 break;
3427 default:
3428 errcode = NERR_notsupported;
3429 goto out;
3430 }
3431
3432 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3433 &handle,
3434 jobid,
3435 NULL, /* unique ptr ctr */
3436 command,
3437 &werr);
3438 if (!NT_STATUS_IS_OK(status)) {
3439 errcode = W_ERROR_V(ntstatus_to_werror(status));
3440 goto out;
3441 }
3442 if (!W_ERROR_IS_OK(werr)) {
3443 errcode = W_ERROR_V(werr);
3444 goto out;
3445 }
3446
3447 out:
3448 if (b && is_valid_policy_hnd(&handle)) {
3449 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3450 }
3451
3452 SSVAL(*rparam,0,errcode);
3453 SSVAL(*rparam,2,0); /* converter word */
3454
3455 return(True);
3456 }
3457
3458 /****************************************************************************
3459 Purge a print queue - or pause or resume it.
3460 ****************************************************************************/
3461
3462 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3463 connection_struct *conn,uint16 vuid,
3464 char *param, int tpscnt,
3465 char *data, int tdscnt,
3466 int mdrcnt,int mprcnt,
3467 char **rdata,char **rparam,
3468 int *rdata_len,int *rparam_len)
3469 {
3470 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3471 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3472 char *str2 = skip_string(param,tpscnt,str1);
3473 char *QueueName = skip_string(param,tpscnt,str2);
3474 int errcode = NERR_notsupported;
3475 WERROR werr = WERR_OK;
3476 NTSTATUS status;
3477
3478 TALLOC_CTX *mem_ctx = talloc_tos();
3479 struct rpc_pipe_client *cli = NULL;
3480 struct dcerpc_binding_handle *b = NULL;
3481 struct policy_handle handle;
3482 struct spoolss_SetPrinterInfoCtr info_ctr;
3483 struct spoolss_DevmodeContainer devmode_ctr;
3484 struct sec_desc_buf secdesc_ctr;
3485 enum spoolss_PrinterControl command;
3486
3487 if (!str1 || !str2 || !QueueName) {
3488 return False;
3489 }
3490
3491 /* check it's a supported varient */
3492 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3493 return(False);
3494
3495 *rparam_len = 4;
3496 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3497 if (!*rparam) {
3498 return False;
3499 }
3500 *rdata_len = 0;
3501
3502 if (skip_string(param,tpscnt,QueueName) == NULL) {
3503 return False;
3504 }
3505
3506 ZERO_STRUCT(handle);
3507
3508 status = rpc_pipe_open_interface(conn,
3509 &ndr_table_spoolss.syntax_id,
3510 conn->session_info,
3511 &conn->sconn->client_id,
3512 conn->sconn->msg_ctx,
3513 &cli);
3514 if (!NT_STATUS_IS_OK(status)) {
3515 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3516 nt_errstr(status)));
3517 errcode = W_ERROR_V(ntstatus_to_werror(status));
3518 goto out;
3519 }
3520 b = cli->binding_handle;
3521
3522 ZERO_STRUCT(devmode_ctr);
3523
3524 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3525 QueueName,
3526 NULL,
3527 devmode_ctr,
3528 SEC_FLAG_MAXIMUM_ALLOWED,
3529 &handle,
3530 &werr);
3531 if (!NT_STATUS_IS_OK(status)) {
3532 errcode = W_ERROR_V(ntstatus_to_werror(status));
3533 goto out;
3534 }
3535 if (!W_ERROR_IS_OK(werr)) {
3536 errcode = W_ERROR_V(werr);
3537 goto out;
3538 }
3539
3540 switch (function) {
3541 case 74: /* Pause queue */
3542 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3543 break;
3544 case 75: /* Resume queue */
3545 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3546 break;
3547 case 103: /* Purge */
3548 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3549 break;
3550 default:
3551 werr = WERR_NOT_SUPPORTED;
3552 break;
3553 }
3554
3555 if (!W_ERROR_IS_OK(werr)) {
3556 errcode = W_ERROR_V(werr);
3557 goto out;
3558 }
3559
3560 ZERO_STRUCT(info_ctr);
3561 ZERO_STRUCT(secdesc_ctr);
3562
3563 status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3564 &handle,
3565 &info_ctr,
3566 &devmode_ctr,
3567 &secdesc_ctr,
3568 command,
3569 &werr);
3570 if (!NT_STATUS_IS_OK(status)) {
3571 errcode = W_ERROR_V(ntstatus_to_werror(status));
3572 goto out;
3573 }
3574 if (!W_ERROR_IS_OK(werr)) {
3575 errcode = W_ERROR_V(werr);
3576 goto out;
3577 }
3578
3579 errcode = W_ERROR_V(werr);
3580
3581 out:
3582
3583 if (b && is_valid_policy_hnd(&handle)) {
3584 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3585 }
3586
3587 SSVAL(*rparam,0,errcode);
3588 SSVAL(*rparam,2,0); /* converter word */
3589
3590 return(True);
3591 }
3592
3593 /****************************************************************************
3594 set the property of a print job (undocumented?)
3595 ? function = 0xb -> set name of print job
3596 ? function = 0x6 -> move print job up/down
3597 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3598 or <WWsTP> <WB21BB16B10zWWzDDz>
3599 ****************************************************************************/
3600
3601 static int check_printjob_info(struct pack_desc* desc,
3602 int uLevel, char* id)
3603 {
3604 desc->subformat = NULL;
3605 switch( uLevel ) {
3606 case 0: desc->format = "W"; break;
3607 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3608 case 2: desc->format = "WWzWWDDzz"; break;
3609 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3610 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3611 default:
3612 DEBUG(0,("check_printjob_info: invalid level %d\n",
3613 uLevel ));
3614 return False;
3615 }
3616 if (id == NULL || strcmp(desc->format,id) != 0) {
3617 DEBUG(0,("check_printjob_info: invalid format %s\n",
3618 id ? id : "<NULL>" ));
3619 return False;
3620 }
3621 return True;
3622 }
3623
3624 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3625 connection_struct *conn, uint16 vuid,
3626 char *param, int tpscnt,
3627 char *data, int tdscnt,
3628 int mdrcnt,int mprcnt,
3629 char **rdata,char **rparam,
3630 int *rdata_len,int *rparam_len)
3631 {
3632 struct pack_desc desc;
3633 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3634 char *str2 = skip_string(param,tpscnt,str1);
3635 char *p = skip_string(param,tpscnt,str2);
3636 uint32 jobid;
3637 fstring sharename;
3638 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3639 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3640 int errcode;
3641
3642 TALLOC_CTX *mem_ctx = talloc_tos();
3643 WERROR werr;
3644 NTSTATUS status;
3645 struct rpc_pipe_client *cli = NULL;
3646 struct dcerpc_binding_handle *b = NULL;
3647 struct policy_handle handle;
3648 struct spoolss_DevmodeContainer devmode_ctr;
3649 struct spoolss_JobInfoContainer ctr;
3650 union spoolss_JobInfo info;
3651 struct spoolss_SetJobInfo1 info1;
3652
3653 if (!str1 || !str2 || !p) {
3654 return False;
3655 }
3656 /*
3657 * We use 1 here not 2 as we're checking
3658 * the last byte we want to access is safe.
3659 */
3660 if (!is_offset_safe(param,tpscnt,p,1)) {
3661 return False;
3662 }
3663 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3664 return False;
3665 *rparam_len = 4;
3666 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3667 if (!*rparam) {
3668 return False;
3669 }
3670
3671 *rdata_len = 0;
3672
3673 /* check it's a supported varient */
3674 if ((strcmp(str1,"WWsTP")) ||
3675 (!check_printjob_info(&desc,uLevel,str2)))
3676 return(False);
3677
3678 errcode = NERR_notsupported;
3679
3680 switch (function) {
3681 case 0xb:
3682 /* change print job name, data gives the name */
3683 break;
3684 default:
3685 goto out;
3686 }
3687
3688 ZERO_STRUCT(handle);
3689
3690 status = rpc_pipe_open_interface(conn,
3691 &ndr_table_spoolss.syntax_id,
3692 conn->session_info,
3693 &conn->sconn->client_id,
3694 conn->sconn->msg_ctx,
3695 &cli);
3696 if (!NT_STATUS_IS_OK(status)) {
3697 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3698 nt_errstr(status)));
3699 errcode = W_ERROR_V(ntstatus_to_werror(status));
3700 goto out;
3701 }
3702 b = cli->binding_handle;
3703
3704 ZERO_STRUCT(devmode_ctr);
3705
3706 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3707 sharename,
3708 "RAW",
3709 devmode_ctr,
3710 PRINTER_ACCESS_USE,
3711 &handle,
3712 &werr);
3713 if (!NT_STATUS_IS_OK(status)) {
3714 errcode = W_ERROR_V(ntstatus_to_werror(status));
3715 goto out;
3716 }
3717 if (!W_ERROR_IS_OK(werr)) {
3718 errcode = W_ERROR_V(werr);
3719 goto out;
3720 }
3721
3722 werr = rpccli_spoolss_getjob(cli, mem_ctx,
3723 &handle,
3724 jobid,
3725 1, /* level */
3726 0, /* offered */
3727 &info);
3728 if (!W_ERROR_IS_OK(werr)) {
3729 errcode = W_ERROR_V(werr);
3730 goto out;
3731 }
3732
3733 ZERO_STRUCT(ctr);
3734
3735 info1.job_id = info.info1.job_id;
3736 info1.printer_name = info.info1.printer_name;
3737 info1.user_name = info.info1.user_name;
3738 info1.document_name = data;
3739 info1.data_type = info.info1.data_type;
3740 info1.text_status = info.info1.text_status;
3741 info1.status = info.info1.status;
3742 info1.priority = info.info1.priority;
3743 info1.position = info.info1.position;
3744 info1.total_pages = info.info1.total_pages;
3745 info1.pages_printed = info.info1.pages_printed;
3746 info1.submitted = info.info1.submitted;
3747
3748 ctr.level = 1;
3749 ctr.info.info1 = &info1;
3750
3751 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3752 &handle,
3753 jobid,
3754 &ctr,
3755 0,
3756 &werr);
3757 if (!NT_STATUS_IS_OK(status)) {
3758 errcode = W_ERROR_V(ntstatus_to_werror(status));
3759 goto out;
3760 }
3761 if (!W_ERROR_IS_OK(werr)) {
3762 errcode = W_ERROR_V(werr);
3763 goto out;
3764 }
3765
3766 errcode = NERR_Success;
3767 out:
3768
3769 if (b && is_valid_policy_hnd(&handle)) {
3770 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3771 }
3772
3773 SSVALS(*rparam,0,errcode);
3774 SSVAL(*rparam,2,0); /* converter word */
3775
3776 return(True);
3777 }
3778
3779
3780 /****************************************************************************
3781 Get info about the server.
3782 ****************************************************************************/
3783
3784 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3785 connection_struct *conn,uint16 vuid,
3786 char *param, int tpscnt,
3787 char *data, int tdscnt,
3788 int mdrcnt,int mprcnt,
3789 char **rdata,char **rparam,
3790 int *rdata_len,int *rparam_len)
3791 {
3792 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3793 char *str2 = skip_string(param,tpscnt,str1);
3794 char *p = skip_string(param,tpscnt,str2);
3795 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3796 char *p2;
3797 int struct_len;
3798
3799 NTSTATUS status;
3800 WERROR werr;
3801 TALLOC_CTX *mem_ctx = talloc_tos();
3802 struct rpc_pipe_client *cli = NULL;
3803 union srvsvc_NetSrvInfo info;
3804 int errcode;
3805 struct dcerpc_binding_handle *b;
3806
3807 if (!str1 || !str2 || !p) {
3808 return False;
3809 }
3810
3811 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3812
3813 /* check it's a supported varient */
3814 if (!prefix_ok(str1,"WrLh")) {
3815 return False;
3816 }
3817
3818 switch( uLevel ) {
3819 case 0:
3820 if (strcmp(str2,"B16") != 0) {
3821 return False;
3822 }
3823 struct_len = 16;
3824 break;
3825 case 1:
3826 if (strcmp(str2,"B16BBDz") != 0) {
3827 return False;
3828 }
3829 struct_len = 26;
3830 break;
3831 case 2:
3832 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3833 return False;
3834 }
3835 struct_len = 134;
3836 break;
3837 case 3:
3838 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3839 return False;
3840 }
3841 struct_len = 144;
3842 break;
3843 case 20:
3844 if (strcmp(str2,"DN") != 0) {
3845 return False;
3846 }
3847 struct_len = 6;
3848 break;
3849 case 50:
3850 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3851 return False;
3852 }
3853 struct_len = 42;
3854 break;
3855 default:
3856 return False;
3857 }
3858
3859 *rdata_len = mdrcnt;
3860 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3861 if (!*rdata) {
3862 return False;
3863 }
3864
3865 p = *rdata;
3866 p2 = p + struct_len;
3867
3868 status = rpc_pipe_open_internal(mem_ctx, &ndr_table_srvsvc.syntax_id,
3869 conn->session_info,
3870 &conn->sconn->client_id,
3871 conn->sconn->msg_ctx,
3872 &cli);
3873 if (!NT_STATUS_IS_OK(status)) {
3874 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3875 nt_errstr(status)));
3876 errcode = W_ERROR_V(ntstatus_to_werror(status));
3877 goto out;
3878 }
3879
3880 b = cli->binding_handle;
3881
3882 status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3883 NULL,
3884 101,
3885 &info,
3886 &werr);
3887 if (!NT_STATUS_IS_OK(status)) {
3888 errcode = W_ERROR_V(ntstatus_to_werror(status));
3889 goto out;
3890 }
3891 if (!W_ERROR_IS_OK(werr)) {
3892 errcode = W_ERROR_V(werr);
3893 goto out;
3894 }
3895
3896 if (info.info101 == NULL) {
3897 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3898 goto out;
3899 }
3900
3901 if (uLevel != 20) {
3902 srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3903 STR_ASCII|STR_UPPER|STR_TERMINATE);
3904 }
3905 p += 16;
3906 if (uLevel > 0) {
3907 SCVAL(p,0,info.info101->version_major);
3908 SCVAL(p,1,info.info101->version_minor);
3909 SIVAL(p,2,info.info101->server_type);
3910
3911 if (mdrcnt == struct_len) {
3912 SIVAL(p,6,0);
3913 } else {
3914 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3915 if (mdrcnt - struct_len <= 0) {
3916 return false;
3917 }
3918 push_ascii(p2,
3919 info.info101->comment,
3920 MIN(mdrcnt - struct_len,
3921 MAX_SERVER_STRING_LENGTH),
3922 STR_TERMINATE);
3923 p2 = skip_string(*rdata,*rdata_len,p2);
3924 if (!p2) {
3925 return False;
3926 }
3927 }
3928 }
3929
3930 if (uLevel > 1) {
3931 return False; /* not yet implemented */
3932 }
3933
3934 errcode = NERR_Success;
3935
3936 out:
3937
3938 *rdata_len = PTR_DIFF(p2,*rdata);
3939
3940 *rparam_len = 6;
3941 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3942 if (!*rparam) {
3943 return False;
3944 }
3945 SSVAL(*rparam,0,errcode);
3946 SSVAL(*rparam,2,0); /* converter word */
3947 SSVAL(*rparam,4,*rdata_len);
3948
3949 return True;
3950 }
3951
3952 /****************************************************************************
3953 Get info about the server.
3954 ****************************************************************************/
3955
3956 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3957 connection_struct *conn,uint16 vuid,
3958 char *param, int tpscnt,
3959 char *data, int tdscnt,
3960 int mdrcnt,int mprcnt,
3961 char **rdata,char **rparam,
3962 int *rdata_len,int *rparam_len)
3963 {
3964 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3965 char *str2 = skip_string(param,tpscnt,str1);
3966 char *p = skip_string(param,tpscnt,str2);
3967 char *p2;
3968 char *endp;
3969 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3970
3971 if (!str1 || !str2 || !p) {
3972 return False;
3973 }
3974
3975 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3976
3977 *rparam_len = 6;
3978 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3979 if (!*rparam) {
3980 return False;
3981 }
3982
3983 /* check it's a supported varient */
3984 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3985 return False;
3986 }
3987
3988 *rdata_len = mdrcnt + 1024;
3989 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3990 if (!*rdata) {
3991 return False;
3992 }
3993
3994 SSVAL(*rparam,0,NERR_Success);
3995 SSVAL(*rparam,2,0); /* converter word */
3996
3997 p = *rdata;
3998 endp = *rdata + *rdata_len;
3999
4000 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
4001 if (!p2) {
4002 return False;
4003 }
4004
4005 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
4006 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
4007 strupper_m(p2);
4008 p2 = skip_string(*rdata,*rdata_len,p2);
4009 if (!p2) {
4010 return False;
4011 }
4012 p += 4;
4013
4014 SIVAL(p,0,PTR_DIFF(p2,*rdata));
4015 strlcpy(p2,conn->session_info->sanitized_username,PTR_DIFF(endp,p2));
4016 p2 = skip_string(*rdata,*rdata_len,p2);
4017 if (!p2) {
4018 return False;
4019 }
4020 p += 4;
4021
4022 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
4023 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
4024 strupper_m(p2);
4025 p2 = skip_string(*rdata,*rdata_len,p2);
4026 if (!p2) {
4027 return False;
4028 }
4029 p += 4;
4030
4031 SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
4032 SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
4033 p += 2;
4034
4035 SIVAL(p,0,PTR_DIFF(p2,*rdata));
4036 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
4037 p2 = skip_string(*rdata,*rdata_len,p2);
4038 if (!p2) {
4039 return False;
4040 }
4041 p += 4;
4042
4043 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
4044 strlcpy(p2,"",PTR_DIFF(endp,p2));
4045 p2 = skip_string(*rdata,*rdata_len,p2);
4046 if (!p2) {
4047 return False;
4048 }
4049 p += 4;
4050
4051 *rdata_len = PTR_DIFF(p2,*rdata);
4052
4053 SSVAL(*rparam,4,*rdata_len);
4054
4055 return True;
4056 }
4057
4058 /****************************************************************************
4059 get info about a user
4060
4061 struct user_info_11 {
4062 char usri11_name[21]; 0-20
4063 char usri11_pad; 21
4064 char *usri11_comment; 22-25
4065 char *usri11_usr_comment; 26-29
4066 unsigned short usri11_priv; 30-31
4067 unsigned long usri11_auth_flags; 32-35
4068 long usri11_password_age; 36-39
4069 char *usri11_homedir; 40-43
4070 char *usri11_parms; 44-47
4071 long usri11_last_logon; 48-51
4072 long usri11_last_logoff; 52-55
4073 unsigned short usri11_bad_pw_count; 56-57
4074 unsigned short usri11_num_logons; 58-59
4075 char *usri11_logon_server; 60-63
4076 unsigned short usri11_country_code; 64-65
4077 char *usri11_workstations; 66-69
4078 unsigned long usri11_max_storage; 70-73
4079 unsigned short usri11_units_per_week; 74-75
4080 unsigned char *usri11_logon_hours; 76-79
4081 unsigned short usri11_code_page; 80-81
4082 };
4083
4084 where:
4085
4086 usri11_name specifies the user name for which information is retrieved
4087
4088 usri11_pad aligns the next data structure element to a word boundary
4089
4090 usri11_comment is a null terminated ASCII comment
4091
4092 usri11_user_comment is a null terminated ASCII comment about the user
4093
4094 usri11_priv specifies the level of the privilege assigned to the user.
4095 The possible values are:
4096
4097 Name Value Description
4098 USER_PRIV_GUEST 0 Guest privilege
4099 USER_PRIV_USER 1 User privilege
4100 USER_PRV_ADMIN 2 Administrator privilege
4101
4102 usri11_auth_flags specifies the account operator privileges. The
4103 possible values are:
4104
4105 Name Value Description
4106 AF_OP_PRINT 0 Print operator
4107
4108
4109 Leach, Naik [Page 28]
4110 \f
4111
4112
4113 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
4114
4115
4116 AF_OP_COMM 1 Communications operator
4117 AF_OP_SERVER 2 Server operator
4118 AF_OP_ACCOUNTS 3 Accounts operator
4119
4120
4121 usri11_password_age specifies how many seconds have elapsed since the
4122 password was last changed.
4123
4124 usri11_home_dir points to a null terminated ASCII string that contains
4125 the path name of the user's home directory.
4126
4127 usri11_parms points to a null terminated ASCII string that is set
4128 aside for use by applications.
4129
4130 usri11_last_logon specifies the time when the user last logged on.
4131 This value is stored as the number of seconds elapsed since
4132 00:00:00, January 1, 1970.
4133
4134 usri11_last_logoff specifies the time when the user last logged off.
4135 This value is stored as the number of seconds elapsed since
4136 00:00:00, January 1, 1970. A value of 0 means the last logoff
4137 time is unknown.
4138
4139 usri11_bad_pw_count specifies the number of incorrect passwords
4140 entered since the last successful logon.
4141
4142 usri11_log1_num_logons specifies the number of times this user has
4143 logged on. A value of -1 means the number of logons is unknown.
4144
4145 usri11_logon_server points to a null terminated ASCII string that
4146 contains the name of the server to which logon requests are sent.
4147 A null string indicates logon requests should be sent to the
4148 domain controller.
4149
4150 usri11_country_code specifies the country code for the user's language
4151 of choice.
4152
4153 usri11_workstations points to a null terminated ASCII string that
4154 contains the names of workstations the user may log on from.
4155 There may be up to 8 workstations, with the names separated by
4156 commas. A null strings indicates there are no restrictions.
4157
4158 usri11_max_storage specifies the maximum amount of disk space the user
4159 can occupy. A value of 0xffffffff indicates there are no
4160 restrictions.
4161
4162 usri11_units_per_week specifies the equal number of time units into
4163 which a week is divided. This value must be equal to 168.
4164
4165 usri11_logon_hours points to a 21 byte (168 bits) string that
4166 specifies the time during which the user can log on. Each bit
4167 represents one unique hour in a week. The first bit (bit 0, word
4168 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
4169
4170
4171
4172 Leach, Naik [Page 29]
4173 \f
4174
4175
4176 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
4177
4178
4179 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
4180 are no restrictions.
4181
4182 usri11_code_page specifies the code page for the user's language of
4183 choice
4184
4185 All of the pointers in this data structure need to be treated
4186 specially. The pointer is a 32 bit pointer. The higher 16 bits need
4187 to be ignored. The converter word returned in the parameters section
4188 needs to be subtracted from the lower 16 bits to calculate an offset
4189 into the return buffer where this ASCII string resides.
4190
4191 There is no auxiliary data in the response.
4192
4193 ****************************************************************************/
4194
4195 #define usri11_name 0
4196 #define usri11_pad 21
4197 #define usri11_comment 22
4198 #define usri11_usr_comment 26
4199 #define usri11_full_name 30
4200 #define usri11_priv 34
4201 #define usri11_auth_flags 36
4202 #define usri11_password_age 40
4203 #define usri11_homedir 44
4204 #define usri11_parms 48
4205 #define usri11_last_logon 52
4206 #define usri11_last_logoff 56
4207 #define usri11_bad_pw_count 60
4208 #define usri11_num_logons 62
4209 #define usri11_logon_server 64
4210 #define usri11_country_code 68
4211 #define usri11_workstations 70
4212 #define usri11_max_storage 74
4213 #define usri11_units_per_week 78
4214 #define usri11_logon_hours 80
4215 #define usri11_code_page 84
4216 #define usri11_end 86
4217
4218 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
4219 connection_struct *conn, uint16 vuid,
4220 char *param, int tpscnt,
4221 char *data, int tdscnt,
4222 int mdrcnt,int mprcnt,
4223 char **rdata,char **rparam,
4224 int *rdata_len,int *rparam_len)
4225 {
4226 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4227 char *str2 = skip_string(param,tpscnt,str1);
4228 char *UserName = skip_string(param,tpscnt,str2);
4229 char *p = skip_string(param,tpscnt,UserName);
4230 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4231 char *p2;
4232 char *endp;
4233 const char *level_string;
4234
4235 TALLOC_CTX *mem_ctx = talloc_tos();
4236 NTSTATUS status, result;
4237 struct rpc_pipe_client *cli = NULL;
4238 struct policy_handle connect_handle, domain_handle, user_handle;
4239 struct lsa_String domain_name;
4240 struct dom_sid2 *domain_sid;
4241 struct lsa_String names;
4242 struct samr_Ids rids;
4243 struct samr_Ids types;
4244 int errcode = W_ERROR_V(WERR_USER_NOT_FOUND);
4245 uint32_t rid;
4246 union samr_UserInfo *info;
4247 struct dcerpc_binding_handle *b = NULL;
4248
4249 if (!str1 || !str2 || !UserName || !p) {
4250 return False;
4251 }
4252
4253 *rparam_len = 6;
4254 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4255 if (!*rparam) {
4256 return False;
4257 }
4258
4259 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4260
4261 /* check it's a supported variant */
4262 if (strcmp(str1,"zWrLh") != 0) {
4263 return False;
4264 }
4265 switch( uLevel ) {
4266 case 0: level_string = "B21"; break;
4267 case 1: level_string = "B21BB16DWzzWz"; break;
4268 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4269 case 10: level_string = "B21Bzzz"; break;
4270 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4271 default: return False;
4272 }
4273
4274 if (strcmp(level_string,str2) != 0) {
4275 return False;
4276 }
4277
4278 *rdata_len = mdrcnt + 1024;
4279 *rdata = smb_realloc_limit(*rdata,*rdata_len);
4280 if (!*rdata) {
4281 return False;
4282 }
4283
4284 p = *rdata;
4285 endp = *rdata + *rdata_len;
4286 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4287 if (!p2) {
4288 return False;
4289 }
4290
4291 ZERO_STRUCT(connect_handle);
4292 ZERO_STRUCT(domain_handle);
4293 ZERO_STRUCT(user_handle);
4294
4295 status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
4296 conn->session_info,
4297 &conn->sconn->client_id,
4298 conn->sconn->msg_ctx,
4299 &cli);
4300 if (!NT_STATUS_IS_OK(status)) {
4301 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4302 nt_errstr(status)));
4303 errcode = W_ERROR_V(ntstatus_to_werror(status));
4304 goto out;
4305 }
4306
4307 b = cli->binding_handle;
4308
4309 status = dcerpc_samr_Connect2(b, mem_ctx,
4310 global_myname(),
4311 SAMR_ACCESS_CONNECT_TO_SERVER |
4312 SAMR_ACCESS_ENUM_DOMAINS |
4313 SAMR_ACCESS_LOOKUP_DOMAIN,
4314 &connect_handle,
4315 &result);
4316 if (!NT_STATUS_IS_OK(status)) {
4317 errcode = W_ERROR_V(ntstatus_to_werror(status));
4318 goto out;
4319 }
4320 if (!NT_STATUS_IS_OK(result)) {
4321 errcode = W_ERROR_V(ntstatus_to_werror(result));
4322 goto out;
4323 }
4324
4325 init_lsa_String(&domain_name, get_global_sam_name());
4326
4327 status = dcerpc_samr_LookupDomain(b, mem_ctx,
4328 &connect_handle,
4329 &domain_name,
4330 &domain_sid,
4331 &result);
4332 if (!NT_STATUS_IS_OK(status)) {
4333 errcode = W_ERROR_V(ntstatus_to_werror(status));
4334 goto out;
4335 }
4336 if (!NT_STATUS_IS_OK(result)) {
4337 errcode = W_ERROR_V(ntstatus_to_werror(result));
4338 goto out;
4339 }
4340
4341 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4342 &connect_handle,
4343 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4344 domain_sid,
4345 &domain_handle,
4346 &result);
4347 if (!NT_STATUS_IS_OK(status)) {
4348 errcode = W_ERROR_V(ntstatus_to_werror(status));
4349 goto out;
4350 }
4351 if (!NT_STATUS_IS_OK(result)) {
4352 errcode = W_ERROR_V(ntstatus_to_werror(result));
4353 goto out;
4354 }
4355
4356 init_lsa_String(&names, UserName);
4357
4358 status = dcerpc_samr_LookupNames(b, mem_ctx,
4359 &domain_handle,
4360 1,
4361 &names,
4362 &rids,
4363 &types,
4364 &result);
4365 if (!NT_STATUS_IS_OK(status)) {
4366 errcode = W_ERROR_V(ntstatus_to_werror(status));
4367 goto out;
4368 }
4369 if (!NT_STATUS_IS_OK(result)) {
4370 errcode = W_ERROR_V(ntstatus_to_werror(result));
4371 goto out;
4372 }
4373
4374 if (rids.count != 1) {
4375 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4376 goto out;
4377 }
4378 if (rids.count != types.count) {
4379 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4380 goto out;
4381 }
4382 if (types.ids[0] != SID_NAME_USER) {
4383 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4384 goto out;
4385 }
4386
4387 rid = rids.ids[0];
4388
4389 status = dcerpc_samr_OpenUser(b, mem_ctx,
4390 &domain_handle,
4391 SAMR_USER_ACCESS_GET_LOCALE |
4392 SAMR_USER_ACCESS_GET_LOGONINFO |
4393 SAMR_USER_ACCESS_GET_ATTRIBUTES |
4394 SAMR_USER_ACCESS_GET_GROUPS |
4395 SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4396 SEC_STD_READ_CONTROL,
4397 rid,
4398 &user_handle,
4399 &result);
4400 if (!NT_STATUS_IS_OK(status)) {
4401 errcode = W_ERROR_V(ntstatus_to_werror(status));
4402 goto out;
4403 }
4404 if (!NT_STATUS_IS_OK(result)) {
4405 errcode = W_ERROR_V(ntstatus_to_werror(result));
4406 goto out;
4407 }
4408
4409 status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4410 &user_handle,
4411 UserAllInformation,
4412 &info,
4413 &result);
4414 if (!NT_STATUS_IS_OK(status)) {
4415 errcode = W_ERROR_V(ntstatus_to_werror(status));
4416 goto out;
4417 }
4418 if (!NT_STATUS_IS_OK(result)) {
4419 errcode = W_ERROR_V(ntstatus_to_werror(result));
4420 goto out;
4421 }
4422
4423 memset(p,0,21);
4424 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4425
4426 if (uLevel > 0) {
4427 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4428 *p2 = 0;
4429 }
4430
4431 if (uLevel >= 10) {
4432 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4433 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4434 p2 = skip_string(*rdata,*rdata_len,p2);
4435 if (!p2) {
4436 return False;
4437 }
4438
4439 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4440 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4441 p2 = skip_string(*rdata,*rdata_len,p2);
4442 if (!p2) {
4443 return False;
4444 }
4445
4446 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4447 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4448 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4449 p2 = skip_string(*rdata,*rdata_len,p2);
4450 if (!p2) {
4451 return False;
4452 }
4453 }
4454
4455 if (uLevel == 11) {
4456 const char *homedir = info->info21.home_directory.string;
4457 /* modelled after NTAS 3.51 reply */
4458 SSVAL(p,usri11_priv,
4459 (get_current_uid(conn) == sec_initial_uid())?
4460 USER_PRIV_ADMIN:USER_PRIV_USER);
4461 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
4462 SIVALS(p,usri11_password_age,-1); /* password age */
4463 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4464 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4465 p2 = skip_string(*rdata,*rdata_len,p2);
4466 if (!p2) {
4467 return False;
4468 }
4469 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4470 strlcpy(p2,"",PTR_DIFF(endp,p2));
4471 p2 = skip_string(*rdata,*rdata_len,p2);
4472 if (!p2) {
4473 return False;
4474 }
4475 SIVAL(p,usri11_last_logon,0); /* last logon */
4476 SIVAL(p,usri11_last_logoff,0); /* last logoff */
4477 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
4478 SSVALS(p,usri11_num_logons,-1); /* num logons */
4479 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4480 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4481 p2 = skip_string(*rdata,*rdata_len,p2);
4482 if (!p2) {
4483 return False;
4484 }
4485 SSVAL(p,usri11_country_code,0); /* country code */
4486
4487 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4488 strlcpy(p2,"",PTR_DIFF(endp,p2));
4489 p2 = skip_string(*rdata,*rdata_len,p2);
4490 if (!p2) {
4491 return False;
4492 }
4493
4494 SIVALS(p,usri11_max_storage,-1); /* max storage */
4495 SSVAL(p,usri11_units_per_week,168); /* units per week */
4496 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4497
4498 /* a simple way to get logon hours at all times. */
4499 memset(p2,0xff,21);
4500 SCVAL(p2,21,0); /* fix zero termination */
4501 p2 = skip_string(*rdata,*rdata_len,p2);
4502 if (!p2) {
4503 return False;
4504 }
4505
4506 SSVAL(p,usri11_code_page,0); /* code page */
4507 }
4508
4509 if (uLevel == 1 || uLevel == 2) {
4510 memset(p+22,' ',16); /* password */
4511 SIVALS(p,38,-1); /* password age */
4512 SSVAL(p,42,
4513 (get_current_uid(conn) == sec_initial_uid())?
4514 USER_PRIV_ADMIN:USER_PRIV_USER);
4515 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4516 strlcpy(p2, info->info21.home_directory.string,
4517 PTR_DIFF(endp,p2));
4518 p2 = skip_string(*rdata,*rdata_len,p2);
4519 if (!p2) {
4520 return False;
4521 }
4522 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4523 *p2++ = 0;
4524 SSVAL(p,52,0); /* flags */
4525 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
4526 strlcpy(p2, info->info21.logon_script.string,
4527 PTR_DIFF(endp,p2));
4528 p2 = skip_string(*rdata,*rdata_len,p2);
4529 if (!p2) {
4530 return False;
4531 }
4532 if (uLevel == 2) {
4533 SIVAL(p,58,0); /* auth_flags */
4534 SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4535 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4536 p2 = skip_string(*rdata,*rdata_len,p2);
4537 if (!p2) {
4538 return False;
4539 }
4540 SIVAL(p,66,0); /* urs_comment */
4541 SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4542 strlcpy(p2,"",PTR_DIFF(endp,p2));
4543 p2 = skip_string(*rdata,*rdata_len,p2);
4544 if (!p2) {
4545 return False;
4546 }
4547 SIVAL(p,74,0); /* workstations */
4548 SIVAL(p,78,0); /* last_logon */
4549 SIVAL(p,82,0); /* last_logoff */
4550 SIVALS(p,86,-1); /* acct_expires */
4551 SIVALS(p,90,-1); /* max_storage */
4552 SSVAL(p,94,168); /* units_per_week */
4553 SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4554 memset(p2,-1,21);
4555 p2 += 21;
4556 SSVALS(p,100,-1); /* bad_pw_count */
4557 SSVALS(p,102,-1); /* num_logons */
4558 SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4559 {
4560 TALLOC_CTX *ctx = talloc_tos();
4561 int space_rem = *rdata_len - (p2 - *rdata);
4562 char *tmp;
4563
4564 if (space_rem <= 0) {
4565 return false;
4566 }
4567 tmp = talloc_strdup(ctx, "\\\\%L");
4568 if (!tmp) {
4569 return false;
4570 }
4571 tmp = talloc_sub_basic(ctx,
4572 "",
4573 "",
4574 tmp);
4575 if (!tmp) {
4576 return false;
4577 }
4578
4579 push_ascii(p2,
4580 tmp,
4581 space_rem,
4582 STR_TERMINATE);
4583 }
4584 p2 = skip_string(*rdata,*rdata_len,p2);
4585 if (!p2) {
4586 return False;
4587 }
4588 SSVAL(p,108,49); /* country_code */
4589 SSVAL(p,110,860); /* code page */
4590 }
4591 }
4592
4593 errcode = NERR_Success;
4594
4595 out:
4596 *rdata_len = PTR_DIFF(p2,*rdata);
4597
4598 if (b && is_valid_policy_hnd(&user_handle)) {
4599 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4600 }
4601 if (b && is_valid_policy_hnd(&domain_handle)) {
4602 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4603 }
4604 if (b && is_valid_policy_hnd(&connect_handle)) {
4605 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4606 }
4607
4608 SSVAL(*rparam,0,errcode);
4609 SSVAL(*rparam,2,0); /* converter word */
4610 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
4611
4612 return(True);
4613 }
4614
4615 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4616 connection_struct *conn,uint16 vuid,
4617 char *param, int tpscnt,
4618 char *data, int tdscnt,
4619 int mdrcnt,int mprcnt,
4620 char **rdata,char **rparam,
4621 int *rdata_len,int *rparam_len)
4622 {
4623 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4624 char *str2 = skip_string(param,tpscnt,str1);
4625 char *p = skip_string(param,tpscnt,str2);
4626 int uLevel;
4627 struct pack_desc desc;
4628 char* name;
4629 /* With share level security vuid will always be zero.
4630 Don't depend on vuser being non-null !!. JRA */
4631 user_struct *vuser = get_valid_user_struct(sconn, vuid);
4632
4633 if (!str1 || !str2 || !p) {
4634 return False;
4635 }
4636
4637 if(vuser != NULL) {
4638 DEBUG(3,(" Username of UID %d is %s\n",
4639 (int)vuser->session_info->utok.uid,
4640 vuser->session_info->unix_name));
4641 }
4642
4643 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4644 name = get_safe_str_ptr(param,tpscnt,p,2);
4645 if (!name) {
4646 return False;
4647 }
4648
4649 memset((char *)&desc,'\0',sizeof(desc));
4650
4651 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4652
4653 /* check it's a supported varient */
4654 if (strcmp(str1,"OOWb54WrLh") != 0) {
4655 return False;
4656 }
4657 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4658 return False;
4659 }
4660 if (mdrcnt > 0) {
4661 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4662 if (!*rdata) {
4663 return False;
4664 }
4665 }
4666
4667 desc.base = *rdata;
4668 desc.buflen = mdrcnt;
4669 desc.subformat = NULL;
4670 desc.format = str2;
4671
4672 if (init_package(&desc,1,0)) {
4673 PACKI(&desc,"W",0); /* code */
4674 PACKS(&desc,"B21",name); /* eff. name */
4675 PACKS(&desc,"B",""); /* pad */
4676 PACKI(&desc,"W",
4677 (get_current_uid(conn) == sec_initial_uid())?
4678 USER_PRIV_ADMIN:USER_PRIV_USER);
4679 PACKI(&desc,"D",0); /* auth flags XXX */
4680 PACKI(&desc,"W",0); /* num logons */
4681 PACKI(&desc,"W",0); /* bad pw count */
4682 PACKI(&desc,"D",0); /* last logon */
4683 PACKI(&desc,"D",-1); /* last logoff */
4684 PACKI(&desc,"D",-1); /* logoff time */
4685 PACKI(&desc,"D",-1); /* kickoff time */
4686 PACKI(&desc,"D",0); /* password age */
4687 PACKI(&desc,"D",0); /* password can change */
4688 PACKI(&desc,"D",-1); /* password must change */
4689
4690 {
4691 fstring mypath;
4692 fstrcpy(mypath,"\\\\");
4693 fstrcat(mypath,get_local_machine_name());
4694 strupper_m(mypath);
4695 PACKS(&desc,"z",mypath); /* computer */
4696 }
4697
4698 PACKS(&desc,"z",lp_workgroup());/* domain */
4699 PACKS(&desc,"z", vuser ?
4700 vuser->session_info->info3->base.logon_script.string
4701 : ""); /* script path */
4702 PACKI(&desc,"D",0x00000000); /* reserved */
4703 }
4704
4705 *rdata_len = desc.usedlen;
4706 *rparam_len = 6;
4707 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4708 if (!*rparam) {
4709 return False;
4710 }
4711 SSVALS(*rparam,0,desc.errcode);
4712 SSVAL(*rparam,2,0);
4713 SSVAL(*rparam,4,desc.neededlen);
4714
4715 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4716
4717 return True;
4718 }
4719
4720 /****************************************************************************
4721 api_WAccessGetUserPerms
4722 ****************************************************************************/
4723
4724 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4725 connection_struct *conn,uint16 vuid,
4726 char *param, int tpscnt,
4727 char *data, int tdscnt,
4728 int mdrcnt,int mprcnt,
4729 char **rdata,char **rparam,
4730 int *rdata_len,int *rparam_len)
4731 {
4732 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4733 char *str2 = skip_string(param,tpscnt,str1);
4734 char *user = skip_string(param,tpscnt,str2);
4735 char *resource = skip_string(param,tpscnt,user);
4736
4737 if (!str1 || !str2 || !user || !resource) {
4738 return False;
4739 }
4740
4741 if (skip_string(param,tpscnt,resource) == NULL) {
4742 return False;
4743 }
4744 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4745
4746 /* check it's a supported varient */
4747 if (strcmp(str1,"zzh") != 0) {
4748 return False;
4749 }
4750 if (strcmp(str2,"") != 0) {
4751 return False;
4752 }
4753
4754 *rparam_len = 6;
4755 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4756 if (!*rparam) {
4757 return False;
4758 }
4759 SSVALS(*rparam,0,0); /* errorcode */
4760 SSVAL(*rparam,2,0); /* converter word */
4761 SSVAL(*rparam,4,0x7f); /* permission flags */
4762
4763 return True;
4764 }
4765
4766 /****************************************************************************
4767 api_WPrintJobEnumerate
4768 ****************************************************************************/
4769
4770 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4771 connection_struct *conn, uint16 vuid,
4772 char *param, int tpscnt,
4773 char *data, int tdscnt,
4774 int mdrcnt,int mprcnt,
4775 char **rdata,char **rparam,
4776 int *rdata_len,int *rparam_len)
4777 {
4778 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4779 char *str2 = skip_string(param,tpscnt,str1);
4780 char *p = skip_string(param,tpscnt,str2);
4781 int uLevel;
4782 fstring sharename;
4783 uint32 jobid;
4784 struct pack_desc desc;
4785 char *tmpdata=NULL;
4786
4787 TALLOC_CTX *mem_ctx = talloc_tos();
4788 WERROR werr;
4789 NTSTATUS status;
4790 struct rpc_pipe_client *cli = NULL;
4791 struct dcerpc_binding_handle *b = NULL;
4792 struct policy_handle handle;
4793 struct spoolss_DevmodeContainer devmode_ctr;
4794 union spoolss_JobInfo info;
4795
4796 if (!str1 || !str2 || !p) {
4797 return False;
4798 }
4799
4800 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4801
4802 memset((char *)&desc,'\0',sizeof(desc));
4803 memset((char *)&status,'\0',sizeof(status));
4804
4805 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4806
4807 /* check it's a supported varient */
4808 if (strcmp(str1,"WWrLh") != 0) {
4809 return False;
4810 }
4811 if (!check_printjob_info(&desc,uLevel,str2)) {
4812 return False;
4813 }
4814
4815 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4816 return False;
4817 }
4818
4819 ZERO_STRUCT(handle);
4820
4821 status = rpc_pipe_open_interface(conn,
4822 &ndr_table_spoolss.syntax_id,
4823 conn->session_info,
4824 &conn->sconn->client_id,
4825 conn->sconn->msg_ctx,
4826 &cli);
4827 if (!NT_STATUS_IS_OK(status)) {
4828 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4829 nt_errstr(status)));
4830 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4831 goto out;
4832 }
4833 b = cli->binding_handle;
4834
4835 ZERO_STRUCT(devmode_ctr);
4836
4837 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4838 sharename,
4839 "RAW",
4840 devmode_ctr,
4841 PRINTER_ACCESS_USE,
4842 &handle,
4843 &werr);
4844 if (!NT_STATUS_IS_OK(status)) {
4845 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4846 goto out;
4847 }
4848 if (!W_ERROR_IS_OK(werr)) {
4849 desc.errcode = W_ERROR_V(werr);
4850 goto out;
4851 }
4852
4853 werr = rpccli_spoolss_getjob(cli, mem_ctx,
4854 &handle,
4855 jobid,
4856 2, /* level */
4857 0, /* offered */
4858 &info);
4859 if (!W_ERROR_IS_OK(werr)) {
4860 desc.errcode = W_ERROR_V(werr);
4861 goto out;
4862 }
4863
4864 if (mdrcnt > 0) {
4865 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4866 if (!*rdata) {
4867 return False;
4868 }
4869 desc.base = *rdata;
4870 desc.buflen = mdrcnt;
4871 } else {
4872 /*
4873 * Don't return data but need to get correct length
4874 * init_package will return wrong size if buflen=0
4875 */
4876 desc.buflen = getlen(desc.format);
4877 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4878 }
4879
4880 if (init_package(&desc,1,0)) {
4881 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4882 *rdata_len = desc.usedlen;
4883 } else {
4884 desc.errcode = NERR_JobNotFound;
4885 *rdata_len = 0;
4886 }
4887 out:
4888 if (b && is_valid_policy_hnd(&handle)) {
4889 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4890 }
4891
4892 *rparam_len = 6;
4893 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4894 if (!*rparam) {
4895 return False;
4896 }
4897 SSVALS(*rparam,0,desc.errcode);
4898 SSVAL(*rparam,2,0);
4899 SSVAL(*rparam,4,desc.neededlen);
4900
4901 SAFE_FREE(tmpdata);
4902
4903 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4904
4905 return True;
4906 }
4907
4908 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4909 connection_struct *conn, uint16 vuid,
4910 char *param, int tpscnt,
4911 char *data, int tdscnt,
4912 int mdrcnt,int mprcnt,
4913 char **rdata,char **rparam,
4914 int *rdata_len,int *rparam_len)
4915 {
4916 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4917 char *str2 = skip_string(param,tpscnt,str1);
4918 char *p = skip_string(param,tpscnt,str2);
4919 char *name = p;
4920 int uLevel;
4921 int i, succnt=0;
4922 struct pack_desc desc;
4923
4924 TALLOC_CTX *mem_ctx = talloc_tos();
4925 WERROR werr;
4926 NTSTATUS status;
4927 struct rpc_pipe_client *cli = NULL;
4928 struct dcerpc_binding_handle *b = NULL;
4929 struct policy_handle handle;
4930 struct spoolss_DevmodeContainer devmode_ctr;
4931 uint32_t count = 0;
4932 union spoolss_JobInfo *info;
4933
4934 if (!str1 || !str2 || !p) {
4935 return False;
4936 }
4937
4938 memset((char *)&desc,'\0',sizeof(desc));
4939
4940 p = skip_string(param,tpscnt,p);
4941 if (!p) {
4942 return False;
4943 }
4944 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4945
4946 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4947
4948 /* check it's a supported variant */
4949 if (strcmp(str1,"zWrLeh") != 0) {
4950 return False;
4951 }
4952
4953 if (uLevel > 2) {
4954 return False; /* defined only for uLevel 0,1,2 */
4955 }
4956
4957 if (!check_printjob_info(&desc,uLevel,str2)) {
4958 return False;
4959 }
4960
4961 ZERO_STRUCT(handle);
4962
4963 status = rpc_pipe_open_interface(conn,
4964 &ndr_table_spoolss.syntax_id,
4965 conn->session_info,
4966 &conn->sconn->client_id,
4967 conn->sconn->msg_ctx,
4968 &cli);
4969 if (!NT_STATUS_IS_OK(status)) {
4970 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4971 nt_errstr(status)));
4972 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4973 goto out;
4974 }
4975 b = cli->binding_handle;
4976
4977 ZERO_STRUCT(devmode_ctr);
4978
4979 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4980 name,
4981 NULL,
4982 devmode_ctr,
4983 SEC_FLAG_MAXIMUM_ALLOWED,
4984 &handle,
4985 &werr);
4986 if (!NT_STATUS_IS_OK(status)) {
4987 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4988 goto out;
4989 }
4990 if (!W_ERROR_IS_OK(werr)) {
4991 desc.errcode = W_ERROR_V(werr);
4992 goto out;
4993 }
4994
4995 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4996 &handle,
4997 0, /* firstjob */
4998 0xff, /* numjobs */
4999 2, /* level */
5000 0, /* offered */
5001 &count,
5002 &info);
5003 if (!W_ERROR_IS_OK(werr)) {
5004 desc.errcode = W_ERROR_V(werr);
5005 goto out;
5006 }
5007
5008 if (mdrcnt > 0) {
5009 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5010 if (!*rdata) {
5011 return False;
5012 }
5013 }
5014 desc.base = *rdata;
5015 desc.buflen = mdrcnt;
5016
5017 if (init_package(&desc,count,0)) {
5018 succnt = 0;
5019 for (i = 0; i < count; i++) {
5020 fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
5021 if (desc.errcode == NERR_Success) {
5022 succnt = i+1;
5023 }
5024 }
5025 }
5026 out:
5027 if (b && is_valid_policy_hnd(&handle)) {
5028 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5029 }
5030
5031 *rdata_len = desc.usedlen;
5032
5033 *rparam_len = 8;
5034 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5035 if (!*rparam) {
5036 return False;
5037 }
5038 SSVALS(*rparam,0,desc.errcode);
5039 SSVAL(*rparam,2,0);
5040 SSVAL(*rparam,4,succnt);
5041 SSVAL(*rparam,6,count);
5042
5043 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
5044
5045 return True;
5046 }
5047
5048 static int check_printdest_info(struct pack_desc* desc,
5049 int uLevel, char* id)
5050 {
5051 desc->subformat = NULL;
5052 switch( uLevel ) {
5053 case 0:
5054 desc->format = "B9";
5055 break;
5056 case 1:
5057 desc->format = "B9B21WWzW";
5058 break;
5059 case 2:
5060 desc->format = "z";
5061 break;
5062 case 3:
5063 desc->format = "zzzWWzzzWW";
5064 break;
5065 default:
5066 DEBUG(0,("check_printdest_info: invalid level %d\n",
5067 uLevel));
5068 return False;
5069 }
5070 if (id == NULL || strcmp(desc->format,id) != 0) {
5071 DEBUG(0,("check_printdest_info: invalid string %s\n",
5072 id ? id : "<NULL>" ));
5073 return False;
5074 }
5075 return True;
5076 }
5077
5078 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
5079 struct pack_desc* desc)
5080 {
5081 char buf[100];
5082
5083 strncpy(buf, info2->printername, sizeof(buf)-1);
5084 buf[sizeof(buf)-1] = 0;
5085 strupper_m(buf);
5086
5087 if (uLevel <= 1) {
5088 PACKS(desc,"B9",buf); /* szName */
5089 if (uLevel == 1) {
5090 PACKS(desc,"B21",""); /* szUserName */
5091 PACKI(desc,"W",0); /* uJobId */
5092 PACKI(desc,"W",0); /* fsStatus */
5093 PACKS(desc,"z",""); /* pszStatus */
5094 PACKI(desc,"W",0); /* time */
5095 }
5096 }
5097
5098 if (uLevel == 2 || uLevel == 3) {
5099 PACKS(desc,"z",buf); /* pszPrinterName */
5100 if (uLevel == 3) {
5101 PACKS(desc,"z",""); /* pszUserName */
5102 PACKS(desc,"z",""); /* pszLogAddr */
5103 PACKI(desc,"W",0); /* uJobId */
5104 PACKI(desc,"W",0); /* fsStatus */
5105 PACKS(desc,"z",""); /* pszStatus */
5106 PACKS(desc,"z",""); /* pszComment */
5107 PACKS(desc,"z","NULL"); /* pszDrivers */
5108 PACKI(desc,"W",0); /* time */
5109 PACKI(desc,"W",0); /* pad1 */
5110 }
5111 }
5112 }
5113
5114 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
5115 connection_struct *conn, uint16 vuid,
5116 char *param, int tpscnt,
5117 char *data, int tdscnt,
5118 int mdrcnt,int mprcnt,
5119 char **rdata,char **rparam,
5120 int *rdata_len,int *rparam_len)
5121 {
5122 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5123 char *str2 = skip_string(param,tpscnt,str1);
5124 char *p = skip_string(param,tpscnt,str2);
5125 char* PrinterName = p;
5126 int uLevel;
5127 struct pack_desc desc;
5128 char *tmpdata=NULL;
5129
5130 TALLOC_CTX *mem_ctx = talloc_tos();
5131 WERROR werr;
5132 NTSTATUS status;
5133 struct rpc_pipe_client *cli = NULL;
5134 struct dcerpc_binding_handle *b = NULL;
5135 struct policy_handle handle;
5136 struct spoolss_DevmodeContainer devmode_ctr;
5137 union spoolss_PrinterInfo info;
5138
5139 if (!str1 || !str2 || !p) {
5140 return False;
5141 }
5142
5143 memset((char *)&desc,'\0',sizeof(desc));
5144
5145 p = skip_string(param,tpscnt,p);
5146 if (!p) {
5147 return False;
5148 }
5149 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5150
5151 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
5152
5153 /* check it's a supported varient */
5154 if (strcmp(str1,"zWrLh") != 0) {
5155 return False;
5156 }
5157 if (!check_printdest_info(&desc,uLevel,str2)) {
5158 return False;
5159 }
5160
5161 ZERO_STRUCT(handle);
5162
5163 status = rpc_pipe_open_interface(conn,
5164 &ndr_table_spoolss.syntax_id,
5165 conn->session_info,
5166 &conn->sconn->client_id,
5167 conn->sconn->msg_ctx,
5168 &cli);
5169 if (!NT_STATUS_IS_OK(status)) {
5170 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
5171 nt_errstr(status)));
5172 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5173 goto out;
5174 }
5175 b = cli->binding_handle;
5176
5177 ZERO_STRUCT(devmode_ctr);
5178
5179 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5180 PrinterName,
5181 NULL,
5182 devmode_ctr,
5183 SEC_FLAG_MAXIMUM_ALLOWED,
5184 &handle,
5185 &werr);
5186 if (!NT_STATUS_IS_OK(status)) {
5187 *rdata_len = 0;
5188 desc.errcode = NERR_DestNotFound;
5189 desc.neededlen = 0;
5190 goto out;
5191 }
5192 if (!W_ERROR_IS_OK(werr)) {
5193 *rdata_len = 0;
5194 desc.errcode = NERR_DestNotFound;
5195 desc.neededlen = 0;
5196 goto out;
5197 }
5198
5199 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
5200 &handle,
5201 2,
5202 0,
5203 &info);
5204 if (!W_ERROR_IS_OK(werr)) {
5205 *rdata_len = 0;
5206 desc.errcode = NERR_DestNotFound;
5207 desc.neededlen = 0;
5208 goto out;
5209 }
5210
5211 if (mdrcnt > 0) {
5212 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5213 if (!*rdata) {
5214 return False;
5215 }
5216 desc.base = *rdata;
5217 desc.buflen = mdrcnt;
5218 } else {
5219 /*
5220 * Don't return data but need to get correct length
5221 * init_package will return wrong size if buflen=0
5222 */
5223 desc.buflen = getlen(desc.format);
5224 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
5225 }
5226 if (init_package(&desc,1,0)) {
5227 fill_printdest_info(&info.info2, uLevel,&desc);
5228 }
5229
5230 out:
5231 if (b && is_valid_policy_hnd(&handle)) {
5232 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5233 }
5234
5235 *rdata_len = desc.usedlen;
5236
5237 *rparam_len = 6;
5238 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5239 if (!*rparam) {
5240 return False;
5241 }
5242 SSVALS(*rparam,0,desc.errcode);
5243 SSVAL(*rparam,2,0);
5244 SSVAL(*rparam,4,desc.neededlen);
5245
5246 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5247 SAFE_FREE(tmpdata);
5248
5249 return True;
5250 }
5251
5252 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5253 connection_struct *conn, uint16 vuid,
5254 char *param, int tpscnt,
5255 char *data, int tdscnt,
5256 int mdrcnt,int mprcnt,
5257 char **rdata,char **rparam,
5258 int *rdata_len,int *rparam_len)
5259 {
5260 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5261 char *str2 = skip_string(param,tpscnt,str1);
5262 char *p = skip_string(param,tpscnt,str2);
5263 int uLevel;
5264 int queuecnt;
5265 int i, n, succnt=0;
5266 struct pack_desc desc;
5267
5268 TALLOC_CTX *mem_ctx = talloc_tos();
5269 WERROR werr;
5270 NTSTATUS status;
5271 struct rpc_pipe_client *cli = NULL;
5272 union spoolss_PrinterInfo *info;
5273 uint32_t count;
5274
5275 if (!str1 || !str2 || !p) {
5276 return False;
5277 }
5278
5279 memset((char *)&desc,'\0',sizeof(desc));
5280
5281 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5282
5283 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5284
5285 /* check it's a supported varient */
5286 if (strcmp(str1,"WrLeh") != 0) {
5287 return False;
5288 }
5289 if (!check_printdest_info(&desc,uLevel,str2)) {
5290 return False;
5291 }
5292
5293 queuecnt = 0;
5294
5295 status = rpc_pipe_open_interface(conn,
5296 &ndr_table_spoolss.syntax_id,
5297 conn->session_info,
5298 &conn->sconn->client_id,
5299 conn->sconn->msg_ctx,
5300 &cli);
5301 if (!NT_STATUS_IS_OK(status)) {
5302 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5303 nt_errstr(status)));
5304 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5305 goto out;
5306 }
5307
5308 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5309 PRINTER_ENUM_LOCAL,
5310 cli->srv_name_slash,
5311 2,
5312 0,
5313 &count,
5314 &info);
5315 if (!W_ERROR_IS_OK(werr)) {
5316 desc.errcode = W_ERROR_V(werr);
5317 *rdata_len = 0;
5318 desc.errcode = NERR_DestNotFound;
5319 desc.neededlen = 0;
5320 goto out;
5321 }
5322
5323 queuecnt = count;
5324
5325 if (mdrcnt > 0) {
5326 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5327 if (!*rdata) {
5328 return False;
5329 }
5330 }
5331
5332 desc.base = *rdata;
5333 desc.buflen = mdrcnt;
5334 if (init_package(&desc,queuecnt,0)) {
5335 succnt = 0;
5336 n = 0;
5337 for (i = 0; i < count; i++) {
5338 fill_printdest_info(&info[i].info2, uLevel,&desc);
5339 n++;
5340 if (desc.errcode == NERR_Success) {
5341 succnt = n;
5342 }
5343 }
5344 }
5345 out:
5346 *rdata_len = desc.usedlen;
5347
5348 *rparam_len = 8;
5349 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5350 if (!*rparam) {
5351 return False;
5352 }
5353 SSVALS(*rparam,0,desc.errcode);
5354 SSVAL(*rparam,2,0);
5355 SSVAL(*rparam,4,succnt);
5356 SSVAL(*rparam,6,queuecnt);
5357
5358 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5359
5360 return True;
5361 }
5362
5363 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5364 connection_struct *conn, uint16 vuid,
5365 char *param, int tpscnt,
5366 char *data, int tdscnt,
5367 int mdrcnt,int mprcnt,
5368 char **rdata,char **rparam,
5369 int *rdata_len,int *rparam_len)
5370 {
5371 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5372 char *str2 = skip_string(param,tpscnt,str1);
5373 char *p = skip_string(param,tpscnt,str2);
5374 int uLevel;
5375 int succnt;
5376 struct pack_desc desc;
5377
5378 if (!str1 || !str2 || !p) {
5379 return False;
5380 }
5381
5382 memset((char *)&desc,'\0',sizeof(desc));
5383
5384 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5385
5386 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5387
5388 /* check it's a supported varient */
5389 if (strcmp(str1,"WrLeh") != 0) {
5390 return False;
5391 }
5392 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5393 return False;
5394 }
5395
5396 if (mdrcnt > 0) {
5397 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5398 if (!*rdata) {
5399 return False;
5400 }
5401 }
5402 desc.base = *rdata;
5403 desc.buflen = mdrcnt;
5404 if (init_package(&desc,1,0)) {
5405 PACKS(&desc,"B41","NULL");
5406 }
5407
5408 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5409
5410 *rdata_len = desc.usedlen;
5411
5412 *rparam_len = 8;
5413 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5414 if (!*rparam) {
5415 return False;
5416 }
5417 SSVALS(*rparam,0,desc.errcode);
5418 SSVAL(*rparam,2,0);
5419 SSVAL(*rparam,4,succnt);
5420 SSVAL(*rparam,6,1);
5421
5422 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5423
5424 return True;
5425 }
5426
5427 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5428 connection_struct *conn, uint16 vuid,
5429 char *param, int tpscnt,
5430 char *data, int tdscnt,
5431 int mdrcnt,int mprcnt,
5432 char **rdata,char **rparam,
5433 int *rdata_len,int *rparam_len)
5434 {
5435 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5436 char *str2 = skip_string(param,tpscnt,str1);
5437 char *p = skip_string(param,tpscnt,str2);
5438 int uLevel;
5439 int succnt;
5440 struct pack_desc desc;
5441
5442 if (!str1 || !str2 || !p) {
5443 return False;
5444 }
5445 memset((char *)&desc,'\0',sizeof(desc));
5446
5447 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5448
5449 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5450
5451 /* check it's a supported varient */
5452 if (strcmp(str1,"WrLeh") != 0) {
5453 return False;
5454 }
5455 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5456 return False;
5457 }
5458
5459 if (mdrcnt > 0) {
5460 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5461 if (!*rdata) {
5462 return False;
5463 }
5464 }
5465 desc.base = *rdata;
5466 desc.buflen = mdrcnt;
5467 desc.format = str2;
5468 if (init_package(&desc,1,0)) {
5469 PACKS(&desc,"B13","lpd");
5470 }
5471
5472 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5473
5474 *rdata_len = desc.usedlen;
5475
5476 *rparam_len = 8;
5477 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5478 if (!*rparam) {
5479 return False;
5480 }
5481 SSVALS(*rparam,0,desc.errcode);
5482 SSVAL(*rparam,2,0);
5483 SSVAL(*rparam,4,succnt);
5484 SSVAL(*rparam,6,1);
5485
5486 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5487
5488 return True;
5489 }
5490
5491 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5492 connection_struct *conn, uint16 vuid,
5493 char *param, int tpscnt,
5494 char *data, int tdscnt,
5495 int mdrcnt,int mprcnt,
5496 char **rdata,char **rparam,
5497 int *rdata_len,int *rparam_len)
5498 {
5499 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5500 char *str2 = skip_string(param,tpscnt,str1);
5501 char *p = skip_string(param,tpscnt,str2);
5502 int uLevel;
5503 int succnt;
5504 struct pack_desc desc;
5505
5506 if (!str1 || !str2 || !p) {
5507 return False;
5508 }
5509
5510 memset((char *)&desc,'\0',sizeof(desc));
5511
5512 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5513
5514 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5515
5516 /* check it's a supported varient */
5517 if (strcmp(str1,"WrLeh") != 0) {
5518 return False;
5519 }
5520 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5521 return False;
5522 }
5523
5524 if (mdrcnt > 0) {
5525 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5526 if (!*rdata) {
5527 return False;
5528 }
5529 }
5530 memset((char *)&desc,'\0',sizeof(desc));
5531 desc.base = *rdata;
5532 desc.buflen = mdrcnt;
5533 desc.format = str2;
5534 if (init_package(&desc,1,0)) {
5535 PACKS(&desc,"B13","lp0");
5536 }
5537
5538 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5539
5540 *rdata_len = desc.usedlen;
5541
5542 *rparam_len = 8;
5543 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5544 if (!*rparam) {
5545 return False;
5546 }
5547 SSVALS(*rparam,0,desc.errcode);
5548 SSVAL(*rparam,2,0);
5549 SSVAL(*rparam,4,succnt);
5550 SSVAL(*rparam,6,1);
5551
5552 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5553
5554 return True;
5555 }
5556
5557 /****************************************************************************
5558 List open sessions
5559 ****************************************************************************/
5560
5561 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5562 connection_struct *conn, uint16 vuid,
5563 char *param, int tpscnt,
5564 char *data, int tdscnt,
5565 int mdrcnt,int mprcnt,
5566 char **rdata,char **rparam,
5567 int *rdata_len,int *rparam_len)
5568
5569 {
5570 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5571 char *str2 = skip_string(param,tpscnt,str1);
5572 char *p = skip_string(param,tpscnt,str2);
5573 int uLevel;
5574 struct pack_desc desc;
5575 int i;
5576
5577 TALLOC_CTX *mem_ctx = talloc_tos();
5578 WERROR werr;
5579 NTSTATUS status;
5580 struct rpc_pipe_client *cli = NULL;
5581 struct dcerpc_binding_handle *b = NULL;
5582 struct srvsvc_NetSessInfoCtr info_ctr;
5583 uint32_t totalentries, resume_handle = 0;
5584 uint32_t count = 0;
5585
5586 if (!str1 || !str2 || !p) {
5587 return False;
5588 }
5589
5590 ZERO_STRUCT(desc);
5591
5592 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5593
5594 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5595 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5596 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5597
5598 /* check it's a supported varient */
5599 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5600 return False;
5601 }
5602 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5603 return False;
5604 }
5605
5606 status = rpc_pipe_open_interface(conn,
5607 &ndr_table_srvsvc.syntax_id,
5608 conn->session_info,
5609 &conn->sconn->client_id,
5610 conn->sconn->msg_ctx,
5611 &cli);
5612 if (!NT_STATUS_IS_OK(status)) {
5613 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5614 nt_errstr(status)));
5615 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5616 goto out;
5617 }
5618 b = cli->binding_handle;
5619
5620 info_ctr.level = 1;
5621 info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5622 if (info_ctr.ctr.ctr1 == NULL) {
5623 desc.errcode = W_ERROR_V(WERR_NOMEM);
5624 goto out;
5625 }
5626
5627 status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5628 cli->srv_name_slash,
5629 NULL, /* client */
5630 NULL, /* user */
5631 &info_ctr,
5632 (uint32_t)-1, /* max_buffer */
5633 &totalentries,
5634 &resume_handle,
5635 &werr);
5636 if (!NT_STATUS_IS_OK(status)) {
5637 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5638 nt_errstr(status)));
5639 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5640 goto out;
5641 }
5642
5643 if (!W_ERROR_IS_OK(werr)) {
5644 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5645 win_errstr(werr)));
5646 desc.errcode = W_ERROR_V(werr);
5647 goto out;
5648 }
5649
5650 count = info_ctr.ctr.ctr1->count;
5651
5652 out:
5653 if (mdrcnt > 0) {
5654 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5655 if (!*rdata) {
5656 return False;
5657 }
5658 }
5659
5660 desc.base = *rdata;
5661 desc.buflen = mdrcnt;
5662 desc.format = str2;
5663 if (!init_package(&desc, count,0)) {
5664 return False;
5665 }
5666
5667 for(i=0; i < count; i++) {
5668 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5669 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5670 PACKI(&desc, "W", 1); /* num conns */
5671 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5672 PACKI(&desc, "W", 1); /* num users */
5673 PACKI(&desc, "D", 0); /* session time */
5674 PACKI(&desc, "D", 0); /* idle time */
5675 PACKI(&desc, "D", 0); /* flags */
5676 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5677 }
5678
5679 *rdata_len = desc.usedlen;
5680
5681 *rparam_len = 8;
5682 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5683 if (!*rparam) {
5684 return False;
5685 }
5686 SSVALS(*rparam,0,desc.errcode);
5687 SSVAL(*rparam,2,0); /* converter */
5688 SSVAL(*rparam,4, count); /* count */
5689
5690 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5691
5692 return True;
5693 }
5694
5695
5696 /****************************************************************************
5697 The buffer was too small.
5698 ****************************************************************************/
5699
5700 static bool api_TooSmall(struct smbd_server_connection *sconn,
5701 connection_struct *conn,uint16 vuid, char *param, char *data,
5702 int mdrcnt, int mprcnt,
5703 char **rdata, char **rparam,
5704 int *rdata_len, int *rparam_len)
5705 {
5706 *rparam_len = MIN(*rparam_len,mprcnt);
5707 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5708 if (!*rparam) {
5709 return False;
5710 }
5711
5712 *rdata_len = 0;
5713
5714 SSVAL(*rparam,0,NERR_BufTooSmall);
5715
5716 DEBUG(3,("Supplied buffer too small in API command\n"));
5717
5718 return True;
5719 }
5720
5721 /****************************************************************************
5722 The request is not supported.
5723 ****************************************************************************/
5724
5725 static bool api_Unsupported(struct smbd_server_connection *sconn,
5726 connection_struct *conn, uint16 vuid,
5727 char *param, int tpscnt,
5728 char *data, int tdscnt,
5729 int mdrcnt, int mprcnt,
5730 char **rdata, char **rparam,
5731 int *rdata_len, int *rparam_len)
5732 {
5733 *rparam_len = 4;
5734 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5735 if (!*rparam) {
5736 return False;
5737 }
5738
5739 *rdata_len = 0;
5740
5741 SSVAL(*rparam,0,NERR_notsupported);
5742 SSVAL(*rparam,2,0); /* converter word */
5743
5744 DEBUG(3,("Unsupported API command\n"));
5745
5746 return True;
5747 }
5748
5749 static const struct {
5750 const char *name;
5751 int id;
5752 bool (*fn)(struct smbd_server_connection *sconn,
5753 connection_struct *, uint16,
5754 char *, int,
5755 char *, int,
5756 int,int,char **,char **,int *,int *);
5757 bool auth_user; /* Deny anonymous access? */
5758 } api_commands[] = {
5759 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
5760 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
5761 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
5762 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
5763 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
5764 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
5765 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
5766 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
5767 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
5768 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
5769 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
5770 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
5771 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
5772 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
5773 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
5774 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
5775 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
5776 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
5777 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
5778 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
5779 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
5780 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
5781 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
5782 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
5783 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
5784 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
5785 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5786 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
5787 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
5788 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
5789 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
5790 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5791 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
5792 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5793 {NULL, -1, api_Unsupported}
5794 /* The following RAP calls are not implemented by Samba:
5795
5796 RAP_WFileEnum2 - anon not OK
5797 */
5798 };
5799
5800
5801 /****************************************************************************
5802 Handle remote api calls.
5803 ****************************************************************************/
5804
5805 void api_reply(connection_struct *conn, uint16 vuid,
5806 struct smb_request *req,
5807 char *data, char *params,
5808 int tdscnt, int tpscnt,
5809 int mdrcnt, int mprcnt)
5810 {
5811 int api_command;
5812 char *rdata = NULL;
5813 char *rparam = NULL;
5814 const char *name1 = NULL;
5815 const char *name2 = NULL;
5816 int rdata_len = 0;
5817 int rparam_len = 0;
5818 bool reply=False;
5819 int i;
5820
5821 if (!params) {
5822 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5823 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5824 return;
5825 }
5826
5827 if (tpscnt < 2) {
5828 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5829 return;
5830 }
5831 api_command = SVAL(params,0);
5832 /* Is there a string at position params+2 ? */
5833 if (skip_string(params,tpscnt,params+2)) {
5834 name1 = params + 2;
5835 } else {
5836 name1 = "";
5837 }
5838 name2 = skip_string(params,tpscnt,params+2);
5839 if (!name2) {
5840 name2 = "";
5841 }
5842
5843 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5844 api_command,
5845 name1,
5846 name2,
5847 tdscnt,tpscnt,mdrcnt,mprcnt));
5848
5849 for (i=0;api_commands[i].name;i++) {
5850 if (api_commands[i].id == api_command && api_commands[i].fn) {
5851 DEBUG(3,("Doing %s\n",api_commands[i].name));
5852 break;
5853 }
5854 }
5855
5856 /* Check whether this api call can be done anonymously */
5857
5858 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5859 user_struct *user = get_valid_user_struct(req->sconn, vuid);
5860
5861 if (!user || user->session_info->guest) {
5862 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5863 return;
5864 }
5865 }
5866
5867 rdata = (char *)SMB_MALLOC(1024);
5868 if (rdata) {
5869 memset(rdata,'\0',1024);
5870 }
5871
5872 rparam = (char *)SMB_MALLOC(1024);
5873 if (rparam) {
5874 memset(rparam,'\0',1024);
5875 }
5876
5877 if(!rdata || !rparam) {
5878 DEBUG(0,("api_reply: malloc fail !\n"));
5879 SAFE_FREE(rdata);
5880 SAFE_FREE(rparam);
5881 reply_nterror(req, NT_STATUS_NO_MEMORY);
5882 return;
5883 }
5884
5885 reply = api_commands[i].fn(req->sconn, conn,
5886 vuid,
5887 params,tpscnt, /* params + length */
5888 data,tdscnt, /* data + length */
5889 mdrcnt,mprcnt,
5890 &rdata,&rparam,&rdata_len,&rparam_len);
5891
5892
5893 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5894 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5895 mdrcnt,mprcnt,
5896 &rdata,&rparam,&rdata_len,&rparam_len);
5897 }
5898
5899 /* if we get False back then it's actually unsupported */
5900 if (!reply) {
5901 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5902 data,
5903 tdscnt,mdrcnt,mprcnt,
5904 &rdata,&rparam,&rdata_len,&rparam_len);
5905 }
5906
5907 /* If api_Unsupported returns false we can't return anything. */
5908 if (reply) {
5909 send_trans_reply(conn, req, rparam, rparam_len,
5910 rdata, rdata_len, False);
5911 }
5912
5913 SAFE_FREE(rdata);
5914 SAFE_FREE(rparam);
5915 return;
5916 }
Samba GIT mirror