?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Do not use the file system GET_REAL_FILENAME for mangled names
[Samba.git] / source3 / smbd / lanman.c
blob979e5b57a44d495b8d1d8a83c4ac8550618059c0
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29
30 #ifdef CHECK_TYPES
31 #undef CHECK_TYPES
32 #endif
33 #define CHECK_TYPES 0
34
35 #define NERR_Success 0
36 #define NERR_badpass 86
37 #define NERR_notsupported 50
38
39 #define NERR_BASE (2100)
40 #define NERR_BufTooSmall (NERR_BASE+23)
41 #define NERR_JobNotFound (NERR_BASE+51)
42 #define NERR_DestNotFound (NERR_BASE+52)
43
44 #define ACCESS_READ 0x01
45 #define ACCESS_WRITE 0x02
46 #define ACCESS_CREATE 0x04
47
48 #define SHPWLEN 8 /* share password length */
49
50 /* Limit size of ipc replies */
51
52 static char *smb_realloc_limit(void *ptr, size_t size)
53 {
54 char *val;
55
56 size = MAX((size),4*1024);
57 val = (char *)SMB_REALLOC(ptr,size);
58 if (val) {
59 memset(val,'\0',size);
60 }
61 return val;
62 }
63
64 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
65 char *param, int tpscnt,
66 char *data, int tdscnt,
67 int mdrcnt, int mprcnt,
68 char **rdata, char **rparam,
69 int *rdata_len, int *rparam_len);
70
71 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
72 int mdrcnt, int mprcnt,
73 char **rdata, char **rparam,
74 int *rdata_len, int *rparam_len);
75
76
77 static int CopyExpanded(connection_struct *conn,
78 int snum, char **dst, char *src, int *p_space_remaining)
79 {
80 TALLOC_CTX *ctx = talloc_tos();
81 char *buf = NULL;
82 int l;
83
84 if (!src || !dst || !p_space_remaining || !(*dst) ||
85 *p_space_remaining <= 0) {
86 return 0;
87 }
88
89 buf = talloc_strdup(ctx, src);
90 if (!buf) {
91 *p_space_remaining = 0;
92 return 0;
93 }
94 buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
95 if (!buf) {
96 *p_space_remaining = 0;
97 return 0;
98 }
99 buf = talloc_sub_advanced(ctx,
100 lp_servicename(SNUM(conn)),
101 conn->server_info->unix_name,
102 conn->connectpath,
103 conn->server_info->utok.gid,
104 conn->server_info->sanitized_username,
105 pdb_get_domain(conn->server_info->sam_account),
106 buf);
107 if (!buf) {
108 *p_space_remaining = 0;
109 return 0;
110 }
111 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
112 if (l == -1) {
113 return 0;
114 }
115 (*dst) += l;
116 (*p_space_remaining) -= l;
117 return l;
118 }
119
120 static int CopyAndAdvance(char **dst, char *src, int *n)
121 {
122 int l;
123 if (!src || !dst || !n || !(*dst)) {
124 return 0;
125 }
126 l = push_ascii(*dst,src,*n, STR_TERMINATE);
127 if (l == -1) {
128 return 0;
129 }
130 (*dst) += l;
131 (*n) -= l;
132 return l;
133 }
134
135 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
136 {
137 TALLOC_CTX *ctx = talloc_tos();
138 char *buf = NULL;
139 if (!s) {
140 return 0;
141 }
142 buf = talloc_strdup(ctx,s);
143 if (!buf) {
144 return 0;
145 }
146 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
147 if (!buf) {
148 return 0;
149 }
150 buf = talloc_sub_advanced(ctx,
151 lp_servicename(SNUM(conn)),
152 conn->server_info->unix_name,
153 conn->connectpath,
154 conn->server_info->utok.gid,
155 conn->server_info->sanitized_username,
156 pdb_get_domain(conn->server_info->sam_account),
157 buf);
158 if (!buf) {
159 return 0;
160 }
161 return strlen(buf) + 1;
162 }
163
164 static char *Expand(connection_struct *conn, int snum, char *s)
165 {
166 TALLOC_CTX *ctx = talloc_tos();
167 char *buf = NULL;
168
169 if (!s) {
170 return NULL;
171 }
172 buf = talloc_strdup(ctx,s);
173 if (!buf) {
174 return 0;
175 }
176 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
177 if (!buf) {
178 return 0;
179 }
180 return talloc_sub_advanced(ctx,
181 lp_servicename(SNUM(conn)),
182 conn->server_info->unix_name,
183 conn->connectpath,
184 conn->server_info->utok.gid,
185 conn->server_info->sanitized_username,
186 pdb_get_domain(conn->server_info->sam_account),
187 buf);
188 }
189
190 /*******************************************************************
191 Check a API string for validity when we only need to check the prefix.
192 ******************************************************************/
193
194 static bool prefix_ok(const char *str, const char *prefix)
195 {
196 return(strncmp(str,prefix,strlen(prefix)) == 0);
197 }
198
199 struct pack_desc {
200 const char *format; /* formatstring for structure */
201 const char *subformat; /* subformat for structure */
202 char *base; /* baseaddress of buffer */
203 int buflen; /* remaining size for fixed part; on init: length of base */
204 int subcount; /* count of substructures */
205 char *structbuf; /* pointer into buffer for remaining fixed part */
206 int stringlen; /* remaining size for variable part */
207 char *stringbuf; /* pointer into buffer for remaining variable part */
208 int neededlen; /* total needed size */
209 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
210 const char *curpos; /* current position; pointer into format or subformat */
211 int errcode;
212 };
213
214 static int get_counter(const char **p)
215 {
216 int i, n;
217 if (!p || !(*p)) {
218 return 1;
219 }
220 if (!isdigit((int)**p)) {
221 return 1;
222 }
223 for (n = 0;;) {
224 i = **p;
225 if (isdigit(i)) {
226 n = 10 * n + (i - '0');
227 } else {
228 return n;
229 }
230 (*p)++;
231 }
232 }
233
234 static int getlen(const char *p)
235 {
236 int n = 0;
237 if (!p) {
238 return 0;
239 }
240
241 while (*p) {
242 switch( *p++ ) {
243 case 'W': /* word (2 byte) */
244 n += 2;
245 break;
246 case 'K': /* status word? (2 byte) */
247 n += 2;
248 break;
249 case 'N': /* count of substructures (word) at end */
250 n += 2;
251 break;
252 case 'D': /* double word (4 byte) */
253 case 'z': /* offset to zero terminated string (4 byte) */
254 case 'l': /* offset to user data (4 byte) */
255 n += 4;
256 break;
257 case 'b': /* offset to data (with counter) (4 byte) */
258 n += 4;
259 get_counter(&p);
260 break;
261 case 'B': /* byte (with optional counter) */
262 n += get_counter(&p);
263 break;
264 }
265 }
266 return n;
267 }
268
269 static bool init_package(struct pack_desc *p, int count, int subcount)
270 {
271 int n = p->buflen;
272 int i;
273
274 if (!p->format || !p->base) {
275 return False;
276 }
277
278 i = count * getlen(p->format);
279 if (p->subformat) {
280 i += subcount * getlen(p->subformat);
281 }
282 p->structbuf = p->base;
283 p->neededlen = 0;
284 p->usedlen = 0;
285 p->subcount = 0;
286 p->curpos = p->format;
287 if (i > n) {
288 p->neededlen = i;
289 i = n = 0;
290 #if 0
291 /*
292 * This is the old error code we used. Aparently
293 * WinNT/2k systems return ERRbuftoosmall (2123) and
294 * OS/2 needs this. I'm leaving this here so we can revert
295 * if needed. JRA.
296 */
297 p->errcode = ERRmoredata;
298 #else
299 p->errcode = ERRbuftoosmall;
300 #endif
301 } else {
302 p->errcode = NERR_Success;
303 }
304 p->buflen = i;
305 n -= i;
306 p->stringbuf = p->base + i;
307 p->stringlen = n;
308 return (p->errcode == NERR_Success);
309 }
310
311 static int package(struct pack_desc *p, ...)
312 {
313 va_list args;
314 int needed=0, stringneeded;
315 const char *str=NULL;
316 int is_string=0, stringused;
317 int32 temp;
318
319 va_start(args,p);
320
321 if (!*p->curpos) {
322 if (!p->subcount) {
323 p->curpos = p->format;
324 } else {
325 p->curpos = p->subformat;
326 p->subcount--;
327 }
328 }
329 #if CHECK_TYPES
330 str = va_arg(args,char*);
331 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
332 #endif
333 stringneeded = -1;
334
335 if (!p->curpos) {
336 va_end(args);
337 return 0;
338 }
339
340 switch( *p->curpos++ ) {
341 case 'W': /* word (2 byte) */
342 needed = 2;
343 temp = va_arg(args,int);
344 if (p->buflen >= needed) {
345 SSVAL(p->structbuf,0,temp);
346 }
347 break;
348 case 'K': /* status word? (2 byte) */
349 needed = 2;
350 temp = va_arg(args,int);
351 if (p->buflen >= needed) {
352 SSVAL(p->structbuf,0,temp);
353 }
354 break;
355 case 'N': /* count of substructures (word) at end */
356 needed = 2;
357 p->subcount = va_arg(args,int);
358 if (p->buflen >= needed) {
359 SSVAL(p->structbuf,0,p->subcount);
360 }
361 break;
362 case 'D': /* double word (4 byte) */
363 needed = 4;
364 temp = va_arg(args,int);
365 if (p->buflen >= needed) {
366 SIVAL(p->structbuf,0,temp);
367 }
368 break;
369 case 'B': /* byte (with optional counter) */
370 needed = get_counter(&p->curpos);
371 {
372 char *s = va_arg(args,char*);
373 if (p->buflen >= needed) {
374 StrnCpy(p->structbuf,s?s:"",needed-1);
375 }
376 }
377 break;
378 case 'z': /* offset to zero terminated string (4 byte) */
379 str = va_arg(args,char*);
380 stringneeded = (str ? strlen(str)+1 : 0);
381 is_string = 1;
382 break;
383 case 'l': /* offset to user data (4 byte) */
384 str = va_arg(args,char*);
385 stringneeded = va_arg(args,int);
386 is_string = 0;
387 break;
388 case 'b': /* offset to data (with counter) (4 byte) */
389 str = va_arg(args,char*);
390 stringneeded = get_counter(&p->curpos);
391 is_string = 0;
392 break;
393 }
394
395 va_end(args);
396 if (stringneeded >= 0) {
397 needed = 4;
398 if (p->buflen >= needed) {
399 stringused = stringneeded;
400 if (stringused > p->stringlen) {
401 stringused = (is_string ? p->stringlen : 0);
402 if (p->errcode == NERR_Success) {
403 p->errcode = ERRmoredata;
404 }
405 }
406 if (!stringused) {
407 SIVAL(p->structbuf,0,0);
408 } else {
409 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
410 memcpy(p->stringbuf,str?str:"",stringused);
411 if (is_string) {
412 p->stringbuf[stringused-1] = '\0';
413 }
414 p->stringbuf += stringused;
415 p->stringlen -= stringused;
416 p->usedlen += stringused;
417 }
418 }
419 p->neededlen += stringneeded;
420 }
421
422 p->neededlen += needed;
423 if (p->buflen >= needed) {
424 p->structbuf += needed;
425 p->buflen -= needed;
426 p->usedlen += needed;
427 } else {
428 if (p->errcode == NERR_Success) {
429 p->errcode = ERRmoredata;
430 }
431 }
432 return 1;
433 }
434
435 #if CHECK_TYPES
436 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
437 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
438 #else
439 #define PACK(desc,t,v) package(desc,v)
440 #define PACKl(desc,t,v,l) package(desc,v,l)
441 #endif
442
443 static void PACKI(struct pack_desc* desc, const char *t,int v)
444 {
445 PACK(desc,t,v);
446 }
447
448 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
449 {
450 PACK(desc,t,v);
451 }
452
453 /****************************************************************************
454 Get a print queue.
455 ****************************************************************************/
456
457 static void PackDriverData(struct pack_desc* desc)
458 {
459 char drivdata[4+4+32];
460 SIVAL(drivdata,0,sizeof drivdata); /* cb */
461 SIVAL(drivdata,4,1000); /* lVersion */
462 memset(drivdata+8,0,32); /* szDeviceName */
463 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
464 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
465 }
466
467 static int check_printq_info(struct pack_desc* desc,
468 unsigned int uLevel, char *id1, char *id2)
469 {
470 desc->subformat = NULL;
471 switch( uLevel ) {
472 case 0:
473 desc->format = "B13";
474 break;
475 case 1:
476 desc->format = "B13BWWWzzzzzWW";
477 break;
478 case 2:
479 desc->format = "B13BWWWzzzzzWN";
480 desc->subformat = "WB21BB16B10zWWzDDz";
481 break;
482 case 3:
483 desc->format = "zWWWWzzzzWWzzl";
484 break;
485 case 4:
486 desc->format = "zWWWWzzzzWNzzl";
487 desc->subformat = "WWzWWDDzz";
488 break;
489 case 5:
490 desc->format = "z";
491 break;
492 case 51:
493 desc->format = "K";
494 break;
495 case 52:
496 desc->format = "WzzzzzzzzN";
497 desc->subformat = "z";
498 break;
499 default:
500 DEBUG(0,("check_printq_info: invalid level %d\n",
501 uLevel ));
502 return False;
503 }
504 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
505 DEBUG(0,("check_printq_info: invalid format %s\n",
506 id1 ? id1 : "<NULL>" ));
507 return False;
508 }
509 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
510 DEBUG(0,("check_printq_info: invalid subformat %s\n",
511 id2 ? id2 : "<NULL>" ));
512 return False;
513 }
514 return True;
515 }
516
517
518 #define RAP_JOB_STATUS_QUEUED 0
519 #define RAP_JOB_STATUS_PAUSED 1
520 #define RAP_JOB_STATUS_SPOOLING 2
521 #define RAP_JOB_STATUS_PRINTING 3
522 #define RAP_JOB_STATUS_PRINTED 4
523
524 #define RAP_QUEUE_STATUS_PAUSED 1
525 #define RAP_QUEUE_STATUS_ERROR 2
526
527 /* turn a print job status into a on the wire status
528 */
529 static int printj_status(int v)
530 {
531 switch (v) {
532 case LPQ_QUEUED:
533 return RAP_JOB_STATUS_QUEUED;
534 case LPQ_PAUSED:
535 return RAP_JOB_STATUS_PAUSED;
536 case LPQ_SPOOLING:
537 return RAP_JOB_STATUS_SPOOLING;
538 case LPQ_PRINTING:
539 return RAP_JOB_STATUS_PRINTING;
540 }
541 return 0;
542 }
543
544 /* turn a print queue status into a on the wire status
545 */
546 static int printq_status(int v)
547 {
548 switch (v) {
549 case LPQ_QUEUED:
550 return 0;
551 case LPQ_PAUSED:
552 return RAP_QUEUE_STATUS_PAUSED;
553 }
554 return RAP_QUEUE_STATUS_ERROR;
555 }
556
557 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
558 struct pack_desc *desc,
559 print_queue_struct *queue, int n)
560 {
561 time_t t = queue->time;
562
563 /* the client expects localtime */
564 t -= get_time_zone(t);
565
566 PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
567 if (uLevel == 1) {
568 PACKS(desc,"B21",queue->fs_user); /* szUserName */
569 PACKS(desc,"B",""); /* pad */
570 PACKS(desc,"B16",""); /* szNotifyName */
571 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
572 PACKS(desc,"z",""); /* pszParms */
573 PACKI(desc,"W",n+1); /* uPosition */
574 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
575 PACKS(desc,"z",""); /* pszStatus */
576 PACKI(desc,"D",t); /* ulSubmitted */
577 PACKI(desc,"D",queue->size); /* ulSize */
578 PACKS(desc,"z",queue->fs_file); /* pszComment */
579 }
580 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
581 PACKI(desc,"W",queue->priority); /* uPriority */
582 PACKS(desc,"z",queue->fs_user); /* pszUserName */
583 PACKI(desc,"W",n+1); /* uPosition */
584 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
585 PACKI(desc,"D",t); /* ulSubmitted */
586 PACKI(desc,"D",queue->size); /* ulSize */
587 PACKS(desc,"z","Samba"); /* pszComment */
588 PACKS(desc,"z",queue->fs_file); /* pszDocument */
589 if (uLevel == 3) {
590 PACKS(desc,"z",""); /* pszNotifyName */
591 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
592 PACKS(desc,"z",""); /* pszParms */
593 PACKS(desc,"z",""); /* pszStatus */
594 PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
595 PACKS(desc,"z","lpd"); /* pszQProcName */
596 PACKS(desc,"z",""); /* pszQProcParms */
597 PACKS(desc,"z","NULL"); /* pszDriverName */
598 PackDriverData(desc); /* pDriverData */
599 PACKS(desc,"z",""); /* pszPrinterName */
600 } else if (uLevel == 4) { /* OS2 */
601 PACKS(desc,"z",""); /* pszSpoolFileName */
602 PACKS(desc,"z",""); /* pszPortName */
603 PACKS(desc,"z",""); /* pszStatus */
604 PACKI(desc,"D",0); /* ulPagesSpooled */
605 PACKI(desc,"D",0); /* ulPagesSent */
606 PACKI(desc,"D",0); /* ulPagesPrinted */
607 PACKI(desc,"D",0); /* ulTimePrinted */
608 PACKI(desc,"D",0); /* ulExtendJobStatus */
609 PACKI(desc,"D",0); /* ulStartPage */
610 PACKI(desc,"D",0); /* ulEndPage */
611 }
612 }
613 }
614
615 /********************************************************************
616 Return a driver name given an snum.
617 Returns True if from tdb, False otherwise.
618 ********************************************************************/
619
620 static bool get_driver_name(int snum, char **pp_drivername)
621 {
622 NT_PRINTER_INFO_LEVEL *info = NULL;
623 bool in_tdb = false;
624
625 get_a_printer (NULL, &info, 2, lp_servicename(snum));
626 if (info != NULL) {
627 *pp_drivername = talloc_strdup(talloc_tos(),
628 info->info_2->drivername);
629 in_tdb = true;
630 free_a_printer(&info, 2);
631 if (!*pp_drivername) {
632 return false;
633 }
634 }
635
636 return in_tdb;
637 }
638
639 /********************************************************************
640 Respond to the DosPrintQInfo command with a level of 52
641 This is used to get printer driver information for Win9x clients
642 ********************************************************************/
643 static void fill_printq_info_52(connection_struct *conn, int snum,
644 struct pack_desc* desc, int count )
645 {
646 int i;
647 fstring location;
648 NT_PRINTER_DRIVER_INFO_LEVEL driver;
649 NT_PRINTER_INFO_LEVEL *printer = NULL;
650
651 ZERO_STRUCT(driver);
652
653 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
654 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
655 lp_servicename(snum)));
656 goto err;
657 }
658
659 if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
660 "Windows 4.0", 0)) )
661 {
662 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
663 printer->info_2->drivername));
664 goto err;
665 }
666
667 trim_string(driver.info_3->driverpath, "\\print$\\WIN40\\0\\", 0);
668 trim_string(driver.info_3->datafile, "\\print$\\WIN40\\0\\", 0);
669 trim_string(driver.info_3->helpfile, "\\print$\\WIN40\\0\\", 0);
670
671 PACKI(desc, "W", 0x0400); /* don't know */
672 PACKS(desc, "z", driver.info_3->name); /* long printer name */
673 PACKS(desc, "z", driver.info_3->driverpath); /* Driverfile Name */
674 PACKS(desc, "z", driver.info_3->datafile); /* Datafile name */
675 PACKS(desc, "z", driver.info_3->monitorname); /* language monitor */
676
677 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
678 standard_sub_basic( "", "", location, sizeof(location)-1 );
679 PACKS(desc,"z", location); /* share to retrieve files */
680
681 PACKS(desc,"z", driver.info_3->defaultdatatype); /* default data type */
682 PACKS(desc,"z", driver.info_3->helpfile); /* helpfile name */
683 PACKS(desc,"z", driver.info_3->driverpath); /* driver name */
684
685 DEBUG(3,("Printer Driver Name: %s:\n",driver.info_3->name));
686 DEBUG(3,("Driver: %s:\n",driver.info_3->driverpath));
687 DEBUG(3,("Data File: %s:\n",driver.info_3->datafile));
688 DEBUG(3,("Language Monitor: %s:\n",driver.info_3->monitorname));
689 DEBUG(3,("Driver Location: %s:\n",location));
690 DEBUG(3,("Data Type: %s:\n",driver.info_3->defaultdatatype));
691 DEBUG(3,("Help File: %s:\n",driver.info_3->helpfile));
692 PACKI(desc,"N",count); /* number of files to copy */
693
694 for ( i=0; i<count && driver.info_3->dependentfiles && *driver.info_3->dependentfiles[i]; i++)
695 {
696 trim_string(driver.info_3->dependentfiles[i], "\\print$\\WIN40\\0\\", 0);
697 PACKS(desc,"z",driver.info_3->dependentfiles[i]); /* driver files to copy */
698 DEBUG(3,("Dependent File: %s:\n",driver.info_3->dependentfiles[i]));
699 }
700
701 /* sanity check */
702 if ( i != count )
703 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
704 count, i));
705
706 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
707
708 desc->errcode=NERR_Success;
709 goto done;
710
711 err:
712 DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
713 desc->errcode=NERR_notsupported;
714
715 done:
716 if ( printer )
717 free_a_printer( &printer, 2 );
718
719 if ( driver.info_3 )
720 free_a_printer_driver( driver, 3 );
721 }
722
723
724 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
725 struct pack_desc* desc,
726 int count, print_queue_struct* queue,
727 print_status_struct* status)
728 {
729 switch (uLevel) {
730 case 1:
731 case 2:
732 PACKS(desc,"B13",SERVICE(snum));
733 break;
734 case 3:
735 case 4:
736 case 5:
737 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
738 break;
739 case 51:
740 PACKI(desc,"K",printq_status(status->status));
741 break;
742 }
743
744 if (uLevel == 1 || uLevel == 2) {
745 PACKS(desc,"B",""); /* alignment */
746 PACKI(desc,"W",5); /* priority */
747 PACKI(desc,"W",0); /* start time */
748 PACKI(desc,"W",0); /* until time */
749 PACKS(desc,"z",""); /* pSepFile */
750 PACKS(desc,"z","lpd"); /* pPrProc */
751 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
752 PACKS(desc,"z",""); /* pParms */
753 if (snum < 0) {
754 PACKS(desc,"z","UNKNOWN PRINTER");
755 PACKI(desc,"W",LPSTAT_ERROR);
756 }
757 else if (!status || !status->message[0]) {
758 PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
759 PACKI(desc,"W",LPSTAT_OK); /* status */
760 } else {
761 PACKS(desc,"z",status->message);
762 PACKI(desc,"W",printq_status(status->status)); /* status */
763 }
764 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
765 }
766
767 if (uLevel == 3 || uLevel == 4) {
768 char *drivername = NULL;
769
770 PACKI(desc,"W",5); /* uPriority */
771 PACKI(desc,"W",0); /* uStarttime */
772 PACKI(desc,"W",0); /* uUntiltime */
773 PACKI(desc,"W",5); /* pad1 */
774 PACKS(desc,"z",""); /* pszSepFile */
775 PACKS(desc,"z","WinPrint"); /* pszPrProc */
776 PACKS(desc,"z",NULL); /* pszParms */
777 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
778 /* "don't ask" that it's done this way to fix corrupted
779 Win9X/ME printer comments. */
780 if (!status) {
781 PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
782 } else {
783 PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
784 }
785 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
786 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
787 get_driver_name(snum,&drivername);
788 if (!drivername) {
789 return;
790 }
791 PACKS(desc,"z",drivername); /* pszDriverName */
792 PackDriverData(desc); /* pDriverData */
793 }
794
795 if (uLevel == 2 || uLevel == 4) {
796 int i;
797 for (i=0;i<count;i++)
798 fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
799 }
800
801 if (uLevel==52)
802 fill_printq_info_52( conn, snum, desc, count );
803 }
804
805 /* This function returns the number of files for a given driver */
806 static int get_printerdrivernumber(int snum)
807 {
808 int result = 0;
809 NT_PRINTER_DRIVER_INFO_LEVEL driver;
810 NT_PRINTER_INFO_LEVEL *printer = NULL;
811
812 ZERO_STRUCT(driver);
813
814 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
815 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
816 lp_servicename(snum)));
817 goto done;
818 }
819
820 if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
821 "Windows 4.0", 0)) )
822 {
823 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
824 printer->info_2->drivername));
825 goto done;
826 }
827
828 /* count the number of files */
829 while ( driver.info_3->dependentfiles && *driver.info_3->dependentfiles[result] )
830 result++;
831 \
832 done:
833 if ( printer )
834 free_a_printer( &printer, 2 );
835
836 if ( driver.info_3 )
837 free_a_printer_driver( driver, 3 );
838
839 return result;
840 }
841
842 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
843 char *param, int tpscnt,
844 char *data, int tdscnt,
845 int mdrcnt,int mprcnt,
846 char **rdata,char **rparam,
847 int *rdata_len,int *rparam_len)
848 {
849 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
850 char *str2 = skip_string(param,tpscnt,str1);
851 char *p = skip_string(param,tpscnt,str2);
852 char *QueueName = p;
853 unsigned int uLevel;
854 int count=0;
855 int snum;
856 char *str3;
857 struct pack_desc desc;
858 print_queue_struct *queue=NULL;
859 print_status_struct status;
860 char* tmpdata=NULL;
861
862 if (!str1 || !str2 || !p) {
863 return False;
864 }
865 memset((char *)&status,'\0',sizeof(status));
866 memset((char *)&desc,'\0',sizeof(desc));
867
868 p = skip_string(param,tpscnt,p);
869 if (!p) {
870 return False;
871 }
872 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
873 str3 = get_safe_str_ptr(param,tpscnt,p,4);
874 /* str3 may be null here and is checked in check_printq_info(). */
875
876 /* remove any trailing username */
877 if ((p = strchr_m(QueueName,'%')))
878 *p = 0;
879
880 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
881
882 /* check it's a supported varient */
883 if (!prefix_ok(str1,"zWrLh"))
884 return False;
885 if (!check_printq_info(&desc,uLevel,str2,str3)) {
886 /*
887 * Patch from Scott Moomaw <scott@bridgewater.edu>
888 * to return the 'invalid info level' error if an
889 * unknown level was requested.
890 */
891 *rdata_len = 0;
892 *rparam_len = 6;
893 *rparam = smb_realloc_limit(*rparam,*rparam_len);
894 if (!*rparam) {
895 return False;
896 }
897 SSVALS(*rparam,0,ERRunknownlevel);
898 SSVAL(*rparam,2,0);
899 SSVAL(*rparam,4,0);
900 return(True);
901 }
902
903 snum = find_service(QueueName);
904 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
905 return False;
906
907 if (uLevel==52) {
908 count = get_printerdrivernumber(snum);
909 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
910 } else {
911 count = print_queue_status(snum, &queue,&status);
912 }
913
914 if (mdrcnt > 0) {
915 *rdata = smb_realloc_limit(*rdata,mdrcnt);
916 if (!*rdata) {
917 SAFE_FREE(queue);
918 return False;
919 }
920 desc.base = *rdata;
921 desc.buflen = mdrcnt;
922 } else {
923 /*
924 * Don't return data but need to get correct length
925 * init_package will return wrong size if buflen=0
926 */
927 desc.buflen = getlen(desc.format);
928 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
929 }
930
931 if (init_package(&desc,1,count)) {
932 desc.subcount = count;
933 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
934 }
935
936 *rdata_len = desc.usedlen;
937
938 /*
939 * We must set the return code to ERRbuftoosmall
940 * in order to support lanman style printing with Win NT/2k
941 * clients --jerry
942 */
943 if (!mdrcnt && lp_disable_spoolss())
944 desc.errcode = ERRbuftoosmall;
945
946 *rdata_len = desc.usedlen;
947 *rparam_len = 6;
948 *rparam = smb_realloc_limit(*rparam,*rparam_len);
949 if (!*rparam) {
950 SAFE_FREE(queue);
951 SAFE_FREE(tmpdata);
952 return False;
953 }
954 SSVALS(*rparam,0,desc.errcode);
955 SSVAL(*rparam,2,0);
956 SSVAL(*rparam,4,desc.neededlen);
957
958 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
959
960 SAFE_FREE(queue);
961 SAFE_FREE(tmpdata);
962
963 return(True);
964 }
965
966 /****************************************************************************
967 View list of all print jobs on all queues.
968 ****************************************************************************/
969
970 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
971 char *param, int tpscnt,
972 char *data, int tdscnt,
973 int mdrcnt, int mprcnt,
974 char **rdata, char** rparam,
975 int *rdata_len, int *rparam_len)
976 {
977 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
978 char *output_format1 = skip_string(param,tpscnt,param_format);
979 char *p = skip_string(param,tpscnt,output_format1);
980 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
981 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
982 int services = lp_numservices();
983 int i, n;
984 struct pack_desc desc;
985 print_queue_struct **queue = NULL;
986 print_status_struct *status = NULL;
987 int *subcntarr = NULL;
988 int queuecnt = 0, subcnt = 0, succnt = 0;
989
990 if (!param_format || !output_format1 || !p) {
991 return False;
992 }
993
994 memset((char *)&desc,'\0',sizeof(desc));
995
996 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
997
998 if (!prefix_ok(param_format,"WrLeh")) {
999 return False;
1000 }
1001 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1002 /*
1003 * Patch from Scott Moomaw <scott@bridgewater.edu>
1004 * to return the 'invalid info level' error if an
1005 * unknown level was requested.
1006 */
1007 *rdata_len = 0;
1008 *rparam_len = 6;
1009 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1010 if (!*rparam) {
1011 return False;
1012 }
1013 SSVALS(*rparam,0,ERRunknownlevel);
1014 SSVAL(*rparam,2,0);
1015 SSVAL(*rparam,4,0);
1016 return(True);
1017 }
1018
1019 for (i = 0; i < services; i++) {
1020 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1021 queuecnt++;
1022 }
1023 }
1024
1025 if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1026 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1027 goto err;
1028 }
1029 memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1030 if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1031 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1032 goto err;
1033 }
1034 memset(status,0,queuecnt*sizeof(print_status_struct));
1035 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1036 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1037 goto err;
1038 }
1039
1040 subcnt = 0;
1041 n = 0;
1042 for (i = 0; i < services; i++) {
1043 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1044 subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1045 subcnt += subcntarr[n];
1046 n++;
1047 }
1048 }
1049
1050 if (mdrcnt > 0) {
1051 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1052 if (!*rdata) {
1053 goto err;
1054 }
1055 }
1056 desc.base = *rdata;
1057 desc.buflen = mdrcnt;
1058
1059 if (init_package(&desc,queuecnt,subcnt)) {
1060 n = 0;
1061 succnt = 0;
1062 for (i = 0; i < services; i++) {
1063 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1064 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1065 n++;
1066 if (desc.errcode == NERR_Success) {
1067 succnt = n;
1068 }
1069 }
1070 }
1071 }
1072
1073 SAFE_FREE(subcntarr);
1074
1075 *rdata_len = desc.usedlen;
1076 *rparam_len = 8;
1077 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1078 if (!*rparam) {
1079 goto err;
1080 }
1081 SSVALS(*rparam,0,desc.errcode);
1082 SSVAL(*rparam,2,0);
1083 SSVAL(*rparam,4,succnt);
1084 SSVAL(*rparam,6,queuecnt);
1085
1086 for (i = 0; i < queuecnt; i++) {
1087 if (queue) {
1088 SAFE_FREE(queue[i]);
1089 }
1090 }
1091
1092 SAFE_FREE(queue);
1093 SAFE_FREE(status);
1094
1095 return True;
1096
1097 err:
1098
1099 SAFE_FREE(subcntarr);
1100 for (i = 0; i < queuecnt; i++) {
1101 if (queue) {
1102 SAFE_FREE(queue[i]);
1103 }
1104 }
1105 SAFE_FREE(queue);
1106 SAFE_FREE(status);
1107
1108 return False;
1109 }
1110
1111 /****************************************************************************
1112 Get info level for a server list query.
1113 ****************************************************************************/
1114
1115 static bool check_server_info(int uLevel, char* id)
1116 {
1117 switch( uLevel ) {
1118 case 0:
1119 if (strcmp(id,"B16") != 0) {
1120 return False;
1121 }
1122 break;
1123 case 1:
1124 if (strcmp(id,"B16BBDz") != 0) {
1125 return False;
1126 }
1127 break;
1128 default:
1129 return False;
1130 }
1131 return True;
1132 }
1133
1134 struct srv_info_struct {
1135 fstring name;
1136 uint32 type;
1137 fstring comment;
1138 fstring domain;
1139 bool server_added;
1140 };
1141
1142 /*******************************************************************
1143 Get server info lists from the files saved by nmbd. Return the
1144 number of entries.
1145 ******************************************************************/
1146
1147 static int get_server_info(uint32 servertype,
1148 struct srv_info_struct **servers,
1149 const char *domain)
1150 {
1151 int count=0;
1152 int alloced=0;
1153 char **lines;
1154 bool local_list_only;
1155 int i;
1156
1157 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1158 if (!lines) {
1159 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1160 return 0;
1161 }
1162
1163 /* request for everything is code for request all servers */
1164 if (servertype == SV_TYPE_ALL) {
1165 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1166 }
1167
1168 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1169
1170 DEBUG(4,("Servertype search: %8x\n",servertype));
1171
1172 for (i=0;lines[i];i++) {
1173 fstring stype;
1174 struct srv_info_struct *s;
1175 const char *ptr = lines[i];
1176 bool ok = True;
1177 TALLOC_CTX *frame = NULL;
1178 char *p;
1179
1180 if (!*ptr) {
1181 continue;
1182 }
1183
1184 if (count == alloced) {
1185 alloced += 10;
1186 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1187 if (!*servers) {
1188 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1189 TALLOC_FREE(lines);
1190 return 0;
1191 }
1192 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1193 }
1194 s = &(*servers)[count];
1195
1196 frame = talloc_stackframe();
1197 s->name[0] = '\0';
1198 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1199 TALLOC_FREE(frame);
1200 continue;
1201 }
1202 fstrcpy(s->name, p);
1203
1204 stype[0] = '\0';
1205 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1206 TALLOC_FREE(frame);
1207 continue;
1208 }
1209 fstrcpy(stype, p);
1210
1211 s->comment[0] = '\0';
1212 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1213 TALLOC_FREE(frame);
1214 continue;
1215 }
1216 fstrcpy(s->comment, p);
1217
1218 s->domain[0] = '\0';
1219 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1220 /* this allows us to cope with an old nmbd */
1221 fstrcpy(s->domain,lp_workgroup());
1222 } else {
1223 fstrcpy(s->domain, p);
1224 }
1225 TALLOC_FREE(frame);
1226
1227 if (sscanf(stype,"%X",&s->type) != 1) {
1228 DEBUG(4,("r:host file "));
1229 ok = False;
1230 }
1231
1232 /* Filter the servers/domains we return based on what was asked for. */
1233
1234 /* Check to see if we are being asked for a local list only. */
1235 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1236 DEBUG(4,("r: local list only"));
1237 ok = False;
1238 }
1239
1240 /* doesn't match up: don't want it */
1241 if (!(servertype & s->type)) {
1242 DEBUG(4,("r:serv type "));
1243 ok = False;
1244 }
1245
1246 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1247 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1248 DEBUG(4,("s: dom mismatch "));
1249 ok = False;
1250 }
1251
1252 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1253 ok = False;
1254 }
1255
1256 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1257 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1258
1259 if (ok) {
1260 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1261 s->name, s->type, s->comment, s->domain));
1262 s->server_added = True;
1263 count++;
1264 } else {
1265 DEBUG(4,("%20s %8x %25s %15s\n",
1266 s->name, s->type, s->comment, s->domain));
1267 }
1268 }
1269
1270 TALLOC_FREE(lines);
1271 return count;
1272 }
1273
1274 /*******************************************************************
1275 Fill in a server info structure.
1276 ******************************************************************/
1277
1278 static int fill_srv_info(struct srv_info_struct *service,
1279 int uLevel, char **buf, int *buflen,
1280 char **stringbuf, int *stringspace, char *baseaddr)
1281 {
1282 int struct_len;
1283 char* p;
1284 char* p2;
1285 int l2;
1286 int len;
1287
1288 switch (uLevel) {
1289 case 0:
1290 struct_len = 16;
1291 break;
1292 case 1:
1293 struct_len = 26;
1294 break;
1295 default:
1296 return -1;
1297 }
1298
1299 if (!buf) {
1300 len = 0;
1301 switch (uLevel) {
1302 case 1:
1303 len = strlen(service->comment)+1;
1304 break;
1305 }
1306
1307 *buflen = struct_len;
1308 *stringspace = len;
1309 return struct_len + len;
1310 }
1311
1312 len = struct_len;
1313 p = *buf;
1314 if (*buflen < struct_len) {
1315 return -1;
1316 }
1317 if (stringbuf) {
1318 p2 = *stringbuf;
1319 l2 = *stringspace;
1320 } else {
1321 p2 = p + struct_len;
1322 l2 = *buflen - struct_len;
1323 }
1324 if (!baseaddr) {
1325 baseaddr = p;
1326 }
1327
1328 switch (uLevel) {
1329 case 0:
1330 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1331 break;
1332
1333 case 1:
1334 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1335 SIVAL(p,18,service->type);
1336 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1337 len += CopyAndAdvance(&p2,service->comment,&l2);
1338 break;
1339 }
1340
1341 if (stringbuf) {
1342 *buf = p + struct_len;
1343 *buflen -= struct_len;
1344 *stringbuf = p2;
1345 *stringspace = l2;
1346 } else {
1347 *buf = p2;
1348 *buflen -= len;
1349 }
1350 return len;
1351 }
1352
1353
1354 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1355 {
1356 return(strcmp(s1->name,s2->name));
1357 }
1358
1359 /****************************************************************************
1360 View list of servers available (or possibly domains). The info is
1361 extracted from lists saved by nmbd on the local host.
1362 ****************************************************************************/
1363
1364 static bool api_RNetServerEnum(connection_struct *conn, uint16 vuid,
1365 char *param, int tpscnt,
1366 char *data, int tdscnt,
1367 int mdrcnt, int mprcnt, char **rdata,
1368 char **rparam, int *rdata_len, int *rparam_len)
1369 {
1370 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1371 char *str2 = skip_string(param,tpscnt,str1);
1372 char *p = skip_string(param,tpscnt,str2);
1373 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1374 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1375 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1376 char *p2;
1377 int data_len, fixed_len, string_len;
1378 int f_len = 0, s_len = 0;
1379 struct srv_info_struct *servers=NULL;
1380 int counted=0,total=0;
1381 int i,missed;
1382 fstring domain;
1383 bool domain_request;
1384 bool local_request;
1385
1386 if (!str1 || !str2 || !p) {
1387 return False;
1388 }
1389
1390 /* If someone sets all the bits they don't really mean to set
1391 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1392 known servers. */
1393
1394 if (servertype == SV_TYPE_ALL) {
1395 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1396 }
1397
1398 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1399 any other bit (they may just set this bit on its own) they
1400 want all the locally seen servers. However this bit can be
1401 set on its own so set the requested servers to be
1402 ALL - DOMAIN_ENUM. */
1403
1404 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1405 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1406 }
1407
1408 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1409 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1410
1411 p += 8;
1412
1413 if (!prefix_ok(str1,"WrLehD")) {
1414 return False;
1415 }
1416 if (!check_server_info(uLevel,str2)) {
1417 return False;
1418 }
1419
1420 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1421 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1422 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1423
1424 if (strcmp(str1, "WrLehDz") == 0) {
1425 if (skip_string(param,tpscnt,p) == NULL) {
1426 return False;
1427 }
1428 pull_ascii_fstring(domain, p);
1429 } else {
1430 fstrcpy(domain, lp_workgroup());
1431 }
1432
1433 if (lp_browse_list()) {
1434 total = get_server_info(servertype,&servers,domain);
1435 }
1436
1437 data_len = fixed_len = string_len = 0;
1438 missed = 0;
1439
1440 if (total > 0) {
1441 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1442 }
1443
1444 {
1445 char *lastname=NULL;
1446
1447 for (i=0;i<total;i++) {
1448 struct srv_info_struct *s = &servers[i];
1449
1450 if (lastname && strequal(lastname,s->name)) {
1451 continue;
1452 }
1453 lastname = s->name;
1454 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1455 DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1456 s->name, s->type, s->comment, s->domain));
1457
1458 if (data_len <= buf_len) {
1459 counted++;
1460 fixed_len += f_len;
1461 string_len += s_len;
1462 } else {
1463 missed++;
1464 }
1465 }
1466 }
1467
1468 *rdata_len = fixed_len + string_len;
1469 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1470 if (!*rdata) {
1471 return False;
1472 }
1473
1474 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1475 p = *rdata;
1476 f_len = fixed_len;
1477 s_len = string_len;
1478
1479 {
1480 char *lastname=NULL;
1481 int count2 = counted;
1482
1483 for (i = 0; i < total && count2;i++) {
1484 struct srv_info_struct *s = &servers[i];
1485
1486 if (lastname && strequal(lastname,s->name)) {
1487 continue;
1488 }
1489 lastname = s->name;
1490 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1491 DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1492 s->name, s->type, s->comment, s->domain));
1493 count2--;
1494 }
1495 }
1496
1497 *rparam_len = 8;
1498 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1499 if (!*rparam) {
1500 return False;
1501 }
1502 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1503 SSVAL(*rparam,2,0);
1504 SSVAL(*rparam,4,counted);
1505 SSVAL(*rparam,6,counted+missed);
1506
1507 SAFE_FREE(servers);
1508
1509 DEBUG(3,("NetServerEnum domain = %s uLevel=%d counted=%d total=%d\n",
1510 domain,uLevel,counted,counted+missed));
1511
1512 return True;
1513 }
1514
1515 /****************************************************************************
1516 command 0x34 - suspected of being a "Lookup Names" stub api
1517 ****************************************************************************/
1518
1519 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1520 char *param, int tpscnt,
1521 char *data, int tdscnt,
1522 int mdrcnt, int mprcnt, char **rdata,
1523 char **rparam, int *rdata_len, int *rparam_len)
1524 {
1525 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1526 char *str2 = skip_string(param,tpscnt,str1);
1527 char *p = skip_string(param,tpscnt,str2);
1528 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1529 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1530 int counted=0;
1531 int missed=0;
1532
1533 if (!str1 || !str2 || !p) {
1534 return False;
1535 }
1536
1537 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1538 str1, str2, p, uLevel, buf_len));
1539
1540 if (!prefix_ok(str1,"zWrLeh")) {
1541 return False;
1542 }
1543
1544 *rdata_len = 0;
1545
1546 *rparam_len = 8;
1547 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1548 if (!*rparam) {
1549 return False;
1550 }
1551
1552 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1553 SSVAL(*rparam,2,0);
1554 SSVAL(*rparam,4,counted);
1555 SSVAL(*rparam,6,counted+missed);
1556
1557 return True;
1558 }
1559
1560 /****************************************************************************
1561 get info about a share
1562 ****************************************************************************/
1563
1564 static bool check_share_info(int uLevel, char* id)
1565 {
1566 switch( uLevel ) {
1567 case 0:
1568 if (strcmp(id,"B13") != 0) {
1569 return False;
1570 }
1571 break;
1572 case 1:
1573 if (strcmp(id,"B13BWz") != 0) {
1574 return False;
1575 }
1576 break;
1577 case 2:
1578 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1579 return False;
1580 }
1581 break;
1582 case 91:
1583 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1584 return False;
1585 }
1586 break;
1587 default:
1588 return False;
1589 }
1590 return True;
1591 }
1592
1593 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1594 char** buf, int* buflen,
1595 char** stringbuf, int* stringspace, char* baseaddr)
1596 {
1597 int struct_len;
1598 char* p;
1599 char* p2;
1600 int l2;
1601 int len;
1602
1603 switch( uLevel ) {
1604 case 0:
1605 struct_len = 13;
1606 break;
1607 case 1:
1608 struct_len = 20;
1609 break;
1610 case 2:
1611 struct_len = 40;
1612 break;
1613 case 91:
1614 struct_len = 68;
1615 break;
1616 default:
1617 return -1;
1618 }
1619
1620 if (!buf) {
1621 len = 0;
1622
1623 if (uLevel > 0) {
1624 len += StrlenExpanded(conn,snum,lp_comment(snum));
1625 }
1626 if (uLevel > 1) {
1627 len += strlen(lp_pathname(snum)) + 1;
1628 }
1629 if (buflen) {
1630 *buflen = struct_len;
1631 }
1632 if (stringspace) {
1633 *stringspace = len;
1634 }
1635 return struct_len + len;
1636 }
1637
1638 len = struct_len;
1639 p = *buf;
1640 if ((*buflen) < struct_len) {
1641 return -1;
1642 }
1643
1644 if (stringbuf) {
1645 p2 = *stringbuf;
1646 l2 = *stringspace;
1647 } else {
1648 p2 = p + struct_len;
1649 l2 = (*buflen) - struct_len;
1650 }
1651
1652 if (!baseaddr) {
1653 baseaddr = p;
1654 }
1655
1656 push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1657
1658 if (uLevel > 0) {
1659 int type;
1660
1661 SCVAL(p,13,0);
1662 type = STYPE_DISKTREE;
1663 if (lp_print_ok(snum)) {
1664 type = STYPE_PRINTQ;
1665 }
1666 if (strequal("IPC",lp_fstype(snum))) {
1667 type = STYPE_IPC;
1668 }
1669 SSVAL(p,14,type); /* device type */
1670 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1671 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1672 }
1673
1674 if (uLevel > 1) {
1675 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1676 SSVALS(p,22,-1); /* max uses */
1677 SSVAL(p,24,1); /* current uses */
1678 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1679 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1680 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1681 }
1682
1683 if (uLevel > 2) {
1684 memset(p+40,0,SHPWLEN+2);
1685 SSVAL(p,50,0);
1686 SIVAL(p,52,0);
1687 SSVAL(p,56,0);
1688 SSVAL(p,58,0);
1689 SIVAL(p,60,0);
1690 SSVAL(p,64,0);
1691 SSVAL(p,66,0);
1692 }
1693
1694 if (stringbuf) {
1695 (*buf) = p + struct_len;
1696 (*buflen) -= struct_len;
1697 (*stringbuf) = p2;
1698 (*stringspace) = l2;
1699 } else {
1700 (*buf) = p2;
1701 (*buflen) -= len;
1702 }
1703
1704 return len;
1705 }
1706
1707 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1708 char *param, int tpscnt,
1709 char *data, int tdscnt,
1710 int mdrcnt,int mprcnt,
1711 char **rdata,char **rparam,
1712 int *rdata_len,int *rparam_len)
1713 {
1714 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1715 char *str2 = skip_string(param,tpscnt,str1);
1716 char *netname = skip_string(param,tpscnt,str2);
1717 char *p = skip_string(param,tpscnt,netname);
1718 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1719 int snum;
1720
1721 if (!str1 || !str2 || !netname || !p) {
1722 return False;
1723 }
1724
1725 snum = find_service(netname);
1726 if (snum < 0) {
1727 return False;
1728 }
1729
1730 /* check it's a supported varient */
1731 if (!prefix_ok(str1,"zWrLh")) {
1732 return False;
1733 }
1734 if (!check_share_info(uLevel,str2)) {
1735 return False;
1736 }
1737
1738 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1739 if (!*rdata) {
1740 return False;
1741 }
1742 p = *rdata;
1743 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1744 if (*rdata_len < 0) {
1745 return False;
1746 }
1747
1748 *rparam_len = 6;
1749 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1750 if (!*rparam) {
1751 return False;
1752 }
1753 SSVAL(*rparam,0,NERR_Success);
1754 SSVAL(*rparam,2,0); /* converter word */
1755 SSVAL(*rparam,4,*rdata_len);
1756
1757 return True;
1758 }
1759
1760 /****************************************************************************
1761 View the list of available shares.
1762
1763 This function is the server side of the NetShareEnum() RAP call.
1764 It fills the return buffer with share names and share comments.
1765 Note that the return buffer normally (in all known cases) allows only
1766 twelve byte strings for share names (plus one for a nul terminator).
1767 Share names longer than 12 bytes must be skipped.
1768 ****************************************************************************/
1769
1770 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1771 char *param, int tpscnt,
1772 char *data, int tdscnt,
1773 int mdrcnt,
1774 int mprcnt,
1775 char **rdata,
1776 char **rparam,
1777 int *rdata_len,
1778 int *rparam_len )
1779 {
1780 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1781 char *str2 = skip_string(param,tpscnt,str1);
1782 char *p = skip_string(param,tpscnt,str2);
1783 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1784 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1785 char *p2;
1786 int count = 0;
1787 int total=0,counted=0;
1788 bool missed = False;
1789 int i;
1790 int data_len, fixed_len, string_len;
1791 int f_len = 0, s_len = 0;
1792
1793 if (!str1 || !str2 || !p) {
1794 return False;
1795 }
1796
1797 if (!prefix_ok(str1,"WrLeh")) {
1798 return False;
1799 }
1800 if (!check_share_info(uLevel,str2)) {
1801 return False;
1802 }
1803
1804 /* Ensure all the usershares are loaded. */
1805 become_root();
1806 load_registry_shares();
1807 count = load_usershare_shares();
1808 unbecome_root();
1809
1810 data_len = fixed_len = string_len = 0;
1811 for (i=0;i<count;i++) {
1812 fstring servicename_dos;
1813 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1814 continue;
1815 }
1816 push_ascii_fstring(servicename_dos, lp_servicename(i));
1817 /* Maximum name length = 13. */
1818 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1819 total++;
1820 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1821 if (data_len <= buf_len) {
1822 counted++;
1823 fixed_len += f_len;
1824 string_len += s_len;
1825 } else {
1826 missed = True;
1827 }
1828 }
1829 }
1830
1831 *rdata_len = fixed_len + string_len;
1832 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1833 if (!*rdata) {
1834 return False;
1835 }
1836
1837 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
1838 p = *rdata;
1839 f_len = fixed_len;
1840 s_len = string_len;
1841
1842 for( i = 0; i < count; i++ ) {
1843 fstring servicename_dos;
1844 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1845 continue;
1846 }
1847
1848 push_ascii_fstring(servicename_dos, lp_servicename(i));
1849 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1850 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1851 break;
1852 }
1853 }
1854 }
1855
1856 *rparam_len = 8;
1857 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1858 if (!*rparam) {
1859 return False;
1860 }
1861 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1862 SSVAL(*rparam,2,0);
1863 SSVAL(*rparam,4,counted);
1864 SSVAL(*rparam,6,total);
1865
1866 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1867 counted,total,uLevel,
1868 buf_len,*rdata_len,mdrcnt));
1869
1870 return True;
1871 }
1872
1873 /****************************************************************************
1874 Add a share
1875 ****************************************************************************/
1876
1877 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1878 char *param, int tpscnt,
1879 char *data, int tdscnt,
1880 int mdrcnt,int mprcnt,
1881 char **rdata,char **rparam,
1882 int *rdata_len,int *rparam_len)
1883 {
1884 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1885 char *str2 = skip_string(param,tpscnt,str1);
1886 char *p = skip_string(param,tpscnt,str2);
1887 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1888 fstring sharename;
1889 fstring comment;
1890 char *pathname = NULL;
1891 char *command, *cmdname;
1892 unsigned int offset;
1893 int snum;
1894 int res = ERRunsup;
1895 size_t converted_size;
1896
1897 if (!str1 || !str2 || !p) {
1898 return False;
1899 }
1900
1901 /* check it's a supported varient */
1902 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1903 return False;
1904 }
1905 if (!check_share_info(uLevel,str2)) {
1906 return False;
1907 }
1908 if (uLevel != 2) {
1909 return False;
1910 }
1911
1912 /* Do we have a string ? */
1913 if (skip_string(data,mdrcnt,data) == NULL) {
1914 return False;
1915 }
1916 pull_ascii_fstring(sharename,data);
1917 snum = find_service(sharename);
1918 if (snum >= 0) { /* already exists */
1919 res = ERRfilexists;
1920 goto error_exit;
1921 }
1922
1923 if (mdrcnt < 28) {
1924 return False;
1925 }
1926
1927 /* only support disk share adds */
1928 if (SVAL(data,14)!=STYPE_DISKTREE) {
1929 return False;
1930 }
1931
1932 offset = IVAL(data, 16);
1933 if (offset >= mdrcnt) {
1934 res = ERRinvalidparam;
1935 goto error_exit;
1936 }
1937
1938 /* Do we have a string ? */
1939 if (skip_string(data,mdrcnt,data+offset) == NULL) {
1940 return False;
1941 }
1942 pull_ascii_fstring(comment, offset? (data+offset) : "");
1943
1944 offset = IVAL(data, 26);
1945
1946 if (offset >= mdrcnt) {
1947 res = ERRinvalidparam;
1948 goto error_exit;
1949 }
1950
1951 /* Do we have a string ? */
1952 if (skip_string(data,mdrcnt,data+offset) == NULL) {
1953 return False;
1954 }
1955
1956 if (!pull_ascii_talloc(talloc_tos(), &pathname,
1957 offset ? (data+offset) : "", &converted_size))
1958 {
1959 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
1960 strerror(errno)));
1961 }
1962
1963 if (!pathname) {
1964 return false;
1965 }
1966
1967 string_replace(sharename, '"', ' ');
1968 string_replace(pathname, '"', ' ');
1969 string_replace(comment, '"', ' ');
1970
1971 cmdname = lp_add_share_cmd();
1972
1973 if (!cmdname || *cmdname == '\0') {
1974 return False;
1975 }
1976
1977 if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1978 lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1979 pathname, comment) == -1) {
1980 return false;
1981 }
1982
1983 DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1984
1985 if ((res = smbrun(command, NULL)) != 0) {
1986 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1987 command, res ));
1988 SAFE_FREE(command);
1989 res = ERRnoaccess;
1990 goto error_exit;
1991 } else {
1992 SAFE_FREE(command);
1993 message_send_all(smbd_messaging_context(),
1994 MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1995 }
1996
1997 *rparam_len = 6;
1998 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1999 if (!*rparam) {
2000 return False;
2001 }
2002 SSVAL(*rparam,0,NERR_Success);
2003 SSVAL(*rparam,2,0); /* converter word */
2004 SSVAL(*rparam,4,*rdata_len);
2005 *rdata_len = 0;
2006
2007 return True;
2008
2009 error_exit:
2010
2011 *rparam_len = 4;
2012 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2013 if (!*rparam) {
2014 return False;
2015 }
2016 *rdata_len = 0;
2017 SSVAL(*rparam,0,res);
2018 SSVAL(*rparam,2,0);
2019 return True;
2020 }
2021
2022 /****************************************************************************
2023 view list of groups available
2024 ****************************************************************************/
2025
2026 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2027 char *param, int tpscnt,
2028 char *data, int tdscnt,
2029 int mdrcnt,int mprcnt,
2030 char **rdata,char **rparam,
2031 int *rdata_len,int *rparam_len)
2032 {
2033 int i;
2034 int errflags=0;
2035 int resume_context, cli_buf_size;
2036 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2037 char *str2 = skip_string(param,tpscnt,str1);
2038 char *p = skip_string(param,tpscnt,str2);
2039
2040 uint32_t num_groups;
2041 uint32_t resume_handle;
2042 struct rpc_pipe_client *samr_pipe;
2043 struct policy_handle samr_handle, domain_handle;
2044 NTSTATUS status;
2045
2046 if (!str1 || !str2 || !p) {
2047 return False;
2048 }
2049
2050 if (strcmp(str1,"WrLeh") != 0) {
2051 return False;
2052 }
2053
2054 /* parameters
2055 * W-> resume context (number of users to skip)
2056 * r -> return parameter pointer to receive buffer
2057 * L -> length of receive buffer
2058 * e -> return parameter number of entries
2059 * h -> return parameter total number of users
2060 */
2061
2062 if (strcmp("B21",str2) != 0) {
2063 return False;
2064 }
2065
2066 status = rpc_pipe_open_internal(
2067 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2068 conn->server_info, &samr_pipe);
2069 if (!NT_STATUS_IS_OK(status)) {
2070 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2071 nt_errstr(status)));
2072 return false;
2073 }
2074
2075 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2076 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2077 if (!NT_STATUS_IS_OK(status)) {
2078 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2079 nt_errstr(status)));
2080 return false;
2081 }
2082
2083 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2084 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2085 get_global_sam_sid(), &domain_handle);
2086 if (!NT_STATUS_IS_OK(status)) {
2087 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2088 nt_errstr(status)));
2089 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2090 return false;
2091 }
2092
2093 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2094 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2095 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2096 "%d\n", resume_context, cli_buf_size));
2097
2098 *rdata_len = cli_buf_size;
2099 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2100 if (!*rdata) {
2101 return False;
2102 }
2103
2104 p = *rdata;
2105
2106 errflags = NERR_Success;
2107 num_groups = 0;
2108 resume_handle = 0;
2109
2110 while (true) {
2111 struct samr_SamArray *sam_entries;
2112 uint32_t num_entries;
2113
2114 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2115 &domain_handle,
2116 &resume_handle,
2117 &sam_entries, 1,
2118 &num_entries);
2119 if (!NT_STATUS_IS_OK(status)) {
2120 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2121 "%s\n", nt_errstr(status)));
2122 break;
2123 }
2124
2125 if (num_entries == 0) {
2126 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2127 "no entries -- done\n"));
2128 break;
2129 }
2130
2131 for(i=0; i<num_entries; i++) {
2132 const char *name;
2133
2134 name = sam_entries->entries[i].name.string;
2135
2136 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2137 /* set overflow error */
2138 DEBUG(3,("overflow on entry %d group %s\n", i,
2139 name));
2140 errflags=234;
2141 break;
2142 }
2143
2144 /* truncate the name at 21 chars. */
2145 memset(p, 0, 21);
2146 strlcpy(p, name, 21);
2147 DEBUG(10,("adding entry %d group %s\n", i, p));
2148 p += 21;
2149 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2150 * idea why... */
2151 num_groups += 1;
2152 }
2153
2154 if (errflags != NERR_Success) {
2155 break;
2156 }
2157
2158 TALLOC_FREE(sam_entries);
2159 }
2160
2161 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2162 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2163
2164 *rdata_len = PTR_DIFF(p,*rdata);
2165
2166 *rparam_len = 8;
2167 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2168 if (!*rparam) {
2169 return False;
2170 }
2171 SSVAL(*rparam, 0, errflags);
2172 SSVAL(*rparam, 2, 0); /* converter word */
2173 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2174 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2175
2176 return(True);
2177 }
2178
2179 /*******************************************************************
2180 Get groups that a user is a member of.
2181 ******************************************************************/
2182
2183 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2184 char *param, int tpscnt,
2185 char *data, int tdscnt,
2186 int mdrcnt,int mprcnt,
2187 char **rdata,char **rparam,
2188 int *rdata_len,int *rparam_len)
2189 {
2190 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2191 char *str2 = skip_string(param,tpscnt,str1);
2192 char *UserName = skip_string(param,tpscnt,str2);
2193 char *p = skip_string(param,tpscnt,UserName);
2194 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2195 const char *level_string;
2196 int count=0;
2197 bool ret = False;
2198 uint32_t i;
2199 char *endp = NULL;
2200
2201 struct rpc_pipe_client *samr_pipe;
2202 struct policy_handle samr_handle, domain_handle, user_handle;
2203 struct lsa_String name;
2204 struct lsa_Strings names;
2205 struct samr_Ids type, rid;
2206 struct samr_RidWithAttributeArray *rids;
2207 NTSTATUS status;
2208
2209 if (!str1 || !str2 || !UserName || !p) {
2210 return False;
2211 }
2212
2213 *rparam_len = 8;
2214 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2215 if (!*rparam) {
2216 return False;
2217 }
2218
2219 /* check it's a supported varient */
2220
2221 if ( strcmp(str1,"zWrLeh") != 0 )
2222 return False;
2223
2224 switch( uLevel ) {
2225 case 0:
2226 level_string = "B21";
2227 break;
2228 default:
2229 return False;
2230 }
2231
2232 if (strcmp(level_string,str2) != 0)
2233 return False;
2234
2235 *rdata_len = mdrcnt + 1024;
2236 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2237 if (!*rdata) {
2238 return False;
2239 }
2240
2241 SSVAL(*rparam,0,NERR_Success);
2242 SSVAL(*rparam,2,0); /* converter word */
2243
2244 p = *rdata;
2245 endp = *rdata + *rdata_len;
2246
2247 status = rpc_pipe_open_internal(
2248 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2249 conn->server_info, &samr_pipe);
2250 if (!NT_STATUS_IS_OK(status)) {
2251 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2252 nt_errstr(status)));
2253 return false;
2254 }
2255
2256 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2257 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2258 if (!NT_STATUS_IS_OK(status)) {
2259 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2260 nt_errstr(status)));
2261 return false;
2262 }
2263
2264 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2265 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2266 get_global_sam_sid(), &domain_handle);
2267 if (!NT_STATUS_IS_OK(status)) {
2268 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2269 nt_errstr(status)));
2270 goto close_sam;
2271 }
2272
2273 name.string = UserName;
2274
2275 status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2276 &domain_handle, 1, &name,
2277 &rid, &type);
2278 if (!NT_STATUS_IS_OK(status)) {
2279 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2280 nt_errstr(status)));
2281 goto close_domain;
2282 }
2283
2284 if (type.ids[0] != SID_NAME_USER) {
2285 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2286 sid_type_lookup(type.ids[0])));
2287 goto close_domain;
2288 }
2289
2290 status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2291 &domain_handle,
2292 SAMR_USER_ACCESS_GET_GROUPS,
2293 rid.ids[0], &user_handle);
2294 if (!NT_STATUS_IS_OK(status)) {
2295 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2296 nt_errstr(status)));
2297 goto close_domain;
2298 }
2299
2300 status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2301 &user_handle, &rids);
2302 if (!NT_STATUS_IS_OK(status)) {
2303 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2304 nt_errstr(status)));
2305 goto close_user;
2306 }
2307
2308 for (i=0; i<rids->count; i++) {
2309
2310 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2311 &domain_handle,
2312 1, &rids->rids[i].rid,
2313 &names, &type);
2314 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2315 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2316 p += 21;
2317 count++;
2318 }
2319 }
2320
2321 *rdata_len = PTR_DIFF(p,*rdata);
2322
2323 SSVAL(*rparam,4,count); /* is this right?? */
2324 SSVAL(*rparam,6,count); /* is this right?? */
2325
2326 ret = True;
2327
2328 close_user:
2329 rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2330 close_domain:
2331 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2332 close_sam:
2333 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2334
2335 return ret;
2336 }
2337
2338 /*******************************************************************
2339 Get all users.
2340 ******************************************************************/
2341
2342 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2343 char *param, int tpscnt,
2344 char *data, int tdscnt,
2345 int mdrcnt,int mprcnt,
2346 char **rdata,char **rparam,
2347 int *rdata_len,int *rparam_len)
2348 {
2349 int count_sent=0;
2350 int num_users=0;
2351 int errflags=0;
2352 int i, resume_context, cli_buf_size;
2353 uint32_t resume_handle;
2354
2355 struct rpc_pipe_client *samr_pipe;
2356 struct policy_handle samr_handle, domain_handle;
2357 NTSTATUS status;
2358
2359 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2360 char *str2 = skip_string(param,tpscnt,str1);
2361 char *p = skip_string(param,tpscnt,str2);
2362 char *endp = NULL;
2363
2364 if (!str1 || !str2 || !p) {
2365 return False;
2366 }
2367
2368 if (strcmp(str1,"WrLeh") != 0)
2369 return False;
2370 /* parameters
2371 * W-> resume context (number of users to skip)
2372 * r -> return parameter pointer to receive buffer
2373 * L -> length of receive buffer
2374 * e -> return parameter number of entries
2375 * h -> return parameter total number of users
2376 */
2377
2378 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2379 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2380 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2381 resume_context, cli_buf_size));
2382
2383 *rparam_len = 8;
2384 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2385 if (!*rparam) {
2386 return False;
2387 }
2388
2389 /* check it's a supported varient */
2390 if (strcmp("B21",str2) != 0)
2391 return False;
2392
2393 *rdata_len = cli_buf_size;
2394 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2395 if (!*rdata) {
2396 return False;
2397 }
2398
2399 p = *rdata;
2400 endp = *rdata + *rdata_len;
2401
2402 status = rpc_pipe_open_internal(
2403 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2404 conn->server_info, &samr_pipe);
2405 if (!NT_STATUS_IS_OK(status)) {
2406 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2407 nt_errstr(status)));
2408 return false;
2409 }
2410
2411 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2412 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2413 if (!NT_STATUS_IS_OK(status)) {
2414 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2415 nt_errstr(status)));
2416 return false;
2417 }
2418
2419 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2420 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2421 get_global_sam_sid(), &domain_handle);
2422 if (!NT_STATUS_IS_OK(status)) {
2423 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2424 nt_errstr(status)));
2425 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2426 return false;
2427 }
2428
2429 errflags=NERR_Success;
2430
2431 resume_handle = 0;
2432
2433 while (true) {
2434 struct samr_SamArray *sam_entries;
2435 uint32_t num_entries;
2436
2437 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2438 &domain_handle,
2439 &resume_handle,
2440 0, &sam_entries, 1,
2441 &num_entries);
2442
2443 if (!NT_STATUS_IS_OK(status)) {
2444 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2445 "%s\n", nt_errstr(status)));
2446 break;
2447 }
2448
2449 if (num_entries == 0) {
2450 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2451 "no entries -- done\n"));
2452 break;
2453 }
2454
2455 for (i=0; i<num_entries; i++) {
2456 const char *name;
2457
2458 name = sam_entries->entries[i].name.string;
2459
2460 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2461 &&(strlen(name)<=21)) {
2462 strlcpy(p,name,PTR_DIFF(endp,p));
2463 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2464 "username %s\n",count_sent,p));
2465 p += 21;
2466 count_sent++;
2467 } else {
2468 /* set overflow error */
2469 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2470 "username %s\n",count_sent,name));
2471 errflags=234;
2472 break;
2473 }
2474 }
2475
2476 if (errflags != NERR_Success) {
2477 break;
2478 }
2479
2480 TALLOC_FREE(sam_entries);
2481 }
2482
2483 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2484 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2485
2486 *rdata_len = PTR_DIFF(p,*rdata);
2487
2488 SSVAL(*rparam,0,errflags);
2489 SSVAL(*rparam,2,0); /* converter word */
2490 SSVAL(*rparam,4,count_sent); /* is this right?? */
2491 SSVAL(*rparam,6,num_users); /* is this right?? */
2492
2493 return True;
2494 }
2495
2496 /****************************************************************************
2497 Get the time of day info.
2498 ****************************************************************************/
2499
2500 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2501 char *param, int tpscnt,
2502 char *data, int tdscnt,
2503 int mdrcnt,int mprcnt,
2504 char **rdata,char **rparam,
2505 int *rdata_len,int *rparam_len)
2506 {
2507 struct tm *t;
2508 time_t unixdate = time(NULL);
2509 char *p;
2510
2511 *rparam_len = 4;
2512 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2513 if (!*rparam) {
2514 return False;
2515 }
2516
2517 *rdata_len = 21;
2518 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2519 if (!*rdata) {
2520 return False;
2521 }
2522
2523 SSVAL(*rparam,0,NERR_Success);
2524 SSVAL(*rparam,2,0); /* converter word */
2525
2526 p = *rdata;
2527
2528 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2529 by NT in a "net time" operation,
2530 it seems to ignore the one below */
2531
2532 /* the client expects to get localtime, not GMT, in this bit
2533 (I think, this needs testing) */
2534 t = localtime(&unixdate);
2535 if (!t) {
2536 return False;
2537 }
2538
2539 SIVAL(p,4,0); /* msecs ? */
2540 SCVAL(p,8,t->tm_hour);
2541 SCVAL(p,9,t->tm_min);
2542 SCVAL(p,10,t->tm_sec);
2543 SCVAL(p,11,0); /* hundredths of seconds */
2544 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2545 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2546 SCVAL(p,16,t->tm_mday);
2547 SCVAL(p,17,t->tm_mon + 1);
2548 SSVAL(p,18,1900+t->tm_year);
2549 SCVAL(p,20,t->tm_wday);
2550
2551 return True;
2552 }
2553
2554 /****************************************************************************
2555 Set the user password.
2556 *****************************************************************************/
2557
2558 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2559 char *param, int tpscnt,
2560 char *data, int tdscnt,
2561 int mdrcnt,int mprcnt,
2562 char **rdata,char **rparam,
2563 int *rdata_len,int *rparam_len)
2564 {
2565 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2566 char *p = NULL;
2567 fstring user;
2568 fstring pass1,pass2;
2569
2570 /* Skip 2 strings. */
2571 p = skip_string(param,tpscnt,np);
2572 p = skip_string(param,tpscnt,p);
2573
2574 if (!np || !p) {
2575 return False;
2576 }
2577
2578 /* Do we have a string ? */
2579 if (skip_string(param,tpscnt,p) == NULL) {
2580 return False;
2581 }
2582 pull_ascii_fstring(user,p);
2583
2584 p = skip_string(param,tpscnt,p);
2585 if (!p) {
2586 return False;
2587 }
2588
2589 memset(pass1,'\0',sizeof(pass1));
2590 memset(pass2,'\0',sizeof(pass2));
2591 /*
2592 * We use 31 here not 32 as we're checking
2593 * the last byte we want to access is safe.
2594 */
2595 if (!is_offset_safe(param,tpscnt,p,31)) {
2596 return False;
2597 }
2598 memcpy(pass1,p,16);
2599 memcpy(pass2,p+16,16);
2600
2601 *rparam_len = 4;
2602 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2603 if (!*rparam) {
2604 return False;
2605 }
2606
2607 *rdata_len = 0;
2608
2609 SSVAL(*rparam,0,NERR_badpass);
2610 SSVAL(*rparam,2,0); /* converter word */
2611
2612 DEBUG(3,("Set password for <%s>\n",user));
2613
2614 /*
2615 * Attempt to verify the old password against smbpasswd entries
2616 * Win98 clients send old and new password in plaintext for this call.
2617 */
2618
2619 {
2620 auth_serversupplied_info *server_info = NULL;
2621 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2622
2623 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2624
2625 become_root();
2626 if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2627 SSVAL(*rparam,0,NERR_Success);
2628 }
2629 unbecome_root();
2630
2631 TALLOC_FREE(server_info);
2632 }
2633 data_blob_clear_free(&password);
2634 }
2635
2636 /*
2637 * If the plaintext change failed, attempt
2638 * the old encrypted method. NT will generate this
2639 * after trying the samr method. Note that this
2640 * method is done as a last resort as this
2641 * password change method loses the NT password hash
2642 * and cannot change the UNIX password as no plaintext
2643 * is received.
2644 */
2645
2646 if(SVAL(*rparam,0) != NERR_Success) {
2647 struct samu *hnd = NULL;
2648
2649 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2650 become_root();
2651 if (change_lanman_password(hnd,(uchar *)pass2)) {
2652 SSVAL(*rparam,0,NERR_Success);
2653 }
2654 unbecome_root();
2655 TALLOC_FREE(hnd);
2656 }
2657 }
2658
2659 memset((char *)pass1,'\0',sizeof(fstring));
2660 memset((char *)pass2,'\0',sizeof(fstring));
2661
2662 return(True);
2663 }
2664
2665 /****************************************************************************
2666 Set the user password (SamOEM version - gets plaintext).
2667 ****************************************************************************/
2668
2669 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2670 char *param, int tpscnt,
2671 char *data, int tdscnt,
2672 int mdrcnt,int mprcnt,
2673 char **rdata,char **rparam,
2674 int *rdata_len,int *rparam_len)
2675 {
2676 fstring user;
2677 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2678 *rparam_len = 2;
2679 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2680 if (!*rparam) {
2681 return False;
2682 }
2683
2684 if (!p) {
2685 return False;
2686 }
2687 *rdata_len = 0;
2688
2689 SSVAL(*rparam,0,NERR_badpass);
2690
2691 /*
2692 * Check the parameter definition is correct.
2693 */
2694
2695 /* Do we have a string ? */
2696 if (skip_string(param,tpscnt,p) == 0) {
2697 return False;
2698 }
2699 if(!strequal(p, "zsT")) {
2700 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2701 return False;
2702 }
2703 p = skip_string(param, tpscnt, p);
2704 if (!p) {
2705 return False;
2706 }
2707
2708 /* Do we have a string ? */
2709 if (skip_string(param,tpscnt,p) == 0) {
2710 return False;
2711 }
2712 if(!strequal(p, "B516B16")) {
2713 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2714 return False;
2715 }
2716 p = skip_string(param,tpscnt,p);
2717 if (!p) {
2718 return False;
2719 }
2720 /* Do we have a string ? */
2721 if (skip_string(param,tpscnt,p) == 0) {
2722 return False;
2723 }
2724 p += pull_ascii_fstring(user,p);
2725
2726 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2727
2728 /*
2729 * Pass the user through the NT -> unix user mapping
2730 * function.
2731 */
2732
2733 (void)map_username(user);
2734
2735 if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2736 SSVAL(*rparam,0,NERR_Success);
2737 }
2738
2739 return(True);
2740 }
2741
2742 /****************************************************************************
2743 delete a print job
2744 Form: <W> <>
2745 ****************************************************************************/
2746
2747 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2748 char *param, int tpscnt,
2749 char *data, int tdscnt,
2750 int mdrcnt,int mprcnt,
2751 char **rdata,char **rparam,
2752 int *rdata_len,int *rparam_len)
2753 {
2754 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2755 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2756 char *str2 = skip_string(param,tpscnt,str1);
2757 char *p = skip_string(param,tpscnt,str2);
2758 uint32 jobid;
2759 int snum;
2760 fstring sharename;
2761 int errcode;
2762 WERROR werr = WERR_OK;
2763
2764 if (!str1 || !str2 || !p) {
2765 return False;
2766 }
2767 /*
2768 * We use 1 here not 2 as we're checking
2769 * the last byte we want to access is safe.
2770 */
2771 if (!is_offset_safe(param,tpscnt,p,1)) {
2772 return False;
2773 }
2774 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2775 return False;
2776
2777 /* check it's a supported varient */
2778 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2779 return(False);
2780
2781 *rparam_len = 4;
2782 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2783 if (!*rparam) {
2784 return False;
2785 }
2786 *rdata_len = 0;
2787
2788 if (!print_job_exists(sharename, jobid)) {
2789 errcode = NERR_JobNotFound;
2790 goto out;
2791 }
2792
2793 snum = lp_servicenumber( sharename);
2794 if (snum == -1) {
2795 errcode = NERR_DestNotFound;
2796 goto out;
2797 }
2798
2799 errcode = NERR_notsupported;
2800
2801 switch (function) {
2802 case 81: /* delete */
2803 if (print_job_delete(conn->server_info, snum, jobid, &werr))
2804 errcode = NERR_Success;
2805 break;
2806 case 82: /* pause */
2807 if (print_job_pause(conn->server_info, snum, jobid, &werr))
2808 errcode = NERR_Success;
2809 break;
2810 case 83: /* resume */
2811 if (print_job_resume(conn->server_info, snum, jobid, &werr))
2812 errcode = NERR_Success;
2813 break;
2814 }
2815
2816 if (!W_ERROR_IS_OK(werr))
2817 errcode = W_ERROR_V(werr);
2818
2819 out:
2820 SSVAL(*rparam,0,errcode);
2821 SSVAL(*rparam,2,0); /* converter word */
2822
2823 return(True);
2824 }
2825
2826 /****************************************************************************
2827 Purge a print queue - or pause or resume it.
2828 ****************************************************************************/
2829
2830 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2831 char *param, int tpscnt,
2832 char *data, int tdscnt,
2833 int mdrcnt,int mprcnt,
2834 char **rdata,char **rparam,
2835 int *rdata_len,int *rparam_len)
2836 {
2837 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2838 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2839 char *str2 = skip_string(param,tpscnt,str1);
2840 char *QueueName = skip_string(param,tpscnt,str2);
2841 int errcode = NERR_notsupported;
2842 int snum;
2843 WERROR werr = WERR_OK;
2844
2845 if (!str1 || !str2 || !QueueName) {
2846 return False;
2847 }
2848
2849 /* check it's a supported varient */
2850 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2851 return(False);
2852
2853 *rparam_len = 4;
2854 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2855 if (!*rparam) {
2856 return False;
2857 }
2858 *rdata_len = 0;
2859
2860 if (skip_string(param,tpscnt,QueueName) == NULL) {
2861 return False;
2862 }
2863 snum = print_queue_snum(QueueName);
2864
2865 if (snum == -1) {
2866 errcode = NERR_JobNotFound;
2867 goto out;
2868 }
2869
2870 switch (function) {
2871 case 74: /* Pause queue */
2872 if (print_queue_pause(conn->server_info, snum, &werr)) {
2873 errcode = NERR_Success;
2874 }
2875 break;
2876 case 75: /* Resume queue */
2877 if (print_queue_resume(conn->server_info, snum, &werr)) {
2878 errcode = NERR_Success;
2879 }
2880 break;
2881 case 103: /* Purge */
2882 if (print_queue_purge(conn->server_info, snum, &werr)) {
2883 errcode = NERR_Success;
2884 }
2885 break;
2886 }
2887
2888 if (!W_ERROR_IS_OK(werr)) errcode = W_ERROR_V(werr);
2889
2890 out:
2891 SSVAL(*rparam,0,errcode);
2892 SSVAL(*rparam,2,0); /* converter word */
2893
2894 return(True);
2895 }
2896
2897 /****************************************************************************
2898 set the property of a print job (undocumented?)
2899 ? function = 0xb -> set name of print job
2900 ? function = 0x6 -> move print job up/down
2901 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2902 or <WWsTP> <WB21BB16B10zWWzDDz>
2903 ****************************************************************************/
2904
2905 static int check_printjob_info(struct pack_desc* desc,
2906 int uLevel, char* id)
2907 {
2908 desc->subformat = NULL;
2909 switch( uLevel ) {
2910 case 0: desc->format = "W"; break;
2911 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2912 case 2: desc->format = "WWzWWDDzz"; break;
2913 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2914 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2915 default:
2916 DEBUG(0,("check_printjob_info: invalid level %d\n",
2917 uLevel ));
2918 return False;
2919 }
2920 if (id == NULL || strcmp(desc->format,id) != 0) {
2921 DEBUG(0,("check_printjob_info: invalid format %s\n",
2922 id ? id : "<NULL>" ));
2923 return False;
2924 }
2925 return True;
2926 }
2927
2928 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2929 char *param, int tpscnt,
2930 char *data, int tdscnt,
2931 int mdrcnt,int mprcnt,
2932 char **rdata,char **rparam,
2933 int *rdata_len,int *rparam_len)
2934 {
2935 struct pack_desc desc;
2936 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2937 char *str2 = skip_string(param,tpscnt,str1);
2938 char *p = skip_string(param,tpscnt,str2);
2939 uint32 jobid;
2940 fstring sharename;
2941 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2942 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2943 int place, errcode;
2944
2945 if (!str1 || !str2 || !p) {
2946 return False;
2947 }
2948 /*
2949 * We use 1 here not 2 as we're checking
2950 * the last byte we want to access is safe.
2951 */
2952 if (!is_offset_safe(param,tpscnt,p,1)) {
2953 return False;
2954 }
2955 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2956 return False;
2957 *rparam_len = 4;
2958 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2959 if (!*rparam) {
2960 return False;
2961 }
2962
2963 if (!share_defined(sharename)) {
2964 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2965 sharename));
2966 return False;
2967 }
2968
2969 *rdata_len = 0;
2970
2971 /* check it's a supported varient */
2972 if ((strcmp(str1,"WWsTP")) ||
2973 (!check_printjob_info(&desc,uLevel,str2)))
2974 return(False);
2975
2976 if (!print_job_exists(sharename, jobid)) {
2977 errcode=NERR_JobNotFound;
2978 goto out;
2979 }
2980
2981 errcode = NERR_notsupported;
2982
2983 switch (function) {
2984 case 0x6:
2985 /* change job place in the queue,
2986 data gives the new place */
2987 place = SVAL(data,0);
2988 if (print_job_set_place(sharename, jobid, place)) {
2989 errcode=NERR_Success;
2990 }
2991 break;
2992
2993 case 0xb:
2994 /* change print job name, data gives the name */
2995 if (print_job_set_name(sharename, jobid, data)) {
2996 errcode=NERR_Success;
2997 }
2998 break;
2999
3000 default:
3001 return False;
3002 }
3003
3004 out:
3005 SSVALS(*rparam,0,errcode);
3006 SSVAL(*rparam,2,0); /* converter word */
3007
3008 return(True);
3009 }
3010
3011
3012 /****************************************************************************
3013 Get info about the server.
3014 ****************************************************************************/
3015
3016 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3017 char *param, int tpscnt,
3018 char *data, int tdscnt,
3019 int mdrcnt,int mprcnt,
3020 char **rdata,char **rparam,
3021 int *rdata_len,int *rparam_len)
3022 {
3023 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3024 char *str2 = skip_string(param,tpscnt,str1);
3025 char *p = skip_string(param,tpscnt,str2);
3026 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3027 char *p2;
3028 int struct_len;
3029
3030 if (!str1 || !str2 || !p) {
3031 return False;
3032 }
3033
3034 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3035
3036 /* check it's a supported varient */
3037 if (!prefix_ok(str1,"WrLh")) {
3038 return False;
3039 }
3040
3041 switch( uLevel ) {
3042 case 0:
3043 if (strcmp(str2,"B16") != 0) {
3044 return False;
3045 }
3046 struct_len = 16;
3047 break;
3048 case 1:
3049 if (strcmp(str2,"B16BBDz") != 0) {
3050 return False;
3051 }
3052 struct_len = 26;
3053 break;
3054 case 2:
3055 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3056 return False;
3057 }
3058 struct_len = 134;
3059 break;
3060 case 3:
3061 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3062 return False;
3063 }
3064 struct_len = 144;
3065 break;
3066 case 20:
3067 if (strcmp(str2,"DN") != 0) {
3068 return False;
3069 }
3070 struct_len = 6;
3071 break;
3072 case 50:
3073 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3074 return False;
3075 }
3076 struct_len = 42;
3077 break;
3078 default:
3079 return False;
3080 }
3081
3082 *rdata_len = mdrcnt;
3083 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3084 if (!*rdata) {
3085 return False;
3086 }
3087
3088 p = *rdata;
3089 p2 = p + struct_len;
3090 if (uLevel != 20) {
3091 srvstr_push(NULL, 0, p,global_myname(),16,
3092 STR_ASCII|STR_UPPER|STR_TERMINATE);
3093 }
3094 p += 16;
3095 if (uLevel > 0) {
3096 struct srv_info_struct *servers=NULL;
3097 int i,count;
3098 char *comment = NULL;
3099 TALLOC_CTX *ctx = talloc_tos();
3100 uint32 servertype= lp_default_server_announce();
3101
3102 comment = talloc_strdup(ctx,lp_serverstring());
3103 if (!comment) {
3104 return false;
3105 }
3106
3107 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3108 for (i=0;i<count;i++) {
3109 if (strequal(servers[i].name,global_myname())) {
3110 servertype = servers[i].type;
3111 TALLOC_FREE(comment);
3112 comment = talloc_strdup(ctx,
3113 servers[i].comment);
3114 if (comment) {
3115 return false;
3116 }
3117 }
3118 }
3119 }
3120
3121 SAFE_FREE(servers);
3122
3123 SCVAL(p,0,lp_major_announce_version());
3124 SCVAL(p,1,lp_minor_announce_version());
3125 SIVAL(p,2,servertype);
3126
3127 if (mdrcnt == struct_len) {
3128 SIVAL(p,6,0);
3129 } else {
3130 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3131 comment = talloc_sub_advanced(
3132 ctx,
3133 lp_servicename(SNUM(conn)),
3134 conn->server_info->unix_name,
3135 conn->connectpath,
3136 conn->server_info->utok.gid,
3137 conn->server_info->sanitized_username,
3138 pdb_get_domain(conn->server_info->sam_account),
3139 comment);
3140 if (comment) {
3141 return false;
3142 }
3143 if (mdrcnt - struct_len <= 0) {
3144 return false;
3145 }
3146 push_ascii(p2,
3147 comment,
3148 MIN(mdrcnt - struct_len,
3149 MAX_SERVER_STRING_LENGTH),
3150 STR_TERMINATE);
3151 p2 = skip_string(*rdata,*rdata_len,p2);
3152 if (!p2) {
3153 return False;
3154 }
3155 }
3156 }
3157
3158 if (uLevel > 1) {
3159 return False; /* not yet implemented */
3160 }
3161
3162 *rdata_len = PTR_DIFF(p2,*rdata);
3163
3164 *rparam_len = 6;
3165 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3166 if (!*rparam) {
3167 return False;
3168 }
3169 SSVAL(*rparam,0,NERR_Success);
3170 SSVAL(*rparam,2,0); /* converter word */
3171 SSVAL(*rparam,4,*rdata_len);
3172
3173 return True;
3174 }
3175
3176 /****************************************************************************
3177 Get info about the server.
3178 ****************************************************************************/
3179
3180 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3181 char *param, int tpscnt,
3182 char *data, int tdscnt,
3183 int mdrcnt,int mprcnt,
3184 char **rdata,char **rparam,
3185 int *rdata_len,int *rparam_len)
3186 {
3187 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3188 char *str2 = skip_string(param,tpscnt,str1);
3189 char *p = skip_string(param,tpscnt,str2);
3190 char *p2;
3191 char *endp;
3192 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3193
3194 if (!str1 || !str2 || !p) {
3195 return False;
3196 }
3197
3198 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3199
3200 *rparam_len = 6;
3201 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3202 if (!*rparam) {
3203 return False;
3204 }
3205
3206 /* check it's a supported varient */
3207 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3208 return False;
3209 }
3210
3211 *rdata_len = mdrcnt + 1024;
3212 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3213 if (!*rdata) {
3214 return False;
3215 }
3216
3217 SSVAL(*rparam,0,NERR_Success);
3218 SSVAL(*rparam,2,0); /* converter word */
3219
3220 p = *rdata;
3221 endp = *rdata + *rdata_len;
3222
3223 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3224 if (!p2) {
3225 return False;
3226 }
3227
3228 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3229 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3230 strupper_m(p2);
3231 p2 = skip_string(*rdata,*rdata_len,p2);
3232 if (!p2) {
3233 return False;
3234 }
3235 p += 4;
3236
3237 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3238 strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3239 p2 = skip_string(*rdata,*rdata_len,p2);
3240 if (!p2) {
3241 return False;
3242 }
3243 p += 4;
3244
3245 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3246 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3247 strupper_m(p2);
3248 p2 = skip_string(*rdata,*rdata_len,p2);
3249 if (!p2) {
3250 return False;
3251 }
3252 p += 4;
3253
3254 SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3255 SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3256 p += 2;
3257
3258 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3259 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3260 p2 = skip_string(*rdata,*rdata_len,p2);
3261 if (!p2) {
3262 return False;
3263 }
3264 p += 4;
3265
3266 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3267 strlcpy(p2,"",PTR_DIFF(endp,p2));
3268 p2 = skip_string(*rdata,*rdata_len,p2);
3269 if (!p2) {
3270 return False;
3271 }
3272 p += 4;
3273
3274 *rdata_len = PTR_DIFF(p2,*rdata);
3275
3276 SSVAL(*rparam,4,*rdata_len);
3277
3278 return True;
3279 }
3280
3281 /****************************************************************************
3282 get info about a user
3283
3284 struct user_info_11 {
3285 char usri11_name[21]; 0-20
3286 char usri11_pad; 21
3287 char *usri11_comment; 22-25
3288 char *usri11_usr_comment; 26-29
3289 unsigned short usri11_priv; 30-31
3290 unsigned long usri11_auth_flags; 32-35
3291 long usri11_password_age; 36-39
3292 char *usri11_homedir; 40-43
3293 char *usri11_parms; 44-47
3294 long usri11_last_logon; 48-51
3295 long usri11_last_logoff; 52-55
3296 unsigned short usri11_bad_pw_count; 56-57
3297 unsigned short usri11_num_logons; 58-59
3298 char *usri11_logon_server; 60-63
3299 unsigned short usri11_country_code; 64-65
3300 char *usri11_workstations; 66-69
3301 unsigned long usri11_max_storage; 70-73
3302 unsigned short usri11_units_per_week; 74-75
3303 unsigned char *usri11_logon_hours; 76-79
3304 unsigned short usri11_code_page; 80-81
3305 };
3306
3307 where:
3308
3309 usri11_name specifies the user name for which information is retrieved
3310
3311 usri11_pad aligns the next data structure element to a word boundary
3312
3313 usri11_comment is a null terminated ASCII comment
3314
3315 usri11_user_comment is a null terminated ASCII comment about the user
3316
3317 usri11_priv specifies the level of the privilege assigned to the user.
3318 The possible values are:
3319
3320 Name Value Description
3321 USER_PRIV_GUEST 0 Guest privilege
3322 USER_PRIV_USER 1 User privilege
3323 USER_PRV_ADMIN 2 Administrator privilege
3324
3325 usri11_auth_flags specifies the account operator privileges. The
3326 possible values are:
3327
3328 Name Value Description
3329 AF_OP_PRINT 0 Print operator
3330
3331
3332 Leach, Naik [Page 28]
3333 \f
3334
3335
3336 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3337
3338
3339 AF_OP_COMM 1 Communications operator
3340 AF_OP_SERVER 2 Server operator
3341 AF_OP_ACCOUNTS 3 Accounts operator
3342
3343
3344 usri11_password_age specifies how many seconds have elapsed since the
3345 password was last changed.
3346
3347 usri11_home_dir points to a null terminated ASCII string that contains
3348 the path name of the user's home directory.
3349
3350 usri11_parms points to a null terminated ASCII string that is set
3351 aside for use by applications.
3352
3353 usri11_last_logon specifies the time when the user last logged on.
3354 This value is stored as the number of seconds elapsed since
3355 00:00:00, January 1, 1970.
3356
3357 usri11_last_logoff specifies the time when the user last logged off.
3358 This value is stored as the number of seconds elapsed since
3359 00:00:00, January 1, 1970. A value of 0 means the last logoff
3360 time is unknown.
3361
3362 usri11_bad_pw_count specifies the number of incorrect passwords
3363 entered since the last successful logon.
3364
3365 usri11_log1_num_logons specifies the number of times this user has
3366 logged on. A value of -1 means the number of logons is unknown.
3367
3368 usri11_logon_server points to a null terminated ASCII string that
3369 contains the name of the server to which logon requests are sent.
3370 A null string indicates logon requests should be sent to the
3371 domain controller.
3372
3373 usri11_country_code specifies the country code for the user's language
3374 of choice.
3375
3376 usri11_workstations points to a null terminated ASCII string that
3377 contains the names of workstations the user may log on from.
3378 There may be up to 8 workstations, with the names separated by
3379 commas. A null strings indicates there are no restrictions.
3380
3381 usri11_max_storage specifies the maximum amount of disk space the user
3382 can occupy. A value of 0xffffffff indicates there are no
3383 restrictions.
3384
3385 usri11_units_per_week specifies the equal number of time units into
3386 which a week is divided. This value must be equal to 168.
3387
3388 usri11_logon_hours points to a 21 byte (168 bits) string that
3389 specifies the time during which the user can log on. Each bit
3390 represents one unique hour in a week. The first bit (bit 0, word
3391 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3392
3393
3394
3395 Leach, Naik [Page 29]
3396 \f
3397
3398
3399 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3400
3401
3402 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3403 are no restrictions.
3404
3405 usri11_code_page specifies the code page for the user's language of
3406 choice
3407
3408 All of the pointers in this data structure need to be treated
3409 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3410 to be ignored. The converter word returned in the parameters section
3411 needs to be subtracted from the lower 16 bits to calculate an offset
3412 into the return buffer where this ASCII string resides.
3413
3414 There is no auxiliary data in the response.
3415
3416 ****************************************************************************/
3417
3418 #define usri11_name 0
3419 #define usri11_pad 21
3420 #define usri11_comment 22
3421 #define usri11_usr_comment 26
3422 #define usri11_full_name 30
3423 #define usri11_priv 34
3424 #define usri11_auth_flags 36
3425 #define usri11_password_age 40
3426 #define usri11_homedir 44
3427 #define usri11_parms 48
3428 #define usri11_last_logon 52
3429 #define usri11_last_logoff 56
3430 #define usri11_bad_pw_count 60
3431 #define usri11_num_logons 62
3432 #define usri11_logon_server 64
3433 #define usri11_country_code 68
3434 #define usri11_workstations 70
3435 #define usri11_max_storage 74
3436 #define usri11_units_per_week 78
3437 #define usri11_logon_hours 80
3438 #define usri11_code_page 84
3439 #define usri11_end 86
3440
3441 #define USER_PRIV_GUEST 0
3442 #define USER_PRIV_USER 1
3443 #define USER_PRIV_ADMIN 2
3444
3445 #define AF_OP_PRINT 0
3446 #define AF_OP_COMM 1
3447 #define AF_OP_SERVER 2
3448 #define AF_OP_ACCOUNTS 3
3449
3450
3451 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3452 char *param, int tpscnt,
3453 char *data, int tdscnt,
3454 int mdrcnt,int mprcnt,
3455 char **rdata,char **rparam,
3456 int *rdata_len,int *rparam_len)
3457 {
3458 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3459 char *str2 = skip_string(param,tpscnt,str1);
3460 char *UserName = skip_string(param,tpscnt,str2);
3461 char *p = skip_string(param,tpscnt,UserName);
3462 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3463 char *p2;
3464 char *endp;
3465 const char *level_string;
3466
3467 /* get NIS home of a previously validated user - simeon */
3468 /* With share level security vuid will always be zero.
3469 Don't depend on vuser being non-null !!. JRA */
3470 user_struct *vuser = get_valid_user_struct(vuid);
3471 if(vuser != NULL) {
3472 DEBUG(3,(" Username of UID %d is %s\n",
3473 (int)vuser->server_info->utok.uid,
3474 vuser->server_info->unix_name));
3475 }
3476
3477 if (!str1 || !str2 || !UserName || !p) {
3478 return False;
3479 }
3480
3481 *rparam_len = 6;
3482 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3483 if (!*rparam) {
3484 return False;
3485 }
3486
3487 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3488
3489 /* check it's a supported variant */
3490 if (strcmp(str1,"zWrLh") != 0) {
3491 return False;
3492 }
3493 switch( uLevel ) {
3494 case 0: level_string = "B21"; break;
3495 case 1: level_string = "B21BB16DWzzWz"; break;
3496 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3497 case 10: level_string = "B21Bzzz"; break;
3498 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3499 default: return False;
3500 }
3501
3502 if (strcmp(level_string,str2) != 0) {
3503 return False;
3504 }
3505
3506 *rdata_len = mdrcnt + 1024;
3507 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3508 if (!*rdata) {
3509 return False;
3510 }
3511
3512 SSVAL(*rparam,0,NERR_Success);
3513 SSVAL(*rparam,2,0); /* converter word */
3514
3515 p = *rdata;
3516 endp = *rdata + *rdata_len;
3517 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3518 if (!p2) {
3519 return False;
3520 }
3521
3522 memset(p,0,21);
3523 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3524
3525 if (uLevel > 0) {
3526 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3527 *p2 = 0;
3528 }
3529
3530 if (uLevel >= 10) {
3531 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3532 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3533 p2 = skip_string(*rdata,*rdata_len,p2);
3534 if (!p2) {
3535 return False;
3536 }
3537
3538 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3539 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3540 p2 = skip_string(*rdata,*rdata_len,p2);
3541 if (!p2) {
3542 return False;
3543 }
3544
3545 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3546 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3547 strlcpy(p2,((vuser != NULL)
3548 ? pdb_get_fullname(vuser->server_info->sam_account)
3549 : UserName),PTR_DIFF(endp,p2));
3550 p2 = skip_string(*rdata,*rdata_len,p2);
3551 if (!p2) {
3552 return False;
3553 }
3554 }
3555
3556 if (uLevel == 11) {
3557 const char *homedir = "";
3558 if (vuser != NULL) {
3559 homedir = pdb_get_homedir(
3560 vuser->server_info->sam_account);
3561 }
3562 /* modelled after NTAS 3.51 reply */
3563 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3564 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
3565 SIVALS(p,usri11_password_age,-1); /* password age */
3566 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3567 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3568 p2 = skip_string(*rdata,*rdata_len,p2);
3569 if (!p2) {
3570 return False;
3571 }
3572 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3573 strlcpy(p2,"",PTR_DIFF(endp,p2));
3574 p2 = skip_string(*rdata,*rdata_len,p2);
3575 if (!p2) {
3576 return False;
3577 }
3578 SIVAL(p,usri11_last_logon,0); /* last logon */
3579 SIVAL(p,usri11_last_logoff,0); /* last logoff */
3580 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
3581 SSVALS(p,usri11_num_logons,-1); /* num logons */
3582 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3583 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3584 p2 = skip_string(*rdata,*rdata_len,p2);
3585 if (!p2) {
3586 return False;
3587 }
3588 SSVAL(p,usri11_country_code,0); /* country code */
3589
3590 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3591 strlcpy(p2,"",PTR_DIFF(endp,p2));
3592 p2 = skip_string(*rdata,*rdata_len,p2);
3593 if (!p2) {
3594 return False;
3595 }
3596
3597 SIVALS(p,usri11_max_storage,-1); /* max storage */
3598 SSVAL(p,usri11_units_per_week,168); /* units per week */
3599 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3600
3601 /* a simple way to get logon hours at all times. */
3602 memset(p2,0xff,21);
3603 SCVAL(p2,21,0); /* fix zero termination */
3604 p2 = skip_string(*rdata,*rdata_len,p2);
3605 if (!p2) {
3606 return False;
3607 }
3608
3609 SSVAL(p,usri11_code_page,0); /* code page */
3610 }
3611
3612 if (uLevel == 1 || uLevel == 2) {
3613 memset(p+22,' ',16); /* password */
3614 SIVALS(p,38,-1); /* password age */
3615 SSVAL(p,42,
3616 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3617 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3618 strlcpy(p2, vuser ? pdb_get_homedir(
3619 vuser->server_info->sam_account) : "",
3620 PTR_DIFF(endp,p2));
3621 p2 = skip_string(*rdata,*rdata_len,p2);
3622 if (!p2) {
3623 return False;
3624 }
3625 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3626 *p2++ = 0;
3627 SSVAL(p,52,0); /* flags */
3628 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
3629 strlcpy(p2, vuser ? pdb_get_logon_script(
3630 vuser->server_info->sam_account) : "",
3631 PTR_DIFF(endp,p2));
3632 p2 = skip_string(*rdata,*rdata_len,p2);
3633 if (!p2) {
3634 return False;
3635 }
3636 if (uLevel == 2) {
3637 SIVAL(p,60,0); /* auth_flags */
3638 SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3639 strlcpy(p2,((vuser != NULL)
3640 ? pdb_get_fullname(vuser->server_info->sam_account)
3641 : UserName),PTR_DIFF(endp,p2));
3642 p2 = skip_string(*rdata,*rdata_len,p2);
3643 if (!p2) {
3644 return False;
3645 }
3646 SIVAL(p,68,0); /* urs_comment */
3647 SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3648 strlcpy(p2,"",PTR_DIFF(endp,p2));
3649 p2 = skip_string(*rdata,*rdata_len,p2);
3650 if (!p2) {
3651 return False;
3652 }
3653 SIVAL(p,76,0); /* workstations */
3654 SIVAL(p,80,0); /* last_logon */
3655 SIVAL(p,84,0); /* last_logoff */
3656 SIVALS(p,88,-1); /* acct_expires */
3657 SIVALS(p,92,-1); /* max_storage */
3658 SSVAL(p,96,168); /* units_per_week */
3659 SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3660 memset(p2,-1,21);
3661 p2 += 21;
3662 SSVALS(p,102,-1); /* bad_pw_count */
3663 SSVALS(p,104,-1); /* num_logons */
3664 SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3665 {
3666 TALLOC_CTX *ctx = talloc_tos();
3667 int space_rem = *rdata_len - (p2 - *rdata);
3668 char *tmp;
3669
3670 if (space_rem <= 0) {
3671 return false;
3672 }
3673 tmp = talloc_strdup(ctx, "\\\\%L");
3674 if (!tmp) {
3675 return false;
3676 }
3677 tmp = talloc_sub_basic(ctx,
3678 "",
3679 "",
3680 tmp);
3681 if (!tmp) {
3682 return false;
3683 }
3684
3685 push_ascii(p2,
3686 tmp,
3687 space_rem,
3688 STR_TERMINATE);
3689 }
3690 p2 = skip_string(*rdata,*rdata_len,p2);
3691 if (!p2) {
3692 return False;
3693 }
3694 SSVAL(p,110,49); /* country_code */
3695 SSVAL(p,112,860); /* code page */
3696 }
3697 }
3698
3699 *rdata_len = PTR_DIFF(p2,*rdata);
3700
3701 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
3702
3703 return(True);
3704 }
3705
3706 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3707 char *param, int tpscnt,
3708 char *data, int tdscnt,
3709 int mdrcnt,int mprcnt,
3710 char **rdata,char **rparam,
3711 int *rdata_len,int *rparam_len)
3712 {
3713 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3714 char *str2 = skip_string(param,tpscnt,str1);
3715 char *p = skip_string(param,tpscnt,str2);
3716 int uLevel;
3717 struct pack_desc desc;
3718 char* name;
3719 /* With share level security vuid will always be zero.
3720 Don't depend on vuser being non-null !!. JRA */
3721 user_struct *vuser = get_valid_user_struct(vuid);
3722
3723 if (!str1 || !str2 || !p) {
3724 return False;
3725 }
3726
3727 if(vuser != NULL) {
3728 DEBUG(3,(" Username of UID %d is %s\n",
3729 (int)vuser->server_info->utok.uid,
3730 vuser->server_info->unix_name));
3731 }
3732
3733 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3734 name = get_safe_str_ptr(param,tpscnt,p,2);
3735 if (!name) {
3736 return False;
3737 }
3738
3739 memset((char *)&desc,'\0',sizeof(desc));
3740
3741 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3742
3743 /* check it's a supported varient */
3744 if (strcmp(str1,"OOWb54WrLh") != 0) {
3745 return False;
3746 }
3747 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3748 return False;
3749 }
3750 if (mdrcnt > 0) {
3751 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3752 if (!*rdata) {
3753 return False;
3754 }
3755 }
3756
3757 desc.base = *rdata;
3758 desc.buflen = mdrcnt;
3759 desc.subformat = NULL;
3760 desc.format = str2;
3761
3762 if (init_package(&desc,1,0)) {
3763 PACKI(&desc,"W",0); /* code */
3764 PACKS(&desc,"B21",name); /* eff. name */
3765 PACKS(&desc,"B",""); /* pad */
3766 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3767 PACKI(&desc,"D",0); /* auth flags XXX */
3768 PACKI(&desc,"W",0); /* num logons */
3769 PACKI(&desc,"W",0); /* bad pw count */
3770 PACKI(&desc,"D",0); /* last logon */
3771 PACKI(&desc,"D",-1); /* last logoff */
3772 PACKI(&desc,"D",-1); /* logoff time */
3773 PACKI(&desc,"D",-1); /* kickoff time */
3774 PACKI(&desc,"D",0); /* password age */
3775 PACKI(&desc,"D",0); /* password can change */
3776 PACKI(&desc,"D",-1); /* password must change */
3777
3778 {
3779 fstring mypath;
3780 fstrcpy(mypath,"\\\\");
3781 fstrcat(mypath,get_local_machine_name());
3782 strupper_m(mypath);
3783 PACKS(&desc,"z",mypath); /* computer */
3784 }
3785
3786 PACKS(&desc,"z",lp_workgroup());/* domain */
3787 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3788 vuser->server_info->sam_account) : ""); /* script path */
3789 PACKI(&desc,"D",0x00000000); /* reserved */
3790 }
3791
3792 *rdata_len = desc.usedlen;
3793 *rparam_len = 6;
3794 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3795 if (!*rparam) {
3796 return False;
3797 }
3798 SSVALS(*rparam,0,desc.errcode);
3799 SSVAL(*rparam,2,0);
3800 SSVAL(*rparam,4,desc.neededlen);
3801
3802 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3803
3804 return True;
3805 }
3806
3807 /****************************************************************************
3808 api_WAccessGetUserPerms
3809 ****************************************************************************/
3810
3811 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3812 char *param, int tpscnt,
3813 char *data, int tdscnt,
3814 int mdrcnt,int mprcnt,
3815 char **rdata,char **rparam,
3816 int *rdata_len,int *rparam_len)
3817 {
3818 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3819 char *str2 = skip_string(param,tpscnt,str1);
3820 char *user = skip_string(param,tpscnt,str2);
3821 char *resource = skip_string(param,tpscnt,user);
3822
3823 if (!str1 || !str2 || !user || !resource) {
3824 return False;
3825 }
3826
3827 if (skip_string(param,tpscnt,resource) == NULL) {
3828 return False;
3829 }
3830 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3831
3832 /* check it's a supported varient */
3833 if (strcmp(str1,"zzh") != 0) {
3834 return False;
3835 }
3836 if (strcmp(str2,"") != 0) {
3837 return False;
3838 }
3839
3840 *rparam_len = 6;
3841 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3842 if (!*rparam) {
3843 return False;
3844 }
3845 SSVALS(*rparam,0,0); /* errorcode */
3846 SSVAL(*rparam,2,0); /* converter word */
3847 SSVAL(*rparam,4,0x7f); /* permission flags */
3848
3849 return True;
3850 }
3851
3852 /****************************************************************************
3853 api_WPrintJobEnumerate
3854 ****************************************************************************/
3855
3856 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3857 char *param, int tpscnt,
3858 char *data, int tdscnt,
3859 int mdrcnt,int mprcnt,
3860 char **rdata,char **rparam,
3861 int *rdata_len,int *rparam_len)
3862 {
3863 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3864 char *str2 = skip_string(param,tpscnt,str1);
3865 char *p = skip_string(param,tpscnt,str2);
3866 int uLevel;
3867 int count;
3868 int i;
3869 int snum;
3870 fstring sharename;
3871 uint32 jobid;
3872 struct pack_desc desc;
3873 print_queue_struct *queue=NULL;
3874 print_status_struct status;
3875 char *tmpdata=NULL;
3876
3877 if (!str1 || !str2 || !p) {
3878 return False;
3879 }
3880
3881 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3882
3883 memset((char *)&desc,'\0',sizeof(desc));
3884 memset((char *)&status,'\0',sizeof(status));
3885
3886 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3887
3888 /* check it's a supported varient */
3889 if (strcmp(str1,"WWrLh") != 0) {
3890 return False;
3891 }
3892 if (!check_printjob_info(&desc,uLevel,str2)) {
3893 return False;
3894 }
3895
3896 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3897 return False;
3898 }
3899
3900 snum = lp_servicenumber( sharename);
3901 if (snum < 0 || !VALID_SNUM(snum)) {
3902 return(False);
3903 }
3904
3905 count = print_queue_status(snum,&queue,&status);
3906 for (i = 0; i < count; i++) {
3907 if (queue[i].job == jobid) {
3908 break;
3909 }
3910 }
3911
3912 if (mdrcnt > 0) {
3913 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3914 if (!*rdata) {
3915 return False;
3916 }
3917 desc.base = *rdata;
3918 desc.buflen = mdrcnt;
3919 } else {
3920 /*
3921 * Don't return data but need to get correct length
3922 * init_package will return wrong size if buflen=0
3923 */
3924 desc.buflen = getlen(desc.format);
3925 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3926 }
3927
3928 if (init_package(&desc,1,0)) {
3929 if (i < count) {
3930 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3931 *rdata_len = desc.usedlen;
3932 } else {
3933 desc.errcode = NERR_JobNotFound;
3934 *rdata_len = 0;
3935 }
3936 }
3937
3938 *rparam_len = 6;
3939 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3940 if (!*rparam) {
3941 return False;
3942 }
3943 SSVALS(*rparam,0,desc.errcode);
3944 SSVAL(*rparam,2,0);
3945 SSVAL(*rparam,4,desc.neededlen);
3946
3947 SAFE_FREE(queue);
3948 SAFE_FREE(tmpdata);
3949
3950 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3951
3952 return True;
3953 }
3954
3955 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3956 char *param, int tpscnt,
3957 char *data, int tdscnt,
3958 int mdrcnt,int mprcnt,
3959 char **rdata,char **rparam,
3960 int *rdata_len,int *rparam_len)
3961 {
3962 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3963 char *str2 = skip_string(param,tpscnt,str1);
3964 char *p = skip_string(param,tpscnt,str2);
3965 char *name = p;
3966 int uLevel;
3967 int count;
3968 int i, succnt=0;
3969 int snum;
3970 struct pack_desc desc;
3971 print_queue_struct *queue=NULL;
3972 print_status_struct status;
3973
3974 if (!str1 || !str2 || !p) {
3975 return False;
3976 }
3977
3978 memset((char *)&desc,'\0',sizeof(desc));
3979 memset((char *)&status,'\0',sizeof(status));
3980
3981 p = skip_string(param,tpscnt,p);
3982 if (!p) {
3983 return False;
3984 }
3985 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3986
3987 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3988
3989 /* check it's a supported variant */
3990 if (strcmp(str1,"zWrLeh") != 0) {
3991 return False;
3992 }
3993
3994 if (uLevel > 2) {
3995 return False; /* defined only for uLevel 0,1,2 */
3996 }
3997
3998 if (!check_printjob_info(&desc,uLevel,str2)) {
3999 return False;
4000 }
4001
4002 snum = find_service(name);
4003 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4004 return False;
4005 }
4006
4007 count = print_queue_status(snum,&queue,&status);
4008 if (mdrcnt > 0) {
4009 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4010 if (!*rdata) {
4011 return False;
4012 }
4013 }
4014 desc.base = *rdata;
4015 desc.buflen = mdrcnt;
4016
4017 if (init_package(&desc,count,0)) {
4018 succnt = 0;
4019 for (i = 0; i < count; i++) {
4020 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4021 if (desc.errcode == NERR_Success) {
4022 succnt = i+1;
4023 }
4024 }
4025 }
4026
4027 *rdata_len = desc.usedlen;
4028
4029 *rparam_len = 8;
4030 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4031 if (!*rparam) {
4032 return False;
4033 }
4034 SSVALS(*rparam,0,desc.errcode);
4035 SSVAL(*rparam,2,0);
4036 SSVAL(*rparam,4,succnt);
4037 SSVAL(*rparam,6,count);
4038
4039 SAFE_FREE(queue);
4040
4041 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4042
4043 return True;
4044 }
4045
4046 static int check_printdest_info(struct pack_desc* desc,
4047 int uLevel, char* id)
4048 {
4049 desc->subformat = NULL;
4050 switch( uLevel ) {
4051 case 0:
4052 desc->format = "B9";
4053 break;
4054 case 1:
4055 desc->format = "B9B21WWzW";
4056 break;
4057 case 2:
4058 desc->format = "z";
4059 break;
4060 case 3:
4061 desc->format = "zzzWWzzzWW";
4062 break;
4063 default:
4064 DEBUG(0,("check_printdest_info: invalid level %d\n",
4065 uLevel));
4066 return False;
4067 }
4068 if (id == NULL || strcmp(desc->format,id) != 0) {
4069 DEBUG(0,("check_printdest_info: invalid string %s\n",
4070 id ? id : "<NULL>" ));
4071 return False;
4072 }
4073 return True;
4074 }
4075
4076 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4077 struct pack_desc* desc)
4078 {
4079 char buf[100];
4080
4081 strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4082 buf[sizeof(buf)-1] = 0;
4083 strupper_m(buf);
4084
4085 if (uLevel <= 1) {
4086 PACKS(desc,"B9",buf); /* szName */
4087 if (uLevel == 1) {
4088 PACKS(desc,"B21",""); /* szUserName */
4089 PACKI(desc,"W",0); /* uJobId */
4090 PACKI(desc,"W",0); /* fsStatus */
4091 PACKS(desc,"z",""); /* pszStatus */
4092 PACKI(desc,"W",0); /* time */
4093 }
4094 }
4095
4096 if (uLevel == 2 || uLevel == 3) {
4097 PACKS(desc,"z",buf); /* pszPrinterName */
4098 if (uLevel == 3) {
4099 PACKS(desc,"z",""); /* pszUserName */
4100 PACKS(desc,"z",""); /* pszLogAddr */
4101 PACKI(desc,"W",0); /* uJobId */
4102 PACKI(desc,"W",0); /* fsStatus */
4103 PACKS(desc,"z",""); /* pszStatus */
4104 PACKS(desc,"z",""); /* pszComment */
4105 PACKS(desc,"z","NULL"); /* pszDrivers */
4106 PACKI(desc,"W",0); /* time */
4107 PACKI(desc,"W",0); /* pad1 */
4108 }
4109 }
4110 }
4111
4112 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4113 char *param, int tpscnt,
4114 char *data, int tdscnt,
4115 int mdrcnt,int mprcnt,
4116 char **rdata,char **rparam,
4117 int *rdata_len,int *rparam_len)
4118 {
4119 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4120 char *str2 = skip_string(param,tpscnt,str1);
4121 char *p = skip_string(param,tpscnt,str2);
4122 char* PrinterName = p;
4123 int uLevel;
4124 struct pack_desc desc;
4125 int snum;
4126 char *tmpdata=NULL;
4127
4128 if (!str1 || !str2 || !p) {
4129 return False;
4130 }
4131
4132 memset((char *)&desc,'\0',sizeof(desc));
4133
4134 p = skip_string(param,tpscnt,p);
4135 if (!p) {
4136 return False;
4137 }
4138 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4139
4140 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4141
4142 /* check it's a supported varient */
4143 if (strcmp(str1,"zWrLh") != 0) {
4144 return False;
4145 }
4146 if (!check_printdest_info(&desc,uLevel,str2)) {
4147 return False;
4148 }
4149
4150 snum = find_service(PrinterName);
4151 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4152 *rdata_len = 0;
4153 desc.errcode = NERR_DestNotFound;
4154 desc.neededlen = 0;
4155 } else {
4156 if (mdrcnt > 0) {
4157 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4158 if (!*rdata) {
4159 return False;
4160 }
4161 desc.base = *rdata;
4162 desc.buflen = mdrcnt;
4163 } else {
4164 /*
4165 * Don't return data but need to get correct length
4166 * init_package will return wrong size if buflen=0
4167 */
4168 desc.buflen = getlen(desc.format);
4169 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4170 }
4171 if (init_package(&desc,1,0)) {
4172 fill_printdest_info(conn,snum,uLevel,&desc);
4173 }
4174 *rdata_len = desc.usedlen;
4175 }
4176
4177 *rparam_len = 6;
4178 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4179 if (!*rparam) {
4180 return False;
4181 }
4182 SSVALS(*rparam,0,desc.errcode);
4183 SSVAL(*rparam,2,0);
4184 SSVAL(*rparam,4,desc.neededlen);
4185
4186 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4187 SAFE_FREE(tmpdata);
4188
4189 return True;
4190 }
4191
4192 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4193 char *param, int tpscnt,
4194 char *data, int tdscnt,
4195 int mdrcnt,int mprcnt,
4196 char **rdata,char **rparam,
4197 int *rdata_len,int *rparam_len)
4198 {
4199 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4200 char *str2 = skip_string(param,tpscnt,str1);
4201 char *p = skip_string(param,tpscnt,str2);
4202 int uLevel;
4203 int queuecnt;
4204 int i, n, succnt=0;
4205 struct pack_desc desc;
4206 int services = lp_numservices();
4207
4208 if (!str1 || !str2 || !p) {
4209 return False;
4210 }
4211
4212 memset((char *)&desc,'\0',sizeof(desc));
4213
4214 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4215
4216 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4217
4218 /* check it's a supported varient */
4219 if (strcmp(str1,"WrLeh") != 0) {
4220 return False;
4221 }
4222 if (!check_printdest_info(&desc,uLevel,str2)) {
4223 return False;
4224 }
4225
4226 queuecnt = 0;
4227 for (i = 0; i < services; i++) {
4228 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4229 queuecnt++;
4230 }
4231 }
4232
4233 if (mdrcnt > 0) {
4234 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4235 if (!*rdata) {
4236 return False;
4237 }
4238 }
4239
4240 desc.base = *rdata;
4241 desc.buflen = mdrcnt;
4242 if (init_package(&desc,queuecnt,0)) {
4243 succnt = 0;
4244 n = 0;
4245 for (i = 0; i < services; i++) {
4246 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4247 fill_printdest_info(conn,i,uLevel,&desc);
4248 n++;
4249 if (desc.errcode == NERR_Success) {
4250 succnt = n;
4251 }
4252 }
4253 }
4254 }
4255
4256 *rdata_len = desc.usedlen;
4257
4258 *rparam_len = 8;
4259 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4260 if (!*rparam) {
4261 return False;
4262 }
4263 SSVALS(*rparam,0,desc.errcode);
4264 SSVAL(*rparam,2,0);
4265 SSVAL(*rparam,4,succnt);
4266 SSVAL(*rparam,6,queuecnt);
4267
4268 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4269
4270 return True;
4271 }
4272
4273 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4274 char *param, int tpscnt,
4275 char *data, int tdscnt,
4276 int mdrcnt,int mprcnt,
4277 char **rdata,char **rparam,
4278 int *rdata_len,int *rparam_len)
4279 {
4280 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4281 char *str2 = skip_string(param,tpscnt,str1);
4282 char *p = skip_string(param,tpscnt,str2);
4283 int uLevel;
4284 int succnt;
4285 struct pack_desc desc;
4286
4287 if (!str1 || !str2 || !p) {
4288 return False;
4289 }
4290
4291 memset((char *)&desc,'\0',sizeof(desc));
4292
4293 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4294
4295 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4296
4297 /* check it's a supported varient */
4298 if (strcmp(str1,"WrLeh") != 0) {
4299 return False;
4300 }
4301 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4302 return False;
4303 }
4304
4305 if (mdrcnt > 0) {
4306 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4307 if (!*rdata) {
4308 return False;
4309 }
4310 }
4311 desc.base = *rdata;
4312 desc.buflen = mdrcnt;
4313 if (init_package(&desc,1,0)) {
4314 PACKS(&desc,"B41","NULL");
4315 }
4316
4317 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4318
4319 *rdata_len = desc.usedlen;
4320
4321 *rparam_len = 8;
4322 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4323 if (!*rparam) {
4324 return False;
4325 }
4326 SSVALS(*rparam,0,desc.errcode);
4327 SSVAL(*rparam,2,0);
4328 SSVAL(*rparam,4,succnt);
4329 SSVAL(*rparam,6,1);
4330
4331 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4332
4333 return True;
4334 }
4335
4336 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4337 char *param, int tpscnt,
4338 char *data, int tdscnt,
4339 int mdrcnt,int mprcnt,
4340 char **rdata,char **rparam,
4341 int *rdata_len,int *rparam_len)
4342 {
4343 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4344 char *str2 = skip_string(param,tpscnt,str1);
4345 char *p = skip_string(param,tpscnt,str2);
4346 int uLevel;
4347 int succnt;
4348 struct pack_desc desc;
4349
4350 if (!str1 || !str2 || !p) {
4351 return False;
4352 }
4353 memset((char *)&desc,'\0',sizeof(desc));
4354
4355 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4356
4357 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4358
4359 /* check it's a supported varient */
4360 if (strcmp(str1,"WrLeh") != 0) {
4361 return False;
4362 }
4363 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4364 return False;
4365 }
4366
4367 if (mdrcnt > 0) {
4368 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4369 if (!*rdata) {
4370 return False;
4371 }
4372 }
4373 desc.base = *rdata;
4374 desc.buflen = mdrcnt;
4375 desc.format = str2;
4376 if (init_package(&desc,1,0)) {
4377 PACKS(&desc,"B13","lpd");
4378 }
4379
4380 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4381
4382 *rdata_len = desc.usedlen;
4383
4384 *rparam_len = 8;
4385 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4386 if (!*rparam) {
4387 return False;
4388 }
4389 SSVALS(*rparam,0,desc.errcode);
4390 SSVAL(*rparam,2,0);
4391 SSVAL(*rparam,4,succnt);
4392 SSVAL(*rparam,6,1);
4393
4394 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4395
4396 return True;
4397 }
4398
4399 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4400 char *param, int tpscnt,
4401 char *data, int tdscnt,
4402 int mdrcnt,int mprcnt,
4403 char **rdata,char **rparam,
4404 int *rdata_len,int *rparam_len)
4405 {
4406 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4407 char *str2 = skip_string(param,tpscnt,str1);
4408 char *p = skip_string(param,tpscnt,str2);
4409 int uLevel;
4410 int succnt;
4411 struct pack_desc desc;
4412
4413 if (!str1 || !str2 || !p) {
4414 return False;
4415 }
4416
4417 memset((char *)&desc,'\0',sizeof(desc));
4418
4419 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4420
4421 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4422
4423 /* check it's a supported varient */
4424 if (strcmp(str1,"WrLeh") != 0) {
4425 return False;
4426 }
4427 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4428 return False;
4429 }
4430
4431 if (mdrcnt > 0) {
4432 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4433 if (!*rdata) {
4434 return False;
4435 }
4436 }
4437 memset((char *)&desc,'\0',sizeof(desc));
4438 desc.base = *rdata;
4439 desc.buflen = mdrcnt;
4440 desc.format = str2;
4441 if (init_package(&desc,1,0)) {
4442 PACKS(&desc,"B13","lp0");
4443 }
4444
4445 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4446
4447 *rdata_len = desc.usedlen;
4448
4449 *rparam_len = 8;
4450 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4451 if (!*rparam) {
4452 return False;
4453 }
4454 SSVALS(*rparam,0,desc.errcode);
4455 SSVAL(*rparam,2,0);
4456 SSVAL(*rparam,4,succnt);
4457 SSVAL(*rparam,6,1);
4458
4459 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4460
4461 return True;
4462 }
4463
4464 /****************************************************************************
4465 List open sessions
4466 ****************************************************************************/
4467
4468 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4469 char *param, int tpscnt,
4470 char *data, int tdscnt,
4471 int mdrcnt,int mprcnt,
4472 char **rdata,char **rparam,
4473 int *rdata_len,int *rparam_len)
4474
4475 {
4476 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4477 char *str2 = skip_string(param,tpscnt,str1);
4478 char *p = skip_string(param,tpscnt,str2);
4479 int uLevel;
4480 struct pack_desc desc;
4481 struct sessionid *session_list;
4482 int i, num_sessions;
4483
4484 if (!str1 || !str2 || !p) {
4485 return False;
4486 }
4487
4488 memset((char *)&desc,'\0',sizeof(desc));
4489
4490 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4491
4492 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4493 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4494 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4495
4496 /* check it's a supported varient */
4497 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4498 return False;
4499 }
4500 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4501 return False;
4502 }
4503
4504 num_sessions = list_sessions(talloc_tos(), &session_list);
4505
4506 if (mdrcnt > 0) {
4507 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4508 if (!*rdata) {
4509 return False;
4510 }
4511 }
4512 memset((char *)&desc,'\0',sizeof(desc));
4513 desc.base = *rdata;
4514 desc.buflen = mdrcnt;
4515 desc.format = str2;
4516 if (!init_package(&desc,num_sessions,0)) {
4517 return False;
4518 }
4519
4520 for(i=0; i<num_sessions; i++) {
4521 PACKS(&desc, "z", session_list[i].remote_machine);
4522 PACKS(&desc, "z", session_list[i].username);
4523 PACKI(&desc, "W", 1); /* num conns */
4524 PACKI(&desc, "W", 0); /* num opens */
4525 PACKI(&desc, "W", 1); /* num users */
4526 PACKI(&desc, "D", 0); /* session time */
4527 PACKI(&desc, "D", 0); /* idle time */
4528 PACKI(&desc, "D", 0); /* flags */
4529 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4530 }
4531
4532 *rdata_len = desc.usedlen;
4533
4534 *rparam_len = 8;
4535 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4536 if (!*rparam) {
4537 return False;
4538 }
4539 SSVALS(*rparam,0,desc.errcode);
4540 SSVAL(*rparam,2,0); /* converter */
4541 SSVAL(*rparam,4,num_sessions); /* count */
4542
4543 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4544
4545 return True;
4546 }
4547
4548
4549 /****************************************************************************
4550 The buffer was too small.
4551 ****************************************************************************/
4552
4553 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4554 int mdrcnt, int mprcnt,
4555 char **rdata, char **rparam,
4556 int *rdata_len, int *rparam_len)
4557 {
4558 *rparam_len = MIN(*rparam_len,mprcnt);
4559 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4560 if (!*rparam) {
4561 return False;
4562 }
4563
4564 *rdata_len = 0;
4565
4566 SSVAL(*rparam,0,NERR_BufTooSmall);
4567
4568 DEBUG(3,("Supplied buffer too small in API command\n"));
4569
4570 return True;
4571 }
4572
4573 /****************************************************************************
4574 The request is not supported.
4575 ****************************************************************************/
4576
4577 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4578 char *param, int tpscnt,
4579 char *data, int tdscnt,
4580 int mdrcnt, int mprcnt,
4581 char **rdata, char **rparam,
4582 int *rdata_len, int *rparam_len)
4583 {
4584 *rparam_len = 4;
4585 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4586 if (!*rparam) {
4587 return False;
4588 }
4589
4590 *rdata_len = 0;
4591
4592 SSVAL(*rparam,0,NERR_notsupported);
4593 SSVAL(*rparam,2,0); /* converter word */
4594
4595 DEBUG(3,("Unsupported API command\n"));
4596
4597 return True;
4598 }
4599
4600 static const struct {
4601 const char *name;
4602 int id;
4603 bool (*fn)(connection_struct *, uint16,
4604 char *, int,
4605 char *, int,
4606 int,int,char **,char **,int *,int *);
4607 bool auth_user; /* Deny anonymous access? */
4608 } api_commands[] = {
4609 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
4610 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
4611 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
4612 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
4613 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
4614 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
4615 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
4616 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
4617 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
4618 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
4619 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
4620 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
4621 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
4622 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
4623 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
4624 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
4625 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
4626 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
4627 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
4628 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
4629 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
4630 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
4631 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
4632 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
4633 {"NetServerEnum", RAP_NetServerEnum2, api_RNetServerEnum}, /* anon OK */
4634 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4635 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
4636 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
4637 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
4638 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
4639 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4640 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
4641 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4642 {NULL, -1, api_Unsupported}
4643 /* The following RAP calls are not implemented by Samba:
4644
4645 RAP_WFileEnum2 - anon not OK
4646 */
4647 };
4648
4649
4650 /****************************************************************************
4651 Handle remote api calls.
4652 ****************************************************************************/
4653
4654 void api_reply(connection_struct *conn, uint16 vuid,
4655 struct smb_request *req,
4656 char *data, char *params,
4657 int tdscnt, int tpscnt,
4658 int mdrcnt, int mprcnt)
4659 {
4660 int api_command;
4661 char *rdata = NULL;
4662 char *rparam = NULL;
4663 const char *name1 = NULL;
4664 const char *name2 = NULL;
4665 int rdata_len = 0;
4666 int rparam_len = 0;
4667 bool reply=False;
4668 int i;
4669
4670 if (!params) {
4671 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4672 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4673 return;
4674 }
4675
4676 if (tpscnt < 2) {
4677 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4678 return;
4679 }
4680 api_command = SVAL(params,0);
4681 /* Is there a string at position params+2 ? */
4682 if (skip_string(params,tpscnt,params+2)) {
4683 name1 = params + 2;
4684 } else {
4685 name1 = "";
4686 }
4687 name2 = skip_string(params,tpscnt,params+2);
4688 if (!name2) {
4689 name2 = "";
4690 }
4691
4692 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4693 api_command,
4694 name1,
4695 name2,
4696 tdscnt,tpscnt,mdrcnt,mprcnt));
4697
4698 for (i=0;api_commands[i].name;i++) {
4699 if (api_commands[i].id == api_command && api_commands[i].fn) {
4700 DEBUG(3,("Doing %s\n",api_commands[i].name));
4701 break;
4702 }
4703 }
4704
4705 /* Check whether this api call can be done anonymously */
4706
4707 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4708 user_struct *user = get_valid_user_struct(vuid);
4709
4710 if (!user || user->server_info->guest) {
4711 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4712 return;
4713 }
4714 }
4715
4716 rdata = (char *)SMB_MALLOC(1024);
4717 if (rdata) {
4718 memset(rdata,'\0',1024);
4719 }
4720
4721 rparam = (char *)SMB_MALLOC(1024);
4722 if (rparam) {
4723 memset(rparam,'\0',1024);
4724 }
4725
4726 if(!rdata || !rparam) {
4727 DEBUG(0,("api_reply: malloc fail !\n"));
4728 SAFE_FREE(rdata);
4729 SAFE_FREE(rparam);
4730 reply_nterror(req, NT_STATUS_NO_MEMORY);
4731 return;
4732 }
4733
4734 reply = api_commands[i].fn(conn,
4735 vuid,
4736 params,tpscnt, /* params + length */
4737 data,tdscnt, /* data + length */
4738 mdrcnt,mprcnt,
4739 &rdata,&rparam,&rdata_len,&rparam_len);
4740
4741
4742 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4743 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4744 &rdata,&rparam,&rdata_len,&rparam_len);
4745 }
4746
4747 /* if we get False back then it's actually unsupported */
4748 if (!reply) {
4749 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4750 &rdata,&rparam,&rdata_len,&rparam_len);
4751 }
4752
4753 /* If api_Unsupported returns false we can't return anything. */
4754 if (reply) {
4755 send_trans_reply(conn, req, rparam, rparam_len,
4756 rdata, rdata_len, False);
4757 }
4758
4759 SAFE_FREE(rdata);
4760 SAFE_FREE(rparam);
4761 return;
4762 }
Samba GIT mirror