?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbd: Restructure brl_conflict_other
[Samba.git] / source3 / smbd / lanman.c
blob66ab8a20130ff3df3655a06f05ba150734443090
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "rpc_client/rpc_client.h"
32 #include "../librpc/gen_ndr/ndr_samr_c.h"
33 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
34 #include "rpc_client/cli_spoolss.h"
35 #include "rpc_client/init_spoolss.h"
36 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
37 #include "../librpc/gen_ndr/rap.h"
38 #include "../lib/util/binsearch.h"
39 #include "../libcli/auth/libcli_auth.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "printing.h"
43 #include "passdb/machine_sid.h"
44 #include "auth.h"
45 #include "rpc_server/rpc_ncacn_np.h"
46
47 #ifdef CHECK_TYPES
48 #undef CHECK_TYPES
49 #endif
50 #define CHECK_TYPES 0
51
52 #define NERR_Success 0
53 #define NERR_badpass 86
54 #define NERR_notsupported 50
55
56 #define NERR_BASE (2100)
57 #define NERR_BufTooSmall (NERR_BASE+23)
58 #define NERR_JobNotFound (NERR_BASE+51)
59 #define NERR_DestNotFound (NERR_BASE+52)
60
61 #define ACCESS_READ 0x01
62 #define ACCESS_WRITE 0x02
63 #define ACCESS_CREATE 0x04
64
65 #define SHPWLEN 8 /* share password length */
66
67 /* Limit size of ipc replies */
68
69 static char *smb_realloc_limit(void *ptr, size_t size)
70 {
71 char *val;
72
73 size = MAX((size),4*1024);
74 val = (char *)SMB_REALLOC(ptr,size);
75 if (val) {
76 memset(val,'\0',size);
77 }
78 return val;
79 }
80
81 static bool api_Unsupported(struct smbd_server_connection *sconn,
82 connection_struct *conn, uint64_t vuid,
83 char *param, int tpscnt,
84 char *data, int tdscnt,
85 int mdrcnt, int mprcnt,
86 char **rdata, char **rparam,
87 int *rdata_len, int *rparam_len);
88
89 static bool api_TooSmall(struct smbd_server_connection *sconn,
90 connection_struct *conn, uint64_t vuid, char *param, char *data,
91 int mdrcnt, int mprcnt,
92 char **rdata, char **rparam,
93 int *rdata_len, int *rparam_len);
94
95
96 static int CopyExpanded(connection_struct *conn,
97 int snum, char **dst, char *src, int *p_space_remaining)
98 {
99 TALLOC_CTX *ctx = talloc_tos();
100 char *buf = NULL;
101 int l;
102
103 if (!src || !dst || !p_space_remaining || !(*dst) ||
104 *p_space_remaining <= 0) {
105 return 0;
106 }
107
108 buf = talloc_strdup(ctx, src);
109 if (!buf) {
110 *p_space_remaining = 0;
111 return 0;
112 }
113 buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, snum));
114 if (!buf) {
115 *p_space_remaining = 0;
116 return 0;
117 }
118 buf = talloc_sub_advanced(ctx,
119 lp_servicename(ctx, SNUM(conn)),
120 conn->session_info->unix_info->unix_name,
121 conn->connectpath,
122 conn->session_info->unix_token->gid,
123 conn->session_info->unix_info->sanitized_username,
124 conn->session_info->info->domain_name,
125 buf);
126 if (!buf) {
127 *p_space_remaining = 0;
128 return 0;
129 }
130 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
131 if (l == 0) {
132 return 0;
133 }
134 (*dst) += l;
135 (*p_space_remaining) -= l;
136 return l;
137 }
138
139 static int CopyAndAdvance(char **dst, char *src, int *n)
140 {
141 int l;
142 if (!src || !dst || !n || !(*dst)) {
143 return 0;
144 }
145 l = push_ascii(*dst,src,*n, STR_TERMINATE);
146 if (l == 0) {
147 return 0;
148 }
149 (*dst) += l;
150 (*n) -= l;
151 return l;
152 }
153
154 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
155 {
156 TALLOC_CTX *ctx = talloc_tos();
157 char *buf = NULL;
158 if (!s) {
159 return 0;
160 }
161 buf = talloc_strdup(ctx,s);
162 if (!buf) {
163 return 0;
164 }
165 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, snum));
166 if (!buf) {
167 return 0;
168 }
169 buf = talloc_sub_advanced(ctx,
170 lp_servicename(ctx, SNUM(conn)),
171 conn->session_info->unix_info->unix_name,
172 conn->connectpath,
173 conn->session_info->unix_token->gid,
174 conn->session_info->unix_info->sanitized_username,
175 conn->session_info->info->domain_name,
176 buf);
177 if (!buf) {
178 return 0;
179 }
180 return strlen(buf) + 1;
181 }
182
183 /*******************************************************************
184 Check a API string for validity when we only need to check the prefix.
185 ******************************************************************/
186
187 static bool prefix_ok(const char *str, const char *prefix)
188 {
189 return(strncmp(str,prefix,strlen(prefix)) == 0);
190 }
191
192 struct pack_desc {
193 const char *format; /* formatstring for structure */
194 const char *subformat; /* subformat for structure */
195 char *base; /* baseaddress of buffer */
196 int buflen; /* remaining size for fixed part; on init: length of base */
197 int subcount; /* count of substructures */
198 char *structbuf; /* pointer into buffer for remaining fixed part */
199 int stringlen; /* remaining size for variable part */
200 char *stringbuf; /* pointer into buffer for remaining variable part */
201 int neededlen; /* total needed size */
202 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
203 const char *curpos; /* current position; pointer into format or subformat */
204 int errcode;
205 };
206
207 static int get_counter(const char **p)
208 {
209 int i, n;
210 if (!p || !(*p)) {
211 return 1;
212 }
213 if (!isdigit((int)**p)) {
214 return 1;
215 }
216 for (n = 0;;) {
217 i = **p;
218 if (isdigit(i)) {
219 n = 10 * n + (i - '0');
220 } else {
221 return n;
222 }
223 (*p)++;
224 }
225 }
226
227 static int getlen(const char *p)
228 {
229 int n = 0;
230 if (!p) {
231 return 0;
232 }
233
234 while (*p) {
235 switch( *p++ ) {
236 case 'W': /* word (2 byte) */
237 n += 2;
238 break;
239 case 'K': /* status word? (2 byte) */
240 n += 2;
241 break;
242 case 'N': /* count of substructures (word) at end */
243 n += 2;
244 break;
245 case 'D': /* double word (4 byte) */
246 case 'z': /* offset to zero terminated string (4 byte) */
247 case 'l': /* offset to user data (4 byte) */
248 n += 4;
249 break;
250 case 'b': /* offset to data (with counter) (4 byte) */
251 n += 4;
252 get_counter(&p);
253 break;
254 case 'B': /* byte (with optional counter) */
255 n += get_counter(&p);
256 break;
257 }
258 }
259 return n;
260 }
261
262 static bool init_package(struct pack_desc *p, int count, int subcount)
263 {
264 int n = p->buflen;
265 int i;
266
267 if (!p->format || !p->base) {
268 return False;
269 }
270
271 i = count * getlen(p->format);
272 if (p->subformat) {
273 i += subcount * getlen(p->subformat);
274 }
275 p->structbuf = p->base;
276 p->neededlen = 0;
277 p->usedlen = 0;
278 p->subcount = 0;
279 p->curpos = p->format;
280 if (i > n) {
281 p->neededlen = i;
282 i = n = 0;
283 #if 0
284 /*
285 * This is the old error code we used. Aparently
286 * WinNT/2k systems return ERRbuftoosmall (2123) and
287 * OS/2 needs this. I'm leaving this here so we can revert
288 * if needed. JRA.
289 */
290 p->errcode = ERRmoredata;
291 #else
292 p->errcode = ERRbuftoosmall;
293 #endif
294 } else {
295 p->errcode = NERR_Success;
296 }
297 p->buflen = i;
298 n -= i;
299 p->stringbuf = p->base + i;
300 p->stringlen = n;
301 return (p->errcode == NERR_Success);
302 }
303
304 static int package(struct pack_desc *p, ...)
305 {
306 va_list args;
307 int needed=0, stringneeded;
308 const char *str=NULL;
309 int is_string=0, stringused;
310 int32 temp;
311
312 va_start(args,p);
313
314 if (!*p->curpos) {
315 if (!p->subcount) {
316 p->curpos = p->format;
317 } else {
318 p->curpos = p->subformat;
319 p->subcount--;
320 }
321 }
322 #if CHECK_TYPES
323 str = va_arg(args,char*);
324 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
325 #endif
326 stringneeded = -1;
327
328 if (!p->curpos) {
329 va_end(args);
330 return 0;
331 }
332
333 switch( *p->curpos++ ) {
334 case 'W': /* word (2 byte) */
335 needed = 2;
336 temp = va_arg(args,int);
337 if (p->buflen >= needed) {
338 SSVAL(p->structbuf,0,temp);
339 }
340 break;
341 case 'K': /* status word? (2 byte) */
342 needed = 2;
343 temp = va_arg(args,int);
344 if (p->buflen >= needed) {
345 SSVAL(p->structbuf,0,temp);
346 }
347 break;
348 case 'N': /* count of substructures (word) at end */
349 needed = 2;
350 p->subcount = va_arg(args,int);
351 if (p->buflen >= needed) {
352 SSVAL(p->structbuf,0,p->subcount);
353 }
354 break;
355 case 'D': /* double word (4 byte) */
356 needed = 4;
357 temp = va_arg(args,int);
358 if (p->buflen >= needed) {
359 SIVAL(p->structbuf,0,temp);
360 }
361 break;
362 case 'B': /* byte (with optional counter) */
363 needed = get_counter(&p->curpos);
364 {
365 char *s = va_arg(args,char*);
366 if (p->buflen >= needed) {
367 StrnCpy(p->structbuf,s?s:"",needed-1);
368 }
369 }
370 break;
371 case 'z': /* offset to zero terminated string (4 byte) */
372 str = va_arg(args,char*);
373 stringneeded = (str ? strlen(str)+1 : 0);
374 is_string = 1;
375 break;
376 case 'l': /* offset to user data (4 byte) */
377 str = va_arg(args,char*);
378 stringneeded = va_arg(args,int);
379 is_string = 0;
380 break;
381 case 'b': /* offset to data (with counter) (4 byte) */
382 str = va_arg(args,char*);
383 stringneeded = get_counter(&p->curpos);
384 is_string = 0;
385 break;
386 }
387
388 va_end(args);
389 if (stringneeded >= 0) {
390 needed = 4;
391 if (p->buflen >= needed) {
392 stringused = stringneeded;
393 if (stringused > p->stringlen) {
394 stringused = (is_string ? p->stringlen : 0);
395 if (p->errcode == NERR_Success) {
396 p->errcode = ERRmoredata;
397 }
398 }
399 if (!stringused) {
400 SIVAL(p->structbuf,0,0);
401 } else {
402 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
403 memcpy(p->stringbuf,str?str:"",stringused);
404 if (is_string) {
405 p->stringbuf[stringused-1] = '\0';
406 }
407 p->stringbuf += stringused;
408 p->stringlen -= stringused;
409 p->usedlen += stringused;
410 }
411 }
412 p->neededlen += stringneeded;
413 }
414
415 p->neededlen += needed;
416 if (p->buflen >= needed) {
417 p->structbuf += needed;
418 p->buflen -= needed;
419 p->usedlen += needed;
420 } else {
421 if (p->errcode == NERR_Success) {
422 p->errcode = ERRmoredata;
423 }
424 }
425 return 1;
426 }
427
428 #if CHECK_TYPES
429 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
430 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
431 #else
432 #define PACK(desc,t,v) package(desc,v)
433 #define PACKl(desc,t,v,l) package(desc,v,l)
434 #endif
435
436 static void PACKI(struct pack_desc* desc, const char *t,int v)
437 {
438 PACK(desc,t,v);
439 }
440
441 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
442 {
443 PACK(desc,t,v);
444 }
445
446 /****************************************************************************
447 Get a print queue.
448 ****************************************************************************/
449
450 static void PackDriverData(struct pack_desc* desc)
451 {
452 char drivdata[4+4+32];
453 SIVAL(drivdata,0,sizeof drivdata); /* cb */
454 SIVAL(drivdata,4,1000); /* lVersion */
455 memset(drivdata+8,0,32); /* szDeviceName */
456 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
457 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
458 }
459
460 static int check_printq_info(struct pack_desc* desc,
461 unsigned int uLevel, char *id1, char *id2)
462 {
463 desc->subformat = NULL;
464 switch( uLevel ) {
465 case 0:
466 desc->format = "B13";
467 break;
468 case 1:
469 desc->format = "B13BWWWzzzzzWW";
470 break;
471 case 2:
472 desc->format = "B13BWWWzzzzzWN";
473 desc->subformat = "WB21BB16B10zWWzDDz";
474 break;
475 case 3:
476 desc->format = "zWWWWzzzzWWzzl";
477 break;
478 case 4:
479 desc->format = "zWWWWzzzzWNzzl";
480 desc->subformat = "WWzWWDDzz";
481 break;
482 case 5:
483 desc->format = "z";
484 break;
485 case 51:
486 desc->format = "K";
487 break;
488 case 52:
489 desc->format = "WzzzzzzzzN";
490 desc->subformat = "z";
491 break;
492 default:
493 DEBUG(0,("check_printq_info: invalid level %d\n",
494 uLevel ));
495 return False;
496 }
497 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
498 DEBUG(0,("check_printq_info: invalid format %s\n",
499 id1 ? id1 : "<NULL>" ));
500 return False;
501 }
502 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
503 DEBUG(0,("check_printq_info: invalid subformat %s\n",
504 id2 ? id2 : "<NULL>" ));
505 return False;
506 }
507 return True;
508 }
509
510
511 #define RAP_JOB_STATUS_QUEUED 0
512 #define RAP_JOB_STATUS_PAUSED 1
513 #define RAP_JOB_STATUS_SPOOLING 2
514 #define RAP_JOB_STATUS_PRINTING 3
515 #define RAP_JOB_STATUS_PRINTED 4
516
517 #define RAP_QUEUE_STATUS_PAUSED 1
518 #define RAP_QUEUE_STATUS_ERROR 2
519
520 /* turn a print job status into a on the wire status
521 */
522 static int printj_spoolss_status(int v)
523 {
524 if (v == JOB_STATUS_QUEUED)
525 return RAP_JOB_STATUS_QUEUED;
526 if (v & JOB_STATUS_PAUSED)
527 return RAP_JOB_STATUS_PAUSED;
528 if (v & JOB_STATUS_SPOOLING)
529 return RAP_JOB_STATUS_SPOOLING;
530 if (v & JOB_STATUS_PRINTING)
531 return RAP_JOB_STATUS_PRINTING;
532 return 0;
533 }
534
535 /* turn a print queue status into a on the wire status
536 */
537 static int printq_spoolss_status(int v)
538 {
539 if (v == PRINTER_STATUS_OK)
540 return 0;
541 if (v & PRINTER_STATUS_PAUSED)
542 return RAP_QUEUE_STATUS_PAUSED;
543 return RAP_QUEUE_STATUS_ERROR;
544 }
545
546 static void fill_spoolss_printjob_info(int uLevel,
547 struct pack_desc *desc,
548 struct spoolss_JobInfo2 *info2,
549 int n)
550 {
551 time_t t = spoolss_Time_to_time_t(&info2->submitted);
552
553 /* the client expects localtime */
554 t -= get_time_zone(t);
555
556 PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
557 if (uLevel == 1) {
558 PACKS(desc,"B21", info2->user_name); /* szUserName */
559 PACKS(desc,"B",""); /* pad */
560 PACKS(desc,"B16",""); /* szNotifyName */
561 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
562 PACKS(desc,"z",""); /* pszParms */
563 PACKI(desc,"W",n+1); /* uPosition */
564 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
565 PACKS(desc,"z",""); /* pszStatus */
566 PACKI(desc,"D", t); /* ulSubmitted */
567 PACKI(desc,"D", info2->size); /* ulSize */
568 PACKS(desc,"z", info2->document_name); /* pszComment */
569 }
570 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
571 PACKI(desc,"W", info2->priority); /* uPriority */
572 PACKS(desc,"z", info2->user_name); /* pszUserName */
573 PACKI(desc,"W",n+1); /* uPosition */
574 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
575 PACKI(desc,"D",t); /* ulSubmitted */
576 PACKI(desc,"D", info2->size); /* ulSize */
577 PACKS(desc,"z","Samba"); /* pszComment */
578 PACKS(desc,"z", info2->document_name); /* pszDocument */
579 if (uLevel == 3) {
580 PACKS(desc,"z",""); /* pszNotifyName */
581 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
582 PACKS(desc,"z",""); /* pszParms */
583 PACKS(desc,"z",""); /* pszStatus */
584 PACKS(desc,"z", info2->printer_name); /* pszQueue */
585 PACKS(desc,"z","lpd"); /* pszQProcName */
586 PACKS(desc,"z",""); /* pszQProcParms */
587 PACKS(desc,"z","NULL"); /* pszDriverName */
588 PackDriverData(desc); /* pDriverData */
589 PACKS(desc,"z",""); /* pszPrinterName */
590 } else if (uLevel == 4) { /* OS2 */
591 PACKS(desc,"z",""); /* pszSpoolFileName */
592 PACKS(desc,"z",""); /* pszPortName */
593 PACKS(desc,"z",""); /* pszStatus */
594 PACKI(desc,"D",0); /* ulPagesSpooled */
595 PACKI(desc,"D",0); /* ulPagesSent */
596 PACKI(desc,"D",0); /* ulPagesPrinted */
597 PACKI(desc,"D",0); /* ulTimePrinted */
598 PACKI(desc,"D",0); /* ulExtendJobStatus */
599 PACKI(desc,"D",0); /* ulStartPage */
600 PACKI(desc,"D",0); /* ulEndPage */
601 }
602 }
603 }
604
605 /********************************************************************
606 Respond to the DosPrintQInfo command with a level of 52
607 This is used to get printer driver information for Win9x clients
608 ********************************************************************/
609 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
610 struct pack_desc* desc, int count,
611 const char *printer_name)
612 {
613 int i;
614 fstring location;
615 trim_string(discard_const_p(char, driver->driver_path), "\\print$\\WIN40\\0\\", 0);
616 trim_string(discard_const_p(char, driver->data_file), "\\print$\\WIN40\\0\\", 0);
617 trim_string(discard_const_p(char, driver->help_file), "\\print$\\WIN40\\0\\", 0);
618
619 PACKI(desc, "W", 0x0400); /* don't know */
620 PACKS(desc, "z", driver->driver_name); /* long printer name */
621 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
622 PACKS(desc, "z", driver->data_file); /* Datafile name */
623 PACKS(desc, "z", driver->monitor_name); /* language monitor */
624
625 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
626 standard_sub_basic( "", "", location, sizeof(location)-1 );
627 PACKS(desc,"z", location); /* share to retrieve files */
628
629 PACKS(desc,"z", driver->default_datatype); /* default data type */
630 PACKS(desc,"z", driver->help_file); /* helpfile name */
631 PACKS(desc,"z", driver->driver_path); /* driver name */
632
633 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
634 DEBUG(3,("Driver: %s:\n",driver->driver_path));
635 DEBUG(3,("Data File: %s:\n",driver->data_file));
636 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
637 DEBUG(3,("Driver Location: %s:\n",location));
638 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
639 DEBUG(3,("Help File: %s:\n",driver->help_file));
640 PACKI(desc,"N",count); /* number of files to copy */
641
642 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
643 {
644 trim_string(discard_const_p(char, driver->dependent_files[i]), "\\print$\\WIN40\\0\\", 0);
645 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
646 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
647 }
648
649 /* sanity check */
650 if ( i != count )
651 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
652 count, i));
653
654 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
655
656 desc->errcode=NERR_Success;
657
658 }
659
660 static const char *strip_unc(const char *unc)
661 {
662 char *p;
663
664 if (unc == NULL) {
665 return NULL;
666 }
667
668 if ((p = strrchr(unc, '\\')) != NULL) {
669 return p+1;
670 }
671
672 return unc;
673 }
674
675 static void fill_printq_info(int uLevel,
676 struct pack_desc* desc,
677 int count,
678 union spoolss_JobInfo *job_info,
679 struct spoolss_DriverInfo3 *driver_info,
680 struct spoolss_PrinterInfo2 *printer_info)
681 {
682 switch (uLevel) {
683 case 0:
684 case 1:
685 case 2:
686 PACKS(desc,"B13", strip_unc(printer_info->printername));
687 break;
688 case 3:
689 case 4:
690 case 5:
691 PACKS(desc,"z", strip_unc(printer_info->printername));
692 break;
693 case 51:
694 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
695 break;
696 }
697
698 if (uLevel == 1 || uLevel == 2) {
699 PACKS(desc,"B",""); /* alignment */
700 PACKI(desc,"W",5); /* priority */
701 PACKI(desc,"W",0); /* start time */
702 PACKI(desc,"W",0); /* until time */
703 PACKS(desc,"z",""); /* pSepFile */
704 PACKS(desc,"z","lpd"); /* pPrProc */
705 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
706 PACKS(desc,"z",""); /* pParms */
707 if (printer_info->printername == NULL) {
708 PACKS(desc,"z","UNKNOWN PRINTER");
709 PACKI(desc,"W",LPSTAT_ERROR);
710 } else {
711 PACKS(desc,"z", printer_info->comment);
712 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
713 }
714 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
715 }
716
717 if (uLevel == 3 || uLevel == 4) {
718 PACKI(desc,"W",5); /* uPriority */
719 PACKI(desc,"W",0); /* uStarttime */
720 PACKI(desc,"W",0); /* uUntiltime */
721 PACKI(desc,"W",5); /* pad1 */
722 PACKS(desc,"z",""); /* pszSepFile */
723 PACKS(desc,"z","WinPrint"); /* pszPrProc */
724 PACKS(desc,"z",NULL); /* pszParms */
725 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
726 /* "don't ask" that it's done this way to fix corrupted
727 Win9X/ME printer comments. */
728 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
729 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
730 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
731 PACKS(desc,"z", printer_info->drivername); /* pszDriverName */
732 PackDriverData(desc); /* pDriverData */
733 }
734
735 if (uLevel == 2 || uLevel == 4) {
736 int i;
737 for (i = 0; i < count; i++) {
738 fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
739 }
740 }
741
742 if (uLevel==52)
743 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
744 }
745
746 /* This function returns the number of files for a given driver */
747 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
748 {
749 int result = 0;
750
751 /* count the number of files */
752 while (driver->dependent_files && *driver->dependent_files[result])
753 result++;
754
755 return result;
756 }
757
758 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
759 connection_struct *conn, uint64_t vuid,
760 char *param, int tpscnt,
761 char *data, int tdscnt,
762 int mdrcnt,int mprcnt,
763 char **rdata,char **rparam,
764 int *rdata_len,int *rparam_len)
765 {
766 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
767 char *str2 = skip_string(param,tpscnt,str1);
768 char *p = skip_string(param,tpscnt,str2);
769 char *QueueName = p;
770 unsigned int uLevel;
771 uint32_t count = 0;
772 char *str3;
773 struct pack_desc desc;
774 char* tmpdata=NULL;
775
776 WERROR werr = WERR_OK;
777 TALLOC_CTX *mem_ctx = talloc_tos();
778 NTSTATUS status;
779 struct rpc_pipe_client *cli = NULL;
780 struct dcerpc_binding_handle *b = NULL;
781 struct policy_handle handle;
782 struct spoolss_DevmodeContainer devmode_ctr;
783 union spoolss_DriverInfo driver_info;
784 union spoolss_JobInfo *job_info = NULL;
785 union spoolss_PrinterInfo printer_info;
786
787 if (!str1 || !str2 || !p) {
788 return False;
789 }
790 memset((char *)&desc,'\0',sizeof(desc));
791
792 p = skip_string(param,tpscnt,p);
793 if (!p) {
794 return False;
795 }
796 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
797 str3 = get_safe_str_ptr(param,tpscnt,p,4);
798 /* str3 may be null here and is checked in check_printq_info(). */
799
800 /* remove any trailing username */
801 if ((p = strchr_m(QueueName,'%')))
802 *p = 0;
803
804 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
805
806 /* check it's a supported varient */
807 if (!prefix_ok(str1,"zWrLh"))
808 return False;
809 if (!check_printq_info(&desc,uLevel,str2,str3)) {
810 /*
811 * Patch from Scott Moomaw <scott@bridgewater.edu>
812 * to return the 'invalid info level' error if an
813 * unknown level was requested.
814 */
815 *rdata_len = 0;
816 *rparam_len = 6;
817 *rparam = smb_realloc_limit(*rparam,*rparam_len);
818 if (!*rparam) {
819 return False;
820 }
821 SSVALS(*rparam,0,ERRunknownlevel);
822 SSVAL(*rparam,2,0);
823 SSVAL(*rparam,4,0);
824 return(True);
825 }
826
827 ZERO_STRUCT(handle);
828
829 if (QueueName == NULL || (strlen(QueueName) < 1)) {
830 desc.errcode = W_ERROR_V(WERR_INVALID_PARAM);
831 goto out;
832 }
833
834 status = rpc_pipe_open_interface(conn,
835 &ndr_table_spoolss,
836 conn->session_info,
837 conn->sconn->remote_address,
838 conn->sconn->msg_ctx,
839 &cli);
840 if (!NT_STATUS_IS_OK(status)) {
841 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
842 nt_errstr(status)));
843 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
844 goto out;
845 }
846 b = cli->binding_handle;
847
848 ZERO_STRUCT(devmode_ctr);
849
850 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
851 QueueName,
852 "RAW",
853 devmode_ctr,
854 PRINTER_ACCESS_USE,
855 &handle,
856 &werr);
857 if (!NT_STATUS_IS_OK(status)) {
858 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
859 goto out;
860 }
861 if (!W_ERROR_IS_OK(werr)) {
862 desc.errcode = W_ERROR_V(werr);
863 goto out;
864 }
865
866 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
867 &handle,
868 2,
869 0,
870 &printer_info);
871 if (!W_ERROR_IS_OK(werr)) {
872 desc.errcode = W_ERROR_V(werr);
873 goto out;
874 }
875
876 if (uLevel==52) {
877 uint32_t server_major_version;
878 uint32_t server_minor_version;
879
880 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
881 &handle,
882 "Windows 4.0",
883 3, /* level */
884 0,
885 0, /* version */
886 0,
887 &driver_info,
888 &server_major_version,
889 &server_minor_version);
890 if (!W_ERROR_IS_OK(werr)) {
891 desc.errcode = W_ERROR_V(werr);
892 goto out;
893 }
894
895 count = get_printerdrivernumber(&driver_info.info3);
896 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
897 } else {
898 uint32_t num_jobs;
899 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
900 &handle,
901 0, /* firstjob */
902 0xff, /* numjobs */
903 2, /* level */
904 0, /* offered */
905 &num_jobs,
906 &job_info);
907 if (!W_ERROR_IS_OK(werr)) {
908 desc.errcode = W_ERROR_V(werr);
909 goto out;
910 }
911
912 count = num_jobs;
913 }
914
915 if (mdrcnt > 0) {
916 *rdata = smb_realloc_limit(*rdata,mdrcnt);
917 if (!*rdata) {
918 return False;
919 }
920 desc.base = *rdata;
921 desc.buflen = mdrcnt;
922 } else {
923 /*
924 * Don't return data but need to get correct length
925 * init_package will return wrong size if buflen=0
926 */
927 desc.buflen = getlen(desc.format);
928 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
929 }
930
931 if (init_package(&desc,1,count)) {
932 desc.subcount = count;
933 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
934 }
935
936 *rdata_len = desc.usedlen;
937
938 /*
939 * We must set the return code to ERRbuftoosmall
940 * in order to support lanman style printing with Win NT/2k
941 * clients --jerry
942 */
943 if (!mdrcnt && lp_disable_spoolss())
944 desc.errcode = ERRbuftoosmall;
945
946 out:
947 if (b && is_valid_policy_hnd(&handle)) {
948 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
949 }
950
951 *rdata_len = desc.usedlen;
952 *rparam_len = 6;
953 *rparam = smb_realloc_limit(*rparam,*rparam_len);
954 if (!*rparam) {
955 SAFE_FREE(tmpdata);
956 return False;
957 }
958 SSVALS(*rparam,0,desc.errcode);
959 SSVAL(*rparam,2,0);
960 SSVAL(*rparam,4,desc.neededlen);
961
962 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
963
964 SAFE_FREE(tmpdata);
965
966 return(True);
967 }
968
969 /****************************************************************************
970 View list of all print jobs on all queues.
971 ****************************************************************************/
972
973 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
974 connection_struct *conn, uint64_t vuid,
975 char *param, int tpscnt,
976 char *data, int tdscnt,
977 int mdrcnt, int mprcnt,
978 char **rdata, char** rparam,
979 int *rdata_len, int *rparam_len)
980 {
981 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
982 char *output_format1 = skip_string(param,tpscnt,param_format);
983 char *p = skip_string(param,tpscnt,output_format1);
984 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
985 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
986 int i;
987 struct pack_desc desc;
988 int *subcntarr = NULL;
989 int queuecnt = 0, subcnt = 0, succnt = 0;
990
991 WERROR werr = WERR_OK;
992 TALLOC_CTX *mem_ctx = talloc_tos();
993 NTSTATUS status;
994 struct rpc_pipe_client *cli = NULL;
995 struct dcerpc_binding_handle *b = NULL;
996 struct spoolss_DevmodeContainer devmode_ctr;
997 uint32_t num_printers;
998 union spoolss_PrinterInfo *printer_info;
999 union spoolss_DriverInfo *driver_info;
1000 union spoolss_JobInfo **job_info;
1001
1002 if (!param_format || !output_format1 || !p) {
1003 return False;
1004 }
1005
1006 memset((char *)&desc,'\0',sizeof(desc));
1007
1008 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1009
1010 if (!prefix_ok(param_format,"WrLeh")) {
1011 return False;
1012 }
1013 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1014 /*
1015 * Patch from Scott Moomaw <scott@bridgewater.edu>
1016 * to return the 'invalid info level' error if an
1017 * unknown level was requested.
1018 */
1019 *rdata_len = 0;
1020 *rparam_len = 6;
1021 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1022 if (!*rparam) {
1023 return False;
1024 }
1025 SSVALS(*rparam,0,ERRunknownlevel);
1026 SSVAL(*rparam,2,0);
1027 SSVAL(*rparam,4,0);
1028 return(True);
1029 }
1030
1031 status = rpc_pipe_open_interface(conn,
1032 &ndr_table_spoolss,
1033 conn->session_info,
1034 conn->sconn->remote_address,
1035 conn->sconn->msg_ctx,
1036 &cli);
1037 if (!NT_STATUS_IS_OK(status)) {
1038 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1039 nt_errstr(status)));
1040 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1041 goto out;
1042 }
1043 b = cli->binding_handle;
1044
1045 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1046 PRINTER_ENUM_LOCAL,
1047 cli->srv_name_slash,
1048 2,
1049 0,
1050 &num_printers,
1051 &printer_info);
1052 if (!W_ERROR_IS_OK(werr)) {
1053 desc.errcode = W_ERROR_V(werr);
1054 goto out;
1055 }
1056
1057 queuecnt = num_printers;
1058
1059 job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1060 if (job_info == NULL) {
1061 goto err;
1062 }
1063
1064 driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1065 if (driver_info == NULL) {
1066 goto err;
1067 }
1068
1069 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1070 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1071 goto err;
1072 }
1073
1074 if (mdrcnt > 0) {
1075 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1076 if (!*rdata) {
1077 goto err;
1078 }
1079 }
1080 desc.base = *rdata;
1081 desc.buflen = mdrcnt;
1082
1083 subcnt = 0;
1084 for (i = 0; i < num_printers; i++) {
1085
1086 uint32_t num_jobs;
1087 struct policy_handle handle;
1088 const char *printername;
1089
1090 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1091 if (printername == NULL) {
1092 goto err;
1093 }
1094
1095 ZERO_STRUCT(handle);
1096 ZERO_STRUCT(devmode_ctr);
1097
1098 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1099 printername,
1100 "RAW",
1101 devmode_ctr,
1102 PRINTER_ACCESS_USE,
1103 &handle,
1104 &werr);
1105 if (!NT_STATUS_IS_OK(status)) {
1106 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1107 goto out;
1108 }
1109 if (!W_ERROR_IS_OK(werr)) {
1110 desc.errcode = W_ERROR_V(werr);
1111 goto out;
1112 }
1113
1114 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1115 &handle,
1116 0, /* firstjob */
1117 0xff, /* numjobs */
1118 2, /* level */
1119 0, /* offered */
1120 &num_jobs,
1121 &job_info[i]);
1122 if (!W_ERROR_IS_OK(werr)) {
1123 desc.errcode = W_ERROR_V(werr);
1124 goto out;
1125 }
1126
1127 if (uLevel==52) {
1128 uint32_t server_major_version;
1129 uint32_t server_minor_version;
1130
1131 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1132 &handle,
1133 "Windows 4.0",
1134 3, /* level */
1135 0,
1136 0, /* version */
1137 0,
1138 &driver_info[i],
1139 &server_major_version,
1140 &server_minor_version);
1141 if (!W_ERROR_IS_OK(werr)) {
1142 desc.errcode = W_ERROR_V(werr);
1143 goto out;
1144 }
1145 }
1146
1147 subcntarr[i] = num_jobs;
1148 subcnt += subcntarr[i];
1149
1150 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1151 }
1152
1153 if (init_package(&desc,queuecnt,subcnt)) {
1154 for (i = 0; i < num_printers; i++) {
1155 fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1156 if (desc.errcode == NERR_Success) {
1157 succnt = i;
1158 }
1159 }
1160 }
1161
1162 out:
1163 SAFE_FREE(subcntarr);
1164 *rdata_len = desc.usedlen;
1165 *rparam_len = 8;
1166 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1167 if (!*rparam) {
1168 goto err;
1169 }
1170 SSVALS(*rparam,0,desc.errcode);
1171 SSVAL(*rparam,2,0);
1172 SSVAL(*rparam,4,succnt);
1173 SSVAL(*rparam,6,queuecnt);
1174
1175 return True;
1176
1177 err:
1178
1179 SAFE_FREE(subcntarr);
1180
1181 return False;
1182 }
1183
1184 /****************************************************************************
1185 Get info level for a server list query.
1186 ****************************************************************************/
1187
1188 static bool check_session_info(int uLevel, char* id)
1189 {
1190 switch( uLevel ) {
1191 case 0:
1192 if (strcmp(id,"B16") != 0) {
1193 return False;
1194 }
1195 break;
1196 case 1:
1197 if (strcmp(id,"B16BBDz") != 0) {
1198 return False;
1199 }
1200 break;
1201 default:
1202 return False;
1203 }
1204 return True;
1205 }
1206
1207 struct srv_info_struct {
1208 fstring name;
1209 uint32 type;
1210 fstring comment;
1211 fstring domain;
1212 bool server_added;
1213 };
1214
1215 /*******************************************************************
1216 Get server info lists from the files saved by nmbd. Return the
1217 number of entries.
1218 ******************************************************************/
1219
1220 static int get_session_info(uint32 servertype,
1221 struct srv_info_struct **servers,
1222 const char *domain)
1223 {
1224 int count=0;
1225 int alloced=0;
1226 char **lines;
1227 bool local_list_only;
1228 int i;
1229
1230 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1231 if (!lines) {
1232 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1233 return 0;
1234 }
1235
1236 /* request for everything is code for request all servers */
1237 if (servertype == SV_TYPE_ALL) {
1238 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1239 }
1240
1241 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1242
1243 DEBUG(4,("Servertype search: %8x\n",servertype));
1244
1245 for (i=0;lines[i];i++) {
1246 fstring stype;
1247 struct srv_info_struct *s;
1248 const char *ptr = lines[i];
1249 bool ok = True;
1250 TALLOC_CTX *frame = NULL;
1251 char *p;
1252
1253 if (!*ptr) {
1254 continue;
1255 }
1256
1257 if (count == alloced) {
1258 alloced += 10;
1259 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1260 if (!*servers) {
1261 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1262 TALLOC_FREE(lines);
1263 return 0;
1264 }
1265 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1266 }
1267 s = &(*servers)[count];
1268
1269 frame = talloc_stackframe();
1270 s->name[0] = '\0';
1271 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1272 TALLOC_FREE(frame);
1273 continue;
1274 }
1275 fstrcpy(s->name, p);
1276
1277 stype[0] = '\0';
1278 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1279 TALLOC_FREE(frame);
1280 continue;
1281 }
1282 fstrcpy(stype, p);
1283
1284 s->comment[0] = '\0';
1285 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1286 TALLOC_FREE(frame);
1287 continue;
1288 }
1289 fstrcpy(s->comment, p);
1290 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1291
1292 s->domain[0] = '\0';
1293 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1294 /* this allows us to cope with an old nmbd */
1295 fstrcpy(s->domain,lp_workgroup());
1296 } else {
1297 fstrcpy(s->domain, p);
1298 }
1299 TALLOC_FREE(frame);
1300
1301 if (sscanf(stype,"%X",&s->type) != 1) {
1302 DEBUG(4,("r:host file "));
1303 ok = False;
1304 }
1305
1306 /* Filter the servers/domains we return based on what was asked for. */
1307
1308 /* Check to see if we are being asked for a local list only. */
1309 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1310 DEBUG(4,("r: local list only"));
1311 ok = False;
1312 }
1313
1314 /* doesn't match up: don't want it */
1315 if (!(servertype & s->type)) {
1316 DEBUG(4,("r:serv type "));
1317 ok = False;
1318 }
1319
1320 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1321 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1322 DEBUG(4,("s: dom mismatch "));
1323 ok = False;
1324 }
1325
1326 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1327 ok = False;
1328 }
1329
1330 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1331 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1332
1333 if (ok) {
1334 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1335 s->name, s->type, s->comment, s->domain));
1336 s->server_added = True;
1337 count++;
1338 } else {
1339 DEBUG(4,("%20s %8x %25s %15s\n",
1340 s->name, s->type, s->comment, s->domain));
1341 }
1342 }
1343
1344 TALLOC_FREE(lines);
1345 return count;
1346 }
1347
1348 /*******************************************************************
1349 Fill in a server info structure.
1350 ******************************************************************/
1351
1352 static int fill_srv_info(struct srv_info_struct *service,
1353 int uLevel, char **buf, int *buflen,
1354 char **stringbuf, int *stringspace, char *baseaddr)
1355 {
1356 int struct_len;
1357 char* p;
1358 char* p2;
1359 int l2;
1360 int len;
1361
1362 switch (uLevel) {
1363 case 0:
1364 struct_len = 16;
1365 break;
1366 case 1:
1367 struct_len = 26;
1368 break;
1369 default:
1370 return -1;
1371 }
1372
1373 if (!buf) {
1374 len = 0;
1375 switch (uLevel) {
1376 case 1:
1377 len = strlen(service->comment)+1;
1378 break;
1379 }
1380
1381 *buflen = struct_len;
1382 *stringspace = len;
1383 return struct_len + len;
1384 }
1385
1386 len = struct_len;
1387 p = *buf;
1388 if (*buflen < struct_len) {
1389 return -1;
1390 }
1391 if (stringbuf) {
1392 p2 = *stringbuf;
1393 l2 = *stringspace;
1394 } else {
1395 p2 = p + struct_len;
1396 l2 = *buflen - struct_len;
1397 }
1398 if (!baseaddr) {
1399 baseaddr = p;
1400 }
1401
1402 switch (uLevel) {
1403 case 0:
1404 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1405 break;
1406
1407 case 1:
1408 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1409 SIVAL(p,18,service->type);
1410 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1411 len += CopyAndAdvance(&p2,service->comment,&l2);
1412 break;
1413 }
1414
1415 if (stringbuf) {
1416 *buf = p + struct_len;
1417 *buflen -= struct_len;
1418 *stringbuf = p2;
1419 *stringspace = l2;
1420 } else {
1421 *buf = p2;
1422 *buflen -= len;
1423 }
1424 return len;
1425 }
1426
1427
1428 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1429 {
1430 return strcasecmp_m(s1->name,s2->name);
1431 }
1432
1433 /****************************************************************************
1434 View list of servers available (or possibly domains). The info is
1435 extracted from lists saved by nmbd on the local host.
1436 ****************************************************************************/
1437
1438 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1439 connection_struct *conn, uint64_t vuid,
1440 char *param, int tpscnt,
1441 char *data, int tdscnt,
1442 int mdrcnt, int mprcnt, char **rdata,
1443 char **rparam, int *rdata_len, int *rparam_len)
1444 {
1445 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1446 char *str2 = skip_string(param,tpscnt,str1);
1447 char *p = skip_string(param,tpscnt,str2);
1448 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1449 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1450 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1451 char *p2;
1452 int data_len, fixed_len, string_len;
1453 int f_len = 0, s_len = 0;
1454 struct srv_info_struct *servers=NULL;
1455 int counted=0,total=0;
1456 int i,missed;
1457 fstring domain;
1458 bool domain_request;
1459 bool local_request;
1460
1461 if (!str1 || !str2 || !p) {
1462 return False;
1463 }
1464
1465 /* If someone sets all the bits they don't really mean to set
1466 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1467 known servers. */
1468
1469 if (servertype == SV_TYPE_ALL) {
1470 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1471 }
1472
1473 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1474 any other bit (they may just set this bit on its own) they
1475 want all the locally seen servers. However this bit can be
1476 set on its own so set the requested servers to be
1477 ALL - DOMAIN_ENUM. */
1478
1479 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1480 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1481 }
1482
1483 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1484 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1485
1486 p += 8;
1487
1488 if (!prefix_ok(str1,"WrLehD")) {
1489 return False;
1490 }
1491 if (!check_session_info(uLevel,str2)) {
1492 return False;
1493 }
1494
1495 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1496 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1497 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1498
1499 if (strcmp(str1, "WrLehDz") == 0) {
1500 if (skip_string(param,tpscnt,p) == NULL) {
1501 return False;
1502 }
1503 pull_ascii_fstring(domain, p);
1504 } else {
1505 fstrcpy(domain, lp_workgroup());
1506 }
1507
1508 DEBUG(4, ("domain [%s]\n", domain));
1509
1510 if (lp_browse_list()) {
1511 total = get_session_info(servertype,&servers,domain);
1512 }
1513
1514 data_len = fixed_len = string_len = 0;
1515 missed = 0;
1516
1517 TYPESAFE_QSORT(servers, total, srv_comp);
1518
1519 {
1520 char *lastname=NULL;
1521
1522 for (i=0;i<total;i++) {
1523 struct srv_info_struct *s = &servers[i];
1524
1525 if (lastname && strequal(lastname,s->name)) {
1526 continue;
1527 }
1528 lastname = s->name;
1529 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1530 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1531 i, s->name, s->type, s->comment, s->domain));
1532
1533 if (data_len < buf_len) {
1534 counted++;
1535 fixed_len += f_len;
1536 string_len += s_len;
1537 } else {
1538 missed++;
1539 }
1540 }
1541 }
1542
1543 *rdata_len = fixed_len + string_len;
1544 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1545 if (!*rdata) {
1546 return False;
1547 }
1548
1549 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1550 p = *rdata;
1551 f_len = fixed_len;
1552 s_len = string_len;
1553
1554 {
1555 char *lastname=NULL;
1556 int count2 = counted;
1557
1558 for (i = 0; i < total && count2;i++) {
1559 struct srv_info_struct *s = &servers[i];
1560
1561 if (lastname && strequal(lastname,s->name)) {
1562 continue;
1563 }
1564 lastname = s->name;
1565 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1566 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1567 i, s->name, s->type, s->comment, s->domain));
1568 count2--;
1569 }
1570 }
1571
1572 *rparam_len = 8;
1573 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1574 if (!*rparam) {
1575 return False;
1576 }
1577 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1578 SSVAL(*rparam,2,0);
1579 SSVAL(*rparam,4,counted);
1580 SSVAL(*rparam,6,counted+missed);
1581
1582 SAFE_FREE(servers);
1583
1584 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1585 domain,uLevel,counted,counted+missed));
1586
1587 return True;
1588 }
1589
1590 static int srv_name_match(const char *n1, const char *n2)
1591 {
1592 /*
1593 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1594 *
1595 * In Windows, FirstNameToReturn need not be an exact match:
1596 * the server will return a list of servers that exist on
1597 * the network greater than or equal to the FirstNameToReturn.
1598 */
1599 int ret = strcasecmp_m(n1, n2);
1600
1601 if (ret <= 0) {
1602 return 0;
1603 }
1604
1605 return ret;
1606 }
1607
1608 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1609 connection_struct *conn, uint64_t vuid,
1610 char *param, int tpscnt,
1611 char *data, int tdscnt,
1612 int mdrcnt, int mprcnt, char **rdata,
1613 char **rparam, int *rdata_len, int *rparam_len)
1614 {
1615 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1616 char *str2 = skip_string(param,tpscnt,str1);
1617 char *p = skip_string(param,tpscnt,str2);
1618 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1619 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1620 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1621 char *p2;
1622 int data_len, fixed_len, string_len;
1623 int f_len = 0, s_len = 0;
1624 struct srv_info_struct *servers=NULL;
1625 int counted=0,first=0,total=0;
1626 int i,missed;
1627 fstring domain;
1628 fstring first_name;
1629 bool domain_request;
1630 bool local_request;
1631
1632 if (!str1 || !str2 || !p) {
1633 return False;
1634 }
1635
1636 /* If someone sets all the bits they don't really mean to set
1637 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1638 known servers. */
1639
1640 if (servertype == SV_TYPE_ALL) {
1641 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1642 }
1643
1644 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1645 any other bit (they may just set this bit on its own) they
1646 want all the locally seen servers. However this bit can be
1647 set on its own so set the requested servers to be
1648 ALL - DOMAIN_ENUM. */
1649
1650 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1651 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1652 }
1653
1654 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1655 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1656
1657 p += 8;
1658
1659 if (strcmp(str1, "WrLehDzz") != 0) {
1660 return false;
1661 }
1662 if (!check_session_info(uLevel,str2)) {
1663 return False;
1664 }
1665
1666 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1667 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1668 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1669
1670 if (skip_string(param,tpscnt,p) == NULL) {
1671 return False;
1672 }
1673 pull_ascii_fstring(domain, p);
1674 if (domain[0] == '\0') {
1675 fstrcpy(domain, lp_workgroup());
1676 }
1677 p = skip_string(param,tpscnt,p);
1678 if (skip_string(param,tpscnt,p) == NULL) {
1679 return False;
1680 }
1681 pull_ascii_fstring(first_name, p);
1682
1683 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1684 domain, first_name));
1685
1686 if (lp_browse_list()) {
1687 total = get_session_info(servertype,&servers,domain);
1688 }
1689
1690 data_len = fixed_len = string_len = 0;
1691 missed = 0;
1692
1693 TYPESAFE_QSORT(servers, total, srv_comp);
1694
1695 if (first_name[0] != '\0') {
1696 struct srv_info_struct *first_server = NULL;
1697
1698 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1699 srv_name_match, first_server);
1700 if (first_server) {
1701 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1702 /*
1703 * The binary search may not find the exact match
1704 * so we need to search backward to find the first match
1705 *
1706 * This implements the strange matching windows
1707 * implements. (see the comment in srv_name_match().
1708 */
1709 for (;first > 0;) {
1710 int ret;
1711 ret = strcasecmp_m(first_name,
1712 servers[first-1].name);
1713 if (ret > 0) {
1714 break;
1715 }
1716 first--;
1717 }
1718 } else {
1719 /* we should return no entries */
1720 first = total;
1721 }
1722 }
1723
1724 {
1725 char *lastname=NULL;
1726
1727 for (i=first;i<total;i++) {
1728 struct srv_info_struct *s = &servers[i];
1729
1730 if (lastname && strequal(lastname,s->name)) {
1731 continue;
1732 }
1733 lastname = s->name;
1734 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1735 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1736 i, s->name, s->type, s->comment, s->domain));
1737
1738 if (data_len < buf_len) {
1739 counted++;
1740 fixed_len += f_len;
1741 string_len += s_len;
1742 } else {
1743 missed++;
1744 }
1745 }
1746 }
1747
1748 *rdata_len = fixed_len + string_len;
1749 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1750 if (!*rdata) {
1751 return False;
1752 }
1753
1754 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1755 p = *rdata;
1756 f_len = fixed_len;
1757 s_len = string_len;
1758
1759 {
1760 char *lastname=NULL;
1761 int count2 = counted;
1762
1763 for (i = first; i < total && count2;i++) {
1764 struct srv_info_struct *s = &servers[i];
1765
1766 if (lastname && strequal(lastname,s->name)) {
1767 continue;
1768 }
1769 lastname = s->name;
1770 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1771 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1772 i, s->name, s->type, s->comment, s->domain));
1773 count2--;
1774 }
1775 }
1776
1777 *rparam_len = 8;
1778 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1779 if (!*rparam) {
1780 return False;
1781 }
1782 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1783 SSVAL(*rparam,2,0);
1784 SSVAL(*rparam,4,counted);
1785 SSVAL(*rparam,6,counted+missed);
1786
1787 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1788 domain,uLevel,first,first_name,
1789 first < total ? servers[first].name : "",
1790 counted,counted+missed));
1791
1792 SAFE_FREE(servers);
1793
1794 return True;
1795 }
1796
1797 /****************************************************************************
1798 command 0x34 - suspected of being a "Lookup Names" stub api
1799 ****************************************************************************/
1800
1801 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1802 connection_struct *conn, uint64_t vuid,
1803 char *param, int tpscnt,
1804 char *data, int tdscnt,
1805 int mdrcnt, int mprcnt, char **rdata,
1806 char **rparam, int *rdata_len, int *rparam_len)
1807 {
1808 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1809 char *str2 = skip_string(param,tpscnt,str1);
1810 char *p = skip_string(param,tpscnt,str2);
1811 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1812 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1813 int counted=0;
1814 int missed=0;
1815
1816 if (!str1 || !str2 || !p) {
1817 return False;
1818 }
1819
1820 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1821 str1, str2, p, uLevel, buf_len));
1822
1823 if (!prefix_ok(str1,"zWrLeh")) {
1824 return False;
1825 }
1826
1827 *rdata_len = 0;
1828
1829 *rparam_len = 8;
1830 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1831 if (!*rparam) {
1832 return False;
1833 }
1834
1835 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1836 SSVAL(*rparam,2,0);
1837 SSVAL(*rparam,4,counted);
1838 SSVAL(*rparam,6,counted+missed);
1839
1840 return True;
1841 }
1842
1843 /****************************************************************************
1844 get info about a share
1845 ****************************************************************************/
1846
1847 static bool check_share_info(int uLevel, char* id)
1848 {
1849 switch( uLevel ) {
1850 case 0:
1851 if (strcmp(id,"B13") != 0) {
1852 return False;
1853 }
1854 break;
1855 case 1:
1856 /* Level-2 descriptor is allowed (and ignored) */
1857 if (strcmp(id,"B13BWz") != 0 &&
1858 strcmp(id,"B13BWzWWWzB9B") != 0) {
1859 return False;
1860 }
1861 break;
1862 case 2:
1863 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1864 return False;
1865 }
1866 break;
1867 case 91:
1868 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1869 return False;
1870 }
1871 break;
1872 default:
1873 return False;
1874 }
1875 return True;
1876 }
1877
1878 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1879 char** buf, int* buflen,
1880 char** stringbuf, int* stringspace, char* baseaddr)
1881 {
1882 int struct_len;
1883 char* p;
1884 char* p2;
1885 int l2;
1886 int len;
1887
1888 switch( uLevel ) {
1889 case 0:
1890 struct_len = 13;
1891 break;
1892 case 1:
1893 struct_len = 20;
1894 break;
1895 case 2:
1896 struct_len = 40;
1897 break;
1898 case 91:
1899 struct_len = 68;
1900 break;
1901 default:
1902 return -1;
1903 }
1904
1905 if (!buf) {
1906 len = 0;
1907
1908 if (uLevel > 0) {
1909 len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), snum));
1910 }
1911 if (uLevel > 1) {
1912 len += strlen(lp_path(talloc_tos(), snum)) + 1;
1913 }
1914 if (buflen) {
1915 *buflen = struct_len;
1916 }
1917 if (stringspace) {
1918 *stringspace = len;
1919 }
1920 return struct_len + len;
1921 }
1922
1923 len = struct_len;
1924 p = *buf;
1925 if ((*buflen) < struct_len) {
1926 return -1;
1927 }
1928
1929 if (stringbuf) {
1930 p2 = *stringbuf;
1931 l2 = *stringspace;
1932 } else {
1933 p2 = p + struct_len;
1934 l2 = (*buflen) - struct_len;
1935 }
1936
1937 if (!baseaddr) {
1938 baseaddr = p;
1939 }
1940
1941 push_ascii(p,lp_servicename(talloc_tos(), snum),13, STR_TERMINATE);
1942
1943 if (uLevel > 0) {
1944 int type;
1945
1946 SCVAL(p,13,0);
1947 type = STYPE_DISKTREE;
1948 if (lp_printable(snum)) {
1949 type = STYPE_PRINTQ;
1950 }
1951 if (strequal("IPC",lp_fstype(snum))) {
1952 type = STYPE_IPC;
1953 }
1954 SSVAL(p,14,type); /* device type */
1955 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1956 len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(),snum),&l2);
1957 }
1958
1959 if (uLevel > 1) {
1960 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1961 SSVALS(p,22,-1); /* max uses */
1962 SSVAL(p,24,1); /* current uses */
1963 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1964 len += CopyAndAdvance(&p2,lp_path(talloc_tos(),snum),&l2);
1965 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1966 }
1967
1968 if (uLevel > 2) {
1969 memset(p+40,0,SHPWLEN+2);
1970 SSVAL(p,50,0);
1971 SIVAL(p,52,0);
1972 SSVAL(p,56,0);
1973 SSVAL(p,58,0);
1974 SIVAL(p,60,0);
1975 SSVAL(p,64,0);
1976 SSVAL(p,66,0);
1977 }
1978
1979 if (stringbuf) {
1980 (*buf) = p + struct_len;
1981 (*buflen) -= struct_len;
1982 (*stringbuf) = p2;
1983 (*stringspace) = l2;
1984 } else {
1985 (*buf) = p2;
1986 (*buflen) -= len;
1987 }
1988
1989 return len;
1990 }
1991
1992 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
1993 connection_struct *conn,uint64_t vuid,
1994 char *param, int tpscnt,
1995 char *data, int tdscnt,
1996 int mdrcnt,int mprcnt,
1997 char **rdata,char **rparam,
1998 int *rdata_len,int *rparam_len)
1999 {
2000 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2001 char *str2 = skip_string(param,tpscnt,str1);
2002 char *netname_in = skip_string(param,tpscnt,str2);
2003 char *netname = NULL;
2004 char *p = skip_string(param,tpscnt,netname);
2005 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2006 int snum;
2007
2008 if (!str1 || !str2 || !netname_in || !p) {
2009 return False;
2010 }
2011
2012 snum = find_service(talloc_tos(), netname_in, &netname);
2013 if (snum < 0 || !netname) {
2014 return False;
2015 }
2016
2017 /* check it's a supported varient */
2018 if (!prefix_ok(str1,"zWrLh")) {
2019 return False;
2020 }
2021 if (!check_share_info(uLevel,str2)) {
2022 return False;
2023 }
2024
2025 *rdata = smb_realloc_limit(*rdata,mdrcnt);
2026 if (!*rdata) {
2027 return False;
2028 }
2029 p = *rdata;
2030 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2031 if (*rdata_len < 0) {
2032 return False;
2033 }
2034
2035 *rparam_len = 6;
2036 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2037 if (!*rparam) {
2038 return False;
2039 }
2040 SSVAL(*rparam,0,NERR_Success);
2041 SSVAL(*rparam,2,0); /* converter word */
2042 SSVAL(*rparam,4,*rdata_len);
2043
2044 return True;
2045 }
2046
2047 /****************************************************************************
2048 View the list of available shares.
2049
2050 This function is the server side of the NetShareEnum() RAP call.
2051 It fills the return buffer with share names and share comments.
2052 Note that the return buffer normally (in all known cases) allows only
2053 twelve byte strings for share names (plus one for a nul terminator).
2054 Share names longer than 12 bytes must be skipped.
2055 ****************************************************************************/
2056
2057 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2058 connection_struct *conn, uint64_t vuid,
2059 char *param, int tpscnt,
2060 char *data, int tdscnt,
2061 int mdrcnt,
2062 int mprcnt,
2063 char **rdata,
2064 char **rparam,
2065 int *rdata_len,
2066 int *rparam_len )
2067 {
2068 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2069 char *str2 = skip_string(param,tpscnt,str1);
2070 char *p = skip_string(param,tpscnt,str2);
2071 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2072 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2073 char *p2;
2074 int count = 0;
2075 int total=0,counted=0;
2076 bool missed = False;
2077 int i;
2078 int data_len, fixed_len, string_len;
2079 int f_len = 0, s_len = 0;
2080
2081 if (!str1 || !str2 || !p) {
2082 return False;
2083 }
2084
2085 if (!prefix_ok(str1,"WrLeh")) {
2086 return False;
2087 }
2088 if (!check_share_info(uLevel,str2)) {
2089 return False;
2090 }
2091
2092 /* Ensure all the usershares are loaded. */
2093 become_root();
2094 load_registry_shares();
2095 count = load_usershare_shares(NULL, connections_snum_used);
2096 unbecome_root();
2097
2098 data_len = fixed_len = string_len = 0;
2099 for (i=0;i<count;i++) {
2100 fstring servicename_dos;
2101 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2102 continue;
2103 }
2104 push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), i));
2105 /* Maximum name length = 13. */
2106 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2107 total++;
2108 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2109 if (data_len < buf_len) {
2110 counted++;
2111 fixed_len += f_len;
2112 string_len += s_len;
2113 } else {
2114 missed = True;
2115 }
2116 }
2117 }
2118
2119 *rdata_len = fixed_len + string_len;
2120 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2121 if (!*rdata) {
2122 return False;
2123 }
2124
2125 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2126 p = *rdata;
2127 f_len = fixed_len;
2128 s_len = string_len;
2129
2130 for( i = 0; i < count; i++ ) {
2131 fstring servicename_dos;
2132 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2133 continue;
2134 }
2135
2136 push_ascii_fstring(servicename_dos,
2137 lp_servicename(talloc_tos(), i));
2138 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2139 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2140 break;
2141 }
2142 }
2143 }
2144
2145 *rparam_len = 8;
2146 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2147 if (!*rparam) {
2148 return False;
2149 }
2150 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2151 SSVAL(*rparam,2,0);
2152 SSVAL(*rparam,4,counted);
2153 SSVAL(*rparam,6,total);
2154
2155 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2156 counted,total,uLevel,
2157 buf_len,*rdata_len,mdrcnt));
2158
2159 return True;
2160 }
2161
2162 /****************************************************************************
2163 Add a share
2164 ****************************************************************************/
2165
2166 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2167 connection_struct *conn,uint64_t vuid,
2168 char *param, int tpscnt,
2169 char *data, int tdscnt,
2170 int mdrcnt,int mprcnt,
2171 char **rdata,char **rparam,
2172 int *rdata_len,int *rparam_len)
2173 {
2174 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2175 char *str2 = skip_string(param,tpscnt,str1);
2176 char *p = skip_string(param,tpscnt,str2);
2177 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2178 fstring sharename;
2179 fstring comment;
2180 char *pathname = NULL;
2181 unsigned int offset;
2182 int res = ERRunsup;
2183 size_t converted_size;
2184
2185 WERROR werr = WERR_OK;
2186 TALLOC_CTX *mem_ctx = talloc_tos();
2187 NTSTATUS status;
2188 struct rpc_pipe_client *cli = NULL;
2189 union srvsvc_NetShareInfo info;
2190 struct srvsvc_NetShareInfo2 info2;
2191 struct dcerpc_binding_handle *b;
2192
2193 if (!str1 || !str2 || !p) {
2194 return False;
2195 }
2196
2197 /* check it's a supported varient */
2198 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2199 return False;
2200 }
2201 if (!check_share_info(uLevel,str2)) {
2202 return False;
2203 }
2204 if (uLevel != 2) {
2205 return False;
2206 }
2207
2208 /* Do we have a string ? */
2209 if (skip_string(data,mdrcnt,data) == NULL) {
2210 return False;
2211 }
2212 pull_ascii_fstring(sharename,data);
2213
2214 if (mdrcnt < 28) {
2215 return False;
2216 }
2217
2218 /* only support disk share adds */
2219 if (SVAL(data,14)!=STYPE_DISKTREE) {
2220 return False;
2221 }
2222
2223 offset = IVAL(data, 16);
2224 if (offset >= mdrcnt) {
2225 res = ERRinvalidparam;
2226 goto out;
2227 }
2228
2229 /* Do we have a string ? */
2230 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2231 return False;
2232 }
2233 pull_ascii_fstring(comment, offset? (data+offset) : "");
2234
2235 offset = IVAL(data, 26);
2236
2237 if (offset >= mdrcnt) {
2238 res = ERRinvalidparam;
2239 goto out;
2240 }
2241
2242 /* Do we have a string ? */
2243 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2244 return False;
2245 }
2246
2247 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2248 offset ? (data+offset) : "", &converted_size))
2249 {
2250 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2251 strerror(errno)));
2252 }
2253
2254 if (!pathname) {
2255 return false;
2256 }
2257
2258 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
2259 conn->session_info,
2260 conn->sconn->remote_address,
2261 conn->sconn->msg_ctx,
2262 &cli);
2263 if (!NT_STATUS_IS_OK(status)) {
2264 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2265 nt_errstr(status)));
2266 res = W_ERROR_V(ntstatus_to_werror(status));
2267 goto out;
2268 }
2269
2270 b = cli->binding_handle;
2271
2272 info2.name = sharename;
2273 info2.type = STYPE_DISKTREE;
2274 info2.comment = comment;
2275 info2.permissions = 0;
2276 info2.max_users = 0;
2277 info2.current_users = 0;
2278 info2.path = pathname;
2279 info2.password = NULL;
2280
2281 info.info2 = &info2;
2282
2283 status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2284 cli->srv_name_slash,
2285 2,
2286 &info,
2287 NULL,
2288 &werr);
2289 if (!NT_STATUS_IS_OK(status)) {
2290 res = W_ERROR_V(ntstatus_to_werror(status));
2291 goto out;
2292 }
2293 if (!W_ERROR_IS_OK(werr)) {
2294 res = W_ERROR_V(werr);
2295 goto out;
2296 }
2297
2298 *rparam_len = 6;
2299 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2300 if (!*rparam) {
2301 return False;
2302 }
2303 SSVAL(*rparam,0,NERR_Success);
2304 SSVAL(*rparam,2,0); /* converter word */
2305 SSVAL(*rparam,4,*rdata_len);
2306 *rdata_len = 0;
2307
2308 return True;
2309
2310 out:
2311
2312 *rparam_len = 4;
2313 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2314 if (!*rparam) {
2315 return False;
2316 }
2317 *rdata_len = 0;
2318 SSVAL(*rparam,0,res);
2319 SSVAL(*rparam,2,0);
2320 return True;
2321 }
2322
2323 /****************************************************************************
2324 view list of groups available
2325 ****************************************************************************/
2326
2327 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2328 connection_struct *conn,uint64_t vuid,
2329 char *param, int tpscnt,
2330 char *data, int tdscnt,
2331 int mdrcnt,int mprcnt,
2332 char **rdata,char **rparam,
2333 int *rdata_len,int *rparam_len)
2334 {
2335 int i;
2336 int errflags=0;
2337 int resume_context, cli_buf_size;
2338 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2339 char *str2 = skip_string(param,tpscnt,str1);
2340 char *p = skip_string(param,tpscnt,str2);
2341
2342 uint32_t num_groups;
2343 uint32_t resume_handle;
2344 struct rpc_pipe_client *samr_pipe = NULL;
2345 struct policy_handle samr_handle, domain_handle;
2346 NTSTATUS status, result;
2347 struct dcerpc_binding_handle *b;
2348
2349 if (!str1 || !str2 || !p) {
2350 return False;
2351 }
2352
2353 if (strcmp(str1,"WrLeh") != 0) {
2354 return False;
2355 }
2356
2357 /* parameters
2358 * W-> resume context (number of users to skip)
2359 * r -> return parameter pointer to receive buffer
2360 * L -> length of receive buffer
2361 * e -> return parameter number of entries
2362 * h -> return parameter total number of users
2363 */
2364
2365 if (strcmp("B21",str2) != 0) {
2366 return False;
2367 }
2368
2369 status = rpc_pipe_open_interface(
2370 talloc_tos(), &ndr_table_samr,
2371 conn->session_info, conn->sconn->remote_address,
2372 conn->sconn->msg_ctx, &samr_pipe);
2373 if (!NT_STATUS_IS_OK(status)) {
2374 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2375 nt_errstr(status)));
2376 return false;
2377 }
2378
2379 b = samr_pipe->binding_handle;
2380
2381 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2382 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2383 &result);
2384 if (!NT_STATUS_IS_OK(status)) {
2385 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2386 nt_errstr(status)));
2387 return false;
2388 }
2389 if (!NT_STATUS_IS_OK(result)) {
2390 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2391 nt_errstr(result)));
2392 return false;
2393 }
2394
2395 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2396 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2397 get_global_sam_sid(), &domain_handle,
2398 &result);
2399 if (!NT_STATUS_IS_OK(status)) {
2400 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2401 nt_errstr(status)));
2402 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2403 return false;
2404 }
2405 if (!NT_STATUS_IS_OK(result)) {
2406 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2407 nt_errstr(result)));
2408 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2409 return false;
2410 }
2411
2412 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2413 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2414 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2415 "%d\n", resume_context, cli_buf_size));
2416
2417 *rdata_len = cli_buf_size;
2418 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2419 if (!*rdata) {
2420 return False;
2421 }
2422
2423 p = *rdata;
2424
2425 errflags = NERR_Success;
2426 num_groups = 0;
2427 resume_handle = 0;
2428
2429 while (true) {
2430 struct samr_SamArray *sam_entries;
2431 uint32_t num_entries;
2432
2433 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2434 &domain_handle,
2435 &resume_handle,
2436 &sam_entries, 1,
2437 &num_entries,
2438 &result);
2439 if (!NT_STATUS_IS_OK(status)) {
2440 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2441 "%s\n", nt_errstr(status)));
2442 break;
2443 }
2444 if (!NT_STATUS_IS_OK(result)) {
2445 status = result;
2446 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2447 "%s\n", nt_errstr(result)));
2448 break;
2449 }
2450
2451 if (num_entries == 0) {
2452 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2453 "no entries -- done\n"));
2454 break;
2455 }
2456
2457 for(i=0; i<num_entries; i++) {
2458 const char *name;
2459
2460 name = sam_entries->entries[i].name.string;
2461
2462 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2463 /* set overflow error */
2464 DEBUG(3,("overflow on entry %d group %s\n", i,
2465 name));
2466 errflags=234;
2467 break;
2468 }
2469
2470 /* truncate the name at 21 chars. */
2471 memset(p, 0, 21);
2472 strlcpy(p, name, 21);
2473 DEBUG(10,("adding entry %d group %s\n", i, p));
2474 p += 21;
2475 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2476 * idea why... */
2477 num_groups += 1;
2478 }
2479
2480 if (errflags != NERR_Success) {
2481 break;
2482 }
2483
2484 TALLOC_FREE(sam_entries);
2485 }
2486
2487 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2488 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2489
2490 *rdata_len = PTR_DIFF(p,*rdata);
2491
2492 *rparam_len = 8;
2493 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2494 if (!*rparam) {
2495 return False;
2496 }
2497 SSVAL(*rparam, 0, errflags);
2498 SSVAL(*rparam, 2, 0); /* converter word */
2499 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2500 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2501
2502 return(True);
2503 }
2504
2505 /*******************************************************************
2506 Get groups that a user is a member of.
2507 ******************************************************************/
2508
2509 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2510 connection_struct *conn,uint64_t vuid,
2511 char *param, int tpscnt,
2512 char *data, int tdscnt,
2513 int mdrcnt,int mprcnt,
2514 char **rdata,char **rparam,
2515 int *rdata_len,int *rparam_len)
2516 {
2517 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2518 char *str2 = skip_string(param,tpscnt,str1);
2519 char *UserName = skip_string(param,tpscnt,str2);
2520 char *p = skip_string(param,tpscnt,UserName);
2521 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2522 const char *level_string;
2523 int count=0;
2524 bool ret = False;
2525 uint32_t i;
2526 char *endp = NULL;
2527
2528 struct rpc_pipe_client *samr_pipe = NULL;
2529 struct policy_handle samr_handle, domain_handle, user_handle;
2530 struct lsa_String name;
2531 struct lsa_Strings names;
2532 struct samr_Ids type, rid;
2533 struct samr_RidWithAttributeArray *rids;
2534 NTSTATUS status, result;
2535 struct dcerpc_binding_handle *b;
2536
2537 if (!str1 || !str2 || !UserName || !p) {
2538 return False;
2539 }
2540
2541 *rparam_len = 8;
2542 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2543 if (!*rparam) {
2544 return False;
2545 }
2546
2547 /* check it's a supported varient */
2548
2549 if ( strcmp(str1,"zWrLeh") != 0 )
2550 return False;
2551
2552 switch( uLevel ) {
2553 case 0:
2554 level_string = "B21";
2555 break;
2556 default:
2557 return False;
2558 }
2559
2560 if (strcmp(level_string,str2) != 0)
2561 return False;
2562
2563 *rdata_len = mdrcnt + 1024;
2564 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2565 if (!*rdata) {
2566 return False;
2567 }
2568
2569 SSVAL(*rparam,0,NERR_Success);
2570 SSVAL(*rparam,2,0); /* converter word */
2571
2572 p = *rdata;
2573 endp = *rdata + *rdata_len;
2574
2575 status = rpc_pipe_open_interface(
2576 talloc_tos(), &ndr_table_samr,
2577 conn->session_info, conn->sconn->remote_address,
2578 conn->sconn->msg_ctx, &samr_pipe);
2579 if (!NT_STATUS_IS_OK(status)) {
2580 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2581 nt_errstr(status)));
2582 return false;
2583 }
2584
2585 b = samr_pipe->binding_handle;
2586
2587 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2588 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2589 &result);
2590 if (!NT_STATUS_IS_OK(status)) {
2591 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2592 nt_errstr(status)));
2593 return false;
2594 }
2595 if (!NT_STATUS_IS_OK(result)) {
2596 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2597 nt_errstr(result)));
2598 return false;
2599 }
2600
2601 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2602 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2603 get_global_sam_sid(), &domain_handle,
2604 &result);
2605 if (!NT_STATUS_IS_OK(status)) {
2606 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2607 nt_errstr(status)));
2608 goto close_sam;
2609 }
2610 if (!NT_STATUS_IS_OK(result)) {
2611 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2612 nt_errstr(result)));
2613 goto close_sam;
2614 }
2615
2616 name.string = UserName;
2617
2618 status = dcerpc_samr_LookupNames(b, talloc_tos(),
2619 &domain_handle, 1, &name,
2620 &rid, &type,
2621 &result);
2622 if (!NT_STATUS_IS_OK(status)) {
2623 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2624 nt_errstr(status)));
2625 goto close_domain;
2626 }
2627 if (!NT_STATUS_IS_OK(result)) {
2628 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2629 nt_errstr(result)));
2630 goto close_domain;
2631 }
2632 if (rid.count != 1) {
2633 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2634 goto close_domain;
2635 }
2636 if (type.count != 1) {
2637 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2638 goto close_domain;
2639 }
2640
2641 if (type.ids[0] != SID_NAME_USER) {
2642 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2643 sid_type_lookup(type.ids[0])));
2644 goto close_domain;
2645 }
2646
2647 status = dcerpc_samr_OpenUser(b, talloc_tos(),
2648 &domain_handle,
2649 SAMR_USER_ACCESS_GET_GROUPS,
2650 rid.ids[0], &user_handle,
2651 &result);
2652 if (!NT_STATUS_IS_OK(status)) {
2653 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2654 nt_errstr(status)));
2655 goto close_domain;
2656 }
2657 if (!NT_STATUS_IS_OK(result)) {
2658 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2659 nt_errstr(result)));
2660 goto close_domain;
2661 }
2662
2663 status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2664 &user_handle, &rids,
2665 &result);
2666 if (!NT_STATUS_IS_OK(status)) {
2667 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2668 nt_errstr(status)));
2669 goto close_user;
2670 }
2671 if (!NT_STATUS_IS_OK(result)) {
2672 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2673 nt_errstr(result)));
2674 goto close_user;
2675 }
2676
2677 for (i=0; i<rids->count; i++) {
2678
2679 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2680 &domain_handle,
2681 1, &rids->rids[i].rid,
2682 &names, &type,
2683 &result);
2684 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2685 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2686 p += 21;
2687 count++;
2688 }
2689 }
2690
2691 *rdata_len = PTR_DIFF(p,*rdata);
2692
2693 SSVAL(*rparam,4,count); /* is this right?? */
2694 SSVAL(*rparam,6,count); /* is this right?? */
2695
2696 ret = True;
2697
2698 close_user:
2699 dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2700 close_domain:
2701 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2702 close_sam:
2703 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2704
2705 return ret;
2706 }
2707
2708 /*******************************************************************
2709 Get all users.
2710 ******************************************************************/
2711
2712 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2713 connection_struct *conn, uint64_t vuid,
2714 char *param, int tpscnt,
2715 char *data, int tdscnt,
2716 int mdrcnt,int mprcnt,
2717 char **rdata,char **rparam,
2718 int *rdata_len,int *rparam_len)
2719 {
2720 int count_sent=0;
2721 int num_users=0;
2722 int errflags=0;
2723 int i, resume_context, cli_buf_size;
2724 uint32_t resume_handle;
2725
2726 struct rpc_pipe_client *samr_pipe = NULL;
2727 struct policy_handle samr_handle, domain_handle;
2728 NTSTATUS status, result;
2729
2730 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2731 char *str2 = skip_string(param,tpscnt,str1);
2732 char *p = skip_string(param,tpscnt,str2);
2733 char *endp = NULL;
2734
2735 struct dcerpc_binding_handle *b;
2736
2737 if (!str1 || !str2 || !p) {
2738 return False;
2739 }
2740
2741 if (strcmp(str1,"WrLeh") != 0)
2742 return False;
2743 /* parameters
2744 * W-> resume context (number of users to skip)
2745 * r -> return parameter pointer to receive buffer
2746 * L -> length of receive buffer
2747 * e -> return parameter number of entries
2748 * h -> return parameter total number of users
2749 */
2750
2751 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2752 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2753 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2754 resume_context, cli_buf_size));
2755
2756 *rparam_len = 8;
2757 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2758 if (!*rparam) {
2759 return False;
2760 }
2761
2762 /* check it's a supported varient */
2763 if (strcmp("B21",str2) != 0)
2764 return False;
2765
2766 *rdata_len = cli_buf_size;
2767 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2768 if (!*rdata) {
2769 return False;
2770 }
2771
2772 p = *rdata;
2773 endp = *rdata + *rdata_len;
2774
2775 status = rpc_pipe_open_interface(
2776 talloc_tos(), &ndr_table_samr,
2777 conn->session_info, conn->sconn->remote_address,
2778 conn->sconn->msg_ctx, &samr_pipe);
2779 if (!NT_STATUS_IS_OK(status)) {
2780 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2781 nt_errstr(status)));
2782 return false;
2783 }
2784
2785 b = samr_pipe->binding_handle;
2786
2787 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2788 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2789 &result);
2790 if (!NT_STATUS_IS_OK(status)) {
2791 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2792 nt_errstr(status)));
2793 return false;
2794 }
2795 if (!NT_STATUS_IS_OK(result)) {
2796 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2797 nt_errstr(result)));
2798 return false;
2799 }
2800
2801 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2802 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2803 get_global_sam_sid(), &domain_handle,
2804 &result);
2805 if (!NT_STATUS_IS_OK(status)) {
2806 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2807 nt_errstr(status)));
2808 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2809 return false;
2810 }
2811 if (!NT_STATUS_IS_OK(result)) {
2812 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2813 nt_errstr(result)));
2814 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2815 return false;
2816 }
2817
2818 errflags=NERR_Success;
2819
2820 resume_handle = 0;
2821
2822 while (true) {
2823 struct samr_SamArray *sam_entries;
2824 uint32_t num_entries;
2825
2826 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2827 &domain_handle,
2828 &resume_handle,
2829 0, &sam_entries, 1,
2830 &num_entries,
2831 &result);
2832
2833 if (!NT_STATUS_IS_OK(status)) {
2834 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2835 "%s\n", nt_errstr(status)));
2836 break;
2837 }
2838 if (!NT_STATUS_IS_OK(result)) {
2839 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2840 "%s\n", nt_errstr(result)));
2841 break;
2842 }
2843
2844 if (num_entries == 0) {
2845 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2846 "no entries -- done\n"));
2847 break;
2848 }
2849
2850 for (i=0; i<num_entries; i++) {
2851 const char *name;
2852
2853 name = sam_entries->entries[i].name.string;
2854
2855 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2856 &&(strlen(name)<=21)) {
2857 strlcpy(p,name,PTR_DIFF(endp,p));
2858 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2859 "username %s\n",count_sent,p));
2860 p += 21;
2861 count_sent++;
2862 } else {
2863 /* set overflow error */
2864 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2865 "username %s\n",count_sent,name));
2866 errflags=234;
2867 break;
2868 }
2869 }
2870
2871 if (errflags != NERR_Success) {
2872 break;
2873 }
2874
2875 TALLOC_FREE(sam_entries);
2876 }
2877
2878 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2879 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2880
2881 *rdata_len = PTR_DIFF(p,*rdata);
2882
2883 SSVAL(*rparam,0,errflags);
2884 SSVAL(*rparam,2,0); /* converter word */
2885 SSVAL(*rparam,4,count_sent); /* is this right?? */
2886 SSVAL(*rparam,6,num_users); /* is this right?? */
2887
2888 return True;
2889 }
2890
2891 /****************************************************************************
2892 Get the time of day info.
2893 ****************************************************************************/
2894
2895 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2896 connection_struct *conn,uint64_t vuid,
2897 char *param, int tpscnt,
2898 char *data, int tdscnt,
2899 int mdrcnt,int mprcnt,
2900 char **rdata,char **rparam,
2901 int *rdata_len,int *rparam_len)
2902 {
2903 struct tm *t;
2904 time_t unixdate = time(NULL);
2905 char *p;
2906
2907 *rparam_len = 4;
2908 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2909 if (!*rparam) {
2910 return False;
2911 }
2912
2913 *rdata_len = 21;
2914 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2915 if (!*rdata) {
2916 return False;
2917 }
2918
2919 SSVAL(*rparam,0,NERR_Success);
2920 SSVAL(*rparam,2,0); /* converter word */
2921
2922 p = *rdata;
2923
2924 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2925 by NT in a "net time" operation,
2926 it seems to ignore the one below */
2927
2928 /* the client expects to get localtime, not GMT, in this bit
2929 (I think, this needs testing) */
2930 t = localtime(&unixdate);
2931 if (!t) {
2932 return False;
2933 }
2934
2935 SIVAL(p,4,0); /* msecs ? */
2936 SCVAL(p,8,t->tm_hour);
2937 SCVAL(p,9,t->tm_min);
2938 SCVAL(p,10,t->tm_sec);
2939 SCVAL(p,11,0); /* hundredths of seconds */
2940 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2941 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2942 SCVAL(p,16,t->tm_mday);
2943 SCVAL(p,17,t->tm_mon + 1);
2944 SSVAL(p,18,1900+t->tm_year);
2945 SCVAL(p,20,t->tm_wday);
2946
2947 return True;
2948 }
2949
2950 /****************************************************************************
2951 Set the user password (SamOEM version - gets plaintext).
2952 ****************************************************************************/
2953
2954 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
2955 connection_struct *conn,uint64_t vuid,
2956 char *param, int tpscnt,
2957 char *data, int tdscnt,
2958 int mdrcnt,int mprcnt,
2959 char **rdata,char **rparam,
2960 int *rdata_len,int *rparam_len)
2961 {
2962 fstring user;
2963 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2964
2965 TALLOC_CTX *mem_ctx = talloc_tos();
2966 NTSTATUS status, result;
2967 struct rpc_pipe_client *cli = NULL;
2968 struct lsa_AsciiString server, account;
2969 struct samr_CryptPassword password;
2970 struct samr_Password hash;
2971 int errcode = NERR_badpass;
2972 int bufsize;
2973 struct dcerpc_binding_handle *b;
2974
2975 *rparam_len = 4;
2976 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2977 if (!*rparam) {
2978 return False;
2979 }
2980
2981 if (!p) {
2982 return False;
2983 }
2984 *rdata_len = 0;
2985
2986 SSVAL(*rparam,0,NERR_badpass);
2987
2988 /*
2989 * Check the parameter definition is correct.
2990 */
2991
2992 /* Do we have a string ? */
2993 if (skip_string(param,tpscnt,p) == 0) {
2994 return False;
2995 }
2996 if(!strequal(p, "zsT")) {
2997 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2998 return False;
2999 }
3000 p = skip_string(param, tpscnt, p);
3001 if (!p) {
3002 return False;
3003 }
3004
3005 /* Do we have a string ? */
3006 if (skip_string(param,tpscnt,p) == 0) {
3007 return False;
3008 }
3009 if(!strequal(p, "B516B16")) {
3010 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3011 return False;
3012 }
3013 p = skip_string(param,tpscnt,p);
3014 if (!p) {
3015 return False;
3016 }
3017 /* Do we have a string ? */
3018 if (skip_string(param,tpscnt,p) == 0) {
3019 return False;
3020 }
3021 p += pull_ascii_fstring(user,p);
3022
3023 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3024
3025 if (tdscnt != 532) {
3026 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3027 goto out;
3028 }
3029
3030 bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3031 if (bufsize != 532) {
3032 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3033 goto out;
3034 }
3035
3036 memcpy(password.data, data, 516);
3037 memcpy(hash.hash, data+516, 16);
3038
3039 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
3040 conn->session_info,
3041 conn->sconn->remote_address,
3042 conn->sconn->msg_ctx,
3043 &cli);
3044 if (!NT_STATUS_IS_OK(status)) {
3045 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3046 nt_errstr(status)));
3047 errcode = W_ERROR_V(ntstatus_to_werror(status));
3048 goto out;
3049 }
3050
3051 b = cli->binding_handle;
3052
3053 init_lsa_AsciiString(&server, lp_netbios_name());
3054 init_lsa_AsciiString(&account, user);
3055
3056 status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3057 &server,
3058 &account,
3059 &password,
3060 &hash,
3061 &result);
3062 if (!NT_STATUS_IS_OK(status)) {
3063 errcode = W_ERROR_V(ntstatus_to_werror(status));
3064 goto out;
3065 }
3066 if (!NT_STATUS_IS_OK(result)) {
3067 errcode = W_ERROR_V(ntstatus_to_werror(result));
3068 goto out;
3069 }
3070
3071 errcode = NERR_Success;
3072 out:
3073 SSVAL(*rparam,0,errcode);
3074 SSVAL(*rparam,2,0); /* converter word */
3075
3076 return(True);
3077 }
3078
3079 /****************************************************************************
3080 delete a print job
3081 Form: <W> <>
3082 ****************************************************************************/
3083
3084 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3085 connection_struct *conn,uint64_t vuid,
3086 char *param, int tpscnt,
3087 char *data, int tdscnt,
3088 int mdrcnt,int mprcnt,
3089 char **rdata,char **rparam,
3090 int *rdata_len,int *rparam_len)
3091 {
3092 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3093 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3094 char *str2 = skip_string(param,tpscnt,str1);
3095 char *p = skip_string(param,tpscnt,str2);
3096 uint32 jobid;
3097 fstring sharename;
3098 int errcode;
3099 WERROR werr = WERR_OK;
3100
3101 TALLOC_CTX *mem_ctx = talloc_tos();
3102 NTSTATUS status;
3103 struct rpc_pipe_client *cli = NULL;
3104 struct dcerpc_binding_handle *b = NULL;
3105 struct policy_handle handle;
3106 struct spoolss_DevmodeContainer devmode_ctr;
3107 enum spoolss_JobControl command;
3108
3109 if (!str1 || !str2 || !p) {
3110 return False;
3111 }
3112 /*
3113 * We use 1 here not 2 as we're checking
3114 * the last byte we want to access is safe.
3115 */
3116 if (!is_offset_safe(param,tpscnt,p,1)) {
3117 return False;
3118 }
3119 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3120 return False;
3121
3122 /* check it's a supported varient */
3123 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3124 return(False);
3125
3126 *rparam_len = 4;
3127 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3128 if (!*rparam) {
3129 return False;
3130 }
3131 *rdata_len = 0;
3132
3133 ZERO_STRUCT(handle);
3134
3135 status = rpc_pipe_open_interface(conn,
3136 &ndr_table_spoolss,
3137 conn->session_info,
3138 conn->sconn->remote_address,
3139 conn->sconn->msg_ctx,
3140 &cli);
3141 if (!NT_STATUS_IS_OK(status)) {
3142 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3143 nt_errstr(status)));
3144 errcode = W_ERROR_V(ntstatus_to_werror(status));
3145 goto out;
3146 }
3147 b = cli->binding_handle;
3148
3149 ZERO_STRUCT(devmode_ctr);
3150
3151 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3152 sharename,
3153 "RAW",
3154 devmode_ctr,
3155 JOB_ACCESS_ADMINISTER,
3156 &handle,
3157 &werr);
3158 if (!NT_STATUS_IS_OK(status)) {
3159 errcode = W_ERROR_V(ntstatus_to_werror(status));
3160 goto out;
3161 }
3162 if (!W_ERROR_IS_OK(werr)) {
3163 errcode = W_ERROR_V(werr);
3164 goto out;
3165 }
3166
3167 /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3168 * and NERR_DestNotFound if share did not exist */
3169
3170 errcode = NERR_Success;
3171
3172 switch (function) {
3173 case 81: /* delete */
3174 command = SPOOLSS_JOB_CONTROL_DELETE;
3175 break;
3176 case 82: /* pause */
3177 command = SPOOLSS_JOB_CONTROL_PAUSE;
3178 break;
3179 case 83: /* resume */
3180 command = SPOOLSS_JOB_CONTROL_RESUME;
3181 break;
3182 default:
3183 errcode = NERR_notsupported;
3184 goto out;
3185 }
3186
3187 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3188 &handle,
3189 jobid,
3190 NULL, /* unique ptr ctr */
3191 command,
3192 &werr);
3193 if (!NT_STATUS_IS_OK(status)) {
3194 errcode = W_ERROR_V(ntstatus_to_werror(status));
3195 goto out;
3196 }
3197 if (!W_ERROR_IS_OK(werr)) {
3198 errcode = W_ERROR_V(werr);
3199 goto out;
3200 }
3201
3202 out:
3203 if (b && is_valid_policy_hnd(&handle)) {
3204 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3205 }
3206
3207 SSVAL(*rparam,0,errcode);
3208 SSVAL(*rparam,2,0); /* converter word */
3209
3210 return(True);
3211 }
3212
3213 /****************************************************************************
3214 Purge a print queue - or pause or resume it.
3215 ****************************************************************************/
3216
3217 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3218 connection_struct *conn,uint64_t vuid,
3219 char *param, int tpscnt,
3220 char *data, int tdscnt,
3221 int mdrcnt,int mprcnt,
3222 char **rdata,char **rparam,
3223 int *rdata_len,int *rparam_len)
3224 {
3225 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3226 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3227 char *str2 = skip_string(param,tpscnt,str1);
3228 char *QueueName = skip_string(param,tpscnt,str2);
3229 int errcode = NERR_notsupported;
3230 WERROR werr = WERR_OK;
3231 NTSTATUS status;
3232
3233 TALLOC_CTX *mem_ctx = talloc_tos();
3234 struct rpc_pipe_client *cli = NULL;
3235 struct dcerpc_binding_handle *b = NULL;
3236 struct policy_handle handle;
3237 struct spoolss_SetPrinterInfoCtr info_ctr;
3238 struct spoolss_DevmodeContainer devmode_ctr;
3239 struct sec_desc_buf secdesc_ctr;
3240 enum spoolss_PrinterControl command;
3241
3242 if (!str1 || !str2 || !QueueName) {
3243 return False;
3244 }
3245
3246 /* check it's a supported varient */
3247 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3248 return(False);
3249
3250 *rparam_len = 4;
3251 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3252 if (!*rparam) {
3253 return False;
3254 }
3255 *rdata_len = 0;
3256
3257 if (skip_string(param,tpscnt,QueueName) == NULL) {
3258 return False;
3259 }
3260
3261 ZERO_STRUCT(handle);
3262
3263 status = rpc_pipe_open_interface(conn,
3264 &ndr_table_spoolss,
3265 conn->session_info,
3266 conn->sconn->remote_address,
3267 conn->sconn->msg_ctx,
3268 &cli);
3269 if (!NT_STATUS_IS_OK(status)) {
3270 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3271 nt_errstr(status)));
3272 errcode = W_ERROR_V(ntstatus_to_werror(status));
3273 goto out;
3274 }
3275 b = cli->binding_handle;
3276
3277 ZERO_STRUCT(devmode_ctr);
3278
3279 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3280 QueueName,
3281 NULL,
3282 devmode_ctr,
3283 PRINTER_ACCESS_ADMINISTER,
3284 &handle,
3285 &werr);
3286 if (!NT_STATUS_IS_OK(status)) {
3287 errcode = W_ERROR_V(ntstatus_to_werror(status));
3288 goto out;
3289 }
3290 if (!W_ERROR_IS_OK(werr)) {
3291 errcode = W_ERROR_V(werr);
3292 goto out;
3293 }
3294
3295 switch (function) {
3296 case 74: /* Pause queue */
3297 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3298 break;
3299 case 75: /* Resume queue */
3300 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3301 break;
3302 case 103: /* Purge */
3303 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3304 break;
3305 default:
3306 werr = WERR_NOT_SUPPORTED;
3307 break;
3308 }
3309
3310 if (!W_ERROR_IS_OK(werr)) {
3311 errcode = W_ERROR_V(werr);
3312 goto out;
3313 }
3314
3315 ZERO_STRUCT(info_ctr);
3316 ZERO_STRUCT(secdesc_ctr);
3317
3318 status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3319 &handle,
3320 &info_ctr,
3321 &devmode_ctr,
3322 &secdesc_ctr,
3323 command,
3324 &werr);
3325 if (!NT_STATUS_IS_OK(status)) {
3326 errcode = W_ERROR_V(ntstatus_to_werror(status));
3327 goto out;
3328 }
3329 if (!W_ERROR_IS_OK(werr)) {
3330 errcode = W_ERROR_V(werr);
3331 goto out;
3332 }
3333
3334 errcode = W_ERROR_V(werr);
3335
3336 out:
3337
3338 if (b && is_valid_policy_hnd(&handle)) {
3339 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3340 }
3341
3342 SSVAL(*rparam,0,errcode);
3343 SSVAL(*rparam,2,0); /* converter word */
3344
3345 return(True);
3346 }
3347
3348 /****************************************************************************
3349 set the property of a print job (undocumented?)
3350 ? function = 0xb -> set name of print job
3351 ? function = 0x6 -> move print job up/down
3352 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3353 or <WWsTP> <WB21BB16B10zWWzDDz>
3354 ****************************************************************************/
3355
3356 static int check_printjob_info(struct pack_desc* desc,
3357 int uLevel, char* id)
3358 {
3359 desc->subformat = NULL;
3360 switch( uLevel ) {
3361 case 0: desc->format = "W"; break;
3362 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3363 case 2: desc->format = "WWzWWDDzz"; break;
3364 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3365 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3366 default:
3367 DEBUG(0,("check_printjob_info: invalid level %d\n",
3368 uLevel ));
3369 return False;
3370 }
3371 if (id == NULL || strcmp(desc->format,id) != 0) {
3372 DEBUG(0,("check_printjob_info: invalid format %s\n",
3373 id ? id : "<NULL>" ));
3374 return False;
3375 }
3376 return True;
3377 }
3378
3379 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3380 connection_struct *conn, uint64_t vuid,
3381 char *param, int tpscnt,
3382 char *data, int tdscnt,
3383 int mdrcnt,int mprcnt,
3384 char **rdata,char **rparam,
3385 int *rdata_len,int *rparam_len)
3386 {
3387 struct pack_desc desc;
3388 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3389 char *str2 = skip_string(param,tpscnt,str1);
3390 char *p = skip_string(param,tpscnt,str2);
3391 uint32 jobid;
3392 fstring sharename;
3393 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3394 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3395 int errcode;
3396
3397 TALLOC_CTX *mem_ctx = talloc_tos();
3398 WERROR werr;
3399 NTSTATUS status;
3400 struct rpc_pipe_client *cli = NULL;
3401 struct dcerpc_binding_handle *b = NULL;
3402 struct policy_handle handle;
3403 struct spoolss_DevmodeContainer devmode_ctr;
3404 struct spoolss_JobInfoContainer ctr;
3405 union spoolss_JobInfo info;
3406 struct spoolss_SetJobInfo1 info1;
3407
3408 if (!str1 || !str2 || !p) {
3409 return False;
3410 }
3411 /*
3412 * We use 1 here not 2 as we're checking
3413 * the last byte we want to access is safe.
3414 */
3415 if (!is_offset_safe(param,tpscnt,p,1)) {
3416 return False;
3417 }
3418 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3419 return False;
3420 *rparam_len = 4;
3421 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3422 if (!*rparam) {
3423 return False;
3424 }
3425
3426 *rdata_len = 0;
3427
3428 /* check it's a supported varient */
3429 if ((strcmp(str1,"WWsTP")) ||
3430 (!check_printjob_info(&desc,uLevel,str2)))
3431 return(False);
3432
3433 errcode = NERR_notsupported;
3434
3435 switch (function) {
3436 case 0xb:
3437 /* change print job name, data gives the name */
3438 break;
3439 default:
3440 goto out;
3441 }
3442
3443 ZERO_STRUCT(handle);
3444
3445 status = rpc_pipe_open_interface(conn,
3446 &ndr_table_spoolss,
3447 conn->session_info,
3448 conn->sconn->remote_address,
3449 conn->sconn->msg_ctx,
3450 &cli);
3451 if (!NT_STATUS_IS_OK(status)) {
3452 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3453 nt_errstr(status)));
3454 errcode = W_ERROR_V(ntstatus_to_werror(status));
3455 goto out;
3456 }
3457 b = cli->binding_handle;
3458
3459 ZERO_STRUCT(devmode_ctr);
3460
3461 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3462 sharename,
3463 "RAW",
3464 devmode_ctr,
3465 PRINTER_ACCESS_USE,
3466 &handle,
3467 &werr);
3468 if (!NT_STATUS_IS_OK(status)) {
3469 errcode = W_ERROR_V(ntstatus_to_werror(status));
3470 goto out;
3471 }
3472 if (!W_ERROR_IS_OK(werr)) {
3473 errcode = W_ERROR_V(werr);
3474 goto out;
3475 }
3476
3477 werr = rpccli_spoolss_getjob(cli, mem_ctx,
3478 &handle,
3479 jobid,
3480 1, /* level */
3481 0, /* offered */
3482 &info);
3483 if (!W_ERROR_IS_OK(werr)) {
3484 errcode = W_ERROR_V(werr);
3485 goto out;
3486 }
3487
3488 ZERO_STRUCT(ctr);
3489
3490 info1.job_id = info.info1.job_id;
3491 info1.printer_name = info.info1.printer_name;
3492 info1.user_name = info.info1.user_name;
3493 info1.document_name = data;
3494 info1.data_type = info.info1.data_type;
3495 info1.text_status = info.info1.text_status;
3496 info1.status = info.info1.status;
3497 info1.priority = info.info1.priority;
3498 info1.position = info.info1.position;
3499 info1.total_pages = info.info1.total_pages;
3500 info1.pages_printed = info.info1.pages_printed;
3501 info1.submitted = info.info1.submitted;
3502
3503 ctr.level = 1;
3504 ctr.info.info1 = &info1;
3505
3506 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3507 &handle,
3508 jobid,
3509 &ctr,
3510 0,
3511 &werr);
3512 if (!NT_STATUS_IS_OK(status)) {
3513 errcode = W_ERROR_V(ntstatus_to_werror(status));
3514 goto out;
3515 }
3516 if (!W_ERROR_IS_OK(werr)) {
3517 errcode = W_ERROR_V(werr);
3518 goto out;
3519 }
3520
3521 errcode = NERR_Success;
3522 out:
3523
3524 if (b && is_valid_policy_hnd(&handle)) {
3525 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3526 }
3527
3528 SSVALS(*rparam,0,errcode);
3529 SSVAL(*rparam,2,0); /* converter word */
3530
3531 return(True);
3532 }
3533
3534
3535 /****************************************************************************
3536 Get info about the server.
3537 ****************************************************************************/
3538
3539 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3540 connection_struct *conn,uint64_t vuid,
3541 char *param, int tpscnt,
3542 char *data, int tdscnt,
3543 int mdrcnt,int mprcnt,
3544 char **rdata,char **rparam,
3545 int *rdata_len,int *rparam_len)
3546 {
3547 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3548 char *str2 = skip_string(param,tpscnt,str1);
3549 char *p = skip_string(param,tpscnt,str2);
3550 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3551 char *p2;
3552 int struct_len;
3553
3554 NTSTATUS status;
3555 WERROR werr;
3556 TALLOC_CTX *mem_ctx = talloc_tos();
3557 struct rpc_pipe_client *cli = NULL;
3558 union srvsvc_NetSrvInfo info;
3559 int errcode;
3560 struct dcerpc_binding_handle *b;
3561
3562 if (!str1 || !str2 || !p) {
3563 return False;
3564 }
3565
3566 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3567
3568 /* check it's a supported varient */
3569 if (!prefix_ok(str1,"WrLh")) {
3570 return False;
3571 }
3572
3573 switch( uLevel ) {
3574 case 0:
3575 if (strcmp(str2,"B16") != 0) {
3576 return False;
3577 }
3578 struct_len = 16;
3579 break;
3580 case 1:
3581 if (strcmp(str2,"B16BBDz") != 0) {
3582 return False;
3583 }
3584 struct_len = 26;
3585 break;
3586 case 2:
3587 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3588 return False;
3589 }
3590 struct_len = 134;
3591 break;
3592 case 3:
3593 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3594 return False;
3595 }
3596 struct_len = 144;
3597 break;
3598 case 20:
3599 if (strcmp(str2,"DN") != 0) {
3600 return False;
3601 }
3602 struct_len = 6;
3603 break;
3604 case 50:
3605 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3606 return False;
3607 }
3608 struct_len = 42;
3609 break;
3610 default:
3611 return False;
3612 }
3613
3614 *rdata_len = mdrcnt;
3615 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3616 if (!*rdata) {
3617 return False;
3618 }
3619
3620 p = *rdata;
3621 p2 = p + struct_len;
3622
3623 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
3624 conn->session_info,
3625 conn->sconn->remote_address,
3626 conn->sconn->msg_ctx,
3627 &cli);
3628 if (!NT_STATUS_IS_OK(status)) {
3629 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3630 nt_errstr(status)));
3631 errcode = W_ERROR_V(ntstatus_to_werror(status));
3632 goto out;
3633 }
3634
3635 b = cli->binding_handle;
3636
3637 status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3638 NULL,
3639 101,
3640 &info,
3641 &werr);
3642 if (!NT_STATUS_IS_OK(status)) {
3643 errcode = W_ERROR_V(ntstatus_to_werror(status));
3644 goto out;
3645 }
3646 if (!W_ERROR_IS_OK(werr)) {
3647 errcode = W_ERROR_V(werr);
3648 goto out;
3649 }
3650
3651 if (info.info101 == NULL) {
3652 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3653 goto out;
3654 }
3655
3656 if (uLevel != 20) {
3657 srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3658 STR_ASCII|STR_UPPER|STR_TERMINATE);
3659 }
3660 p += 16;
3661 if (uLevel > 0) {
3662 SCVAL(p,0,info.info101->version_major);
3663 SCVAL(p,1,info.info101->version_minor);
3664 SIVAL(p,2,info.info101->server_type);
3665
3666 if (mdrcnt == struct_len) {
3667 SIVAL(p,6,0);
3668 } else {
3669 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3670 if (mdrcnt - struct_len <= 0) {
3671 return false;
3672 }
3673 push_ascii(p2,
3674 info.info101->comment,
3675 MIN(mdrcnt - struct_len,
3676 MAX_SERVER_STRING_LENGTH),
3677 STR_TERMINATE);
3678 p2 = skip_string(*rdata,*rdata_len,p2);
3679 if (!p2) {
3680 return False;
3681 }
3682 }
3683 }
3684
3685 if (uLevel > 1) {
3686 return False; /* not yet implemented */
3687 }
3688
3689 errcode = NERR_Success;
3690
3691 out:
3692
3693 *rdata_len = PTR_DIFF(p2,*rdata);
3694
3695 *rparam_len = 6;
3696 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3697 if (!*rparam) {
3698 return False;
3699 }
3700 SSVAL(*rparam,0,errcode);
3701 SSVAL(*rparam,2,0); /* converter word */
3702 SSVAL(*rparam,4,*rdata_len);
3703
3704 return True;
3705 }
3706
3707 /****************************************************************************
3708 Get info about the server.
3709 ****************************************************************************/
3710
3711 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3712 connection_struct *conn,uint64_t vuid,
3713 char *param, int tpscnt,
3714 char *data, int tdscnt,
3715 int mdrcnt,int mprcnt,
3716 char **rdata,char **rparam,
3717 int *rdata_len,int *rparam_len)
3718 {
3719 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3720 char *str2 = skip_string(param,tpscnt,str1);
3721 char *p = skip_string(param,tpscnt,str2);
3722 char *p2;
3723 char *endp;
3724 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3725
3726 if (!str1 || !str2 || !p) {
3727 return False;
3728 }
3729
3730 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3731
3732 *rparam_len = 6;
3733 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3734 if (!*rparam) {
3735 return False;
3736 }
3737
3738 /* check it's a supported varient */
3739 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3740 return False;
3741 }
3742
3743 *rdata_len = mdrcnt + 1024;
3744 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3745 if (!*rdata) {
3746 return False;
3747 }
3748
3749 SSVAL(*rparam,0,NERR_Success);
3750 SSVAL(*rparam,2,0); /* converter word */
3751
3752 p = *rdata;
3753 endp = *rdata + *rdata_len;
3754
3755 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3756 if (!p2) {
3757 return False;
3758 }
3759
3760 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3761 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3762 if (!strupper_m(p2)) {
3763 return false;
3764 }
3765 p2 = skip_string(*rdata,*rdata_len,p2);
3766 if (!p2) {
3767 return False;
3768 }
3769 p += 4;
3770
3771 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3772 strlcpy(p2,conn->session_info->unix_info->sanitized_username,PTR_DIFF(endp,p2));
3773 p2 = skip_string(*rdata,*rdata_len,p2);
3774 if (!p2) {
3775 return False;
3776 }
3777 p += 4;
3778
3779 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3780 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3781 if (!strupper_m(p2)) {
3782 return false;
3783 }
3784 p2 = skip_string(*rdata,*rdata_len,p2);
3785 if (!p2) {
3786 return False;
3787 }
3788 p += 4;
3789
3790 SCVAL(p,0,SAMBA_MAJOR_NBT_ANNOUNCE_VERSION); /* system version - e.g 4 in 4.1 */
3791 SCVAL(p,1,SAMBA_MINOR_NBT_ANNOUNCE_VERSION); /* system version - e.g .1 in 4.1 */
3792 p += 2;
3793
3794 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3795 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3796 p2 = skip_string(*rdata,*rdata_len,p2);
3797 if (!p2) {
3798 return False;
3799 }
3800 p += 4;
3801
3802 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3803 strlcpy(p2,"",PTR_DIFF(endp,p2));
3804 p2 = skip_string(*rdata,*rdata_len,p2);
3805 if (!p2) {
3806 return False;
3807 }
3808 p += 4;
3809
3810 *rdata_len = PTR_DIFF(p2,*rdata);
3811
3812 SSVAL(*rparam,4,*rdata_len);
3813
3814 return True;
3815 }
3816
3817 /****************************************************************************
3818 get info about a user
3819
3820 struct user_info_11 {
3821 char usri11_name[21]; 0-20
3822 char usri11_pad; 21
3823 char *usri11_comment; 22-25
3824 char *usri11_usr_comment; 26-29
3825 unsigned short usri11_priv; 30-31
3826 unsigned long usri11_auth_flags; 32-35
3827 long usri11_password_age; 36-39
3828 char *usri11_homedir; 40-43
3829 char *usri11_parms; 44-47
3830 long usri11_last_logon; 48-51
3831 long usri11_last_logoff; 52-55
3832 unsigned short usri11_bad_pw_count; 56-57
3833 unsigned short usri11_num_logons; 58-59
3834 char *usri11_logon_server; 60-63
3835 unsigned short usri11_country_code; 64-65
3836 char *usri11_workstations; 66-69
3837 unsigned long usri11_max_storage; 70-73
3838 unsigned short usri11_units_per_week; 74-75
3839 unsigned char *usri11_logon_hours; 76-79
3840 unsigned short usri11_code_page; 80-81
3841 };
3842
3843 where:
3844
3845 usri11_name specifies the user name for which information is retrieved
3846
3847 usri11_pad aligns the next data structure element to a word boundary
3848
3849 usri11_comment is a null terminated ASCII comment
3850
3851 usri11_user_comment is a null terminated ASCII comment about the user
3852
3853 usri11_priv specifies the level of the privilege assigned to the user.
3854 The possible values are:
3855
3856 Name Value Description
3857 USER_PRIV_GUEST 0 Guest privilege
3858 USER_PRIV_USER 1 User privilege
3859 USER_PRV_ADMIN 2 Administrator privilege
3860
3861 usri11_auth_flags specifies the account operator privileges. The
3862 possible values are:
3863
3864 Name Value Description
3865 AF_OP_PRINT 0 Print operator
3866
3867
3868 Leach, Naik [Page 28]
3869 \f
3870
3871
3872 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3873
3874
3875 AF_OP_COMM 1 Communications operator
3876 AF_OP_SERVER 2 Server operator
3877 AF_OP_ACCOUNTS 3 Accounts operator
3878
3879
3880 usri11_password_age specifies how many seconds have elapsed since the
3881 password was last changed.
3882
3883 usri11_home_dir points to a null terminated ASCII string that contains
3884 the path name of the user's home directory.
3885
3886 usri11_parms points to a null terminated ASCII string that is set
3887 aside for use by applications.
3888
3889 usri11_last_logon specifies the time when the user last logged on.
3890 This value is stored as the number of seconds elapsed since
3891 00:00:00, January 1, 1970.
3892
3893 usri11_last_logoff specifies the time when the user last logged off.
3894 This value is stored as the number of seconds elapsed since
3895 00:00:00, January 1, 1970. A value of 0 means the last logoff
3896 time is unknown.
3897
3898 usri11_bad_pw_count specifies the number of incorrect passwords
3899 entered since the last successful logon.
3900
3901 usri11_log1_num_logons specifies the number of times this user has
3902 logged on. A value of -1 means the number of logons is unknown.
3903
3904 usri11_logon_server points to a null terminated ASCII string that
3905 contains the name of the server to which logon requests are sent.
3906 A null string indicates logon requests should be sent to the
3907 domain controller.
3908
3909 usri11_country_code specifies the country code for the user's language
3910 of choice.
3911
3912 usri11_workstations points to a null terminated ASCII string that
3913 contains the names of workstations the user may log on from.
3914 There may be up to 8 workstations, with the names separated by
3915 commas. A null strings indicates there are no restrictions.
3916
3917 usri11_max_storage specifies the maximum amount of disk space the user
3918 can occupy. A value of 0xffffffff indicates there are no
3919 restrictions.
3920
3921 usri11_units_per_week specifies the equal number of time units into
3922 which a week is divided. This value must be equal to 168.
3923
3924 usri11_logon_hours points to a 21 byte (168 bits) string that
3925 specifies the time during which the user can log on. Each bit
3926 represents one unique hour in a week. The first bit (bit 0, word
3927 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3928
3929
3930
3931 Leach, Naik [Page 29]
3932 \f
3933
3934
3935 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3936
3937
3938 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3939 are no restrictions.
3940
3941 usri11_code_page specifies the code page for the user's language of
3942 choice
3943
3944 All of the pointers in this data structure need to be treated
3945 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3946 to be ignored. The converter word returned in the parameters section
3947 needs to be subtracted from the lower 16 bits to calculate an offset
3948 into the return buffer where this ASCII string resides.
3949
3950 There is no auxiliary data in the response.
3951
3952 ****************************************************************************/
3953
3954 #define usri11_name 0
3955 #define usri11_pad 21
3956 #define usri11_comment 22
3957 #define usri11_usr_comment 26
3958 #define usri11_full_name 30
3959 #define usri11_priv 34
3960 #define usri11_auth_flags 36
3961 #define usri11_password_age 40
3962 #define usri11_homedir 44
3963 #define usri11_parms 48
3964 #define usri11_last_logon 52
3965 #define usri11_last_logoff 56
3966 #define usri11_bad_pw_count 60
3967 #define usri11_num_logons 62
3968 #define usri11_logon_server 64
3969 #define usri11_country_code 68
3970 #define usri11_workstations 70
3971 #define usri11_max_storage 74
3972 #define usri11_units_per_week 78
3973 #define usri11_logon_hours 80
3974 #define usri11_code_page 84
3975 #define usri11_end 86
3976
3977 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
3978 connection_struct *conn, uint64_t vuid,
3979 char *param, int tpscnt,
3980 char *data, int tdscnt,
3981 int mdrcnt,int mprcnt,
3982 char **rdata,char **rparam,
3983 int *rdata_len,int *rparam_len)
3984 {
3985 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3986 char *str2 = skip_string(param,tpscnt,str1);
3987 char *UserName = skip_string(param,tpscnt,str2);
3988 char *p = skip_string(param,tpscnt,UserName);
3989 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3990 char *p2;
3991 char *endp;
3992 const char *level_string;
3993
3994 TALLOC_CTX *mem_ctx = talloc_tos();
3995 NTSTATUS status, result;
3996 struct rpc_pipe_client *cli = NULL;
3997 struct policy_handle connect_handle, domain_handle, user_handle;
3998 struct lsa_String domain_name;
3999 struct dom_sid2 *domain_sid;
4000 struct lsa_String names;
4001 struct samr_Ids rids;
4002 struct samr_Ids types;
4003 int errcode = W_ERROR_V(WERR_USER_NOT_FOUND);
4004 uint32_t rid;
4005 union samr_UserInfo *info;
4006 struct dcerpc_binding_handle *b = NULL;
4007
4008 if (!str1 || !str2 || !UserName || !p) {
4009 return False;
4010 }
4011
4012 *rparam_len = 6;
4013 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4014 if (!*rparam) {
4015 return False;
4016 }
4017
4018 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4019
4020 /* check it's a supported variant */
4021 if (strcmp(str1,"zWrLh") != 0) {
4022 return False;
4023 }
4024 switch( uLevel ) {
4025 case 0: level_string = "B21"; break;
4026 case 1: level_string = "B21BB16DWzzWz"; break;
4027 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4028 case 10: level_string = "B21Bzzz"; break;
4029 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4030 default: return False;
4031 }
4032
4033 if (strcmp(level_string,str2) != 0) {
4034 return False;
4035 }
4036
4037 *rdata_len = mdrcnt + 1024;
4038 *rdata = smb_realloc_limit(*rdata,*rdata_len);
4039 if (!*rdata) {
4040 return False;
4041 }
4042
4043 p = *rdata;
4044 endp = *rdata + *rdata_len;
4045 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4046 if (!p2) {
4047 return False;
4048 }
4049
4050 ZERO_STRUCT(connect_handle);
4051 ZERO_STRUCT(domain_handle);
4052 ZERO_STRUCT(user_handle);
4053
4054 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
4055 conn->session_info,
4056 conn->sconn->remote_address,
4057 conn->sconn->msg_ctx,
4058 &cli);
4059 if (!NT_STATUS_IS_OK(status)) {
4060 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4061 nt_errstr(status)));
4062 errcode = W_ERROR_V(ntstatus_to_werror(status));
4063 goto out;
4064 }
4065
4066 b = cli->binding_handle;
4067
4068 status = dcerpc_samr_Connect2(b, mem_ctx,
4069 lp_netbios_name(),
4070 SAMR_ACCESS_CONNECT_TO_SERVER |
4071 SAMR_ACCESS_ENUM_DOMAINS |
4072 SAMR_ACCESS_LOOKUP_DOMAIN,
4073 &connect_handle,
4074 &result);
4075 if (!NT_STATUS_IS_OK(status)) {
4076 errcode = W_ERROR_V(ntstatus_to_werror(status));
4077 goto out;
4078 }
4079 if (!NT_STATUS_IS_OK(result)) {
4080 errcode = W_ERROR_V(ntstatus_to_werror(result));
4081 goto out;
4082 }
4083
4084 init_lsa_String(&domain_name, get_global_sam_name());
4085
4086 status = dcerpc_samr_LookupDomain(b, mem_ctx,
4087 &connect_handle,
4088 &domain_name,
4089 &domain_sid,
4090 &result);
4091 if (!NT_STATUS_IS_OK(status)) {
4092 errcode = W_ERROR_V(ntstatus_to_werror(status));
4093 goto out;
4094 }
4095 if (!NT_STATUS_IS_OK(result)) {
4096 errcode = W_ERROR_V(ntstatus_to_werror(result));
4097 goto out;
4098 }
4099
4100 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4101 &connect_handle,
4102 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4103 domain_sid,
4104 &domain_handle,
4105 &result);
4106 if (!NT_STATUS_IS_OK(status)) {
4107 errcode = W_ERROR_V(ntstatus_to_werror(status));
4108 goto out;
4109 }
4110 if (!NT_STATUS_IS_OK(result)) {
4111 errcode = W_ERROR_V(ntstatus_to_werror(result));
4112 goto out;
4113 }
4114
4115 init_lsa_String(&names, UserName);
4116
4117 status = dcerpc_samr_LookupNames(b, mem_ctx,
4118 &domain_handle,
4119 1,
4120 &names,
4121 &rids,
4122 &types,
4123 &result);
4124 if (!NT_STATUS_IS_OK(status)) {
4125 errcode = W_ERROR_V(ntstatus_to_werror(status));
4126 goto out;
4127 }
4128 if (!NT_STATUS_IS_OK(result)) {
4129 errcode = W_ERROR_V(ntstatus_to_werror(result));
4130 goto out;
4131 }
4132
4133 if (rids.count != 1) {
4134 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4135 goto out;
4136 }
4137 if (rids.count != types.count) {
4138 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4139 goto out;
4140 }
4141 if (types.ids[0] != SID_NAME_USER) {
4142 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4143 goto out;
4144 }
4145
4146 rid = rids.ids[0];
4147
4148 status = dcerpc_samr_OpenUser(b, mem_ctx,
4149 &domain_handle,
4150 SAMR_USER_ACCESS_GET_LOCALE |
4151 SAMR_USER_ACCESS_GET_LOGONINFO |
4152 SAMR_USER_ACCESS_GET_ATTRIBUTES |
4153 SAMR_USER_ACCESS_GET_GROUPS |
4154 SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4155 SEC_STD_READ_CONTROL,
4156 rid,
4157 &user_handle,
4158 &result);
4159 if (!NT_STATUS_IS_OK(status)) {
4160 errcode = W_ERROR_V(ntstatus_to_werror(status));
4161 goto out;
4162 }
4163 if (!NT_STATUS_IS_OK(result)) {
4164 errcode = W_ERROR_V(ntstatus_to_werror(result));
4165 goto out;
4166 }
4167
4168 status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4169 &user_handle,
4170 UserAllInformation,
4171 &info,
4172 &result);
4173 if (!NT_STATUS_IS_OK(status)) {
4174 errcode = W_ERROR_V(ntstatus_to_werror(status));
4175 goto out;
4176 }
4177 if (!NT_STATUS_IS_OK(result)) {
4178 errcode = W_ERROR_V(ntstatus_to_werror(result));
4179 goto out;
4180 }
4181
4182 memset(p,0,21);
4183 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4184
4185 if (uLevel > 0) {
4186 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4187 *p2 = 0;
4188 }
4189
4190 if (uLevel >= 10) {
4191 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4192 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4193 p2 = skip_string(*rdata,*rdata_len,p2);
4194 if (!p2) {
4195 return False;
4196 }
4197
4198 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4199 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4200 p2 = skip_string(*rdata,*rdata_len,p2);
4201 if (!p2) {
4202 return False;
4203 }
4204
4205 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4206 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4207 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4208 p2 = skip_string(*rdata,*rdata_len,p2);
4209 if (!p2) {
4210 return False;
4211 }
4212 }
4213
4214 if (uLevel == 11) {
4215 const char *homedir = info->info21.home_directory.string;
4216 /* modelled after NTAS 3.51 reply */
4217 SSVAL(p,usri11_priv,
4218 (get_current_uid(conn) == sec_initial_uid())?
4219 USER_PRIV_ADMIN:USER_PRIV_USER);
4220 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
4221 SIVALS(p,usri11_password_age,-1); /* password age */
4222 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4223 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4224 p2 = skip_string(*rdata,*rdata_len,p2);
4225 if (!p2) {
4226 return False;
4227 }
4228 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4229 strlcpy(p2,"",PTR_DIFF(endp,p2));
4230 p2 = skip_string(*rdata,*rdata_len,p2);
4231 if (!p2) {
4232 return False;
4233 }
4234 SIVAL(p,usri11_last_logon,0); /* last logon */
4235 SIVAL(p,usri11_last_logoff,0); /* last logoff */
4236 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
4237 SSVALS(p,usri11_num_logons,-1); /* num logons */
4238 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4239 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4240 p2 = skip_string(*rdata,*rdata_len,p2);
4241 if (!p2) {
4242 return False;
4243 }
4244 SSVAL(p,usri11_country_code,0); /* country code */
4245
4246 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4247 strlcpy(p2,"",PTR_DIFF(endp,p2));
4248 p2 = skip_string(*rdata,*rdata_len,p2);
4249 if (!p2) {
4250 return False;
4251 }
4252
4253 SIVALS(p,usri11_max_storage,-1); /* max storage */
4254 SSVAL(p,usri11_units_per_week,168); /* units per week */
4255 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4256
4257 /* a simple way to get logon hours at all times. */
4258 memset(p2,0xff,21);
4259 SCVAL(p2,21,0); /* fix zero termination */
4260 p2 = skip_string(*rdata,*rdata_len,p2);
4261 if (!p2) {
4262 return False;
4263 }
4264
4265 SSVAL(p,usri11_code_page,0); /* code page */
4266 }
4267
4268 if (uLevel == 1 || uLevel == 2) {
4269 memset(p+22,' ',16); /* password */
4270 SIVALS(p,38,-1); /* password age */
4271 SSVAL(p,42,
4272 (get_current_uid(conn) == sec_initial_uid())?
4273 USER_PRIV_ADMIN:USER_PRIV_USER);
4274 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4275 strlcpy(p2, info->info21.home_directory.string,
4276 PTR_DIFF(endp,p2));
4277 p2 = skip_string(*rdata,*rdata_len,p2);
4278 if (!p2) {
4279 return False;
4280 }
4281 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4282 *p2++ = 0;
4283 SSVAL(p,52,0); /* flags */
4284 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
4285 strlcpy(p2, info->info21.logon_script.string,
4286 PTR_DIFF(endp,p2));
4287 p2 = skip_string(*rdata,*rdata_len,p2);
4288 if (!p2) {
4289 return False;
4290 }
4291 if (uLevel == 2) {
4292 SIVAL(p,58,0); /* auth_flags */
4293 SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4294 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4295 p2 = skip_string(*rdata,*rdata_len,p2);
4296 if (!p2) {
4297 return False;
4298 }
4299 SIVAL(p,66,0); /* urs_comment */
4300 SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4301 strlcpy(p2,"",PTR_DIFF(endp,p2));
4302 p2 = skip_string(*rdata,*rdata_len,p2);
4303 if (!p2) {
4304 return False;
4305 }
4306 SIVAL(p,74,0); /* workstations */
4307 SIVAL(p,78,0); /* last_logon */
4308 SIVAL(p,82,0); /* last_logoff */
4309 SIVALS(p,86,-1); /* acct_expires */
4310 SIVALS(p,90,-1); /* max_storage */
4311 SSVAL(p,94,168); /* units_per_week */
4312 SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4313 memset(p2,-1,21);
4314 p2 += 21;
4315 SSVALS(p,100,-1); /* bad_pw_count */
4316 SSVALS(p,102,-1); /* num_logons */
4317 SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4318 {
4319 TALLOC_CTX *ctx = talloc_tos();
4320 int space_rem = *rdata_len - (p2 - *rdata);
4321 char *tmp;
4322
4323 if (space_rem <= 0) {
4324 return false;
4325 }
4326 tmp = talloc_strdup(ctx, "\\\\%L");
4327 if (!tmp) {
4328 return false;
4329 }
4330 tmp = talloc_sub_basic(ctx,
4331 "",
4332 "",
4333 tmp);
4334 if (!tmp) {
4335 return false;
4336 }
4337
4338 push_ascii(p2,
4339 tmp,
4340 space_rem,
4341 STR_TERMINATE);
4342 }
4343 p2 = skip_string(*rdata,*rdata_len,p2);
4344 if (!p2) {
4345 return False;
4346 }
4347 SSVAL(p,108,49); /* country_code */
4348 SSVAL(p,110,860); /* code page */
4349 }
4350 }
4351
4352 errcode = NERR_Success;
4353
4354 out:
4355 *rdata_len = PTR_DIFF(p2,*rdata);
4356
4357 if (b && is_valid_policy_hnd(&user_handle)) {
4358 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4359 }
4360 if (b && is_valid_policy_hnd(&domain_handle)) {
4361 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4362 }
4363 if (b && is_valid_policy_hnd(&connect_handle)) {
4364 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4365 }
4366
4367 SSVAL(*rparam,0,errcode);
4368 SSVAL(*rparam,2,0); /* converter word */
4369 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
4370
4371 return(True);
4372 }
4373
4374 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4375 connection_struct *conn,uint64_t vuid,
4376 char *param, int tpscnt,
4377 char *data, int tdscnt,
4378 int mdrcnt,int mprcnt,
4379 char **rdata,char **rparam,
4380 int *rdata_len,int *rparam_len)
4381 {
4382 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4383 char *str2 = skip_string(param,tpscnt,str1);
4384 char *p = skip_string(param,tpscnt,str2);
4385 int uLevel;
4386 struct pack_desc desc;
4387 char* name;
4388 /* With share level security vuid will always be zero.
4389 Don't depend on vuser being non-null !!. JRA */
4390 struct user_struct *vuser = get_valid_user_struct(sconn, vuid);
4391
4392 if (!str1 || !str2 || !p) {
4393 return False;
4394 }
4395
4396 if(vuser != NULL) {
4397 DEBUG(3,(" Username of UID %d is %s\n",
4398 (int)vuser->session_info->unix_token->uid,
4399 vuser->session_info->unix_info->unix_name));
4400 }
4401
4402 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4403 name = get_safe_str_ptr(param,tpscnt,p,2);
4404 if (!name) {
4405 return False;
4406 }
4407
4408 memset((char *)&desc,'\0',sizeof(desc));
4409
4410 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4411
4412 /* check it's a supported varient */
4413 if (strcmp(str1,"OOWb54WrLh") != 0) {
4414 return False;
4415 }
4416 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4417 return False;
4418 }
4419 if (mdrcnt > 0) {
4420 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4421 if (!*rdata) {
4422 return False;
4423 }
4424 }
4425
4426 desc.base = *rdata;
4427 desc.buflen = mdrcnt;
4428 desc.subformat = NULL;
4429 desc.format = str2;
4430
4431 if (init_package(&desc,1,0)) {
4432 PACKI(&desc,"W",0); /* code */
4433 PACKS(&desc,"B21",name); /* eff. name */
4434 PACKS(&desc,"B",""); /* pad */
4435 PACKI(&desc,"W",
4436 (get_current_uid(conn) == sec_initial_uid())?
4437 USER_PRIV_ADMIN:USER_PRIV_USER);
4438 PACKI(&desc,"D",0); /* auth flags XXX */
4439 PACKI(&desc,"W",0); /* num logons */
4440 PACKI(&desc,"W",0); /* bad pw count */
4441 PACKI(&desc,"D",0); /* last logon */
4442 PACKI(&desc,"D",-1); /* last logoff */
4443 PACKI(&desc,"D",-1); /* logoff time */
4444 PACKI(&desc,"D",-1); /* kickoff time */
4445 PACKI(&desc,"D",0); /* password age */
4446 PACKI(&desc,"D",0); /* password can change */
4447 PACKI(&desc,"D",-1); /* password must change */
4448
4449 {
4450 fstring mypath;
4451 fstrcpy(mypath,"\\\\");
4452 fstrcat(mypath,get_local_machine_name());
4453 if (!strupper_m(mypath)) {
4454 return false;
4455 }
4456 PACKS(&desc,"z",mypath); /* computer */
4457 }
4458
4459 PACKS(&desc,"z",lp_workgroup());/* domain */
4460 PACKS(&desc,"z", vuser ?
4461 vuser->session_info->info->logon_script
4462 : ""); /* script path */
4463 PACKI(&desc,"D",0x00000000); /* reserved */
4464 }
4465
4466 *rdata_len = desc.usedlen;
4467 *rparam_len = 6;
4468 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4469 if (!*rparam) {
4470 return False;
4471 }
4472 SSVALS(*rparam,0,desc.errcode);
4473 SSVAL(*rparam,2,0);
4474 SSVAL(*rparam,4,desc.neededlen);
4475
4476 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4477
4478 return True;
4479 }
4480
4481 /****************************************************************************
4482 api_WAccessGetUserPerms
4483 ****************************************************************************/
4484
4485 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4486 connection_struct *conn,uint64_t vuid,
4487 char *param, int tpscnt,
4488 char *data, int tdscnt,
4489 int mdrcnt,int mprcnt,
4490 char **rdata,char **rparam,
4491 int *rdata_len,int *rparam_len)
4492 {
4493 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4494 char *str2 = skip_string(param,tpscnt,str1);
4495 char *user = skip_string(param,tpscnt,str2);
4496 char *resource = skip_string(param,tpscnt,user);
4497
4498 if (!str1 || !str2 || !user || !resource) {
4499 return False;
4500 }
4501
4502 if (skip_string(param,tpscnt,resource) == NULL) {
4503 return False;
4504 }
4505 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4506
4507 /* check it's a supported varient */
4508 if (strcmp(str1,"zzh") != 0) {
4509 return False;
4510 }
4511 if (strcmp(str2,"") != 0) {
4512 return False;
4513 }
4514
4515 *rparam_len = 6;
4516 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4517 if (!*rparam) {
4518 return False;
4519 }
4520 SSVALS(*rparam,0,0); /* errorcode */
4521 SSVAL(*rparam,2,0); /* converter word */
4522 SSVAL(*rparam,4,0x7f); /* permission flags */
4523
4524 return True;
4525 }
4526
4527 /****************************************************************************
4528 api_WPrintJobEnumerate
4529 ****************************************************************************/
4530
4531 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4532 connection_struct *conn, uint64_t vuid,
4533 char *param, int tpscnt,
4534 char *data, int tdscnt,
4535 int mdrcnt,int mprcnt,
4536 char **rdata,char **rparam,
4537 int *rdata_len,int *rparam_len)
4538 {
4539 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4540 char *str2 = skip_string(param,tpscnt,str1);
4541 char *p = skip_string(param,tpscnt,str2);
4542 int uLevel;
4543 fstring sharename;
4544 uint32 jobid;
4545 struct pack_desc desc;
4546 char *tmpdata=NULL;
4547
4548 TALLOC_CTX *mem_ctx = talloc_tos();
4549 WERROR werr;
4550 NTSTATUS status;
4551 struct rpc_pipe_client *cli = NULL;
4552 struct dcerpc_binding_handle *b = NULL;
4553 struct policy_handle handle;
4554 struct spoolss_DevmodeContainer devmode_ctr;
4555 union spoolss_JobInfo info;
4556
4557 if (!str1 || !str2 || !p) {
4558 return False;
4559 }
4560
4561 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4562
4563 memset((char *)&desc,'\0',sizeof(desc));
4564 memset((char *)&status,'\0',sizeof(status));
4565
4566 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4567
4568 /* check it's a supported varient */
4569 if (strcmp(str1,"WWrLh") != 0) {
4570 return False;
4571 }
4572 if (!check_printjob_info(&desc,uLevel,str2)) {
4573 return False;
4574 }
4575
4576 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4577 return False;
4578 }
4579
4580 ZERO_STRUCT(handle);
4581
4582 status = rpc_pipe_open_interface(conn,
4583 &ndr_table_spoolss,
4584 conn->session_info,
4585 conn->sconn->remote_address,
4586 conn->sconn->msg_ctx,
4587 &cli);
4588 if (!NT_STATUS_IS_OK(status)) {
4589 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4590 nt_errstr(status)));
4591 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4592 goto out;
4593 }
4594 b = cli->binding_handle;
4595
4596 ZERO_STRUCT(devmode_ctr);
4597
4598 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4599 sharename,
4600 "RAW",
4601 devmode_ctr,
4602 PRINTER_ACCESS_USE,
4603 &handle,
4604 &werr);
4605 if (!NT_STATUS_IS_OK(status)) {
4606 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4607 goto out;
4608 }
4609 if (!W_ERROR_IS_OK(werr)) {
4610 desc.errcode = W_ERROR_V(werr);
4611 goto out;
4612 }
4613
4614 werr = rpccli_spoolss_getjob(cli, mem_ctx,
4615 &handle,
4616 jobid,
4617 2, /* level */
4618 0, /* offered */
4619 &info);
4620 if (!W_ERROR_IS_OK(werr)) {
4621 desc.errcode = W_ERROR_V(werr);
4622 goto out;
4623 }
4624
4625 if (mdrcnt > 0) {
4626 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4627 if (!*rdata) {
4628 return False;
4629 }
4630 desc.base = *rdata;
4631 desc.buflen = mdrcnt;
4632 } else {
4633 /*
4634 * Don't return data but need to get correct length
4635 * init_package will return wrong size if buflen=0
4636 */
4637 desc.buflen = getlen(desc.format);
4638 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4639 }
4640
4641 if (init_package(&desc,1,0)) {
4642 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4643 *rdata_len = desc.usedlen;
4644 } else {
4645 desc.errcode = NERR_JobNotFound;
4646 *rdata_len = 0;
4647 }
4648 out:
4649 if (b && is_valid_policy_hnd(&handle)) {
4650 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4651 }
4652
4653 *rparam_len = 6;
4654 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4655 if (!*rparam) {
4656 return False;
4657 }
4658 SSVALS(*rparam,0,desc.errcode);
4659 SSVAL(*rparam,2,0);
4660 SSVAL(*rparam,4,desc.neededlen);
4661
4662 SAFE_FREE(tmpdata);
4663
4664 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4665
4666 return True;
4667 }
4668
4669 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4670 connection_struct *conn, uint64_t vuid,
4671 char *param, int tpscnt,
4672 char *data, int tdscnt,
4673 int mdrcnt,int mprcnt,
4674 char **rdata,char **rparam,
4675 int *rdata_len,int *rparam_len)
4676 {
4677 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4678 char *str2 = skip_string(param,tpscnt,str1);
4679 char *p = skip_string(param,tpscnt,str2);
4680 char *name = p;
4681 int uLevel;
4682 int i, succnt=0;
4683 struct pack_desc desc;
4684
4685 TALLOC_CTX *mem_ctx = talloc_tos();
4686 WERROR werr;
4687 NTSTATUS status;
4688 struct rpc_pipe_client *cli = NULL;
4689 struct dcerpc_binding_handle *b = NULL;
4690 struct policy_handle handle;
4691 struct spoolss_DevmodeContainer devmode_ctr;
4692 uint32_t count = 0;
4693 union spoolss_JobInfo *info;
4694
4695 if (!str1 || !str2 || !p) {
4696 return False;
4697 }
4698
4699 memset((char *)&desc,'\0',sizeof(desc));
4700
4701 p = skip_string(param,tpscnt,p);
4702 if (!p) {
4703 return False;
4704 }
4705 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4706
4707 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4708
4709 /* check it's a supported variant */
4710 if (strcmp(str1,"zWrLeh") != 0) {
4711 return False;
4712 }
4713
4714 if (uLevel > 2) {
4715 return False; /* defined only for uLevel 0,1,2 */
4716 }
4717
4718 if (!check_printjob_info(&desc,uLevel,str2)) {
4719 return False;
4720 }
4721
4722 ZERO_STRUCT(handle);
4723
4724 status = rpc_pipe_open_interface(conn,
4725 &ndr_table_spoolss,
4726 conn->session_info,
4727 conn->sconn->remote_address,
4728 conn->sconn->msg_ctx,
4729 &cli);
4730 if (!NT_STATUS_IS_OK(status)) {
4731 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4732 nt_errstr(status)));
4733 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4734 goto out;
4735 }
4736 b = cli->binding_handle;
4737
4738 ZERO_STRUCT(devmode_ctr);
4739
4740 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4741 name,
4742 NULL,
4743 devmode_ctr,
4744 PRINTER_ACCESS_USE,
4745 &handle,
4746 &werr);
4747 if (!NT_STATUS_IS_OK(status)) {
4748 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4749 goto out;
4750 }
4751 if (!W_ERROR_IS_OK(werr)) {
4752 desc.errcode = W_ERROR_V(werr);
4753 goto out;
4754 }
4755
4756 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4757 &handle,
4758 0, /* firstjob */
4759 0xff, /* numjobs */
4760 2, /* level */
4761 0, /* offered */
4762 &count,
4763 &info);
4764 if (!W_ERROR_IS_OK(werr)) {
4765 desc.errcode = W_ERROR_V(werr);
4766 goto out;
4767 }
4768
4769 if (mdrcnt > 0) {
4770 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4771 if (!*rdata) {
4772 return False;
4773 }
4774 }
4775 desc.base = *rdata;
4776 desc.buflen = mdrcnt;
4777
4778 if (init_package(&desc,count,0)) {
4779 succnt = 0;
4780 for (i = 0; i < count; i++) {
4781 fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4782 if (desc.errcode == NERR_Success) {
4783 succnt = i+1;
4784 }
4785 }
4786 }
4787 out:
4788 if (b && is_valid_policy_hnd(&handle)) {
4789 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4790 }
4791
4792 *rdata_len = desc.usedlen;
4793
4794 *rparam_len = 8;
4795 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4796 if (!*rparam) {
4797 return False;
4798 }
4799 SSVALS(*rparam,0,desc.errcode);
4800 SSVAL(*rparam,2,0);
4801 SSVAL(*rparam,4,succnt);
4802 SSVAL(*rparam,6,count);
4803
4804 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4805
4806 return True;
4807 }
4808
4809 static int check_printdest_info(struct pack_desc* desc,
4810 int uLevel, char* id)
4811 {
4812 desc->subformat = NULL;
4813 switch( uLevel ) {
4814 case 0:
4815 desc->format = "B9";
4816 break;
4817 case 1:
4818 desc->format = "B9B21WWzW";
4819 break;
4820 case 2:
4821 desc->format = "z";
4822 break;
4823 case 3:
4824 desc->format = "zzzWWzzzWW";
4825 break;
4826 default:
4827 DEBUG(0,("check_printdest_info: invalid level %d\n",
4828 uLevel));
4829 return False;
4830 }
4831 if (id == NULL || strcmp(desc->format,id) != 0) {
4832 DEBUG(0,("check_printdest_info: invalid string %s\n",
4833 id ? id : "<NULL>" ));
4834 return False;
4835 }
4836 return True;
4837 }
4838
4839 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4840 struct pack_desc* desc)
4841 {
4842 char buf[100];
4843
4844 strncpy(buf, info2->printername, sizeof(buf)-1);
4845 buf[sizeof(buf)-1] = 0;
4846 (void)strupper_m(buf);
4847
4848 if (uLevel <= 1) {
4849 PACKS(desc,"B9",buf); /* szName */
4850 if (uLevel == 1) {
4851 PACKS(desc,"B21",""); /* szUserName */
4852 PACKI(desc,"W",0); /* uJobId */
4853 PACKI(desc,"W",0); /* fsStatus */
4854 PACKS(desc,"z",""); /* pszStatus */
4855 PACKI(desc,"W",0); /* time */
4856 }
4857 }
4858
4859 if (uLevel == 2 || uLevel == 3) {
4860 PACKS(desc,"z",buf); /* pszPrinterName */
4861 if (uLevel == 3) {
4862 PACKS(desc,"z",""); /* pszUserName */
4863 PACKS(desc,"z",""); /* pszLogAddr */
4864 PACKI(desc,"W",0); /* uJobId */
4865 PACKI(desc,"W",0); /* fsStatus */
4866 PACKS(desc,"z",""); /* pszStatus */
4867 PACKS(desc,"z",""); /* pszComment */
4868 PACKS(desc,"z","NULL"); /* pszDrivers */
4869 PACKI(desc,"W",0); /* time */
4870 PACKI(desc,"W",0); /* pad1 */
4871 }
4872 }
4873 }
4874
4875 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
4876 connection_struct *conn, uint64_t vuid,
4877 char *param, int tpscnt,
4878 char *data, int tdscnt,
4879 int mdrcnt,int mprcnt,
4880 char **rdata,char **rparam,
4881 int *rdata_len,int *rparam_len)
4882 {
4883 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4884 char *str2 = skip_string(param,tpscnt,str1);
4885 char *p = skip_string(param,tpscnt,str2);
4886 char* PrinterName = p;
4887 int uLevel;
4888 struct pack_desc desc;
4889 char *tmpdata=NULL;
4890
4891 TALLOC_CTX *mem_ctx = talloc_tos();
4892 WERROR werr;
4893 NTSTATUS status;
4894 struct rpc_pipe_client *cli = NULL;
4895 struct dcerpc_binding_handle *b = NULL;
4896 struct policy_handle handle;
4897 struct spoolss_DevmodeContainer devmode_ctr;
4898 union spoolss_PrinterInfo info;
4899
4900 if (!str1 || !str2 || !p) {
4901 return False;
4902 }
4903
4904 memset((char *)&desc,'\0',sizeof(desc));
4905
4906 p = skip_string(param,tpscnt,p);
4907 if (!p) {
4908 return False;
4909 }
4910 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4911
4912 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4913
4914 /* check it's a supported varient */
4915 if (strcmp(str1,"zWrLh") != 0) {
4916 return False;
4917 }
4918 if (!check_printdest_info(&desc,uLevel,str2)) {
4919 return False;
4920 }
4921
4922 ZERO_STRUCT(handle);
4923
4924 status = rpc_pipe_open_interface(conn,
4925 &ndr_table_spoolss,
4926 conn->session_info,
4927 conn->sconn->remote_address,
4928 conn->sconn->msg_ctx,
4929 &cli);
4930 if (!NT_STATUS_IS_OK(status)) {
4931 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
4932 nt_errstr(status)));
4933 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4934 goto out;
4935 }
4936 b = cli->binding_handle;
4937
4938 ZERO_STRUCT(devmode_ctr);
4939
4940 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4941 PrinterName,
4942 NULL,
4943 devmode_ctr,
4944 PRINTER_ACCESS_USE,
4945 &handle,
4946 &werr);
4947 if (!NT_STATUS_IS_OK(status)) {
4948 *rdata_len = 0;
4949 desc.errcode = NERR_DestNotFound;
4950 desc.neededlen = 0;
4951 goto out;
4952 }
4953 if (!W_ERROR_IS_OK(werr)) {
4954 *rdata_len = 0;
4955 desc.errcode = NERR_DestNotFound;
4956 desc.neededlen = 0;
4957 goto out;
4958 }
4959
4960 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
4961 &handle,
4962 2,
4963 0,
4964 &info);
4965 if (!W_ERROR_IS_OK(werr)) {
4966 *rdata_len = 0;
4967 desc.errcode = NERR_DestNotFound;
4968 desc.neededlen = 0;
4969 goto out;
4970 }
4971
4972 if (mdrcnt > 0) {
4973 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4974 if (!*rdata) {
4975 return False;
4976 }
4977 desc.base = *rdata;
4978 desc.buflen = mdrcnt;
4979 } else {
4980 /*
4981 * Don't return data but need to get correct length
4982 * init_package will return wrong size if buflen=0
4983 */
4984 desc.buflen = getlen(desc.format);
4985 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4986 }
4987 if (init_package(&desc,1,0)) {
4988 fill_printdest_info(&info.info2, uLevel,&desc);
4989 }
4990
4991 out:
4992 if (b && is_valid_policy_hnd(&handle)) {
4993 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4994 }
4995
4996 *rdata_len = desc.usedlen;
4997
4998 *rparam_len = 6;
4999 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5000 if (!*rparam) {
5001 return False;
5002 }
5003 SSVALS(*rparam,0,desc.errcode);
5004 SSVAL(*rparam,2,0);
5005 SSVAL(*rparam,4,desc.neededlen);
5006
5007 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5008 SAFE_FREE(tmpdata);
5009
5010 return True;
5011 }
5012
5013 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5014 connection_struct *conn, uint64_t vuid,
5015 char *param, int tpscnt,
5016 char *data, int tdscnt,
5017 int mdrcnt,int mprcnt,
5018 char **rdata,char **rparam,
5019 int *rdata_len,int *rparam_len)
5020 {
5021 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5022 char *str2 = skip_string(param,tpscnt,str1);
5023 char *p = skip_string(param,tpscnt,str2);
5024 int uLevel;
5025 int queuecnt;
5026 int i, n, succnt=0;
5027 struct pack_desc desc;
5028
5029 TALLOC_CTX *mem_ctx = talloc_tos();
5030 WERROR werr;
5031 NTSTATUS status;
5032 struct rpc_pipe_client *cli = NULL;
5033 union spoolss_PrinterInfo *info;
5034 uint32_t count;
5035
5036 if (!str1 || !str2 || !p) {
5037 return False;
5038 }
5039
5040 memset((char *)&desc,'\0',sizeof(desc));
5041
5042 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5043
5044 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5045
5046 /* check it's a supported varient */
5047 if (strcmp(str1,"WrLeh") != 0) {
5048 return False;
5049 }
5050 if (!check_printdest_info(&desc,uLevel,str2)) {
5051 return False;
5052 }
5053
5054 queuecnt = 0;
5055
5056 status = rpc_pipe_open_interface(conn,
5057 &ndr_table_spoolss,
5058 conn->session_info,
5059 conn->sconn->remote_address,
5060 conn->sconn->msg_ctx,
5061 &cli);
5062 if (!NT_STATUS_IS_OK(status)) {
5063 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5064 nt_errstr(status)));
5065 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5066 goto out;
5067 }
5068
5069 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5070 PRINTER_ENUM_LOCAL,
5071 cli->srv_name_slash,
5072 2,
5073 0,
5074 &count,
5075 &info);
5076 if (!W_ERROR_IS_OK(werr)) {
5077 desc.errcode = W_ERROR_V(werr);
5078 *rdata_len = 0;
5079 desc.errcode = NERR_DestNotFound;
5080 desc.neededlen = 0;
5081 goto out;
5082 }
5083
5084 queuecnt = count;
5085
5086 if (mdrcnt > 0) {
5087 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5088 if (!*rdata) {
5089 return False;
5090 }
5091 }
5092
5093 desc.base = *rdata;
5094 desc.buflen = mdrcnt;
5095 if (init_package(&desc,queuecnt,0)) {
5096 succnt = 0;
5097 n = 0;
5098 for (i = 0; i < count; i++) {
5099 fill_printdest_info(&info[i].info2, uLevel,&desc);
5100 n++;
5101 if (desc.errcode == NERR_Success) {
5102 succnt = n;
5103 }
5104 }
5105 }
5106 out:
5107 *rdata_len = desc.usedlen;
5108
5109 *rparam_len = 8;
5110 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5111 if (!*rparam) {
5112 return False;
5113 }
5114 SSVALS(*rparam,0,desc.errcode);
5115 SSVAL(*rparam,2,0);
5116 SSVAL(*rparam,4,succnt);
5117 SSVAL(*rparam,6,queuecnt);
5118
5119 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5120
5121 return True;
5122 }
5123
5124 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5125 connection_struct *conn, uint64_t vuid,
5126 char *param, int tpscnt,
5127 char *data, int tdscnt,
5128 int mdrcnt,int mprcnt,
5129 char **rdata,char **rparam,
5130 int *rdata_len,int *rparam_len)
5131 {
5132 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5133 char *str2 = skip_string(param,tpscnt,str1);
5134 char *p = skip_string(param,tpscnt,str2);
5135 int uLevel;
5136 int succnt;
5137 struct pack_desc desc;
5138
5139 if (!str1 || !str2 || !p) {
5140 return False;
5141 }
5142
5143 memset((char *)&desc,'\0',sizeof(desc));
5144
5145 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5146
5147 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5148
5149 /* check it's a supported varient */
5150 if (strcmp(str1,"WrLeh") != 0) {
5151 return False;
5152 }
5153 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5154 return False;
5155 }
5156
5157 if (mdrcnt > 0) {
5158 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5159 if (!*rdata) {
5160 return False;
5161 }
5162 }
5163 desc.base = *rdata;
5164 desc.buflen = mdrcnt;
5165 if (init_package(&desc,1,0)) {
5166 PACKS(&desc,"B41","NULL");
5167 }
5168
5169 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5170
5171 *rdata_len = desc.usedlen;
5172
5173 *rparam_len = 8;
5174 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5175 if (!*rparam) {
5176 return False;
5177 }
5178 SSVALS(*rparam,0,desc.errcode);
5179 SSVAL(*rparam,2,0);
5180 SSVAL(*rparam,4,succnt);
5181 SSVAL(*rparam,6,1);
5182
5183 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5184
5185 return True;
5186 }
5187
5188 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5189 connection_struct *conn, uint64_t vuid,
5190 char *param, int tpscnt,
5191 char *data, int tdscnt,
5192 int mdrcnt,int mprcnt,
5193 char **rdata,char **rparam,
5194 int *rdata_len,int *rparam_len)
5195 {
5196 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5197 char *str2 = skip_string(param,tpscnt,str1);
5198 char *p = skip_string(param,tpscnt,str2);
5199 int uLevel;
5200 int succnt;
5201 struct pack_desc desc;
5202
5203 if (!str1 || !str2 || !p) {
5204 return False;
5205 }
5206 memset((char *)&desc,'\0',sizeof(desc));
5207
5208 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5209
5210 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5211
5212 /* check it's a supported varient */
5213 if (strcmp(str1,"WrLeh") != 0) {
5214 return False;
5215 }
5216 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5217 return False;
5218 }
5219
5220 if (mdrcnt > 0) {
5221 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5222 if (!*rdata) {
5223 return False;
5224 }
5225 }
5226 desc.base = *rdata;
5227 desc.buflen = mdrcnt;
5228 desc.format = str2;
5229 if (init_package(&desc,1,0)) {
5230 PACKS(&desc,"B13","lpd");
5231 }
5232
5233 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5234
5235 *rdata_len = desc.usedlen;
5236
5237 *rparam_len = 8;
5238 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5239 if (!*rparam) {
5240 return False;
5241 }
5242 SSVALS(*rparam,0,desc.errcode);
5243 SSVAL(*rparam,2,0);
5244 SSVAL(*rparam,4,succnt);
5245 SSVAL(*rparam,6,1);
5246
5247 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5248
5249 return True;
5250 }
5251
5252 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5253 connection_struct *conn, uint64_t vuid,
5254 char *param, int tpscnt,
5255 char *data, int tdscnt,
5256 int mdrcnt,int mprcnt,
5257 char **rdata,char **rparam,
5258 int *rdata_len,int *rparam_len)
5259 {
5260 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5261 char *str2 = skip_string(param,tpscnt,str1);
5262 char *p = skip_string(param,tpscnt,str2);
5263 int uLevel;
5264 int succnt;
5265 struct pack_desc desc;
5266
5267 if (!str1 || !str2 || !p) {
5268 return False;
5269 }
5270
5271 memset((char *)&desc,'\0',sizeof(desc));
5272
5273 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5274
5275 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5276
5277 /* check it's a supported varient */
5278 if (strcmp(str1,"WrLeh") != 0) {
5279 return False;
5280 }
5281 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5282 return False;
5283 }
5284
5285 if (mdrcnt > 0) {
5286 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5287 if (!*rdata) {
5288 return False;
5289 }
5290 }
5291 memset((char *)&desc,'\0',sizeof(desc));
5292 desc.base = *rdata;
5293 desc.buflen = mdrcnt;
5294 desc.format = str2;
5295 if (init_package(&desc,1,0)) {
5296 PACKS(&desc,"B13","lp0");
5297 }
5298
5299 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5300
5301 *rdata_len = desc.usedlen;
5302
5303 *rparam_len = 8;
5304 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5305 if (!*rparam) {
5306 return False;
5307 }
5308 SSVALS(*rparam,0,desc.errcode);
5309 SSVAL(*rparam,2,0);
5310 SSVAL(*rparam,4,succnt);
5311 SSVAL(*rparam,6,1);
5312
5313 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5314
5315 return True;
5316 }
5317
5318 /****************************************************************************
5319 List open sessions
5320 ****************************************************************************/
5321
5322 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5323 connection_struct *conn, uint64_t vuid,
5324 char *param, int tpscnt,
5325 char *data, int tdscnt,
5326 int mdrcnt,int mprcnt,
5327 char **rdata,char **rparam,
5328 int *rdata_len,int *rparam_len)
5329
5330 {
5331 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5332 char *str2 = skip_string(param,tpscnt,str1);
5333 char *p = skip_string(param,tpscnt,str2);
5334 int uLevel;
5335 struct pack_desc desc;
5336 int i;
5337
5338 TALLOC_CTX *mem_ctx = talloc_tos();
5339 WERROR werr;
5340 NTSTATUS status;
5341 struct rpc_pipe_client *cli = NULL;
5342 struct dcerpc_binding_handle *b = NULL;
5343 struct srvsvc_NetSessInfoCtr info_ctr;
5344 uint32_t totalentries, resume_handle = 0;
5345 uint32_t count = 0;
5346
5347 if (!str1 || !str2 || !p) {
5348 return False;
5349 }
5350
5351 ZERO_STRUCT(desc);
5352
5353 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5354
5355 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5356 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5357 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5358
5359 /* check it's a supported varient */
5360 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5361 return False;
5362 }
5363 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5364 return False;
5365 }
5366
5367 status = rpc_pipe_open_interface(conn,
5368 &ndr_table_srvsvc,
5369 conn->session_info,
5370 conn->sconn->remote_address,
5371 conn->sconn->msg_ctx,
5372 &cli);
5373 if (!NT_STATUS_IS_OK(status)) {
5374 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5375 nt_errstr(status)));
5376 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5377 goto out;
5378 }
5379 b = cli->binding_handle;
5380
5381 info_ctr.level = 1;
5382 info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5383 if (info_ctr.ctr.ctr1 == NULL) {
5384 desc.errcode = W_ERROR_V(WERR_NOMEM);
5385 goto out;
5386 }
5387
5388 status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5389 cli->srv_name_slash,
5390 NULL, /* client */
5391 NULL, /* user */
5392 &info_ctr,
5393 (uint32_t)-1, /* max_buffer */
5394 &totalentries,
5395 &resume_handle,
5396 &werr);
5397 if (!NT_STATUS_IS_OK(status)) {
5398 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5399 nt_errstr(status)));
5400 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5401 goto out;
5402 }
5403
5404 if (!W_ERROR_IS_OK(werr)) {
5405 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5406 win_errstr(werr)));
5407 desc.errcode = W_ERROR_V(werr);
5408 goto out;
5409 }
5410
5411 count = info_ctr.ctr.ctr1->count;
5412
5413 out:
5414 if (mdrcnt > 0) {
5415 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5416 if (!*rdata) {
5417 return False;
5418 }
5419 }
5420
5421 desc.base = *rdata;
5422 desc.buflen = mdrcnt;
5423 desc.format = str2;
5424 if (!init_package(&desc, count,0)) {
5425 return False;
5426 }
5427
5428 for(i=0; i < count; i++) {
5429 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5430 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5431 PACKI(&desc, "W", 1); /* num conns */
5432 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5433 PACKI(&desc, "W", 1); /* num users */
5434 PACKI(&desc, "D", 0); /* session time */
5435 PACKI(&desc, "D", 0); /* idle time */
5436 PACKI(&desc, "D", 0); /* flags */
5437 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5438 }
5439
5440 *rdata_len = desc.usedlen;
5441
5442 *rparam_len = 8;
5443 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5444 if (!*rparam) {
5445 return False;
5446 }
5447 SSVALS(*rparam,0,desc.errcode);
5448 SSVAL(*rparam,2,0); /* converter */
5449 SSVAL(*rparam,4, count); /* count */
5450
5451 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5452
5453 return True;
5454 }
5455
5456
5457 /****************************************************************************
5458 The buffer was too small.
5459 ****************************************************************************/
5460
5461 static bool api_TooSmall(struct smbd_server_connection *sconn,
5462 connection_struct *conn,uint64_t vuid, char *param, char *data,
5463 int mdrcnt, int mprcnt,
5464 char **rdata, char **rparam,
5465 int *rdata_len, int *rparam_len)
5466 {
5467 *rparam_len = MIN(*rparam_len,mprcnt);
5468 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5469 if (!*rparam) {
5470 return False;
5471 }
5472
5473 *rdata_len = 0;
5474
5475 SSVAL(*rparam,0,NERR_BufTooSmall);
5476
5477 DEBUG(3,("Supplied buffer too small in API command\n"));
5478
5479 return True;
5480 }
5481
5482 /****************************************************************************
5483 The request is not supported.
5484 ****************************************************************************/
5485
5486 static bool api_Unsupported(struct smbd_server_connection *sconn,
5487 connection_struct *conn, uint64_t vuid,
5488 char *param, int tpscnt,
5489 char *data, int tdscnt,
5490 int mdrcnt, int mprcnt,
5491 char **rdata, char **rparam,
5492 int *rdata_len, int *rparam_len)
5493 {
5494 *rparam_len = 4;
5495 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5496 if (!*rparam) {
5497 return False;
5498 }
5499
5500 *rdata_len = 0;
5501
5502 SSVAL(*rparam,0,NERR_notsupported);
5503 SSVAL(*rparam,2,0); /* converter word */
5504
5505 DEBUG(3,("Unsupported API command\n"));
5506
5507 return True;
5508 }
5509
5510 static const struct {
5511 const char *name;
5512 int id;
5513 bool (*fn)(struct smbd_server_connection *sconn,
5514 connection_struct *, uint64_t,
5515 char *, int,
5516 char *, int,
5517 int,int,char **,char **,int *,int *);
5518 bool auth_user; /* Deny anonymous access? */
5519 } api_commands[] = {
5520 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
5521 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
5522 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
5523 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
5524 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
5525 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
5526 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
5527 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
5528 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
5529 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
5530 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
5531 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
5532 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
5533 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
5534 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
5535 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
5536 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
5537 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
5538 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
5539 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
5540 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
5541 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
5542 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
5543 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
5544 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
5545 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
5546 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5547 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
5548 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
5549 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
5550 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5551 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
5552 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5553 {NULL, -1, api_Unsupported}
5554 /* The following RAP calls are not implemented by Samba:
5555
5556 RAP_WFileEnum2 - anon not OK
5557 */
5558 };
5559
5560
5561 /****************************************************************************
5562 Handle remote api calls.
5563 ****************************************************************************/
5564
5565 void api_reply(connection_struct *conn, uint64_t vuid,
5566 struct smb_request *req,
5567 char *data, char *params,
5568 int tdscnt, int tpscnt,
5569 int mdrcnt, int mprcnt)
5570 {
5571 int api_command;
5572 char *rdata = NULL;
5573 char *rparam = NULL;
5574 const char *name1 = NULL;
5575 const char *name2 = NULL;
5576 int rdata_len = 0;
5577 int rparam_len = 0;
5578 bool reply=False;
5579 int i;
5580
5581 if (!params) {
5582 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5583 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5584 return;
5585 }
5586
5587 if (tpscnt < 2) {
5588 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5589 return;
5590 }
5591 api_command = SVAL(params,0);
5592 /* Is there a string at position params+2 ? */
5593 if (skip_string(params,tpscnt,params+2)) {
5594 name1 = params + 2;
5595 } else {
5596 name1 = "";
5597 }
5598 name2 = skip_string(params,tpscnt,params+2);
5599 if (!name2) {
5600 name2 = "";
5601 }
5602
5603 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5604 api_command,
5605 name1,
5606 name2,
5607 tdscnt,tpscnt,mdrcnt,mprcnt));
5608
5609 for (i=0;api_commands[i].name;i++) {
5610 if (api_commands[i].id == api_command && api_commands[i].fn) {
5611 DEBUG(3,("Doing %s\n",api_commands[i].name));
5612 break;
5613 }
5614 }
5615
5616 /* Check whether this api call can be done anonymously */
5617
5618 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5619 struct user_struct *user = get_valid_user_struct(req->sconn, vuid);
5620
5621 if (!user || security_session_user_level(user->session_info, NULL) < SECURITY_USER) {
5622 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5623 return;
5624 }
5625 }
5626
5627 rdata = (char *)SMB_MALLOC(1024);
5628 if (rdata) {
5629 memset(rdata,'\0',1024);
5630 }
5631
5632 rparam = (char *)SMB_MALLOC(1024);
5633 if (rparam) {
5634 memset(rparam,'\0',1024);
5635 }
5636
5637 if(!rdata || !rparam) {
5638 DEBUG(0,("api_reply: malloc fail !\n"));
5639 SAFE_FREE(rdata);
5640 SAFE_FREE(rparam);
5641 reply_nterror(req, NT_STATUS_NO_MEMORY);
5642 return;
5643 }
5644
5645 reply = api_commands[i].fn(req->sconn, conn,
5646 vuid,
5647 params,tpscnt, /* params + length */
5648 data,tdscnt, /* data + length */
5649 mdrcnt,mprcnt,
5650 &rdata,&rparam,&rdata_len,&rparam_len);
5651
5652
5653 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5654 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5655 mdrcnt,mprcnt,
5656 &rdata,&rparam,&rdata_len,&rparam_len);
5657 }
5658
5659 /* if we get False back then it's actually unsupported */
5660 if (!reply) {
5661 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5662 data,
5663 tdscnt,mdrcnt,mprcnt,
5664 &rdata,&rparam,&rdata_len,&rparam_len);
5665 }
5666
5667 /* If api_Unsupported returns false we can't return anything. */
5668 if (reply) {
5669 send_trans_reply(conn, req, rparam, rparam_len,
5670 rdata, rdata_len, False);
5671 }
5672
5673 SAFE_FREE(rdata);
5674 SAFE_FREE(rparam);
5675 return;
5676 }
Samba GIT mirror