?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
format-subunit: Hide reason if it is None.
[Samba/eduardoll.git] / source3 / smbd / lanman.c
blobc97228fab79d3cba0c79be561c11ad1065210b1b
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/globals.h"
30 #include "../librpc/gen_ndr/cli_samr.h"
31 #include "../librpc/gen_ndr/srv_samr.h"
32 #include "../lib/util/binsearch.h"
33
34 #ifdef CHECK_TYPES
35 #undef CHECK_TYPES
36 #endif
37 #define CHECK_TYPES 0
38
39 #define NERR_Success 0
40 #define NERR_badpass 86
41 #define NERR_notsupported 50
42
43 #define NERR_BASE (2100)
44 #define NERR_BufTooSmall (NERR_BASE+23)
45 #define NERR_JobNotFound (NERR_BASE+51)
46 #define NERR_DestNotFound (NERR_BASE+52)
47
48 #define ACCESS_READ 0x01
49 #define ACCESS_WRITE 0x02
50 #define ACCESS_CREATE 0x04
51
52 #define SHPWLEN 8 /* share password length */
53
54 /* Limit size of ipc replies */
55
56 static char *smb_realloc_limit(void *ptr, size_t size)
57 {
58 char *val;
59
60 size = MAX((size),4*1024);
61 val = (char *)SMB_REALLOC(ptr,size);
62 if (val) {
63 memset(val,'\0',size);
64 }
65 return val;
66 }
67
68 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
69 char *param, int tpscnt,
70 char *data, int tdscnt,
71 int mdrcnt, int mprcnt,
72 char **rdata, char **rparam,
73 int *rdata_len, int *rparam_len);
74
75 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
76 int mdrcnt, int mprcnt,
77 char **rdata, char **rparam,
78 int *rdata_len, int *rparam_len);
79
80
81 static int CopyExpanded(connection_struct *conn,
82 int snum, char **dst, char *src, int *p_space_remaining)
83 {
84 TALLOC_CTX *ctx = talloc_tos();
85 char *buf = NULL;
86 int l;
87
88 if (!src || !dst || !p_space_remaining || !(*dst) ||
89 *p_space_remaining <= 0) {
90 return 0;
91 }
92
93 buf = talloc_strdup(ctx, src);
94 if (!buf) {
95 *p_space_remaining = 0;
96 return 0;
97 }
98 buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
99 if (!buf) {
100 *p_space_remaining = 0;
101 return 0;
102 }
103 buf = talloc_sub_advanced(ctx,
104 lp_servicename(SNUM(conn)),
105 conn->server_info->unix_name,
106 conn->connectpath,
107 conn->server_info->utok.gid,
108 conn->server_info->sanitized_username,
109 pdb_get_domain(conn->server_info->sam_account),
110 buf);
111 if (!buf) {
112 *p_space_remaining = 0;
113 return 0;
114 }
115 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
116 if (l == -1) {
117 return 0;
118 }
119 (*dst) += l;
120 (*p_space_remaining) -= l;
121 return l;
122 }
123
124 static int CopyAndAdvance(char **dst, char *src, int *n)
125 {
126 int l;
127 if (!src || !dst || !n || !(*dst)) {
128 return 0;
129 }
130 l = push_ascii(*dst,src,*n, STR_TERMINATE);
131 if (l == -1) {
132 return 0;
133 }
134 (*dst) += l;
135 (*n) -= l;
136 return l;
137 }
138
139 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
140 {
141 TALLOC_CTX *ctx = talloc_tos();
142 char *buf = NULL;
143 if (!s) {
144 return 0;
145 }
146 buf = talloc_strdup(ctx,s);
147 if (!buf) {
148 return 0;
149 }
150 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
151 if (!buf) {
152 return 0;
153 }
154 buf = talloc_sub_advanced(ctx,
155 lp_servicename(SNUM(conn)),
156 conn->server_info->unix_name,
157 conn->connectpath,
158 conn->server_info->utok.gid,
159 conn->server_info->sanitized_username,
160 pdb_get_domain(conn->server_info->sam_account),
161 buf);
162 if (!buf) {
163 return 0;
164 }
165 return strlen(buf) + 1;
166 }
167
168 static char *Expand(connection_struct *conn, int snum, char *s)
169 {
170 TALLOC_CTX *ctx = talloc_tos();
171 char *buf = NULL;
172
173 if (!s) {
174 return NULL;
175 }
176 buf = talloc_strdup(ctx,s);
177 if (!buf) {
178 return 0;
179 }
180 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
181 if (!buf) {
182 return 0;
183 }
184 return talloc_sub_advanced(ctx,
185 lp_servicename(SNUM(conn)),
186 conn->server_info->unix_name,
187 conn->connectpath,
188 conn->server_info->utok.gid,
189 conn->server_info->sanitized_username,
190 pdb_get_domain(conn->server_info->sam_account),
191 buf);
192 }
193
194 /*******************************************************************
195 Check a API string for validity when we only need to check the prefix.
196 ******************************************************************/
197
198 static bool prefix_ok(const char *str, const char *prefix)
199 {
200 return(strncmp(str,prefix,strlen(prefix)) == 0);
201 }
202
203 struct pack_desc {
204 const char *format; /* formatstring for structure */
205 const char *subformat; /* subformat for structure */
206 char *base; /* baseaddress of buffer */
207 int buflen; /* remaining size for fixed part; on init: length of base */
208 int subcount; /* count of substructures */
209 char *structbuf; /* pointer into buffer for remaining fixed part */
210 int stringlen; /* remaining size for variable part */
211 char *stringbuf; /* pointer into buffer for remaining variable part */
212 int neededlen; /* total needed size */
213 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
214 const char *curpos; /* current position; pointer into format or subformat */
215 int errcode;
216 };
217
218 static int get_counter(const char **p)
219 {
220 int i, n;
221 if (!p || !(*p)) {
222 return 1;
223 }
224 if (!isdigit((int)**p)) {
225 return 1;
226 }
227 for (n = 0;;) {
228 i = **p;
229 if (isdigit(i)) {
230 n = 10 * n + (i - '0');
231 } else {
232 return n;
233 }
234 (*p)++;
235 }
236 }
237
238 static int getlen(const char *p)
239 {
240 int n = 0;
241 if (!p) {
242 return 0;
243 }
244
245 while (*p) {
246 switch( *p++ ) {
247 case 'W': /* word (2 byte) */
248 n += 2;
249 break;
250 case 'K': /* status word? (2 byte) */
251 n += 2;
252 break;
253 case 'N': /* count of substructures (word) at end */
254 n += 2;
255 break;
256 case 'D': /* double word (4 byte) */
257 case 'z': /* offset to zero terminated string (4 byte) */
258 case 'l': /* offset to user data (4 byte) */
259 n += 4;
260 break;
261 case 'b': /* offset to data (with counter) (4 byte) */
262 n += 4;
263 get_counter(&p);
264 break;
265 case 'B': /* byte (with optional counter) */
266 n += get_counter(&p);
267 break;
268 }
269 }
270 return n;
271 }
272
273 static bool init_package(struct pack_desc *p, int count, int subcount)
274 {
275 int n = p->buflen;
276 int i;
277
278 if (!p->format || !p->base) {
279 return False;
280 }
281
282 i = count * getlen(p->format);
283 if (p->subformat) {
284 i += subcount * getlen(p->subformat);
285 }
286 p->structbuf = p->base;
287 p->neededlen = 0;
288 p->usedlen = 0;
289 p->subcount = 0;
290 p->curpos = p->format;
291 if (i > n) {
292 p->neededlen = i;
293 i = n = 0;
294 #if 0
295 /*
296 * This is the old error code we used. Aparently
297 * WinNT/2k systems return ERRbuftoosmall (2123) and
298 * OS/2 needs this. I'm leaving this here so we can revert
299 * if needed. JRA.
300 */
301 p->errcode = ERRmoredata;
302 #else
303 p->errcode = ERRbuftoosmall;
304 #endif
305 } else {
306 p->errcode = NERR_Success;
307 }
308 p->buflen = i;
309 n -= i;
310 p->stringbuf = p->base + i;
311 p->stringlen = n;
312 return (p->errcode == NERR_Success);
313 }
314
315 static int package(struct pack_desc *p, ...)
316 {
317 va_list args;
318 int needed=0, stringneeded;
319 const char *str=NULL;
320 int is_string=0, stringused;
321 int32 temp;
322
323 va_start(args,p);
324
325 if (!*p->curpos) {
326 if (!p->subcount) {
327 p->curpos = p->format;
328 } else {
329 p->curpos = p->subformat;
330 p->subcount--;
331 }
332 }
333 #if CHECK_TYPES
334 str = va_arg(args,char*);
335 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
336 #endif
337 stringneeded = -1;
338
339 if (!p->curpos) {
340 va_end(args);
341 return 0;
342 }
343
344 switch( *p->curpos++ ) {
345 case 'W': /* word (2 byte) */
346 needed = 2;
347 temp = va_arg(args,int);
348 if (p->buflen >= needed) {
349 SSVAL(p->structbuf,0,temp);
350 }
351 break;
352 case 'K': /* status word? (2 byte) */
353 needed = 2;
354 temp = va_arg(args,int);
355 if (p->buflen >= needed) {
356 SSVAL(p->structbuf,0,temp);
357 }
358 break;
359 case 'N': /* count of substructures (word) at end */
360 needed = 2;
361 p->subcount = va_arg(args,int);
362 if (p->buflen >= needed) {
363 SSVAL(p->structbuf,0,p->subcount);
364 }
365 break;
366 case 'D': /* double word (4 byte) */
367 needed = 4;
368 temp = va_arg(args,int);
369 if (p->buflen >= needed) {
370 SIVAL(p->structbuf,0,temp);
371 }
372 break;
373 case 'B': /* byte (with optional counter) */
374 needed = get_counter(&p->curpos);
375 {
376 char *s = va_arg(args,char*);
377 if (p->buflen >= needed) {
378 StrnCpy(p->structbuf,s?s:"",needed-1);
379 }
380 }
381 break;
382 case 'z': /* offset to zero terminated string (4 byte) */
383 str = va_arg(args,char*);
384 stringneeded = (str ? strlen(str)+1 : 0);
385 is_string = 1;
386 break;
387 case 'l': /* offset to user data (4 byte) */
388 str = va_arg(args,char*);
389 stringneeded = va_arg(args,int);
390 is_string = 0;
391 break;
392 case 'b': /* offset to data (with counter) (4 byte) */
393 str = va_arg(args,char*);
394 stringneeded = get_counter(&p->curpos);
395 is_string = 0;
396 break;
397 }
398
399 va_end(args);
400 if (stringneeded >= 0) {
401 needed = 4;
402 if (p->buflen >= needed) {
403 stringused = stringneeded;
404 if (stringused > p->stringlen) {
405 stringused = (is_string ? p->stringlen : 0);
406 if (p->errcode == NERR_Success) {
407 p->errcode = ERRmoredata;
408 }
409 }
410 if (!stringused) {
411 SIVAL(p->structbuf,0,0);
412 } else {
413 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
414 memcpy(p->stringbuf,str?str:"",stringused);
415 if (is_string) {
416 p->stringbuf[stringused-1] = '\0';
417 }
418 p->stringbuf += stringused;
419 p->stringlen -= stringused;
420 p->usedlen += stringused;
421 }
422 }
423 p->neededlen += stringneeded;
424 }
425
426 p->neededlen += needed;
427 if (p->buflen >= needed) {
428 p->structbuf += needed;
429 p->buflen -= needed;
430 p->usedlen += needed;
431 } else {
432 if (p->errcode == NERR_Success) {
433 p->errcode = ERRmoredata;
434 }
435 }
436 return 1;
437 }
438
439 #if CHECK_TYPES
440 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
441 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
442 #else
443 #define PACK(desc,t,v) package(desc,v)
444 #define PACKl(desc,t,v,l) package(desc,v,l)
445 #endif
446
447 static void PACKI(struct pack_desc* desc, const char *t,int v)
448 {
449 PACK(desc,t,v);
450 }
451
452 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
453 {
454 PACK(desc,t,v);
455 }
456
457 /****************************************************************************
458 Get a print queue.
459 ****************************************************************************/
460
461 static void PackDriverData(struct pack_desc* desc)
462 {
463 char drivdata[4+4+32];
464 SIVAL(drivdata,0,sizeof drivdata); /* cb */
465 SIVAL(drivdata,4,1000); /* lVersion */
466 memset(drivdata+8,0,32); /* szDeviceName */
467 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
468 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
469 }
470
471 static int check_printq_info(struct pack_desc* desc,
472 unsigned int uLevel, char *id1, char *id2)
473 {
474 desc->subformat = NULL;
475 switch( uLevel ) {
476 case 0:
477 desc->format = "B13";
478 break;
479 case 1:
480 desc->format = "B13BWWWzzzzzWW";
481 break;
482 case 2:
483 desc->format = "B13BWWWzzzzzWN";
484 desc->subformat = "WB21BB16B10zWWzDDz";
485 break;
486 case 3:
487 desc->format = "zWWWWzzzzWWzzl";
488 break;
489 case 4:
490 desc->format = "zWWWWzzzzWNzzl";
491 desc->subformat = "WWzWWDDzz";
492 break;
493 case 5:
494 desc->format = "z";
495 break;
496 case 51:
497 desc->format = "K";
498 break;
499 case 52:
500 desc->format = "WzzzzzzzzN";
501 desc->subformat = "z";
502 break;
503 default:
504 DEBUG(0,("check_printq_info: invalid level %d\n",
505 uLevel ));
506 return False;
507 }
508 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
509 DEBUG(0,("check_printq_info: invalid format %s\n",
510 id1 ? id1 : "<NULL>" ));
511 return False;
512 }
513 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
514 DEBUG(0,("check_printq_info: invalid subformat %s\n",
515 id2 ? id2 : "<NULL>" ));
516 return False;
517 }
518 return True;
519 }
520
521
522 #define RAP_JOB_STATUS_QUEUED 0
523 #define RAP_JOB_STATUS_PAUSED 1
524 #define RAP_JOB_STATUS_SPOOLING 2
525 #define RAP_JOB_STATUS_PRINTING 3
526 #define RAP_JOB_STATUS_PRINTED 4
527
528 #define RAP_QUEUE_STATUS_PAUSED 1
529 #define RAP_QUEUE_STATUS_ERROR 2
530
531 /* turn a print job status into a on the wire status
532 */
533 static int printj_status(int v)
534 {
535 switch (v) {
536 case LPQ_QUEUED:
537 return RAP_JOB_STATUS_QUEUED;
538 case LPQ_PAUSED:
539 return RAP_JOB_STATUS_PAUSED;
540 case LPQ_SPOOLING:
541 return RAP_JOB_STATUS_SPOOLING;
542 case LPQ_PRINTING:
543 return RAP_JOB_STATUS_PRINTING;
544 }
545 return 0;
546 }
547
548 /* turn a print queue status into a on the wire status
549 */
550 static int printq_status(int v)
551 {
552 switch (v) {
553 case LPQ_QUEUED:
554 return 0;
555 case LPQ_PAUSED:
556 return RAP_QUEUE_STATUS_PAUSED;
557 }
558 return RAP_QUEUE_STATUS_ERROR;
559 }
560
561 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
562 struct pack_desc *desc,
563 print_queue_struct *queue, int n)
564 {
565 time_t t = queue->time;
566
567 /* the client expects localtime */
568 t -= get_time_zone(t);
569
570 PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
571 if (uLevel == 1) {
572 PACKS(desc,"B21",queue->fs_user); /* szUserName */
573 PACKS(desc,"B",""); /* pad */
574 PACKS(desc,"B16",""); /* szNotifyName */
575 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
576 PACKS(desc,"z",""); /* pszParms */
577 PACKI(desc,"W",n+1); /* uPosition */
578 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
579 PACKS(desc,"z",""); /* pszStatus */
580 PACKI(desc,"D",t); /* ulSubmitted */
581 PACKI(desc,"D",queue->size); /* ulSize */
582 PACKS(desc,"z",queue->fs_file); /* pszComment */
583 }
584 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
585 PACKI(desc,"W",queue->priority); /* uPriority */
586 PACKS(desc,"z",queue->fs_user); /* pszUserName */
587 PACKI(desc,"W",n+1); /* uPosition */
588 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
589 PACKI(desc,"D",t); /* ulSubmitted */
590 PACKI(desc,"D",queue->size); /* ulSize */
591 PACKS(desc,"z","Samba"); /* pszComment */
592 PACKS(desc,"z",queue->fs_file); /* pszDocument */
593 if (uLevel == 3) {
594 PACKS(desc,"z",""); /* pszNotifyName */
595 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
596 PACKS(desc,"z",""); /* pszParms */
597 PACKS(desc,"z",""); /* pszStatus */
598 PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
599 PACKS(desc,"z","lpd"); /* pszQProcName */
600 PACKS(desc,"z",""); /* pszQProcParms */
601 PACKS(desc,"z","NULL"); /* pszDriverName */
602 PackDriverData(desc); /* pDriverData */
603 PACKS(desc,"z",""); /* pszPrinterName */
604 } else if (uLevel == 4) { /* OS2 */
605 PACKS(desc,"z",""); /* pszSpoolFileName */
606 PACKS(desc,"z",""); /* pszPortName */
607 PACKS(desc,"z",""); /* pszStatus */
608 PACKI(desc,"D",0); /* ulPagesSpooled */
609 PACKI(desc,"D",0); /* ulPagesSent */
610 PACKI(desc,"D",0); /* ulPagesPrinted */
611 PACKI(desc,"D",0); /* ulTimePrinted */
612 PACKI(desc,"D",0); /* ulExtendJobStatus */
613 PACKI(desc,"D",0); /* ulStartPage */
614 PACKI(desc,"D",0); /* ulEndPage */
615 }
616 }
617 }
618
619 /********************************************************************
620 Return a driver name given an snum.
621 Returns True if from tdb, False otherwise.
622 ********************************************************************/
623
624 static bool get_driver_name(int snum, char **pp_drivername)
625 {
626 NT_PRINTER_INFO_LEVEL *info = NULL;
627 bool in_tdb = false;
628
629 get_a_printer (NULL, &info, 2, lp_servicename(snum));
630 if (info != NULL) {
631 *pp_drivername = talloc_strdup(talloc_tos(),
632 info->info_2->drivername);
633 in_tdb = true;
634 free_a_printer(&info, 2);
635 if (!*pp_drivername) {
636 return false;
637 }
638 }
639
640 return in_tdb;
641 }
642
643 /********************************************************************
644 Respond to the DosPrintQInfo command with a level of 52
645 This is used to get printer driver information for Win9x clients
646 ********************************************************************/
647 static void fill_printq_info_52(connection_struct *conn, int snum,
648 struct pack_desc* desc, int count )
649 {
650 int i;
651 fstring location;
652 struct spoolss_DriverInfo8 *driver = NULL;
653 NT_PRINTER_INFO_LEVEL *printer = NULL;
654
655 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
656 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
657 lp_servicename(snum)));
658 goto err;
659 }
660
661 if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
662 "Windows 4.0", 0)) )
663 {
664 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
665 printer->info_2->drivername));
666 goto err;
667 }
668
669 trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
670 trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
671 trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
672
673 PACKI(desc, "W", 0x0400); /* don't know */
674 PACKS(desc, "z", driver->driver_name); /* long printer name */
675 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
676 PACKS(desc, "z", driver->data_file); /* Datafile name */
677 PACKS(desc, "z", driver->monitor_name); /* language monitor */
678
679 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
680 standard_sub_basic( "", "", location, sizeof(location)-1 );
681 PACKS(desc,"z", location); /* share to retrieve files */
682
683 PACKS(desc,"z", driver->default_datatype); /* default data type */
684 PACKS(desc,"z", driver->help_file); /* helpfile name */
685 PACKS(desc,"z", driver->driver_path); /* driver name */
686
687 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
688 DEBUG(3,("Driver: %s:\n",driver->driver_path));
689 DEBUG(3,("Data File: %s:\n",driver->data_file));
690 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
691 DEBUG(3,("Driver Location: %s:\n",location));
692 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
693 DEBUG(3,("Help File: %s:\n",driver->help_file));
694 PACKI(desc,"N",count); /* number of files to copy */
695
696 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
697 {
698 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
699 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
700 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
701 }
702
703 /* sanity check */
704 if ( i != count )
705 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
706 count, i));
707
708 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
709
710 desc->errcode=NERR_Success;
711 goto done;
712
713 err:
714 DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
715 desc->errcode=NERR_notsupported;
716
717 done:
718 if ( printer )
719 free_a_printer( &printer, 2 );
720
721 free_a_printer_driver(driver);
722 }
723
724
725 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
726 struct pack_desc* desc,
727 int count, print_queue_struct* queue,
728 print_status_struct* status)
729 {
730 switch (uLevel) {
731 case 1:
732 case 2:
733 PACKS(desc,"B13",SERVICE(snum));
734 break;
735 case 3:
736 case 4:
737 case 5:
738 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
739 break;
740 case 51:
741 PACKI(desc,"K",printq_status(status->status));
742 break;
743 }
744
745 if (uLevel == 1 || uLevel == 2) {
746 PACKS(desc,"B",""); /* alignment */
747 PACKI(desc,"W",5); /* priority */
748 PACKI(desc,"W",0); /* start time */
749 PACKI(desc,"W",0); /* until time */
750 PACKS(desc,"z",""); /* pSepFile */
751 PACKS(desc,"z","lpd"); /* pPrProc */
752 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
753 PACKS(desc,"z",""); /* pParms */
754 if (snum < 0) {
755 PACKS(desc,"z","UNKNOWN PRINTER");
756 PACKI(desc,"W",LPSTAT_ERROR);
757 }
758 else if (!status || !status->message[0]) {
759 PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
760 PACKI(desc,"W",LPSTAT_OK); /* status */
761 } else {
762 PACKS(desc,"z",status->message);
763 PACKI(desc,"W",printq_status(status->status)); /* status */
764 }
765 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
766 }
767
768 if (uLevel == 3 || uLevel == 4) {
769 char *drivername = NULL;
770
771 PACKI(desc,"W",5); /* uPriority */
772 PACKI(desc,"W",0); /* uStarttime */
773 PACKI(desc,"W",0); /* uUntiltime */
774 PACKI(desc,"W",5); /* pad1 */
775 PACKS(desc,"z",""); /* pszSepFile */
776 PACKS(desc,"z","WinPrint"); /* pszPrProc */
777 PACKS(desc,"z",NULL); /* pszParms */
778 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
779 /* "don't ask" that it's done this way to fix corrupted
780 Win9X/ME printer comments. */
781 if (!status) {
782 PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
783 } else {
784 PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
785 }
786 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
787 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
788 get_driver_name(snum,&drivername);
789 if (!drivername) {
790 return;
791 }
792 PACKS(desc,"z",drivername); /* pszDriverName */
793 PackDriverData(desc); /* pDriverData */
794 }
795
796 if (uLevel == 2 || uLevel == 4) {
797 int i;
798 for (i=0;i<count;i++)
799 fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
800 }
801
802 if (uLevel==52)
803 fill_printq_info_52( conn, snum, desc, count );
804 }
805
806 /* This function returns the number of files for a given driver */
807 static int get_printerdrivernumber(int snum)
808 {
809 int result = 0;
810 struct spoolss_DriverInfo8 *driver;
811 NT_PRINTER_INFO_LEVEL *printer = NULL;
812
813 ZERO_STRUCT(driver);
814
815 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
816 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
817 lp_servicename(snum)));
818 goto done;
819 }
820
821 if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
822 "Windows 4.0", 0)) )
823 {
824 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
825 printer->info_2->drivername));
826 goto done;
827 }
828
829 /* count the number of files */
830 while (driver->dependent_files && *driver->dependent_files[result])
831 result++;
832 done:
833 if ( printer )
834 free_a_printer( &printer, 2 );
835
836 free_a_printer_driver(driver);
837
838 return result;
839 }
840
841 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
842 char *param, int tpscnt,
843 char *data, int tdscnt,
844 int mdrcnt,int mprcnt,
845 char **rdata,char **rparam,
846 int *rdata_len,int *rparam_len)
847 {
848 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
849 char *str2 = skip_string(param,tpscnt,str1);
850 char *p = skip_string(param,tpscnt,str2);
851 char *QueueName = p;
852 unsigned int uLevel;
853 int count=0;
854 int snum;
855 char *str3;
856 struct pack_desc desc;
857 print_queue_struct *queue=NULL;
858 print_status_struct status;
859 char* tmpdata=NULL;
860
861 if (!str1 || !str2 || !p) {
862 return False;
863 }
864 memset((char *)&status,'\0',sizeof(status));
865 memset((char *)&desc,'\0',sizeof(desc));
866
867 p = skip_string(param,tpscnt,p);
868 if (!p) {
869 return False;
870 }
871 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
872 str3 = get_safe_str_ptr(param,tpscnt,p,4);
873 /* str3 may be null here and is checked in check_printq_info(). */
874
875 /* remove any trailing username */
876 if ((p = strchr_m(QueueName,'%')))
877 *p = 0;
878
879 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
880
881 /* check it's a supported varient */
882 if (!prefix_ok(str1,"zWrLh"))
883 return False;
884 if (!check_printq_info(&desc,uLevel,str2,str3)) {
885 /*
886 * Patch from Scott Moomaw <scott@bridgewater.edu>
887 * to return the 'invalid info level' error if an
888 * unknown level was requested.
889 */
890 *rdata_len = 0;
891 *rparam_len = 6;
892 *rparam = smb_realloc_limit(*rparam,*rparam_len);
893 if (!*rparam) {
894 return False;
895 }
896 SSVALS(*rparam,0,ERRunknownlevel);
897 SSVAL(*rparam,2,0);
898 SSVAL(*rparam,4,0);
899 return(True);
900 }
901
902 snum = find_service(QueueName);
903 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
904 return False;
905
906 if (uLevel==52) {
907 count = get_printerdrivernumber(snum);
908 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
909 } else {
910 count = print_queue_status(snum, &queue,&status);
911 }
912
913 if (mdrcnt > 0) {
914 *rdata = smb_realloc_limit(*rdata,mdrcnt);
915 if (!*rdata) {
916 SAFE_FREE(queue);
917 return False;
918 }
919 desc.base = *rdata;
920 desc.buflen = mdrcnt;
921 } else {
922 /*
923 * Don't return data but need to get correct length
924 * init_package will return wrong size if buflen=0
925 */
926 desc.buflen = getlen(desc.format);
927 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
928 }
929
930 if (init_package(&desc,1,count)) {
931 desc.subcount = count;
932 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
933 }
934
935 *rdata_len = desc.usedlen;
936
937 /*
938 * We must set the return code to ERRbuftoosmall
939 * in order to support lanman style printing with Win NT/2k
940 * clients --jerry
941 */
942 if (!mdrcnt && lp_disable_spoolss())
943 desc.errcode = ERRbuftoosmall;
944
945 *rdata_len = desc.usedlen;
946 *rparam_len = 6;
947 *rparam = smb_realloc_limit(*rparam,*rparam_len);
948 if (!*rparam) {
949 SAFE_FREE(queue);
950 SAFE_FREE(tmpdata);
951 return False;
952 }
953 SSVALS(*rparam,0,desc.errcode);
954 SSVAL(*rparam,2,0);
955 SSVAL(*rparam,4,desc.neededlen);
956
957 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
958
959 SAFE_FREE(queue);
960 SAFE_FREE(tmpdata);
961
962 return(True);
963 }
964
965 /****************************************************************************
966 View list of all print jobs on all queues.
967 ****************************************************************************/
968
969 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
970 char *param, int tpscnt,
971 char *data, int tdscnt,
972 int mdrcnt, int mprcnt,
973 char **rdata, char** rparam,
974 int *rdata_len, int *rparam_len)
975 {
976 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
977 char *output_format1 = skip_string(param,tpscnt,param_format);
978 char *p = skip_string(param,tpscnt,output_format1);
979 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
980 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
981 int services = lp_numservices();
982 int i, n;
983 struct pack_desc desc;
984 print_queue_struct **queue = NULL;
985 print_status_struct *status = NULL;
986 int *subcntarr = NULL;
987 int queuecnt = 0, subcnt = 0, succnt = 0;
988
989 if (!param_format || !output_format1 || !p) {
990 return False;
991 }
992
993 memset((char *)&desc,'\0',sizeof(desc));
994
995 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
996
997 if (!prefix_ok(param_format,"WrLeh")) {
998 return False;
999 }
1000 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1001 /*
1002 * Patch from Scott Moomaw <scott@bridgewater.edu>
1003 * to return the 'invalid info level' error if an
1004 * unknown level was requested.
1005 */
1006 *rdata_len = 0;
1007 *rparam_len = 6;
1008 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1009 if (!*rparam) {
1010 return False;
1011 }
1012 SSVALS(*rparam,0,ERRunknownlevel);
1013 SSVAL(*rparam,2,0);
1014 SSVAL(*rparam,4,0);
1015 return(True);
1016 }
1017
1018 for (i = 0; i < services; i++) {
1019 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1020 queuecnt++;
1021 }
1022 }
1023
1024 if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1025 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1026 goto err;
1027 }
1028 memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1029 if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1030 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1031 goto err;
1032 }
1033 memset(status,0,queuecnt*sizeof(print_status_struct));
1034 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1035 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1036 goto err;
1037 }
1038
1039 subcnt = 0;
1040 n = 0;
1041 for (i = 0; i < services; i++) {
1042 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1043 subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1044 subcnt += subcntarr[n];
1045 n++;
1046 }
1047 }
1048
1049 if (mdrcnt > 0) {
1050 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1051 if (!*rdata) {
1052 goto err;
1053 }
1054 }
1055 desc.base = *rdata;
1056 desc.buflen = mdrcnt;
1057
1058 if (init_package(&desc,queuecnt,subcnt)) {
1059 n = 0;
1060 succnt = 0;
1061 for (i = 0; i < services; i++) {
1062 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1063 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1064 n++;
1065 if (desc.errcode == NERR_Success) {
1066 succnt = n;
1067 }
1068 }
1069 }
1070 }
1071
1072 SAFE_FREE(subcntarr);
1073
1074 *rdata_len = desc.usedlen;
1075 *rparam_len = 8;
1076 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1077 if (!*rparam) {
1078 goto err;
1079 }
1080 SSVALS(*rparam,0,desc.errcode);
1081 SSVAL(*rparam,2,0);
1082 SSVAL(*rparam,4,succnt);
1083 SSVAL(*rparam,6,queuecnt);
1084
1085 for (i = 0; i < queuecnt; i++) {
1086 if (queue) {
1087 SAFE_FREE(queue[i]);
1088 }
1089 }
1090
1091 SAFE_FREE(queue);
1092 SAFE_FREE(status);
1093
1094 return True;
1095
1096 err:
1097
1098 SAFE_FREE(subcntarr);
1099 for (i = 0; i < queuecnt; i++) {
1100 if (queue) {
1101 SAFE_FREE(queue[i]);
1102 }
1103 }
1104 SAFE_FREE(queue);
1105 SAFE_FREE(status);
1106
1107 return False;
1108 }
1109
1110 /****************************************************************************
1111 Get info level for a server list query.
1112 ****************************************************************************/
1113
1114 static bool check_server_info(int uLevel, char* id)
1115 {
1116 switch( uLevel ) {
1117 case 0:
1118 if (strcmp(id,"B16") != 0) {
1119 return False;
1120 }
1121 break;
1122 case 1:
1123 if (strcmp(id,"B16BBDz") != 0) {
1124 return False;
1125 }
1126 break;
1127 default:
1128 return False;
1129 }
1130 return True;
1131 }
1132
1133 struct srv_info_struct {
1134 fstring name;
1135 uint32 type;
1136 fstring comment;
1137 fstring domain;
1138 bool server_added;
1139 };
1140
1141 /*******************************************************************
1142 Get server info lists from the files saved by nmbd. Return the
1143 number of entries.
1144 ******************************************************************/
1145
1146 static int get_server_info(uint32 servertype,
1147 struct srv_info_struct **servers,
1148 const char *domain)
1149 {
1150 int count=0;
1151 int alloced=0;
1152 char **lines;
1153 bool local_list_only;
1154 int i;
1155
1156 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1157 if (!lines) {
1158 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1159 return 0;
1160 }
1161
1162 /* request for everything is code for request all servers */
1163 if (servertype == SV_TYPE_ALL) {
1164 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1165 }
1166
1167 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1168
1169 DEBUG(4,("Servertype search: %8x\n",servertype));
1170
1171 for (i=0;lines[i];i++) {
1172 fstring stype;
1173 struct srv_info_struct *s;
1174 const char *ptr = lines[i];
1175 bool ok = True;
1176 TALLOC_CTX *frame = NULL;
1177 char *p;
1178
1179 if (!*ptr) {
1180 continue;
1181 }
1182
1183 if (count == alloced) {
1184 alloced += 10;
1185 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1186 if (!*servers) {
1187 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1188 TALLOC_FREE(lines);
1189 return 0;
1190 }
1191 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1192 }
1193 s = &(*servers)[count];
1194
1195 frame = talloc_stackframe();
1196 s->name[0] = '\0';
1197 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1198 TALLOC_FREE(frame);
1199 continue;
1200 }
1201 fstrcpy(s->name, p);
1202
1203 stype[0] = '\0';
1204 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1205 TALLOC_FREE(frame);
1206 continue;
1207 }
1208 fstrcpy(stype, p);
1209
1210 s->comment[0] = '\0';
1211 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1212 TALLOC_FREE(frame);
1213 continue;
1214 }
1215 fstrcpy(s->comment, p);
1216 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1217
1218 s->domain[0] = '\0';
1219 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1220 /* this allows us to cope with an old nmbd */
1221 fstrcpy(s->domain,lp_workgroup());
1222 } else {
1223 fstrcpy(s->domain, p);
1224 }
1225 TALLOC_FREE(frame);
1226
1227 if (sscanf(stype,"%X",&s->type) != 1) {
1228 DEBUG(4,("r:host file "));
1229 ok = False;
1230 }
1231
1232 /* Filter the servers/domains we return based on what was asked for. */
1233
1234 /* Check to see if we are being asked for a local list only. */
1235 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1236 DEBUG(4,("r: local list only"));
1237 ok = False;
1238 }
1239
1240 /* doesn't match up: don't want it */
1241 if (!(servertype & s->type)) {
1242 DEBUG(4,("r:serv type "));
1243 ok = False;
1244 }
1245
1246 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1247 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1248 DEBUG(4,("s: dom mismatch "));
1249 ok = False;
1250 }
1251
1252 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1253 ok = False;
1254 }
1255
1256 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1257 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1258
1259 if (ok) {
1260 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1261 s->name, s->type, s->comment, s->domain));
1262 s->server_added = True;
1263 count++;
1264 } else {
1265 DEBUG(4,("%20s %8x %25s %15s\n",
1266 s->name, s->type, s->comment, s->domain));
1267 }
1268 }
1269
1270 TALLOC_FREE(lines);
1271 return count;
1272 }
1273
1274 /*******************************************************************
1275 Fill in a server info structure.
1276 ******************************************************************/
1277
1278 static int fill_srv_info(struct srv_info_struct *service,
1279 int uLevel, char **buf, int *buflen,
1280 char **stringbuf, int *stringspace, char *baseaddr)
1281 {
1282 int struct_len;
1283 char* p;
1284 char* p2;
1285 int l2;
1286 int len;
1287
1288 switch (uLevel) {
1289 case 0:
1290 struct_len = 16;
1291 break;
1292 case 1:
1293 struct_len = 26;
1294 break;
1295 default:
1296 return -1;
1297 }
1298
1299 if (!buf) {
1300 len = 0;
1301 switch (uLevel) {
1302 case 1:
1303 len = strlen(service->comment)+1;
1304 break;
1305 }
1306
1307 *buflen = struct_len;
1308 *stringspace = len;
1309 return struct_len + len;
1310 }
1311
1312 len = struct_len;
1313 p = *buf;
1314 if (*buflen < struct_len) {
1315 return -1;
1316 }
1317 if (stringbuf) {
1318 p2 = *stringbuf;
1319 l2 = *stringspace;
1320 } else {
1321 p2 = p + struct_len;
1322 l2 = *buflen - struct_len;
1323 }
1324 if (!baseaddr) {
1325 baseaddr = p;
1326 }
1327
1328 switch (uLevel) {
1329 case 0:
1330 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1331 break;
1332
1333 case 1:
1334 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1335 SIVAL(p,18,service->type);
1336 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1337 len += CopyAndAdvance(&p2,service->comment,&l2);
1338 break;
1339 }
1340
1341 if (stringbuf) {
1342 *buf = p + struct_len;
1343 *buflen -= struct_len;
1344 *stringbuf = p2;
1345 *stringspace = l2;
1346 } else {
1347 *buf = p2;
1348 *buflen -= len;
1349 }
1350 return len;
1351 }
1352
1353
1354 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1355 {
1356 return StrCaseCmp(s1->name,s2->name);
1357 }
1358
1359 /****************************************************************************
1360 View list of servers available (or possibly domains). The info is
1361 extracted from lists saved by nmbd on the local host.
1362 ****************************************************************************/
1363
1364 static bool api_RNetServerEnum2(connection_struct *conn, uint16 vuid,
1365 char *param, int tpscnt,
1366 char *data, int tdscnt,
1367 int mdrcnt, int mprcnt, char **rdata,
1368 char **rparam, int *rdata_len, int *rparam_len)
1369 {
1370 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1371 char *str2 = skip_string(param,tpscnt,str1);
1372 char *p = skip_string(param,tpscnt,str2);
1373 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1374 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1375 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1376 char *p2;
1377 int data_len, fixed_len, string_len;
1378 int f_len = 0, s_len = 0;
1379 struct srv_info_struct *servers=NULL;
1380 int counted=0,total=0;
1381 int i,missed;
1382 fstring domain;
1383 bool domain_request;
1384 bool local_request;
1385
1386 if (!str1 || !str2 || !p) {
1387 return False;
1388 }
1389
1390 /* If someone sets all the bits they don't really mean to set
1391 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1392 known servers. */
1393
1394 if (servertype == SV_TYPE_ALL) {
1395 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1396 }
1397
1398 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1399 any other bit (they may just set this bit on its own) they
1400 want all the locally seen servers. However this bit can be
1401 set on its own so set the requested servers to be
1402 ALL - DOMAIN_ENUM. */
1403
1404 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1405 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1406 }
1407
1408 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1409 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1410
1411 p += 8;
1412
1413 if (!prefix_ok(str1,"WrLehD")) {
1414 return False;
1415 }
1416 if (!check_server_info(uLevel,str2)) {
1417 return False;
1418 }
1419
1420 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1421 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1422 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1423
1424 if (strcmp(str1, "WrLehDz") == 0) {
1425 if (skip_string(param,tpscnt,p) == NULL) {
1426 return False;
1427 }
1428 pull_ascii_fstring(domain, p);
1429 } else {
1430 fstrcpy(domain, lp_workgroup());
1431 }
1432
1433 DEBUG(4, ("domain [%s]\n", domain));
1434
1435 if (lp_browse_list()) {
1436 total = get_server_info(servertype,&servers,domain);
1437 }
1438
1439 data_len = fixed_len = string_len = 0;
1440 missed = 0;
1441
1442 TYPESAFE_QSORT(servers, total, srv_comp);
1443
1444 {
1445 char *lastname=NULL;
1446
1447 for (i=0;i<total;i++) {
1448 struct srv_info_struct *s = &servers[i];
1449
1450 if (lastname && strequal(lastname,s->name)) {
1451 continue;
1452 }
1453 lastname = s->name;
1454 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1455 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1456 i, s->name, s->type, s->comment, s->domain));
1457
1458 if (data_len < buf_len) {
1459 counted++;
1460 fixed_len += f_len;
1461 string_len += s_len;
1462 } else {
1463 missed++;
1464 }
1465 }
1466 }
1467
1468 *rdata_len = fixed_len + string_len;
1469 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1470 if (!*rdata) {
1471 return False;
1472 }
1473
1474 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1475 p = *rdata;
1476 f_len = fixed_len;
1477 s_len = string_len;
1478
1479 {
1480 char *lastname=NULL;
1481 int count2 = counted;
1482
1483 for (i = 0; i < total && count2;i++) {
1484 struct srv_info_struct *s = &servers[i];
1485
1486 if (lastname && strequal(lastname,s->name)) {
1487 continue;
1488 }
1489 lastname = s->name;
1490 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1491 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1492 i, s->name, s->type, s->comment, s->domain));
1493 count2--;
1494 }
1495 }
1496
1497 *rparam_len = 8;
1498 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1499 if (!*rparam) {
1500 return False;
1501 }
1502 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1503 SSVAL(*rparam,2,0);
1504 SSVAL(*rparam,4,counted);
1505 SSVAL(*rparam,6,counted+missed);
1506
1507 SAFE_FREE(servers);
1508
1509 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1510 domain,uLevel,counted,counted+missed));
1511
1512 return True;
1513 }
1514
1515 static int srv_name_match(const char *n1, const char *n2)
1516 {
1517 /*
1518 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1519 *
1520 * In Windows, FirstNameToReturn need not be an exact match:
1521 * the server will return a list of servers that exist on
1522 * the network greater than or equal to the FirstNameToReturn.
1523 */
1524 int ret = StrCaseCmp(n1, n2);
1525
1526 if (ret <= 0) {
1527 return 0;
1528 }
1529
1530 return ret;
1531 }
1532
1533 static bool api_RNetServerEnum3(connection_struct *conn, uint16 vuid,
1534 char *param, int tpscnt,
1535 char *data, int tdscnt,
1536 int mdrcnt, int mprcnt, char **rdata,
1537 char **rparam, int *rdata_len, int *rparam_len)
1538 {
1539 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1540 char *str2 = skip_string(param,tpscnt,str1);
1541 char *p = skip_string(param,tpscnt,str2);
1542 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1543 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1544 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1545 char *p2;
1546 int data_len, fixed_len, string_len;
1547 int f_len = 0, s_len = 0;
1548 struct srv_info_struct *servers=NULL;
1549 int counted=0,first=0,total=0;
1550 int i,missed;
1551 fstring domain;
1552 fstring first_name;
1553 bool domain_request;
1554 bool local_request;
1555
1556 if (!str1 || !str2 || !p) {
1557 return False;
1558 }
1559
1560 /* If someone sets all the bits they don't really mean to set
1561 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1562 known servers. */
1563
1564 if (servertype == SV_TYPE_ALL) {
1565 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1566 }
1567
1568 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1569 any other bit (they may just set this bit on its own) they
1570 want all the locally seen servers. However this bit can be
1571 set on its own so set the requested servers to be
1572 ALL - DOMAIN_ENUM. */
1573
1574 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1575 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1576 }
1577
1578 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1579 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1580
1581 p += 8;
1582
1583 if (strcmp(str1, "WrLehDzz") != 0) {
1584 return false;
1585 }
1586 if (!check_server_info(uLevel,str2)) {
1587 return False;
1588 }
1589
1590 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1591 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1592 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1593
1594 if (skip_string(param,tpscnt,p) == NULL) {
1595 return False;
1596 }
1597 pull_ascii_fstring(domain, p);
1598 if (domain[0] == '\0') {
1599 fstrcpy(domain, lp_workgroup());
1600 }
1601 p = skip_string(param,tpscnt,p);
1602 if (skip_string(param,tpscnt,p) == NULL) {
1603 return False;
1604 }
1605 pull_ascii_fstring(first_name, p);
1606
1607 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1608 domain, first_name));
1609
1610 if (lp_browse_list()) {
1611 total = get_server_info(servertype,&servers,domain);
1612 }
1613
1614 data_len = fixed_len = string_len = 0;
1615 missed = 0;
1616
1617 TYPESAFE_QSORT(servers, total, srv_comp);
1618
1619 if (first_name[0] != '\0') {
1620 struct srv_info_struct *first_server = NULL;
1621
1622 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1623 srv_name_match, first_server);
1624 if (first_server) {
1625 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1626 /*
1627 * The binary search may not find the exact match
1628 * so we need to search backward to find the first match
1629 *
1630 * This implements the strange matching windows
1631 * implements. (see the comment in srv_name_match().
1632 */
1633 for (;first > 0;) {
1634 int ret;
1635 ret = StrCaseCmp(first_name,
1636 servers[first-1].name);
1637 if (ret > 0) {
1638 break;
1639 }
1640 first--;
1641 }
1642 } else {
1643 /* we should return no entries */
1644 first = total;
1645 }
1646 }
1647
1648 {
1649 char *lastname=NULL;
1650
1651 for (i=first;i<total;i++) {
1652 struct srv_info_struct *s = &servers[i];
1653
1654 if (lastname && strequal(lastname,s->name)) {
1655 continue;
1656 }
1657 lastname = s->name;
1658 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1659 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1660 i, s->name, s->type, s->comment, s->domain));
1661
1662 if (data_len < buf_len) {
1663 counted++;
1664 fixed_len += f_len;
1665 string_len += s_len;
1666 } else {
1667 missed++;
1668 }
1669 }
1670 }
1671
1672 *rdata_len = fixed_len + string_len;
1673 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1674 if (!*rdata) {
1675 return False;
1676 }
1677
1678 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1679 p = *rdata;
1680 f_len = fixed_len;
1681 s_len = string_len;
1682
1683 {
1684 char *lastname=NULL;
1685 int count2 = counted;
1686
1687 for (i = first; i < total && count2;i++) {
1688 struct srv_info_struct *s = &servers[i];
1689
1690 if (lastname && strequal(lastname,s->name)) {
1691 continue;
1692 }
1693 lastname = s->name;
1694 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1695 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1696 i, s->name, s->type, s->comment, s->domain));
1697 count2--;
1698 }
1699 }
1700
1701 *rparam_len = 8;
1702 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1703 if (!*rparam) {
1704 return False;
1705 }
1706 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1707 SSVAL(*rparam,2,0);
1708 SSVAL(*rparam,4,counted);
1709 SSVAL(*rparam,6,counted+missed);
1710
1711 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1712 domain,uLevel,first,first_name,
1713 first < total ? servers[first].name : "",
1714 counted,counted+missed));
1715
1716 SAFE_FREE(servers);
1717
1718 return True;
1719 }
1720
1721 /****************************************************************************
1722 command 0x34 - suspected of being a "Lookup Names" stub api
1723 ****************************************************************************/
1724
1725 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1726 char *param, int tpscnt,
1727 char *data, int tdscnt,
1728 int mdrcnt, int mprcnt, char **rdata,
1729 char **rparam, int *rdata_len, int *rparam_len)
1730 {
1731 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1732 char *str2 = skip_string(param,tpscnt,str1);
1733 char *p = skip_string(param,tpscnt,str2);
1734 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1735 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1736 int counted=0;
1737 int missed=0;
1738
1739 if (!str1 || !str2 || !p) {
1740 return False;
1741 }
1742
1743 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1744 str1, str2, p, uLevel, buf_len));
1745
1746 if (!prefix_ok(str1,"zWrLeh")) {
1747 return False;
1748 }
1749
1750 *rdata_len = 0;
1751
1752 *rparam_len = 8;
1753 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1754 if (!*rparam) {
1755 return False;
1756 }
1757
1758 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1759 SSVAL(*rparam,2,0);
1760 SSVAL(*rparam,4,counted);
1761 SSVAL(*rparam,6,counted+missed);
1762
1763 return True;
1764 }
1765
1766 /****************************************************************************
1767 get info about a share
1768 ****************************************************************************/
1769
1770 static bool check_share_info(int uLevel, char* id)
1771 {
1772 switch( uLevel ) {
1773 case 0:
1774 if (strcmp(id,"B13") != 0) {
1775 return False;
1776 }
1777 break;
1778 case 1:
1779 /* Level-2 descriptor is allowed (and ignored) */
1780 if (strcmp(id,"B13BWz") != 0 &&
1781 strcmp(id,"B13BWzWWWzB9B") != 0) {
1782 return False;
1783 }
1784 break;
1785 case 2:
1786 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1787 return False;
1788 }
1789 break;
1790 case 91:
1791 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1792 return False;
1793 }
1794 break;
1795 default:
1796 return False;
1797 }
1798 return True;
1799 }
1800
1801 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1802 char** buf, int* buflen,
1803 char** stringbuf, int* stringspace, char* baseaddr)
1804 {
1805 int struct_len;
1806 char* p;
1807 char* p2;
1808 int l2;
1809 int len;
1810
1811 switch( uLevel ) {
1812 case 0:
1813 struct_len = 13;
1814 break;
1815 case 1:
1816 struct_len = 20;
1817 break;
1818 case 2:
1819 struct_len = 40;
1820 break;
1821 case 91:
1822 struct_len = 68;
1823 break;
1824 default:
1825 return -1;
1826 }
1827
1828 if (!buf) {
1829 len = 0;
1830
1831 if (uLevel > 0) {
1832 len += StrlenExpanded(conn,snum,lp_comment(snum));
1833 }
1834 if (uLevel > 1) {
1835 len += strlen(lp_pathname(snum)) + 1;
1836 }
1837 if (buflen) {
1838 *buflen = struct_len;
1839 }
1840 if (stringspace) {
1841 *stringspace = len;
1842 }
1843 return struct_len + len;
1844 }
1845
1846 len = struct_len;
1847 p = *buf;
1848 if ((*buflen) < struct_len) {
1849 return -1;
1850 }
1851
1852 if (stringbuf) {
1853 p2 = *stringbuf;
1854 l2 = *stringspace;
1855 } else {
1856 p2 = p + struct_len;
1857 l2 = (*buflen) - struct_len;
1858 }
1859
1860 if (!baseaddr) {
1861 baseaddr = p;
1862 }
1863
1864 push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1865
1866 if (uLevel > 0) {
1867 int type;
1868
1869 SCVAL(p,13,0);
1870 type = STYPE_DISKTREE;
1871 if (lp_print_ok(snum)) {
1872 type = STYPE_PRINTQ;
1873 }
1874 if (strequal("IPC",lp_fstype(snum))) {
1875 type = STYPE_IPC;
1876 }
1877 SSVAL(p,14,type); /* device type */
1878 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1879 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1880 }
1881
1882 if (uLevel > 1) {
1883 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1884 SSVALS(p,22,-1); /* max uses */
1885 SSVAL(p,24,1); /* current uses */
1886 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1887 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1888 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1889 }
1890
1891 if (uLevel > 2) {
1892 memset(p+40,0,SHPWLEN+2);
1893 SSVAL(p,50,0);
1894 SIVAL(p,52,0);
1895 SSVAL(p,56,0);
1896 SSVAL(p,58,0);
1897 SIVAL(p,60,0);
1898 SSVAL(p,64,0);
1899 SSVAL(p,66,0);
1900 }
1901
1902 if (stringbuf) {
1903 (*buf) = p + struct_len;
1904 (*buflen) -= struct_len;
1905 (*stringbuf) = p2;
1906 (*stringspace) = l2;
1907 } else {
1908 (*buf) = p2;
1909 (*buflen) -= len;
1910 }
1911
1912 return len;
1913 }
1914
1915 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1916 char *param, int tpscnt,
1917 char *data, int tdscnt,
1918 int mdrcnt,int mprcnt,
1919 char **rdata,char **rparam,
1920 int *rdata_len,int *rparam_len)
1921 {
1922 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1923 char *str2 = skip_string(param,tpscnt,str1);
1924 char *netname = skip_string(param,tpscnt,str2);
1925 char *p = skip_string(param,tpscnt,netname);
1926 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1927 int snum;
1928
1929 if (!str1 || !str2 || !netname || !p) {
1930 return False;
1931 }
1932
1933 snum = find_service(netname);
1934 if (snum < 0) {
1935 return False;
1936 }
1937
1938 /* check it's a supported varient */
1939 if (!prefix_ok(str1,"zWrLh")) {
1940 return False;
1941 }
1942 if (!check_share_info(uLevel,str2)) {
1943 return False;
1944 }
1945
1946 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1947 if (!*rdata) {
1948 return False;
1949 }
1950 p = *rdata;
1951 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1952 if (*rdata_len < 0) {
1953 return False;
1954 }
1955
1956 *rparam_len = 6;
1957 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1958 if (!*rparam) {
1959 return False;
1960 }
1961 SSVAL(*rparam,0,NERR_Success);
1962 SSVAL(*rparam,2,0); /* converter word */
1963 SSVAL(*rparam,4,*rdata_len);
1964
1965 return True;
1966 }
1967
1968 /****************************************************************************
1969 View the list of available shares.
1970
1971 This function is the server side of the NetShareEnum() RAP call.
1972 It fills the return buffer with share names and share comments.
1973 Note that the return buffer normally (in all known cases) allows only
1974 twelve byte strings for share names (plus one for a nul terminator).
1975 Share names longer than 12 bytes must be skipped.
1976 ****************************************************************************/
1977
1978 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1979 char *param, int tpscnt,
1980 char *data, int tdscnt,
1981 int mdrcnt,
1982 int mprcnt,
1983 char **rdata,
1984 char **rparam,
1985 int *rdata_len,
1986 int *rparam_len )
1987 {
1988 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1989 char *str2 = skip_string(param,tpscnt,str1);
1990 char *p = skip_string(param,tpscnt,str2);
1991 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1992 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1993 char *p2;
1994 int count = 0;
1995 int total=0,counted=0;
1996 bool missed = False;
1997 int i;
1998 int data_len, fixed_len, string_len;
1999 int f_len = 0, s_len = 0;
2000
2001 if (!str1 || !str2 || !p) {
2002 return False;
2003 }
2004
2005 if (!prefix_ok(str1,"WrLeh")) {
2006 return False;
2007 }
2008 if (!check_share_info(uLevel,str2)) {
2009 return False;
2010 }
2011
2012 /* Ensure all the usershares are loaded. */
2013 become_root();
2014 load_registry_shares();
2015 count = load_usershare_shares();
2016 unbecome_root();
2017
2018 data_len = fixed_len = string_len = 0;
2019 for (i=0;i<count;i++) {
2020 fstring servicename_dos;
2021 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2022 continue;
2023 }
2024 push_ascii_fstring(servicename_dos, lp_servicename(i));
2025 /* Maximum name length = 13. */
2026 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2027 total++;
2028 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2029 if (data_len < buf_len) {
2030 counted++;
2031 fixed_len += f_len;
2032 string_len += s_len;
2033 } else {
2034 missed = True;
2035 }
2036 }
2037 }
2038
2039 *rdata_len = fixed_len + string_len;
2040 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2041 if (!*rdata) {
2042 return False;
2043 }
2044
2045 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2046 p = *rdata;
2047 f_len = fixed_len;
2048 s_len = string_len;
2049
2050 for( i = 0; i < count; i++ ) {
2051 fstring servicename_dos;
2052 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2053 continue;
2054 }
2055
2056 push_ascii_fstring(servicename_dos, lp_servicename(i));
2057 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2058 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2059 break;
2060 }
2061 }
2062 }
2063
2064 *rparam_len = 8;
2065 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2066 if (!*rparam) {
2067 return False;
2068 }
2069 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2070 SSVAL(*rparam,2,0);
2071 SSVAL(*rparam,4,counted);
2072 SSVAL(*rparam,6,total);
2073
2074 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2075 counted,total,uLevel,
2076 buf_len,*rdata_len,mdrcnt));
2077
2078 return True;
2079 }
2080
2081 /****************************************************************************
2082 Add a share
2083 ****************************************************************************/
2084
2085 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
2086 char *param, int tpscnt,
2087 char *data, int tdscnt,
2088 int mdrcnt,int mprcnt,
2089 char **rdata,char **rparam,
2090 int *rdata_len,int *rparam_len)
2091 {
2092 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2093 char *str2 = skip_string(param,tpscnt,str1);
2094 char *p = skip_string(param,tpscnt,str2);
2095 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2096 fstring sharename;
2097 fstring comment;
2098 char *pathname = NULL;
2099 char *command, *cmdname;
2100 unsigned int offset;
2101 int snum;
2102 int res = ERRunsup;
2103 size_t converted_size;
2104
2105 if (!str1 || !str2 || !p) {
2106 return False;
2107 }
2108
2109 /* check it's a supported varient */
2110 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2111 return False;
2112 }
2113 if (!check_share_info(uLevel,str2)) {
2114 return False;
2115 }
2116 if (uLevel != 2) {
2117 return False;
2118 }
2119
2120 /* Do we have a string ? */
2121 if (skip_string(data,mdrcnt,data) == NULL) {
2122 return False;
2123 }
2124 pull_ascii_fstring(sharename,data);
2125 snum = find_service(sharename);
2126 if (snum >= 0) { /* already exists */
2127 res = ERRfilexists;
2128 goto error_exit;
2129 }
2130
2131 if (mdrcnt < 28) {
2132 return False;
2133 }
2134
2135 /* only support disk share adds */
2136 if (SVAL(data,14)!=STYPE_DISKTREE) {
2137 return False;
2138 }
2139
2140 offset = IVAL(data, 16);
2141 if (offset >= mdrcnt) {
2142 res = ERRinvalidparam;
2143 goto error_exit;
2144 }
2145
2146 /* Do we have a string ? */
2147 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2148 return False;
2149 }
2150 pull_ascii_fstring(comment, offset? (data+offset) : "");
2151
2152 offset = IVAL(data, 26);
2153
2154 if (offset >= mdrcnt) {
2155 res = ERRinvalidparam;
2156 goto error_exit;
2157 }
2158
2159 /* Do we have a string ? */
2160 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2161 return False;
2162 }
2163
2164 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2165 offset ? (data+offset) : "", &converted_size))
2166 {
2167 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2168 strerror(errno)));
2169 }
2170
2171 if (!pathname) {
2172 return false;
2173 }
2174
2175 string_replace(sharename, '"', ' ');
2176 string_replace(pathname, '"', ' ');
2177 string_replace(comment, '"', ' ');
2178
2179 cmdname = lp_add_share_cmd();
2180
2181 if (!cmdname || *cmdname == '\0') {
2182 return False;
2183 }
2184
2185 if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
2186 lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
2187 pathname, comment) == -1) {
2188 return false;
2189 }
2190
2191 DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
2192
2193 if ((res = smbrun(command, NULL)) != 0) {
2194 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
2195 command, res ));
2196 SAFE_FREE(command);
2197 res = ERRnoaccess;
2198 goto error_exit;
2199 } else {
2200 SAFE_FREE(command);
2201 message_send_all(smbd_messaging_context(),
2202 MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
2203 }
2204
2205 *rparam_len = 6;
2206 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2207 if (!*rparam) {
2208 return False;
2209 }
2210 SSVAL(*rparam,0,NERR_Success);
2211 SSVAL(*rparam,2,0); /* converter word */
2212 SSVAL(*rparam,4,*rdata_len);
2213 *rdata_len = 0;
2214
2215 return True;
2216
2217 error_exit:
2218
2219 *rparam_len = 4;
2220 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2221 if (!*rparam) {
2222 return False;
2223 }
2224 *rdata_len = 0;
2225 SSVAL(*rparam,0,res);
2226 SSVAL(*rparam,2,0);
2227 return True;
2228 }
2229
2230 /****************************************************************************
2231 view list of groups available
2232 ****************************************************************************/
2233
2234 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2235 char *param, int tpscnt,
2236 char *data, int tdscnt,
2237 int mdrcnt,int mprcnt,
2238 char **rdata,char **rparam,
2239 int *rdata_len,int *rparam_len)
2240 {
2241 int i;
2242 int errflags=0;
2243 int resume_context, cli_buf_size;
2244 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2245 char *str2 = skip_string(param,tpscnt,str1);
2246 char *p = skip_string(param,tpscnt,str2);
2247
2248 uint32_t num_groups;
2249 uint32_t resume_handle;
2250 struct rpc_pipe_client *samr_pipe;
2251 struct policy_handle samr_handle, domain_handle;
2252 NTSTATUS status;
2253
2254 if (!str1 || !str2 || !p) {
2255 return False;
2256 }
2257
2258 if (strcmp(str1,"WrLeh") != 0) {
2259 return False;
2260 }
2261
2262 /* parameters
2263 * W-> resume context (number of users to skip)
2264 * r -> return parameter pointer to receive buffer
2265 * L -> length of receive buffer
2266 * e -> return parameter number of entries
2267 * h -> return parameter total number of users
2268 */
2269
2270 if (strcmp("B21",str2) != 0) {
2271 return False;
2272 }
2273
2274 status = rpc_pipe_open_internal(
2275 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2276 conn->server_info, &samr_pipe);
2277 if (!NT_STATUS_IS_OK(status)) {
2278 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2279 nt_errstr(status)));
2280 return false;
2281 }
2282
2283 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2284 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2285 if (!NT_STATUS_IS_OK(status)) {
2286 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2287 nt_errstr(status)));
2288 return false;
2289 }
2290
2291 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2292 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2293 get_global_sam_sid(), &domain_handle);
2294 if (!NT_STATUS_IS_OK(status)) {
2295 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2296 nt_errstr(status)));
2297 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2298 return false;
2299 }
2300
2301 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2302 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2303 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2304 "%d\n", resume_context, cli_buf_size));
2305
2306 *rdata_len = cli_buf_size;
2307 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2308 if (!*rdata) {
2309 return False;
2310 }
2311
2312 p = *rdata;
2313
2314 errflags = NERR_Success;
2315 num_groups = 0;
2316 resume_handle = 0;
2317
2318 while (true) {
2319 struct samr_SamArray *sam_entries;
2320 uint32_t num_entries;
2321
2322 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2323 &domain_handle,
2324 &resume_handle,
2325 &sam_entries, 1,
2326 &num_entries);
2327 if (!NT_STATUS_IS_OK(status)) {
2328 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2329 "%s\n", nt_errstr(status)));
2330 break;
2331 }
2332
2333 if (num_entries == 0) {
2334 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2335 "no entries -- done\n"));
2336 break;
2337 }
2338
2339 for(i=0; i<num_entries; i++) {
2340 const char *name;
2341
2342 name = sam_entries->entries[i].name.string;
2343
2344 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2345 /* set overflow error */
2346 DEBUG(3,("overflow on entry %d group %s\n", i,
2347 name));
2348 errflags=234;
2349 break;
2350 }
2351
2352 /* truncate the name at 21 chars. */
2353 memset(p, 0, 21);
2354 strlcpy(p, name, 21);
2355 DEBUG(10,("adding entry %d group %s\n", i, p));
2356 p += 21;
2357 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2358 * idea why... */
2359 num_groups += 1;
2360 }
2361
2362 if (errflags != NERR_Success) {
2363 break;
2364 }
2365
2366 TALLOC_FREE(sam_entries);
2367 }
2368
2369 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2370 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2371
2372 *rdata_len = PTR_DIFF(p,*rdata);
2373
2374 *rparam_len = 8;
2375 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2376 if (!*rparam) {
2377 return False;
2378 }
2379 SSVAL(*rparam, 0, errflags);
2380 SSVAL(*rparam, 2, 0); /* converter word */
2381 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2382 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2383
2384 return(True);
2385 }
2386
2387 /*******************************************************************
2388 Get groups that a user is a member of.
2389 ******************************************************************/
2390
2391 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2392 char *param, int tpscnt,
2393 char *data, int tdscnt,
2394 int mdrcnt,int mprcnt,
2395 char **rdata,char **rparam,
2396 int *rdata_len,int *rparam_len)
2397 {
2398 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2399 char *str2 = skip_string(param,tpscnt,str1);
2400 char *UserName = skip_string(param,tpscnt,str2);
2401 char *p = skip_string(param,tpscnt,UserName);
2402 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2403 const char *level_string;
2404 int count=0;
2405 bool ret = False;
2406 uint32_t i;
2407 char *endp = NULL;
2408
2409 struct rpc_pipe_client *samr_pipe;
2410 struct policy_handle samr_handle, domain_handle, user_handle;
2411 struct lsa_String name;
2412 struct lsa_Strings names;
2413 struct samr_Ids type, rid;
2414 struct samr_RidWithAttributeArray *rids;
2415 NTSTATUS status;
2416
2417 if (!str1 || !str2 || !UserName || !p) {
2418 return False;
2419 }
2420
2421 *rparam_len = 8;
2422 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2423 if (!*rparam) {
2424 return False;
2425 }
2426
2427 /* check it's a supported varient */
2428
2429 if ( strcmp(str1,"zWrLeh") != 0 )
2430 return False;
2431
2432 switch( uLevel ) {
2433 case 0:
2434 level_string = "B21";
2435 break;
2436 default:
2437 return False;
2438 }
2439
2440 if (strcmp(level_string,str2) != 0)
2441 return False;
2442
2443 *rdata_len = mdrcnt + 1024;
2444 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2445 if (!*rdata) {
2446 return False;
2447 }
2448
2449 SSVAL(*rparam,0,NERR_Success);
2450 SSVAL(*rparam,2,0); /* converter word */
2451
2452 p = *rdata;
2453 endp = *rdata + *rdata_len;
2454
2455 status = rpc_pipe_open_internal(
2456 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2457 conn->server_info, &samr_pipe);
2458 if (!NT_STATUS_IS_OK(status)) {
2459 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2460 nt_errstr(status)));
2461 return false;
2462 }
2463
2464 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2465 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2466 if (!NT_STATUS_IS_OK(status)) {
2467 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2468 nt_errstr(status)));
2469 return false;
2470 }
2471
2472 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2473 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2474 get_global_sam_sid(), &domain_handle);
2475 if (!NT_STATUS_IS_OK(status)) {
2476 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2477 nt_errstr(status)));
2478 goto close_sam;
2479 }
2480
2481 name.string = UserName;
2482
2483 status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2484 &domain_handle, 1, &name,
2485 &rid, &type);
2486 if (!NT_STATUS_IS_OK(status)) {
2487 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2488 nt_errstr(status)));
2489 goto close_domain;
2490 }
2491
2492 if (type.ids[0] != SID_NAME_USER) {
2493 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2494 sid_type_lookup(type.ids[0])));
2495 goto close_domain;
2496 }
2497
2498 status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2499 &domain_handle,
2500 SAMR_USER_ACCESS_GET_GROUPS,
2501 rid.ids[0], &user_handle);
2502 if (!NT_STATUS_IS_OK(status)) {
2503 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2504 nt_errstr(status)));
2505 goto close_domain;
2506 }
2507
2508 status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2509 &user_handle, &rids);
2510 if (!NT_STATUS_IS_OK(status)) {
2511 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2512 nt_errstr(status)));
2513 goto close_user;
2514 }
2515
2516 for (i=0; i<rids->count; i++) {
2517
2518 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2519 &domain_handle,
2520 1, &rids->rids[i].rid,
2521 &names, &type);
2522 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2523 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2524 p += 21;
2525 count++;
2526 }
2527 }
2528
2529 *rdata_len = PTR_DIFF(p,*rdata);
2530
2531 SSVAL(*rparam,4,count); /* is this right?? */
2532 SSVAL(*rparam,6,count); /* is this right?? */
2533
2534 ret = True;
2535
2536 close_user:
2537 rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2538 close_domain:
2539 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2540 close_sam:
2541 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2542
2543 return ret;
2544 }
2545
2546 /*******************************************************************
2547 Get all users.
2548 ******************************************************************/
2549
2550 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2551 char *param, int tpscnt,
2552 char *data, int tdscnt,
2553 int mdrcnt,int mprcnt,
2554 char **rdata,char **rparam,
2555 int *rdata_len,int *rparam_len)
2556 {
2557 int count_sent=0;
2558 int num_users=0;
2559 int errflags=0;
2560 int i, resume_context, cli_buf_size;
2561 uint32_t resume_handle;
2562
2563 struct rpc_pipe_client *samr_pipe;
2564 struct policy_handle samr_handle, domain_handle;
2565 NTSTATUS status;
2566
2567 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2568 char *str2 = skip_string(param,tpscnt,str1);
2569 char *p = skip_string(param,tpscnt,str2);
2570 char *endp = NULL;
2571
2572 if (!str1 || !str2 || !p) {
2573 return False;
2574 }
2575
2576 if (strcmp(str1,"WrLeh") != 0)
2577 return False;
2578 /* parameters
2579 * W-> resume context (number of users to skip)
2580 * r -> return parameter pointer to receive buffer
2581 * L -> length of receive buffer
2582 * e -> return parameter number of entries
2583 * h -> return parameter total number of users
2584 */
2585
2586 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2587 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2588 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2589 resume_context, cli_buf_size));
2590
2591 *rparam_len = 8;
2592 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2593 if (!*rparam) {
2594 return False;
2595 }
2596
2597 /* check it's a supported varient */
2598 if (strcmp("B21",str2) != 0)
2599 return False;
2600
2601 *rdata_len = cli_buf_size;
2602 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2603 if (!*rdata) {
2604 return False;
2605 }
2606
2607 p = *rdata;
2608 endp = *rdata + *rdata_len;
2609
2610 status = rpc_pipe_open_internal(
2611 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2612 conn->server_info, &samr_pipe);
2613 if (!NT_STATUS_IS_OK(status)) {
2614 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2615 nt_errstr(status)));
2616 return false;
2617 }
2618
2619 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2620 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2621 if (!NT_STATUS_IS_OK(status)) {
2622 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2623 nt_errstr(status)));
2624 return false;
2625 }
2626
2627 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2628 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2629 get_global_sam_sid(), &domain_handle);
2630 if (!NT_STATUS_IS_OK(status)) {
2631 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2632 nt_errstr(status)));
2633 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2634 return false;
2635 }
2636
2637 errflags=NERR_Success;
2638
2639 resume_handle = 0;
2640
2641 while (true) {
2642 struct samr_SamArray *sam_entries;
2643 uint32_t num_entries;
2644
2645 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2646 &domain_handle,
2647 &resume_handle,
2648 0, &sam_entries, 1,
2649 &num_entries);
2650
2651 if (!NT_STATUS_IS_OK(status)) {
2652 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2653 "%s\n", nt_errstr(status)));
2654 break;
2655 }
2656
2657 if (num_entries == 0) {
2658 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2659 "no entries -- done\n"));
2660 break;
2661 }
2662
2663 for (i=0; i<num_entries; i++) {
2664 const char *name;
2665
2666 name = sam_entries->entries[i].name.string;
2667
2668 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2669 &&(strlen(name)<=21)) {
2670 strlcpy(p,name,PTR_DIFF(endp,p));
2671 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2672 "username %s\n",count_sent,p));
2673 p += 21;
2674 count_sent++;
2675 } else {
2676 /* set overflow error */
2677 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2678 "username %s\n",count_sent,name));
2679 errflags=234;
2680 break;
2681 }
2682 }
2683
2684 if (errflags != NERR_Success) {
2685 break;
2686 }
2687
2688 TALLOC_FREE(sam_entries);
2689 }
2690
2691 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2692 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2693
2694 *rdata_len = PTR_DIFF(p,*rdata);
2695
2696 SSVAL(*rparam,0,errflags);
2697 SSVAL(*rparam,2,0); /* converter word */
2698 SSVAL(*rparam,4,count_sent); /* is this right?? */
2699 SSVAL(*rparam,6,num_users); /* is this right?? */
2700
2701 return True;
2702 }
2703
2704 /****************************************************************************
2705 Get the time of day info.
2706 ****************************************************************************/
2707
2708 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2709 char *param, int tpscnt,
2710 char *data, int tdscnt,
2711 int mdrcnt,int mprcnt,
2712 char **rdata,char **rparam,
2713 int *rdata_len,int *rparam_len)
2714 {
2715 struct tm *t;
2716 time_t unixdate = time(NULL);
2717 char *p;
2718
2719 *rparam_len = 4;
2720 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2721 if (!*rparam) {
2722 return False;
2723 }
2724
2725 *rdata_len = 21;
2726 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2727 if (!*rdata) {
2728 return False;
2729 }
2730
2731 SSVAL(*rparam,0,NERR_Success);
2732 SSVAL(*rparam,2,0); /* converter word */
2733
2734 p = *rdata;
2735
2736 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2737 by NT in a "net time" operation,
2738 it seems to ignore the one below */
2739
2740 /* the client expects to get localtime, not GMT, in this bit
2741 (I think, this needs testing) */
2742 t = localtime(&unixdate);
2743 if (!t) {
2744 return False;
2745 }
2746
2747 SIVAL(p,4,0); /* msecs ? */
2748 SCVAL(p,8,t->tm_hour);
2749 SCVAL(p,9,t->tm_min);
2750 SCVAL(p,10,t->tm_sec);
2751 SCVAL(p,11,0); /* hundredths of seconds */
2752 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2753 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2754 SCVAL(p,16,t->tm_mday);
2755 SCVAL(p,17,t->tm_mon + 1);
2756 SSVAL(p,18,1900+t->tm_year);
2757 SCVAL(p,20,t->tm_wday);
2758
2759 return True;
2760 }
2761
2762 /****************************************************************************
2763 Set the user password.
2764 *****************************************************************************/
2765
2766 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2767 char *param, int tpscnt,
2768 char *data, int tdscnt,
2769 int mdrcnt,int mprcnt,
2770 char **rdata,char **rparam,
2771 int *rdata_len,int *rparam_len)
2772 {
2773 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2774 char *p = NULL;
2775 fstring user;
2776 fstring pass1,pass2;
2777
2778 /* Skip 2 strings. */
2779 p = skip_string(param,tpscnt,np);
2780 p = skip_string(param,tpscnt,p);
2781
2782 if (!np || !p) {
2783 return False;
2784 }
2785
2786 /* Do we have a string ? */
2787 if (skip_string(param,tpscnt,p) == NULL) {
2788 return False;
2789 }
2790 pull_ascii_fstring(user,p);
2791
2792 p = skip_string(param,tpscnt,p);
2793 if (!p) {
2794 return False;
2795 }
2796
2797 memset(pass1,'\0',sizeof(pass1));
2798 memset(pass2,'\0',sizeof(pass2));
2799 /*
2800 * We use 31 here not 32 as we're checking
2801 * the last byte we want to access is safe.
2802 */
2803 if (!is_offset_safe(param,tpscnt,p,31)) {
2804 return False;
2805 }
2806 memcpy(pass1,p,16);
2807 memcpy(pass2,p+16,16);
2808
2809 *rparam_len = 4;
2810 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2811 if (!*rparam) {
2812 return False;
2813 }
2814
2815 *rdata_len = 0;
2816
2817 SSVAL(*rparam,0,NERR_badpass);
2818 SSVAL(*rparam,2,0); /* converter word */
2819
2820 DEBUG(3,("Set password for <%s>\n",user));
2821
2822 /*
2823 * Attempt to verify the old password against smbpasswd entries
2824 * Win98 clients send old and new password in plaintext for this call.
2825 */
2826
2827 {
2828 struct auth_serversupplied_info *server_info = NULL;
2829 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2830
2831 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2832
2833 become_root();
2834 if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2835 SSVAL(*rparam,0,NERR_Success);
2836 }
2837 unbecome_root();
2838
2839 TALLOC_FREE(server_info);
2840 }
2841 data_blob_clear_free(&password);
2842 }
2843
2844 /*
2845 * If the plaintext change failed, attempt
2846 * the old encrypted method. NT will generate this
2847 * after trying the samr method. Note that this
2848 * method is done as a last resort as this
2849 * password change method loses the NT password hash
2850 * and cannot change the UNIX password as no plaintext
2851 * is received.
2852 */
2853
2854 if(SVAL(*rparam,0) != NERR_Success) {
2855 struct samu *hnd = NULL;
2856
2857 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2858 become_root();
2859 if (change_lanman_password(hnd,(uchar *)pass2)) {
2860 SSVAL(*rparam,0,NERR_Success);
2861 }
2862 unbecome_root();
2863 TALLOC_FREE(hnd);
2864 }
2865 }
2866
2867 memset((char *)pass1,'\0',sizeof(fstring));
2868 memset((char *)pass2,'\0',sizeof(fstring));
2869
2870 return(True);
2871 }
2872
2873 /****************************************************************************
2874 Set the user password (SamOEM version - gets plaintext).
2875 ****************************************************************************/
2876
2877 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2878 char *param, int tpscnt,
2879 char *data, int tdscnt,
2880 int mdrcnt,int mprcnt,
2881 char **rdata,char **rparam,
2882 int *rdata_len,int *rparam_len)
2883 {
2884 struct smbd_server_connection *sconn = smbd_server_conn;
2885 fstring user;
2886 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2887 *rparam_len = 2;
2888 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2889 if (!*rparam) {
2890 return False;
2891 }
2892
2893 if (!p) {
2894 return False;
2895 }
2896 *rdata_len = 0;
2897
2898 SSVAL(*rparam,0,NERR_badpass);
2899
2900 /*
2901 * Check the parameter definition is correct.
2902 */
2903
2904 /* Do we have a string ? */
2905 if (skip_string(param,tpscnt,p) == 0) {
2906 return False;
2907 }
2908 if(!strequal(p, "zsT")) {
2909 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2910 return False;
2911 }
2912 p = skip_string(param, tpscnt, p);
2913 if (!p) {
2914 return False;
2915 }
2916
2917 /* Do we have a string ? */
2918 if (skip_string(param,tpscnt,p) == 0) {
2919 return False;
2920 }
2921 if(!strequal(p, "B516B16")) {
2922 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2923 return False;
2924 }
2925 p = skip_string(param,tpscnt,p);
2926 if (!p) {
2927 return False;
2928 }
2929 /* Do we have a string ? */
2930 if (skip_string(param,tpscnt,p) == 0) {
2931 return False;
2932 }
2933 p += pull_ascii_fstring(user,p);
2934
2935 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2936
2937 /*
2938 * Pass the user through the NT -> unix user mapping
2939 * function.
2940 */
2941
2942 (void)map_username(sconn, user);
2943
2944 if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2945 SSVAL(*rparam,0,NERR_Success);
2946 }
2947
2948 return(True);
2949 }
2950
2951 /****************************************************************************
2952 delete a print job
2953 Form: <W> <>
2954 ****************************************************************************/
2955
2956 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2957 char *param, int tpscnt,
2958 char *data, int tdscnt,
2959 int mdrcnt,int mprcnt,
2960 char **rdata,char **rparam,
2961 int *rdata_len,int *rparam_len)
2962 {
2963 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2964 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2965 char *str2 = skip_string(param,tpscnt,str1);
2966 char *p = skip_string(param,tpscnt,str2);
2967 uint32 jobid;
2968 int snum;
2969 fstring sharename;
2970 int errcode;
2971 WERROR werr = WERR_OK;
2972
2973 if (!str1 || !str2 || !p) {
2974 return False;
2975 }
2976 /*
2977 * We use 1 here not 2 as we're checking
2978 * the last byte we want to access is safe.
2979 */
2980 if (!is_offset_safe(param,tpscnt,p,1)) {
2981 return False;
2982 }
2983 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2984 return False;
2985
2986 /* check it's a supported varient */
2987 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2988 return(False);
2989
2990 *rparam_len = 4;
2991 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2992 if (!*rparam) {
2993 return False;
2994 }
2995 *rdata_len = 0;
2996
2997 if (!print_job_exists(sharename, jobid)) {
2998 errcode = NERR_JobNotFound;
2999 goto out;
3000 }
3001
3002 snum = lp_servicenumber( sharename);
3003 if (snum == -1) {
3004 errcode = NERR_DestNotFound;
3005 goto out;
3006 }
3007
3008 errcode = NERR_notsupported;
3009
3010 switch (function) {
3011 case 81: /* delete */
3012 if (print_job_delete(conn->server_info, snum, jobid, &werr))
3013 errcode = NERR_Success;
3014 break;
3015 case 82: /* pause */
3016 if (print_job_pause(conn->server_info, snum, jobid, &werr))
3017 errcode = NERR_Success;
3018 break;
3019 case 83: /* resume */
3020 if (print_job_resume(conn->server_info, snum, jobid, &werr))
3021 errcode = NERR_Success;
3022 break;
3023 }
3024
3025 if (!W_ERROR_IS_OK(werr))
3026 errcode = W_ERROR_V(werr);
3027
3028 out:
3029 SSVAL(*rparam,0,errcode);
3030 SSVAL(*rparam,2,0); /* converter word */
3031
3032 return(True);
3033 }
3034
3035 /****************************************************************************
3036 Purge a print queue - or pause or resume it.
3037 ****************************************************************************/
3038
3039 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
3040 char *param, int tpscnt,
3041 char *data, int tdscnt,
3042 int mdrcnt,int mprcnt,
3043 char **rdata,char **rparam,
3044 int *rdata_len,int *rparam_len)
3045 {
3046 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3047 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3048 char *str2 = skip_string(param,tpscnt,str1);
3049 char *QueueName = skip_string(param,tpscnt,str2);
3050 int errcode = NERR_notsupported;
3051 int snum;
3052 WERROR werr = WERR_OK;
3053
3054 if (!str1 || !str2 || !QueueName) {
3055 return False;
3056 }
3057
3058 /* check it's a supported varient */
3059 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3060 return(False);
3061
3062 *rparam_len = 4;
3063 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3064 if (!*rparam) {
3065 return False;
3066 }
3067 *rdata_len = 0;
3068
3069 if (skip_string(param,tpscnt,QueueName) == NULL) {
3070 return False;
3071 }
3072 snum = print_queue_snum(QueueName);
3073
3074 if (snum == -1) {
3075 errcode = NERR_JobNotFound;
3076 goto out;
3077 }
3078
3079 switch (function) {
3080 case 74: /* Pause queue */
3081 werr = print_queue_pause(conn->server_info, snum);
3082 break;
3083 case 75: /* Resume queue */
3084 werr = print_queue_resume(conn->server_info, snum);
3085 break;
3086 case 103: /* Purge */
3087 werr = print_queue_purge(conn->server_info, snum);
3088 break;
3089 default:
3090 werr = WERR_NOT_SUPPORTED;
3091 break;
3092 }
3093
3094 errcode = W_ERROR_V(werr);
3095
3096 out:
3097 SSVAL(*rparam,0,errcode);
3098 SSVAL(*rparam,2,0); /* converter word */
3099
3100 return(True);
3101 }
3102
3103 /****************************************************************************
3104 set the property of a print job (undocumented?)
3105 ? function = 0xb -> set name of print job
3106 ? function = 0x6 -> move print job up/down
3107 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3108 or <WWsTP> <WB21BB16B10zWWzDDz>
3109 ****************************************************************************/
3110
3111 static int check_printjob_info(struct pack_desc* desc,
3112 int uLevel, char* id)
3113 {
3114 desc->subformat = NULL;
3115 switch( uLevel ) {
3116 case 0: desc->format = "W"; break;
3117 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3118 case 2: desc->format = "WWzWWDDzz"; break;
3119 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3120 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3121 default:
3122 DEBUG(0,("check_printjob_info: invalid level %d\n",
3123 uLevel ));
3124 return False;
3125 }
3126 if (id == NULL || strcmp(desc->format,id) != 0) {
3127 DEBUG(0,("check_printjob_info: invalid format %s\n",
3128 id ? id : "<NULL>" ));
3129 return False;
3130 }
3131 return True;
3132 }
3133
3134 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
3135 char *param, int tpscnt,
3136 char *data, int tdscnt,
3137 int mdrcnt,int mprcnt,
3138 char **rdata,char **rparam,
3139 int *rdata_len,int *rparam_len)
3140 {
3141 struct pack_desc desc;
3142 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3143 char *str2 = skip_string(param,tpscnt,str1);
3144 char *p = skip_string(param,tpscnt,str2);
3145 uint32 jobid;
3146 fstring sharename;
3147 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3148 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3149 int place, errcode;
3150
3151 if (!str1 || !str2 || !p) {
3152 return False;
3153 }
3154 /*
3155 * We use 1 here not 2 as we're checking
3156 * the last byte we want to access is safe.
3157 */
3158 if (!is_offset_safe(param,tpscnt,p,1)) {
3159 return False;
3160 }
3161 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3162 return False;
3163 *rparam_len = 4;
3164 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3165 if (!*rparam) {
3166 return False;
3167 }
3168
3169 if (!share_defined(sharename)) {
3170 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
3171 sharename));
3172 return False;
3173 }
3174
3175 *rdata_len = 0;
3176
3177 /* check it's a supported varient */
3178 if ((strcmp(str1,"WWsTP")) ||
3179 (!check_printjob_info(&desc,uLevel,str2)))
3180 return(False);
3181
3182 if (!print_job_exists(sharename, jobid)) {
3183 errcode=NERR_JobNotFound;
3184 goto out;
3185 }
3186
3187 errcode = NERR_notsupported;
3188
3189 switch (function) {
3190 case 0x6:
3191 /* change job place in the queue,
3192 data gives the new place */
3193 place = SVAL(data,0);
3194 if (print_job_set_place(sharename, jobid, place)) {
3195 errcode=NERR_Success;
3196 }
3197 break;
3198
3199 case 0xb:
3200 /* change print job name, data gives the name */
3201 if (print_job_set_name(sharename, jobid, data)) {
3202 errcode=NERR_Success;
3203 }
3204 break;
3205
3206 default:
3207 return False;
3208 }
3209
3210 out:
3211 SSVALS(*rparam,0,errcode);
3212 SSVAL(*rparam,2,0); /* converter word */
3213
3214 return(True);
3215 }
3216
3217
3218 /****************************************************************************
3219 Get info about the server.
3220 ****************************************************************************/
3221
3222 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3223 char *param, int tpscnt,
3224 char *data, int tdscnt,
3225 int mdrcnt,int mprcnt,
3226 char **rdata,char **rparam,
3227 int *rdata_len,int *rparam_len)
3228 {
3229 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3230 char *str2 = skip_string(param,tpscnt,str1);
3231 char *p = skip_string(param,tpscnt,str2);
3232 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3233 char *p2;
3234 int struct_len;
3235
3236 if (!str1 || !str2 || !p) {
3237 return False;
3238 }
3239
3240 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3241
3242 /* check it's a supported varient */
3243 if (!prefix_ok(str1,"WrLh")) {
3244 return False;
3245 }
3246
3247 switch( uLevel ) {
3248 case 0:
3249 if (strcmp(str2,"B16") != 0) {
3250 return False;
3251 }
3252 struct_len = 16;
3253 break;
3254 case 1:
3255 if (strcmp(str2,"B16BBDz") != 0) {
3256 return False;
3257 }
3258 struct_len = 26;
3259 break;
3260 case 2:
3261 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3262 return False;
3263 }
3264 struct_len = 134;
3265 break;
3266 case 3:
3267 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3268 return False;
3269 }
3270 struct_len = 144;
3271 break;
3272 case 20:
3273 if (strcmp(str2,"DN") != 0) {
3274 return False;
3275 }
3276 struct_len = 6;
3277 break;
3278 case 50:
3279 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3280 return False;
3281 }
3282 struct_len = 42;
3283 break;
3284 default:
3285 return False;
3286 }
3287
3288 *rdata_len = mdrcnt;
3289 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3290 if (!*rdata) {
3291 return False;
3292 }
3293
3294 p = *rdata;
3295 p2 = p + struct_len;
3296 if (uLevel != 20) {
3297 srvstr_push(NULL, 0, p,global_myname(),16,
3298 STR_ASCII|STR_UPPER|STR_TERMINATE);
3299 }
3300 p += 16;
3301 if (uLevel > 0) {
3302 struct srv_info_struct *servers=NULL;
3303 int i,count;
3304 char *comment = NULL;
3305 TALLOC_CTX *ctx = talloc_tos();
3306 uint32 servertype= lp_default_server_announce();
3307
3308 comment = talloc_strdup(ctx,lp_serverstring());
3309 if (!comment) {
3310 return false;
3311 }
3312
3313 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3314 for (i=0;i<count;i++) {
3315 if (strequal(servers[i].name,global_myname())) {
3316 servertype = servers[i].type;
3317 TALLOC_FREE(comment);
3318 comment = talloc_strdup(ctx,
3319 servers[i].comment);
3320 if (comment) {
3321 return false;
3322 }
3323 }
3324 }
3325 }
3326
3327 SAFE_FREE(servers);
3328
3329 SCVAL(p,0,lp_major_announce_version());
3330 SCVAL(p,1,lp_minor_announce_version());
3331 SIVAL(p,2,servertype);
3332
3333 if (mdrcnt == struct_len) {
3334 SIVAL(p,6,0);
3335 } else {
3336 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3337 comment = talloc_sub_advanced(
3338 ctx,
3339 lp_servicename(SNUM(conn)),
3340 conn->server_info->unix_name,
3341 conn->connectpath,
3342 conn->server_info->utok.gid,
3343 conn->server_info->sanitized_username,
3344 pdb_get_domain(conn->server_info->sam_account),
3345 comment);
3346 if (comment) {
3347 return false;
3348 }
3349 if (mdrcnt - struct_len <= 0) {
3350 return false;
3351 }
3352 push_ascii(p2,
3353 comment,
3354 MIN(mdrcnt - struct_len,
3355 MAX_SERVER_STRING_LENGTH),
3356 STR_TERMINATE);
3357 p2 = skip_string(*rdata,*rdata_len,p2);
3358 if (!p2) {
3359 return False;
3360 }
3361 }
3362 }
3363
3364 if (uLevel > 1) {
3365 return False; /* not yet implemented */
3366 }
3367
3368 *rdata_len = PTR_DIFF(p2,*rdata);
3369
3370 *rparam_len = 6;
3371 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3372 if (!*rparam) {
3373 return False;
3374 }
3375 SSVAL(*rparam,0,NERR_Success);
3376 SSVAL(*rparam,2,0); /* converter word */
3377 SSVAL(*rparam,4,*rdata_len);
3378
3379 return True;
3380 }
3381
3382 /****************************************************************************
3383 Get info about the server.
3384 ****************************************************************************/
3385
3386 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3387 char *param, int tpscnt,
3388 char *data, int tdscnt,
3389 int mdrcnt,int mprcnt,
3390 char **rdata,char **rparam,
3391 int *rdata_len,int *rparam_len)
3392 {
3393 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3394 char *str2 = skip_string(param,tpscnt,str1);
3395 char *p = skip_string(param,tpscnt,str2);
3396 char *p2;
3397 char *endp;
3398 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3399
3400 if (!str1 || !str2 || !p) {
3401 return False;
3402 }
3403
3404 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3405
3406 *rparam_len = 6;
3407 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3408 if (!*rparam) {
3409 return False;
3410 }
3411
3412 /* check it's a supported varient */
3413 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3414 return False;
3415 }
3416
3417 *rdata_len = mdrcnt + 1024;
3418 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3419 if (!*rdata) {
3420 return False;
3421 }
3422
3423 SSVAL(*rparam,0,NERR_Success);
3424 SSVAL(*rparam,2,0); /* converter word */
3425
3426 p = *rdata;
3427 endp = *rdata + *rdata_len;
3428
3429 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3430 if (!p2) {
3431 return False;
3432 }
3433
3434 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3435 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3436 strupper_m(p2);
3437 p2 = skip_string(*rdata,*rdata_len,p2);
3438 if (!p2) {
3439 return False;
3440 }
3441 p += 4;
3442
3443 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3444 strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3445 p2 = skip_string(*rdata,*rdata_len,p2);
3446 if (!p2) {
3447 return False;
3448 }
3449 p += 4;
3450
3451 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3452 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3453 strupper_m(p2);
3454 p2 = skip_string(*rdata,*rdata_len,p2);
3455 if (!p2) {
3456 return False;
3457 }
3458 p += 4;
3459
3460 SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3461 SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3462 p += 2;
3463
3464 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3465 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3466 p2 = skip_string(*rdata,*rdata_len,p2);
3467 if (!p2) {
3468 return False;
3469 }
3470 p += 4;
3471
3472 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3473 strlcpy(p2,"",PTR_DIFF(endp,p2));
3474 p2 = skip_string(*rdata,*rdata_len,p2);
3475 if (!p2) {
3476 return False;
3477 }
3478 p += 4;
3479
3480 *rdata_len = PTR_DIFF(p2,*rdata);
3481
3482 SSVAL(*rparam,4,*rdata_len);
3483
3484 return True;
3485 }
3486
3487 /****************************************************************************
3488 get info about a user
3489
3490 struct user_info_11 {
3491 char usri11_name[21]; 0-20
3492 char usri11_pad; 21
3493 char *usri11_comment; 22-25
3494 char *usri11_usr_comment; 26-29
3495 unsigned short usri11_priv; 30-31
3496 unsigned long usri11_auth_flags; 32-35
3497 long usri11_password_age; 36-39
3498 char *usri11_homedir; 40-43
3499 char *usri11_parms; 44-47
3500 long usri11_last_logon; 48-51
3501 long usri11_last_logoff; 52-55
3502 unsigned short usri11_bad_pw_count; 56-57
3503 unsigned short usri11_num_logons; 58-59
3504 char *usri11_logon_server; 60-63
3505 unsigned short usri11_country_code; 64-65
3506 char *usri11_workstations; 66-69
3507 unsigned long usri11_max_storage; 70-73
3508 unsigned short usri11_units_per_week; 74-75
3509 unsigned char *usri11_logon_hours; 76-79
3510 unsigned short usri11_code_page; 80-81
3511 };
3512
3513 where:
3514
3515 usri11_name specifies the user name for which information is retrieved
3516
3517 usri11_pad aligns the next data structure element to a word boundary
3518
3519 usri11_comment is a null terminated ASCII comment
3520
3521 usri11_user_comment is a null terminated ASCII comment about the user
3522
3523 usri11_priv specifies the level of the privilege assigned to the user.
3524 The possible values are:
3525
3526 Name Value Description
3527 USER_PRIV_GUEST 0 Guest privilege
3528 USER_PRIV_USER 1 User privilege
3529 USER_PRV_ADMIN 2 Administrator privilege
3530
3531 usri11_auth_flags specifies the account operator privileges. The
3532 possible values are:
3533
3534 Name Value Description
3535 AF_OP_PRINT 0 Print operator
3536
3537
3538 Leach, Naik [Page 28]
3539 \f
3540
3541
3542 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3543
3544
3545 AF_OP_COMM 1 Communications operator
3546 AF_OP_SERVER 2 Server operator
3547 AF_OP_ACCOUNTS 3 Accounts operator
3548
3549
3550 usri11_password_age specifies how many seconds have elapsed since the
3551 password was last changed.
3552
3553 usri11_home_dir points to a null terminated ASCII string that contains
3554 the path name of the user's home directory.
3555
3556 usri11_parms points to a null terminated ASCII string that is set
3557 aside for use by applications.
3558
3559 usri11_last_logon specifies the time when the user last logged on.
3560 This value is stored as the number of seconds elapsed since
3561 00:00:00, January 1, 1970.
3562
3563 usri11_last_logoff specifies the time when the user last logged off.
3564 This value is stored as the number of seconds elapsed since
3565 00:00:00, January 1, 1970. A value of 0 means the last logoff
3566 time is unknown.
3567
3568 usri11_bad_pw_count specifies the number of incorrect passwords
3569 entered since the last successful logon.
3570
3571 usri11_log1_num_logons specifies the number of times this user has
3572 logged on. A value of -1 means the number of logons is unknown.
3573
3574 usri11_logon_server points to a null terminated ASCII string that
3575 contains the name of the server to which logon requests are sent.
3576 A null string indicates logon requests should be sent to the
3577 domain controller.
3578
3579 usri11_country_code specifies the country code for the user's language
3580 of choice.
3581
3582 usri11_workstations points to a null terminated ASCII string that
3583 contains the names of workstations the user may log on from.
3584 There may be up to 8 workstations, with the names separated by
3585 commas. A null strings indicates there are no restrictions.
3586
3587 usri11_max_storage specifies the maximum amount of disk space the user
3588 can occupy. A value of 0xffffffff indicates there are no
3589 restrictions.
3590
3591 usri11_units_per_week specifies the equal number of time units into
3592 which a week is divided. This value must be equal to 168.
3593
3594 usri11_logon_hours points to a 21 byte (168 bits) string that
3595 specifies the time during which the user can log on. Each bit
3596 represents one unique hour in a week. The first bit (bit 0, word
3597 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3598
3599
3600
3601 Leach, Naik [Page 29]
3602 \f
3603
3604
3605 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3606
3607
3608 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3609 are no restrictions.
3610
3611 usri11_code_page specifies the code page for the user's language of
3612 choice
3613
3614 All of the pointers in this data structure need to be treated
3615 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3616 to be ignored. The converter word returned in the parameters section
3617 needs to be subtracted from the lower 16 bits to calculate an offset
3618 into the return buffer where this ASCII string resides.
3619
3620 There is no auxiliary data in the response.
3621
3622 ****************************************************************************/
3623
3624 #define usri11_name 0
3625 #define usri11_pad 21
3626 #define usri11_comment 22
3627 #define usri11_usr_comment 26
3628 #define usri11_full_name 30
3629 #define usri11_priv 34
3630 #define usri11_auth_flags 36
3631 #define usri11_password_age 40
3632 #define usri11_homedir 44
3633 #define usri11_parms 48
3634 #define usri11_last_logon 52
3635 #define usri11_last_logoff 56
3636 #define usri11_bad_pw_count 60
3637 #define usri11_num_logons 62
3638 #define usri11_logon_server 64
3639 #define usri11_country_code 68
3640 #define usri11_workstations 70
3641 #define usri11_max_storage 74
3642 #define usri11_units_per_week 78
3643 #define usri11_logon_hours 80
3644 #define usri11_code_page 84
3645 #define usri11_end 86
3646
3647 #define USER_PRIV_GUEST 0
3648 #define USER_PRIV_USER 1
3649 #define USER_PRIV_ADMIN 2
3650
3651 #define AF_OP_PRINT 0
3652 #define AF_OP_COMM 1
3653 #define AF_OP_SERVER 2
3654 #define AF_OP_ACCOUNTS 3
3655
3656
3657 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3658 char *param, int tpscnt,
3659 char *data, int tdscnt,
3660 int mdrcnt,int mprcnt,
3661 char **rdata,char **rparam,
3662 int *rdata_len,int *rparam_len)
3663 {
3664 struct smbd_server_connection *sconn = smbd_server_conn;
3665 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3666 char *str2 = skip_string(param,tpscnt,str1);
3667 char *UserName = skip_string(param,tpscnt,str2);
3668 char *p = skip_string(param,tpscnt,UserName);
3669 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3670 char *p2;
3671 char *endp;
3672 const char *level_string;
3673
3674 /* get NIS home of a previously validated user - simeon */
3675 /* With share level security vuid will always be zero.
3676 Don't depend on vuser being non-null !!. JRA */
3677 user_struct *vuser = get_valid_user_struct(sconn, vuid);
3678 if(vuser != NULL) {
3679 DEBUG(3,(" Username of UID %d is %s\n",
3680 (int)vuser->server_info->utok.uid,
3681 vuser->server_info->unix_name));
3682 }
3683
3684 if (!str1 || !str2 || !UserName || !p) {
3685 return False;
3686 }
3687
3688 *rparam_len = 6;
3689 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3690 if (!*rparam) {
3691 return False;
3692 }
3693
3694 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3695
3696 /* check it's a supported variant */
3697 if (strcmp(str1,"zWrLh") != 0) {
3698 return False;
3699 }
3700 switch( uLevel ) {
3701 case 0: level_string = "B21"; break;
3702 case 1: level_string = "B21BB16DWzzWz"; break;
3703 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3704 case 10: level_string = "B21Bzzz"; break;
3705 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3706 default: return False;
3707 }
3708
3709 if (strcmp(level_string,str2) != 0) {
3710 return False;
3711 }
3712
3713 *rdata_len = mdrcnt + 1024;
3714 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3715 if (!*rdata) {
3716 return False;
3717 }
3718
3719 SSVAL(*rparam,0,NERR_Success);
3720 SSVAL(*rparam,2,0); /* converter word */
3721
3722 p = *rdata;
3723 endp = *rdata + *rdata_len;
3724 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3725 if (!p2) {
3726 return False;
3727 }
3728
3729 memset(p,0,21);
3730 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3731
3732 if (uLevel > 0) {
3733 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3734 *p2 = 0;
3735 }
3736
3737 if (uLevel >= 10) {
3738 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3739 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3740 p2 = skip_string(*rdata,*rdata_len,p2);
3741 if (!p2) {
3742 return False;
3743 }
3744
3745 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3746 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3747 p2 = skip_string(*rdata,*rdata_len,p2);
3748 if (!p2) {
3749 return False;
3750 }
3751
3752 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3753 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3754 strlcpy(p2,((vuser != NULL)
3755 ? pdb_get_fullname(vuser->server_info->sam_account)
3756 : UserName),PTR_DIFF(endp,p2));
3757 p2 = skip_string(*rdata,*rdata_len,p2);
3758 if (!p2) {
3759 return False;
3760 }
3761 }
3762
3763 if (uLevel == 11) {
3764 const char *homedir = "";
3765 if (vuser != NULL) {
3766 homedir = pdb_get_homedir(
3767 vuser->server_info->sam_account);
3768 }
3769 /* modelled after NTAS 3.51 reply */
3770 SSVAL(p,usri11_priv,
3771 (get_current_uid(conn) == sec_initial_uid())?
3772 USER_PRIV_ADMIN:USER_PRIV_USER);
3773 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
3774 SIVALS(p,usri11_password_age,-1); /* password age */
3775 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3776 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3777 p2 = skip_string(*rdata,*rdata_len,p2);
3778 if (!p2) {
3779 return False;
3780 }
3781 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3782 strlcpy(p2,"",PTR_DIFF(endp,p2));
3783 p2 = skip_string(*rdata,*rdata_len,p2);
3784 if (!p2) {
3785 return False;
3786 }
3787 SIVAL(p,usri11_last_logon,0); /* last logon */
3788 SIVAL(p,usri11_last_logoff,0); /* last logoff */
3789 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
3790 SSVALS(p,usri11_num_logons,-1); /* num logons */
3791 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3792 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3793 p2 = skip_string(*rdata,*rdata_len,p2);
3794 if (!p2) {
3795 return False;
3796 }
3797 SSVAL(p,usri11_country_code,0); /* country code */
3798
3799 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3800 strlcpy(p2,"",PTR_DIFF(endp,p2));
3801 p2 = skip_string(*rdata,*rdata_len,p2);
3802 if (!p2) {
3803 return False;
3804 }
3805
3806 SIVALS(p,usri11_max_storage,-1); /* max storage */
3807 SSVAL(p,usri11_units_per_week,168); /* units per week */
3808 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3809
3810 /* a simple way to get logon hours at all times. */
3811 memset(p2,0xff,21);
3812 SCVAL(p2,21,0); /* fix zero termination */
3813 p2 = skip_string(*rdata,*rdata_len,p2);
3814 if (!p2) {
3815 return False;
3816 }
3817
3818 SSVAL(p,usri11_code_page,0); /* code page */
3819 }
3820
3821 if (uLevel == 1 || uLevel == 2) {
3822 memset(p+22,' ',16); /* password */
3823 SIVALS(p,38,-1); /* password age */
3824 SSVAL(p,42,
3825 (get_current_uid(conn) == sec_initial_uid())?
3826 USER_PRIV_ADMIN:USER_PRIV_USER);
3827 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3828 strlcpy(p2, vuser ? pdb_get_homedir(
3829 vuser->server_info->sam_account) : "",
3830 PTR_DIFF(endp,p2));
3831 p2 = skip_string(*rdata,*rdata_len,p2);
3832 if (!p2) {
3833 return False;
3834 }
3835 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3836 *p2++ = 0;
3837 SSVAL(p,52,0); /* flags */
3838 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
3839 strlcpy(p2, vuser ? pdb_get_logon_script(
3840 vuser->server_info->sam_account) : "",
3841 PTR_DIFF(endp,p2));
3842 p2 = skip_string(*rdata,*rdata_len,p2);
3843 if (!p2) {
3844 return False;
3845 }
3846 if (uLevel == 2) {
3847 SIVAL(p,60,0); /* auth_flags */
3848 SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3849 strlcpy(p2,((vuser != NULL)
3850 ? pdb_get_fullname(vuser->server_info->sam_account)
3851 : UserName),PTR_DIFF(endp,p2));
3852 p2 = skip_string(*rdata,*rdata_len,p2);
3853 if (!p2) {
3854 return False;
3855 }
3856 SIVAL(p,68,0); /* urs_comment */
3857 SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3858 strlcpy(p2,"",PTR_DIFF(endp,p2));
3859 p2 = skip_string(*rdata,*rdata_len,p2);
3860 if (!p2) {
3861 return False;
3862 }
3863 SIVAL(p,76,0); /* workstations */
3864 SIVAL(p,80,0); /* last_logon */
3865 SIVAL(p,84,0); /* last_logoff */
3866 SIVALS(p,88,-1); /* acct_expires */
3867 SIVALS(p,92,-1); /* max_storage */
3868 SSVAL(p,96,168); /* units_per_week */
3869 SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3870 memset(p2,-1,21);
3871 p2 += 21;
3872 SSVALS(p,102,-1); /* bad_pw_count */
3873 SSVALS(p,104,-1); /* num_logons */
3874 SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3875 {
3876 TALLOC_CTX *ctx = talloc_tos();
3877 int space_rem = *rdata_len - (p2 - *rdata);
3878 char *tmp;
3879
3880 if (space_rem <= 0) {
3881 return false;
3882 }
3883 tmp = talloc_strdup(ctx, "\\\\%L");
3884 if (!tmp) {
3885 return false;
3886 }
3887 tmp = talloc_sub_basic(ctx,
3888 "",
3889 "",
3890 tmp);
3891 if (!tmp) {
3892 return false;
3893 }
3894
3895 push_ascii(p2,
3896 tmp,
3897 space_rem,
3898 STR_TERMINATE);
3899 }
3900 p2 = skip_string(*rdata,*rdata_len,p2);
3901 if (!p2) {
3902 return False;
3903 }
3904 SSVAL(p,110,49); /* country_code */
3905 SSVAL(p,112,860); /* code page */
3906 }
3907 }
3908
3909 *rdata_len = PTR_DIFF(p2,*rdata);
3910
3911 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
3912
3913 return(True);
3914 }
3915
3916 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3917 char *param, int tpscnt,
3918 char *data, int tdscnt,
3919 int mdrcnt,int mprcnt,
3920 char **rdata,char **rparam,
3921 int *rdata_len,int *rparam_len)
3922 {
3923 struct smbd_server_connection *sconn = smbd_server_conn;
3924 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3925 char *str2 = skip_string(param,tpscnt,str1);
3926 char *p = skip_string(param,tpscnt,str2);
3927 int uLevel;
3928 struct pack_desc desc;
3929 char* name;
3930 /* With share level security vuid will always be zero.
3931 Don't depend on vuser being non-null !!. JRA */
3932 user_struct *vuser = get_valid_user_struct(sconn, vuid);
3933
3934 if (!str1 || !str2 || !p) {
3935 return False;
3936 }
3937
3938 if(vuser != NULL) {
3939 DEBUG(3,(" Username of UID %d is %s\n",
3940 (int)vuser->server_info->utok.uid,
3941 vuser->server_info->unix_name));
3942 }
3943
3944 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3945 name = get_safe_str_ptr(param,tpscnt,p,2);
3946 if (!name) {
3947 return False;
3948 }
3949
3950 memset((char *)&desc,'\0',sizeof(desc));
3951
3952 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3953
3954 /* check it's a supported varient */
3955 if (strcmp(str1,"OOWb54WrLh") != 0) {
3956 return False;
3957 }
3958 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3959 return False;
3960 }
3961 if (mdrcnt > 0) {
3962 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3963 if (!*rdata) {
3964 return False;
3965 }
3966 }
3967
3968 desc.base = *rdata;
3969 desc.buflen = mdrcnt;
3970 desc.subformat = NULL;
3971 desc.format = str2;
3972
3973 if (init_package(&desc,1,0)) {
3974 PACKI(&desc,"W",0); /* code */
3975 PACKS(&desc,"B21",name); /* eff. name */
3976 PACKS(&desc,"B",""); /* pad */
3977 PACKI(&desc,"W",
3978 (get_current_uid(conn) == sec_initial_uid())?
3979 USER_PRIV_ADMIN:USER_PRIV_USER);
3980 PACKI(&desc,"D",0); /* auth flags XXX */
3981 PACKI(&desc,"W",0); /* num logons */
3982 PACKI(&desc,"W",0); /* bad pw count */
3983 PACKI(&desc,"D",0); /* last logon */
3984 PACKI(&desc,"D",-1); /* last logoff */
3985 PACKI(&desc,"D",-1); /* logoff time */
3986 PACKI(&desc,"D",-1); /* kickoff time */
3987 PACKI(&desc,"D",0); /* password age */
3988 PACKI(&desc,"D",0); /* password can change */
3989 PACKI(&desc,"D",-1); /* password must change */
3990
3991 {
3992 fstring mypath;
3993 fstrcpy(mypath,"\\\\");
3994 fstrcat(mypath,get_local_machine_name());
3995 strupper_m(mypath);
3996 PACKS(&desc,"z",mypath); /* computer */
3997 }
3998
3999 PACKS(&desc,"z",lp_workgroup());/* domain */
4000 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
4001 vuser->server_info->sam_account) : ""); /* script path */
4002 PACKI(&desc,"D",0x00000000); /* reserved */
4003 }
4004
4005 *rdata_len = desc.usedlen;
4006 *rparam_len = 6;
4007 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4008 if (!*rparam) {
4009 return False;
4010 }
4011 SSVALS(*rparam,0,desc.errcode);
4012 SSVAL(*rparam,2,0);
4013 SSVAL(*rparam,4,desc.neededlen);
4014
4015 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4016
4017 return True;
4018 }
4019
4020 /****************************************************************************
4021 api_WAccessGetUserPerms
4022 ****************************************************************************/
4023
4024 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
4025 char *param, int tpscnt,
4026 char *data, int tdscnt,
4027 int mdrcnt,int mprcnt,
4028 char **rdata,char **rparam,
4029 int *rdata_len,int *rparam_len)
4030 {
4031 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4032 char *str2 = skip_string(param,tpscnt,str1);
4033 char *user = skip_string(param,tpscnt,str2);
4034 char *resource = skip_string(param,tpscnt,user);
4035
4036 if (!str1 || !str2 || !user || !resource) {
4037 return False;
4038 }
4039
4040 if (skip_string(param,tpscnt,resource) == NULL) {
4041 return False;
4042 }
4043 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4044
4045 /* check it's a supported varient */
4046 if (strcmp(str1,"zzh") != 0) {
4047 return False;
4048 }
4049 if (strcmp(str2,"") != 0) {
4050 return False;
4051 }
4052
4053 *rparam_len = 6;
4054 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4055 if (!*rparam) {
4056 return False;
4057 }
4058 SSVALS(*rparam,0,0); /* errorcode */
4059 SSVAL(*rparam,2,0); /* converter word */
4060 SSVAL(*rparam,4,0x7f); /* permission flags */
4061
4062 return True;
4063 }
4064
4065 /****************************************************************************
4066 api_WPrintJobEnumerate
4067 ****************************************************************************/
4068
4069 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
4070 char *param, int tpscnt,
4071 char *data, int tdscnt,
4072 int mdrcnt,int mprcnt,
4073 char **rdata,char **rparam,
4074 int *rdata_len,int *rparam_len)
4075 {
4076 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4077 char *str2 = skip_string(param,tpscnt,str1);
4078 char *p = skip_string(param,tpscnt,str2);
4079 int uLevel;
4080 int count;
4081 int i;
4082 int snum;
4083 fstring sharename;
4084 uint32 jobid;
4085 struct pack_desc desc;
4086 print_queue_struct *queue=NULL;
4087 print_status_struct status;
4088 char *tmpdata=NULL;
4089
4090 if (!str1 || !str2 || !p) {
4091 return False;
4092 }
4093
4094 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4095
4096 memset((char *)&desc,'\0',sizeof(desc));
4097 memset((char *)&status,'\0',sizeof(status));
4098
4099 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4100
4101 /* check it's a supported varient */
4102 if (strcmp(str1,"WWrLh") != 0) {
4103 return False;
4104 }
4105 if (!check_printjob_info(&desc,uLevel,str2)) {
4106 return False;
4107 }
4108
4109 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4110 return False;
4111 }
4112
4113 snum = lp_servicenumber( sharename);
4114 if (snum < 0 || !VALID_SNUM(snum)) {
4115 return(False);
4116 }
4117
4118 count = print_queue_status(snum,&queue,&status);
4119 for (i = 0; i < count; i++) {
4120 if (queue[i].job == jobid) {
4121 break;
4122 }
4123 }
4124
4125 if (mdrcnt > 0) {
4126 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4127 if (!*rdata) {
4128 return False;
4129 }
4130 desc.base = *rdata;
4131 desc.buflen = mdrcnt;
4132 } else {
4133 /*
4134 * Don't return data but need to get correct length
4135 * init_package will return wrong size if buflen=0
4136 */
4137 desc.buflen = getlen(desc.format);
4138 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4139 }
4140
4141 if (init_package(&desc,1,0)) {
4142 if (i < count) {
4143 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4144 *rdata_len = desc.usedlen;
4145 } else {
4146 desc.errcode = NERR_JobNotFound;
4147 *rdata_len = 0;
4148 }
4149 }
4150
4151 *rparam_len = 6;
4152 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4153 if (!*rparam) {
4154 return False;
4155 }
4156 SSVALS(*rparam,0,desc.errcode);
4157 SSVAL(*rparam,2,0);
4158 SSVAL(*rparam,4,desc.neededlen);
4159
4160 SAFE_FREE(queue);
4161 SAFE_FREE(tmpdata);
4162
4163 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4164
4165 return True;
4166 }
4167
4168 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
4169 char *param, int tpscnt,
4170 char *data, int tdscnt,
4171 int mdrcnt,int mprcnt,
4172 char **rdata,char **rparam,
4173 int *rdata_len,int *rparam_len)
4174 {
4175 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4176 char *str2 = skip_string(param,tpscnt,str1);
4177 char *p = skip_string(param,tpscnt,str2);
4178 char *name = p;
4179 int uLevel;
4180 int count;
4181 int i, succnt=0;
4182 int snum;
4183 struct pack_desc desc;
4184 print_queue_struct *queue=NULL;
4185 print_status_struct status;
4186
4187 if (!str1 || !str2 || !p) {
4188 return False;
4189 }
4190
4191 memset((char *)&desc,'\0',sizeof(desc));
4192 memset((char *)&status,'\0',sizeof(status));
4193
4194 p = skip_string(param,tpscnt,p);
4195 if (!p) {
4196 return False;
4197 }
4198 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4199
4200 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4201
4202 /* check it's a supported variant */
4203 if (strcmp(str1,"zWrLeh") != 0) {
4204 return False;
4205 }
4206
4207 if (uLevel > 2) {
4208 return False; /* defined only for uLevel 0,1,2 */
4209 }
4210
4211 if (!check_printjob_info(&desc,uLevel,str2)) {
4212 return False;
4213 }
4214
4215 snum = find_service(name);
4216 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4217 return False;
4218 }
4219
4220 count = print_queue_status(snum,&queue,&status);
4221 if (mdrcnt > 0) {
4222 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4223 if (!*rdata) {
4224 return False;
4225 }
4226 }
4227 desc.base = *rdata;
4228 desc.buflen = mdrcnt;
4229
4230 if (init_package(&desc,count,0)) {
4231 succnt = 0;
4232 for (i = 0; i < count; i++) {
4233 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4234 if (desc.errcode == NERR_Success) {
4235 succnt = i+1;
4236 }
4237 }
4238 }
4239
4240 *rdata_len = desc.usedlen;
4241
4242 *rparam_len = 8;
4243 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4244 if (!*rparam) {
4245 return False;
4246 }
4247 SSVALS(*rparam,0,desc.errcode);
4248 SSVAL(*rparam,2,0);
4249 SSVAL(*rparam,4,succnt);
4250 SSVAL(*rparam,6,count);
4251
4252 SAFE_FREE(queue);
4253
4254 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4255
4256 return True;
4257 }
4258
4259 static int check_printdest_info(struct pack_desc* desc,
4260 int uLevel, char* id)
4261 {
4262 desc->subformat = NULL;
4263 switch( uLevel ) {
4264 case 0:
4265 desc->format = "B9";
4266 break;
4267 case 1:
4268 desc->format = "B9B21WWzW";
4269 break;
4270 case 2:
4271 desc->format = "z";
4272 break;
4273 case 3:
4274 desc->format = "zzzWWzzzWW";
4275 break;
4276 default:
4277 DEBUG(0,("check_printdest_info: invalid level %d\n",
4278 uLevel));
4279 return False;
4280 }
4281 if (id == NULL || strcmp(desc->format,id) != 0) {
4282 DEBUG(0,("check_printdest_info: invalid string %s\n",
4283 id ? id : "<NULL>" ));
4284 return False;
4285 }
4286 return True;
4287 }
4288
4289 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4290 struct pack_desc* desc)
4291 {
4292 char buf[100];
4293
4294 strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4295 buf[sizeof(buf)-1] = 0;
4296 strupper_m(buf);
4297
4298 if (uLevel <= 1) {
4299 PACKS(desc,"B9",buf); /* szName */
4300 if (uLevel == 1) {
4301 PACKS(desc,"B21",""); /* szUserName */
4302 PACKI(desc,"W",0); /* uJobId */
4303 PACKI(desc,"W",0); /* fsStatus */
4304 PACKS(desc,"z",""); /* pszStatus */
4305 PACKI(desc,"W",0); /* time */
4306 }
4307 }
4308
4309 if (uLevel == 2 || uLevel == 3) {
4310 PACKS(desc,"z",buf); /* pszPrinterName */
4311 if (uLevel == 3) {
4312 PACKS(desc,"z",""); /* pszUserName */
4313 PACKS(desc,"z",""); /* pszLogAddr */
4314 PACKI(desc,"W",0); /* uJobId */
4315 PACKI(desc,"W",0); /* fsStatus */
4316 PACKS(desc,"z",""); /* pszStatus */
4317 PACKS(desc,"z",""); /* pszComment */
4318 PACKS(desc,"z","NULL"); /* pszDrivers */
4319 PACKI(desc,"W",0); /* time */
4320 PACKI(desc,"W",0); /* pad1 */
4321 }
4322 }
4323 }
4324
4325 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4326 char *param, int tpscnt,
4327 char *data, int tdscnt,
4328 int mdrcnt,int mprcnt,
4329 char **rdata,char **rparam,
4330 int *rdata_len,int *rparam_len)
4331 {
4332 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4333 char *str2 = skip_string(param,tpscnt,str1);
4334 char *p = skip_string(param,tpscnt,str2);
4335 char* PrinterName = p;
4336 int uLevel;
4337 struct pack_desc desc;
4338 int snum;
4339 char *tmpdata=NULL;
4340
4341 if (!str1 || !str2 || !p) {
4342 return False;
4343 }
4344
4345 memset((char *)&desc,'\0',sizeof(desc));
4346
4347 p = skip_string(param,tpscnt,p);
4348 if (!p) {
4349 return False;
4350 }
4351 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4352
4353 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4354
4355 /* check it's a supported varient */
4356 if (strcmp(str1,"zWrLh") != 0) {
4357 return False;
4358 }
4359 if (!check_printdest_info(&desc,uLevel,str2)) {
4360 return False;
4361 }
4362
4363 snum = find_service(PrinterName);
4364 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4365 *rdata_len = 0;
4366 desc.errcode = NERR_DestNotFound;
4367 desc.neededlen = 0;
4368 } else {
4369 if (mdrcnt > 0) {
4370 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4371 if (!*rdata) {
4372 return False;
4373 }
4374 desc.base = *rdata;
4375 desc.buflen = mdrcnt;
4376 } else {
4377 /*
4378 * Don't return data but need to get correct length
4379 * init_package will return wrong size if buflen=0
4380 */
4381 desc.buflen = getlen(desc.format);
4382 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4383 }
4384 if (init_package(&desc,1,0)) {
4385 fill_printdest_info(conn,snum,uLevel,&desc);
4386 }
4387 *rdata_len = desc.usedlen;
4388 }
4389
4390 *rparam_len = 6;
4391 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4392 if (!*rparam) {
4393 return False;
4394 }
4395 SSVALS(*rparam,0,desc.errcode);
4396 SSVAL(*rparam,2,0);
4397 SSVAL(*rparam,4,desc.neededlen);
4398
4399 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4400 SAFE_FREE(tmpdata);
4401
4402 return True;
4403 }
4404
4405 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4406 char *param, int tpscnt,
4407 char *data, int tdscnt,
4408 int mdrcnt,int mprcnt,
4409 char **rdata,char **rparam,
4410 int *rdata_len,int *rparam_len)
4411 {
4412 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4413 char *str2 = skip_string(param,tpscnt,str1);
4414 char *p = skip_string(param,tpscnt,str2);
4415 int uLevel;
4416 int queuecnt;
4417 int i, n, succnt=0;
4418 struct pack_desc desc;
4419 int services = lp_numservices();
4420
4421 if (!str1 || !str2 || !p) {
4422 return False;
4423 }
4424
4425 memset((char *)&desc,'\0',sizeof(desc));
4426
4427 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4428
4429 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4430
4431 /* check it's a supported varient */
4432 if (strcmp(str1,"WrLeh") != 0) {
4433 return False;
4434 }
4435 if (!check_printdest_info(&desc,uLevel,str2)) {
4436 return False;
4437 }
4438
4439 queuecnt = 0;
4440 for (i = 0; i < services; i++) {
4441 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4442 queuecnt++;
4443 }
4444 }
4445
4446 if (mdrcnt > 0) {
4447 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4448 if (!*rdata) {
4449 return False;
4450 }
4451 }
4452
4453 desc.base = *rdata;
4454 desc.buflen = mdrcnt;
4455 if (init_package(&desc,queuecnt,0)) {
4456 succnt = 0;
4457 n = 0;
4458 for (i = 0; i < services; i++) {
4459 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4460 fill_printdest_info(conn,i,uLevel,&desc);
4461 n++;
4462 if (desc.errcode == NERR_Success) {
4463 succnt = n;
4464 }
4465 }
4466 }
4467 }
4468
4469 *rdata_len = desc.usedlen;
4470
4471 *rparam_len = 8;
4472 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4473 if (!*rparam) {
4474 return False;
4475 }
4476 SSVALS(*rparam,0,desc.errcode);
4477 SSVAL(*rparam,2,0);
4478 SSVAL(*rparam,4,succnt);
4479 SSVAL(*rparam,6,queuecnt);
4480
4481 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4482
4483 return True;
4484 }
4485
4486 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4487 char *param, int tpscnt,
4488 char *data, int tdscnt,
4489 int mdrcnt,int mprcnt,
4490 char **rdata,char **rparam,
4491 int *rdata_len,int *rparam_len)
4492 {
4493 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4494 char *str2 = skip_string(param,tpscnt,str1);
4495 char *p = skip_string(param,tpscnt,str2);
4496 int uLevel;
4497 int succnt;
4498 struct pack_desc desc;
4499
4500 if (!str1 || !str2 || !p) {
4501 return False;
4502 }
4503
4504 memset((char *)&desc,'\0',sizeof(desc));
4505
4506 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4507
4508 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4509
4510 /* check it's a supported varient */
4511 if (strcmp(str1,"WrLeh") != 0) {
4512 return False;
4513 }
4514 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4515 return False;
4516 }
4517
4518 if (mdrcnt > 0) {
4519 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4520 if (!*rdata) {
4521 return False;
4522 }
4523 }
4524 desc.base = *rdata;
4525 desc.buflen = mdrcnt;
4526 if (init_package(&desc,1,0)) {
4527 PACKS(&desc,"B41","NULL");
4528 }
4529
4530 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4531
4532 *rdata_len = desc.usedlen;
4533
4534 *rparam_len = 8;
4535 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4536 if (!*rparam) {
4537 return False;
4538 }
4539 SSVALS(*rparam,0,desc.errcode);
4540 SSVAL(*rparam,2,0);
4541 SSVAL(*rparam,4,succnt);
4542 SSVAL(*rparam,6,1);
4543
4544 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4545
4546 return True;
4547 }
4548
4549 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4550 char *param, int tpscnt,
4551 char *data, int tdscnt,
4552 int mdrcnt,int mprcnt,
4553 char **rdata,char **rparam,
4554 int *rdata_len,int *rparam_len)
4555 {
4556 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4557 char *str2 = skip_string(param,tpscnt,str1);
4558 char *p = skip_string(param,tpscnt,str2);
4559 int uLevel;
4560 int succnt;
4561 struct pack_desc desc;
4562
4563 if (!str1 || !str2 || !p) {
4564 return False;
4565 }
4566 memset((char *)&desc,'\0',sizeof(desc));
4567
4568 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4569
4570 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4571
4572 /* check it's a supported varient */
4573 if (strcmp(str1,"WrLeh") != 0) {
4574 return False;
4575 }
4576 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4577 return False;
4578 }
4579
4580 if (mdrcnt > 0) {
4581 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4582 if (!*rdata) {
4583 return False;
4584 }
4585 }
4586 desc.base = *rdata;
4587 desc.buflen = mdrcnt;
4588 desc.format = str2;
4589 if (init_package(&desc,1,0)) {
4590 PACKS(&desc,"B13","lpd");
4591 }
4592
4593 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4594
4595 *rdata_len = desc.usedlen;
4596
4597 *rparam_len = 8;
4598 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4599 if (!*rparam) {
4600 return False;
4601 }
4602 SSVALS(*rparam,0,desc.errcode);
4603 SSVAL(*rparam,2,0);
4604 SSVAL(*rparam,4,succnt);
4605 SSVAL(*rparam,6,1);
4606
4607 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4608
4609 return True;
4610 }
4611
4612 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4613 char *param, int tpscnt,
4614 char *data, int tdscnt,
4615 int mdrcnt,int mprcnt,
4616 char **rdata,char **rparam,
4617 int *rdata_len,int *rparam_len)
4618 {
4619 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4620 char *str2 = skip_string(param,tpscnt,str1);
4621 char *p = skip_string(param,tpscnt,str2);
4622 int uLevel;
4623 int succnt;
4624 struct pack_desc desc;
4625
4626 if (!str1 || !str2 || !p) {
4627 return False;
4628 }
4629
4630 memset((char *)&desc,'\0',sizeof(desc));
4631
4632 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4633
4634 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4635
4636 /* check it's a supported varient */
4637 if (strcmp(str1,"WrLeh") != 0) {
4638 return False;
4639 }
4640 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4641 return False;
4642 }
4643
4644 if (mdrcnt > 0) {
4645 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4646 if (!*rdata) {
4647 return False;
4648 }
4649 }
4650 memset((char *)&desc,'\0',sizeof(desc));
4651 desc.base = *rdata;
4652 desc.buflen = mdrcnt;
4653 desc.format = str2;
4654 if (init_package(&desc,1,0)) {
4655 PACKS(&desc,"B13","lp0");
4656 }
4657
4658 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4659
4660 *rdata_len = desc.usedlen;
4661
4662 *rparam_len = 8;
4663 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4664 if (!*rparam) {
4665 return False;
4666 }
4667 SSVALS(*rparam,0,desc.errcode);
4668 SSVAL(*rparam,2,0);
4669 SSVAL(*rparam,4,succnt);
4670 SSVAL(*rparam,6,1);
4671
4672 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4673
4674 return True;
4675 }
4676
4677 /****************************************************************************
4678 List open sessions
4679 ****************************************************************************/
4680
4681 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4682 char *param, int tpscnt,
4683 char *data, int tdscnt,
4684 int mdrcnt,int mprcnt,
4685 char **rdata,char **rparam,
4686 int *rdata_len,int *rparam_len)
4687
4688 {
4689 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4690 char *str2 = skip_string(param,tpscnt,str1);
4691 char *p = skip_string(param,tpscnt,str2);
4692 int uLevel;
4693 struct pack_desc desc;
4694 struct sessionid *session_list;
4695 int i, num_sessions;
4696
4697 if (!str1 || !str2 || !p) {
4698 return False;
4699 }
4700
4701 memset((char *)&desc,'\0',sizeof(desc));
4702
4703 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4704
4705 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4706 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4707 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4708
4709 /* check it's a supported varient */
4710 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4711 return False;
4712 }
4713 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4714 return False;
4715 }
4716
4717 num_sessions = list_sessions(talloc_tos(), &session_list);
4718
4719 if (mdrcnt > 0) {
4720 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4721 if (!*rdata) {
4722 return False;
4723 }
4724 }
4725 memset((char *)&desc,'\0',sizeof(desc));
4726 desc.base = *rdata;
4727 desc.buflen = mdrcnt;
4728 desc.format = str2;
4729 if (!init_package(&desc,num_sessions,0)) {
4730 return False;
4731 }
4732
4733 for(i=0; i<num_sessions; i++) {
4734 PACKS(&desc, "z", session_list[i].remote_machine);
4735 PACKS(&desc, "z", session_list[i].username);
4736 PACKI(&desc, "W", 1); /* num conns */
4737 PACKI(&desc, "W", 0); /* num opens */
4738 PACKI(&desc, "W", 1); /* num users */
4739 PACKI(&desc, "D", 0); /* session time */
4740 PACKI(&desc, "D", 0); /* idle time */
4741 PACKI(&desc, "D", 0); /* flags */
4742 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4743 }
4744
4745 *rdata_len = desc.usedlen;
4746
4747 *rparam_len = 8;
4748 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4749 if (!*rparam) {
4750 return False;
4751 }
4752 SSVALS(*rparam,0,desc.errcode);
4753 SSVAL(*rparam,2,0); /* converter */
4754 SSVAL(*rparam,4,num_sessions); /* count */
4755
4756 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4757
4758 return True;
4759 }
4760
4761
4762 /****************************************************************************
4763 The buffer was too small.
4764 ****************************************************************************/
4765
4766 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4767 int mdrcnt, int mprcnt,
4768 char **rdata, char **rparam,
4769 int *rdata_len, int *rparam_len)
4770 {
4771 *rparam_len = MIN(*rparam_len,mprcnt);
4772 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4773 if (!*rparam) {
4774 return False;
4775 }
4776
4777 *rdata_len = 0;
4778
4779 SSVAL(*rparam,0,NERR_BufTooSmall);
4780
4781 DEBUG(3,("Supplied buffer too small in API command\n"));
4782
4783 return True;
4784 }
4785
4786 /****************************************************************************
4787 The request is not supported.
4788 ****************************************************************************/
4789
4790 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4791 char *param, int tpscnt,
4792 char *data, int tdscnt,
4793 int mdrcnt, int mprcnt,
4794 char **rdata, char **rparam,
4795 int *rdata_len, int *rparam_len)
4796 {
4797 *rparam_len = 4;
4798 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4799 if (!*rparam) {
4800 return False;
4801 }
4802
4803 *rdata_len = 0;
4804
4805 SSVAL(*rparam,0,NERR_notsupported);
4806 SSVAL(*rparam,2,0); /* converter word */
4807
4808 DEBUG(3,("Unsupported API command\n"));
4809
4810 return True;
4811 }
4812
4813 static const struct {
4814 const char *name;
4815 int id;
4816 bool (*fn)(connection_struct *, uint16,
4817 char *, int,
4818 char *, int,
4819 int,int,char **,char **,int *,int *);
4820 bool auth_user; /* Deny anonymous access? */
4821 } api_commands[] = {
4822 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
4823 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
4824 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
4825 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
4826 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
4827 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
4828 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
4829 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
4830 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
4831 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
4832 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
4833 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
4834 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
4835 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
4836 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
4837 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
4838 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
4839 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
4840 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
4841 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
4842 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
4843 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
4844 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
4845 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
4846 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
4847 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
4848 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4849 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
4850 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
4851 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
4852 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
4853 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4854 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
4855 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4856 {NULL, -1, api_Unsupported}
4857 /* The following RAP calls are not implemented by Samba:
4858
4859 RAP_WFileEnum2 - anon not OK
4860 */
4861 };
4862
4863
4864 /****************************************************************************
4865 Handle remote api calls.
4866 ****************************************************************************/
4867
4868 void api_reply(connection_struct *conn, uint16 vuid,
4869 struct smb_request *req,
4870 char *data, char *params,
4871 int tdscnt, int tpscnt,
4872 int mdrcnt, int mprcnt)
4873 {
4874 struct smbd_server_connection *sconn = smbd_server_conn;
4875 int api_command;
4876 char *rdata = NULL;
4877 char *rparam = NULL;
4878 const char *name1 = NULL;
4879 const char *name2 = NULL;
4880 int rdata_len = 0;
4881 int rparam_len = 0;
4882 bool reply=False;
4883 int i;
4884
4885 if (!params) {
4886 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4887 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4888 return;
4889 }
4890
4891 if (tpscnt < 2) {
4892 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4893 return;
4894 }
4895 api_command = SVAL(params,0);
4896 /* Is there a string at position params+2 ? */
4897 if (skip_string(params,tpscnt,params+2)) {
4898 name1 = params + 2;
4899 } else {
4900 name1 = "";
4901 }
4902 name2 = skip_string(params,tpscnt,params+2);
4903 if (!name2) {
4904 name2 = "";
4905 }
4906
4907 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4908 api_command,
4909 name1,
4910 name2,
4911 tdscnt,tpscnt,mdrcnt,mprcnt));
4912
4913 for (i=0;api_commands[i].name;i++) {
4914 if (api_commands[i].id == api_command && api_commands[i].fn) {
4915 DEBUG(3,("Doing %s\n",api_commands[i].name));
4916 break;
4917 }
4918 }
4919
4920 /* Check whether this api call can be done anonymously */
4921
4922 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4923 user_struct *user = get_valid_user_struct(sconn, vuid);
4924
4925 if (!user || user->server_info->guest) {
4926 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4927 return;
4928 }
4929 }
4930
4931 rdata = (char *)SMB_MALLOC(1024);
4932 if (rdata) {
4933 memset(rdata,'\0',1024);
4934 }
4935
4936 rparam = (char *)SMB_MALLOC(1024);
4937 if (rparam) {
4938 memset(rparam,'\0',1024);
4939 }
4940
4941 if(!rdata || !rparam) {
4942 DEBUG(0,("api_reply: malloc fail !\n"));
4943 SAFE_FREE(rdata);
4944 SAFE_FREE(rparam);
4945 reply_nterror(req, NT_STATUS_NO_MEMORY);
4946 return;
4947 }
4948
4949 reply = api_commands[i].fn(conn,
4950 vuid,
4951 params,tpscnt, /* params + length */
4952 data,tdscnt, /* data + length */
4953 mdrcnt,mprcnt,
4954 &rdata,&rparam,&rdata_len,&rparam_len);
4955
4956
4957 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4958 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4959 &rdata,&rparam,&rdata_len,&rparam_len);
4960 }
4961
4962 /* if we get False back then it's actually unsupported */
4963 if (!reply) {
4964 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4965 &rdata,&rparam,&rdata_len,&rparam_len);
4966 }
4967
4968 /* If api_Unsupported returns false we can't return anything. */
4969 if (reply) {
4970 send_trans_reply(conn, req, rparam, rparam_len,
4971 rdata, rdata_len, False);
4972 }
4973
4974 SAFE_FREE(rdata);
4975 SAFE_FREE(rparam);
4976 return;
4977 }
Eduardo's samba4 branches