?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Convert uint32/16/8 to 32_t/16_t/8_t in printing.h and all files that include it.
[Samba.git] / source3 / smbd / lanman.c
blobe444a6e886737511df763df80417e7a48973c57a
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "rpc_client/rpc_client.h"
32 #include "../librpc/gen_ndr/ndr_samr_c.h"
33 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
34 #include "rpc_client/cli_spoolss.h"
35 #include "rpc_client/init_spoolss.h"
36 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
37 #include "../librpc/gen_ndr/rap.h"
38 #include "../lib/util/binsearch.h"
39 #include "../libcli/auth/libcli_auth.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "printing.h"
43 #include "passdb/machine_sid.h"
44 #include "auth.h"
45 #include "rpc_server/rpc_ncacn_np.h"
46
47 #ifdef CHECK_TYPES
48 #undef CHECK_TYPES
49 #endif
50 #define CHECK_TYPES 0
51
52 #define NERR_Success 0
53 #define NERR_badpass 86
54 #define NERR_notsupported 50
55
56 #define NERR_BASE (2100)
57 #define NERR_BufTooSmall (NERR_BASE+23)
58 #define NERR_JobNotFound (NERR_BASE+51)
59 #define NERR_DestNotFound (NERR_BASE+52)
60
61 #define ACCESS_READ 0x01
62 #define ACCESS_WRITE 0x02
63 #define ACCESS_CREATE 0x04
64
65 #define SHPWLEN 8 /* share password length */
66
67 /* Limit size of ipc replies */
68
69 static char *smb_realloc_limit(void *ptr, size_t size)
70 {
71 char *val;
72
73 size = MAX((size),4*1024);
74 val = (char *)SMB_REALLOC(ptr,size);
75 if (val) {
76 memset(val,'\0',size);
77 }
78 return val;
79 }
80
81 static bool api_Unsupported(struct smbd_server_connection *sconn,
82 connection_struct *conn, uint64_t vuid,
83 char *param, int tpscnt,
84 char *data, int tdscnt,
85 int mdrcnt, int mprcnt,
86 char **rdata, char **rparam,
87 int *rdata_len, int *rparam_len);
88
89 static bool api_TooSmall(struct smbd_server_connection *sconn,
90 connection_struct *conn, uint64_t vuid, char *param, char *data,
91 int mdrcnt, int mprcnt,
92 char **rdata, char **rparam,
93 int *rdata_len, int *rparam_len);
94
95
96 static int CopyExpanded(connection_struct *conn,
97 int snum, char **dst, char *src, int *p_space_remaining)
98 {
99 TALLOC_CTX *ctx = talloc_tos();
100 char *buf = NULL;
101 int l;
102
103 if (!src || !dst || !p_space_remaining || !(*dst) ||
104 *p_space_remaining <= 0) {
105 return 0;
106 }
107
108 buf = talloc_strdup(ctx, src);
109 if (!buf) {
110 *p_space_remaining = 0;
111 return 0;
112 }
113 buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, snum));
114 if (!buf) {
115 *p_space_remaining = 0;
116 return 0;
117 }
118 buf = talloc_sub_advanced(ctx,
119 lp_servicename(ctx, SNUM(conn)),
120 conn->session_info->unix_info->unix_name,
121 conn->connectpath,
122 conn->session_info->unix_token->gid,
123 conn->session_info->unix_info->sanitized_username,
124 conn->session_info->info->domain_name,
125 buf);
126 if (!buf) {
127 *p_space_remaining = 0;
128 return 0;
129 }
130 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
131 if (l == 0) {
132 return 0;
133 }
134 (*dst) += l;
135 (*p_space_remaining) -= l;
136 return l;
137 }
138
139 static int CopyAndAdvance(char **dst, char *src, int *n)
140 {
141 int l;
142 if (!src || !dst || !n || !(*dst)) {
143 return 0;
144 }
145 l = push_ascii(*dst,src,*n, STR_TERMINATE);
146 if (l == 0) {
147 return 0;
148 }
149 (*dst) += l;
150 (*n) -= l;
151 return l;
152 }
153
154 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
155 {
156 TALLOC_CTX *ctx = talloc_tos();
157 char *buf = NULL;
158 if (!s) {
159 return 0;
160 }
161 buf = talloc_strdup(ctx,s);
162 if (!buf) {
163 return 0;
164 }
165 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, snum));
166 if (!buf) {
167 return 0;
168 }
169 buf = talloc_sub_advanced(ctx,
170 lp_servicename(ctx, SNUM(conn)),
171 conn->session_info->unix_info->unix_name,
172 conn->connectpath,
173 conn->session_info->unix_token->gid,
174 conn->session_info->unix_info->sanitized_username,
175 conn->session_info->info->domain_name,
176 buf);
177 if (!buf) {
178 return 0;
179 }
180 return strlen(buf) + 1;
181 }
182
183 /*******************************************************************
184 Check a API string for validity when we only need to check the prefix.
185 ******************************************************************/
186
187 static bool prefix_ok(const char *str, const char *prefix)
188 {
189 return(strncmp(str,prefix,strlen(prefix)) == 0);
190 }
191
192 struct pack_desc {
193 const char *format; /* formatstring for structure */
194 const char *subformat; /* subformat for structure */
195 char *base; /* baseaddress of buffer */
196 int buflen; /* remaining size for fixed part; on init: length of base */
197 int subcount; /* count of substructures */
198 char *structbuf; /* pointer into buffer for remaining fixed part */
199 int stringlen; /* remaining size for variable part */
200 char *stringbuf; /* pointer into buffer for remaining variable part */
201 int neededlen; /* total needed size */
202 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
203 const char *curpos; /* current position; pointer into format or subformat */
204 int errcode;
205 };
206
207 static int get_counter(const char **p)
208 {
209 int i, n;
210 if (!p || !(*p)) {
211 return 1;
212 }
213 if (!isdigit((int)**p)) {
214 return 1;
215 }
216 for (n = 0;;) {
217 i = **p;
218 if (isdigit(i)) {
219 n = 10 * n + (i - '0');
220 } else {
221 return n;
222 }
223 (*p)++;
224 }
225 }
226
227 static int getlen(const char *p)
228 {
229 int n = 0;
230 if (!p) {
231 return 0;
232 }
233
234 while (*p) {
235 switch( *p++ ) {
236 case 'W': /* word (2 byte) */
237 n += 2;
238 break;
239 case 'K': /* status word? (2 byte) */
240 n += 2;
241 break;
242 case 'N': /* count of substructures (word) at end */
243 n += 2;
244 break;
245 case 'D': /* double word (4 byte) */
246 case 'z': /* offset to zero terminated string (4 byte) */
247 case 'l': /* offset to user data (4 byte) */
248 n += 4;
249 break;
250 case 'b': /* offset to data (with counter) (4 byte) */
251 n += 4;
252 get_counter(&p);
253 break;
254 case 'B': /* byte (with optional counter) */
255 n += get_counter(&p);
256 break;
257 }
258 }
259 return n;
260 }
261
262 static bool init_package(struct pack_desc *p, int count, int subcount)
263 {
264 int n = p->buflen;
265 int i;
266
267 if (!p->format || !p->base) {
268 return False;
269 }
270
271 i = count * getlen(p->format);
272 if (p->subformat) {
273 i += subcount * getlen(p->subformat);
274 }
275 p->structbuf = p->base;
276 p->neededlen = 0;
277 p->usedlen = 0;
278 p->subcount = 0;
279 p->curpos = p->format;
280 if (i > n) {
281 p->neededlen = i;
282 i = n = 0;
283 #if 0
284 /*
285 * This is the old error code we used. Aparently
286 * WinNT/2k systems return ERRbuftoosmall (2123) and
287 * OS/2 needs this. I'm leaving this here so we can revert
288 * if needed. JRA.
289 */
290 p->errcode = ERRmoredata;
291 #else
292 p->errcode = ERRbuftoosmall;
293 #endif
294 } else {
295 p->errcode = NERR_Success;
296 }
297 p->buflen = i;
298 n -= i;
299 p->stringbuf = p->base + i;
300 p->stringlen = n;
301 return (p->errcode == NERR_Success);
302 }
303
304 static int package(struct pack_desc *p, ...)
305 {
306 va_list args;
307 int needed=0, stringneeded;
308 const char *str=NULL;
309 int is_string=0, stringused;
310 int32 temp;
311
312 va_start(args,p);
313
314 if (!*p->curpos) {
315 if (!p->subcount) {
316 p->curpos = p->format;
317 } else {
318 p->curpos = p->subformat;
319 p->subcount--;
320 }
321 }
322 #if CHECK_TYPES
323 str = va_arg(args,char*);
324 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
325 #endif
326 stringneeded = -1;
327
328 if (!p->curpos) {
329 va_end(args);
330 return 0;
331 }
332
333 switch( *p->curpos++ ) {
334 case 'W': /* word (2 byte) */
335 needed = 2;
336 temp = va_arg(args,int);
337 if (p->buflen >= needed) {
338 SSVAL(p->structbuf,0,temp);
339 }
340 break;
341 case 'K': /* status word? (2 byte) */
342 needed = 2;
343 temp = va_arg(args,int);
344 if (p->buflen >= needed) {
345 SSVAL(p->structbuf,0,temp);
346 }
347 break;
348 case 'N': /* count of substructures (word) at end */
349 needed = 2;
350 p->subcount = va_arg(args,int);
351 if (p->buflen >= needed) {
352 SSVAL(p->structbuf,0,p->subcount);
353 }
354 break;
355 case 'D': /* double word (4 byte) */
356 needed = 4;
357 temp = va_arg(args,int);
358 if (p->buflen >= needed) {
359 SIVAL(p->structbuf,0,temp);
360 }
361 break;
362 case 'B': /* byte (with optional counter) */
363 needed = get_counter(&p->curpos);
364 {
365 char *s = va_arg(args,char*);
366 if (p->buflen >= needed) {
367 StrnCpy(p->structbuf,s?s:"",needed-1);
368 }
369 }
370 break;
371 case 'z': /* offset to zero terminated string (4 byte) */
372 str = va_arg(args,char*);
373 stringneeded = (str ? strlen(str)+1 : 0);
374 is_string = 1;
375 break;
376 case 'l': /* offset to user data (4 byte) */
377 str = va_arg(args,char*);
378 stringneeded = va_arg(args,int);
379 is_string = 0;
380 break;
381 case 'b': /* offset to data (with counter) (4 byte) */
382 str = va_arg(args,char*);
383 stringneeded = get_counter(&p->curpos);
384 is_string = 0;
385 break;
386 }
387
388 va_end(args);
389 if (stringneeded >= 0) {
390 needed = 4;
391 if (p->buflen >= needed) {
392 stringused = stringneeded;
393 if (stringused > p->stringlen) {
394 stringused = (is_string ? p->stringlen : 0);
395 if (p->errcode == NERR_Success) {
396 p->errcode = ERRmoredata;
397 }
398 }
399 if (!stringused) {
400 SIVAL(p->structbuf,0,0);
401 } else {
402 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
403 memcpy(p->stringbuf,str?str:"",stringused);
404 if (is_string) {
405 p->stringbuf[stringused-1] = '\0';
406 }
407 p->stringbuf += stringused;
408 p->stringlen -= stringused;
409 p->usedlen += stringused;
410 }
411 }
412 p->neededlen += stringneeded;
413 }
414
415 p->neededlen += needed;
416 if (p->buflen >= needed) {
417 p->structbuf += needed;
418 p->buflen -= needed;
419 p->usedlen += needed;
420 } else {
421 if (p->errcode == NERR_Success) {
422 p->errcode = ERRmoredata;
423 }
424 }
425 return 1;
426 }
427
428 #if CHECK_TYPES
429 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
430 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
431 #else
432 #define PACK(desc,t,v) package(desc,v)
433 #define PACKl(desc,t,v,l) package(desc,v,l)
434 #endif
435
436 static void PACKI(struct pack_desc* desc, const char *t,int v)
437 {
438 PACK(desc,t,v);
439 }
440
441 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
442 {
443 PACK(desc,t,v);
444 }
445
446 /****************************************************************************
447 Get a print queue.
448 ****************************************************************************/
449
450 static void PackDriverData(struct pack_desc* desc)
451 {
452 char drivdata[4+4+32];
453 SIVAL(drivdata,0,sizeof drivdata); /* cb */
454 SIVAL(drivdata,4,1000); /* lVersion */
455 memset(drivdata+8,0,32); /* szDeviceName */
456 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
457 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
458 }
459
460 static int check_printq_info(struct pack_desc* desc,
461 unsigned int uLevel, char *id1, char *id2)
462 {
463 desc->subformat = NULL;
464 switch( uLevel ) {
465 case 0:
466 desc->format = "B13";
467 break;
468 case 1:
469 desc->format = "B13BWWWzzzzzWW";
470 break;
471 case 2:
472 desc->format = "B13BWWWzzzzzWN";
473 desc->subformat = "WB21BB16B10zWWzDDz";
474 break;
475 case 3:
476 desc->format = "zWWWWzzzzWWzzl";
477 break;
478 case 4:
479 desc->format = "zWWWWzzzzWNzzl";
480 desc->subformat = "WWzWWDDzz";
481 break;
482 case 5:
483 desc->format = "z";
484 break;
485 case 51:
486 desc->format = "K";
487 break;
488 case 52:
489 desc->format = "WzzzzzzzzN";
490 desc->subformat = "z";
491 break;
492 default:
493 DEBUG(0,("check_printq_info: invalid level %d\n",
494 uLevel ));
495 return False;
496 }
497 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
498 DEBUG(0,("check_printq_info: invalid format %s\n",
499 id1 ? id1 : "<NULL>" ));
500 return False;
501 }
502 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
503 DEBUG(0,("check_printq_info: invalid subformat %s\n",
504 id2 ? id2 : "<NULL>" ));
505 return False;
506 }
507 return True;
508 }
509
510
511 #define RAP_JOB_STATUS_QUEUED 0
512 #define RAP_JOB_STATUS_PAUSED 1
513 #define RAP_JOB_STATUS_SPOOLING 2
514 #define RAP_JOB_STATUS_PRINTING 3
515 #define RAP_JOB_STATUS_PRINTED 4
516
517 #define RAP_QUEUE_STATUS_PAUSED 1
518 #define RAP_QUEUE_STATUS_ERROR 2
519
520 /* turn a print job status into a on the wire status
521 */
522 static int printj_spoolss_status(int v)
523 {
524 if (v == JOB_STATUS_QUEUED)
525 return RAP_JOB_STATUS_QUEUED;
526 if (v & JOB_STATUS_PAUSED)
527 return RAP_JOB_STATUS_PAUSED;
528 if (v & JOB_STATUS_SPOOLING)
529 return RAP_JOB_STATUS_SPOOLING;
530 if (v & JOB_STATUS_PRINTING)
531 return RAP_JOB_STATUS_PRINTING;
532 return 0;
533 }
534
535 /* turn a print queue status into a on the wire status
536 */
537 static int printq_spoolss_status(int v)
538 {
539 if (v == PRINTER_STATUS_OK)
540 return 0;
541 if (v & PRINTER_STATUS_PAUSED)
542 return RAP_QUEUE_STATUS_PAUSED;
543 return RAP_QUEUE_STATUS_ERROR;
544 }
545
546 static void fill_spoolss_printjob_info(int uLevel,
547 struct pack_desc *desc,
548 struct spoolss_JobInfo2 *info2,
549 int n)
550 {
551 time_t t = spoolss_Time_to_time_t(&info2->submitted);
552
553 /* the client expects localtime */
554 t -= get_time_zone(t);
555
556 PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
557 if (uLevel == 1) {
558 PACKS(desc,"B21", info2->user_name); /* szUserName */
559 PACKS(desc,"B",""); /* pad */
560 PACKS(desc,"B16",""); /* szNotifyName */
561 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
562 PACKS(desc,"z",""); /* pszParms */
563 PACKI(desc,"W",n+1); /* uPosition */
564 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
565 PACKS(desc,"z",""); /* pszStatus */
566 PACKI(desc,"D", t); /* ulSubmitted */
567 PACKI(desc,"D", info2->size); /* ulSize */
568 PACKS(desc,"z", info2->document_name); /* pszComment */
569 }
570 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
571 PACKI(desc,"W", info2->priority); /* uPriority */
572 PACKS(desc,"z", info2->user_name); /* pszUserName */
573 PACKI(desc,"W",n+1); /* uPosition */
574 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
575 PACKI(desc,"D",t); /* ulSubmitted */
576 PACKI(desc,"D", info2->size); /* ulSize */
577 PACKS(desc,"z","Samba"); /* pszComment */
578 PACKS(desc,"z", info2->document_name); /* pszDocument */
579 if (uLevel == 3) {
580 PACKS(desc,"z",""); /* pszNotifyName */
581 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
582 PACKS(desc,"z",""); /* pszParms */
583 PACKS(desc,"z",""); /* pszStatus */
584 PACKS(desc,"z", info2->printer_name); /* pszQueue */
585 PACKS(desc,"z","lpd"); /* pszQProcName */
586 PACKS(desc,"z",""); /* pszQProcParms */
587 PACKS(desc,"z","NULL"); /* pszDriverName */
588 PackDriverData(desc); /* pDriverData */
589 PACKS(desc,"z",""); /* pszPrinterName */
590 } else if (uLevel == 4) { /* OS2 */
591 PACKS(desc,"z",""); /* pszSpoolFileName */
592 PACKS(desc,"z",""); /* pszPortName */
593 PACKS(desc,"z",""); /* pszStatus */
594 PACKI(desc,"D",0); /* ulPagesSpooled */
595 PACKI(desc,"D",0); /* ulPagesSent */
596 PACKI(desc,"D",0); /* ulPagesPrinted */
597 PACKI(desc,"D",0); /* ulTimePrinted */
598 PACKI(desc,"D",0); /* ulExtendJobStatus */
599 PACKI(desc,"D",0); /* ulStartPage */
600 PACKI(desc,"D",0); /* ulEndPage */
601 }
602 }
603 }
604
605 /********************************************************************
606 Respond to the DosPrintQInfo command with a level of 52
607 This is used to get printer driver information for Win9x clients
608 ********************************************************************/
609 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
610 struct pack_desc* desc, int count,
611 const char *printer_name)
612 {
613 int i;
614 fstring location;
615 trim_string(discard_const_p(char, driver->driver_path), "\\print$\\WIN40\\0\\", 0);
616 trim_string(discard_const_p(char, driver->data_file), "\\print$\\WIN40\\0\\", 0);
617 trim_string(discard_const_p(char, driver->help_file), "\\print$\\WIN40\\0\\", 0);
618
619 PACKI(desc, "W", 0x0400); /* don't know */
620 PACKS(desc, "z", driver->driver_name); /* long printer name */
621 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
622 PACKS(desc, "z", driver->data_file); /* Datafile name */
623 PACKS(desc, "z", driver->monitor_name); /* language monitor */
624
625 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
626 standard_sub_basic( "", "", location, sizeof(location)-1 );
627 PACKS(desc,"z", location); /* share to retrieve files */
628
629 PACKS(desc,"z", driver->default_datatype); /* default data type */
630 PACKS(desc,"z", driver->help_file); /* helpfile name */
631 PACKS(desc,"z", driver->driver_path); /* driver name */
632
633 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
634 DEBUG(3,("Driver: %s:\n",driver->driver_path));
635 DEBUG(3,("Data File: %s:\n",driver->data_file));
636 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
637 DEBUG(3,("Driver Location: %s:\n",location));
638 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
639 DEBUG(3,("Help File: %s:\n",driver->help_file));
640 PACKI(desc,"N",count); /* number of files to copy */
641
642 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
643 {
644 trim_string(discard_const_p(char, driver->dependent_files[i]), "\\print$\\WIN40\\0\\", 0);
645 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
646 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
647 }
648
649 /* sanity check */
650 if ( i != count )
651 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
652 count, i));
653
654 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
655
656 desc->errcode=NERR_Success;
657
658 }
659
660 static const char *strip_unc(const char *unc)
661 {
662 char *p;
663
664 if (unc == NULL) {
665 return NULL;
666 }
667
668 if ((p = strrchr(unc, '\\')) != NULL) {
669 return p+1;
670 }
671
672 return unc;
673 }
674
675 static void fill_printq_info(int uLevel,
676 struct pack_desc* desc,
677 int count,
678 union spoolss_JobInfo *job_info,
679 struct spoolss_DriverInfo3 *driver_info,
680 struct spoolss_PrinterInfo2 *printer_info)
681 {
682 switch (uLevel) {
683 case 0:
684 case 1:
685 case 2:
686 PACKS(desc,"B13", strip_unc(printer_info->printername));
687 break;
688 case 3:
689 case 4:
690 case 5:
691 PACKS(desc,"z", strip_unc(printer_info->printername));
692 break;
693 case 51:
694 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
695 break;
696 }
697
698 if (uLevel == 1 || uLevel == 2) {
699 PACKS(desc,"B",""); /* alignment */
700 PACKI(desc,"W",5); /* priority */
701 PACKI(desc,"W",0); /* start time */
702 PACKI(desc,"W",0); /* until time */
703 PACKS(desc,"z",""); /* pSepFile */
704 PACKS(desc,"z","lpd"); /* pPrProc */
705 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
706 PACKS(desc,"z",""); /* pParms */
707 if (printer_info->printername == NULL) {
708 PACKS(desc,"z","UNKNOWN PRINTER");
709 PACKI(desc,"W",LPSTAT_ERROR);
710 } else {
711 PACKS(desc,"z", printer_info->comment);
712 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
713 }
714 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
715 }
716
717 if (uLevel == 3 || uLevel == 4) {
718 PACKI(desc,"W",5); /* uPriority */
719 PACKI(desc,"W",0); /* uStarttime */
720 PACKI(desc,"W",0); /* uUntiltime */
721 PACKI(desc,"W",5); /* pad1 */
722 PACKS(desc,"z",""); /* pszSepFile */
723 PACKS(desc,"z","WinPrint"); /* pszPrProc */
724 PACKS(desc,"z",NULL); /* pszParms */
725 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
726 /* "don't ask" that it's done this way to fix corrupted
727 Win9X/ME printer comments. */
728 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
729 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
730 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
731 PACKS(desc,"z", printer_info->drivername); /* pszDriverName */
732 PackDriverData(desc); /* pDriverData */
733 }
734
735 if (uLevel == 2 || uLevel == 4) {
736 int i;
737 for (i = 0; i < count; i++) {
738 fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
739 }
740 }
741
742 if (uLevel==52)
743 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
744 }
745
746 /* This function returns the number of files for a given driver */
747 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
748 {
749 int result = 0;
750
751 /* count the number of files */
752 while (driver->dependent_files && *driver->dependent_files[result])
753 result++;
754
755 return result;
756 }
757
758 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
759 connection_struct *conn, uint64_t vuid,
760 char *param, int tpscnt,
761 char *data, int tdscnt,
762 int mdrcnt,int mprcnt,
763 char **rdata,char **rparam,
764 int *rdata_len,int *rparam_len)
765 {
766 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
767 char *str2 = skip_string(param,tpscnt,str1);
768 char *p = skip_string(param,tpscnt,str2);
769 char *QueueName = p;
770 unsigned int uLevel;
771 uint32_t count = 0;
772 char *str3;
773 struct pack_desc desc;
774 char* tmpdata=NULL;
775
776 WERROR werr = WERR_OK;
777 TALLOC_CTX *mem_ctx = talloc_tos();
778 NTSTATUS status;
779 struct rpc_pipe_client *cli = NULL;
780 struct dcerpc_binding_handle *b = NULL;
781 struct policy_handle handle;
782 struct spoolss_DevmodeContainer devmode_ctr;
783 union spoolss_DriverInfo driver_info;
784 union spoolss_JobInfo *job_info = NULL;
785 union spoolss_PrinterInfo printer_info;
786
787 if (!str1 || !str2 || !p) {
788 return False;
789 }
790 memset((char *)&desc,'\0',sizeof(desc));
791
792 p = skip_string(param,tpscnt,p);
793 if (!p) {
794 return False;
795 }
796 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
797 str3 = get_safe_str_ptr(param,tpscnt,p,4);
798 /* str3 may be null here and is checked in check_printq_info(). */
799
800 /* remove any trailing username */
801 if ((p = strchr_m(QueueName,'%')))
802 *p = 0;
803
804 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
805
806 /* check it's a supported varient */
807 if (!prefix_ok(str1,"zWrLh"))
808 return False;
809 if (!check_printq_info(&desc,uLevel,str2,str3)) {
810 /*
811 * Patch from Scott Moomaw <scott@bridgewater.edu>
812 * to return the 'invalid info level' error if an
813 * unknown level was requested.
814 */
815 *rdata_len = 0;
816 *rparam_len = 6;
817 *rparam = smb_realloc_limit(*rparam,*rparam_len);
818 if (!*rparam) {
819 return False;
820 }
821 SSVALS(*rparam,0,ERRunknownlevel);
822 SSVAL(*rparam,2,0);
823 SSVAL(*rparam,4,0);
824 return(True);
825 }
826
827 ZERO_STRUCT(handle);
828
829 if (QueueName == NULL || (strlen(QueueName) < 1)) {
830 desc.errcode = W_ERROR_V(WERR_INVALID_PARAM);
831 goto out;
832 }
833
834 status = rpc_pipe_open_interface(conn,
835 &ndr_table_spoolss,
836 conn->session_info,
837 conn->sconn->remote_address,
838 conn->sconn->msg_ctx,
839 &cli);
840 if (!NT_STATUS_IS_OK(status)) {
841 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
842 nt_errstr(status)));
843 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
844 goto out;
845 }
846 b = cli->binding_handle;
847
848 ZERO_STRUCT(devmode_ctr);
849
850 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
851 QueueName,
852 "RAW",
853 devmode_ctr,
854 PRINTER_ACCESS_USE,
855 &handle,
856 &werr);
857 if (!NT_STATUS_IS_OK(status)) {
858 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
859 goto out;
860 }
861 if (!W_ERROR_IS_OK(werr)) {
862 desc.errcode = W_ERROR_V(werr);
863 goto out;
864 }
865
866 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
867 &handle,
868 2,
869 0,
870 &printer_info);
871 if (!W_ERROR_IS_OK(werr)) {
872 desc.errcode = W_ERROR_V(werr);
873 goto out;
874 }
875
876 if (uLevel==52) {
877 uint32_t server_major_version;
878 uint32_t server_minor_version;
879
880 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
881 &handle,
882 "Windows 4.0",
883 3, /* level */
884 0,
885 0, /* version */
886 0,
887 &driver_info,
888 &server_major_version,
889 &server_minor_version);
890 if (!W_ERROR_IS_OK(werr)) {
891 desc.errcode = W_ERROR_V(werr);
892 goto out;
893 }
894
895 count = get_printerdrivernumber(&driver_info.info3);
896 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
897 } else {
898 uint32_t num_jobs;
899 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
900 &handle,
901 0, /* firstjob */
902 0xff, /* numjobs */
903 2, /* level */
904 0, /* offered */
905 &num_jobs,
906 &job_info);
907 if (!W_ERROR_IS_OK(werr)) {
908 desc.errcode = W_ERROR_V(werr);
909 goto out;
910 }
911
912 count = num_jobs;
913 }
914
915 if (mdrcnt > 0) {
916 *rdata = smb_realloc_limit(*rdata,mdrcnt);
917 if (!*rdata) {
918 return False;
919 }
920 desc.base = *rdata;
921 desc.buflen = mdrcnt;
922 } else {
923 /*
924 * Don't return data but need to get correct length
925 * init_package will return wrong size if buflen=0
926 */
927 desc.buflen = getlen(desc.format);
928 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
929 }
930
931 if (init_package(&desc,1,count)) {
932 desc.subcount = count;
933 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
934 }
935
936 *rdata_len = desc.usedlen;
937
938 /*
939 * We must set the return code to ERRbuftoosmall
940 * in order to support lanman style printing with Win NT/2k
941 * clients --jerry
942 */
943 if (!mdrcnt && lp_disable_spoolss())
944 desc.errcode = ERRbuftoosmall;
945
946 out:
947 if (b && is_valid_policy_hnd(&handle)) {
948 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
949 }
950
951 *rdata_len = desc.usedlen;
952 *rparam_len = 6;
953 *rparam = smb_realloc_limit(*rparam,*rparam_len);
954 if (!*rparam) {
955 SAFE_FREE(tmpdata);
956 return False;
957 }
958 SSVALS(*rparam,0,desc.errcode);
959 SSVAL(*rparam,2,0);
960 SSVAL(*rparam,4,desc.neededlen);
961
962 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
963
964 SAFE_FREE(tmpdata);
965
966 return(True);
967 }
968
969 /****************************************************************************
970 View list of all print jobs on all queues.
971 ****************************************************************************/
972
973 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
974 connection_struct *conn, uint64_t vuid,
975 char *param, int tpscnt,
976 char *data, int tdscnt,
977 int mdrcnt, int mprcnt,
978 char **rdata, char** rparam,
979 int *rdata_len, int *rparam_len)
980 {
981 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
982 char *output_format1 = skip_string(param,tpscnt,param_format);
983 char *p = skip_string(param,tpscnt,output_format1);
984 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
985 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
986 int i;
987 struct pack_desc desc;
988 int *subcntarr = NULL;
989 int queuecnt = 0, subcnt = 0, succnt = 0;
990
991 WERROR werr = WERR_OK;
992 TALLOC_CTX *mem_ctx = talloc_tos();
993 NTSTATUS status;
994 struct rpc_pipe_client *cli = NULL;
995 struct dcerpc_binding_handle *b = NULL;
996 struct spoolss_DevmodeContainer devmode_ctr;
997 uint32_t num_printers;
998 union spoolss_PrinterInfo *printer_info;
999 union spoolss_DriverInfo *driver_info;
1000 union spoolss_JobInfo **job_info;
1001
1002 if (!param_format || !output_format1 || !p) {
1003 return False;
1004 }
1005
1006 memset((char *)&desc,'\0',sizeof(desc));
1007
1008 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1009
1010 if (!prefix_ok(param_format,"WrLeh")) {
1011 return False;
1012 }
1013 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1014 /*
1015 * Patch from Scott Moomaw <scott@bridgewater.edu>
1016 * to return the 'invalid info level' error if an
1017 * unknown level was requested.
1018 */
1019 *rdata_len = 0;
1020 *rparam_len = 6;
1021 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1022 if (!*rparam) {
1023 return False;
1024 }
1025 SSVALS(*rparam,0,ERRunknownlevel);
1026 SSVAL(*rparam,2,0);
1027 SSVAL(*rparam,4,0);
1028 return(True);
1029 }
1030
1031 status = rpc_pipe_open_interface(conn,
1032 &ndr_table_spoolss,
1033 conn->session_info,
1034 conn->sconn->remote_address,
1035 conn->sconn->msg_ctx,
1036 &cli);
1037 if (!NT_STATUS_IS_OK(status)) {
1038 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1039 nt_errstr(status)));
1040 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1041 goto out;
1042 }
1043 b = cli->binding_handle;
1044
1045 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1046 PRINTER_ENUM_LOCAL,
1047 cli->srv_name_slash,
1048 2,
1049 0,
1050 &num_printers,
1051 &printer_info);
1052 if (!W_ERROR_IS_OK(werr)) {
1053 desc.errcode = W_ERROR_V(werr);
1054 goto out;
1055 }
1056
1057 queuecnt = num_printers;
1058
1059 job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1060 if (job_info == NULL) {
1061 goto err;
1062 }
1063
1064 driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1065 if (driver_info == NULL) {
1066 goto err;
1067 }
1068
1069 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1070 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1071 goto err;
1072 }
1073
1074 if (mdrcnt > 0) {
1075 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1076 if (!*rdata) {
1077 goto err;
1078 }
1079 }
1080 desc.base = *rdata;
1081 desc.buflen = mdrcnt;
1082
1083 subcnt = 0;
1084 for (i = 0; i < num_printers; i++) {
1085
1086 uint32_t num_jobs;
1087 struct policy_handle handle;
1088 const char *printername;
1089
1090 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1091 if (printername == NULL) {
1092 goto err;
1093 }
1094
1095 ZERO_STRUCT(handle);
1096 ZERO_STRUCT(devmode_ctr);
1097
1098 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1099 printername,
1100 "RAW",
1101 devmode_ctr,
1102 PRINTER_ACCESS_USE,
1103 &handle,
1104 &werr);
1105 if (!NT_STATUS_IS_OK(status)) {
1106 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1107 goto out;
1108 }
1109 if (!W_ERROR_IS_OK(werr)) {
1110 desc.errcode = W_ERROR_V(werr);
1111 goto out;
1112 }
1113
1114 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1115 &handle,
1116 0, /* firstjob */
1117 0xff, /* numjobs */
1118 2, /* level */
1119 0, /* offered */
1120 &num_jobs,
1121 &job_info[i]);
1122 if (!W_ERROR_IS_OK(werr)) {
1123 desc.errcode = W_ERROR_V(werr);
1124 goto out;
1125 }
1126
1127 if (uLevel==52) {
1128 uint32_t server_major_version;
1129 uint32_t server_minor_version;
1130
1131 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1132 &handle,
1133 "Windows 4.0",
1134 3, /* level */
1135 0,
1136 0, /* version */
1137 0,
1138 &driver_info[i],
1139 &server_major_version,
1140 &server_minor_version);
1141 if (!W_ERROR_IS_OK(werr)) {
1142 desc.errcode = W_ERROR_V(werr);
1143 goto out;
1144 }
1145 }
1146
1147 subcntarr[i] = num_jobs;
1148 subcnt += subcntarr[i];
1149
1150 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1151 }
1152
1153 if (init_package(&desc,queuecnt,subcnt)) {
1154 for (i = 0; i < num_printers; i++) {
1155 fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1156 if (desc.errcode == NERR_Success) {
1157 succnt = i;
1158 }
1159 }
1160 }
1161
1162 out:
1163 SAFE_FREE(subcntarr);
1164 *rdata_len = desc.usedlen;
1165 *rparam_len = 8;
1166 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1167 if (!*rparam) {
1168 goto err;
1169 }
1170 SSVALS(*rparam,0,desc.errcode);
1171 SSVAL(*rparam,2,0);
1172 SSVAL(*rparam,4,succnt);
1173 SSVAL(*rparam,6,queuecnt);
1174
1175 return True;
1176
1177 err:
1178
1179 SAFE_FREE(subcntarr);
1180
1181 return False;
1182 }
1183
1184 /****************************************************************************
1185 Get info level for a server list query.
1186 ****************************************************************************/
1187
1188 static bool check_session_info(int uLevel, char* id)
1189 {
1190 switch( uLevel ) {
1191 case 0:
1192 if (strcmp(id,"B16") != 0) {
1193 return False;
1194 }
1195 break;
1196 case 1:
1197 if (strcmp(id,"B16BBDz") != 0) {
1198 return False;
1199 }
1200 break;
1201 default:
1202 return False;
1203 }
1204 return True;
1205 }
1206
1207 struct srv_info_struct {
1208 fstring name;
1209 uint32_t type;
1210 fstring comment;
1211 fstring domain;
1212 bool server_added;
1213 };
1214
1215 /*******************************************************************
1216 Get server info lists from the files saved by nmbd. Return the
1217 number of entries.
1218 ******************************************************************/
1219
1220 static int get_session_info(uint32_t servertype,
1221 struct srv_info_struct **servers,
1222 const char *domain)
1223 {
1224 int count=0;
1225 int alloced=0;
1226 char **lines;
1227 bool local_list_only;
1228 int i;
1229 char *slist_cache_path = cache_path(SERVER_LIST);
1230 if (slist_cache_path == NULL) {
1231 return 0;
1232 }
1233
1234 lines = file_lines_load(slist_cache_path, NULL, 0, NULL);
1235 if (!lines) {
1236 DEBUG(4, ("Can't open %s - %s\n",
1237 slist_cache_path, strerror(errno)));
1238 TALLOC_FREE(slist_cache_path);
1239 return 0;
1240 }
1241 TALLOC_FREE(slist_cache_path);
1242
1243 /* request for everything is code for request all servers */
1244 if (servertype == SV_TYPE_ALL) {
1245 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1246 }
1247
1248 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1249
1250 DEBUG(4,("Servertype search: %8x\n",servertype));
1251
1252 for (i=0;lines[i];i++) {
1253 fstring stype;
1254 struct srv_info_struct *s;
1255 const char *ptr = lines[i];
1256 bool ok = True;
1257 TALLOC_CTX *frame = NULL;
1258 char *p;
1259
1260 if (!*ptr) {
1261 continue;
1262 }
1263
1264 if (count == alloced) {
1265 alloced += 10;
1266 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1267 if (!*servers) {
1268 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1269 TALLOC_FREE(lines);
1270 return 0;
1271 }
1272 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1273 }
1274 s = &(*servers)[count];
1275
1276 frame = talloc_stackframe();
1277 s->name[0] = '\0';
1278 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1279 TALLOC_FREE(frame);
1280 continue;
1281 }
1282 fstrcpy(s->name, p);
1283
1284 stype[0] = '\0';
1285 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1286 TALLOC_FREE(frame);
1287 continue;
1288 }
1289 fstrcpy(stype, p);
1290
1291 s->comment[0] = '\0';
1292 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1293 TALLOC_FREE(frame);
1294 continue;
1295 }
1296 fstrcpy(s->comment, p);
1297 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1298
1299 s->domain[0] = '\0';
1300 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1301 /* this allows us to cope with an old nmbd */
1302 fstrcpy(s->domain,lp_workgroup());
1303 } else {
1304 fstrcpy(s->domain, p);
1305 }
1306 TALLOC_FREE(frame);
1307
1308 if (sscanf(stype,"%X",&s->type) != 1) {
1309 DEBUG(4,("r:host file "));
1310 ok = False;
1311 }
1312
1313 /* Filter the servers/domains we return based on what was asked for. */
1314
1315 /* Check to see if we are being asked for a local list only. */
1316 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1317 DEBUG(4,("r: local list only"));
1318 ok = False;
1319 }
1320
1321 /* doesn't match up: don't want it */
1322 if (!(servertype & s->type)) {
1323 DEBUG(4,("r:serv type "));
1324 ok = False;
1325 }
1326
1327 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1328 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1329 DEBUG(4,("s: dom mismatch "));
1330 ok = False;
1331 }
1332
1333 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1334 ok = False;
1335 }
1336
1337 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1338 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1339
1340 if (ok) {
1341 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1342 s->name, s->type, s->comment, s->domain));
1343 s->server_added = True;
1344 count++;
1345 } else {
1346 DEBUG(4,("%20s %8x %25s %15s\n",
1347 s->name, s->type, s->comment, s->domain));
1348 }
1349 }
1350
1351 TALLOC_FREE(lines);
1352 return count;
1353 }
1354
1355 /*******************************************************************
1356 Fill in a server info structure.
1357 ******************************************************************/
1358
1359 static int fill_srv_info(struct srv_info_struct *service,
1360 int uLevel, char **buf, int *buflen,
1361 char **stringbuf, int *stringspace, char *baseaddr)
1362 {
1363 int struct_len;
1364 char* p;
1365 char* p2;
1366 int l2;
1367 int len;
1368
1369 switch (uLevel) {
1370 case 0:
1371 struct_len = 16;
1372 break;
1373 case 1:
1374 struct_len = 26;
1375 break;
1376 default:
1377 return -1;
1378 }
1379
1380 if (!buf) {
1381 len = 0;
1382 switch (uLevel) {
1383 case 1:
1384 len = strlen(service->comment)+1;
1385 break;
1386 }
1387
1388 *buflen = struct_len;
1389 *stringspace = len;
1390 return struct_len + len;
1391 }
1392
1393 len = struct_len;
1394 p = *buf;
1395 if (*buflen < struct_len) {
1396 return -1;
1397 }
1398 if (stringbuf) {
1399 p2 = *stringbuf;
1400 l2 = *stringspace;
1401 } else {
1402 p2 = p + struct_len;
1403 l2 = *buflen - struct_len;
1404 }
1405 if (!baseaddr) {
1406 baseaddr = p;
1407 }
1408
1409 switch (uLevel) {
1410 case 0:
1411 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1412 break;
1413
1414 case 1:
1415 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1416 SIVAL(p,18,service->type);
1417 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1418 len += CopyAndAdvance(&p2,service->comment,&l2);
1419 break;
1420 }
1421
1422 if (stringbuf) {
1423 *buf = p + struct_len;
1424 *buflen -= struct_len;
1425 *stringbuf = p2;
1426 *stringspace = l2;
1427 } else {
1428 *buf = p2;
1429 *buflen -= len;
1430 }
1431 return len;
1432 }
1433
1434
1435 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1436 {
1437 return strcasecmp_m(s1->name,s2->name);
1438 }
1439
1440 /****************************************************************************
1441 View list of servers available (or possibly domains). The info is
1442 extracted from lists saved by nmbd on the local host.
1443 ****************************************************************************/
1444
1445 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1446 connection_struct *conn, uint64_t vuid,
1447 char *param, int tpscnt,
1448 char *data, int tdscnt,
1449 int mdrcnt, int mprcnt, char **rdata,
1450 char **rparam, int *rdata_len, int *rparam_len)
1451 {
1452 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1453 char *str2 = skip_string(param,tpscnt,str1);
1454 char *p = skip_string(param,tpscnt,str2);
1455 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1456 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1457 uint32_t servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1458 char *p2;
1459 int data_len, fixed_len, string_len;
1460 int f_len = 0, s_len = 0;
1461 struct srv_info_struct *servers=NULL;
1462 int counted=0,total=0;
1463 int i,missed;
1464 fstring domain;
1465 bool domain_request;
1466 bool local_request;
1467
1468 if (!str1 || !str2 || !p) {
1469 return False;
1470 }
1471
1472 /* If someone sets all the bits they don't really mean to set
1473 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1474 known servers. */
1475
1476 if (servertype == SV_TYPE_ALL) {
1477 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1478 }
1479
1480 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1481 any other bit (they may just set this bit on its own) they
1482 want all the locally seen servers. However this bit can be
1483 set on its own so set the requested servers to be
1484 ALL - DOMAIN_ENUM. */
1485
1486 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1487 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1488 }
1489
1490 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1491 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1492
1493 p += 8;
1494
1495 if (!prefix_ok(str1,"WrLehD")) {
1496 return False;
1497 }
1498 if (!check_session_info(uLevel,str2)) {
1499 return False;
1500 }
1501
1502 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1503 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1504 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1505
1506 if (strcmp(str1, "WrLehDz") == 0) {
1507 if (skip_string(param,tpscnt,p) == NULL) {
1508 return False;
1509 }
1510 pull_ascii_fstring(domain, p);
1511 } else {
1512 fstrcpy(domain, lp_workgroup());
1513 }
1514
1515 DEBUG(4, ("domain [%s]\n", domain));
1516
1517 if (lp_browse_list()) {
1518 total = get_session_info(servertype,&servers,domain);
1519 }
1520
1521 data_len = fixed_len = string_len = 0;
1522 missed = 0;
1523
1524 TYPESAFE_QSORT(servers, total, srv_comp);
1525
1526 {
1527 char *lastname=NULL;
1528
1529 for (i=0;i<total;i++) {
1530 struct srv_info_struct *s = &servers[i];
1531
1532 if (lastname && strequal(lastname,s->name)) {
1533 continue;
1534 }
1535 lastname = s->name;
1536 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1537 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1538 i, s->name, s->type, s->comment, s->domain));
1539
1540 if (data_len < buf_len) {
1541 counted++;
1542 fixed_len += f_len;
1543 string_len += s_len;
1544 } else {
1545 missed++;
1546 }
1547 }
1548 }
1549
1550 *rdata_len = fixed_len + string_len;
1551 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1552 if (!*rdata) {
1553 return False;
1554 }
1555
1556 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1557 p = *rdata;
1558 f_len = fixed_len;
1559 s_len = string_len;
1560
1561 {
1562 char *lastname=NULL;
1563 int count2 = counted;
1564
1565 for (i = 0; i < total && count2;i++) {
1566 struct srv_info_struct *s = &servers[i];
1567
1568 if (lastname && strequal(lastname,s->name)) {
1569 continue;
1570 }
1571 lastname = s->name;
1572 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1573 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1574 i, s->name, s->type, s->comment, s->domain));
1575 count2--;
1576 }
1577 }
1578
1579 *rparam_len = 8;
1580 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1581 if (!*rparam) {
1582 return False;
1583 }
1584 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1585 SSVAL(*rparam,2,0);
1586 SSVAL(*rparam,4,counted);
1587 SSVAL(*rparam,6,counted+missed);
1588
1589 SAFE_FREE(servers);
1590
1591 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1592 domain,uLevel,counted,counted+missed));
1593
1594 return True;
1595 }
1596
1597 static int srv_name_match(const char *n1, const char *n2)
1598 {
1599 /*
1600 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1601 *
1602 * In Windows, FirstNameToReturn need not be an exact match:
1603 * the server will return a list of servers that exist on
1604 * the network greater than or equal to the FirstNameToReturn.
1605 */
1606 int ret = strcasecmp_m(n1, n2);
1607
1608 if (ret <= 0) {
1609 return 0;
1610 }
1611
1612 return ret;
1613 }
1614
1615 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1616 connection_struct *conn, uint64_t vuid,
1617 char *param, int tpscnt,
1618 char *data, int tdscnt,
1619 int mdrcnt, int mprcnt, char **rdata,
1620 char **rparam, int *rdata_len, int *rparam_len)
1621 {
1622 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1623 char *str2 = skip_string(param,tpscnt,str1);
1624 char *p = skip_string(param,tpscnt,str2);
1625 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1626 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1627 uint32_t servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1628 char *p2;
1629 int data_len, fixed_len, string_len;
1630 int f_len = 0, s_len = 0;
1631 struct srv_info_struct *servers=NULL;
1632 int counted=0,first=0,total=0;
1633 int i,missed;
1634 fstring domain;
1635 fstring first_name;
1636 bool domain_request;
1637 bool local_request;
1638
1639 if (!str1 || !str2 || !p) {
1640 return False;
1641 }
1642
1643 /* If someone sets all the bits they don't really mean to set
1644 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1645 known servers. */
1646
1647 if (servertype == SV_TYPE_ALL) {
1648 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1649 }
1650
1651 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1652 any other bit (they may just set this bit on its own) they
1653 want all the locally seen servers. However this bit can be
1654 set on its own so set the requested servers to be
1655 ALL - DOMAIN_ENUM. */
1656
1657 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1658 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1659 }
1660
1661 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1662 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1663
1664 p += 8;
1665
1666 if (strcmp(str1, "WrLehDzz") != 0) {
1667 return false;
1668 }
1669 if (!check_session_info(uLevel,str2)) {
1670 return False;
1671 }
1672
1673 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1674 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1675 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1676
1677 if (skip_string(param,tpscnt,p) == NULL) {
1678 return False;
1679 }
1680 pull_ascii_fstring(domain, p);
1681 if (domain[0] == '\0') {
1682 fstrcpy(domain, lp_workgroup());
1683 }
1684 p = skip_string(param,tpscnt,p);
1685 if (skip_string(param,tpscnt,p) == NULL) {
1686 return False;
1687 }
1688 pull_ascii_fstring(first_name, p);
1689
1690 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1691 domain, first_name));
1692
1693 if (lp_browse_list()) {
1694 total = get_session_info(servertype,&servers,domain);
1695 }
1696
1697 data_len = fixed_len = string_len = 0;
1698 missed = 0;
1699
1700 TYPESAFE_QSORT(servers, total, srv_comp);
1701
1702 if (first_name[0] != '\0') {
1703 struct srv_info_struct *first_server = NULL;
1704
1705 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1706 srv_name_match, first_server);
1707 if (first_server) {
1708 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1709 /*
1710 * The binary search may not find the exact match
1711 * so we need to search backward to find the first match
1712 *
1713 * This implements the strange matching windows
1714 * implements. (see the comment in srv_name_match().
1715 */
1716 for (;first > 0;) {
1717 int ret;
1718 ret = strcasecmp_m(first_name,
1719 servers[first-1].name);
1720 if (ret > 0) {
1721 break;
1722 }
1723 first--;
1724 }
1725 } else {
1726 /* we should return no entries */
1727 first = total;
1728 }
1729 }
1730
1731 {
1732 char *lastname=NULL;
1733
1734 for (i=first;i<total;i++) {
1735 struct srv_info_struct *s = &servers[i];
1736
1737 if (lastname && strequal(lastname,s->name)) {
1738 continue;
1739 }
1740 lastname = s->name;
1741 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1742 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1743 i, s->name, s->type, s->comment, s->domain));
1744
1745 if (data_len < buf_len) {
1746 counted++;
1747 fixed_len += f_len;
1748 string_len += s_len;
1749 } else {
1750 missed++;
1751 }
1752 }
1753 }
1754
1755 *rdata_len = fixed_len + string_len;
1756 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1757 if (!*rdata) {
1758 return False;
1759 }
1760
1761 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1762 p = *rdata;
1763 f_len = fixed_len;
1764 s_len = string_len;
1765
1766 {
1767 char *lastname=NULL;
1768 int count2 = counted;
1769
1770 for (i = first; i < total && count2;i++) {
1771 struct srv_info_struct *s = &servers[i];
1772
1773 if (lastname && strequal(lastname,s->name)) {
1774 continue;
1775 }
1776 lastname = s->name;
1777 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1778 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1779 i, s->name, s->type, s->comment, s->domain));
1780 count2--;
1781 }
1782 }
1783
1784 *rparam_len = 8;
1785 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1786 if (!*rparam) {
1787 return False;
1788 }
1789 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1790 SSVAL(*rparam,2,0);
1791 SSVAL(*rparam,4,counted);
1792 SSVAL(*rparam,6,counted+missed);
1793
1794 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1795 domain,uLevel,first,first_name,
1796 first < total ? servers[first].name : "",
1797 counted,counted+missed));
1798
1799 SAFE_FREE(servers);
1800
1801 return True;
1802 }
1803
1804 /****************************************************************************
1805 command 0x34 - suspected of being a "Lookup Names" stub api
1806 ****************************************************************************/
1807
1808 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1809 connection_struct *conn, uint64_t vuid,
1810 char *param, int tpscnt,
1811 char *data, int tdscnt,
1812 int mdrcnt, int mprcnt, char **rdata,
1813 char **rparam, int *rdata_len, int *rparam_len)
1814 {
1815 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1816 char *str2 = skip_string(param,tpscnt,str1);
1817 char *p = skip_string(param,tpscnt,str2);
1818 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1819 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1820 int counted=0;
1821 int missed=0;
1822
1823 if (!str1 || !str2 || !p) {
1824 return False;
1825 }
1826
1827 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1828 str1, str2, p, uLevel, buf_len));
1829
1830 if (!prefix_ok(str1,"zWrLeh")) {
1831 return False;
1832 }
1833
1834 *rdata_len = 0;
1835
1836 *rparam_len = 8;
1837 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1838 if (!*rparam) {
1839 return False;
1840 }
1841
1842 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1843 SSVAL(*rparam,2,0);
1844 SSVAL(*rparam,4,counted);
1845 SSVAL(*rparam,6,counted+missed);
1846
1847 return True;
1848 }
1849
1850 /****************************************************************************
1851 get info about a share
1852 ****************************************************************************/
1853
1854 static bool check_share_info(int uLevel, char* id)
1855 {
1856 switch( uLevel ) {
1857 case 0:
1858 if (strcmp(id,"B13") != 0) {
1859 return False;
1860 }
1861 break;
1862 case 1:
1863 /* Level-2 descriptor is allowed (and ignored) */
1864 if (strcmp(id,"B13BWz") != 0 &&
1865 strcmp(id,"B13BWzWWWzB9B") != 0) {
1866 return False;
1867 }
1868 break;
1869 case 2:
1870 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1871 return False;
1872 }
1873 break;
1874 case 91:
1875 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1876 return False;
1877 }
1878 break;
1879 default:
1880 return False;
1881 }
1882 return True;
1883 }
1884
1885 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1886 char** buf, int* buflen,
1887 char** stringbuf, int* stringspace, char* baseaddr)
1888 {
1889 int struct_len;
1890 char* p;
1891 char* p2;
1892 int l2;
1893 int len;
1894
1895 switch( uLevel ) {
1896 case 0:
1897 struct_len = 13;
1898 break;
1899 case 1:
1900 struct_len = 20;
1901 break;
1902 case 2:
1903 struct_len = 40;
1904 break;
1905 case 91:
1906 struct_len = 68;
1907 break;
1908 default:
1909 return -1;
1910 }
1911
1912 if (!buf) {
1913 len = 0;
1914
1915 if (uLevel > 0) {
1916 len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), snum));
1917 }
1918 if (uLevel > 1) {
1919 len += strlen(lp_path(talloc_tos(), snum)) + 1;
1920 }
1921 if (buflen) {
1922 *buflen = struct_len;
1923 }
1924 if (stringspace) {
1925 *stringspace = len;
1926 }
1927 return struct_len + len;
1928 }
1929
1930 len = struct_len;
1931 p = *buf;
1932 if ((*buflen) < struct_len) {
1933 return -1;
1934 }
1935
1936 if (stringbuf) {
1937 p2 = *stringbuf;
1938 l2 = *stringspace;
1939 } else {
1940 p2 = p + struct_len;
1941 l2 = (*buflen) - struct_len;
1942 }
1943
1944 if (!baseaddr) {
1945 baseaddr = p;
1946 }
1947
1948 push_ascii(p,lp_servicename(talloc_tos(), snum),13, STR_TERMINATE);
1949
1950 if (uLevel > 0) {
1951 int type;
1952
1953 SCVAL(p,13,0);
1954 type = STYPE_DISKTREE;
1955 if (lp_printable(snum)) {
1956 type = STYPE_PRINTQ;
1957 }
1958 if (strequal("IPC",lp_fstype(snum))) {
1959 type = STYPE_IPC;
1960 }
1961 SSVAL(p,14,type); /* device type */
1962 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1963 len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(),snum),&l2);
1964 }
1965
1966 if (uLevel > 1) {
1967 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1968 SSVALS(p,22,-1); /* max uses */
1969 SSVAL(p,24,1); /* current uses */
1970 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1971 len += CopyAndAdvance(&p2,lp_path(talloc_tos(),snum),&l2);
1972 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1973 }
1974
1975 if (uLevel > 2) {
1976 memset(p+40,0,SHPWLEN+2);
1977 SSVAL(p,50,0);
1978 SIVAL(p,52,0);
1979 SSVAL(p,56,0);
1980 SSVAL(p,58,0);
1981 SIVAL(p,60,0);
1982 SSVAL(p,64,0);
1983 SSVAL(p,66,0);
1984 }
1985
1986 if (stringbuf) {
1987 (*buf) = p + struct_len;
1988 (*buflen) -= struct_len;
1989 (*stringbuf) = p2;
1990 (*stringspace) = l2;
1991 } else {
1992 (*buf) = p2;
1993 (*buflen) -= len;
1994 }
1995
1996 return len;
1997 }
1998
1999 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
2000 connection_struct *conn,uint64_t vuid,
2001 char *param, int tpscnt,
2002 char *data, int tdscnt,
2003 int mdrcnt,int mprcnt,
2004 char **rdata,char **rparam,
2005 int *rdata_len,int *rparam_len)
2006 {
2007 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2008 char *str2 = skip_string(param,tpscnt,str1);
2009 char *netname_in = skip_string(param,tpscnt,str2);
2010 char *netname = NULL;
2011 char *p = skip_string(param,tpscnt,netname);
2012 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2013 int snum;
2014
2015 if (!str1 || !str2 || !netname_in || !p) {
2016 return False;
2017 }
2018
2019 snum = find_service(talloc_tos(), netname_in, &netname);
2020 if (snum < 0 || !netname) {
2021 return False;
2022 }
2023
2024 /* check it's a supported varient */
2025 if (!prefix_ok(str1,"zWrLh")) {
2026 return False;
2027 }
2028 if (!check_share_info(uLevel,str2)) {
2029 return False;
2030 }
2031
2032 *rdata = smb_realloc_limit(*rdata,mdrcnt);
2033 if (!*rdata) {
2034 return False;
2035 }
2036 p = *rdata;
2037 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2038 if (*rdata_len < 0) {
2039 return False;
2040 }
2041
2042 *rparam_len = 6;
2043 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2044 if (!*rparam) {
2045 return False;
2046 }
2047 SSVAL(*rparam,0,NERR_Success);
2048 SSVAL(*rparam,2,0); /* converter word */
2049 SSVAL(*rparam,4,*rdata_len);
2050
2051 return True;
2052 }
2053
2054 /****************************************************************************
2055 View the list of available shares.
2056
2057 This function is the server side of the NetShareEnum() RAP call.
2058 It fills the return buffer with share names and share comments.
2059 Note that the return buffer normally (in all known cases) allows only
2060 twelve byte strings for share names (plus one for a nul terminator).
2061 Share names longer than 12 bytes must be skipped.
2062 ****************************************************************************/
2063
2064 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2065 connection_struct *conn, uint64_t vuid,
2066 char *param, int tpscnt,
2067 char *data, int tdscnt,
2068 int mdrcnt,
2069 int mprcnt,
2070 char **rdata,
2071 char **rparam,
2072 int *rdata_len,
2073 int *rparam_len )
2074 {
2075 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2076 char *str2 = skip_string(param,tpscnt,str1);
2077 char *p = skip_string(param,tpscnt,str2);
2078 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2079 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2080 char *p2;
2081 int count = 0;
2082 int total=0,counted=0;
2083 bool missed = False;
2084 int i;
2085 int data_len, fixed_len, string_len;
2086 int f_len = 0, s_len = 0;
2087
2088 if (!str1 || !str2 || !p) {
2089 return False;
2090 }
2091
2092 if (!prefix_ok(str1,"WrLeh")) {
2093 return False;
2094 }
2095 if (!check_share_info(uLevel,str2)) {
2096 return False;
2097 }
2098
2099 /* Ensure all the usershares are loaded. */
2100 become_root();
2101 delete_and_reload_printers(sconn->ev_ctx, sconn->msg_ctx);
2102 load_registry_shares();
2103 count = load_usershare_shares(NULL, connections_snum_used);
2104 unbecome_root();
2105
2106 data_len = fixed_len = string_len = 0;
2107 for (i=0;i<count;i++) {
2108 fstring servicename_dos;
2109 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2110 continue;
2111 }
2112 push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), i));
2113 /* Maximum name length = 13. */
2114 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2115 total++;
2116 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2117 if (data_len < buf_len) {
2118 counted++;
2119 fixed_len += f_len;
2120 string_len += s_len;
2121 } else {
2122 missed = True;
2123 }
2124 }
2125 }
2126
2127 *rdata_len = fixed_len + string_len;
2128 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2129 if (!*rdata) {
2130 return False;
2131 }
2132
2133 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2134 p = *rdata;
2135 f_len = fixed_len;
2136 s_len = string_len;
2137
2138 for( i = 0; i < count; i++ ) {
2139 fstring servicename_dos;
2140 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2141 continue;
2142 }
2143
2144 push_ascii_fstring(servicename_dos,
2145 lp_servicename(talloc_tos(), i));
2146 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2147 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2148 break;
2149 }
2150 }
2151 }
2152
2153 *rparam_len = 8;
2154 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2155 if (!*rparam) {
2156 return False;
2157 }
2158 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2159 SSVAL(*rparam,2,0);
2160 SSVAL(*rparam,4,counted);
2161 SSVAL(*rparam,6,total);
2162
2163 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2164 counted,total,uLevel,
2165 buf_len,*rdata_len,mdrcnt));
2166
2167 return True;
2168 }
2169
2170 /****************************************************************************
2171 Add a share
2172 ****************************************************************************/
2173
2174 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2175 connection_struct *conn,uint64_t vuid,
2176 char *param, int tpscnt,
2177 char *data, int tdscnt,
2178 int mdrcnt,int mprcnt,
2179 char **rdata,char **rparam,
2180 int *rdata_len,int *rparam_len)
2181 {
2182 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2183 char *str2 = skip_string(param,tpscnt,str1);
2184 char *p = skip_string(param,tpscnt,str2);
2185 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2186 fstring sharename;
2187 fstring comment;
2188 char *pathname = NULL;
2189 unsigned int offset;
2190 int res = ERRunsup;
2191 size_t converted_size;
2192
2193 WERROR werr = WERR_OK;
2194 TALLOC_CTX *mem_ctx = talloc_tos();
2195 NTSTATUS status;
2196 struct rpc_pipe_client *cli = NULL;
2197 union srvsvc_NetShareInfo info;
2198 struct srvsvc_NetShareInfo2 info2;
2199 struct dcerpc_binding_handle *b;
2200
2201 if (!str1 || !str2 || !p) {
2202 return False;
2203 }
2204
2205 /* check it's a supported varient */
2206 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2207 return False;
2208 }
2209 if (!check_share_info(uLevel,str2)) {
2210 return False;
2211 }
2212 if (uLevel != 2) {
2213 return False;
2214 }
2215
2216 /* Do we have a string ? */
2217 if (skip_string(data,mdrcnt,data) == NULL) {
2218 return False;
2219 }
2220 pull_ascii_fstring(sharename,data);
2221
2222 if (mdrcnt < 28) {
2223 return False;
2224 }
2225
2226 /* only support disk share adds */
2227 if (SVAL(data,14)!=STYPE_DISKTREE) {
2228 return False;
2229 }
2230
2231 offset = IVAL(data, 16);
2232 if (offset >= mdrcnt) {
2233 res = ERRinvalidparam;
2234 goto out;
2235 }
2236
2237 /* Do we have a string ? */
2238 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2239 return False;
2240 }
2241 pull_ascii_fstring(comment, offset? (data+offset) : "");
2242
2243 offset = IVAL(data, 26);
2244
2245 if (offset >= mdrcnt) {
2246 res = ERRinvalidparam;
2247 goto out;
2248 }
2249
2250 /* Do we have a string ? */
2251 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2252 return False;
2253 }
2254
2255 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2256 offset ? (data+offset) : "", &converted_size))
2257 {
2258 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2259 strerror(errno)));
2260 }
2261
2262 if (!pathname) {
2263 return false;
2264 }
2265
2266 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
2267 conn->session_info,
2268 conn->sconn->remote_address,
2269 conn->sconn->msg_ctx,
2270 &cli);
2271 if (!NT_STATUS_IS_OK(status)) {
2272 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2273 nt_errstr(status)));
2274 res = W_ERROR_V(ntstatus_to_werror(status));
2275 goto out;
2276 }
2277
2278 b = cli->binding_handle;
2279
2280 info2.name = sharename;
2281 info2.type = STYPE_DISKTREE;
2282 info2.comment = comment;
2283 info2.permissions = 0;
2284 info2.max_users = 0;
2285 info2.current_users = 0;
2286 info2.path = pathname;
2287 info2.password = NULL;
2288
2289 info.info2 = &info2;
2290
2291 status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2292 cli->srv_name_slash,
2293 2,
2294 &info,
2295 NULL,
2296 &werr);
2297 if (!NT_STATUS_IS_OK(status)) {
2298 res = W_ERROR_V(ntstatus_to_werror(status));
2299 goto out;
2300 }
2301 if (!W_ERROR_IS_OK(werr)) {
2302 res = W_ERROR_V(werr);
2303 goto out;
2304 }
2305
2306 *rparam_len = 6;
2307 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2308 if (!*rparam) {
2309 return False;
2310 }
2311 SSVAL(*rparam,0,NERR_Success);
2312 SSVAL(*rparam,2,0); /* converter word */
2313 SSVAL(*rparam,4,*rdata_len);
2314 *rdata_len = 0;
2315
2316 return True;
2317
2318 out:
2319
2320 *rparam_len = 4;
2321 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2322 if (!*rparam) {
2323 return False;
2324 }
2325 *rdata_len = 0;
2326 SSVAL(*rparam,0,res);
2327 SSVAL(*rparam,2,0);
2328 return True;
2329 }
2330
2331 /****************************************************************************
2332 view list of groups available
2333 ****************************************************************************/
2334
2335 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2336 connection_struct *conn,uint64_t vuid,
2337 char *param, int tpscnt,
2338 char *data, int tdscnt,
2339 int mdrcnt,int mprcnt,
2340 char **rdata,char **rparam,
2341 int *rdata_len,int *rparam_len)
2342 {
2343 int i;
2344 int errflags=0;
2345 int resume_context, cli_buf_size;
2346 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2347 char *str2 = skip_string(param,tpscnt,str1);
2348 char *p = skip_string(param,tpscnt,str2);
2349
2350 uint32_t num_groups;
2351 uint32_t resume_handle;
2352 struct rpc_pipe_client *samr_pipe = NULL;
2353 struct policy_handle samr_handle, domain_handle;
2354 NTSTATUS status, result;
2355 struct dcerpc_binding_handle *b;
2356
2357 if (!str1 || !str2 || !p) {
2358 return False;
2359 }
2360
2361 if (strcmp(str1,"WrLeh") != 0) {
2362 return False;
2363 }
2364
2365 /* parameters
2366 * W-> resume context (number of users to skip)
2367 * r -> return parameter pointer to receive buffer
2368 * L -> length of receive buffer
2369 * e -> return parameter number of entries
2370 * h -> return parameter total number of users
2371 */
2372
2373 if (strcmp("B21",str2) != 0) {
2374 return False;
2375 }
2376
2377 status = rpc_pipe_open_interface(
2378 talloc_tos(), &ndr_table_samr,
2379 conn->session_info, conn->sconn->remote_address,
2380 conn->sconn->msg_ctx, &samr_pipe);
2381 if (!NT_STATUS_IS_OK(status)) {
2382 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2383 nt_errstr(status)));
2384 return false;
2385 }
2386
2387 b = samr_pipe->binding_handle;
2388
2389 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2390 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2391 &result);
2392 if (!NT_STATUS_IS_OK(status)) {
2393 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2394 nt_errstr(status)));
2395 return false;
2396 }
2397 if (!NT_STATUS_IS_OK(result)) {
2398 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2399 nt_errstr(result)));
2400 return false;
2401 }
2402
2403 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2404 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2405 get_global_sam_sid(), &domain_handle,
2406 &result);
2407 if (!NT_STATUS_IS_OK(status)) {
2408 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2409 nt_errstr(status)));
2410 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2411 return false;
2412 }
2413 if (!NT_STATUS_IS_OK(result)) {
2414 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2415 nt_errstr(result)));
2416 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2417 return false;
2418 }
2419
2420 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2421 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2422 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2423 "%d\n", resume_context, cli_buf_size));
2424
2425 *rdata_len = cli_buf_size;
2426 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2427 if (!*rdata) {
2428 return False;
2429 }
2430
2431 p = *rdata;
2432
2433 errflags = NERR_Success;
2434 num_groups = 0;
2435 resume_handle = 0;
2436
2437 while (true) {
2438 struct samr_SamArray *sam_entries;
2439 uint32_t num_entries;
2440
2441 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2442 &domain_handle,
2443 &resume_handle,
2444 &sam_entries, 1,
2445 &num_entries,
2446 &result);
2447 if (!NT_STATUS_IS_OK(status)) {
2448 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2449 "%s\n", nt_errstr(status)));
2450 break;
2451 }
2452 if (!NT_STATUS_IS_OK(result)) {
2453 status = result;
2454 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2455 "%s\n", nt_errstr(result)));
2456 break;
2457 }
2458
2459 if (num_entries == 0) {
2460 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2461 "no entries -- done\n"));
2462 break;
2463 }
2464
2465 for(i=0; i<num_entries; i++) {
2466 const char *name;
2467
2468 name = sam_entries->entries[i].name.string;
2469
2470 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2471 /* set overflow error */
2472 DEBUG(3,("overflow on entry %d group %s\n", i,
2473 name));
2474 errflags=234;
2475 break;
2476 }
2477
2478 /* truncate the name at 21 chars. */
2479 memset(p, 0, 21);
2480 strlcpy(p, name, 21);
2481 DEBUG(10,("adding entry %d group %s\n", i, p));
2482 p += 21;
2483 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2484 * idea why... */
2485 num_groups += 1;
2486 }
2487
2488 if (errflags != NERR_Success) {
2489 break;
2490 }
2491
2492 TALLOC_FREE(sam_entries);
2493 }
2494
2495 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2496 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2497
2498 *rdata_len = PTR_DIFF(p,*rdata);
2499
2500 *rparam_len = 8;
2501 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2502 if (!*rparam) {
2503 return False;
2504 }
2505 SSVAL(*rparam, 0, errflags);
2506 SSVAL(*rparam, 2, 0); /* converter word */
2507 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2508 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2509
2510 return(True);
2511 }
2512
2513 /*******************************************************************
2514 Get groups that a user is a member of.
2515 ******************************************************************/
2516
2517 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2518 connection_struct *conn,uint64_t vuid,
2519 char *param, int tpscnt,
2520 char *data, int tdscnt,
2521 int mdrcnt,int mprcnt,
2522 char **rdata,char **rparam,
2523 int *rdata_len,int *rparam_len)
2524 {
2525 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2526 char *str2 = skip_string(param,tpscnt,str1);
2527 char *UserName = skip_string(param,tpscnt,str2);
2528 char *p = skip_string(param,tpscnt,UserName);
2529 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2530 const char *level_string;
2531 int count=0;
2532 bool ret = False;
2533 uint32_t i;
2534 char *endp = NULL;
2535
2536 struct rpc_pipe_client *samr_pipe = NULL;
2537 struct policy_handle samr_handle, domain_handle, user_handle;
2538 struct lsa_String name;
2539 struct lsa_Strings names;
2540 struct samr_Ids type, rid;
2541 struct samr_RidWithAttributeArray *rids;
2542 NTSTATUS status, result;
2543 struct dcerpc_binding_handle *b;
2544
2545 if (!str1 || !str2 || !UserName || !p) {
2546 return False;
2547 }
2548
2549 *rparam_len = 8;
2550 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2551 if (!*rparam) {
2552 return False;
2553 }
2554
2555 /* check it's a supported varient */
2556
2557 if ( strcmp(str1,"zWrLeh") != 0 )
2558 return False;
2559
2560 switch( uLevel ) {
2561 case 0:
2562 level_string = "B21";
2563 break;
2564 default:
2565 return False;
2566 }
2567
2568 if (strcmp(level_string,str2) != 0)
2569 return False;
2570
2571 *rdata_len = mdrcnt + 1024;
2572 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2573 if (!*rdata) {
2574 return False;
2575 }
2576
2577 SSVAL(*rparam,0,NERR_Success);
2578 SSVAL(*rparam,2,0); /* converter word */
2579
2580 p = *rdata;
2581 endp = *rdata + *rdata_len;
2582
2583 status = rpc_pipe_open_interface(
2584 talloc_tos(), &ndr_table_samr,
2585 conn->session_info, conn->sconn->remote_address,
2586 conn->sconn->msg_ctx, &samr_pipe);
2587 if (!NT_STATUS_IS_OK(status)) {
2588 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2589 nt_errstr(status)));
2590 return false;
2591 }
2592
2593 b = samr_pipe->binding_handle;
2594
2595 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2596 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2597 &result);
2598 if (!NT_STATUS_IS_OK(status)) {
2599 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2600 nt_errstr(status)));
2601 return false;
2602 }
2603 if (!NT_STATUS_IS_OK(result)) {
2604 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2605 nt_errstr(result)));
2606 return false;
2607 }
2608
2609 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2610 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2611 get_global_sam_sid(), &domain_handle,
2612 &result);
2613 if (!NT_STATUS_IS_OK(status)) {
2614 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2615 nt_errstr(status)));
2616 goto close_sam;
2617 }
2618 if (!NT_STATUS_IS_OK(result)) {
2619 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2620 nt_errstr(result)));
2621 goto close_sam;
2622 }
2623
2624 name.string = UserName;
2625
2626 status = dcerpc_samr_LookupNames(b, talloc_tos(),
2627 &domain_handle, 1, &name,
2628 &rid, &type,
2629 &result);
2630 if (!NT_STATUS_IS_OK(status)) {
2631 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2632 nt_errstr(status)));
2633 goto close_domain;
2634 }
2635 if (!NT_STATUS_IS_OK(result)) {
2636 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2637 nt_errstr(result)));
2638 goto close_domain;
2639 }
2640 if (rid.count != 1) {
2641 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2642 goto close_domain;
2643 }
2644 if (type.count != 1) {
2645 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2646 goto close_domain;
2647 }
2648
2649 if (type.ids[0] != SID_NAME_USER) {
2650 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2651 sid_type_lookup(type.ids[0])));
2652 goto close_domain;
2653 }
2654
2655 status = dcerpc_samr_OpenUser(b, talloc_tos(),
2656 &domain_handle,
2657 SAMR_USER_ACCESS_GET_GROUPS,
2658 rid.ids[0], &user_handle,
2659 &result);
2660 if (!NT_STATUS_IS_OK(status)) {
2661 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2662 nt_errstr(status)));
2663 goto close_domain;
2664 }
2665 if (!NT_STATUS_IS_OK(result)) {
2666 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2667 nt_errstr(result)));
2668 goto close_domain;
2669 }
2670
2671 status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2672 &user_handle, &rids,
2673 &result);
2674 if (!NT_STATUS_IS_OK(status)) {
2675 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2676 nt_errstr(status)));
2677 goto close_user;
2678 }
2679 if (!NT_STATUS_IS_OK(result)) {
2680 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2681 nt_errstr(result)));
2682 goto close_user;
2683 }
2684
2685 for (i=0; i<rids->count; i++) {
2686
2687 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2688 &domain_handle,
2689 1, &rids->rids[i].rid,
2690 &names, &type,
2691 &result);
2692 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2693 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2694 p += 21;
2695 count++;
2696 }
2697 }
2698
2699 *rdata_len = PTR_DIFF(p,*rdata);
2700
2701 SSVAL(*rparam,4,count); /* is this right?? */
2702 SSVAL(*rparam,6,count); /* is this right?? */
2703
2704 ret = True;
2705
2706 close_user:
2707 dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2708 close_domain:
2709 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2710 close_sam:
2711 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2712
2713 return ret;
2714 }
2715
2716 /*******************************************************************
2717 Get all users.
2718 ******************************************************************/
2719
2720 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2721 connection_struct *conn, uint64_t vuid,
2722 char *param, int tpscnt,
2723 char *data, int tdscnt,
2724 int mdrcnt,int mprcnt,
2725 char **rdata,char **rparam,
2726 int *rdata_len,int *rparam_len)
2727 {
2728 int count_sent=0;
2729 int num_users=0;
2730 int errflags=0;
2731 int i, resume_context, cli_buf_size;
2732 uint32_t resume_handle;
2733
2734 struct rpc_pipe_client *samr_pipe = NULL;
2735 struct policy_handle samr_handle, domain_handle;
2736 NTSTATUS status, result;
2737
2738 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2739 char *str2 = skip_string(param,tpscnt,str1);
2740 char *p = skip_string(param,tpscnt,str2);
2741 char *endp = NULL;
2742
2743 struct dcerpc_binding_handle *b;
2744
2745 if (!str1 || !str2 || !p) {
2746 return False;
2747 }
2748
2749 if (strcmp(str1,"WrLeh") != 0)
2750 return False;
2751 /* parameters
2752 * W-> resume context (number of users to skip)
2753 * r -> return parameter pointer to receive buffer
2754 * L -> length of receive buffer
2755 * e -> return parameter number of entries
2756 * h -> return parameter total number of users
2757 */
2758
2759 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2760 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2761 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2762 resume_context, cli_buf_size));
2763
2764 *rparam_len = 8;
2765 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2766 if (!*rparam) {
2767 return False;
2768 }
2769
2770 /* check it's a supported varient */
2771 if (strcmp("B21",str2) != 0)
2772 return False;
2773
2774 *rdata_len = cli_buf_size;
2775 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2776 if (!*rdata) {
2777 return False;
2778 }
2779
2780 p = *rdata;
2781 endp = *rdata + *rdata_len;
2782
2783 status = rpc_pipe_open_interface(
2784 talloc_tos(), &ndr_table_samr,
2785 conn->session_info, conn->sconn->remote_address,
2786 conn->sconn->msg_ctx, &samr_pipe);
2787 if (!NT_STATUS_IS_OK(status)) {
2788 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2789 nt_errstr(status)));
2790 return false;
2791 }
2792
2793 b = samr_pipe->binding_handle;
2794
2795 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2796 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2797 &result);
2798 if (!NT_STATUS_IS_OK(status)) {
2799 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2800 nt_errstr(status)));
2801 return false;
2802 }
2803 if (!NT_STATUS_IS_OK(result)) {
2804 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2805 nt_errstr(result)));
2806 return false;
2807 }
2808
2809 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2810 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2811 get_global_sam_sid(), &domain_handle,
2812 &result);
2813 if (!NT_STATUS_IS_OK(status)) {
2814 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2815 nt_errstr(status)));
2816 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2817 return false;
2818 }
2819 if (!NT_STATUS_IS_OK(result)) {
2820 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2821 nt_errstr(result)));
2822 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2823 return false;
2824 }
2825
2826 errflags=NERR_Success;
2827
2828 resume_handle = 0;
2829
2830 while (true) {
2831 struct samr_SamArray *sam_entries;
2832 uint32_t num_entries;
2833
2834 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2835 &domain_handle,
2836 &resume_handle,
2837 0, &sam_entries, 1,
2838 &num_entries,
2839 &result);
2840
2841 if (!NT_STATUS_IS_OK(status)) {
2842 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2843 "%s\n", nt_errstr(status)));
2844 break;
2845 }
2846 if (!NT_STATUS_IS_OK(result)) {
2847 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2848 "%s\n", nt_errstr(result)));
2849 break;
2850 }
2851
2852 if (num_entries == 0) {
2853 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2854 "no entries -- done\n"));
2855 break;
2856 }
2857
2858 for (i=0; i<num_entries; i++) {
2859 const char *name;
2860
2861 name = sam_entries->entries[i].name.string;
2862
2863 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2864 &&(strlen(name)<=21)) {
2865 strlcpy(p,name,PTR_DIFF(endp,p));
2866 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2867 "username %s\n",count_sent,p));
2868 p += 21;
2869 count_sent++;
2870 } else {
2871 /* set overflow error */
2872 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2873 "username %s\n",count_sent,name));
2874 errflags=234;
2875 break;
2876 }
2877 }
2878
2879 if (errflags != NERR_Success) {
2880 break;
2881 }
2882
2883 TALLOC_FREE(sam_entries);
2884 }
2885
2886 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2887 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2888
2889 *rdata_len = PTR_DIFF(p,*rdata);
2890
2891 SSVAL(*rparam,0,errflags);
2892 SSVAL(*rparam,2,0); /* converter word */
2893 SSVAL(*rparam,4,count_sent); /* is this right?? */
2894 SSVAL(*rparam,6,num_users); /* is this right?? */
2895
2896 return True;
2897 }
2898
2899 /****************************************************************************
2900 Get the time of day info.
2901 ****************************************************************************/
2902
2903 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2904 connection_struct *conn,uint64_t vuid,
2905 char *param, int tpscnt,
2906 char *data, int tdscnt,
2907 int mdrcnt,int mprcnt,
2908 char **rdata,char **rparam,
2909 int *rdata_len,int *rparam_len)
2910 {
2911 struct tm *t;
2912 time_t unixdate = time(NULL);
2913 char *p;
2914
2915 *rparam_len = 4;
2916 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2917 if (!*rparam) {
2918 return False;
2919 }
2920
2921 *rdata_len = 21;
2922 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2923 if (!*rdata) {
2924 return False;
2925 }
2926
2927 SSVAL(*rparam,0,NERR_Success);
2928 SSVAL(*rparam,2,0); /* converter word */
2929
2930 p = *rdata;
2931
2932 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2933 by NT in a "net time" operation,
2934 it seems to ignore the one below */
2935
2936 /* the client expects to get localtime, not GMT, in this bit
2937 (I think, this needs testing) */
2938 t = localtime(&unixdate);
2939 if (!t) {
2940 return False;
2941 }
2942
2943 SIVAL(p,4,0); /* msecs ? */
2944 SCVAL(p,8,t->tm_hour);
2945 SCVAL(p,9,t->tm_min);
2946 SCVAL(p,10,t->tm_sec);
2947 SCVAL(p,11,0); /* hundredths of seconds */
2948 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2949 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2950 SCVAL(p,16,t->tm_mday);
2951 SCVAL(p,17,t->tm_mon + 1);
2952 SSVAL(p,18,1900+t->tm_year);
2953 SCVAL(p,20,t->tm_wday);
2954
2955 return True;
2956 }
2957
2958 /****************************************************************************
2959 Set the user password (SamOEM version - gets plaintext).
2960 ****************************************************************************/
2961
2962 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
2963 connection_struct *conn,uint64_t vuid,
2964 char *param, int tpscnt,
2965 char *data, int tdscnt,
2966 int mdrcnt,int mprcnt,
2967 char **rdata,char **rparam,
2968 int *rdata_len,int *rparam_len)
2969 {
2970 fstring user;
2971 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2972
2973 TALLOC_CTX *mem_ctx = talloc_tos();
2974 NTSTATUS status, result;
2975 struct rpc_pipe_client *cli = NULL;
2976 struct lsa_AsciiString server, account;
2977 struct samr_CryptPassword password;
2978 struct samr_Password hash;
2979 int errcode = NERR_badpass;
2980 int bufsize;
2981 struct dcerpc_binding_handle *b;
2982
2983 *rparam_len = 4;
2984 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2985 if (!*rparam) {
2986 return False;
2987 }
2988
2989 if (!p) {
2990 return False;
2991 }
2992 *rdata_len = 0;
2993
2994 SSVAL(*rparam,0,NERR_badpass);
2995
2996 /*
2997 * Check the parameter definition is correct.
2998 */
2999
3000 /* Do we have a string ? */
3001 if (skip_string(param,tpscnt,p) == 0) {
3002 return False;
3003 }
3004 if(!strequal(p, "zsT")) {
3005 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
3006 return False;
3007 }
3008 p = skip_string(param, tpscnt, p);
3009 if (!p) {
3010 return False;
3011 }
3012
3013 /* Do we have a string ? */
3014 if (skip_string(param,tpscnt,p) == 0) {
3015 return False;
3016 }
3017 if(!strequal(p, "B516B16")) {
3018 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3019 return False;
3020 }
3021 p = skip_string(param,tpscnt,p);
3022 if (!p) {
3023 return False;
3024 }
3025 /* Do we have a string ? */
3026 if (skip_string(param,tpscnt,p) == 0) {
3027 return False;
3028 }
3029 p += pull_ascii_fstring(user,p);
3030
3031 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3032
3033 if (tdscnt != 532) {
3034 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3035 goto out;
3036 }
3037
3038 bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3039 if (bufsize != 532) {
3040 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3041 goto out;
3042 }
3043
3044 memcpy(password.data, data, 516);
3045 memcpy(hash.hash, data+516, 16);
3046
3047 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
3048 conn->session_info,
3049 conn->sconn->remote_address,
3050 conn->sconn->msg_ctx,
3051 &cli);
3052 if (!NT_STATUS_IS_OK(status)) {
3053 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3054 nt_errstr(status)));
3055 errcode = W_ERROR_V(ntstatus_to_werror(status));
3056 goto out;
3057 }
3058
3059 b = cli->binding_handle;
3060
3061 init_lsa_AsciiString(&server, lp_netbios_name());
3062 init_lsa_AsciiString(&account, user);
3063
3064 status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3065 &server,
3066 &account,
3067 &password,
3068 &hash,
3069 &result);
3070 if (!NT_STATUS_IS_OK(status)) {
3071 errcode = W_ERROR_V(ntstatus_to_werror(status));
3072 goto out;
3073 }
3074 if (!NT_STATUS_IS_OK(result)) {
3075 errcode = W_ERROR_V(ntstatus_to_werror(result));
3076 goto out;
3077 }
3078
3079 errcode = NERR_Success;
3080 out:
3081 SSVAL(*rparam,0,errcode);
3082 SSVAL(*rparam,2,0); /* converter word */
3083
3084 return(True);
3085 }
3086
3087 /****************************************************************************
3088 delete a print job
3089 Form: <W> <>
3090 ****************************************************************************/
3091
3092 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3093 connection_struct *conn,uint64_t vuid,
3094 char *param, int tpscnt,
3095 char *data, int tdscnt,
3096 int mdrcnt,int mprcnt,
3097 char **rdata,char **rparam,
3098 int *rdata_len,int *rparam_len)
3099 {
3100 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3101 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3102 char *str2 = skip_string(param,tpscnt,str1);
3103 char *p = skip_string(param,tpscnt,str2);
3104 uint32_t jobid;
3105 fstring sharename;
3106 int errcode;
3107 WERROR werr = WERR_OK;
3108
3109 TALLOC_CTX *mem_ctx = talloc_tos();
3110 NTSTATUS status;
3111 struct rpc_pipe_client *cli = NULL;
3112 struct dcerpc_binding_handle *b = NULL;
3113 struct policy_handle handle;
3114 struct spoolss_DevmodeContainer devmode_ctr;
3115 enum spoolss_JobControl command;
3116
3117 if (!str1 || !str2 || !p) {
3118 return False;
3119 }
3120 /*
3121 * We use 1 here not 2 as we're checking
3122 * the last byte we want to access is safe.
3123 */
3124 if (!is_offset_safe(param,tpscnt,p,1)) {
3125 return False;
3126 }
3127 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3128 return False;
3129
3130 /* check it's a supported varient */
3131 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3132 return(False);
3133
3134 *rparam_len = 4;
3135 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3136 if (!*rparam) {
3137 return False;
3138 }
3139 *rdata_len = 0;
3140
3141 ZERO_STRUCT(handle);
3142
3143 status = rpc_pipe_open_interface(conn,
3144 &ndr_table_spoolss,
3145 conn->session_info,
3146 conn->sconn->remote_address,
3147 conn->sconn->msg_ctx,
3148 &cli);
3149 if (!NT_STATUS_IS_OK(status)) {
3150 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3151 nt_errstr(status)));
3152 errcode = W_ERROR_V(ntstatus_to_werror(status));
3153 goto out;
3154 }
3155 b = cli->binding_handle;
3156
3157 ZERO_STRUCT(devmode_ctr);
3158
3159 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3160 sharename,
3161 "RAW",
3162 devmode_ctr,
3163 JOB_ACCESS_ADMINISTER,
3164 &handle,
3165 &werr);
3166 if (!NT_STATUS_IS_OK(status)) {
3167 errcode = W_ERROR_V(ntstatus_to_werror(status));
3168 goto out;
3169 }
3170 if (!W_ERROR_IS_OK(werr)) {
3171 errcode = W_ERROR_V(werr);
3172 goto out;
3173 }
3174
3175 /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3176 * and NERR_DestNotFound if share did not exist */
3177
3178 errcode = NERR_Success;
3179
3180 switch (function) {
3181 case 81: /* delete */
3182 command = SPOOLSS_JOB_CONTROL_DELETE;
3183 break;
3184 case 82: /* pause */
3185 command = SPOOLSS_JOB_CONTROL_PAUSE;
3186 break;
3187 case 83: /* resume */
3188 command = SPOOLSS_JOB_CONTROL_RESUME;
3189 break;
3190 default:
3191 errcode = NERR_notsupported;
3192 goto out;
3193 }
3194
3195 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3196 &handle,
3197 jobid,
3198 NULL, /* unique ptr ctr */
3199 command,
3200 &werr);
3201 if (!NT_STATUS_IS_OK(status)) {
3202 errcode = W_ERROR_V(ntstatus_to_werror(status));
3203 goto out;
3204 }
3205 if (!W_ERROR_IS_OK(werr)) {
3206 errcode = W_ERROR_V(werr);
3207 goto out;
3208 }
3209
3210 out:
3211 if (b && is_valid_policy_hnd(&handle)) {
3212 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3213 }
3214
3215 SSVAL(*rparam,0,errcode);
3216 SSVAL(*rparam,2,0); /* converter word */
3217
3218 return(True);
3219 }
3220
3221 /****************************************************************************
3222 Purge a print queue - or pause or resume it.
3223 ****************************************************************************/
3224
3225 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3226 connection_struct *conn,uint64_t vuid,
3227 char *param, int tpscnt,
3228 char *data, int tdscnt,
3229 int mdrcnt,int mprcnt,
3230 char **rdata,char **rparam,
3231 int *rdata_len,int *rparam_len)
3232 {
3233 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3234 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3235 char *str2 = skip_string(param,tpscnt,str1);
3236 char *QueueName = skip_string(param,tpscnt,str2);
3237 int errcode = NERR_notsupported;
3238 WERROR werr = WERR_OK;
3239 NTSTATUS status;
3240
3241 TALLOC_CTX *mem_ctx = talloc_tos();
3242 struct rpc_pipe_client *cli = NULL;
3243 struct dcerpc_binding_handle *b = NULL;
3244 struct policy_handle handle;
3245 struct spoolss_SetPrinterInfoCtr info_ctr;
3246 struct spoolss_DevmodeContainer devmode_ctr;
3247 struct sec_desc_buf secdesc_ctr;
3248 enum spoolss_PrinterControl command;
3249
3250 if (!str1 || !str2 || !QueueName) {
3251 return False;
3252 }
3253
3254 /* check it's a supported varient */
3255 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3256 return(False);
3257
3258 *rparam_len = 4;
3259 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3260 if (!*rparam) {
3261 return False;
3262 }
3263 *rdata_len = 0;
3264
3265 if (skip_string(param,tpscnt,QueueName) == NULL) {
3266 return False;
3267 }
3268
3269 ZERO_STRUCT(handle);
3270
3271 status = rpc_pipe_open_interface(conn,
3272 &ndr_table_spoolss,
3273 conn->session_info,
3274 conn->sconn->remote_address,
3275 conn->sconn->msg_ctx,
3276 &cli);
3277 if (!NT_STATUS_IS_OK(status)) {
3278 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3279 nt_errstr(status)));
3280 errcode = W_ERROR_V(ntstatus_to_werror(status));
3281 goto out;
3282 }
3283 b = cli->binding_handle;
3284
3285 ZERO_STRUCT(devmode_ctr);
3286
3287 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3288 QueueName,
3289 NULL,
3290 devmode_ctr,
3291 PRINTER_ACCESS_ADMINISTER,
3292 &handle,
3293 &werr);
3294 if (!NT_STATUS_IS_OK(status)) {
3295 errcode = W_ERROR_V(ntstatus_to_werror(status));
3296 goto out;
3297 }
3298 if (!W_ERROR_IS_OK(werr)) {
3299 errcode = W_ERROR_V(werr);
3300 goto out;
3301 }
3302
3303 switch (function) {
3304 case 74: /* Pause queue */
3305 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3306 break;
3307 case 75: /* Resume queue */
3308 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3309 break;
3310 case 103: /* Purge */
3311 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3312 break;
3313 default:
3314 werr = WERR_NOT_SUPPORTED;
3315 break;
3316 }
3317
3318 if (!W_ERROR_IS_OK(werr)) {
3319 errcode = W_ERROR_V(werr);
3320 goto out;
3321 }
3322
3323 ZERO_STRUCT(info_ctr);
3324 ZERO_STRUCT(secdesc_ctr);
3325
3326 status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3327 &handle,
3328 &info_ctr,
3329 &devmode_ctr,
3330 &secdesc_ctr,
3331 command,
3332 &werr);
3333 if (!NT_STATUS_IS_OK(status)) {
3334 errcode = W_ERROR_V(ntstatus_to_werror(status));
3335 goto out;
3336 }
3337 if (!W_ERROR_IS_OK(werr)) {
3338 errcode = W_ERROR_V(werr);
3339 goto out;
3340 }
3341
3342 errcode = W_ERROR_V(werr);
3343
3344 out:
3345
3346 if (b && is_valid_policy_hnd(&handle)) {
3347 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3348 }
3349
3350 SSVAL(*rparam,0,errcode);
3351 SSVAL(*rparam,2,0); /* converter word */
3352
3353 return(True);
3354 }
3355
3356 /****************************************************************************
3357 set the property of a print job (undocumented?)
3358 ? function = 0xb -> set name of print job
3359 ? function = 0x6 -> move print job up/down
3360 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3361 or <WWsTP> <WB21BB16B10zWWzDDz>
3362 ****************************************************************************/
3363
3364 static int check_printjob_info(struct pack_desc* desc,
3365 int uLevel, char* id)
3366 {
3367 desc->subformat = NULL;
3368 switch( uLevel ) {
3369 case 0: desc->format = "W"; break;
3370 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3371 case 2: desc->format = "WWzWWDDzz"; break;
3372 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3373 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3374 default:
3375 DEBUG(0,("check_printjob_info: invalid level %d\n",
3376 uLevel ));
3377 return False;
3378 }
3379 if (id == NULL || strcmp(desc->format,id) != 0) {
3380 DEBUG(0,("check_printjob_info: invalid format %s\n",
3381 id ? id : "<NULL>" ));
3382 return False;
3383 }
3384 return True;
3385 }
3386
3387 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3388 connection_struct *conn, uint64_t vuid,
3389 char *param, int tpscnt,
3390 char *data, int tdscnt,
3391 int mdrcnt,int mprcnt,
3392 char **rdata,char **rparam,
3393 int *rdata_len,int *rparam_len)
3394 {
3395 struct pack_desc desc;
3396 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3397 char *str2 = skip_string(param,tpscnt,str1);
3398 char *p = skip_string(param,tpscnt,str2);
3399 uint32_t jobid;
3400 fstring sharename;
3401 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3402 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3403 int errcode;
3404
3405 TALLOC_CTX *mem_ctx = talloc_tos();
3406 WERROR werr;
3407 NTSTATUS status;
3408 struct rpc_pipe_client *cli = NULL;
3409 struct dcerpc_binding_handle *b = NULL;
3410 struct policy_handle handle;
3411 struct spoolss_DevmodeContainer devmode_ctr;
3412 struct spoolss_JobInfoContainer ctr;
3413 union spoolss_JobInfo info;
3414 struct spoolss_SetJobInfo1 info1;
3415
3416 if (!str1 || !str2 || !p) {
3417 return False;
3418 }
3419 /*
3420 * We use 1 here not 2 as we're checking
3421 * the last byte we want to access is safe.
3422 */
3423 if (!is_offset_safe(param,tpscnt,p,1)) {
3424 return False;
3425 }
3426 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3427 return False;
3428 *rparam_len = 4;
3429 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3430 if (!*rparam) {
3431 return False;
3432 }
3433
3434 *rdata_len = 0;
3435
3436 /* check it's a supported varient */
3437 if ((strcmp(str1,"WWsTP")) ||
3438 (!check_printjob_info(&desc,uLevel,str2)))
3439 return(False);
3440
3441 errcode = NERR_notsupported;
3442
3443 switch (function) {
3444 case 0xb:
3445 /* change print job name, data gives the name */
3446 break;
3447 default:
3448 goto out;
3449 }
3450
3451 ZERO_STRUCT(handle);
3452
3453 status = rpc_pipe_open_interface(conn,
3454 &ndr_table_spoolss,
3455 conn->session_info,
3456 conn->sconn->remote_address,
3457 conn->sconn->msg_ctx,
3458 &cli);
3459 if (!NT_STATUS_IS_OK(status)) {
3460 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3461 nt_errstr(status)));
3462 errcode = W_ERROR_V(ntstatus_to_werror(status));
3463 goto out;
3464 }
3465 b = cli->binding_handle;
3466
3467 ZERO_STRUCT(devmode_ctr);
3468
3469 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3470 sharename,
3471 "RAW",
3472 devmode_ctr,
3473 PRINTER_ACCESS_USE,
3474 &handle,
3475 &werr);
3476 if (!NT_STATUS_IS_OK(status)) {
3477 errcode = W_ERROR_V(ntstatus_to_werror(status));
3478 goto out;
3479 }
3480 if (!W_ERROR_IS_OK(werr)) {
3481 errcode = W_ERROR_V(werr);
3482 goto out;
3483 }
3484
3485 werr = rpccli_spoolss_getjob(cli, mem_ctx,
3486 &handle,
3487 jobid,
3488 1, /* level */
3489 0, /* offered */
3490 &info);
3491 if (!W_ERROR_IS_OK(werr)) {
3492 errcode = W_ERROR_V(werr);
3493 goto out;
3494 }
3495
3496 ZERO_STRUCT(ctr);
3497
3498 info1.job_id = info.info1.job_id;
3499 info1.printer_name = info.info1.printer_name;
3500 info1.user_name = info.info1.user_name;
3501 info1.document_name = data;
3502 info1.data_type = info.info1.data_type;
3503 info1.text_status = info.info1.text_status;
3504 info1.status = info.info1.status;
3505 info1.priority = info.info1.priority;
3506 info1.position = info.info1.position;
3507 info1.total_pages = info.info1.total_pages;
3508 info1.pages_printed = info.info1.pages_printed;
3509 info1.submitted = info.info1.submitted;
3510
3511 ctr.level = 1;
3512 ctr.info.info1 = &info1;
3513
3514 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3515 &handle,
3516 jobid,
3517 &ctr,
3518 0,
3519 &werr);
3520 if (!NT_STATUS_IS_OK(status)) {
3521 errcode = W_ERROR_V(ntstatus_to_werror(status));
3522 goto out;
3523 }
3524 if (!W_ERROR_IS_OK(werr)) {
3525 errcode = W_ERROR_V(werr);
3526 goto out;
3527 }
3528
3529 errcode = NERR_Success;
3530 out:
3531
3532 if (b && is_valid_policy_hnd(&handle)) {
3533 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3534 }
3535
3536 SSVALS(*rparam,0,errcode);
3537 SSVAL(*rparam,2,0); /* converter word */
3538
3539 return(True);
3540 }
3541
3542
3543 /****************************************************************************
3544 Get info about the server.
3545 ****************************************************************************/
3546
3547 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3548 connection_struct *conn,uint64_t vuid,
3549 char *param, int tpscnt,
3550 char *data, int tdscnt,
3551 int mdrcnt,int mprcnt,
3552 char **rdata,char **rparam,
3553 int *rdata_len,int *rparam_len)
3554 {
3555 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3556 char *str2 = skip_string(param,tpscnt,str1);
3557 char *p = skip_string(param,tpscnt,str2);
3558 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3559 char *p2;
3560 int struct_len;
3561
3562 NTSTATUS status;
3563 WERROR werr;
3564 TALLOC_CTX *mem_ctx = talloc_tos();
3565 struct rpc_pipe_client *cli = NULL;
3566 union srvsvc_NetSrvInfo info;
3567 int errcode;
3568 struct dcerpc_binding_handle *b;
3569
3570 if (!str1 || !str2 || !p) {
3571 return False;
3572 }
3573
3574 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3575
3576 /* check it's a supported varient */
3577 if (!prefix_ok(str1,"WrLh")) {
3578 return False;
3579 }
3580
3581 switch( uLevel ) {
3582 case 0:
3583 if (strcmp(str2,"B16") != 0) {
3584 return False;
3585 }
3586 struct_len = 16;
3587 break;
3588 case 1:
3589 if (strcmp(str2,"B16BBDz") != 0) {
3590 return False;
3591 }
3592 struct_len = 26;
3593 break;
3594 case 2:
3595 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3596 return False;
3597 }
3598 struct_len = 134;
3599 break;
3600 case 3:
3601 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3602 return False;
3603 }
3604 struct_len = 144;
3605 break;
3606 case 20:
3607 if (strcmp(str2,"DN") != 0) {
3608 return False;
3609 }
3610 struct_len = 6;
3611 break;
3612 case 50:
3613 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3614 return False;
3615 }
3616 struct_len = 42;
3617 break;
3618 default:
3619 return False;
3620 }
3621
3622 *rdata_len = mdrcnt;
3623 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3624 if (!*rdata) {
3625 return False;
3626 }
3627
3628 p = *rdata;
3629 p2 = p + struct_len;
3630
3631 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
3632 conn->session_info,
3633 conn->sconn->remote_address,
3634 conn->sconn->msg_ctx,
3635 &cli);
3636 if (!NT_STATUS_IS_OK(status)) {
3637 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3638 nt_errstr(status)));
3639 errcode = W_ERROR_V(ntstatus_to_werror(status));
3640 goto out;
3641 }
3642
3643 b = cli->binding_handle;
3644
3645 status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3646 NULL,
3647 101,
3648 &info,
3649 &werr);
3650 if (!NT_STATUS_IS_OK(status)) {
3651 errcode = W_ERROR_V(ntstatus_to_werror(status));
3652 goto out;
3653 }
3654 if (!W_ERROR_IS_OK(werr)) {
3655 errcode = W_ERROR_V(werr);
3656 goto out;
3657 }
3658
3659 if (info.info101 == NULL) {
3660 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3661 goto out;
3662 }
3663
3664 if (uLevel != 20) {
3665 size_t len = 0;
3666 status = srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3667 STR_ASCII|STR_UPPER|STR_TERMINATE, &len);
3668 if (!NT_STATUS_IS_OK(status)) {
3669 errcode = W_ERROR_V(ntstatus_to_werror(status));
3670 goto out;
3671 }
3672 }
3673 p += 16;
3674 if (uLevel > 0) {
3675 SCVAL(p,0,info.info101->version_major);
3676 SCVAL(p,1,info.info101->version_minor);
3677 SIVAL(p,2,info.info101->server_type);
3678
3679 if (mdrcnt == struct_len) {
3680 SIVAL(p,6,0);
3681 } else {
3682 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3683 if (mdrcnt - struct_len <= 0) {
3684 return false;
3685 }
3686 push_ascii(p2,
3687 info.info101->comment,
3688 MIN(mdrcnt - struct_len,
3689 MAX_SERVER_STRING_LENGTH),
3690 STR_TERMINATE);
3691 p2 = skip_string(*rdata,*rdata_len,p2);
3692 if (!p2) {
3693 return False;
3694 }
3695 }
3696 }
3697
3698 if (uLevel > 1) {
3699 return False; /* not yet implemented */
3700 }
3701
3702 errcode = NERR_Success;
3703
3704 out:
3705
3706 *rdata_len = PTR_DIFF(p2,*rdata);
3707
3708 *rparam_len = 6;
3709 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3710 if (!*rparam) {
3711 return False;
3712 }
3713 SSVAL(*rparam,0,errcode);
3714 SSVAL(*rparam,2,0); /* converter word */
3715 SSVAL(*rparam,4,*rdata_len);
3716
3717 return True;
3718 }
3719
3720 /****************************************************************************
3721 Get info about the server.
3722 ****************************************************************************/
3723
3724 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3725 connection_struct *conn,uint64_t vuid,
3726 char *param, int tpscnt,
3727 char *data, int tdscnt,
3728 int mdrcnt,int mprcnt,
3729 char **rdata,char **rparam,
3730 int *rdata_len,int *rparam_len)
3731 {
3732 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3733 char *str2 = skip_string(param,tpscnt,str1);
3734 char *p = skip_string(param,tpscnt,str2);
3735 char *p2;
3736 char *endp;
3737 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3738
3739 if (!str1 || !str2 || !p) {
3740 return False;
3741 }
3742
3743 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3744
3745 *rparam_len = 6;
3746 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3747 if (!*rparam) {
3748 return False;
3749 }
3750
3751 /* check it's a supported varient */
3752 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3753 return False;
3754 }
3755
3756 *rdata_len = mdrcnt + 1024;
3757 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3758 if (!*rdata) {
3759 return False;
3760 }
3761
3762 SSVAL(*rparam,0,NERR_Success);
3763 SSVAL(*rparam,2,0); /* converter word */
3764
3765 p = *rdata;
3766 endp = *rdata + *rdata_len;
3767
3768 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3769 if (!p2) {
3770 return False;
3771 }
3772
3773 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3774 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3775 if (!strupper_m(p2)) {
3776 return false;
3777 }
3778 p2 = skip_string(*rdata,*rdata_len,p2);
3779 if (!p2) {
3780 return False;
3781 }
3782 p += 4;
3783
3784 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3785 strlcpy(p2,conn->session_info->unix_info->sanitized_username,PTR_DIFF(endp,p2));
3786 p2 = skip_string(*rdata,*rdata_len,p2);
3787 if (!p2) {
3788 return False;
3789 }
3790 p += 4;
3791
3792 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3793 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3794 if (!strupper_m(p2)) {
3795 return false;
3796 }
3797 p2 = skip_string(*rdata,*rdata_len,p2);
3798 if (!p2) {
3799 return False;
3800 }
3801 p += 4;
3802
3803 SCVAL(p,0,SAMBA_MAJOR_NBT_ANNOUNCE_VERSION); /* system version - e.g 4 in 4.1 */
3804 SCVAL(p,1,SAMBA_MINOR_NBT_ANNOUNCE_VERSION); /* system version - e.g .1 in 4.1 */
3805 p += 2;
3806
3807 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3808 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3809 p2 = skip_string(*rdata,*rdata_len,p2);
3810 if (!p2) {
3811 return False;
3812 }
3813 p += 4;
3814
3815 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3816 strlcpy(p2,"",PTR_DIFF(endp,p2));
3817 p2 = skip_string(*rdata,*rdata_len,p2);
3818 if (!p2) {
3819 return False;
3820 }
3821 p += 4;
3822
3823 *rdata_len = PTR_DIFF(p2,*rdata);
3824
3825 SSVAL(*rparam,4,*rdata_len);
3826
3827 return True;
3828 }
3829
3830 /****************************************************************************
3831 get info about a user
3832
3833 struct user_info_11 {
3834 char usri11_name[21]; 0-20
3835 char usri11_pad; 21
3836 char *usri11_comment; 22-25
3837 char *usri11_usr_comment; 26-29
3838 unsigned short usri11_priv; 30-31
3839 unsigned long usri11_auth_flags; 32-35
3840 long usri11_password_age; 36-39
3841 char *usri11_homedir; 40-43
3842 char *usri11_parms; 44-47
3843 long usri11_last_logon; 48-51
3844 long usri11_last_logoff; 52-55
3845 unsigned short usri11_bad_pw_count; 56-57
3846 unsigned short usri11_num_logons; 58-59
3847 char *usri11_logon_server; 60-63
3848 unsigned short usri11_country_code; 64-65
3849 char *usri11_workstations; 66-69
3850 unsigned long usri11_max_storage; 70-73
3851 unsigned short usri11_units_per_week; 74-75
3852 unsigned char *usri11_logon_hours; 76-79
3853 unsigned short usri11_code_page; 80-81
3854 };
3855
3856 where:
3857
3858 usri11_name specifies the user name for which information is retrieved
3859
3860 usri11_pad aligns the next data structure element to a word boundary
3861
3862 usri11_comment is a null terminated ASCII comment
3863
3864 usri11_user_comment is a null terminated ASCII comment about the user
3865
3866 usri11_priv specifies the level of the privilege assigned to the user.
3867 The possible values are:
3868
3869 Name Value Description
3870 USER_PRIV_GUEST 0 Guest privilege
3871 USER_PRIV_USER 1 User privilege
3872 USER_PRV_ADMIN 2 Administrator privilege
3873
3874 usri11_auth_flags specifies the account operator privileges. The
3875 possible values are:
3876
3877 Name Value Description
3878 AF_OP_PRINT 0 Print operator
3879
3880
3881 Leach, Naik [Page 28]
3882 \f
3883
3884
3885 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3886
3887
3888 AF_OP_COMM 1 Communications operator
3889 AF_OP_SERVER 2 Server operator
3890 AF_OP_ACCOUNTS 3 Accounts operator
3891
3892
3893 usri11_password_age specifies how many seconds have elapsed since the
3894 password was last changed.
3895
3896 usri11_home_dir points to a null terminated ASCII string that contains
3897 the path name of the user's home directory.
3898
3899 usri11_parms points to a null terminated ASCII string that is set
3900 aside for use by applications.
3901
3902 usri11_last_logon specifies the time when the user last logged on.
3903 This value is stored as the number of seconds elapsed since
3904 00:00:00, January 1, 1970.
3905
3906 usri11_last_logoff specifies the time when the user last logged off.
3907 This value is stored as the number of seconds elapsed since
3908 00:00:00, January 1, 1970. A value of 0 means the last logoff
3909 time is unknown.
3910
3911 usri11_bad_pw_count specifies the number of incorrect passwords
3912 entered since the last successful logon.
3913
3914 usri11_log1_num_logons specifies the number of times this user has
3915 logged on. A value of -1 means the number of logons is unknown.
3916
3917 usri11_logon_server points to a null terminated ASCII string that
3918 contains the name of the server to which logon requests are sent.
3919 A null string indicates logon requests should be sent to the
3920 domain controller.
3921
3922 usri11_country_code specifies the country code for the user's language
3923 of choice.
3924
3925 usri11_workstations points to a null terminated ASCII string that
3926 contains the names of workstations the user may log on from.
3927 There may be up to 8 workstations, with the names separated by
3928 commas. A null strings indicates there are no restrictions.
3929
3930 usri11_max_storage specifies the maximum amount of disk space the user
3931 can occupy. A value of 0xffffffff indicates there are no
3932 restrictions.
3933
3934 usri11_units_per_week specifies the equal number of time units into
3935 which a week is divided. This value must be equal to 168.
3936
3937 usri11_logon_hours points to a 21 byte (168 bits) string that
3938 specifies the time during which the user can log on. Each bit
3939 represents one unique hour in a week. The first bit (bit 0, word
3940 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3941
3942
3943
3944 Leach, Naik [Page 29]
3945 \f
3946
3947
3948 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3949
3950
3951 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3952 are no restrictions.
3953
3954 usri11_code_page specifies the code page for the user's language of
3955 choice
3956
3957 All of the pointers in this data structure need to be treated
3958 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3959 to be ignored. The converter word returned in the parameters section
3960 needs to be subtracted from the lower 16 bits to calculate an offset
3961 into the return buffer where this ASCII string resides.
3962
3963 There is no auxiliary data in the response.
3964
3965 ****************************************************************************/
3966
3967 #define usri11_name 0
3968 #define usri11_pad 21
3969 #define usri11_comment 22
3970 #define usri11_usr_comment 26
3971 #define usri11_full_name 30
3972 #define usri11_priv 34
3973 #define usri11_auth_flags 36
3974 #define usri11_password_age 40
3975 #define usri11_homedir 44
3976 #define usri11_parms 48
3977 #define usri11_last_logon 52
3978 #define usri11_last_logoff 56
3979 #define usri11_bad_pw_count 60
3980 #define usri11_num_logons 62
3981 #define usri11_logon_server 64
3982 #define usri11_country_code 68
3983 #define usri11_workstations 70
3984 #define usri11_max_storage 74
3985 #define usri11_units_per_week 78
3986 #define usri11_logon_hours 80
3987 #define usri11_code_page 84
3988 #define usri11_end 86
3989
3990 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
3991 connection_struct *conn, uint64_t vuid,
3992 char *param, int tpscnt,
3993 char *data, int tdscnt,
3994 int mdrcnt,int mprcnt,
3995 char **rdata,char **rparam,
3996 int *rdata_len,int *rparam_len)
3997 {
3998 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3999 char *str2 = skip_string(param,tpscnt,str1);
4000 char *UserName = skip_string(param,tpscnt,str2);
4001 char *p = skip_string(param,tpscnt,UserName);
4002 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4003 char *p2;
4004 char *endp;
4005 const char *level_string;
4006
4007 TALLOC_CTX *mem_ctx = talloc_tos();
4008 NTSTATUS status, result;
4009 struct rpc_pipe_client *cli = NULL;
4010 struct policy_handle connect_handle, domain_handle, user_handle;
4011 struct lsa_String domain_name;
4012 struct dom_sid2 *domain_sid;
4013 struct lsa_String names;
4014 struct samr_Ids rids;
4015 struct samr_Ids types;
4016 int errcode = W_ERROR_V(WERR_USER_NOT_FOUND);
4017 uint32_t rid;
4018 union samr_UserInfo *info;
4019 struct dcerpc_binding_handle *b = NULL;
4020
4021 if (!str1 || !str2 || !UserName || !p) {
4022 return False;
4023 }
4024
4025 *rparam_len = 6;
4026 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4027 if (!*rparam) {
4028 return False;
4029 }
4030
4031 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4032
4033 /* check it's a supported variant */
4034 if (strcmp(str1,"zWrLh") != 0) {
4035 return False;
4036 }
4037 switch( uLevel ) {
4038 case 0: level_string = "B21"; break;
4039 case 1: level_string = "B21BB16DWzzWz"; break;
4040 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4041 case 10: level_string = "B21Bzzz"; break;
4042 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4043 default: return False;
4044 }
4045
4046 if (strcmp(level_string,str2) != 0) {
4047 return False;
4048 }
4049
4050 *rdata_len = mdrcnt + 1024;
4051 *rdata = smb_realloc_limit(*rdata,*rdata_len);
4052 if (!*rdata) {
4053 return False;
4054 }
4055
4056 p = *rdata;
4057 endp = *rdata + *rdata_len;
4058 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4059 if (!p2) {
4060 return False;
4061 }
4062
4063 ZERO_STRUCT(connect_handle);
4064 ZERO_STRUCT(domain_handle);
4065 ZERO_STRUCT(user_handle);
4066
4067 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
4068 conn->session_info,
4069 conn->sconn->remote_address,
4070 conn->sconn->msg_ctx,
4071 &cli);
4072 if (!NT_STATUS_IS_OK(status)) {
4073 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4074 nt_errstr(status)));
4075 errcode = W_ERROR_V(ntstatus_to_werror(status));
4076 goto out;
4077 }
4078
4079 b = cli->binding_handle;
4080
4081 status = dcerpc_samr_Connect2(b, mem_ctx,
4082 lp_netbios_name(),
4083 SAMR_ACCESS_CONNECT_TO_SERVER |
4084 SAMR_ACCESS_ENUM_DOMAINS |
4085 SAMR_ACCESS_LOOKUP_DOMAIN,
4086 &connect_handle,
4087 &result);
4088 if (!NT_STATUS_IS_OK(status)) {
4089 errcode = W_ERROR_V(ntstatus_to_werror(status));
4090 goto out;
4091 }
4092 if (!NT_STATUS_IS_OK(result)) {
4093 errcode = W_ERROR_V(ntstatus_to_werror(result));
4094 goto out;
4095 }
4096
4097 init_lsa_String(&domain_name, get_global_sam_name());
4098
4099 status = dcerpc_samr_LookupDomain(b, mem_ctx,
4100 &connect_handle,
4101 &domain_name,
4102 &domain_sid,
4103 &result);
4104 if (!NT_STATUS_IS_OK(status)) {
4105 errcode = W_ERROR_V(ntstatus_to_werror(status));
4106 goto out;
4107 }
4108 if (!NT_STATUS_IS_OK(result)) {
4109 errcode = W_ERROR_V(ntstatus_to_werror(result));
4110 goto out;
4111 }
4112
4113 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4114 &connect_handle,
4115 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4116 domain_sid,
4117 &domain_handle,
4118 &result);
4119 if (!NT_STATUS_IS_OK(status)) {
4120 errcode = W_ERROR_V(ntstatus_to_werror(status));
4121 goto out;
4122 }
4123 if (!NT_STATUS_IS_OK(result)) {
4124 errcode = W_ERROR_V(ntstatus_to_werror(result));
4125 goto out;
4126 }
4127
4128 init_lsa_String(&names, UserName);
4129
4130 status = dcerpc_samr_LookupNames(b, mem_ctx,
4131 &domain_handle,
4132 1,
4133 &names,
4134 &rids,
4135 &types,
4136 &result);
4137 if (!NT_STATUS_IS_OK(status)) {
4138 errcode = W_ERROR_V(ntstatus_to_werror(status));
4139 goto out;
4140 }
4141 if (!NT_STATUS_IS_OK(result)) {
4142 errcode = W_ERROR_V(ntstatus_to_werror(result));
4143 goto out;
4144 }
4145
4146 if (rids.count != 1) {
4147 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4148 goto out;
4149 }
4150 if (rids.count != types.count) {
4151 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4152 goto out;
4153 }
4154 if (types.ids[0] != SID_NAME_USER) {
4155 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4156 goto out;
4157 }
4158
4159 rid = rids.ids[0];
4160
4161 status = dcerpc_samr_OpenUser(b, mem_ctx,
4162 &domain_handle,
4163 SAMR_USER_ACCESS_GET_LOCALE |
4164 SAMR_USER_ACCESS_GET_LOGONINFO |
4165 SAMR_USER_ACCESS_GET_ATTRIBUTES |
4166 SAMR_USER_ACCESS_GET_GROUPS |
4167 SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4168 SEC_STD_READ_CONTROL,
4169 rid,
4170 &user_handle,
4171 &result);
4172 if (!NT_STATUS_IS_OK(status)) {
4173 errcode = W_ERROR_V(ntstatus_to_werror(status));
4174 goto out;
4175 }
4176 if (!NT_STATUS_IS_OK(result)) {
4177 errcode = W_ERROR_V(ntstatus_to_werror(result));
4178 goto out;
4179 }
4180
4181 status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4182 &user_handle,
4183 UserAllInformation,
4184 &info,
4185 &result);
4186 if (!NT_STATUS_IS_OK(status)) {
4187 errcode = W_ERROR_V(ntstatus_to_werror(status));
4188 goto out;
4189 }
4190 if (!NT_STATUS_IS_OK(result)) {
4191 errcode = W_ERROR_V(ntstatus_to_werror(result));
4192 goto out;
4193 }
4194
4195 memset(p,0,21);
4196 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4197
4198 if (uLevel > 0) {
4199 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4200 *p2 = 0;
4201 }
4202
4203 if (uLevel >= 10) {
4204 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4205 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4206 p2 = skip_string(*rdata,*rdata_len,p2);
4207 if (!p2) {
4208 return False;
4209 }
4210
4211 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4212 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4213 p2 = skip_string(*rdata,*rdata_len,p2);
4214 if (!p2) {
4215 return False;
4216 }
4217
4218 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4219 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4220 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4221 p2 = skip_string(*rdata,*rdata_len,p2);
4222 if (!p2) {
4223 return False;
4224 }
4225 }
4226
4227 if (uLevel == 11) {
4228 const char *homedir = info->info21.home_directory.string;
4229 /* modelled after NTAS 3.51 reply */
4230 SSVAL(p,usri11_priv,
4231 (get_current_uid(conn) == sec_initial_uid())?
4232 USER_PRIV_ADMIN:USER_PRIV_USER);
4233 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
4234 SIVALS(p,usri11_password_age,-1); /* password age */
4235 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4236 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4237 p2 = skip_string(*rdata,*rdata_len,p2);
4238 if (!p2) {
4239 return False;
4240 }
4241 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4242 strlcpy(p2,"",PTR_DIFF(endp,p2));
4243 p2 = skip_string(*rdata,*rdata_len,p2);
4244 if (!p2) {
4245 return False;
4246 }
4247 SIVAL(p,usri11_last_logon,0); /* last logon */
4248 SIVAL(p,usri11_last_logoff,0); /* last logoff */
4249 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
4250 SSVALS(p,usri11_num_logons,-1); /* num logons */
4251 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4252 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4253 p2 = skip_string(*rdata,*rdata_len,p2);
4254 if (!p2) {
4255 return False;
4256 }
4257 SSVAL(p,usri11_country_code,0); /* country code */
4258
4259 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4260 strlcpy(p2,"",PTR_DIFF(endp,p2));
4261 p2 = skip_string(*rdata,*rdata_len,p2);
4262 if (!p2) {
4263 return False;
4264 }
4265
4266 SIVALS(p,usri11_max_storage,-1); /* max storage */
4267 SSVAL(p,usri11_units_per_week,168); /* units per week */
4268 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4269
4270 /* a simple way to get logon hours at all times. */
4271 memset(p2,0xff,21);
4272 SCVAL(p2,21,0); /* fix zero termination */
4273 p2 = skip_string(*rdata,*rdata_len,p2);
4274 if (!p2) {
4275 return False;
4276 }
4277
4278 SSVAL(p,usri11_code_page,0); /* code page */
4279 }
4280
4281 if (uLevel == 1 || uLevel == 2) {
4282 memset(p+22,' ',16); /* password */
4283 SIVALS(p,38,-1); /* password age */
4284 SSVAL(p,42,
4285 (get_current_uid(conn) == sec_initial_uid())?
4286 USER_PRIV_ADMIN:USER_PRIV_USER);
4287 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4288 strlcpy(p2, info->info21.home_directory.string,
4289 PTR_DIFF(endp,p2));
4290 p2 = skip_string(*rdata,*rdata_len,p2);
4291 if (!p2) {
4292 return False;
4293 }
4294 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4295 *p2++ = 0;
4296 SSVAL(p,52,0); /* flags */
4297 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
4298 strlcpy(p2, info->info21.logon_script.string,
4299 PTR_DIFF(endp,p2));
4300 p2 = skip_string(*rdata,*rdata_len,p2);
4301 if (!p2) {
4302 return False;
4303 }
4304 if (uLevel == 2) {
4305 SIVAL(p,58,0); /* auth_flags */
4306 SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4307 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4308 p2 = skip_string(*rdata,*rdata_len,p2);
4309 if (!p2) {
4310 return False;
4311 }
4312 SIVAL(p,66,0); /* urs_comment */
4313 SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4314 strlcpy(p2,"",PTR_DIFF(endp,p2));
4315 p2 = skip_string(*rdata,*rdata_len,p2);
4316 if (!p2) {
4317 return False;
4318 }
4319 SIVAL(p,74,0); /* workstations */
4320 SIVAL(p,78,0); /* last_logon */
4321 SIVAL(p,82,0); /* last_logoff */
4322 SIVALS(p,86,-1); /* acct_expires */
4323 SIVALS(p,90,-1); /* max_storage */
4324 SSVAL(p,94,168); /* units_per_week */
4325 SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4326 memset(p2,-1,21);
4327 p2 += 21;
4328 SSVALS(p,100,-1); /* bad_pw_count */
4329 SSVALS(p,102,-1); /* num_logons */
4330 SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4331 {
4332 TALLOC_CTX *ctx = talloc_tos();
4333 int space_rem = *rdata_len - (p2 - *rdata);
4334 char *tmp;
4335
4336 if (space_rem <= 0) {
4337 return false;
4338 }
4339 tmp = talloc_strdup(ctx, "\\\\%L");
4340 if (!tmp) {
4341 return false;
4342 }
4343 tmp = talloc_sub_basic(ctx,
4344 "",
4345 "",
4346 tmp);
4347 if (!tmp) {
4348 return false;
4349 }
4350
4351 push_ascii(p2,
4352 tmp,
4353 space_rem,
4354 STR_TERMINATE);
4355 }
4356 p2 = skip_string(*rdata,*rdata_len,p2);
4357 if (!p2) {
4358 return False;
4359 }
4360 SSVAL(p,108,49); /* country_code */
4361 SSVAL(p,110,860); /* code page */
4362 }
4363 }
4364
4365 errcode = NERR_Success;
4366
4367 out:
4368 *rdata_len = PTR_DIFF(p2,*rdata);
4369
4370 if (b && is_valid_policy_hnd(&user_handle)) {
4371 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4372 }
4373 if (b && is_valid_policy_hnd(&domain_handle)) {
4374 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4375 }
4376 if (b && is_valid_policy_hnd(&connect_handle)) {
4377 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4378 }
4379
4380 SSVAL(*rparam,0,errcode);
4381 SSVAL(*rparam,2,0); /* converter word */
4382 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
4383
4384 return(True);
4385 }
4386
4387 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4388 connection_struct *conn,uint64_t vuid,
4389 char *param, int tpscnt,
4390 char *data, int tdscnt,
4391 int mdrcnt,int mprcnt,
4392 char **rdata,char **rparam,
4393 int *rdata_len,int *rparam_len)
4394 {
4395 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4396 char *str2 = skip_string(param,tpscnt,str1);
4397 char *p = skip_string(param,tpscnt,str2);
4398 int uLevel;
4399 struct pack_desc desc;
4400 char* name;
4401 /* With share level security vuid will always be zero.
4402 Don't depend on vuser being non-null !!. JRA */
4403 struct user_struct *vuser = get_valid_user_struct(sconn, vuid);
4404
4405 if (!str1 || !str2 || !p) {
4406 return False;
4407 }
4408
4409 if(vuser != NULL) {
4410 DEBUG(3,(" Username of UID %d is %s\n",
4411 (int)vuser->session_info->unix_token->uid,
4412 vuser->session_info->unix_info->unix_name));
4413 }
4414
4415 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4416 name = get_safe_str_ptr(param,tpscnt,p,2);
4417 if (!name) {
4418 return False;
4419 }
4420
4421 memset((char *)&desc,'\0',sizeof(desc));
4422
4423 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4424
4425 /* check it's a supported varient */
4426 if (strcmp(str1,"OOWb54WrLh") != 0) {
4427 return False;
4428 }
4429 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4430 return False;
4431 }
4432 if (mdrcnt > 0) {
4433 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4434 if (!*rdata) {
4435 return False;
4436 }
4437 }
4438
4439 desc.base = *rdata;
4440 desc.buflen = mdrcnt;
4441 desc.subformat = NULL;
4442 desc.format = str2;
4443
4444 if (init_package(&desc,1,0)) {
4445 PACKI(&desc,"W",0); /* code */
4446 PACKS(&desc,"B21",name); /* eff. name */
4447 PACKS(&desc,"B",""); /* pad */
4448 PACKI(&desc,"W",
4449 (get_current_uid(conn) == sec_initial_uid())?
4450 USER_PRIV_ADMIN:USER_PRIV_USER);
4451 PACKI(&desc,"D",0); /* auth flags XXX */
4452 PACKI(&desc,"W",0); /* num logons */
4453 PACKI(&desc,"W",0); /* bad pw count */
4454 PACKI(&desc,"D",0); /* last logon */
4455 PACKI(&desc,"D",-1); /* last logoff */
4456 PACKI(&desc,"D",-1); /* logoff time */
4457 PACKI(&desc,"D",-1); /* kickoff time */
4458 PACKI(&desc,"D",0); /* password age */
4459 PACKI(&desc,"D",0); /* password can change */
4460 PACKI(&desc,"D",-1); /* password must change */
4461
4462 {
4463 fstring mypath;
4464 fstrcpy(mypath,"\\\\");
4465 fstrcat(mypath,get_local_machine_name());
4466 if (!strupper_m(mypath)) {
4467 return false;
4468 }
4469 PACKS(&desc,"z",mypath); /* computer */
4470 }
4471
4472 PACKS(&desc,"z",lp_workgroup());/* domain */
4473 PACKS(&desc,"z", vuser ?
4474 vuser->session_info->info->logon_script
4475 : ""); /* script path */
4476 PACKI(&desc,"D",0x00000000); /* reserved */
4477 }
4478
4479 *rdata_len = desc.usedlen;
4480 *rparam_len = 6;
4481 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4482 if (!*rparam) {
4483 return False;
4484 }
4485 SSVALS(*rparam,0,desc.errcode);
4486 SSVAL(*rparam,2,0);
4487 SSVAL(*rparam,4,desc.neededlen);
4488
4489 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4490
4491 return True;
4492 }
4493
4494 /****************************************************************************
4495 api_WAccessGetUserPerms
4496 ****************************************************************************/
4497
4498 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4499 connection_struct *conn,uint64_t vuid,
4500 char *param, int tpscnt,
4501 char *data, int tdscnt,
4502 int mdrcnt,int mprcnt,
4503 char **rdata,char **rparam,
4504 int *rdata_len,int *rparam_len)
4505 {
4506 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4507 char *str2 = skip_string(param,tpscnt,str1);
4508 char *user = skip_string(param,tpscnt,str2);
4509 char *resource = skip_string(param,tpscnt,user);
4510
4511 if (!str1 || !str2 || !user || !resource) {
4512 return False;
4513 }
4514
4515 if (skip_string(param,tpscnt,resource) == NULL) {
4516 return False;
4517 }
4518 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4519
4520 /* check it's a supported varient */
4521 if (strcmp(str1,"zzh") != 0) {
4522 return False;
4523 }
4524 if (strcmp(str2,"") != 0) {
4525 return False;
4526 }
4527
4528 *rparam_len = 6;
4529 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4530 if (!*rparam) {
4531 return False;
4532 }
4533 SSVALS(*rparam,0,0); /* errorcode */
4534 SSVAL(*rparam,2,0); /* converter word */
4535 SSVAL(*rparam,4,0x7f); /* permission flags */
4536
4537 return True;
4538 }
4539
4540 /****************************************************************************
4541 api_WPrintJobEnumerate
4542 ****************************************************************************/
4543
4544 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4545 connection_struct *conn, uint64_t vuid,
4546 char *param, int tpscnt,
4547 char *data, int tdscnt,
4548 int mdrcnt,int mprcnt,
4549 char **rdata,char **rparam,
4550 int *rdata_len,int *rparam_len)
4551 {
4552 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4553 char *str2 = skip_string(param,tpscnt,str1);
4554 char *p = skip_string(param,tpscnt,str2);
4555 int uLevel;
4556 fstring sharename;
4557 uint32_t jobid;
4558 struct pack_desc desc;
4559 char *tmpdata=NULL;
4560
4561 TALLOC_CTX *mem_ctx = talloc_tos();
4562 WERROR werr;
4563 NTSTATUS status;
4564 struct rpc_pipe_client *cli = NULL;
4565 struct dcerpc_binding_handle *b = NULL;
4566 struct policy_handle handle;
4567 struct spoolss_DevmodeContainer devmode_ctr;
4568 union spoolss_JobInfo info;
4569
4570 if (!str1 || !str2 || !p) {
4571 return False;
4572 }
4573
4574 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4575
4576 memset((char *)&desc,'\0',sizeof(desc));
4577 memset((char *)&status,'\0',sizeof(status));
4578
4579 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4580
4581 /* check it's a supported varient */
4582 if (strcmp(str1,"WWrLh") != 0) {
4583 return False;
4584 }
4585 if (!check_printjob_info(&desc,uLevel,str2)) {
4586 return False;
4587 }
4588
4589 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4590 return False;
4591 }
4592
4593 ZERO_STRUCT(handle);
4594
4595 status = rpc_pipe_open_interface(conn,
4596 &ndr_table_spoolss,
4597 conn->session_info,
4598 conn->sconn->remote_address,
4599 conn->sconn->msg_ctx,
4600 &cli);
4601 if (!NT_STATUS_IS_OK(status)) {
4602 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4603 nt_errstr(status)));
4604 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4605 goto out;
4606 }
4607 b = cli->binding_handle;
4608
4609 ZERO_STRUCT(devmode_ctr);
4610
4611 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4612 sharename,
4613 "RAW",
4614 devmode_ctr,
4615 PRINTER_ACCESS_USE,
4616 &handle,
4617 &werr);
4618 if (!NT_STATUS_IS_OK(status)) {
4619 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4620 goto out;
4621 }
4622 if (!W_ERROR_IS_OK(werr)) {
4623 desc.errcode = W_ERROR_V(werr);
4624 goto out;
4625 }
4626
4627 werr = rpccli_spoolss_getjob(cli, mem_ctx,
4628 &handle,
4629 jobid,
4630 2, /* level */
4631 0, /* offered */
4632 &info);
4633 if (!W_ERROR_IS_OK(werr)) {
4634 desc.errcode = W_ERROR_V(werr);
4635 goto out;
4636 }
4637
4638 if (mdrcnt > 0) {
4639 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4640 if (!*rdata) {
4641 return False;
4642 }
4643 desc.base = *rdata;
4644 desc.buflen = mdrcnt;
4645 } else {
4646 /*
4647 * Don't return data but need to get correct length
4648 * init_package will return wrong size if buflen=0
4649 */
4650 desc.buflen = getlen(desc.format);
4651 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4652 }
4653
4654 if (init_package(&desc,1,0)) {
4655 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4656 *rdata_len = desc.usedlen;
4657 } else {
4658 desc.errcode = NERR_JobNotFound;
4659 *rdata_len = 0;
4660 }
4661 out:
4662 if (b && is_valid_policy_hnd(&handle)) {
4663 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4664 }
4665
4666 *rparam_len = 6;
4667 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4668 if (!*rparam) {
4669 return False;
4670 }
4671 SSVALS(*rparam,0,desc.errcode);
4672 SSVAL(*rparam,2,0);
4673 SSVAL(*rparam,4,desc.neededlen);
4674
4675 SAFE_FREE(tmpdata);
4676
4677 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4678
4679 return True;
4680 }
4681
4682 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4683 connection_struct *conn, uint64_t vuid,
4684 char *param, int tpscnt,
4685 char *data, int tdscnt,
4686 int mdrcnt,int mprcnt,
4687 char **rdata,char **rparam,
4688 int *rdata_len,int *rparam_len)
4689 {
4690 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4691 char *str2 = skip_string(param,tpscnt,str1);
4692 char *p = skip_string(param,tpscnt,str2);
4693 char *name = p;
4694 int uLevel;
4695 int i, succnt=0;
4696 struct pack_desc desc;
4697
4698 TALLOC_CTX *mem_ctx = talloc_tos();
4699 WERROR werr;
4700 NTSTATUS status;
4701 struct rpc_pipe_client *cli = NULL;
4702 struct dcerpc_binding_handle *b = NULL;
4703 struct policy_handle handle;
4704 struct spoolss_DevmodeContainer devmode_ctr;
4705 uint32_t count = 0;
4706 union spoolss_JobInfo *info;
4707
4708 if (!str1 || !str2 || !p) {
4709 return False;
4710 }
4711
4712 memset((char *)&desc,'\0',sizeof(desc));
4713
4714 p = skip_string(param,tpscnt,p);
4715 if (!p) {
4716 return False;
4717 }
4718 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4719
4720 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4721
4722 /* check it's a supported variant */
4723 if (strcmp(str1,"zWrLeh") != 0) {
4724 return False;
4725 }
4726
4727 if (uLevel > 2) {
4728 return False; /* defined only for uLevel 0,1,2 */
4729 }
4730
4731 if (!check_printjob_info(&desc,uLevel,str2)) {
4732 return False;
4733 }
4734
4735 ZERO_STRUCT(handle);
4736
4737 status = rpc_pipe_open_interface(conn,
4738 &ndr_table_spoolss,
4739 conn->session_info,
4740 conn->sconn->remote_address,
4741 conn->sconn->msg_ctx,
4742 &cli);
4743 if (!NT_STATUS_IS_OK(status)) {
4744 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4745 nt_errstr(status)));
4746 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4747 goto out;
4748 }
4749 b = cli->binding_handle;
4750
4751 ZERO_STRUCT(devmode_ctr);
4752
4753 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4754 name,
4755 NULL,
4756 devmode_ctr,
4757 PRINTER_ACCESS_USE,
4758 &handle,
4759 &werr);
4760 if (!NT_STATUS_IS_OK(status)) {
4761 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4762 goto out;
4763 }
4764 if (!W_ERROR_IS_OK(werr)) {
4765 desc.errcode = W_ERROR_V(werr);
4766 goto out;
4767 }
4768
4769 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4770 &handle,
4771 0, /* firstjob */
4772 0xff, /* numjobs */
4773 2, /* level */
4774 0, /* offered */
4775 &count,
4776 &info);
4777 if (!W_ERROR_IS_OK(werr)) {
4778 desc.errcode = W_ERROR_V(werr);
4779 goto out;
4780 }
4781
4782 if (mdrcnt > 0) {
4783 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4784 if (!*rdata) {
4785 return False;
4786 }
4787 }
4788 desc.base = *rdata;
4789 desc.buflen = mdrcnt;
4790
4791 if (init_package(&desc,count,0)) {
4792 succnt = 0;
4793 for (i = 0; i < count; i++) {
4794 fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4795 if (desc.errcode == NERR_Success) {
4796 succnt = i+1;
4797 }
4798 }
4799 }
4800 out:
4801 if (b && is_valid_policy_hnd(&handle)) {
4802 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4803 }
4804
4805 *rdata_len = desc.usedlen;
4806
4807 *rparam_len = 8;
4808 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4809 if (!*rparam) {
4810 return False;
4811 }
4812 SSVALS(*rparam,0,desc.errcode);
4813 SSVAL(*rparam,2,0);
4814 SSVAL(*rparam,4,succnt);
4815 SSVAL(*rparam,6,count);
4816
4817 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4818
4819 return True;
4820 }
4821
4822 static int check_printdest_info(struct pack_desc* desc,
4823 int uLevel, char* id)
4824 {
4825 desc->subformat = NULL;
4826 switch( uLevel ) {
4827 case 0:
4828 desc->format = "B9";
4829 break;
4830 case 1:
4831 desc->format = "B9B21WWzW";
4832 break;
4833 case 2:
4834 desc->format = "z";
4835 break;
4836 case 3:
4837 desc->format = "zzzWWzzzWW";
4838 break;
4839 default:
4840 DEBUG(0,("check_printdest_info: invalid level %d\n",
4841 uLevel));
4842 return False;
4843 }
4844 if (id == NULL || strcmp(desc->format,id) != 0) {
4845 DEBUG(0,("check_printdest_info: invalid string %s\n",
4846 id ? id : "<NULL>" ));
4847 return False;
4848 }
4849 return True;
4850 }
4851
4852 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4853 struct pack_desc* desc)
4854 {
4855 char buf[100];
4856
4857 strncpy(buf, info2->printername, sizeof(buf)-1);
4858 buf[sizeof(buf)-1] = 0;
4859 (void)strupper_m(buf);
4860
4861 if (uLevel <= 1) {
4862 PACKS(desc,"B9",buf); /* szName */
4863 if (uLevel == 1) {
4864 PACKS(desc,"B21",""); /* szUserName */
4865 PACKI(desc,"W",0); /* uJobId */
4866 PACKI(desc,"W",0); /* fsStatus */
4867 PACKS(desc,"z",""); /* pszStatus */
4868 PACKI(desc,"W",0); /* time */
4869 }
4870 }
4871
4872 if (uLevel == 2 || uLevel == 3) {
4873 PACKS(desc,"z",buf); /* pszPrinterName */
4874 if (uLevel == 3) {
4875 PACKS(desc,"z",""); /* pszUserName */
4876 PACKS(desc,"z",""); /* pszLogAddr */
4877 PACKI(desc,"W",0); /* uJobId */
4878 PACKI(desc,"W",0); /* fsStatus */
4879 PACKS(desc,"z",""); /* pszStatus */
4880 PACKS(desc,"z",""); /* pszComment */
4881 PACKS(desc,"z","NULL"); /* pszDrivers */
4882 PACKI(desc,"W",0); /* time */
4883 PACKI(desc,"W",0); /* pad1 */
4884 }
4885 }
4886 }
4887
4888 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
4889 connection_struct *conn, uint64_t vuid,
4890 char *param, int tpscnt,
4891 char *data, int tdscnt,
4892 int mdrcnt,int mprcnt,
4893 char **rdata,char **rparam,
4894 int *rdata_len,int *rparam_len)
4895 {
4896 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4897 char *str2 = skip_string(param,tpscnt,str1);
4898 char *p = skip_string(param,tpscnt,str2);
4899 char* PrinterName = p;
4900 int uLevel;
4901 struct pack_desc desc;
4902 char *tmpdata=NULL;
4903
4904 TALLOC_CTX *mem_ctx = talloc_tos();
4905 WERROR werr;
4906 NTSTATUS status;
4907 struct rpc_pipe_client *cli = NULL;
4908 struct dcerpc_binding_handle *b = NULL;
4909 struct policy_handle handle;
4910 struct spoolss_DevmodeContainer devmode_ctr;
4911 union spoolss_PrinterInfo info;
4912
4913 if (!str1 || !str2 || !p) {
4914 return False;
4915 }
4916
4917 memset((char *)&desc,'\0',sizeof(desc));
4918
4919 p = skip_string(param,tpscnt,p);
4920 if (!p) {
4921 return False;
4922 }
4923 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4924
4925 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4926
4927 /* check it's a supported varient */
4928 if (strcmp(str1,"zWrLh") != 0) {
4929 return False;
4930 }
4931 if (!check_printdest_info(&desc,uLevel,str2)) {
4932 return False;
4933 }
4934
4935 ZERO_STRUCT(handle);
4936
4937 status = rpc_pipe_open_interface(conn,
4938 &ndr_table_spoolss,
4939 conn->session_info,
4940 conn->sconn->remote_address,
4941 conn->sconn->msg_ctx,
4942 &cli);
4943 if (!NT_STATUS_IS_OK(status)) {
4944 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
4945 nt_errstr(status)));
4946 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4947 goto out;
4948 }
4949 b = cli->binding_handle;
4950
4951 ZERO_STRUCT(devmode_ctr);
4952
4953 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4954 PrinterName,
4955 NULL,
4956 devmode_ctr,
4957 PRINTER_ACCESS_USE,
4958 &handle,
4959 &werr);
4960 if (!NT_STATUS_IS_OK(status)) {
4961 *rdata_len = 0;
4962 desc.errcode = NERR_DestNotFound;
4963 desc.neededlen = 0;
4964 goto out;
4965 }
4966 if (!W_ERROR_IS_OK(werr)) {
4967 *rdata_len = 0;
4968 desc.errcode = NERR_DestNotFound;
4969 desc.neededlen = 0;
4970 goto out;
4971 }
4972
4973 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
4974 &handle,
4975 2,
4976 0,
4977 &info);
4978 if (!W_ERROR_IS_OK(werr)) {
4979 *rdata_len = 0;
4980 desc.errcode = NERR_DestNotFound;
4981 desc.neededlen = 0;
4982 goto out;
4983 }
4984
4985 if (mdrcnt > 0) {
4986 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4987 if (!*rdata) {
4988 return False;
4989 }
4990 desc.base = *rdata;
4991 desc.buflen = mdrcnt;
4992 } else {
4993 /*
4994 * Don't return data but need to get correct length
4995 * init_package will return wrong size if buflen=0
4996 */
4997 desc.buflen = getlen(desc.format);
4998 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4999 }
5000 if (init_package(&desc,1,0)) {
5001 fill_printdest_info(&info.info2, uLevel,&desc);
5002 }
5003
5004 out:
5005 if (b && is_valid_policy_hnd(&handle)) {
5006 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5007 }
5008
5009 *rdata_len = desc.usedlen;
5010
5011 *rparam_len = 6;
5012 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5013 if (!*rparam) {
5014 return False;
5015 }
5016 SSVALS(*rparam,0,desc.errcode);
5017 SSVAL(*rparam,2,0);
5018 SSVAL(*rparam,4,desc.neededlen);
5019
5020 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5021 SAFE_FREE(tmpdata);
5022
5023 return True;
5024 }
5025
5026 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5027 connection_struct *conn, uint64_t vuid,
5028 char *param, int tpscnt,
5029 char *data, int tdscnt,
5030 int mdrcnt,int mprcnt,
5031 char **rdata,char **rparam,
5032 int *rdata_len,int *rparam_len)
5033 {
5034 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5035 char *str2 = skip_string(param,tpscnt,str1);
5036 char *p = skip_string(param,tpscnt,str2);
5037 int uLevel;
5038 int queuecnt;
5039 int i, n, succnt=0;
5040 struct pack_desc desc;
5041
5042 TALLOC_CTX *mem_ctx = talloc_tos();
5043 WERROR werr;
5044 NTSTATUS status;
5045 struct rpc_pipe_client *cli = NULL;
5046 union spoolss_PrinterInfo *info;
5047 uint32_t count;
5048
5049 if (!str1 || !str2 || !p) {
5050 return False;
5051 }
5052
5053 memset((char *)&desc,'\0',sizeof(desc));
5054
5055 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5056
5057 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5058
5059 /* check it's a supported varient */
5060 if (strcmp(str1,"WrLeh") != 0) {
5061 return False;
5062 }
5063 if (!check_printdest_info(&desc,uLevel,str2)) {
5064 return False;
5065 }
5066
5067 queuecnt = 0;
5068
5069 status = rpc_pipe_open_interface(conn,
5070 &ndr_table_spoolss,
5071 conn->session_info,
5072 conn->sconn->remote_address,
5073 conn->sconn->msg_ctx,
5074 &cli);
5075 if (!NT_STATUS_IS_OK(status)) {
5076 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5077 nt_errstr(status)));
5078 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5079 goto out;
5080 }
5081
5082 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5083 PRINTER_ENUM_LOCAL,
5084 cli->srv_name_slash,
5085 2,
5086 0,
5087 &count,
5088 &info);
5089 if (!W_ERROR_IS_OK(werr)) {
5090 desc.errcode = W_ERROR_V(werr);
5091 *rdata_len = 0;
5092 desc.errcode = NERR_DestNotFound;
5093 desc.neededlen = 0;
5094 goto out;
5095 }
5096
5097 queuecnt = count;
5098
5099 if (mdrcnt > 0) {
5100 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5101 if (!*rdata) {
5102 return False;
5103 }
5104 }
5105
5106 desc.base = *rdata;
5107 desc.buflen = mdrcnt;
5108 if (init_package(&desc,queuecnt,0)) {
5109 succnt = 0;
5110 n = 0;
5111 for (i = 0; i < count; i++) {
5112 fill_printdest_info(&info[i].info2, uLevel,&desc);
5113 n++;
5114 if (desc.errcode == NERR_Success) {
5115 succnt = n;
5116 }
5117 }
5118 }
5119 out:
5120 *rdata_len = desc.usedlen;
5121
5122 *rparam_len = 8;
5123 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5124 if (!*rparam) {
5125 return False;
5126 }
5127 SSVALS(*rparam,0,desc.errcode);
5128 SSVAL(*rparam,2,0);
5129 SSVAL(*rparam,4,succnt);
5130 SSVAL(*rparam,6,queuecnt);
5131
5132 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5133
5134 return True;
5135 }
5136
5137 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5138 connection_struct *conn, uint64_t vuid,
5139 char *param, int tpscnt,
5140 char *data, int tdscnt,
5141 int mdrcnt,int mprcnt,
5142 char **rdata,char **rparam,
5143 int *rdata_len,int *rparam_len)
5144 {
5145 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5146 char *str2 = skip_string(param,tpscnt,str1);
5147 char *p = skip_string(param,tpscnt,str2);
5148 int uLevel;
5149 int succnt;
5150 struct pack_desc desc;
5151
5152 if (!str1 || !str2 || !p) {
5153 return False;
5154 }
5155
5156 memset((char *)&desc,'\0',sizeof(desc));
5157
5158 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5159
5160 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5161
5162 /* check it's a supported varient */
5163 if (strcmp(str1,"WrLeh") != 0) {
5164 return False;
5165 }
5166 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5167 return False;
5168 }
5169
5170 if (mdrcnt > 0) {
5171 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5172 if (!*rdata) {
5173 return False;
5174 }
5175 }
5176 desc.base = *rdata;
5177 desc.buflen = mdrcnt;
5178 if (init_package(&desc,1,0)) {
5179 PACKS(&desc,"B41","NULL");
5180 }
5181
5182 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5183
5184 *rdata_len = desc.usedlen;
5185
5186 *rparam_len = 8;
5187 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5188 if (!*rparam) {
5189 return False;
5190 }
5191 SSVALS(*rparam,0,desc.errcode);
5192 SSVAL(*rparam,2,0);
5193 SSVAL(*rparam,4,succnt);
5194 SSVAL(*rparam,6,1);
5195
5196 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5197
5198 return True;
5199 }
5200
5201 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5202 connection_struct *conn, uint64_t vuid,
5203 char *param, int tpscnt,
5204 char *data, int tdscnt,
5205 int mdrcnt,int mprcnt,
5206 char **rdata,char **rparam,
5207 int *rdata_len,int *rparam_len)
5208 {
5209 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5210 char *str2 = skip_string(param,tpscnt,str1);
5211 char *p = skip_string(param,tpscnt,str2);
5212 int uLevel;
5213 int succnt;
5214 struct pack_desc desc;
5215
5216 if (!str1 || !str2 || !p) {
5217 return False;
5218 }
5219 memset((char *)&desc,'\0',sizeof(desc));
5220
5221 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5222
5223 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5224
5225 /* check it's a supported varient */
5226 if (strcmp(str1,"WrLeh") != 0) {
5227 return False;
5228 }
5229 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5230 return False;
5231 }
5232
5233 if (mdrcnt > 0) {
5234 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5235 if (!*rdata) {
5236 return False;
5237 }
5238 }
5239 desc.base = *rdata;
5240 desc.buflen = mdrcnt;
5241 desc.format = str2;
5242 if (init_package(&desc,1,0)) {
5243 PACKS(&desc,"B13","lpd");
5244 }
5245
5246 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5247
5248 *rdata_len = desc.usedlen;
5249
5250 *rparam_len = 8;
5251 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5252 if (!*rparam) {
5253 return False;
5254 }
5255 SSVALS(*rparam,0,desc.errcode);
5256 SSVAL(*rparam,2,0);
5257 SSVAL(*rparam,4,succnt);
5258 SSVAL(*rparam,6,1);
5259
5260 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5261
5262 return True;
5263 }
5264
5265 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5266 connection_struct *conn, uint64_t vuid,
5267 char *param, int tpscnt,
5268 char *data, int tdscnt,
5269 int mdrcnt,int mprcnt,
5270 char **rdata,char **rparam,
5271 int *rdata_len,int *rparam_len)
5272 {
5273 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5274 char *str2 = skip_string(param,tpscnt,str1);
5275 char *p = skip_string(param,tpscnt,str2);
5276 int uLevel;
5277 int succnt;
5278 struct pack_desc desc;
5279
5280 if (!str1 || !str2 || !p) {
5281 return False;
5282 }
5283
5284 memset((char *)&desc,'\0',sizeof(desc));
5285
5286 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5287
5288 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5289
5290 /* check it's a supported varient */
5291 if (strcmp(str1,"WrLeh") != 0) {
5292 return False;
5293 }
5294 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5295 return False;
5296 }
5297
5298 if (mdrcnt > 0) {
5299 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5300 if (!*rdata) {
5301 return False;
5302 }
5303 }
5304 memset((char *)&desc,'\0',sizeof(desc));
5305 desc.base = *rdata;
5306 desc.buflen = mdrcnt;
5307 desc.format = str2;
5308 if (init_package(&desc,1,0)) {
5309 PACKS(&desc,"B13","lp0");
5310 }
5311
5312 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5313
5314 *rdata_len = desc.usedlen;
5315
5316 *rparam_len = 8;
5317 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5318 if (!*rparam) {
5319 return False;
5320 }
5321 SSVALS(*rparam,0,desc.errcode);
5322 SSVAL(*rparam,2,0);
5323 SSVAL(*rparam,4,succnt);
5324 SSVAL(*rparam,6,1);
5325
5326 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5327
5328 return True;
5329 }
5330
5331 /****************************************************************************
5332 List open sessions
5333 ****************************************************************************/
5334
5335 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5336 connection_struct *conn, uint64_t vuid,
5337 char *param, int tpscnt,
5338 char *data, int tdscnt,
5339 int mdrcnt,int mprcnt,
5340 char **rdata,char **rparam,
5341 int *rdata_len,int *rparam_len)
5342
5343 {
5344 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5345 char *str2 = skip_string(param,tpscnt,str1);
5346 char *p = skip_string(param,tpscnt,str2);
5347 int uLevel;
5348 struct pack_desc desc;
5349 int i;
5350
5351 TALLOC_CTX *mem_ctx = talloc_tos();
5352 WERROR werr;
5353 NTSTATUS status;
5354 struct rpc_pipe_client *cli = NULL;
5355 struct dcerpc_binding_handle *b = NULL;
5356 struct srvsvc_NetSessInfoCtr info_ctr;
5357 uint32_t totalentries, resume_handle = 0;
5358 uint32_t count = 0;
5359
5360 if (!str1 || !str2 || !p) {
5361 return False;
5362 }
5363
5364 ZERO_STRUCT(desc);
5365
5366 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5367
5368 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5369 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5370 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5371
5372 /* check it's a supported varient */
5373 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5374 return False;
5375 }
5376 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5377 return False;
5378 }
5379
5380 status = rpc_pipe_open_interface(conn,
5381 &ndr_table_srvsvc,
5382 conn->session_info,
5383 conn->sconn->remote_address,
5384 conn->sconn->msg_ctx,
5385 &cli);
5386 if (!NT_STATUS_IS_OK(status)) {
5387 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5388 nt_errstr(status)));
5389 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5390 goto out;
5391 }
5392 b = cli->binding_handle;
5393
5394 info_ctr.level = 1;
5395 info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5396 if (info_ctr.ctr.ctr1 == NULL) {
5397 desc.errcode = W_ERROR_V(WERR_NOMEM);
5398 goto out;
5399 }
5400
5401 status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5402 cli->srv_name_slash,
5403 NULL, /* client */
5404 NULL, /* user */
5405 &info_ctr,
5406 (uint32_t)-1, /* max_buffer */
5407 &totalentries,
5408 &resume_handle,
5409 &werr);
5410 if (!NT_STATUS_IS_OK(status)) {
5411 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5412 nt_errstr(status)));
5413 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5414 goto out;
5415 }
5416
5417 if (!W_ERROR_IS_OK(werr)) {
5418 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5419 win_errstr(werr)));
5420 desc.errcode = W_ERROR_V(werr);
5421 goto out;
5422 }
5423
5424 count = info_ctr.ctr.ctr1->count;
5425
5426 out:
5427 if (mdrcnt > 0) {
5428 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5429 if (!*rdata) {
5430 return False;
5431 }
5432 }
5433
5434 desc.base = *rdata;
5435 desc.buflen = mdrcnt;
5436 desc.format = str2;
5437 if (!init_package(&desc, count,0)) {
5438 return False;
5439 }
5440
5441 for(i=0; i < count; i++) {
5442 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5443 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5444 PACKI(&desc, "W", 1); /* num conns */
5445 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5446 PACKI(&desc, "W", 1); /* num users */
5447 PACKI(&desc, "D", 0); /* session time */
5448 PACKI(&desc, "D", 0); /* idle time */
5449 PACKI(&desc, "D", 0); /* flags */
5450 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5451 }
5452
5453 *rdata_len = desc.usedlen;
5454
5455 *rparam_len = 8;
5456 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5457 if (!*rparam) {
5458 return False;
5459 }
5460 SSVALS(*rparam,0,desc.errcode);
5461 SSVAL(*rparam,2,0); /* converter */
5462 SSVAL(*rparam,4, count); /* count */
5463
5464 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5465
5466 return True;
5467 }
5468
5469
5470 /****************************************************************************
5471 The buffer was too small.
5472 ****************************************************************************/
5473
5474 static bool api_TooSmall(struct smbd_server_connection *sconn,
5475 connection_struct *conn,uint64_t vuid, char *param, char *data,
5476 int mdrcnt, int mprcnt,
5477 char **rdata, char **rparam,
5478 int *rdata_len, int *rparam_len)
5479 {
5480 *rparam_len = MIN(*rparam_len,mprcnt);
5481 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5482 if (!*rparam) {
5483 return False;
5484 }
5485
5486 *rdata_len = 0;
5487
5488 SSVAL(*rparam,0,NERR_BufTooSmall);
5489
5490 DEBUG(3,("Supplied buffer too small in API command\n"));
5491
5492 return True;
5493 }
5494
5495 /****************************************************************************
5496 The request is not supported.
5497 ****************************************************************************/
5498
5499 static bool api_Unsupported(struct smbd_server_connection *sconn,
5500 connection_struct *conn, uint64_t vuid,
5501 char *param, int tpscnt,
5502 char *data, int tdscnt,
5503 int mdrcnt, int mprcnt,
5504 char **rdata, char **rparam,
5505 int *rdata_len, int *rparam_len)
5506 {
5507 *rparam_len = 4;
5508 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5509 if (!*rparam) {
5510 return False;
5511 }
5512
5513 *rdata_len = 0;
5514
5515 SSVAL(*rparam,0,NERR_notsupported);
5516 SSVAL(*rparam,2,0); /* converter word */
5517
5518 DEBUG(3,("Unsupported API command\n"));
5519
5520 return True;
5521 }
5522
5523 static const struct {
5524 const char *name;
5525 int id;
5526 bool (*fn)(struct smbd_server_connection *sconn,
5527 connection_struct *, uint64_t,
5528 char *, int,
5529 char *, int,
5530 int,int,char **,char **,int *,int *);
5531 bool auth_user; /* Deny anonymous access? */
5532 } api_commands[] = {
5533 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
5534 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
5535 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
5536 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
5537 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
5538 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
5539 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
5540 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
5541 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
5542 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
5543 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
5544 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
5545 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
5546 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
5547 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
5548 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
5549 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
5550 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
5551 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
5552 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
5553 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
5554 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
5555 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
5556 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
5557 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
5558 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
5559 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5560 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
5561 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
5562 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
5563 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5564 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
5565 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5566 {NULL, -1, api_Unsupported}
5567 /* The following RAP calls are not implemented by Samba:
5568
5569 RAP_WFileEnum2 - anon not OK
5570 */
5571 };
5572
5573
5574 /****************************************************************************
5575 Handle remote api calls.
5576 ****************************************************************************/
5577
5578 void api_reply(connection_struct *conn, uint64_t vuid,
5579 struct smb_request *req,
5580 char *data, char *params,
5581 int tdscnt, int tpscnt,
5582 int mdrcnt, int mprcnt)
5583 {
5584 int api_command;
5585 char *rdata = NULL;
5586 char *rparam = NULL;
5587 const char *name1 = NULL;
5588 const char *name2 = NULL;
5589 int rdata_len = 0;
5590 int rparam_len = 0;
5591 bool reply=False;
5592 int i;
5593
5594 if (!params) {
5595 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5596 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5597 return;
5598 }
5599
5600 if (tpscnt < 2) {
5601 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5602 return;
5603 }
5604 api_command = SVAL(params,0);
5605 /* Is there a string at position params+2 ? */
5606 if (skip_string(params,tpscnt,params+2)) {
5607 name1 = params + 2;
5608 } else {
5609 name1 = "";
5610 }
5611 name2 = skip_string(params,tpscnt,params+2);
5612 if (!name2) {
5613 name2 = "";
5614 }
5615
5616 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5617 api_command,
5618 name1,
5619 name2,
5620 tdscnt,tpscnt,mdrcnt,mprcnt));
5621
5622 for (i=0;api_commands[i].name;i++) {
5623 if (api_commands[i].id == api_command && api_commands[i].fn) {
5624 DEBUG(3,("Doing %s\n",api_commands[i].name));
5625 break;
5626 }
5627 }
5628
5629 /* Check whether this api call can be done anonymously */
5630
5631 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5632 struct user_struct *user = get_valid_user_struct(req->sconn, vuid);
5633
5634 if (!user || security_session_user_level(user->session_info, NULL) < SECURITY_USER) {
5635 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5636 return;
5637 }
5638 }
5639
5640 rdata = (char *)SMB_MALLOC(1024);
5641 if (rdata) {
5642 memset(rdata,'\0',1024);
5643 }
5644
5645 rparam = (char *)SMB_MALLOC(1024);
5646 if (rparam) {
5647 memset(rparam,'\0',1024);
5648 }
5649
5650 if(!rdata || !rparam) {
5651 DEBUG(0,("api_reply: malloc fail !\n"));
5652 SAFE_FREE(rdata);
5653 SAFE_FREE(rparam);
5654 reply_nterror(req, NT_STATUS_NO_MEMORY);
5655 return;
5656 }
5657
5658 reply = api_commands[i].fn(req->sconn, conn,
5659 vuid,
5660 params,tpscnt, /* params + length */
5661 data,tdscnt, /* data + length */
5662 mdrcnt,mprcnt,
5663 &rdata,&rparam,&rdata_len,&rparam_len);
5664
5665
5666 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5667 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5668 mdrcnt,mprcnt,
5669 &rdata,&rparam,&rdata_len,&rparam_len);
5670 }
5671
5672 /* if we get False back then it's actually unsupported */
5673 if (!reply) {
5674 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5675 data,
5676 tdscnt,mdrcnt,mprcnt,
5677 &rdata,&rparam,&rdata_len,&rparam_len);
5678 }
5679
5680 /* If api_Unsupported returns false we can't return anything. */
5681 if (reply) {
5682 send_trans_reply(conn, req, rparam, rparam_len,
5683 rdata, rdata_len, False);
5684 }
5685
5686 SAFE_FREE(rdata);
5687 SAFE_FREE(rparam);
5688 return;
5689 }
Samba GIT mirror