?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
VERSION: Re-enable git snapshots.
[Samba.git] / source3 / smbd / lanman.c
blobd0dae36db2eb5d29324458c4d2de3d542c04515a
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "rpc_client/rpc_client.h"
32 #include "../librpc/gen_ndr/ndr_samr_c.h"
33 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
34 #include "rpc_client/cli_spoolss.h"
35 #include "rpc_client/init_spoolss.h"
36 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
37 #include "../librpc/gen_ndr/rap.h"
38 #include "../lib/util/binsearch.h"
39 #include "../libcli/auth/libcli_auth.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "printing.h"
43 #include "passdb/machine_sid.h"
44 #include "auth.h"
45 #include "rpc_server/rpc_ncacn_np.h"
46
47 #ifdef CHECK_TYPES
48 #undef CHECK_TYPES
49 #endif
50 #define CHECK_TYPES 0
51
52 #define NERR_Success 0
53 #define NERR_badpass 86
54 #define NERR_notsupported 50
55
56 #define NERR_BASE (2100)
57 #define NERR_BufTooSmall (NERR_BASE+23)
58 #define NERR_JobNotFound (NERR_BASE+51)
59 #define NERR_DestNotFound (NERR_BASE+52)
60
61 #define ACCESS_READ 0x01
62 #define ACCESS_WRITE 0x02
63 #define ACCESS_CREATE 0x04
64
65 #define SHPWLEN 8 /* share password length */
66
67 /* Limit size of ipc replies */
68
69 static char *smb_realloc_limit(void *ptr, size_t size)
70 {
71 char *val;
72
73 size = MAX((size),4*1024);
74 val = (char *)SMB_REALLOC(ptr,size);
75 if (val) {
76 memset(val,'\0',size);
77 }
78 return val;
79 }
80
81 static bool api_Unsupported(struct smbd_server_connection *sconn,
82 connection_struct *conn, uint64_t vuid,
83 char *param, int tpscnt,
84 char *data, int tdscnt,
85 int mdrcnt, int mprcnt,
86 char **rdata, char **rparam,
87 int *rdata_len, int *rparam_len);
88
89 static bool api_TooSmall(struct smbd_server_connection *sconn,
90 connection_struct *conn, uint64_t vuid, char *param, char *data,
91 int mdrcnt, int mprcnt,
92 char **rdata, char **rparam,
93 int *rdata_len, int *rparam_len);
94
95
96 static int CopyExpanded(connection_struct *conn,
97 int snum, char **dst, char *src, int *p_space_remaining)
98 {
99 TALLOC_CTX *ctx = talloc_tos();
100 char *buf = NULL;
101 int l;
102
103 if (!src || !dst || !p_space_remaining || !(*dst) ||
104 *p_space_remaining <= 0) {
105 return 0;
106 }
107
108 buf = talloc_strdup(ctx, src);
109 if (!buf) {
110 *p_space_remaining = 0;
111 return 0;
112 }
113 buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, snum));
114 if (!buf) {
115 *p_space_remaining = 0;
116 return 0;
117 }
118 buf = talloc_sub_advanced(ctx,
119 lp_servicename(ctx, SNUM(conn)),
120 conn->session_info->unix_info->unix_name,
121 conn->connectpath,
122 conn->session_info->unix_token->gid,
123 conn->session_info->unix_info->sanitized_username,
124 conn->session_info->info->domain_name,
125 buf);
126 if (!buf) {
127 *p_space_remaining = 0;
128 return 0;
129 }
130 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
131 if (l == 0) {
132 return 0;
133 }
134 (*dst) += l;
135 (*p_space_remaining) -= l;
136 return l;
137 }
138
139 static int CopyAndAdvance(char **dst, char *src, int *n)
140 {
141 int l;
142 if (!src || !dst || !n || !(*dst)) {
143 return 0;
144 }
145 l = push_ascii(*dst,src,*n, STR_TERMINATE);
146 if (l == 0) {
147 return 0;
148 }
149 (*dst) += l;
150 (*n) -= l;
151 return l;
152 }
153
154 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
155 {
156 TALLOC_CTX *ctx = talloc_tos();
157 char *buf = NULL;
158 if (!s) {
159 return 0;
160 }
161 buf = talloc_strdup(ctx,s);
162 if (!buf) {
163 return 0;
164 }
165 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, snum));
166 if (!buf) {
167 return 0;
168 }
169 buf = talloc_sub_advanced(ctx,
170 lp_servicename(ctx, SNUM(conn)),
171 conn->session_info->unix_info->unix_name,
172 conn->connectpath,
173 conn->session_info->unix_token->gid,
174 conn->session_info->unix_info->sanitized_username,
175 conn->session_info->info->domain_name,
176 buf);
177 if (!buf) {
178 return 0;
179 }
180 return strlen(buf) + 1;
181 }
182
183 /*******************************************************************
184 Check a API string for validity when we only need to check the prefix.
185 ******************************************************************/
186
187 static bool prefix_ok(const char *str, const char *prefix)
188 {
189 return(strncmp(str,prefix,strlen(prefix)) == 0);
190 }
191
192 struct pack_desc {
193 const char *format; /* formatstring for structure */
194 const char *subformat; /* subformat for structure */
195 char *base; /* baseaddress of buffer */
196 int buflen; /* remaining size for fixed part; on init: length of base */
197 int subcount; /* count of substructures */
198 char *structbuf; /* pointer into buffer for remaining fixed part */
199 int stringlen; /* remaining size for variable part */
200 char *stringbuf; /* pointer into buffer for remaining variable part */
201 int neededlen; /* total needed size */
202 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
203 const char *curpos; /* current position; pointer into format or subformat */
204 int errcode;
205 };
206
207 static int get_counter(const char **p)
208 {
209 int i, n;
210 if (!p || !(*p)) {
211 return 1;
212 }
213 if (!isdigit((int)**p)) {
214 return 1;
215 }
216 for (n = 0;;) {
217 i = **p;
218 if (isdigit(i)) {
219 n = 10 * n + (i - '0');
220 } else {
221 return n;
222 }
223 (*p)++;
224 }
225 }
226
227 static int getlen(const char *p)
228 {
229 int n = 0;
230 if (!p) {
231 return 0;
232 }
233
234 while (*p) {
235 switch( *p++ ) {
236 case 'W': /* word (2 byte) */
237 n += 2;
238 break;
239 case 'K': /* status word? (2 byte) */
240 n += 2;
241 break;
242 case 'N': /* count of substructures (word) at end */
243 n += 2;
244 break;
245 case 'D': /* double word (4 byte) */
246 case 'z': /* offset to zero terminated string (4 byte) */
247 case 'l': /* offset to user data (4 byte) */
248 n += 4;
249 break;
250 case 'b': /* offset to data (with counter) (4 byte) */
251 n += 4;
252 get_counter(&p);
253 break;
254 case 'B': /* byte (with optional counter) */
255 n += get_counter(&p);
256 break;
257 }
258 }
259 return n;
260 }
261
262 static bool init_package(struct pack_desc *p, int count, int subcount)
263 {
264 int n = p->buflen;
265 int i;
266
267 if (!p->format || !p->base) {
268 return False;
269 }
270
271 i = count * getlen(p->format);
272 if (p->subformat) {
273 i += subcount * getlen(p->subformat);
274 }
275 p->structbuf = p->base;
276 p->neededlen = 0;
277 p->usedlen = 0;
278 p->subcount = 0;
279 p->curpos = p->format;
280 if (i > n) {
281 p->neededlen = i;
282 i = n = 0;
283 #if 0
284 /*
285 * This is the old error code we used. Aparently
286 * WinNT/2k systems return ERRbuftoosmall (2123) and
287 * OS/2 needs this. I'm leaving this here so we can revert
288 * if needed. JRA.
289 */
290 p->errcode = ERRmoredata;
291 #else
292 p->errcode = ERRbuftoosmall;
293 #endif
294 } else {
295 p->errcode = NERR_Success;
296 }
297 p->buflen = i;
298 n -= i;
299 p->stringbuf = p->base + i;
300 p->stringlen = n;
301 return (p->errcode == NERR_Success);
302 }
303
304 static int package(struct pack_desc *p, ...)
305 {
306 va_list args;
307 int needed=0, stringneeded;
308 const char *str=NULL;
309 int is_string=0, stringused;
310 int32 temp;
311
312 va_start(args,p);
313
314 if (!*p->curpos) {
315 if (!p->subcount) {
316 p->curpos = p->format;
317 } else {
318 p->curpos = p->subformat;
319 p->subcount--;
320 }
321 }
322 #if CHECK_TYPES
323 str = va_arg(args,char*);
324 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
325 #endif
326 stringneeded = -1;
327
328 if (!p->curpos) {
329 va_end(args);
330 return 0;
331 }
332
333 switch( *p->curpos++ ) {
334 case 'W': /* word (2 byte) */
335 needed = 2;
336 temp = va_arg(args,int);
337 if (p->buflen >= needed) {
338 SSVAL(p->structbuf,0,temp);
339 }
340 break;
341 case 'K': /* status word? (2 byte) */
342 needed = 2;
343 temp = va_arg(args,int);
344 if (p->buflen >= needed) {
345 SSVAL(p->structbuf,0,temp);
346 }
347 break;
348 case 'N': /* count of substructures (word) at end */
349 needed = 2;
350 p->subcount = va_arg(args,int);
351 if (p->buflen >= needed) {
352 SSVAL(p->structbuf,0,p->subcount);
353 }
354 break;
355 case 'D': /* double word (4 byte) */
356 needed = 4;
357 temp = va_arg(args,int);
358 if (p->buflen >= needed) {
359 SIVAL(p->structbuf,0,temp);
360 }
361 break;
362 case 'B': /* byte (with optional counter) */
363 needed = get_counter(&p->curpos);
364 {
365 char *s = va_arg(args,char*);
366 if (p->buflen >= needed) {
367 StrnCpy(p->structbuf,s?s:"",needed-1);
368 }
369 }
370 break;
371 case 'z': /* offset to zero terminated string (4 byte) */
372 str = va_arg(args,char*);
373 stringneeded = (str ? strlen(str)+1 : 0);
374 is_string = 1;
375 break;
376 case 'l': /* offset to user data (4 byte) */
377 str = va_arg(args,char*);
378 stringneeded = va_arg(args,int);
379 is_string = 0;
380 break;
381 case 'b': /* offset to data (with counter) (4 byte) */
382 str = va_arg(args,char*);
383 stringneeded = get_counter(&p->curpos);
384 is_string = 0;
385 break;
386 }
387
388 va_end(args);
389 if (stringneeded >= 0) {
390 needed = 4;
391 if (p->buflen >= needed) {
392 stringused = stringneeded;
393 if (stringused > p->stringlen) {
394 stringused = (is_string ? p->stringlen : 0);
395 if (p->errcode == NERR_Success) {
396 p->errcode = ERRmoredata;
397 }
398 }
399 if (!stringused) {
400 SIVAL(p->structbuf,0,0);
401 } else {
402 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
403 memcpy(p->stringbuf,str?str:"",stringused);
404 if (is_string) {
405 p->stringbuf[stringused-1] = '\0';
406 }
407 p->stringbuf += stringused;
408 p->stringlen -= stringused;
409 p->usedlen += stringused;
410 }
411 }
412 p->neededlen += stringneeded;
413 }
414
415 p->neededlen += needed;
416 if (p->buflen >= needed) {
417 p->structbuf += needed;
418 p->buflen -= needed;
419 p->usedlen += needed;
420 } else {
421 if (p->errcode == NERR_Success) {
422 p->errcode = ERRmoredata;
423 }
424 }
425 return 1;
426 }
427
428 #if CHECK_TYPES
429 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
430 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
431 #else
432 #define PACK(desc,t,v) package(desc,v)
433 #define PACKl(desc,t,v,l) package(desc,v,l)
434 #endif
435
436 static void PACKI(struct pack_desc* desc, const char *t,int v)
437 {
438 PACK(desc,t,v);
439 }
440
441 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
442 {
443 PACK(desc,t,v);
444 }
445
446 /****************************************************************************
447 Get a print queue.
448 ****************************************************************************/
449
450 static void PackDriverData(struct pack_desc* desc)
451 {
452 char drivdata[4+4+32];
453 SIVAL(drivdata,0,sizeof drivdata); /* cb */
454 SIVAL(drivdata,4,1000); /* lVersion */
455 memset(drivdata+8,0,32); /* szDeviceName */
456 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
457 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
458 }
459
460 static int check_printq_info(struct pack_desc* desc,
461 unsigned int uLevel, char *id1, char *id2)
462 {
463 desc->subformat = NULL;
464 switch( uLevel ) {
465 case 0:
466 desc->format = "B13";
467 break;
468 case 1:
469 desc->format = "B13BWWWzzzzzWW";
470 break;
471 case 2:
472 desc->format = "B13BWWWzzzzzWN";
473 desc->subformat = "WB21BB16B10zWWzDDz";
474 break;
475 case 3:
476 desc->format = "zWWWWzzzzWWzzl";
477 break;
478 case 4:
479 desc->format = "zWWWWzzzzWNzzl";
480 desc->subformat = "WWzWWDDzz";
481 break;
482 case 5:
483 desc->format = "z";
484 break;
485 case 51:
486 desc->format = "K";
487 break;
488 case 52:
489 desc->format = "WzzzzzzzzN";
490 desc->subformat = "z";
491 break;
492 default:
493 DEBUG(0,("check_printq_info: invalid level %d\n",
494 uLevel ));
495 return False;
496 }
497 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
498 DEBUG(0,("check_printq_info: invalid format %s\n",
499 id1 ? id1 : "<NULL>" ));
500 return False;
501 }
502 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
503 DEBUG(0,("check_printq_info: invalid subformat %s\n",
504 id2 ? id2 : "<NULL>" ));
505 return False;
506 }
507 return True;
508 }
509
510
511 #define RAP_JOB_STATUS_QUEUED 0
512 #define RAP_JOB_STATUS_PAUSED 1
513 #define RAP_JOB_STATUS_SPOOLING 2
514 #define RAP_JOB_STATUS_PRINTING 3
515 #define RAP_JOB_STATUS_PRINTED 4
516
517 #define RAP_QUEUE_STATUS_PAUSED 1
518 #define RAP_QUEUE_STATUS_ERROR 2
519
520 /* turn a print job status into a on the wire status
521 */
522 static int printj_spoolss_status(int v)
523 {
524 if (v == JOB_STATUS_QUEUED)
525 return RAP_JOB_STATUS_QUEUED;
526 if (v & JOB_STATUS_PAUSED)
527 return RAP_JOB_STATUS_PAUSED;
528 if (v & JOB_STATUS_SPOOLING)
529 return RAP_JOB_STATUS_SPOOLING;
530 if (v & JOB_STATUS_PRINTING)
531 return RAP_JOB_STATUS_PRINTING;
532 return 0;
533 }
534
535 /* turn a print queue status into a on the wire status
536 */
537 static int printq_spoolss_status(int v)
538 {
539 if (v == PRINTER_STATUS_OK)
540 return 0;
541 if (v & PRINTER_STATUS_PAUSED)
542 return RAP_QUEUE_STATUS_PAUSED;
543 return RAP_QUEUE_STATUS_ERROR;
544 }
545
546 static void fill_spoolss_printjob_info(int uLevel,
547 struct pack_desc *desc,
548 struct spoolss_JobInfo2 *info2,
549 int n)
550 {
551 time_t t = spoolss_Time_to_time_t(&info2->submitted);
552
553 /* the client expects localtime */
554 t -= get_time_zone(t);
555
556 PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
557 if (uLevel == 1) {
558 PACKS(desc,"B21", info2->user_name); /* szUserName */
559 PACKS(desc,"B",""); /* pad */
560 PACKS(desc,"B16",""); /* szNotifyName */
561 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
562 PACKS(desc,"z",""); /* pszParms */
563 PACKI(desc,"W",n+1); /* uPosition */
564 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
565 PACKS(desc,"z",""); /* pszStatus */
566 PACKI(desc,"D", t); /* ulSubmitted */
567 PACKI(desc,"D", info2->size); /* ulSize */
568 PACKS(desc,"z", info2->document_name); /* pszComment */
569 }
570 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
571 PACKI(desc,"W", info2->priority); /* uPriority */
572 PACKS(desc,"z", info2->user_name); /* pszUserName */
573 PACKI(desc,"W",n+1); /* uPosition */
574 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
575 PACKI(desc,"D",t); /* ulSubmitted */
576 PACKI(desc,"D", info2->size); /* ulSize */
577 PACKS(desc,"z","Samba"); /* pszComment */
578 PACKS(desc,"z", info2->document_name); /* pszDocument */
579 if (uLevel == 3) {
580 PACKS(desc,"z",""); /* pszNotifyName */
581 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
582 PACKS(desc,"z",""); /* pszParms */
583 PACKS(desc,"z",""); /* pszStatus */
584 PACKS(desc,"z", info2->printer_name); /* pszQueue */
585 PACKS(desc,"z","lpd"); /* pszQProcName */
586 PACKS(desc,"z",""); /* pszQProcParms */
587 PACKS(desc,"z","NULL"); /* pszDriverName */
588 PackDriverData(desc); /* pDriverData */
589 PACKS(desc,"z",""); /* pszPrinterName */
590 } else if (uLevel == 4) { /* OS2 */
591 PACKS(desc,"z",""); /* pszSpoolFileName */
592 PACKS(desc,"z",""); /* pszPortName */
593 PACKS(desc,"z",""); /* pszStatus */
594 PACKI(desc,"D",0); /* ulPagesSpooled */
595 PACKI(desc,"D",0); /* ulPagesSent */
596 PACKI(desc,"D",0); /* ulPagesPrinted */
597 PACKI(desc,"D",0); /* ulTimePrinted */
598 PACKI(desc,"D",0); /* ulExtendJobStatus */
599 PACKI(desc,"D",0); /* ulStartPage */
600 PACKI(desc,"D",0); /* ulEndPage */
601 }
602 }
603 }
604
605 /********************************************************************
606 Respond to the DosPrintQInfo command with a level of 52
607 This is used to get printer driver information for Win9x clients
608 ********************************************************************/
609 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
610 struct pack_desc* desc, int count,
611 const char *printer_name)
612 {
613 int i;
614 fstring location;
615 trim_string(discard_const_p(char, driver->driver_path), "\\print$\\WIN40\\0\\", 0);
616 trim_string(discard_const_p(char, driver->data_file), "\\print$\\WIN40\\0\\", 0);
617 trim_string(discard_const_p(char, driver->help_file), "\\print$\\WIN40\\0\\", 0);
618
619 PACKI(desc, "W", 0x0400); /* don't know */
620 PACKS(desc, "z", driver->driver_name); /* long printer name */
621 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
622 PACKS(desc, "z", driver->data_file); /* Datafile name */
623 PACKS(desc, "z", driver->monitor_name); /* language monitor */
624
625 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
626 standard_sub_basic( "", "", location, sizeof(location)-1 );
627 PACKS(desc,"z", location); /* share to retrieve files */
628
629 PACKS(desc,"z", driver->default_datatype); /* default data type */
630 PACKS(desc,"z", driver->help_file); /* helpfile name */
631 PACKS(desc,"z", driver->driver_path); /* driver name */
632
633 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
634 DEBUG(3,("Driver: %s:\n",driver->driver_path));
635 DEBUG(3,("Data File: %s:\n",driver->data_file));
636 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
637 DEBUG(3,("Driver Location: %s:\n",location));
638 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
639 DEBUG(3,("Help File: %s:\n",driver->help_file));
640 PACKI(desc,"N",count); /* number of files to copy */
641
642 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
643 {
644 trim_string(discard_const_p(char, driver->dependent_files[i]), "\\print$\\WIN40\\0\\", 0);
645 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
646 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
647 }
648
649 /* sanity check */
650 if ( i != count )
651 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
652 count, i));
653
654 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
655
656 desc->errcode=NERR_Success;
657
658 }
659
660 static const char *strip_unc(const char *unc)
661 {
662 char *p;
663
664 if (unc == NULL) {
665 return NULL;
666 }
667
668 if ((p = strrchr(unc, '\\')) != NULL) {
669 return p+1;
670 }
671
672 return unc;
673 }
674
675 static void fill_printq_info(int uLevel,
676 struct pack_desc* desc,
677 int count,
678 union spoolss_JobInfo *job_info,
679 struct spoolss_DriverInfo3 *driver_info,
680 struct spoolss_PrinterInfo2 *printer_info)
681 {
682 switch (uLevel) {
683 case 0:
684 case 1:
685 case 2:
686 PACKS(desc,"B13", strip_unc(printer_info->printername));
687 break;
688 case 3:
689 case 4:
690 case 5:
691 PACKS(desc,"z", strip_unc(printer_info->printername));
692 break;
693 case 51:
694 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
695 break;
696 }
697
698 if (uLevel == 1 || uLevel == 2) {
699 PACKS(desc,"B",""); /* alignment */
700 PACKI(desc,"W",5); /* priority */
701 PACKI(desc,"W",0); /* start time */
702 PACKI(desc,"W",0); /* until time */
703 PACKS(desc,"z",""); /* pSepFile */
704 PACKS(desc,"z","lpd"); /* pPrProc */
705 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
706 PACKS(desc,"z",""); /* pParms */
707 if (printer_info->printername == NULL) {
708 PACKS(desc,"z","UNKNOWN PRINTER");
709 PACKI(desc,"W",LPSTAT_ERROR);
710 } else {
711 PACKS(desc,"z", printer_info->comment);
712 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
713 }
714 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
715 }
716
717 if (uLevel == 3 || uLevel == 4) {
718 PACKI(desc,"W",5); /* uPriority */
719 PACKI(desc,"W",0); /* uStarttime */
720 PACKI(desc,"W",0); /* uUntiltime */
721 PACKI(desc,"W",5); /* pad1 */
722 PACKS(desc,"z",""); /* pszSepFile */
723 PACKS(desc,"z","WinPrint"); /* pszPrProc */
724 PACKS(desc,"z",NULL); /* pszParms */
725 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
726 /* "don't ask" that it's done this way to fix corrupted
727 Win9X/ME printer comments. */
728 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
729 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
730 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
731 PACKS(desc,"z", printer_info->drivername); /* pszDriverName */
732 PackDriverData(desc); /* pDriverData */
733 }
734
735 if (uLevel == 2 || uLevel == 4) {
736 int i;
737 for (i = 0; i < count; i++) {
738 fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
739 }
740 }
741
742 if (uLevel==52)
743 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
744 }
745
746 /* This function returns the number of files for a given driver */
747 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
748 {
749 int result = 0;
750
751 /* count the number of files */
752 while (driver->dependent_files && *driver->dependent_files[result])
753 result++;
754
755 return result;
756 }
757
758 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
759 connection_struct *conn, uint64_t vuid,
760 char *param, int tpscnt,
761 char *data, int tdscnt,
762 int mdrcnt,int mprcnt,
763 char **rdata,char **rparam,
764 int *rdata_len,int *rparam_len)
765 {
766 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
767 char *str2 = skip_string(param,tpscnt,str1);
768 char *p = skip_string(param,tpscnt,str2);
769 char *QueueName = p;
770 unsigned int uLevel;
771 uint32_t count = 0;
772 char *str3;
773 struct pack_desc desc;
774 char* tmpdata=NULL;
775
776 WERROR werr = WERR_OK;
777 TALLOC_CTX *mem_ctx = talloc_tos();
778 NTSTATUS status;
779 struct rpc_pipe_client *cli = NULL;
780 struct dcerpc_binding_handle *b = NULL;
781 struct policy_handle handle;
782 struct spoolss_DevmodeContainer devmode_ctr;
783 union spoolss_DriverInfo driver_info;
784 union spoolss_JobInfo *job_info = NULL;
785 union spoolss_PrinterInfo printer_info;
786
787 if (!str1 || !str2 || !p) {
788 return False;
789 }
790 memset((char *)&desc,'\0',sizeof(desc));
791
792 p = skip_string(param,tpscnt,p);
793 if (!p) {
794 return False;
795 }
796 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
797 str3 = get_safe_str_ptr(param,tpscnt,p,4);
798 /* str3 may be null here and is checked in check_printq_info(). */
799
800 /* remove any trailing username */
801 if ((p = strchr_m(QueueName,'%')))
802 *p = 0;
803
804 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
805
806 /* check it's a supported varient */
807 if (!prefix_ok(str1,"zWrLh"))
808 return False;
809 if (!check_printq_info(&desc,uLevel,str2,str3)) {
810 /*
811 * Patch from Scott Moomaw <scott@bridgewater.edu>
812 * to return the 'invalid info level' error if an
813 * unknown level was requested.
814 */
815 *rdata_len = 0;
816 *rparam_len = 6;
817 *rparam = smb_realloc_limit(*rparam,*rparam_len);
818 if (!*rparam) {
819 return False;
820 }
821 SSVALS(*rparam,0,ERRunknownlevel);
822 SSVAL(*rparam,2,0);
823 SSVAL(*rparam,4,0);
824 return(True);
825 }
826
827 ZERO_STRUCT(handle);
828
829 if (QueueName == NULL || (strlen(QueueName) < 1)) {
830 desc.errcode = W_ERROR_V(WERR_INVALID_PARAM);
831 goto out;
832 }
833
834 status = rpc_pipe_open_interface(conn,
835 &ndr_table_spoolss.syntax_id,
836 conn->session_info,
837 conn->sconn->remote_address,
838 conn->sconn->msg_ctx,
839 &cli);
840 if (!NT_STATUS_IS_OK(status)) {
841 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
842 nt_errstr(status)));
843 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
844 goto out;
845 }
846 b = cli->binding_handle;
847
848 ZERO_STRUCT(devmode_ctr);
849
850 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
851 QueueName,
852 "RAW",
853 devmode_ctr,
854 PRINTER_ACCESS_USE,
855 &handle,
856 &werr);
857 if (!NT_STATUS_IS_OK(status)) {
858 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
859 goto out;
860 }
861 if (!W_ERROR_IS_OK(werr)) {
862 desc.errcode = W_ERROR_V(werr);
863 goto out;
864 }
865
866 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
867 &handle,
868 2,
869 0,
870 &printer_info);
871 if (!W_ERROR_IS_OK(werr)) {
872 desc.errcode = W_ERROR_V(werr);
873 goto out;
874 }
875
876 if (uLevel==52) {
877 uint32_t server_major_version;
878 uint32_t server_minor_version;
879
880 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
881 &handle,
882 "Windows 4.0",
883 3, /* level */
884 0,
885 0, /* version */
886 0,
887 &driver_info,
888 &server_major_version,
889 &server_minor_version);
890 if (!W_ERROR_IS_OK(werr)) {
891 desc.errcode = W_ERROR_V(werr);
892 goto out;
893 }
894
895 count = get_printerdrivernumber(&driver_info.info3);
896 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
897 } else {
898 uint32_t num_jobs;
899 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
900 &handle,
901 0, /* firstjob */
902 0xff, /* numjobs */
903 2, /* level */
904 0, /* offered */
905 &num_jobs,
906 &job_info);
907 if (!W_ERROR_IS_OK(werr)) {
908 desc.errcode = W_ERROR_V(werr);
909 goto out;
910 }
911
912 count = num_jobs;
913 }
914
915 if (mdrcnt > 0) {
916 *rdata = smb_realloc_limit(*rdata,mdrcnt);
917 if (!*rdata) {
918 return False;
919 }
920 desc.base = *rdata;
921 desc.buflen = mdrcnt;
922 } else {
923 /*
924 * Don't return data but need to get correct length
925 * init_package will return wrong size if buflen=0
926 */
927 desc.buflen = getlen(desc.format);
928 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
929 }
930
931 if (init_package(&desc,1,count)) {
932 desc.subcount = count;
933 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
934 }
935
936 *rdata_len = desc.usedlen;
937
938 /*
939 * We must set the return code to ERRbuftoosmall
940 * in order to support lanman style printing with Win NT/2k
941 * clients --jerry
942 */
943 if (!mdrcnt && lp_disable_spoolss())
944 desc.errcode = ERRbuftoosmall;
945
946 out:
947 if (b && is_valid_policy_hnd(&handle)) {
948 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
949 }
950
951 *rdata_len = desc.usedlen;
952 *rparam_len = 6;
953 *rparam = smb_realloc_limit(*rparam,*rparam_len);
954 if (!*rparam) {
955 SAFE_FREE(tmpdata);
956 return False;
957 }
958 SSVALS(*rparam,0,desc.errcode);
959 SSVAL(*rparam,2,0);
960 SSVAL(*rparam,4,desc.neededlen);
961
962 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
963
964 SAFE_FREE(tmpdata);
965
966 return(True);
967 }
968
969 /****************************************************************************
970 View list of all print jobs on all queues.
971 ****************************************************************************/
972
973 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
974 connection_struct *conn, uint64_t vuid,
975 char *param, int tpscnt,
976 char *data, int tdscnt,
977 int mdrcnt, int mprcnt,
978 char **rdata, char** rparam,
979 int *rdata_len, int *rparam_len)
980 {
981 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
982 char *output_format1 = skip_string(param,tpscnt,param_format);
983 char *p = skip_string(param,tpscnt,output_format1);
984 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
985 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
986 int i;
987 struct pack_desc desc;
988 int *subcntarr = NULL;
989 int queuecnt = 0, subcnt = 0, succnt = 0;
990
991 WERROR werr = WERR_OK;
992 TALLOC_CTX *mem_ctx = talloc_tos();
993 NTSTATUS status;
994 struct rpc_pipe_client *cli = NULL;
995 struct dcerpc_binding_handle *b = NULL;
996 struct spoolss_DevmodeContainer devmode_ctr;
997 uint32_t num_printers;
998 union spoolss_PrinterInfo *printer_info;
999 union spoolss_DriverInfo *driver_info;
1000 union spoolss_JobInfo **job_info;
1001
1002 if (!param_format || !output_format1 || !p) {
1003 return False;
1004 }
1005
1006 memset((char *)&desc,'\0',sizeof(desc));
1007
1008 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1009
1010 if (!prefix_ok(param_format,"WrLeh")) {
1011 return False;
1012 }
1013 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1014 /*
1015 * Patch from Scott Moomaw <scott@bridgewater.edu>
1016 * to return the 'invalid info level' error if an
1017 * unknown level was requested.
1018 */
1019 *rdata_len = 0;
1020 *rparam_len = 6;
1021 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1022 if (!*rparam) {
1023 return False;
1024 }
1025 SSVALS(*rparam,0,ERRunknownlevel);
1026 SSVAL(*rparam,2,0);
1027 SSVAL(*rparam,4,0);
1028 return(True);
1029 }
1030
1031 status = rpc_pipe_open_interface(conn,
1032 &ndr_table_spoolss.syntax_id,
1033 conn->session_info,
1034 conn->sconn->remote_address,
1035 conn->sconn->msg_ctx,
1036 &cli);
1037 if (!NT_STATUS_IS_OK(status)) {
1038 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1039 nt_errstr(status)));
1040 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1041 goto out;
1042 }
1043 b = cli->binding_handle;
1044
1045 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1046 PRINTER_ENUM_LOCAL,
1047 cli->srv_name_slash,
1048 2,
1049 0,
1050 &num_printers,
1051 &printer_info);
1052 if (!W_ERROR_IS_OK(werr)) {
1053 desc.errcode = W_ERROR_V(werr);
1054 goto out;
1055 }
1056
1057 queuecnt = num_printers;
1058
1059 job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1060 if (job_info == NULL) {
1061 goto err;
1062 }
1063
1064 driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1065 if (driver_info == NULL) {
1066 goto err;
1067 }
1068
1069 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1070 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1071 goto err;
1072 }
1073
1074 if (mdrcnt > 0) {
1075 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1076 if (!*rdata) {
1077 goto err;
1078 }
1079 }
1080 desc.base = *rdata;
1081 desc.buflen = mdrcnt;
1082
1083 subcnt = 0;
1084 for (i = 0; i < num_printers; i++) {
1085
1086 uint32_t num_jobs;
1087 struct policy_handle handle;
1088 const char *printername;
1089
1090 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1091 if (printername == NULL) {
1092 goto err;
1093 }
1094
1095 ZERO_STRUCT(handle);
1096 ZERO_STRUCT(devmode_ctr);
1097
1098 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1099 printername,
1100 "RAW",
1101 devmode_ctr,
1102 PRINTER_ACCESS_USE,
1103 &handle,
1104 &werr);
1105 if (!NT_STATUS_IS_OK(status)) {
1106 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1107 goto out;
1108 }
1109 if (!W_ERROR_IS_OK(werr)) {
1110 desc.errcode = W_ERROR_V(werr);
1111 goto out;
1112 }
1113
1114 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1115 &handle,
1116 0, /* firstjob */
1117 0xff, /* numjobs */
1118 2, /* level */
1119 0, /* offered */
1120 &num_jobs,
1121 &job_info[i]);
1122 if (!W_ERROR_IS_OK(werr)) {
1123 desc.errcode = W_ERROR_V(werr);
1124 goto out;
1125 }
1126
1127 if (uLevel==52) {
1128 uint32_t server_major_version;
1129 uint32_t server_minor_version;
1130
1131 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1132 &handle,
1133 "Windows 4.0",
1134 3, /* level */
1135 0,
1136 0, /* version */
1137 0,
1138 &driver_info[i],
1139 &server_major_version,
1140 &server_minor_version);
1141 if (!W_ERROR_IS_OK(werr)) {
1142 desc.errcode = W_ERROR_V(werr);
1143 goto out;
1144 }
1145 }
1146
1147 subcntarr[i] = num_jobs;
1148 subcnt += subcntarr[i];
1149
1150 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1151 }
1152
1153 if (init_package(&desc,queuecnt,subcnt)) {
1154 for (i = 0; i < num_printers; i++) {
1155 fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1156 if (desc.errcode == NERR_Success) {
1157 succnt = i;
1158 }
1159 }
1160 }
1161
1162 out:
1163 SAFE_FREE(subcntarr);
1164 *rdata_len = desc.usedlen;
1165 *rparam_len = 8;
1166 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1167 if (!*rparam) {
1168 goto err;
1169 }
1170 SSVALS(*rparam,0,desc.errcode);
1171 SSVAL(*rparam,2,0);
1172 SSVAL(*rparam,4,succnt);
1173 SSVAL(*rparam,6,queuecnt);
1174
1175 return True;
1176
1177 err:
1178
1179 SAFE_FREE(subcntarr);
1180
1181 return False;
1182 }
1183
1184 /****************************************************************************
1185 Get info level for a server list query.
1186 ****************************************************************************/
1187
1188 static bool check_session_info(int uLevel, char* id)
1189 {
1190 switch( uLevel ) {
1191 case 0:
1192 if (strcmp(id,"B16") != 0) {
1193 return False;
1194 }
1195 break;
1196 case 1:
1197 if (strcmp(id,"B16BBDz") != 0) {
1198 return False;
1199 }
1200 break;
1201 default:
1202 return False;
1203 }
1204 return True;
1205 }
1206
1207 struct srv_info_struct {
1208 fstring name;
1209 uint32 type;
1210 fstring comment;
1211 fstring domain;
1212 bool server_added;
1213 };
1214
1215 /*******************************************************************
1216 Get server info lists from the files saved by nmbd. Return the
1217 number of entries.
1218 ******************************************************************/
1219
1220 static int get_session_info(uint32 servertype,
1221 struct srv_info_struct **servers,
1222 const char *domain)
1223 {
1224 int count=0;
1225 int alloced=0;
1226 char **lines;
1227 bool local_list_only;
1228 int i;
1229
1230 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1231 if (!lines) {
1232 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1233 return 0;
1234 }
1235
1236 /* request for everything is code for request all servers */
1237 if (servertype == SV_TYPE_ALL) {
1238 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1239 }
1240
1241 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1242
1243 DEBUG(4,("Servertype search: %8x\n",servertype));
1244
1245 for (i=0;lines[i];i++) {
1246 fstring stype;
1247 struct srv_info_struct *s;
1248 const char *ptr = lines[i];
1249 bool ok = True;
1250 TALLOC_CTX *frame = NULL;
1251 char *p;
1252
1253 if (!*ptr) {
1254 continue;
1255 }
1256
1257 if (count == alloced) {
1258 alloced += 10;
1259 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1260 if (!*servers) {
1261 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1262 TALLOC_FREE(lines);
1263 return 0;
1264 }
1265 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1266 }
1267 s = &(*servers)[count];
1268
1269 frame = talloc_stackframe();
1270 s->name[0] = '\0';
1271 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1272 TALLOC_FREE(frame);
1273 continue;
1274 }
1275 fstrcpy(s->name, p);
1276
1277 stype[0] = '\0';
1278 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1279 TALLOC_FREE(frame);
1280 continue;
1281 }
1282 fstrcpy(stype, p);
1283
1284 s->comment[0] = '\0';
1285 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1286 TALLOC_FREE(frame);
1287 continue;
1288 }
1289 fstrcpy(s->comment, p);
1290 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1291
1292 s->domain[0] = '\0';
1293 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1294 /* this allows us to cope with an old nmbd */
1295 fstrcpy(s->domain,lp_workgroup());
1296 } else {
1297 fstrcpy(s->domain, p);
1298 }
1299 TALLOC_FREE(frame);
1300
1301 if (sscanf(stype,"%X",&s->type) != 1) {
1302 DEBUG(4,("r:host file "));
1303 ok = False;
1304 }
1305
1306 /* Filter the servers/domains we return based on what was asked for. */
1307
1308 /* Check to see if we are being asked for a local list only. */
1309 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1310 DEBUG(4,("r: local list only"));
1311 ok = False;
1312 }
1313
1314 /* doesn't match up: don't want it */
1315 if (!(servertype & s->type)) {
1316 DEBUG(4,("r:serv type "));
1317 ok = False;
1318 }
1319
1320 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1321 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1322 DEBUG(4,("s: dom mismatch "));
1323 ok = False;
1324 }
1325
1326 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1327 ok = False;
1328 }
1329
1330 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1331 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1332
1333 if (ok) {
1334 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1335 s->name, s->type, s->comment, s->domain));
1336 s->server_added = True;
1337 count++;
1338 } else {
1339 DEBUG(4,("%20s %8x %25s %15s\n",
1340 s->name, s->type, s->comment, s->domain));
1341 }
1342 }
1343
1344 TALLOC_FREE(lines);
1345 return count;
1346 }
1347
1348 /*******************************************************************
1349 Fill in a server info structure.
1350 ******************************************************************/
1351
1352 static int fill_srv_info(struct srv_info_struct *service,
1353 int uLevel, char **buf, int *buflen,
1354 char **stringbuf, int *stringspace, char *baseaddr)
1355 {
1356 int struct_len;
1357 char* p;
1358 char* p2;
1359 int l2;
1360 int len;
1361
1362 switch (uLevel) {
1363 case 0:
1364 struct_len = 16;
1365 break;
1366 case 1:
1367 struct_len = 26;
1368 break;
1369 default:
1370 return -1;
1371 }
1372
1373 if (!buf) {
1374 len = 0;
1375 switch (uLevel) {
1376 case 1:
1377 len = strlen(service->comment)+1;
1378 break;
1379 }
1380
1381 *buflen = struct_len;
1382 *stringspace = len;
1383 return struct_len + len;
1384 }
1385
1386 len = struct_len;
1387 p = *buf;
1388 if (*buflen < struct_len) {
1389 return -1;
1390 }
1391 if (stringbuf) {
1392 p2 = *stringbuf;
1393 l2 = *stringspace;
1394 } else {
1395 p2 = p + struct_len;
1396 l2 = *buflen - struct_len;
1397 }
1398 if (!baseaddr) {
1399 baseaddr = p;
1400 }
1401
1402 switch (uLevel) {
1403 case 0:
1404 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1405 break;
1406
1407 case 1:
1408 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1409 SIVAL(p,18,service->type);
1410 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1411 len += CopyAndAdvance(&p2,service->comment,&l2);
1412 break;
1413 }
1414
1415 if (stringbuf) {
1416 *buf = p + struct_len;
1417 *buflen -= struct_len;
1418 *stringbuf = p2;
1419 *stringspace = l2;
1420 } else {
1421 *buf = p2;
1422 *buflen -= len;
1423 }
1424 return len;
1425 }
1426
1427
1428 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1429 {
1430 return strcasecmp_m(s1->name,s2->name);
1431 }
1432
1433 /****************************************************************************
1434 View list of servers available (or possibly domains). The info is
1435 extracted from lists saved by nmbd on the local host.
1436 ****************************************************************************/
1437
1438 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1439 connection_struct *conn, uint64_t vuid,
1440 char *param, int tpscnt,
1441 char *data, int tdscnt,
1442 int mdrcnt, int mprcnt, char **rdata,
1443 char **rparam, int *rdata_len, int *rparam_len)
1444 {
1445 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1446 char *str2 = skip_string(param,tpscnt,str1);
1447 char *p = skip_string(param,tpscnt,str2);
1448 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1449 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1450 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1451 char *p2;
1452 int data_len, fixed_len, string_len;
1453 int f_len = 0, s_len = 0;
1454 struct srv_info_struct *servers=NULL;
1455 int counted=0,total=0;
1456 int i,missed;
1457 fstring domain;
1458 bool domain_request;
1459 bool local_request;
1460
1461 if (!str1 || !str2 || !p) {
1462 return False;
1463 }
1464
1465 /* If someone sets all the bits they don't really mean to set
1466 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1467 known servers. */
1468
1469 if (servertype == SV_TYPE_ALL) {
1470 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1471 }
1472
1473 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1474 any other bit (they may just set this bit on its own) they
1475 want all the locally seen servers. However this bit can be
1476 set on its own so set the requested servers to be
1477 ALL - DOMAIN_ENUM. */
1478
1479 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1480 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1481 }
1482
1483 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1484 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1485
1486 p += 8;
1487
1488 if (!prefix_ok(str1,"WrLehD")) {
1489 return False;
1490 }
1491 if (!check_session_info(uLevel,str2)) {
1492 return False;
1493 }
1494
1495 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1496 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1497 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1498
1499 if (strcmp(str1, "WrLehDz") == 0) {
1500 if (skip_string(param,tpscnt,p) == NULL) {
1501 return False;
1502 }
1503 pull_ascii_fstring(domain, p);
1504 } else {
1505 fstrcpy(domain, lp_workgroup());
1506 }
1507
1508 DEBUG(4, ("domain [%s]\n", domain));
1509
1510 if (lp_browse_list()) {
1511 total = get_session_info(servertype,&servers,domain);
1512 }
1513
1514 data_len = fixed_len = string_len = 0;
1515 missed = 0;
1516
1517 TYPESAFE_QSORT(servers, total, srv_comp);
1518
1519 {
1520 char *lastname=NULL;
1521
1522 for (i=0;i<total;i++) {
1523 struct srv_info_struct *s = &servers[i];
1524
1525 if (lastname && strequal(lastname,s->name)) {
1526 continue;
1527 }
1528 lastname = s->name;
1529 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1530 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1531 i, s->name, s->type, s->comment, s->domain));
1532
1533 if (data_len < buf_len) {
1534 counted++;
1535 fixed_len += f_len;
1536 string_len += s_len;
1537 } else {
1538 missed++;
1539 }
1540 }
1541 }
1542
1543 *rdata_len = fixed_len + string_len;
1544 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1545 if (!*rdata) {
1546 return False;
1547 }
1548
1549 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1550 p = *rdata;
1551 f_len = fixed_len;
1552 s_len = string_len;
1553
1554 {
1555 char *lastname=NULL;
1556 int count2 = counted;
1557
1558 for (i = 0; i < total && count2;i++) {
1559 struct srv_info_struct *s = &servers[i];
1560
1561 if (lastname && strequal(lastname,s->name)) {
1562 continue;
1563 }
1564 lastname = s->name;
1565 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1566 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1567 i, s->name, s->type, s->comment, s->domain));
1568 count2--;
1569 }
1570 }
1571
1572 *rparam_len = 8;
1573 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1574 if (!*rparam) {
1575 return False;
1576 }
1577 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1578 SSVAL(*rparam,2,0);
1579 SSVAL(*rparam,4,counted);
1580 SSVAL(*rparam,6,counted+missed);
1581
1582 SAFE_FREE(servers);
1583
1584 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1585 domain,uLevel,counted,counted+missed));
1586
1587 return True;
1588 }
1589
1590 static int srv_name_match(const char *n1, const char *n2)
1591 {
1592 /*
1593 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1594 *
1595 * In Windows, FirstNameToReturn need not be an exact match:
1596 * the server will return a list of servers that exist on
1597 * the network greater than or equal to the FirstNameToReturn.
1598 */
1599 int ret = strcasecmp_m(n1, n2);
1600
1601 if (ret <= 0) {
1602 return 0;
1603 }
1604
1605 return ret;
1606 }
1607
1608 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1609 connection_struct *conn, uint64_t vuid,
1610 char *param, int tpscnt,
1611 char *data, int tdscnt,
1612 int mdrcnt, int mprcnt, char **rdata,
1613 char **rparam, int *rdata_len, int *rparam_len)
1614 {
1615 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1616 char *str2 = skip_string(param,tpscnt,str1);
1617 char *p = skip_string(param,tpscnt,str2);
1618 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1619 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1620 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1621 char *p2;
1622 int data_len, fixed_len, string_len;
1623 int f_len = 0, s_len = 0;
1624 struct srv_info_struct *servers=NULL;
1625 int counted=0,first=0,total=0;
1626 int i,missed;
1627 fstring domain;
1628 fstring first_name;
1629 bool domain_request;
1630 bool local_request;
1631
1632 if (!str1 || !str2 || !p) {
1633 return False;
1634 }
1635
1636 /* If someone sets all the bits they don't really mean to set
1637 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1638 known servers. */
1639
1640 if (servertype == SV_TYPE_ALL) {
1641 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1642 }
1643
1644 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1645 any other bit (they may just set this bit on its own) they
1646 want all the locally seen servers. However this bit can be
1647 set on its own so set the requested servers to be
1648 ALL - DOMAIN_ENUM. */
1649
1650 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1651 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1652 }
1653
1654 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1655 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1656
1657 p += 8;
1658
1659 if (strcmp(str1, "WrLehDzz") != 0) {
1660 return false;
1661 }
1662 if (!check_session_info(uLevel,str2)) {
1663 return False;
1664 }
1665
1666 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1667 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1668 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1669
1670 if (skip_string(param,tpscnt,p) == NULL) {
1671 return False;
1672 }
1673 pull_ascii_fstring(domain, p);
1674 if (domain[0] == '\0') {
1675 fstrcpy(domain, lp_workgroup());
1676 }
1677 p = skip_string(param,tpscnt,p);
1678 if (skip_string(param,tpscnt,p) == NULL) {
1679 return False;
1680 }
1681 pull_ascii_fstring(first_name, p);
1682
1683 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1684 domain, first_name));
1685
1686 if (lp_browse_list()) {
1687 total = get_session_info(servertype,&servers,domain);
1688 }
1689
1690 data_len = fixed_len = string_len = 0;
1691 missed = 0;
1692
1693 TYPESAFE_QSORT(servers, total, srv_comp);
1694
1695 if (first_name[0] != '\0') {
1696 struct srv_info_struct *first_server = NULL;
1697
1698 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1699 srv_name_match, first_server);
1700 if (first_server) {
1701 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1702 /*
1703 * The binary search may not find the exact match
1704 * so we need to search backward to find the first match
1705 *
1706 * This implements the strange matching windows
1707 * implements. (see the comment in srv_name_match().
1708 */
1709 for (;first > 0;) {
1710 int ret;
1711 ret = strcasecmp_m(first_name,
1712 servers[first-1].name);
1713 if (ret > 0) {
1714 break;
1715 }
1716 first--;
1717 }
1718 } else {
1719 /* we should return no entries */
1720 first = total;
1721 }
1722 }
1723
1724 {
1725 char *lastname=NULL;
1726
1727 for (i=first;i<total;i++) {
1728 struct srv_info_struct *s = &servers[i];
1729
1730 if (lastname && strequal(lastname,s->name)) {
1731 continue;
1732 }
1733 lastname = s->name;
1734 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1735 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1736 i, s->name, s->type, s->comment, s->domain));
1737
1738 if (data_len < buf_len) {
1739 counted++;
1740 fixed_len += f_len;
1741 string_len += s_len;
1742 } else {
1743 missed++;
1744 }
1745 }
1746 }
1747
1748 *rdata_len = fixed_len + string_len;
1749 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1750 if (!*rdata) {
1751 return False;
1752 }
1753
1754 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1755 p = *rdata;
1756 f_len = fixed_len;
1757 s_len = string_len;
1758
1759 {
1760 char *lastname=NULL;
1761 int count2 = counted;
1762
1763 for (i = first; i < total && count2;i++) {
1764 struct srv_info_struct *s = &servers[i];
1765
1766 if (lastname && strequal(lastname,s->name)) {
1767 continue;
1768 }
1769 lastname = s->name;
1770 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1771 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1772 i, s->name, s->type, s->comment, s->domain));
1773 count2--;
1774 }
1775 }
1776
1777 *rparam_len = 8;
1778 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1779 if (!*rparam) {
1780 return False;
1781 }
1782 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1783 SSVAL(*rparam,2,0);
1784 SSVAL(*rparam,4,counted);
1785 SSVAL(*rparam,6,counted+missed);
1786
1787 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1788 domain,uLevel,first,first_name,
1789 first < total ? servers[first].name : "",
1790 counted,counted+missed));
1791
1792 SAFE_FREE(servers);
1793
1794 return True;
1795 }
1796
1797 /****************************************************************************
1798 command 0x34 - suspected of being a "Lookup Names" stub api
1799 ****************************************************************************/
1800
1801 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1802 connection_struct *conn, uint64_t vuid,
1803 char *param, int tpscnt,
1804 char *data, int tdscnt,
1805 int mdrcnt, int mprcnt, char **rdata,
1806 char **rparam, int *rdata_len, int *rparam_len)
1807 {
1808 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1809 char *str2 = skip_string(param,tpscnt,str1);
1810 char *p = skip_string(param,tpscnt,str2);
1811 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1812 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1813 int counted=0;
1814 int missed=0;
1815
1816 if (!str1 || !str2 || !p) {
1817 return False;
1818 }
1819
1820 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1821 str1, str2, p, uLevel, buf_len));
1822
1823 if (!prefix_ok(str1,"zWrLeh")) {
1824 return False;
1825 }
1826
1827 *rdata_len = 0;
1828
1829 *rparam_len = 8;
1830 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1831 if (!*rparam) {
1832 return False;
1833 }
1834
1835 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1836 SSVAL(*rparam,2,0);
1837 SSVAL(*rparam,4,counted);
1838 SSVAL(*rparam,6,counted+missed);
1839
1840 return True;
1841 }
1842
1843 /****************************************************************************
1844 get info about a share
1845 ****************************************************************************/
1846
1847 static bool check_share_info(int uLevel, char* id)
1848 {
1849 switch( uLevel ) {
1850 case 0:
1851 if (strcmp(id,"B13") != 0) {
1852 return False;
1853 }
1854 break;
1855 case 1:
1856 /* Level-2 descriptor is allowed (and ignored) */
1857 if (strcmp(id,"B13BWz") != 0 &&
1858 strcmp(id,"B13BWzWWWzB9B") != 0) {
1859 return False;
1860 }
1861 break;
1862 case 2:
1863 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1864 return False;
1865 }
1866 break;
1867 case 91:
1868 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1869 return False;
1870 }
1871 break;
1872 default:
1873 return False;
1874 }
1875 return True;
1876 }
1877
1878 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1879 char** buf, int* buflen,
1880 char** stringbuf, int* stringspace, char* baseaddr)
1881 {
1882 int struct_len;
1883 char* p;
1884 char* p2;
1885 int l2;
1886 int len;
1887
1888 switch( uLevel ) {
1889 case 0:
1890 struct_len = 13;
1891 break;
1892 case 1:
1893 struct_len = 20;
1894 break;
1895 case 2:
1896 struct_len = 40;
1897 break;
1898 case 91:
1899 struct_len = 68;
1900 break;
1901 default:
1902 return -1;
1903 }
1904
1905 if (!buf) {
1906 len = 0;
1907
1908 if (uLevel > 0) {
1909 len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), snum));
1910 }
1911 if (uLevel > 1) {
1912 len += strlen(lp_pathname(talloc_tos(), snum)) + 1;
1913 }
1914 if (buflen) {
1915 *buflen = struct_len;
1916 }
1917 if (stringspace) {
1918 *stringspace = len;
1919 }
1920 return struct_len + len;
1921 }
1922
1923 len = struct_len;
1924 p = *buf;
1925 if ((*buflen) < struct_len) {
1926 return -1;
1927 }
1928
1929 if (stringbuf) {
1930 p2 = *stringbuf;
1931 l2 = *stringspace;
1932 } else {
1933 p2 = p + struct_len;
1934 l2 = (*buflen) - struct_len;
1935 }
1936
1937 if (!baseaddr) {
1938 baseaddr = p;
1939 }
1940
1941 push_ascii(p,lp_servicename(talloc_tos(), snum),13, STR_TERMINATE);
1942
1943 if (uLevel > 0) {
1944 int type;
1945
1946 SCVAL(p,13,0);
1947 type = STYPE_DISKTREE;
1948 if (lp_print_ok(snum)) {
1949 type = STYPE_PRINTQ;
1950 }
1951 if (strequal("IPC",lp_fstype(talloc_tos(),snum))) {
1952 type = STYPE_IPC;
1953 }
1954 SSVAL(p,14,type); /* device type */
1955 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1956 len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(),snum),&l2);
1957 }
1958
1959 if (uLevel > 1) {
1960 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1961 SSVALS(p,22,-1); /* max uses */
1962 SSVAL(p,24,1); /* current uses */
1963 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1964 len += CopyAndAdvance(&p2,lp_pathname(talloc_tos(),snum),&l2);
1965 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1966 }
1967
1968 if (uLevel > 2) {
1969 memset(p+40,0,SHPWLEN+2);
1970 SSVAL(p,50,0);
1971 SIVAL(p,52,0);
1972 SSVAL(p,56,0);
1973 SSVAL(p,58,0);
1974 SIVAL(p,60,0);
1975 SSVAL(p,64,0);
1976 SSVAL(p,66,0);
1977 }
1978
1979 if (stringbuf) {
1980 (*buf) = p + struct_len;
1981 (*buflen) -= struct_len;
1982 (*stringbuf) = p2;
1983 (*stringspace) = l2;
1984 } else {
1985 (*buf) = p2;
1986 (*buflen) -= len;
1987 }
1988
1989 return len;
1990 }
1991
1992 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
1993 connection_struct *conn,uint64_t vuid,
1994 char *param, int tpscnt,
1995 char *data, int tdscnt,
1996 int mdrcnt,int mprcnt,
1997 char **rdata,char **rparam,
1998 int *rdata_len,int *rparam_len)
1999 {
2000 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2001 char *str2 = skip_string(param,tpscnt,str1);
2002 char *netname_in = skip_string(param,tpscnt,str2);
2003 char *netname = NULL;
2004 char *p = skip_string(param,tpscnt,netname);
2005 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2006 int snum;
2007
2008 if (!str1 || !str2 || !netname_in || !p) {
2009 return False;
2010 }
2011
2012 snum = find_service(talloc_tos(), netname_in, &netname);
2013 if (snum < 0 || !netname) {
2014 return False;
2015 }
2016
2017 /* check it's a supported varient */
2018 if (!prefix_ok(str1,"zWrLh")) {
2019 return False;
2020 }
2021 if (!check_share_info(uLevel,str2)) {
2022 return False;
2023 }
2024
2025 *rdata = smb_realloc_limit(*rdata,mdrcnt);
2026 if (!*rdata) {
2027 return False;
2028 }
2029 p = *rdata;
2030 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2031 if (*rdata_len < 0) {
2032 return False;
2033 }
2034
2035 *rparam_len = 6;
2036 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2037 if (!*rparam) {
2038 return False;
2039 }
2040 SSVAL(*rparam,0,NERR_Success);
2041 SSVAL(*rparam,2,0); /* converter word */
2042 SSVAL(*rparam,4,*rdata_len);
2043
2044 return True;
2045 }
2046
2047 /****************************************************************************
2048 View the list of available shares.
2049
2050 This function is the server side of the NetShareEnum() RAP call.
2051 It fills the return buffer with share names and share comments.
2052 Note that the return buffer normally (in all known cases) allows only
2053 twelve byte strings for share names (plus one for a nul terminator).
2054 Share names longer than 12 bytes must be skipped.
2055 ****************************************************************************/
2056
2057 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2058 connection_struct *conn, uint64_t vuid,
2059 char *param, int tpscnt,
2060 char *data, int tdscnt,
2061 int mdrcnt,
2062 int mprcnt,
2063 char **rdata,
2064 char **rparam,
2065 int *rdata_len,
2066 int *rparam_len )
2067 {
2068 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2069 char *str2 = skip_string(param,tpscnt,str1);
2070 char *p = skip_string(param,tpscnt,str2);
2071 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2072 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2073 char *p2;
2074 int count = 0;
2075 int total=0,counted=0;
2076 bool missed = False;
2077 int i;
2078 int data_len, fixed_len, string_len;
2079 int f_len = 0, s_len = 0;
2080
2081 if (!str1 || !str2 || !p) {
2082 return False;
2083 }
2084
2085 if (!prefix_ok(str1,"WrLeh")) {
2086 return False;
2087 }
2088 if (!check_share_info(uLevel,str2)) {
2089 return False;
2090 }
2091
2092 /* Ensure all the usershares are loaded. */
2093 become_root();
2094 delete_and_reload_printers(sconn->ev_ctx, sconn->msg_ctx);
2095 load_registry_shares();
2096 count = load_usershare_shares(NULL, connections_snum_used);
2097 unbecome_root();
2098
2099 data_len = fixed_len = string_len = 0;
2100 for (i=0;i<count;i++) {
2101 fstring servicename_dos;
2102 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2103 continue;
2104 }
2105 push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), i));
2106 /* Maximum name length = 13. */
2107 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2108 total++;
2109 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2110 if (data_len < buf_len) {
2111 counted++;
2112 fixed_len += f_len;
2113 string_len += s_len;
2114 } else {
2115 missed = True;
2116 }
2117 }
2118 }
2119
2120 *rdata_len = fixed_len + string_len;
2121 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2122 if (!*rdata) {
2123 return False;
2124 }
2125
2126 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2127 p = *rdata;
2128 f_len = fixed_len;
2129 s_len = string_len;
2130
2131 for( i = 0; i < count; i++ ) {
2132 fstring servicename_dos;
2133 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2134 continue;
2135 }
2136
2137 push_ascii_fstring(servicename_dos,
2138 lp_servicename(talloc_tos(), i));
2139 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2140 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2141 break;
2142 }
2143 }
2144 }
2145
2146 *rparam_len = 8;
2147 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2148 if (!*rparam) {
2149 return False;
2150 }
2151 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2152 SSVAL(*rparam,2,0);
2153 SSVAL(*rparam,4,counted);
2154 SSVAL(*rparam,6,total);
2155
2156 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2157 counted,total,uLevel,
2158 buf_len,*rdata_len,mdrcnt));
2159
2160 return True;
2161 }
2162
2163 /****************************************************************************
2164 Add a share
2165 ****************************************************************************/
2166
2167 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2168 connection_struct *conn,uint64_t vuid,
2169 char *param, int tpscnt,
2170 char *data, int tdscnt,
2171 int mdrcnt,int mprcnt,
2172 char **rdata,char **rparam,
2173 int *rdata_len,int *rparam_len)
2174 {
2175 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2176 char *str2 = skip_string(param,tpscnt,str1);
2177 char *p = skip_string(param,tpscnt,str2);
2178 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2179 fstring sharename;
2180 fstring comment;
2181 char *pathname = NULL;
2182 unsigned int offset;
2183 int res = ERRunsup;
2184 size_t converted_size;
2185
2186 WERROR werr = WERR_OK;
2187 TALLOC_CTX *mem_ctx = talloc_tos();
2188 NTSTATUS status;
2189 struct rpc_pipe_client *cli = NULL;
2190 union srvsvc_NetShareInfo info;
2191 struct srvsvc_NetShareInfo2 info2;
2192 struct dcerpc_binding_handle *b;
2193
2194 if (!str1 || !str2 || !p) {
2195 return False;
2196 }
2197
2198 /* check it's a supported varient */
2199 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2200 return False;
2201 }
2202 if (!check_share_info(uLevel,str2)) {
2203 return False;
2204 }
2205 if (uLevel != 2) {
2206 return False;
2207 }
2208
2209 /* Do we have a string ? */
2210 if (skip_string(data,mdrcnt,data) == NULL) {
2211 return False;
2212 }
2213 pull_ascii_fstring(sharename,data);
2214
2215 if (mdrcnt < 28) {
2216 return False;
2217 }
2218
2219 /* only support disk share adds */
2220 if (SVAL(data,14)!=STYPE_DISKTREE) {
2221 return False;
2222 }
2223
2224 offset = IVAL(data, 16);
2225 if (offset >= mdrcnt) {
2226 res = ERRinvalidparam;
2227 goto out;
2228 }
2229
2230 /* Do we have a string ? */
2231 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2232 return False;
2233 }
2234 pull_ascii_fstring(comment, offset? (data+offset) : "");
2235
2236 offset = IVAL(data, 26);
2237
2238 if (offset >= mdrcnt) {
2239 res = ERRinvalidparam;
2240 goto out;
2241 }
2242
2243 /* Do we have a string ? */
2244 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2245 return False;
2246 }
2247
2248 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2249 offset ? (data+offset) : "", &converted_size))
2250 {
2251 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2252 strerror(errno)));
2253 }
2254
2255 if (!pathname) {
2256 return false;
2257 }
2258
2259 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc.syntax_id,
2260 conn->session_info,
2261 conn->sconn->remote_address,
2262 conn->sconn->msg_ctx,
2263 &cli);
2264 if (!NT_STATUS_IS_OK(status)) {
2265 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2266 nt_errstr(status)));
2267 res = W_ERROR_V(ntstatus_to_werror(status));
2268 goto out;
2269 }
2270
2271 b = cli->binding_handle;
2272
2273 info2.name = sharename;
2274 info2.type = STYPE_DISKTREE;
2275 info2.comment = comment;
2276 info2.permissions = 0;
2277 info2.max_users = 0;
2278 info2.current_users = 0;
2279 info2.path = pathname;
2280 info2.password = NULL;
2281
2282 info.info2 = &info2;
2283
2284 status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2285 cli->srv_name_slash,
2286 2,
2287 &info,
2288 NULL,
2289 &werr);
2290 if (!NT_STATUS_IS_OK(status)) {
2291 res = W_ERROR_V(ntstatus_to_werror(status));
2292 goto out;
2293 }
2294 if (!W_ERROR_IS_OK(werr)) {
2295 res = W_ERROR_V(werr);
2296 goto out;
2297 }
2298
2299 *rparam_len = 6;
2300 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2301 if (!*rparam) {
2302 return False;
2303 }
2304 SSVAL(*rparam,0,NERR_Success);
2305 SSVAL(*rparam,2,0); /* converter word */
2306 SSVAL(*rparam,4,*rdata_len);
2307 *rdata_len = 0;
2308
2309 return True;
2310
2311 out:
2312
2313 *rparam_len = 4;
2314 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2315 if (!*rparam) {
2316 return False;
2317 }
2318 *rdata_len = 0;
2319 SSVAL(*rparam,0,res);
2320 SSVAL(*rparam,2,0);
2321 return True;
2322 }
2323
2324 /****************************************************************************
2325 view list of groups available
2326 ****************************************************************************/
2327
2328 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2329 connection_struct *conn,uint64_t vuid,
2330 char *param, int tpscnt,
2331 char *data, int tdscnt,
2332 int mdrcnt,int mprcnt,
2333 char **rdata,char **rparam,
2334 int *rdata_len,int *rparam_len)
2335 {
2336 int i;
2337 int errflags=0;
2338 int resume_context, cli_buf_size;
2339 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2340 char *str2 = skip_string(param,tpscnt,str1);
2341 char *p = skip_string(param,tpscnt,str2);
2342
2343 uint32_t num_groups;
2344 uint32_t resume_handle;
2345 struct rpc_pipe_client *samr_pipe;
2346 struct policy_handle samr_handle, domain_handle;
2347 NTSTATUS status, result;
2348 struct dcerpc_binding_handle *b;
2349
2350 if (!str1 || !str2 || !p) {
2351 return False;
2352 }
2353
2354 if (strcmp(str1,"WrLeh") != 0) {
2355 return False;
2356 }
2357
2358 /* parameters
2359 * W-> resume context (number of users to skip)
2360 * r -> return parameter pointer to receive buffer
2361 * L -> length of receive buffer
2362 * e -> return parameter number of entries
2363 * h -> return parameter total number of users
2364 */
2365
2366 if (strcmp("B21",str2) != 0) {
2367 return False;
2368 }
2369
2370 status = rpc_pipe_open_interface(
2371 talloc_tos(), &ndr_table_samr.syntax_id,
2372 conn->session_info, conn->sconn->remote_address,
2373 conn->sconn->msg_ctx, &samr_pipe);
2374 if (!NT_STATUS_IS_OK(status)) {
2375 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2376 nt_errstr(status)));
2377 return false;
2378 }
2379
2380 b = samr_pipe->binding_handle;
2381
2382 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2383 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2384 &result);
2385 if (!NT_STATUS_IS_OK(status)) {
2386 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2387 nt_errstr(status)));
2388 return false;
2389 }
2390 if (!NT_STATUS_IS_OK(result)) {
2391 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2392 nt_errstr(result)));
2393 return false;
2394 }
2395
2396 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2397 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2398 get_global_sam_sid(), &domain_handle,
2399 &result);
2400 if (!NT_STATUS_IS_OK(status)) {
2401 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2402 nt_errstr(status)));
2403 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2404 return false;
2405 }
2406 if (!NT_STATUS_IS_OK(result)) {
2407 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2408 nt_errstr(result)));
2409 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2410 return false;
2411 }
2412
2413 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2414 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2415 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2416 "%d\n", resume_context, cli_buf_size));
2417
2418 *rdata_len = cli_buf_size;
2419 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2420 if (!*rdata) {
2421 return False;
2422 }
2423
2424 p = *rdata;
2425
2426 errflags = NERR_Success;
2427 num_groups = 0;
2428 resume_handle = 0;
2429
2430 while (true) {
2431 struct samr_SamArray *sam_entries;
2432 uint32_t num_entries;
2433
2434 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2435 &domain_handle,
2436 &resume_handle,
2437 &sam_entries, 1,
2438 &num_entries,
2439 &result);
2440 if (!NT_STATUS_IS_OK(status)) {
2441 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2442 "%s\n", nt_errstr(status)));
2443 break;
2444 }
2445 if (!NT_STATUS_IS_OK(result)) {
2446 status = result;
2447 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2448 "%s\n", nt_errstr(result)));
2449 break;
2450 }
2451
2452 if (num_entries == 0) {
2453 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2454 "no entries -- done\n"));
2455 break;
2456 }
2457
2458 for(i=0; i<num_entries; i++) {
2459 const char *name;
2460
2461 name = sam_entries->entries[i].name.string;
2462
2463 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2464 /* set overflow error */
2465 DEBUG(3,("overflow on entry %d group %s\n", i,
2466 name));
2467 errflags=234;
2468 break;
2469 }
2470
2471 /* truncate the name at 21 chars. */
2472 memset(p, 0, 21);
2473 strlcpy(p, name, 21);
2474 DEBUG(10,("adding entry %d group %s\n", i, p));
2475 p += 21;
2476 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2477 * idea why... */
2478 num_groups += 1;
2479 }
2480
2481 if (errflags != NERR_Success) {
2482 break;
2483 }
2484
2485 TALLOC_FREE(sam_entries);
2486 }
2487
2488 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2489 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2490
2491 *rdata_len = PTR_DIFF(p,*rdata);
2492
2493 *rparam_len = 8;
2494 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2495 if (!*rparam) {
2496 return False;
2497 }
2498 SSVAL(*rparam, 0, errflags);
2499 SSVAL(*rparam, 2, 0); /* converter word */
2500 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2501 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2502
2503 return(True);
2504 }
2505
2506 /*******************************************************************
2507 Get groups that a user is a member of.
2508 ******************************************************************/
2509
2510 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2511 connection_struct *conn,uint64_t vuid,
2512 char *param, int tpscnt,
2513 char *data, int tdscnt,
2514 int mdrcnt,int mprcnt,
2515 char **rdata,char **rparam,
2516 int *rdata_len,int *rparam_len)
2517 {
2518 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2519 char *str2 = skip_string(param,tpscnt,str1);
2520 char *UserName = skip_string(param,tpscnt,str2);
2521 char *p = skip_string(param,tpscnt,UserName);
2522 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2523 const char *level_string;
2524 int count=0;
2525 bool ret = False;
2526 uint32_t i;
2527 char *endp = NULL;
2528
2529 struct rpc_pipe_client *samr_pipe;
2530 struct policy_handle samr_handle, domain_handle, user_handle;
2531 struct lsa_String name;
2532 struct lsa_Strings names;
2533 struct samr_Ids type, rid;
2534 struct samr_RidWithAttributeArray *rids;
2535 NTSTATUS status, result;
2536 struct dcerpc_binding_handle *b;
2537
2538 if (!str1 || !str2 || !UserName || !p) {
2539 return False;
2540 }
2541
2542 *rparam_len = 8;
2543 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2544 if (!*rparam) {
2545 return False;
2546 }
2547
2548 /* check it's a supported varient */
2549
2550 if ( strcmp(str1,"zWrLeh") != 0 )
2551 return False;
2552
2553 switch( uLevel ) {
2554 case 0:
2555 level_string = "B21";
2556 break;
2557 default:
2558 return False;
2559 }
2560
2561 if (strcmp(level_string,str2) != 0)
2562 return False;
2563
2564 *rdata_len = mdrcnt + 1024;
2565 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2566 if (!*rdata) {
2567 return False;
2568 }
2569
2570 SSVAL(*rparam,0,NERR_Success);
2571 SSVAL(*rparam,2,0); /* converter word */
2572
2573 p = *rdata;
2574 endp = *rdata + *rdata_len;
2575
2576 status = rpc_pipe_open_interface(
2577 talloc_tos(), &ndr_table_samr.syntax_id,
2578 conn->session_info, conn->sconn->remote_address,
2579 conn->sconn->msg_ctx, &samr_pipe);
2580 if (!NT_STATUS_IS_OK(status)) {
2581 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2582 nt_errstr(status)));
2583 return false;
2584 }
2585
2586 b = samr_pipe->binding_handle;
2587
2588 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2589 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2590 &result);
2591 if (!NT_STATUS_IS_OK(status)) {
2592 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2593 nt_errstr(status)));
2594 return false;
2595 }
2596 if (!NT_STATUS_IS_OK(result)) {
2597 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2598 nt_errstr(result)));
2599 return false;
2600 }
2601
2602 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2603 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2604 get_global_sam_sid(), &domain_handle,
2605 &result);
2606 if (!NT_STATUS_IS_OK(status)) {
2607 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2608 nt_errstr(status)));
2609 goto close_sam;
2610 }
2611 if (!NT_STATUS_IS_OK(result)) {
2612 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2613 nt_errstr(result)));
2614 goto close_sam;
2615 }
2616
2617 name.string = UserName;
2618
2619 status = dcerpc_samr_LookupNames(b, talloc_tos(),
2620 &domain_handle, 1, &name,
2621 &rid, &type,
2622 &result);
2623 if (!NT_STATUS_IS_OK(status)) {
2624 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2625 nt_errstr(status)));
2626 goto close_domain;
2627 }
2628 if (!NT_STATUS_IS_OK(result)) {
2629 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2630 nt_errstr(result)));
2631 goto close_domain;
2632 }
2633 if (rid.count != 1) {
2634 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2635 goto close_domain;
2636 }
2637 if (type.count != 1) {
2638 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2639 goto close_domain;
2640 }
2641
2642 if (type.ids[0] != SID_NAME_USER) {
2643 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2644 sid_type_lookup(type.ids[0])));
2645 goto close_domain;
2646 }
2647
2648 status = dcerpc_samr_OpenUser(b, talloc_tos(),
2649 &domain_handle,
2650 SAMR_USER_ACCESS_GET_GROUPS,
2651 rid.ids[0], &user_handle,
2652 &result);
2653 if (!NT_STATUS_IS_OK(status)) {
2654 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2655 nt_errstr(status)));
2656 goto close_domain;
2657 }
2658 if (!NT_STATUS_IS_OK(result)) {
2659 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2660 nt_errstr(result)));
2661 goto close_domain;
2662 }
2663
2664 status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2665 &user_handle, &rids,
2666 &result);
2667 if (!NT_STATUS_IS_OK(status)) {
2668 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2669 nt_errstr(status)));
2670 goto close_user;
2671 }
2672 if (!NT_STATUS_IS_OK(result)) {
2673 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2674 nt_errstr(result)));
2675 goto close_user;
2676 }
2677
2678 for (i=0; i<rids->count; i++) {
2679
2680 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2681 &domain_handle,
2682 1, &rids->rids[i].rid,
2683 &names, &type,
2684 &result);
2685 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2686 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2687 p += 21;
2688 count++;
2689 }
2690 }
2691
2692 *rdata_len = PTR_DIFF(p,*rdata);
2693
2694 SSVAL(*rparam,4,count); /* is this right?? */
2695 SSVAL(*rparam,6,count); /* is this right?? */
2696
2697 ret = True;
2698
2699 close_user:
2700 dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2701 close_domain:
2702 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2703 close_sam:
2704 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2705
2706 return ret;
2707 }
2708
2709 /*******************************************************************
2710 Get all users.
2711 ******************************************************************/
2712
2713 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2714 connection_struct *conn, uint64_t vuid,
2715 char *param, int tpscnt,
2716 char *data, int tdscnt,
2717 int mdrcnt,int mprcnt,
2718 char **rdata,char **rparam,
2719 int *rdata_len,int *rparam_len)
2720 {
2721 int count_sent=0;
2722 int num_users=0;
2723 int errflags=0;
2724 int i, resume_context, cli_buf_size;
2725 uint32_t resume_handle;
2726
2727 struct rpc_pipe_client *samr_pipe;
2728 struct policy_handle samr_handle, domain_handle;
2729 NTSTATUS status, result;
2730
2731 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2732 char *str2 = skip_string(param,tpscnt,str1);
2733 char *p = skip_string(param,tpscnt,str2);
2734 char *endp = NULL;
2735
2736 struct dcerpc_binding_handle *b;
2737
2738 if (!str1 || !str2 || !p) {
2739 return False;
2740 }
2741
2742 if (strcmp(str1,"WrLeh") != 0)
2743 return False;
2744 /* parameters
2745 * W-> resume context (number of users to skip)
2746 * r -> return parameter pointer to receive buffer
2747 * L -> length of receive buffer
2748 * e -> return parameter number of entries
2749 * h -> return parameter total number of users
2750 */
2751
2752 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2753 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2754 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2755 resume_context, cli_buf_size));
2756
2757 *rparam_len = 8;
2758 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2759 if (!*rparam) {
2760 return False;
2761 }
2762
2763 /* check it's a supported varient */
2764 if (strcmp("B21",str2) != 0)
2765 return False;
2766
2767 *rdata_len = cli_buf_size;
2768 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2769 if (!*rdata) {
2770 return False;
2771 }
2772
2773 p = *rdata;
2774 endp = *rdata + *rdata_len;
2775
2776 status = rpc_pipe_open_interface(
2777 talloc_tos(), &ndr_table_samr.syntax_id,
2778 conn->session_info, conn->sconn->remote_address,
2779 conn->sconn->msg_ctx, &samr_pipe);
2780 if (!NT_STATUS_IS_OK(status)) {
2781 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2782 nt_errstr(status)));
2783 return false;
2784 }
2785
2786 b = samr_pipe->binding_handle;
2787
2788 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2789 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2790 &result);
2791 if (!NT_STATUS_IS_OK(status)) {
2792 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2793 nt_errstr(status)));
2794 return false;
2795 }
2796 if (!NT_STATUS_IS_OK(result)) {
2797 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2798 nt_errstr(result)));
2799 return false;
2800 }
2801
2802 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2803 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2804 get_global_sam_sid(), &domain_handle,
2805 &result);
2806 if (!NT_STATUS_IS_OK(status)) {
2807 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2808 nt_errstr(status)));
2809 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2810 return false;
2811 }
2812 if (!NT_STATUS_IS_OK(result)) {
2813 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2814 nt_errstr(result)));
2815 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2816 return false;
2817 }
2818
2819 errflags=NERR_Success;
2820
2821 resume_handle = 0;
2822
2823 while (true) {
2824 struct samr_SamArray *sam_entries;
2825 uint32_t num_entries;
2826
2827 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2828 &domain_handle,
2829 &resume_handle,
2830 0, &sam_entries, 1,
2831 &num_entries,
2832 &result);
2833
2834 if (!NT_STATUS_IS_OK(status)) {
2835 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2836 "%s\n", nt_errstr(status)));
2837 break;
2838 }
2839 if (!NT_STATUS_IS_OK(result)) {
2840 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2841 "%s\n", nt_errstr(result)));
2842 break;
2843 }
2844
2845 if (num_entries == 0) {
2846 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2847 "no entries -- done\n"));
2848 break;
2849 }
2850
2851 for (i=0; i<num_entries; i++) {
2852 const char *name;
2853
2854 name = sam_entries->entries[i].name.string;
2855
2856 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2857 &&(strlen(name)<=21)) {
2858 strlcpy(p,name,PTR_DIFF(endp,p));
2859 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2860 "username %s\n",count_sent,p));
2861 p += 21;
2862 count_sent++;
2863 } else {
2864 /* set overflow error */
2865 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2866 "username %s\n",count_sent,name));
2867 errflags=234;
2868 break;
2869 }
2870 }
2871
2872 if (errflags != NERR_Success) {
2873 break;
2874 }
2875
2876 TALLOC_FREE(sam_entries);
2877 }
2878
2879 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2880 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2881
2882 *rdata_len = PTR_DIFF(p,*rdata);
2883
2884 SSVAL(*rparam,0,errflags);
2885 SSVAL(*rparam,2,0); /* converter word */
2886 SSVAL(*rparam,4,count_sent); /* is this right?? */
2887 SSVAL(*rparam,6,num_users); /* is this right?? */
2888
2889 return True;
2890 }
2891
2892 /****************************************************************************
2893 Get the time of day info.
2894 ****************************************************************************/
2895
2896 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2897 connection_struct *conn,uint64_t vuid,
2898 char *param, int tpscnt,
2899 char *data, int tdscnt,
2900 int mdrcnt,int mprcnt,
2901 char **rdata,char **rparam,
2902 int *rdata_len,int *rparam_len)
2903 {
2904 struct tm *t;
2905 time_t unixdate = time(NULL);
2906 char *p;
2907
2908 *rparam_len = 4;
2909 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2910 if (!*rparam) {
2911 return False;
2912 }
2913
2914 *rdata_len = 21;
2915 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2916 if (!*rdata) {
2917 return False;
2918 }
2919
2920 SSVAL(*rparam,0,NERR_Success);
2921 SSVAL(*rparam,2,0); /* converter word */
2922
2923 p = *rdata;
2924
2925 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2926 by NT in a "net time" operation,
2927 it seems to ignore the one below */
2928
2929 /* the client expects to get localtime, not GMT, in this bit
2930 (I think, this needs testing) */
2931 t = localtime(&unixdate);
2932 if (!t) {
2933 return False;
2934 }
2935
2936 SIVAL(p,4,0); /* msecs ? */
2937 SCVAL(p,8,t->tm_hour);
2938 SCVAL(p,9,t->tm_min);
2939 SCVAL(p,10,t->tm_sec);
2940 SCVAL(p,11,0); /* hundredths of seconds */
2941 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2942 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2943 SCVAL(p,16,t->tm_mday);
2944 SCVAL(p,17,t->tm_mon + 1);
2945 SSVAL(p,18,1900+t->tm_year);
2946 SCVAL(p,20,t->tm_wday);
2947
2948 return True;
2949 }
2950
2951 /****************************************************************************
2952 Set the user password (SamOEM version - gets plaintext).
2953 ****************************************************************************/
2954
2955 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
2956 connection_struct *conn,uint64_t vuid,
2957 char *param, int tpscnt,
2958 char *data, int tdscnt,
2959 int mdrcnt,int mprcnt,
2960 char **rdata,char **rparam,
2961 int *rdata_len,int *rparam_len)
2962 {
2963 fstring user;
2964 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2965
2966 TALLOC_CTX *mem_ctx = talloc_tos();
2967 NTSTATUS status, result;
2968 struct rpc_pipe_client *cli = NULL;
2969 struct lsa_AsciiString server, account;
2970 struct samr_CryptPassword password;
2971 struct samr_Password hash;
2972 int errcode = NERR_badpass;
2973 int bufsize;
2974 struct dcerpc_binding_handle *b;
2975
2976 *rparam_len = 4;
2977 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2978 if (!*rparam) {
2979 return False;
2980 }
2981
2982 if (!p) {
2983 return False;
2984 }
2985 *rdata_len = 0;
2986
2987 SSVAL(*rparam,0,NERR_badpass);
2988
2989 /*
2990 * Check the parameter definition is correct.
2991 */
2992
2993 /* Do we have a string ? */
2994 if (skip_string(param,tpscnt,p) == 0) {
2995 return False;
2996 }
2997 if(!strequal(p, "zsT")) {
2998 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2999 return False;
3000 }
3001 p = skip_string(param, tpscnt, p);
3002 if (!p) {
3003 return False;
3004 }
3005
3006 /* Do we have a string ? */
3007 if (skip_string(param,tpscnt,p) == 0) {
3008 return False;
3009 }
3010 if(!strequal(p, "B516B16")) {
3011 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3012 return False;
3013 }
3014 p = skip_string(param,tpscnt,p);
3015 if (!p) {
3016 return False;
3017 }
3018 /* Do we have a string ? */
3019 if (skip_string(param,tpscnt,p) == 0) {
3020 return False;
3021 }
3022 p += pull_ascii_fstring(user,p);
3023
3024 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3025
3026 if (tdscnt != 532) {
3027 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3028 goto out;
3029 }
3030
3031 bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3032 if (bufsize != 532) {
3033 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3034 goto out;
3035 }
3036
3037 memcpy(password.data, data, 516);
3038 memcpy(hash.hash, data+516, 16);
3039
3040 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,
3041 conn->session_info,
3042 conn->sconn->remote_address,
3043 conn->sconn->msg_ctx,
3044 &cli);
3045 if (!NT_STATUS_IS_OK(status)) {
3046 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3047 nt_errstr(status)));
3048 errcode = W_ERROR_V(ntstatus_to_werror(status));
3049 goto out;
3050 }
3051
3052 b = cli->binding_handle;
3053
3054 init_lsa_AsciiString(&server, lp_netbios_name());
3055 init_lsa_AsciiString(&account, user);
3056
3057 status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3058 &server,
3059 &account,
3060 &password,
3061 &hash,
3062 &result);
3063 if (!NT_STATUS_IS_OK(status)) {
3064 errcode = W_ERROR_V(ntstatus_to_werror(status));
3065 goto out;
3066 }
3067 if (!NT_STATUS_IS_OK(result)) {
3068 errcode = W_ERROR_V(ntstatus_to_werror(result));
3069 goto out;
3070 }
3071
3072 errcode = NERR_Success;
3073 out:
3074 SSVAL(*rparam,0,errcode);
3075 SSVAL(*rparam,2,0); /* converter word */
3076
3077 return(True);
3078 }
3079
3080 /****************************************************************************
3081 delete a print job
3082 Form: <W> <>
3083 ****************************************************************************/
3084
3085 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3086 connection_struct *conn,uint64_t vuid,
3087 char *param, int tpscnt,
3088 char *data, int tdscnt,
3089 int mdrcnt,int mprcnt,
3090 char **rdata,char **rparam,
3091 int *rdata_len,int *rparam_len)
3092 {
3093 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3094 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3095 char *str2 = skip_string(param,tpscnt,str1);
3096 char *p = skip_string(param,tpscnt,str2);
3097 uint32 jobid;
3098 fstring sharename;
3099 int errcode;
3100 WERROR werr = WERR_OK;
3101
3102 TALLOC_CTX *mem_ctx = talloc_tos();
3103 NTSTATUS status;
3104 struct rpc_pipe_client *cli = NULL;
3105 struct dcerpc_binding_handle *b = NULL;
3106 struct policy_handle handle;
3107 struct spoolss_DevmodeContainer devmode_ctr;
3108 enum spoolss_JobControl command;
3109
3110 if (!str1 || !str2 || !p) {
3111 return False;
3112 }
3113 /*
3114 * We use 1 here not 2 as we're checking
3115 * the last byte we want to access is safe.
3116 */
3117 if (!is_offset_safe(param,tpscnt,p,1)) {
3118 return False;
3119 }
3120 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3121 return False;
3122
3123 /* check it's a supported varient */
3124 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3125 return(False);
3126
3127 *rparam_len = 4;
3128 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3129 if (!*rparam) {
3130 return False;
3131 }
3132 *rdata_len = 0;
3133
3134 ZERO_STRUCT(handle);
3135
3136 status = rpc_pipe_open_interface(conn,
3137 &ndr_table_spoolss.syntax_id,
3138 conn->session_info,
3139 conn->sconn->remote_address,
3140 conn->sconn->msg_ctx,
3141 &cli);
3142 if (!NT_STATUS_IS_OK(status)) {
3143 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3144 nt_errstr(status)));
3145 errcode = W_ERROR_V(ntstatus_to_werror(status));
3146 goto out;
3147 }
3148 b = cli->binding_handle;
3149
3150 ZERO_STRUCT(devmode_ctr);
3151
3152 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3153 sharename,
3154 "RAW",
3155 devmode_ctr,
3156 JOB_ACCESS_ADMINISTER,
3157 &handle,
3158 &werr);
3159 if (!NT_STATUS_IS_OK(status)) {
3160 errcode = W_ERROR_V(ntstatus_to_werror(status));
3161 goto out;
3162 }
3163 if (!W_ERROR_IS_OK(werr)) {
3164 errcode = W_ERROR_V(werr);
3165 goto out;
3166 }
3167
3168 /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3169 * and NERR_DestNotFound if share did not exist */
3170
3171 errcode = NERR_Success;
3172
3173 switch (function) {
3174 case 81: /* delete */
3175 command = SPOOLSS_JOB_CONTROL_DELETE;
3176 break;
3177 case 82: /* pause */
3178 command = SPOOLSS_JOB_CONTROL_PAUSE;
3179 break;
3180 case 83: /* resume */
3181 command = SPOOLSS_JOB_CONTROL_RESUME;
3182 break;
3183 default:
3184 errcode = NERR_notsupported;
3185 goto out;
3186 }
3187
3188 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3189 &handle,
3190 jobid,
3191 NULL, /* unique ptr ctr */
3192 command,
3193 &werr);
3194 if (!NT_STATUS_IS_OK(status)) {
3195 errcode = W_ERROR_V(ntstatus_to_werror(status));
3196 goto out;
3197 }
3198 if (!W_ERROR_IS_OK(werr)) {
3199 errcode = W_ERROR_V(werr);
3200 goto out;
3201 }
3202
3203 out:
3204 if (b && is_valid_policy_hnd(&handle)) {
3205 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3206 }
3207
3208 SSVAL(*rparam,0,errcode);
3209 SSVAL(*rparam,2,0); /* converter word */
3210
3211 return(True);
3212 }
3213
3214 /****************************************************************************
3215 Purge a print queue - or pause or resume it.
3216 ****************************************************************************/
3217
3218 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3219 connection_struct *conn,uint64_t vuid,
3220 char *param, int tpscnt,
3221 char *data, int tdscnt,
3222 int mdrcnt,int mprcnt,
3223 char **rdata,char **rparam,
3224 int *rdata_len,int *rparam_len)
3225 {
3226 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3227 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3228 char *str2 = skip_string(param,tpscnt,str1);
3229 char *QueueName = skip_string(param,tpscnt,str2);
3230 int errcode = NERR_notsupported;
3231 WERROR werr = WERR_OK;
3232 NTSTATUS status;
3233
3234 TALLOC_CTX *mem_ctx = talloc_tos();
3235 struct rpc_pipe_client *cli = NULL;
3236 struct dcerpc_binding_handle *b = NULL;
3237 struct policy_handle handle;
3238 struct spoolss_SetPrinterInfoCtr info_ctr;
3239 struct spoolss_DevmodeContainer devmode_ctr;
3240 struct sec_desc_buf secdesc_ctr;
3241 enum spoolss_PrinterControl command;
3242
3243 if (!str1 || !str2 || !QueueName) {
3244 return False;
3245 }
3246
3247 /* check it's a supported varient */
3248 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3249 return(False);
3250
3251 *rparam_len = 4;
3252 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3253 if (!*rparam) {
3254 return False;
3255 }
3256 *rdata_len = 0;
3257
3258 if (skip_string(param,tpscnt,QueueName) == NULL) {
3259 return False;
3260 }
3261
3262 ZERO_STRUCT(handle);
3263
3264 status = rpc_pipe_open_interface(conn,
3265 &ndr_table_spoolss.syntax_id,
3266 conn->session_info,
3267 conn->sconn->remote_address,
3268 conn->sconn->msg_ctx,
3269 &cli);
3270 if (!NT_STATUS_IS_OK(status)) {
3271 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3272 nt_errstr(status)));
3273 errcode = W_ERROR_V(ntstatus_to_werror(status));
3274 goto out;
3275 }
3276 b = cli->binding_handle;
3277
3278 ZERO_STRUCT(devmode_ctr);
3279
3280 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3281 QueueName,
3282 NULL,
3283 devmode_ctr,
3284 PRINTER_ACCESS_ADMINISTER,
3285 &handle,
3286 &werr);
3287 if (!NT_STATUS_IS_OK(status)) {
3288 errcode = W_ERROR_V(ntstatus_to_werror(status));
3289 goto out;
3290 }
3291 if (!W_ERROR_IS_OK(werr)) {
3292 errcode = W_ERROR_V(werr);
3293 goto out;
3294 }
3295
3296 switch (function) {
3297 case 74: /* Pause queue */
3298 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3299 break;
3300 case 75: /* Resume queue */
3301 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3302 break;
3303 case 103: /* Purge */
3304 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3305 break;
3306 default:
3307 werr = WERR_NOT_SUPPORTED;
3308 break;
3309 }
3310
3311 if (!W_ERROR_IS_OK(werr)) {
3312 errcode = W_ERROR_V(werr);
3313 goto out;
3314 }
3315
3316 ZERO_STRUCT(info_ctr);
3317 ZERO_STRUCT(secdesc_ctr);
3318
3319 status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3320 &handle,
3321 &info_ctr,
3322 &devmode_ctr,
3323 &secdesc_ctr,
3324 command,
3325 &werr);
3326 if (!NT_STATUS_IS_OK(status)) {
3327 errcode = W_ERROR_V(ntstatus_to_werror(status));
3328 goto out;
3329 }
3330 if (!W_ERROR_IS_OK(werr)) {
3331 errcode = W_ERROR_V(werr);
3332 goto out;
3333 }
3334
3335 errcode = W_ERROR_V(werr);
3336
3337 out:
3338
3339 if (b && is_valid_policy_hnd(&handle)) {
3340 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3341 }
3342
3343 SSVAL(*rparam,0,errcode);
3344 SSVAL(*rparam,2,0); /* converter word */
3345
3346 return(True);
3347 }
3348
3349 /****************************************************************************
3350 set the property of a print job (undocumented?)
3351 ? function = 0xb -> set name of print job
3352 ? function = 0x6 -> move print job up/down
3353 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3354 or <WWsTP> <WB21BB16B10zWWzDDz>
3355 ****************************************************************************/
3356
3357 static int check_printjob_info(struct pack_desc* desc,
3358 int uLevel, char* id)
3359 {
3360 desc->subformat = NULL;
3361 switch( uLevel ) {
3362 case 0: desc->format = "W"; break;
3363 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3364 case 2: desc->format = "WWzWWDDzz"; break;
3365 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3366 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3367 default:
3368 DEBUG(0,("check_printjob_info: invalid level %d\n",
3369 uLevel ));
3370 return False;
3371 }
3372 if (id == NULL || strcmp(desc->format,id) != 0) {
3373 DEBUG(0,("check_printjob_info: invalid format %s\n",
3374 id ? id : "<NULL>" ));
3375 return False;
3376 }
3377 return True;
3378 }
3379
3380 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3381 connection_struct *conn, uint64_t vuid,
3382 char *param, int tpscnt,
3383 char *data, int tdscnt,
3384 int mdrcnt,int mprcnt,
3385 char **rdata,char **rparam,
3386 int *rdata_len,int *rparam_len)
3387 {
3388 struct pack_desc desc;
3389 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3390 char *str2 = skip_string(param,tpscnt,str1);
3391 char *p = skip_string(param,tpscnt,str2);
3392 uint32 jobid;
3393 fstring sharename;
3394 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3395 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3396 int errcode;
3397
3398 TALLOC_CTX *mem_ctx = talloc_tos();
3399 WERROR werr;
3400 NTSTATUS status;
3401 struct rpc_pipe_client *cli = NULL;
3402 struct dcerpc_binding_handle *b = NULL;
3403 struct policy_handle handle;
3404 struct spoolss_DevmodeContainer devmode_ctr;
3405 struct spoolss_JobInfoContainer ctr;
3406 union spoolss_JobInfo info;
3407 struct spoolss_SetJobInfo1 info1;
3408
3409 if (!str1 || !str2 || !p) {
3410 return False;
3411 }
3412 /*
3413 * We use 1 here not 2 as we're checking
3414 * the last byte we want to access is safe.
3415 */
3416 if (!is_offset_safe(param,tpscnt,p,1)) {
3417 return False;
3418 }
3419 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3420 return False;
3421 *rparam_len = 4;
3422 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3423 if (!*rparam) {
3424 return False;
3425 }
3426
3427 *rdata_len = 0;
3428
3429 /* check it's a supported varient */
3430 if ((strcmp(str1,"WWsTP")) ||
3431 (!check_printjob_info(&desc,uLevel,str2)))
3432 return(False);
3433
3434 errcode = NERR_notsupported;
3435
3436 switch (function) {
3437 case 0xb:
3438 /* change print job name, data gives the name */
3439 break;
3440 default:
3441 goto out;
3442 }
3443
3444 ZERO_STRUCT(handle);
3445
3446 status = rpc_pipe_open_interface(conn,
3447 &ndr_table_spoolss.syntax_id,
3448 conn->session_info,
3449 conn->sconn->remote_address,
3450 conn->sconn->msg_ctx,
3451 &cli);
3452 if (!NT_STATUS_IS_OK(status)) {
3453 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3454 nt_errstr(status)));
3455 errcode = W_ERROR_V(ntstatus_to_werror(status));
3456 goto out;
3457 }
3458 b = cli->binding_handle;
3459
3460 ZERO_STRUCT(devmode_ctr);
3461
3462 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3463 sharename,
3464 "RAW",
3465 devmode_ctr,
3466 PRINTER_ACCESS_USE,
3467 &handle,
3468 &werr);
3469 if (!NT_STATUS_IS_OK(status)) {
3470 errcode = W_ERROR_V(ntstatus_to_werror(status));
3471 goto out;
3472 }
3473 if (!W_ERROR_IS_OK(werr)) {
3474 errcode = W_ERROR_V(werr);
3475 goto out;
3476 }
3477
3478 werr = rpccli_spoolss_getjob(cli, mem_ctx,
3479 &handle,
3480 jobid,
3481 1, /* level */
3482 0, /* offered */
3483 &info);
3484 if (!W_ERROR_IS_OK(werr)) {
3485 errcode = W_ERROR_V(werr);
3486 goto out;
3487 }
3488
3489 ZERO_STRUCT(ctr);
3490
3491 info1.job_id = info.info1.job_id;
3492 info1.printer_name = info.info1.printer_name;
3493 info1.user_name = info.info1.user_name;
3494 info1.document_name = data;
3495 info1.data_type = info.info1.data_type;
3496 info1.text_status = info.info1.text_status;
3497 info1.status = info.info1.status;
3498 info1.priority = info.info1.priority;
3499 info1.position = info.info1.position;
3500 info1.total_pages = info.info1.total_pages;
3501 info1.pages_printed = info.info1.pages_printed;
3502 info1.submitted = info.info1.submitted;
3503
3504 ctr.level = 1;
3505 ctr.info.info1 = &info1;
3506
3507 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3508 &handle,
3509 jobid,
3510 &ctr,
3511 0,
3512 &werr);
3513 if (!NT_STATUS_IS_OK(status)) {
3514 errcode = W_ERROR_V(ntstatus_to_werror(status));
3515 goto out;
3516 }
3517 if (!W_ERROR_IS_OK(werr)) {
3518 errcode = W_ERROR_V(werr);
3519 goto out;
3520 }
3521
3522 errcode = NERR_Success;
3523 out:
3524
3525 if (b && is_valid_policy_hnd(&handle)) {
3526 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3527 }
3528
3529 SSVALS(*rparam,0,errcode);
3530 SSVAL(*rparam,2,0); /* converter word */
3531
3532 return(True);
3533 }
3534
3535
3536 /****************************************************************************
3537 Get info about the server.
3538 ****************************************************************************/
3539
3540 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3541 connection_struct *conn,uint64_t vuid,
3542 char *param, int tpscnt,
3543 char *data, int tdscnt,
3544 int mdrcnt,int mprcnt,
3545 char **rdata,char **rparam,
3546 int *rdata_len,int *rparam_len)
3547 {
3548 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3549 char *str2 = skip_string(param,tpscnt,str1);
3550 char *p = skip_string(param,tpscnt,str2);
3551 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3552 char *p2;
3553 int struct_len;
3554
3555 NTSTATUS status;
3556 WERROR werr;
3557 TALLOC_CTX *mem_ctx = talloc_tos();
3558 struct rpc_pipe_client *cli = NULL;
3559 union srvsvc_NetSrvInfo info;
3560 int errcode;
3561 struct dcerpc_binding_handle *b;
3562
3563 if (!str1 || !str2 || !p) {
3564 return False;
3565 }
3566
3567 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3568
3569 /* check it's a supported varient */
3570 if (!prefix_ok(str1,"WrLh")) {
3571 return False;
3572 }
3573
3574 switch( uLevel ) {
3575 case 0:
3576 if (strcmp(str2,"B16") != 0) {
3577 return False;
3578 }
3579 struct_len = 16;
3580 break;
3581 case 1:
3582 if (strcmp(str2,"B16BBDz") != 0) {
3583 return False;
3584 }
3585 struct_len = 26;
3586 break;
3587 case 2:
3588 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3589 return False;
3590 }
3591 struct_len = 134;
3592 break;
3593 case 3:
3594 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3595 return False;
3596 }
3597 struct_len = 144;
3598 break;
3599 case 20:
3600 if (strcmp(str2,"DN") != 0) {
3601 return False;
3602 }
3603 struct_len = 6;
3604 break;
3605 case 50:
3606 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3607 return False;
3608 }
3609 struct_len = 42;
3610 break;
3611 default:
3612 return False;
3613 }
3614
3615 *rdata_len = mdrcnt;
3616 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3617 if (!*rdata) {
3618 return False;
3619 }
3620
3621 p = *rdata;
3622 p2 = p + struct_len;
3623
3624 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc.syntax_id,
3625 conn->session_info,
3626 conn->sconn->remote_address,
3627 conn->sconn->msg_ctx,
3628 &cli);
3629 if (!NT_STATUS_IS_OK(status)) {
3630 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3631 nt_errstr(status)));
3632 errcode = W_ERROR_V(ntstatus_to_werror(status));
3633 goto out;
3634 }
3635
3636 b = cli->binding_handle;
3637
3638 status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3639 NULL,
3640 101,
3641 &info,
3642 &werr);
3643 if (!NT_STATUS_IS_OK(status)) {
3644 errcode = W_ERROR_V(ntstatus_to_werror(status));
3645 goto out;
3646 }
3647 if (!W_ERROR_IS_OK(werr)) {
3648 errcode = W_ERROR_V(werr);
3649 goto out;
3650 }
3651
3652 if (info.info101 == NULL) {
3653 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3654 goto out;
3655 }
3656
3657 if (uLevel != 20) {
3658 srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3659 STR_ASCII|STR_UPPER|STR_TERMINATE);
3660 }
3661 p += 16;
3662 if (uLevel > 0) {
3663 SCVAL(p,0,info.info101->version_major);
3664 SCVAL(p,1,info.info101->version_minor);
3665 SIVAL(p,2,info.info101->server_type);
3666
3667 if (mdrcnt == struct_len) {
3668 SIVAL(p,6,0);
3669 } else {
3670 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3671 if (mdrcnt - struct_len <= 0) {
3672 return false;
3673 }
3674 push_ascii(p2,
3675 info.info101->comment,
3676 MIN(mdrcnt - struct_len,
3677 MAX_SERVER_STRING_LENGTH),
3678 STR_TERMINATE);
3679 p2 = skip_string(*rdata,*rdata_len,p2);
3680 if (!p2) {
3681 return False;
3682 }
3683 }
3684 }
3685
3686 if (uLevel > 1) {
3687 return False; /* not yet implemented */
3688 }
3689
3690 errcode = NERR_Success;
3691
3692 out:
3693
3694 *rdata_len = PTR_DIFF(p2,*rdata);
3695
3696 *rparam_len = 6;
3697 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3698 if (!*rparam) {
3699 return False;
3700 }
3701 SSVAL(*rparam,0,errcode);
3702 SSVAL(*rparam,2,0); /* converter word */
3703 SSVAL(*rparam,4,*rdata_len);
3704
3705 return True;
3706 }
3707
3708 /****************************************************************************
3709 Get info about the server.
3710 ****************************************************************************/
3711
3712 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3713 connection_struct *conn,uint64_t vuid,
3714 char *param, int tpscnt,
3715 char *data, int tdscnt,
3716 int mdrcnt,int mprcnt,
3717 char **rdata,char **rparam,
3718 int *rdata_len,int *rparam_len)
3719 {
3720 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3721 char *str2 = skip_string(param,tpscnt,str1);
3722 char *p = skip_string(param,tpscnt,str2);
3723 char *p2;
3724 char *endp;
3725 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3726
3727 if (!str1 || !str2 || !p) {
3728 return False;
3729 }
3730
3731 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3732
3733 *rparam_len = 6;
3734 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3735 if (!*rparam) {
3736 return False;
3737 }
3738
3739 /* check it's a supported varient */
3740 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3741 return False;
3742 }
3743
3744 *rdata_len = mdrcnt + 1024;
3745 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3746 if (!*rdata) {
3747 return False;
3748 }
3749
3750 SSVAL(*rparam,0,NERR_Success);
3751 SSVAL(*rparam,2,0); /* converter word */
3752
3753 p = *rdata;
3754 endp = *rdata + *rdata_len;
3755
3756 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3757 if (!p2) {
3758 return False;
3759 }
3760
3761 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3762 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3763 if (!strupper_m(p2)) {
3764 return false;
3765 }
3766 p2 = skip_string(*rdata,*rdata_len,p2);
3767 if (!p2) {
3768 return False;
3769 }
3770 p += 4;
3771
3772 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3773 strlcpy(p2,conn->session_info->unix_info->sanitized_username,PTR_DIFF(endp,p2));
3774 p2 = skip_string(*rdata,*rdata_len,p2);
3775 if (!p2) {
3776 return False;
3777 }
3778 p += 4;
3779
3780 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3781 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3782 if (!strupper_m(p2)) {
3783 return false;
3784 }
3785 p2 = skip_string(*rdata,*rdata_len,p2);
3786 if (!p2) {
3787 return False;
3788 }
3789 p += 4;
3790
3791 SCVAL(p,0,SAMBA_MAJOR_NBT_ANNOUNCE_VERSION); /* system version - e.g 4 in 4.1 */
3792 SCVAL(p,1,SAMBA_MINOR_NBT_ANNOUNCE_VERSION); /* system version - e.g .1 in 4.1 */
3793 p += 2;
3794
3795 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3796 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3797 p2 = skip_string(*rdata,*rdata_len,p2);
3798 if (!p2) {
3799 return False;
3800 }
3801 p += 4;
3802
3803 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3804 strlcpy(p2,"",PTR_DIFF(endp,p2));
3805 p2 = skip_string(*rdata,*rdata_len,p2);
3806 if (!p2) {
3807 return False;
3808 }
3809 p += 4;
3810
3811 *rdata_len = PTR_DIFF(p2,*rdata);
3812
3813 SSVAL(*rparam,4,*rdata_len);
3814
3815 return True;
3816 }
3817
3818 /****************************************************************************
3819 get info about a user
3820
3821 struct user_info_11 {
3822 char usri11_name[21]; 0-20
3823 char usri11_pad; 21
3824 char *usri11_comment; 22-25
3825 char *usri11_usr_comment; 26-29
3826 unsigned short usri11_priv; 30-31
3827 unsigned long usri11_auth_flags; 32-35
3828 long usri11_password_age; 36-39
3829 char *usri11_homedir; 40-43
3830 char *usri11_parms; 44-47
3831 long usri11_last_logon; 48-51
3832 long usri11_last_logoff; 52-55
3833 unsigned short usri11_bad_pw_count; 56-57
3834 unsigned short usri11_num_logons; 58-59
3835 char *usri11_logon_server; 60-63
3836 unsigned short usri11_country_code; 64-65
3837 char *usri11_workstations; 66-69
3838 unsigned long usri11_max_storage; 70-73
3839 unsigned short usri11_units_per_week; 74-75
3840 unsigned char *usri11_logon_hours; 76-79
3841 unsigned short usri11_code_page; 80-81
3842 };
3843
3844 where:
3845
3846 usri11_name specifies the user name for which information is retrieved
3847
3848 usri11_pad aligns the next data structure element to a word boundary
3849
3850 usri11_comment is a null terminated ASCII comment
3851
3852 usri11_user_comment is a null terminated ASCII comment about the user
3853
3854 usri11_priv specifies the level of the privilege assigned to the user.
3855 The possible values are:
3856
3857 Name Value Description
3858 USER_PRIV_GUEST 0 Guest privilege
3859 USER_PRIV_USER 1 User privilege
3860 USER_PRV_ADMIN 2 Administrator privilege
3861
3862 usri11_auth_flags specifies the account operator privileges. The
3863 possible values are:
3864
3865 Name Value Description
3866 AF_OP_PRINT 0 Print operator
3867
3868
3869 Leach, Naik [Page 28]
3870 \f
3871
3872
3873 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3874
3875
3876 AF_OP_COMM 1 Communications operator
3877 AF_OP_SERVER 2 Server operator
3878 AF_OP_ACCOUNTS 3 Accounts operator
3879
3880
3881 usri11_password_age specifies how many seconds have elapsed since the
3882 password was last changed.
3883
3884 usri11_home_dir points to a null terminated ASCII string that contains
3885 the path name of the user's home directory.
3886
3887 usri11_parms points to a null terminated ASCII string that is set
3888 aside for use by applications.
3889
3890 usri11_last_logon specifies the time when the user last logged on.
3891 This value is stored as the number of seconds elapsed since
3892 00:00:00, January 1, 1970.
3893
3894 usri11_last_logoff specifies the time when the user last logged off.
3895 This value is stored as the number of seconds elapsed since
3896 00:00:00, January 1, 1970. A value of 0 means the last logoff
3897 time is unknown.
3898
3899 usri11_bad_pw_count specifies the number of incorrect passwords
3900 entered since the last successful logon.
3901
3902 usri11_log1_num_logons specifies the number of times this user has
3903 logged on. A value of -1 means the number of logons is unknown.
3904
3905 usri11_logon_server points to a null terminated ASCII string that
3906 contains the name of the server to which logon requests are sent.
3907 A null string indicates logon requests should be sent to the
3908 domain controller.
3909
3910 usri11_country_code specifies the country code for the user's language
3911 of choice.
3912
3913 usri11_workstations points to a null terminated ASCII string that
3914 contains the names of workstations the user may log on from.
3915 There may be up to 8 workstations, with the names separated by
3916 commas. A null strings indicates there are no restrictions.
3917
3918 usri11_max_storage specifies the maximum amount of disk space the user
3919 can occupy. A value of 0xffffffff indicates there are no
3920 restrictions.
3921
3922 usri11_units_per_week specifies the equal number of time units into
3923 which a week is divided. This value must be equal to 168.
3924
3925 usri11_logon_hours points to a 21 byte (168 bits) string that
3926 specifies the time during which the user can log on. Each bit
3927 represents one unique hour in a week. The first bit (bit 0, word
3928 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3929
3930
3931
3932 Leach, Naik [Page 29]
3933 \f
3934
3935
3936 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3937
3938
3939 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3940 are no restrictions.
3941
3942 usri11_code_page specifies the code page for the user's language of
3943 choice
3944
3945 All of the pointers in this data structure need to be treated
3946 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3947 to be ignored. The converter word returned in the parameters section
3948 needs to be subtracted from the lower 16 bits to calculate an offset
3949 into the return buffer where this ASCII string resides.
3950
3951 There is no auxiliary data in the response.
3952
3953 ****************************************************************************/
3954
3955 #define usri11_name 0
3956 #define usri11_pad 21
3957 #define usri11_comment 22
3958 #define usri11_usr_comment 26
3959 #define usri11_full_name 30
3960 #define usri11_priv 34
3961 #define usri11_auth_flags 36
3962 #define usri11_password_age 40
3963 #define usri11_homedir 44
3964 #define usri11_parms 48
3965 #define usri11_last_logon 52
3966 #define usri11_last_logoff 56
3967 #define usri11_bad_pw_count 60
3968 #define usri11_num_logons 62
3969 #define usri11_logon_server 64
3970 #define usri11_country_code 68
3971 #define usri11_workstations 70
3972 #define usri11_max_storage 74
3973 #define usri11_units_per_week 78
3974 #define usri11_logon_hours 80
3975 #define usri11_code_page 84
3976 #define usri11_end 86
3977
3978 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
3979 connection_struct *conn, uint64_t vuid,
3980 char *param, int tpscnt,
3981 char *data, int tdscnt,
3982 int mdrcnt,int mprcnt,
3983 char **rdata,char **rparam,
3984 int *rdata_len,int *rparam_len)
3985 {
3986 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3987 char *str2 = skip_string(param,tpscnt,str1);
3988 char *UserName = skip_string(param,tpscnt,str2);
3989 char *p = skip_string(param,tpscnt,UserName);
3990 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3991 char *p2;
3992 char *endp;
3993 const char *level_string;
3994
3995 TALLOC_CTX *mem_ctx = talloc_tos();
3996 NTSTATUS status, result;
3997 struct rpc_pipe_client *cli = NULL;
3998 struct policy_handle connect_handle, domain_handle, user_handle;
3999 struct lsa_String domain_name;
4000 struct dom_sid2 *domain_sid;
4001 struct lsa_String names;
4002 struct samr_Ids rids;
4003 struct samr_Ids types;
4004 int errcode = W_ERROR_V(WERR_USER_NOT_FOUND);
4005 uint32_t rid;
4006 union samr_UserInfo *info;
4007 struct dcerpc_binding_handle *b = NULL;
4008
4009 if (!str1 || !str2 || !UserName || !p) {
4010 return False;
4011 }
4012
4013 *rparam_len = 6;
4014 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4015 if (!*rparam) {
4016 return False;
4017 }
4018
4019 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4020
4021 /* check it's a supported variant */
4022 if (strcmp(str1,"zWrLh") != 0) {
4023 return False;
4024 }
4025 switch( uLevel ) {
4026 case 0: level_string = "B21"; break;
4027 case 1: level_string = "B21BB16DWzzWz"; break;
4028 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4029 case 10: level_string = "B21Bzzz"; break;
4030 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4031 default: return False;
4032 }
4033
4034 if (strcmp(level_string,str2) != 0) {
4035 return False;
4036 }
4037
4038 *rdata_len = mdrcnt + 1024;
4039 *rdata = smb_realloc_limit(*rdata,*rdata_len);
4040 if (!*rdata) {
4041 return False;
4042 }
4043
4044 p = *rdata;
4045 endp = *rdata + *rdata_len;
4046 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4047 if (!p2) {
4048 return False;
4049 }
4050
4051 ZERO_STRUCT(connect_handle);
4052 ZERO_STRUCT(domain_handle);
4053 ZERO_STRUCT(user_handle);
4054
4055 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,
4056 conn->session_info,
4057 conn->sconn->remote_address,
4058 conn->sconn->msg_ctx,
4059 &cli);
4060 if (!NT_STATUS_IS_OK(status)) {
4061 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4062 nt_errstr(status)));
4063 errcode = W_ERROR_V(ntstatus_to_werror(status));
4064 goto out;
4065 }
4066
4067 b = cli->binding_handle;
4068
4069 status = dcerpc_samr_Connect2(b, mem_ctx,
4070 lp_netbios_name(),
4071 SAMR_ACCESS_CONNECT_TO_SERVER |
4072 SAMR_ACCESS_ENUM_DOMAINS |
4073 SAMR_ACCESS_LOOKUP_DOMAIN,
4074 &connect_handle,
4075 &result);
4076 if (!NT_STATUS_IS_OK(status)) {
4077 errcode = W_ERROR_V(ntstatus_to_werror(status));
4078 goto out;
4079 }
4080 if (!NT_STATUS_IS_OK(result)) {
4081 errcode = W_ERROR_V(ntstatus_to_werror(result));
4082 goto out;
4083 }
4084
4085 init_lsa_String(&domain_name, get_global_sam_name());
4086
4087 status = dcerpc_samr_LookupDomain(b, mem_ctx,
4088 &connect_handle,
4089 &domain_name,
4090 &domain_sid,
4091 &result);
4092 if (!NT_STATUS_IS_OK(status)) {
4093 errcode = W_ERROR_V(ntstatus_to_werror(status));
4094 goto out;
4095 }
4096 if (!NT_STATUS_IS_OK(result)) {
4097 errcode = W_ERROR_V(ntstatus_to_werror(result));
4098 goto out;
4099 }
4100
4101 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4102 &connect_handle,
4103 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4104 domain_sid,
4105 &domain_handle,
4106 &result);
4107 if (!NT_STATUS_IS_OK(status)) {
4108 errcode = W_ERROR_V(ntstatus_to_werror(status));
4109 goto out;
4110 }
4111 if (!NT_STATUS_IS_OK(result)) {
4112 errcode = W_ERROR_V(ntstatus_to_werror(result));
4113 goto out;
4114 }
4115
4116 init_lsa_String(&names, UserName);
4117
4118 status = dcerpc_samr_LookupNames(b, mem_ctx,
4119 &domain_handle,
4120 1,
4121 &names,
4122 &rids,
4123 &types,
4124 &result);
4125 if (!NT_STATUS_IS_OK(status)) {
4126 errcode = W_ERROR_V(ntstatus_to_werror(status));
4127 goto out;
4128 }
4129 if (!NT_STATUS_IS_OK(result)) {
4130 errcode = W_ERROR_V(ntstatus_to_werror(result));
4131 goto out;
4132 }
4133
4134 if (rids.count != 1) {
4135 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4136 goto out;
4137 }
4138 if (rids.count != types.count) {
4139 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4140 goto out;
4141 }
4142 if (types.ids[0] != SID_NAME_USER) {
4143 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4144 goto out;
4145 }
4146
4147 rid = rids.ids[0];
4148
4149 status = dcerpc_samr_OpenUser(b, mem_ctx,
4150 &domain_handle,
4151 SAMR_USER_ACCESS_GET_LOCALE |
4152 SAMR_USER_ACCESS_GET_LOGONINFO |
4153 SAMR_USER_ACCESS_GET_ATTRIBUTES |
4154 SAMR_USER_ACCESS_GET_GROUPS |
4155 SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4156 SEC_STD_READ_CONTROL,
4157 rid,
4158 &user_handle,
4159 &result);
4160 if (!NT_STATUS_IS_OK(status)) {
4161 errcode = W_ERROR_V(ntstatus_to_werror(status));
4162 goto out;
4163 }
4164 if (!NT_STATUS_IS_OK(result)) {
4165 errcode = W_ERROR_V(ntstatus_to_werror(result));
4166 goto out;
4167 }
4168
4169 status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4170 &user_handle,
4171 UserAllInformation,
4172 &info,
4173 &result);
4174 if (!NT_STATUS_IS_OK(status)) {
4175 errcode = W_ERROR_V(ntstatus_to_werror(status));
4176 goto out;
4177 }
4178 if (!NT_STATUS_IS_OK(result)) {
4179 errcode = W_ERROR_V(ntstatus_to_werror(result));
4180 goto out;
4181 }
4182
4183 memset(p,0,21);
4184 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4185
4186 if (uLevel > 0) {
4187 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4188 *p2 = 0;
4189 }
4190
4191 if (uLevel >= 10) {
4192 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4193 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4194 p2 = skip_string(*rdata,*rdata_len,p2);
4195 if (!p2) {
4196 return False;
4197 }
4198
4199 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4200 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4201 p2 = skip_string(*rdata,*rdata_len,p2);
4202 if (!p2) {
4203 return False;
4204 }
4205
4206 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4207 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4208 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4209 p2 = skip_string(*rdata,*rdata_len,p2);
4210 if (!p2) {
4211 return False;
4212 }
4213 }
4214
4215 if (uLevel == 11) {
4216 const char *homedir = info->info21.home_directory.string;
4217 /* modelled after NTAS 3.51 reply */
4218 SSVAL(p,usri11_priv,
4219 (get_current_uid(conn) == sec_initial_uid())?
4220 USER_PRIV_ADMIN:USER_PRIV_USER);
4221 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
4222 SIVALS(p,usri11_password_age,-1); /* password age */
4223 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4224 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4225 p2 = skip_string(*rdata,*rdata_len,p2);
4226 if (!p2) {
4227 return False;
4228 }
4229 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4230 strlcpy(p2,"",PTR_DIFF(endp,p2));
4231 p2 = skip_string(*rdata,*rdata_len,p2);
4232 if (!p2) {
4233 return False;
4234 }
4235 SIVAL(p,usri11_last_logon,0); /* last logon */
4236 SIVAL(p,usri11_last_logoff,0); /* last logoff */
4237 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
4238 SSVALS(p,usri11_num_logons,-1); /* num logons */
4239 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4240 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4241 p2 = skip_string(*rdata,*rdata_len,p2);
4242 if (!p2) {
4243 return False;
4244 }
4245 SSVAL(p,usri11_country_code,0); /* country code */
4246
4247 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4248 strlcpy(p2,"",PTR_DIFF(endp,p2));
4249 p2 = skip_string(*rdata,*rdata_len,p2);
4250 if (!p2) {
4251 return False;
4252 }
4253
4254 SIVALS(p,usri11_max_storage,-1); /* max storage */
4255 SSVAL(p,usri11_units_per_week,168); /* units per week */
4256 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4257
4258 /* a simple way to get logon hours at all times. */
4259 memset(p2,0xff,21);
4260 SCVAL(p2,21,0); /* fix zero termination */
4261 p2 = skip_string(*rdata,*rdata_len,p2);
4262 if (!p2) {
4263 return False;
4264 }
4265
4266 SSVAL(p,usri11_code_page,0); /* code page */
4267 }
4268
4269 if (uLevel == 1 || uLevel == 2) {
4270 memset(p+22,' ',16); /* password */
4271 SIVALS(p,38,-1); /* password age */
4272 SSVAL(p,42,
4273 (get_current_uid(conn) == sec_initial_uid())?
4274 USER_PRIV_ADMIN:USER_PRIV_USER);
4275 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4276 strlcpy(p2, info->info21.home_directory.string,
4277 PTR_DIFF(endp,p2));
4278 p2 = skip_string(*rdata,*rdata_len,p2);
4279 if (!p2) {
4280 return False;
4281 }
4282 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4283 *p2++ = 0;
4284 SSVAL(p,52,0); /* flags */
4285 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
4286 strlcpy(p2, info->info21.logon_script.string,
4287 PTR_DIFF(endp,p2));
4288 p2 = skip_string(*rdata,*rdata_len,p2);
4289 if (!p2) {
4290 return False;
4291 }
4292 if (uLevel == 2) {
4293 SIVAL(p,58,0); /* auth_flags */
4294 SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4295 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4296 p2 = skip_string(*rdata,*rdata_len,p2);
4297 if (!p2) {
4298 return False;
4299 }
4300 SIVAL(p,66,0); /* urs_comment */
4301 SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4302 strlcpy(p2,"",PTR_DIFF(endp,p2));
4303 p2 = skip_string(*rdata,*rdata_len,p2);
4304 if (!p2) {
4305 return False;
4306 }
4307 SIVAL(p,74,0); /* workstations */
4308 SIVAL(p,78,0); /* last_logon */
4309 SIVAL(p,82,0); /* last_logoff */
4310 SIVALS(p,86,-1); /* acct_expires */
4311 SIVALS(p,90,-1); /* max_storage */
4312 SSVAL(p,94,168); /* units_per_week */
4313 SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4314 memset(p2,-1,21);
4315 p2 += 21;
4316 SSVALS(p,100,-1); /* bad_pw_count */
4317 SSVALS(p,102,-1); /* num_logons */
4318 SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4319 {
4320 TALLOC_CTX *ctx = talloc_tos();
4321 int space_rem = *rdata_len - (p2 - *rdata);
4322 char *tmp;
4323
4324 if (space_rem <= 0) {
4325 return false;
4326 }
4327 tmp = talloc_strdup(ctx, "\\\\%L");
4328 if (!tmp) {
4329 return false;
4330 }
4331 tmp = talloc_sub_basic(ctx,
4332 "",
4333 "",
4334 tmp);
4335 if (!tmp) {
4336 return false;
4337 }
4338
4339 push_ascii(p2,
4340 tmp,
4341 space_rem,
4342 STR_TERMINATE);
4343 }
4344 p2 = skip_string(*rdata,*rdata_len,p2);
4345 if (!p2) {
4346 return False;
4347 }
4348 SSVAL(p,108,49); /* country_code */
4349 SSVAL(p,110,860); /* code page */
4350 }
4351 }
4352
4353 errcode = NERR_Success;
4354
4355 out:
4356 *rdata_len = PTR_DIFF(p2,*rdata);
4357
4358 if (b && is_valid_policy_hnd(&user_handle)) {
4359 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4360 }
4361 if (b && is_valid_policy_hnd(&domain_handle)) {
4362 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4363 }
4364 if (b && is_valid_policy_hnd(&connect_handle)) {
4365 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4366 }
4367
4368 SSVAL(*rparam,0,errcode);
4369 SSVAL(*rparam,2,0); /* converter word */
4370 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
4371
4372 return(True);
4373 }
4374
4375 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4376 connection_struct *conn,uint64_t vuid,
4377 char *param, int tpscnt,
4378 char *data, int tdscnt,
4379 int mdrcnt,int mprcnt,
4380 char **rdata,char **rparam,
4381 int *rdata_len,int *rparam_len)
4382 {
4383 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4384 char *str2 = skip_string(param,tpscnt,str1);
4385 char *p = skip_string(param,tpscnt,str2);
4386 int uLevel;
4387 struct pack_desc desc;
4388 char* name;
4389 /* With share level security vuid will always be zero.
4390 Don't depend on vuser being non-null !!. JRA */
4391 struct user_struct *vuser = get_valid_user_struct(sconn, vuid);
4392
4393 if (!str1 || !str2 || !p) {
4394 return False;
4395 }
4396
4397 if(vuser != NULL) {
4398 DEBUG(3,(" Username of UID %d is %s\n",
4399 (int)vuser->session_info->unix_token->uid,
4400 vuser->session_info->unix_info->unix_name));
4401 }
4402
4403 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4404 name = get_safe_str_ptr(param,tpscnt,p,2);
4405 if (!name) {
4406 return False;
4407 }
4408
4409 memset((char *)&desc,'\0',sizeof(desc));
4410
4411 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4412
4413 /* check it's a supported varient */
4414 if (strcmp(str1,"OOWb54WrLh") != 0) {
4415 return False;
4416 }
4417 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4418 return False;
4419 }
4420 if (mdrcnt > 0) {
4421 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4422 if (!*rdata) {
4423 return False;
4424 }
4425 }
4426
4427 desc.base = *rdata;
4428 desc.buflen = mdrcnt;
4429 desc.subformat = NULL;
4430 desc.format = str2;
4431
4432 if (init_package(&desc,1,0)) {
4433 PACKI(&desc,"W",0); /* code */
4434 PACKS(&desc,"B21",name); /* eff. name */
4435 PACKS(&desc,"B",""); /* pad */
4436 PACKI(&desc,"W",
4437 (get_current_uid(conn) == sec_initial_uid())?
4438 USER_PRIV_ADMIN:USER_PRIV_USER);
4439 PACKI(&desc,"D",0); /* auth flags XXX */
4440 PACKI(&desc,"W",0); /* num logons */
4441 PACKI(&desc,"W",0); /* bad pw count */
4442 PACKI(&desc,"D",0); /* last logon */
4443 PACKI(&desc,"D",-1); /* last logoff */
4444 PACKI(&desc,"D",-1); /* logoff time */
4445 PACKI(&desc,"D",-1); /* kickoff time */
4446 PACKI(&desc,"D",0); /* password age */
4447 PACKI(&desc,"D",0); /* password can change */
4448 PACKI(&desc,"D",-1); /* password must change */
4449
4450 {
4451 fstring mypath;
4452 fstrcpy(mypath,"\\\\");
4453 fstrcat(mypath,get_local_machine_name());
4454 if (!strupper_m(mypath)) {
4455 return false;
4456 }
4457 PACKS(&desc,"z",mypath); /* computer */
4458 }
4459
4460 PACKS(&desc,"z",lp_workgroup());/* domain */
4461 PACKS(&desc,"z", vuser ?
4462 vuser->session_info->info->logon_script
4463 : ""); /* script path */
4464 PACKI(&desc,"D",0x00000000); /* reserved */
4465 }
4466
4467 *rdata_len = desc.usedlen;
4468 *rparam_len = 6;
4469 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4470 if (!*rparam) {
4471 return False;
4472 }
4473 SSVALS(*rparam,0,desc.errcode);
4474 SSVAL(*rparam,2,0);
4475 SSVAL(*rparam,4,desc.neededlen);
4476
4477 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4478
4479 return True;
4480 }
4481
4482 /****************************************************************************
4483 api_WAccessGetUserPerms
4484 ****************************************************************************/
4485
4486 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4487 connection_struct *conn,uint64_t vuid,
4488 char *param, int tpscnt,
4489 char *data, int tdscnt,
4490 int mdrcnt,int mprcnt,
4491 char **rdata,char **rparam,
4492 int *rdata_len,int *rparam_len)
4493 {
4494 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4495 char *str2 = skip_string(param,tpscnt,str1);
4496 char *user = skip_string(param,tpscnt,str2);
4497 char *resource = skip_string(param,tpscnt,user);
4498
4499 if (!str1 || !str2 || !user || !resource) {
4500 return False;
4501 }
4502
4503 if (skip_string(param,tpscnt,resource) == NULL) {
4504 return False;
4505 }
4506 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4507
4508 /* check it's a supported varient */
4509 if (strcmp(str1,"zzh") != 0) {
4510 return False;
4511 }
4512 if (strcmp(str2,"") != 0) {
4513 return False;
4514 }
4515
4516 *rparam_len = 6;
4517 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4518 if (!*rparam) {
4519 return False;
4520 }
4521 SSVALS(*rparam,0,0); /* errorcode */
4522 SSVAL(*rparam,2,0); /* converter word */
4523 SSVAL(*rparam,4,0x7f); /* permission flags */
4524
4525 return True;
4526 }
4527
4528 /****************************************************************************
4529 api_WPrintJobEnumerate
4530 ****************************************************************************/
4531
4532 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4533 connection_struct *conn, uint64_t vuid,
4534 char *param, int tpscnt,
4535 char *data, int tdscnt,
4536 int mdrcnt,int mprcnt,
4537 char **rdata,char **rparam,
4538 int *rdata_len,int *rparam_len)
4539 {
4540 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4541 char *str2 = skip_string(param,tpscnt,str1);
4542 char *p = skip_string(param,tpscnt,str2);
4543 int uLevel;
4544 fstring sharename;
4545 uint32 jobid;
4546 struct pack_desc desc;
4547 char *tmpdata=NULL;
4548
4549 TALLOC_CTX *mem_ctx = talloc_tos();
4550 WERROR werr;
4551 NTSTATUS status;
4552 struct rpc_pipe_client *cli = NULL;
4553 struct dcerpc_binding_handle *b = NULL;
4554 struct policy_handle handle;
4555 struct spoolss_DevmodeContainer devmode_ctr;
4556 union spoolss_JobInfo info;
4557
4558 if (!str1 || !str2 || !p) {
4559 return False;
4560 }
4561
4562 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4563
4564 memset((char *)&desc,'\0',sizeof(desc));
4565 memset((char *)&status,'\0',sizeof(status));
4566
4567 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4568
4569 /* check it's a supported varient */
4570 if (strcmp(str1,"WWrLh") != 0) {
4571 return False;
4572 }
4573 if (!check_printjob_info(&desc,uLevel,str2)) {
4574 return False;
4575 }
4576
4577 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4578 return False;
4579 }
4580
4581 ZERO_STRUCT(handle);
4582
4583 status = rpc_pipe_open_interface(conn,
4584 &ndr_table_spoolss.syntax_id,
4585 conn->session_info,
4586 conn->sconn->remote_address,
4587 conn->sconn->msg_ctx,
4588 &cli);
4589 if (!NT_STATUS_IS_OK(status)) {
4590 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4591 nt_errstr(status)));
4592 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4593 goto out;
4594 }
4595 b = cli->binding_handle;
4596
4597 ZERO_STRUCT(devmode_ctr);
4598
4599 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4600 sharename,
4601 "RAW",
4602 devmode_ctr,
4603 PRINTER_ACCESS_USE,
4604 &handle,
4605 &werr);
4606 if (!NT_STATUS_IS_OK(status)) {
4607 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4608 goto out;
4609 }
4610 if (!W_ERROR_IS_OK(werr)) {
4611 desc.errcode = W_ERROR_V(werr);
4612 goto out;
4613 }
4614
4615 werr = rpccli_spoolss_getjob(cli, mem_ctx,
4616 &handle,
4617 jobid,
4618 2, /* level */
4619 0, /* offered */
4620 &info);
4621 if (!W_ERROR_IS_OK(werr)) {
4622 desc.errcode = W_ERROR_V(werr);
4623 goto out;
4624 }
4625
4626 if (mdrcnt > 0) {
4627 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4628 if (!*rdata) {
4629 return False;
4630 }
4631 desc.base = *rdata;
4632 desc.buflen = mdrcnt;
4633 } else {
4634 /*
4635 * Don't return data but need to get correct length
4636 * init_package will return wrong size if buflen=0
4637 */
4638 desc.buflen = getlen(desc.format);
4639 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4640 }
4641
4642 if (init_package(&desc,1,0)) {
4643 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4644 *rdata_len = desc.usedlen;
4645 } else {
4646 desc.errcode = NERR_JobNotFound;
4647 *rdata_len = 0;
4648 }
4649 out:
4650 if (b && is_valid_policy_hnd(&handle)) {
4651 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4652 }
4653
4654 *rparam_len = 6;
4655 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4656 if (!*rparam) {
4657 return False;
4658 }
4659 SSVALS(*rparam,0,desc.errcode);
4660 SSVAL(*rparam,2,0);
4661 SSVAL(*rparam,4,desc.neededlen);
4662
4663 SAFE_FREE(tmpdata);
4664
4665 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4666
4667 return True;
4668 }
4669
4670 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4671 connection_struct *conn, uint64_t vuid,
4672 char *param, int tpscnt,
4673 char *data, int tdscnt,
4674 int mdrcnt,int mprcnt,
4675 char **rdata,char **rparam,
4676 int *rdata_len,int *rparam_len)
4677 {
4678 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4679 char *str2 = skip_string(param,tpscnt,str1);
4680 char *p = skip_string(param,tpscnt,str2);
4681 char *name = p;
4682 int uLevel;
4683 int i, succnt=0;
4684 struct pack_desc desc;
4685
4686 TALLOC_CTX *mem_ctx = talloc_tos();
4687 WERROR werr;
4688 NTSTATUS status;
4689 struct rpc_pipe_client *cli = NULL;
4690 struct dcerpc_binding_handle *b = NULL;
4691 struct policy_handle handle;
4692 struct spoolss_DevmodeContainer devmode_ctr;
4693 uint32_t count = 0;
4694 union spoolss_JobInfo *info;
4695
4696 if (!str1 || !str2 || !p) {
4697 return False;
4698 }
4699
4700 memset((char *)&desc,'\0',sizeof(desc));
4701
4702 p = skip_string(param,tpscnt,p);
4703 if (!p) {
4704 return False;
4705 }
4706 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4707
4708 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4709
4710 /* check it's a supported variant */
4711 if (strcmp(str1,"zWrLeh") != 0) {
4712 return False;
4713 }
4714
4715 if (uLevel > 2) {
4716 return False; /* defined only for uLevel 0,1,2 */
4717 }
4718
4719 if (!check_printjob_info(&desc,uLevel,str2)) {
4720 return False;
4721 }
4722
4723 ZERO_STRUCT(handle);
4724
4725 status = rpc_pipe_open_interface(conn,
4726 &ndr_table_spoolss.syntax_id,
4727 conn->session_info,
4728 conn->sconn->remote_address,
4729 conn->sconn->msg_ctx,
4730 &cli);
4731 if (!NT_STATUS_IS_OK(status)) {
4732 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4733 nt_errstr(status)));
4734 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4735 goto out;
4736 }
4737 b = cli->binding_handle;
4738
4739 ZERO_STRUCT(devmode_ctr);
4740
4741 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4742 name,
4743 NULL,
4744 devmode_ctr,
4745 PRINTER_ACCESS_USE,
4746 &handle,
4747 &werr);
4748 if (!NT_STATUS_IS_OK(status)) {
4749 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4750 goto out;
4751 }
4752 if (!W_ERROR_IS_OK(werr)) {
4753 desc.errcode = W_ERROR_V(werr);
4754 goto out;
4755 }
4756
4757 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4758 &handle,
4759 0, /* firstjob */
4760 0xff, /* numjobs */
4761 2, /* level */
4762 0, /* offered */
4763 &count,
4764 &info);
4765 if (!W_ERROR_IS_OK(werr)) {
4766 desc.errcode = W_ERROR_V(werr);
4767 goto out;
4768 }
4769
4770 if (mdrcnt > 0) {
4771 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4772 if (!*rdata) {
4773 return False;
4774 }
4775 }
4776 desc.base = *rdata;
4777 desc.buflen = mdrcnt;
4778
4779 if (init_package(&desc,count,0)) {
4780 succnt = 0;
4781 for (i = 0; i < count; i++) {
4782 fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4783 if (desc.errcode == NERR_Success) {
4784 succnt = i+1;
4785 }
4786 }
4787 }
4788 out:
4789 if (b && is_valid_policy_hnd(&handle)) {
4790 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4791 }
4792
4793 *rdata_len = desc.usedlen;
4794
4795 *rparam_len = 8;
4796 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4797 if (!*rparam) {
4798 return False;
4799 }
4800 SSVALS(*rparam,0,desc.errcode);
4801 SSVAL(*rparam,2,0);
4802 SSVAL(*rparam,4,succnt);
4803 SSVAL(*rparam,6,count);
4804
4805 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4806
4807 return True;
4808 }
4809
4810 static int check_printdest_info(struct pack_desc* desc,
4811 int uLevel, char* id)
4812 {
4813 desc->subformat = NULL;
4814 switch( uLevel ) {
4815 case 0:
4816 desc->format = "B9";
4817 break;
4818 case 1:
4819 desc->format = "B9B21WWzW";
4820 break;
4821 case 2:
4822 desc->format = "z";
4823 break;
4824 case 3:
4825 desc->format = "zzzWWzzzWW";
4826 break;
4827 default:
4828 DEBUG(0,("check_printdest_info: invalid level %d\n",
4829 uLevel));
4830 return False;
4831 }
4832 if (id == NULL || strcmp(desc->format,id) != 0) {
4833 DEBUG(0,("check_printdest_info: invalid string %s\n",
4834 id ? id : "<NULL>" ));
4835 return False;
4836 }
4837 return True;
4838 }
4839
4840 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4841 struct pack_desc* desc)
4842 {
4843 char buf[100];
4844
4845 strncpy(buf, info2->printername, sizeof(buf)-1);
4846 buf[sizeof(buf)-1] = 0;
4847 (void)strupper_m(buf);
4848
4849 if (uLevel <= 1) {
4850 PACKS(desc,"B9",buf); /* szName */
4851 if (uLevel == 1) {
4852 PACKS(desc,"B21",""); /* szUserName */
4853 PACKI(desc,"W",0); /* uJobId */
4854 PACKI(desc,"W",0); /* fsStatus */
4855 PACKS(desc,"z",""); /* pszStatus */
4856 PACKI(desc,"W",0); /* time */
4857 }
4858 }
4859
4860 if (uLevel == 2 || uLevel == 3) {
4861 PACKS(desc,"z",buf); /* pszPrinterName */
4862 if (uLevel == 3) {
4863 PACKS(desc,"z",""); /* pszUserName */
4864 PACKS(desc,"z",""); /* pszLogAddr */
4865 PACKI(desc,"W",0); /* uJobId */
4866 PACKI(desc,"W",0); /* fsStatus */
4867 PACKS(desc,"z",""); /* pszStatus */
4868 PACKS(desc,"z",""); /* pszComment */
4869 PACKS(desc,"z","NULL"); /* pszDrivers */
4870 PACKI(desc,"W",0); /* time */
4871 PACKI(desc,"W",0); /* pad1 */
4872 }
4873 }
4874 }
4875
4876 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
4877 connection_struct *conn, uint64_t vuid,
4878 char *param, int tpscnt,
4879 char *data, int tdscnt,
4880 int mdrcnt,int mprcnt,
4881 char **rdata,char **rparam,
4882 int *rdata_len,int *rparam_len)
4883 {
4884 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4885 char *str2 = skip_string(param,tpscnt,str1);
4886 char *p = skip_string(param,tpscnt,str2);
4887 char* PrinterName = p;
4888 int uLevel;
4889 struct pack_desc desc;
4890 char *tmpdata=NULL;
4891
4892 TALLOC_CTX *mem_ctx = talloc_tos();
4893 WERROR werr;
4894 NTSTATUS status;
4895 struct rpc_pipe_client *cli = NULL;
4896 struct dcerpc_binding_handle *b = NULL;
4897 struct policy_handle handle;
4898 struct spoolss_DevmodeContainer devmode_ctr;
4899 union spoolss_PrinterInfo info;
4900
4901 if (!str1 || !str2 || !p) {
4902 return False;
4903 }
4904
4905 memset((char *)&desc,'\0',sizeof(desc));
4906
4907 p = skip_string(param,tpscnt,p);
4908 if (!p) {
4909 return False;
4910 }
4911 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4912
4913 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4914
4915 /* check it's a supported varient */
4916 if (strcmp(str1,"zWrLh") != 0) {
4917 return False;
4918 }
4919 if (!check_printdest_info(&desc,uLevel,str2)) {
4920 return False;
4921 }
4922
4923 ZERO_STRUCT(handle);
4924
4925 status = rpc_pipe_open_interface(conn,
4926 &ndr_table_spoolss.syntax_id,
4927 conn->session_info,
4928 conn->sconn->remote_address,
4929 conn->sconn->msg_ctx,
4930 &cli);
4931 if (!NT_STATUS_IS_OK(status)) {
4932 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
4933 nt_errstr(status)));
4934 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4935 goto out;
4936 }
4937 b = cli->binding_handle;
4938
4939 ZERO_STRUCT(devmode_ctr);
4940
4941 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4942 PrinterName,
4943 NULL,
4944 devmode_ctr,
4945 PRINTER_ACCESS_USE,
4946 &handle,
4947 &werr);
4948 if (!NT_STATUS_IS_OK(status)) {
4949 *rdata_len = 0;
4950 desc.errcode = NERR_DestNotFound;
4951 desc.neededlen = 0;
4952 goto out;
4953 }
4954 if (!W_ERROR_IS_OK(werr)) {
4955 *rdata_len = 0;
4956 desc.errcode = NERR_DestNotFound;
4957 desc.neededlen = 0;
4958 goto out;
4959 }
4960
4961 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
4962 &handle,
4963 2,
4964 0,
4965 &info);
4966 if (!W_ERROR_IS_OK(werr)) {
4967 *rdata_len = 0;
4968 desc.errcode = NERR_DestNotFound;
4969 desc.neededlen = 0;
4970 goto out;
4971 }
4972
4973 if (mdrcnt > 0) {
4974 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4975 if (!*rdata) {
4976 return False;
4977 }
4978 desc.base = *rdata;
4979 desc.buflen = mdrcnt;
4980 } else {
4981 /*
4982 * Don't return data but need to get correct length
4983 * init_package will return wrong size if buflen=0
4984 */
4985 desc.buflen = getlen(desc.format);
4986 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4987 }
4988 if (init_package(&desc,1,0)) {
4989 fill_printdest_info(&info.info2, uLevel,&desc);
4990 }
4991
4992 out:
4993 if (b && is_valid_policy_hnd(&handle)) {
4994 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4995 }
4996
4997 *rdata_len = desc.usedlen;
4998
4999 *rparam_len = 6;
5000 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5001 if (!*rparam) {
5002 return False;
5003 }
5004 SSVALS(*rparam,0,desc.errcode);
5005 SSVAL(*rparam,2,0);
5006 SSVAL(*rparam,4,desc.neededlen);
5007
5008 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5009 SAFE_FREE(tmpdata);
5010
5011 return True;
5012 }
5013
5014 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5015 connection_struct *conn, uint64_t vuid,
5016 char *param, int tpscnt,
5017 char *data, int tdscnt,
5018 int mdrcnt,int mprcnt,
5019 char **rdata,char **rparam,
5020 int *rdata_len,int *rparam_len)
5021 {
5022 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5023 char *str2 = skip_string(param,tpscnt,str1);
5024 char *p = skip_string(param,tpscnt,str2);
5025 int uLevel;
5026 int queuecnt;
5027 int i, n, succnt=0;
5028 struct pack_desc desc;
5029
5030 TALLOC_CTX *mem_ctx = talloc_tos();
5031 WERROR werr;
5032 NTSTATUS status;
5033 struct rpc_pipe_client *cli = NULL;
5034 union spoolss_PrinterInfo *info;
5035 uint32_t count;
5036
5037 if (!str1 || !str2 || !p) {
5038 return False;
5039 }
5040
5041 memset((char *)&desc,'\0',sizeof(desc));
5042
5043 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5044
5045 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5046
5047 /* check it's a supported varient */
5048 if (strcmp(str1,"WrLeh") != 0) {
5049 return False;
5050 }
5051 if (!check_printdest_info(&desc,uLevel,str2)) {
5052 return False;
5053 }
5054
5055 queuecnt = 0;
5056
5057 status = rpc_pipe_open_interface(conn,
5058 &ndr_table_spoolss.syntax_id,
5059 conn->session_info,
5060 conn->sconn->remote_address,
5061 conn->sconn->msg_ctx,
5062 &cli);
5063 if (!NT_STATUS_IS_OK(status)) {
5064 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5065 nt_errstr(status)));
5066 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5067 goto out;
5068 }
5069
5070 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5071 PRINTER_ENUM_LOCAL,
5072 cli->srv_name_slash,
5073 2,
5074 0,
5075 &count,
5076 &info);
5077 if (!W_ERROR_IS_OK(werr)) {
5078 desc.errcode = W_ERROR_V(werr);
5079 *rdata_len = 0;
5080 desc.errcode = NERR_DestNotFound;
5081 desc.neededlen = 0;
5082 goto out;
5083 }
5084
5085 queuecnt = count;
5086
5087 if (mdrcnt > 0) {
5088 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5089 if (!*rdata) {
5090 return False;
5091 }
5092 }
5093
5094 desc.base = *rdata;
5095 desc.buflen = mdrcnt;
5096 if (init_package(&desc,queuecnt,0)) {
5097 succnt = 0;
5098 n = 0;
5099 for (i = 0; i < count; i++) {
5100 fill_printdest_info(&info[i].info2, uLevel,&desc);
5101 n++;
5102 if (desc.errcode == NERR_Success) {
5103 succnt = n;
5104 }
5105 }
5106 }
5107 out:
5108 *rdata_len = desc.usedlen;
5109
5110 *rparam_len = 8;
5111 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5112 if (!*rparam) {
5113 return False;
5114 }
5115 SSVALS(*rparam,0,desc.errcode);
5116 SSVAL(*rparam,2,0);
5117 SSVAL(*rparam,4,succnt);
5118 SSVAL(*rparam,6,queuecnt);
5119
5120 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5121
5122 return True;
5123 }
5124
5125 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5126 connection_struct *conn, uint64_t vuid,
5127 char *param, int tpscnt,
5128 char *data, int tdscnt,
5129 int mdrcnt,int mprcnt,
5130 char **rdata,char **rparam,
5131 int *rdata_len,int *rparam_len)
5132 {
5133 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5134 char *str2 = skip_string(param,tpscnt,str1);
5135 char *p = skip_string(param,tpscnt,str2);
5136 int uLevel;
5137 int succnt;
5138 struct pack_desc desc;
5139
5140 if (!str1 || !str2 || !p) {
5141 return False;
5142 }
5143
5144 memset((char *)&desc,'\0',sizeof(desc));
5145
5146 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5147
5148 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5149
5150 /* check it's a supported varient */
5151 if (strcmp(str1,"WrLeh") != 0) {
5152 return False;
5153 }
5154 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5155 return False;
5156 }
5157
5158 if (mdrcnt > 0) {
5159 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5160 if (!*rdata) {
5161 return False;
5162 }
5163 }
5164 desc.base = *rdata;
5165 desc.buflen = mdrcnt;
5166 if (init_package(&desc,1,0)) {
5167 PACKS(&desc,"B41","NULL");
5168 }
5169
5170 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5171
5172 *rdata_len = desc.usedlen;
5173
5174 *rparam_len = 8;
5175 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5176 if (!*rparam) {
5177 return False;
5178 }
5179 SSVALS(*rparam,0,desc.errcode);
5180 SSVAL(*rparam,2,0);
5181 SSVAL(*rparam,4,succnt);
5182 SSVAL(*rparam,6,1);
5183
5184 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5185
5186 return True;
5187 }
5188
5189 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5190 connection_struct *conn, uint64_t vuid,
5191 char *param, int tpscnt,
5192 char *data, int tdscnt,
5193 int mdrcnt,int mprcnt,
5194 char **rdata,char **rparam,
5195 int *rdata_len,int *rparam_len)
5196 {
5197 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5198 char *str2 = skip_string(param,tpscnt,str1);
5199 char *p = skip_string(param,tpscnt,str2);
5200 int uLevel;
5201 int succnt;
5202 struct pack_desc desc;
5203
5204 if (!str1 || !str2 || !p) {
5205 return False;
5206 }
5207 memset((char *)&desc,'\0',sizeof(desc));
5208
5209 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5210
5211 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5212
5213 /* check it's a supported varient */
5214 if (strcmp(str1,"WrLeh") != 0) {
5215 return False;
5216 }
5217 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5218 return False;
5219 }
5220
5221 if (mdrcnt > 0) {
5222 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5223 if (!*rdata) {
5224 return False;
5225 }
5226 }
5227 desc.base = *rdata;
5228 desc.buflen = mdrcnt;
5229 desc.format = str2;
5230 if (init_package(&desc,1,0)) {
5231 PACKS(&desc,"B13","lpd");
5232 }
5233
5234 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5235
5236 *rdata_len = desc.usedlen;
5237
5238 *rparam_len = 8;
5239 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5240 if (!*rparam) {
5241 return False;
5242 }
5243 SSVALS(*rparam,0,desc.errcode);
5244 SSVAL(*rparam,2,0);
5245 SSVAL(*rparam,4,succnt);
5246 SSVAL(*rparam,6,1);
5247
5248 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5249
5250 return True;
5251 }
5252
5253 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5254 connection_struct *conn, uint64_t vuid,
5255 char *param, int tpscnt,
5256 char *data, int tdscnt,
5257 int mdrcnt,int mprcnt,
5258 char **rdata,char **rparam,
5259 int *rdata_len,int *rparam_len)
5260 {
5261 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5262 char *str2 = skip_string(param,tpscnt,str1);
5263 char *p = skip_string(param,tpscnt,str2);
5264 int uLevel;
5265 int succnt;
5266 struct pack_desc desc;
5267
5268 if (!str1 || !str2 || !p) {
5269 return False;
5270 }
5271
5272 memset((char *)&desc,'\0',sizeof(desc));
5273
5274 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5275
5276 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5277
5278 /* check it's a supported varient */
5279 if (strcmp(str1,"WrLeh") != 0) {
5280 return False;
5281 }
5282 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5283 return False;
5284 }
5285
5286 if (mdrcnt > 0) {
5287 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5288 if (!*rdata) {
5289 return False;
5290 }
5291 }
5292 memset((char *)&desc,'\0',sizeof(desc));
5293 desc.base = *rdata;
5294 desc.buflen = mdrcnt;
5295 desc.format = str2;
5296 if (init_package(&desc,1,0)) {
5297 PACKS(&desc,"B13","lp0");
5298 }
5299
5300 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5301
5302 *rdata_len = desc.usedlen;
5303
5304 *rparam_len = 8;
5305 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5306 if (!*rparam) {
5307 return False;
5308 }
5309 SSVALS(*rparam,0,desc.errcode);
5310 SSVAL(*rparam,2,0);
5311 SSVAL(*rparam,4,succnt);
5312 SSVAL(*rparam,6,1);
5313
5314 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5315
5316 return True;
5317 }
5318
5319 /****************************************************************************
5320 List open sessions
5321 ****************************************************************************/
5322
5323 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5324 connection_struct *conn, uint64_t vuid,
5325 char *param, int tpscnt,
5326 char *data, int tdscnt,
5327 int mdrcnt,int mprcnt,
5328 char **rdata,char **rparam,
5329 int *rdata_len,int *rparam_len)
5330
5331 {
5332 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5333 char *str2 = skip_string(param,tpscnt,str1);
5334 char *p = skip_string(param,tpscnt,str2);
5335 int uLevel;
5336 struct pack_desc desc;
5337 int i;
5338
5339 TALLOC_CTX *mem_ctx = talloc_tos();
5340 WERROR werr;
5341 NTSTATUS status;
5342 struct rpc_pipe_client *cli = NULL;
5343 struct dcerpc_binding_handle *b = NULL;
5344 struct srvsvc_NetSessInfoCtr info_ctr;
5345 uint32_t totalentries, resume_handle = 0;
5346 uint32_t count = 0;
5347
5348 if (!str1 || !str2 || !p) {
5349 return False;
5350 }
5351
5352 ZERO_STRUCT(desc);
5353
5354 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5355
5356 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5357 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5358 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5359
5360 /* check it's a supported varient */
5361 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5362 return False;
5363 }
5364 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5365 return False;
5366 }
5367
5368 status = rpc_pipe_open_interface(conn,
5369 &ndr_table_srvsvc.syntax_id,
5370 conn->session_info,
5371 conn->sconn->remote_address,
5372 conn->sconn->msg_ctx,
5373 &cli);
5374 if (!NT_STATUS_IS_OK(status)) {
5375 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5376 nt_errstr(status)));
5377 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5378 goto out;
5379 }
5380 b = cli->binding_handle;
5381
5382 info_ctr.level = 1;
5383 info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5384 if (info_ctr.ctr.ctr1 == NULL) {
5385 desc.errcode = W_ERROR_V(WERR_NOMEM);
5386 goto out;
5387 }
5388
5389 status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5390 cli->srv_name_slash,
5391 NULL, /* client */
5392 NULL, /* user */
5393 &info_ctr,
5394 (uint32_t)-1, /* max_buffer */
5395 &totalentries,
5396 &resume_handle,
5397 &werr);
5398 if (!NT_STATUS_IS_OK(status)) {
5399 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5400 nt_errstr(status)));
5401 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5402 goto out;
5403 }
5404
5405 if (!W_ERROR_IS_OK(werr)) {
5406 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5407 win_errstr(werr)));
5408 desc.errcode = W_ERROR_V(werr);
5409 goto out;
5410 }
5411
5412 count = info_ctr.ctr.ctr1->count;
5413
5414 out:
5415 if (mdrcnt > 0) {
5416 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5417 if (!*rdata) {
5418 return False;
5419 }
5420 }
5421
5422 desc.base = *rdata;
5423 desc.buflen = mdrcnt;
5424 desc.format = str2;
5425 if (!init_package(&desc, count,0)) {
5426 return False;
5427 }
5428
5429 for(i=0; i < count; i++) {
5430 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5431 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5432 PACKI(&desc, "W", 1); /* num conns */
5433 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5434 PACKI(&desc, "W", 1); /* num users */
5435 PACKI(&desc, "D", 0); /* session time */
5436 PACKI(&desc, "D", 0); /* idle time */
5437 PACKI(&desc, "D", 0); /* flags */
5438 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5439 }
5440
5441 *rdata_len = desc.usedlen;
5442
5443 *rparam_len = 8;
5444 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5445 if (!*rparam) {
5446 return False;
5447 }
5448 SSVALS(*rparam,0,desc.errcode);
5449 SSVAL(*rparam,2,0); /* converter */
5450 SSVAL(*rparam,4, count); /* count */
5451
5452 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5453
5454 return True;
5455 }
5456
5457
5458 /****************************************************************************
5459 The buffer was too small.
5460 ****************************************************************************/
5461
5462 static bool api_TooSmall(struct smbd_server_connection *sconn,
5463 connection_struct *conn,uint64_t vuid, char *param, char *data,
5464 int mdrcnt, int mprcnt,
5465 char **rdata, char **rparam,
5466 int *rdata_len, int *rparam_len)
5467 {
5468 *rparam_len = MIN(*rparam_len,mprcnt);
5469 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5470 if (!*rparam) {
5471 return False;
5472 }
5473
5474 *rdata_len = 0;
5475
5476 SSVAL(*rparam,0,NERR_BufTooSmall);
5477
5478 DEBUG(3,("Supplied buffer too small in API command\n"));
5479
5480 return True;
5481 }
5482
5483 /****************************************************************************
5484 The request is not supported.
5485 ****************************************************************************/
5486
5487 static bool api_Unsupported(struct smbd_server_connection *sconn,
5488 connection_struct *conn, uint64_t vuid,
5489 char *param, int tpscnt,
5490 char *data, int tdscnt,
5491 int mdrcnt, int mprcnt,
5492 char **rdata, char **rparam,
5493 int *rdata_len, int *rparam_len)
5494 {
5495 *rparam_len = 4;
5496 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5497 if (!*rparam) {
5498 return False;
5499 }
5500
5501 *rdata_len = 0;
5502
5503 SSVAL(*rparam,0,NERR_notsupported);
5504 SSVAL(*rparam,2,0); /* converter word */
5505
5506 DEBUG(3,("Unsupported API command\n"));
5507
5508 return True;
5509 }
5510
5511 static const struct {
5512 const char *name;
5513 int id;
5514 bool (*fn)(struct smbd_server_connection *sconn,
5515 connection_struct *, uint64_t,
5516 char *, int,
5517 char *, int,
5518 int,int,char **,char **,int *,int *);
5519 bool auth_user; /* Deny anonymous access? */
5520 } api_commands[] = {
5521 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
5522 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
5523 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
5524 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
5525 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
5526 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
5527 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
5528 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
5529 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
5530 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
5531 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
5532 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
5533 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
5534 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
5535 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
5536 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
5537 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
5538 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
5539 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
5540 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
5541 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
5542 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
5543 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
5544 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
5545 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
5546 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
5547 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5548 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
5549 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
5550 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
5551 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5552 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
5553 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5554 {NULL, -1, api_Unsupported}
5555 /* The following RAP calls are not implemented by Samba:
5556
5557 RAP_WFileEnum2 - anon not OK
5558 */
5559 };
5560
5561
5562 /****************************************************************************
5563 Handle remote api calls.
5564 ****************************************************************************/
5565
5566 void api_reply(connection_struct *conn, uint64_t vuid,
5567 struct smb_request *req,
5568 char *data, char *params,
5569 int tdscnt, int tpscnt,
5570 int mdrcnt, int mprcnt)
5571 {
5572 int api_command;
5573 char *rdata = NULL;
5574 char *rparam = NULL;
5575 const char *name1 = NULL;
5576 const char *name2 = NULL;
5577 int rdata_len = 0;
5578 int rparam_len = 0;
5579 bool reply=False;
5580 int i;
5581
5582 if (!params) {
5583 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5584 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5585 return;
5586 }
5587
5588 if (tpscnt < 2) {
5589 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5590 return;
5591 }
5592 api_command = SVAL(params,0);
5593 /* Is there a string at position params+2 ? */
5594 if (skip_string(params,tpscnt,params+2)) {
5595 name1 = params + 2;
5596 } else {
5597 name1 = "";
5598 }
5599 name2 = skip_string(params,tpscnt,params+2);
5600 if (!name2) {
5601 name2 = "";
5602 }
5603
5604 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5605 api_command,
5606 name1,
5607 name2,
5608 tdscnt,tpscnt,mdrcnt,mprcnt));
5609
5610 for (i=0;api_commands[i].name;i++) {
5611 if (api_commands[i].id == api_command && api_commands[i].fn) {
5612 DEBUG(3,("Doing %s\n",api_commands[i].name));
5613 break;
5614 }
5615 }
5616
5617 /* Check whether this api call can be done anonymously */
5618
5619 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5620 struct user_struct *user = get_valid_user_struct(req->sconn, vuid);
5621
5622 if (!user || security_session_user_level(user->session_info, NULL) < SECURITY_USER) {
5623 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5624 return;
5625 }
5626 }
5627
5628 rdata = (char *)SMB_MALLOC(1024);
5629 if (rdata) {
5630 memset(rdata,'\0',1024);
5631 }
5632
5633 rparam = (char *)SMB_MALLOC(1024);
5634 if (rparam) {
5635 memset(rparam,'\0',1024);
5636 }
5637
5638 if(!rdata || !rparam) {
5639 DEBUG(0,("api_reply: malloc fail !\n"));
5640 SAFE_FREE(rdata);
5641 SAFE_FREE(rparam);
5642 reply_nterror(req, NT_STATUS_NO_MEMORY);
5643 return;
5644 }
5645
5646 reply = api_commands[i].fn(req->sconn, conn,
5647 vuid,
5648 params,tpscnt, /* params + length */
5649 data,tdscnt, /* data + length */
5650 mdrcnt,mprcnt,
5651 &rdata,&rparam,&rdata_len,&rparam_len);
5652
5653
5654 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5655 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5656 mdrcnt,mprcnt,
5657 &rdata,&rparam,&rdata_len,&rparam_len);
5658 }
5659
5660 /* if we get False back then it's actually unsupported */
5661 if (!reply) {
5662 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5663 data,
5664 tdscnt,mdrcnt,mprcnt,
5665 &rdata,&rparam,&rdata_len,&rparam_len);
5666 }
5667
5668 /* If api_Unsupported returns false we can't return anything. */
5669 if (reply) {
5670 send_trans_reply(conn, req, rparam, rparam_len,
5671 rdata, rdata_len, False);
5672 }
5673
5674 SAFE_FREE(rdata);
5675 SAFE_FREE(rparam);
5676 return;
5677 }
Samba GIT mirror