?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3/docs: Fix typo.
[Samba/gebeck_regimport.git] / source3 / smbd / lanman.c
blob88ac096c82b546591771b80fa7ecf3bf8ca5a088
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/globals.h"
30
31 #ifdef CHECK_TYPES
32 #undef CHECK_TYPES
33 #endif
34 #define CHECK_TYPES 0
35
36 #define NERR_Success 0
37 #define NERR_badpass 86
38 #define NERR_notsupported 50
39
40 #define NERR_BASE (2100)
41 #define NERR_BufTooSmall (NERR_BASE+23)
42 #define NERR_JobNotFound (NERR_BASE+51)
43 #define NERR_DestNotFound (NERR_BASE+52)
44
45 #define ACCESS_READ 0x01
46 #define ACCESS_WRITE 0x02
47 #define ACCESS_CREATE 0x04
48
49 #define SHPWLEN 8 /* share password length */
50
51 /* Limit size of ipc replies */
52
53 static char *smb_realloc_limit(void *ptr, size_t size)
54 {
55 char *val;
56
57 size = MAX((size),4*1024);
58 val = (char *)SMB_REALLOC(ptr,size);
59 if (val) {
60 memset(val,'\0',size);
61 }
62 return val;
63 }
64
65 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
66 char *param, int tpscnt,
67 char *data, int tdscnt,
68 int mdrcnt, int mprcnt,
69 char **rdata, char **rparam,
70 int *rdata_len, int *rparam_len);
71
72 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
73 int mdrcnt, int mprcnt,
74 char **rdata, char **rparam,
75 int *rdata_len, int *rparam_len);
76
77
78 static int CopyExpanded(connection_struct *conn,
79 int snum, char **dst, char *src, int *p_space_remaining)
80 {
81 TALLOC_CTX *ctx = talloc_tos();
82 char *buf = NULL;
83 int l;
84
85 if (!src || !dst || !p_space_remaining || !(*dst) ||
86 *p_space_remaining <= 0) {
87 return 0;
88 }
89
90 buf = talloc_strdup(ctx, src);
91 if (!buf) {
92 *p_space_remaining = 0;
93 return 0;
94 }
95 buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
96 if (!buf) {
97 *p_space_remaining = 0;
98 return 0;
99 }
100 buf = talloc_sub_advanced(ctx,
101 lp_servicename(SNUM(conn)),
102 conn->server_info->unix_name,
103 conn->connectpath,
104 conn->server_info->utok.gid,
105 conn->server_info->sanitized_username,
106 pdb_get_domain(conn->server_info->sam_account),
107 buf);
108 if (!buf) {
109 *p_space_remaining = 0;
110 return 0;
111 }
112 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
113 if (l == -1) {
114 return 0;
115 }
116 (*dst) += l;
117 (*p_space_remaining) -= l;
118 return l;
119 }
120
121 static int CopyAndAdvance(char **dst, char *src, int *n)
122 {
123 int l;
124 if (!src || !dst || !n || !(*dst)) {
125 return 0;
126 }
127 l = push_ascii(*dst,src,*n, STR_TERMINATE);
128 if (l == -1) {
129 return 0;
130 }
131 (*dst) += l;
132 (*n) -= l;
133 return l;
134 }
135
136 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
137 {
138 TALLOC_CTX *ctx = talloc_tos();
139 char *buf = NULL;
140 if (!s) {
141 return 0;
142 }
143 buf = talloc_strdup(ctx,s);
144 if (!buf) {
145 return 0;
146 }
147 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
148 if (!buf) {
149 return 0;
150 }
151 buf = talloc_sub_advanced(ctx,
152 lp_servicename(SNUM(conn)),
153 conn->server_info->unix_name,
154 conn->connectpath,
155 conn->server_info->utok.gid,
156 conn->server_info->sanitized_username,
157 pdb_get_domain(conn->server_info->sam_account),
158 buf);
159 if (!buf) {
160 return 0;
161 }
162 return strlen(buf) + 1;
163 }
164
165 static char *Expand(connection_struct *conn, int snum, char *s)
166 {
167 TALLOC_CTX *ctx = talloc_tos();
168 char *buf = NULL;
169
170 if (!s) {
171 return NULL;
172 }
173 buf = talloc_strdup(ctx,s);
174 if (!buf) {
175 return 0;
176 }
177 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
178 if (!buf) {
179 return 0;
180 }
181 return talloc_sub_advanced(ctx,
182 lp_servicename(SNUM(conn)),
183 conn->server_info->unix_name,
184 conn->connectpath,
185 conn->server_info->utok.gid,
186 conn->server_info->sanitized_username,
187 pdb_get_domain(conn->server_info->sam_account),
188 buf);
189 }
190
191 /*******************************************************************
192 Check a API string for validity when we only need to check the prefix.
193 ******************************************************************/
194
195 static bool prefix_ok(const char *str, const char *prefix)
196 {
197 return(strncmp(str,prefix,strlen(prefix)) == 0);
198 }
199
200 struct pack_desc {
201 const char *format; /* formatstring for structure */
202 const char *subformat; /* subformat for structure */
203 char *base; /* baseaddress of buffer */
204 int buflen; /* remaining size for fixed part; on init: length of base */
205 int subcount; /* count of substructures */
206 char *structbuf; /* pointer into buffer for remaining fixed part */
207 int stringlen; /* remaining size for variable part */
208 char *stringbuf; /* pointer into buffer for remaining variable part */
209 int neededlen; /* total needed size */
210 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
211 const char *curpos; /* current position; pointer into format or subformat */
212 int errcode;
213 };
214
215 static int get_counter(const char **p)
216 {
217 int i, n;
218 if (!p || !(*p)) {
219 return 1;
220 }
221 if (!isdigit((int)**p)) {
222 return 1;
223 }
224 for (n = 0;;) {
225 i = **p;
226 if (isdigit(i)) {
227 n = 10 * n + (i - '0');
228 } else {
229 return n;
230 }
231 (*p)++;
232 }
233 }
234
235 static int getlen(const char *p)
236 {
237 int n = 0;
238 if (!p) {
239 return 0;
240 }
241
242 while (*p) {
243 switch( *p++ ) {
244 case 'W': /* word (2 byte) */
245 n += 2;
246 break;
247 case 'K': /* status word? (2 byte) */
248 n += 2;
249 break;
250 case 'N': /* count of substructures (word) at end */
251 n += 2;
252 break;
253 case 'D': /* double word (4 byte) */
254 case 'z': /* offset to zero terminated string (4 byte) */
255 case 'l': /* offset to user data (4 byte) */
256 n += 4;
257 break;
258 case 'b': /* offset to data (with counter) (4 byte) */
259 n += 4;
260 get_counter(&p);
261 break;
262 case 'B': /* byte (with optional counter) */
263 n += get_counter(&p);
264 break;
265 }
266 }
267 return n;
268 }
269
270 static bool init_package(struct pack_desc *p, int count, int subcount)
271 {
272 int n = p->buflen;
273 int i;
274
275 if (!p->format || !p->base) {
276 return False;
277 }
278
279 i = count * getlen(p->format);
280 if (p->subformat) {
281 i += subcount * getlen(p->subformat);
282 }
283 p->structbuf = p->base;
284 p->neededlen = 0;
285 p->usedlen = 0;
286 p->subcount = 0;
287 p->curpos = p->format;
288 if (i > n) {
289 p->neededlen = i;
290 i = n = 0;
291 #if 0
292 /*
293 * This is the old error code we used. Aparently
294 * WinNT/2k systems return ERRbuftoosmall (2123) and
295 * OS/2 needs this. I'm leaving this here so we can revert
296 * if needed. JRA.
297 */
298 p->errcode = ERRmoredata;
299 #else
300 p->errcode = ERRbuftoosmall;
301 #endif
302 } else {
303 p->errcode = NERR_Success;
304 }
305 p->buflen = i;
306 n -= i;
307 p->stringbuf = p->base + i;
308 p->stringlen = n;
309 return (p->errcode == NERR_Success);
310 }
311
312 static int package(struct pack_desc *p, ...)
313 {
314 va_list args;
315 int needed=0, stringneeded;
316 const char *str=NULL;
317 int is_string=0, stringused;
318 int32 temp;
319
320 va_start(args,p);
321
322 if (!*p->curpos) {
323 if (!p->subcount) {
324 p->curpos = p->format;
325 } else {
326 p->curpos = p->subformat;
327 p->subcount--;
328 }
329 }
330 #if CHECK_TYPES
331 str = va_arg(args,char*);
332 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
333 #endif
334 stringneeded = -1;
335
336 if (!p->curpos) {
337 va_end(args);
338 return 0;
339 }
340
341 switch( *p->curpos++ ) {
342 case 'W': /* word (2 byte) */
343 needed = 2;
344 temp = va_arg(args,int);
345 if (p->buflen >= needed) {
346 SSVAL(p->structbuf,0,temp);
347 }
348 break;
349 case 'K': /* status word? (2 byte) */
350 needed = 2;
351 temp = va_arg(args,int);
352 if (p->buflen >= needed) {
353 SSVAL(p->structbuf,0,temp);
354 }
355 break;
356 case 'N': /* count of substructures (word) at end */
357 needed = 2;
358 p->subcount = va_arg(args,int);
359 if (p->buflen >= needed) {
360 SSVAL(p->structbuf,0,p->subcount);
361 }
362 break;
363 case 'D': /* double word (4 byte) */
364 needed = 4;
365 temp = va_arg(args,int);
366 if (p->buflen >= needed) {
367 SIVAL(p->structbuf,0,temp);
368 }
369 break;
370 case 'B': /* byte (with optional counter) */
371 needed = get_counter(&p->curpos);
372 {
373 char *s = va_arg(args,char*);
374 if (p->buflen >= needed) {
375 StrnCpy(p->structbuf,s?s:"",needed-1);
376 }
377 }
378 break;
379 case 'z': /* offset to zero terminated string (4 byte) */
380 str = va_arg(args,char*);
381 stringneeded = (str ? strlen(str)+1 : 0);
382 is_string = 1;
383 break;
384 case 'l': /* offset to user data (4 byte) */
385 str = va_arg(args,char*);
386 stringneeded = va_arg(args,int);
387 is_string = 0;
388 break;
389 case 'b': /* offset to data (with counter) (4 byte) */
390 str = va_arg(args,char*);
391 stringneeded = get_counter(&p->curpos);
392 is_string = 0;
393 break;
394 }
395
396 va_end(args);
397 if (stringneeded >= 0) {
398 needed = 4;
399 if (p->buflen >= needed) {
400 stringused = stringneeded;
401 if (stringused > p->stringlen) {
402 stringused = (is_string ? p->stringlen : 0);
403 if (p->errcode == NERR_Success) {
404 p->errcode = ERRmoredata;
405 }
406 }
407 if (!stringused) {
408 SIVAL(p->structbuf,0,0);
409 } else {
410 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
411 memcpy(p->stringbuf,str?str:"",stringused);
412 if (is_string) {
413 p->stringbuf[stringused-1] = '\0';
414 }
415 p->stringbuf += stringused;
416 p->stringlen -= stringused;
417 p->usedlen += stringused;
418 }
419 }
420 p->neededlen += stringneeded;
421 }
422
423 p->neededlen += needed;
424 if (p->buflen >= needed) {
425 p->structbuf += needed;
426 p->buflen -= needed;
427 p->usedlen += needed;
428 } else {
429 if (p->errcode == NERR_Success) {
430 p->errcode = ERRmoredata;
431 }
432 }
433 return 1;
434 }
435
436 #if CHECK_TYPES
437 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
438 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
439 #else
440 #define PACK(desc,t,v) package(desc,v)
441 #define PACKl(desc,t,v,l) package(desc,v,l)
442 #endif
443
444 static void PACKI(struct pack_desc* desc, const char *t,int v)
445 {
446 PACK(desc,t,v);
447 }
448
449 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
450 {
451 PACK(desc,t,v);
452 }
453
454 /****************************************************************************
455 Get a print queue.
456 ****************************************************************************/
457
458 static void PackDriverData(struct pack_desc* desc)
459 {
460 char drivdata[4+4+32];
461 SIVAL(drivdata,0,sizeof drivdata); /* cb */
462 SIVAL(drivdata,4,1000); /* lVersion */
463 memset(drivdata+8,0,32); /* szDeviceName */
464 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
465 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
466 }
467
468 static int check_printq_info(struct pack_desc* desc,
469 unsigned int uLevel, char *id1, char *id2)
470 {
471 desc->subformat = NULL;
472 switch( uLevel ) {
473 case 0:
474 desc->format = "B13";
475 break;
476 case 1:
477 desc->format = "B13BWWWzzzzzWW";
478 break;
479 case 2:
480 desc->format = "B13BWWWzzzzzWN";
481 desc->subformat = "WB21BB16B10zWWzDDz";
482 break;
483 case 3:
484 desc->format = "zWWWWzzzzWWzzl";
485 break;
486 case 4:
487 desc->format = "zWWWWzzzzWNzzl";
488 desc->subformat = "WWzWWDDzz";
489 break;
490 case 5:
491 desc->format = "z";
492 break;
493 case 51:
494 desc->format = "K";
495 break;
496 case 52:
497 desc->format = "WzzzzzzzzN";
498 desc->subformat = "z";
499 break;
500 default:
501 DEBUG(0,("check_printq_info: invalid level %d\n",
502 uLevel ));
503 return False;
504 }
505 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
506 DEBUG(0,("check_printq_info: invalid format %s\n",
507 id1 ? id1 : "<NULL>" ));
508 return False;
509 }
510 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
511 DEBUG(0,("check_printq_info: invalid subformat %s\n",
512 id2 ? id2 : "<NULL>" ));
513 return False;
514 }
515 return True;
516 }
517
518
519 #define RAP_JOB_STATUS_QUEUED 0
520 #define RAP_JOB_STATUS_PAUSED 1
521 #define RAP_JOB_STATUS_SPOOLING 2
522 #define RAP_JOB_STATUS_PRINTING 3
523 #define RAP_JOB_STATUS_PRINTED 4
524
525 #define RAP_QUEUE_STATUS_PAUSED 1
526 #define RAP_QUEUE_STATUS_ERROR 2
527
528 /* turn a print job status into a on the wire status
529 */
530 static int printj_status(int v)
531 {
532 switch (v) {
533 case LPQ_QUEUED:
534 return RAP_JOB_STATUS_QUEUED;
535 case LPQ_PAUSED:
536 return RAP_JOB_STATUS_PAUSED;
537 case LPQ_SPOOLING:
538 return RAP_JOB_STATUS_SPOOLING;
539 case LPQ_PRINTING:
540 return RAP_JOB_STATUS_PRINTING;
541 }
542 return 0;
543 }
544
545 /* turn a print queue status into a on the wire status
546 */
547 static int printq_status(int v)
548 {
549 switch (v) {
550 case LPQ_QUEUED:
551 return 0;
552 case LPQ_PAUSED:
553 return RAP_QUEUE_STATUS_PAUSED;
554 }
555 return RAP_QUEUE_STATUS_ERROR;
556 }
557
558 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
559 struct pack_desc *desc,
560 print_queue_struct *queue, int n)
561 {
562 time_t t = queue->time;
563
564 /* the client expects localtime */
565 t -= get_time_zone(t);
566
567 PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
568 if (uLevel == 1) {
569 PACKS(desc,"B21",queue->fs_user); /* szUserName */
570 PACKS(desc,"B",""); /* pad */
571 PACKS(desc,"B16",""); /* szNotifyName */
572 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
573 PACKS(desc,"z",""); /* pszParms */
574 PACKI(desc,"W",n+1); /* uPosition */
575 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
576 PACKS(desc,"z",""); /* pszStatus */
577 PACKI(desc,"D",t); /* ulSubmitted */
578 PACKI(desc,"D",queue->size); /* ulSize */
579 PACKS(desc,"z",queue->fs_file); /* pszComment */
580 }
581 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
582 PACKI(desc,"W",queue->priority); /* uPriority */
583 PACKS(desc,"z",queue->fs_user); /* pszUserName */
584 PACKI(desc,"W",n+1); /* uPosition */
585 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
586 PACKI(desc,"D",t); /* ulSubmitted */
587 PACKI(desc,"D",queue->size); /* ulSize */
588 PACKS(desc,"z","Samba"); /* pszComment */
589 PACKS(desc,"z",queue->fs_file); /* pszDocument */
590 if (uLevel == 3) {
591 PACKS(desc,"z",""); /* pszNotifyName */
592 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
593 PACKS(desc,"z",""); /* pszParms */
594 PACKS(desc,"z",""); /* pszStatus */
595 PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
596 PACKS(desc,"z","lpd"); /* pszQProcName */
597 PACKS(desc,"z",""); /* pszQProcParms */
598 PACKS(desc,"z","NULL"); /* pszDriverName */
599 PackDriverData(desc); /* pDriverData */
600 PACKS(desc,"z",""); /* pszPrinterName */
601 } else if (uLevel == 4) { /* OS2 */
602 PACKS(desc,"z",""); /* pszSpoolFileName */
603 PACKS(desc,"z",""); /* pszPortName */
604 PACKS(desc,"z",""); /* pszStatus */
605 PACKI(desc,"D",0); /* ulPagesSpooled */
606 PACKI(desc,"D",0); /* ulPagesSent */
607 PACKI(desc,"D",0); /* ulPagesPrinted */
608 PACKI(desc,"D",0); /* ulTimePrinted */
609 PACKI(desc,"D",0); /* ulExtendJobStatus */
610 PACKI(desc,"D",0); /* ulStartPage */
611 PACKI(desc,"D",0); /* ulEndPage */
612 }
613 }
614 }
615
616 /********************************************************************
617 Return a driver name given an snum.
618 Returns True if from tdb, False otherwise.
619 ********************************************************************/
620
621 static bool get_driver_name(int snum, char **pp_drivername)
622 {
623 NT_PRINTER_INFO_LEVEL *info = NULL;
624 bool in_tdb = false;
625
626 get_a_printer (NULL, &info, 2, lp_servicename(snum));
627 if (info != NULL) {
628 *pp_drivername = talloc_strdup(talloc_tos(),
629 info->info_2->drivername);
630 in_tdb = true;
631 free_a_printer(&info, 2);
632 if (!*pp_drivername) {
633 return false;
634 }
635 }
636
637 return in_tdb;
638 }
639
640 /********************************************************************
641 Respond to the DosPrintQInfo command with a level of 52
642 This is used to get printer driver information for Win9x clients
643 ********************************************************************/
644 static void fill_printq_info_52(connection_struct *conn, int snum,
645 struct pack_desc* desc, int count )
646 {
647 int i;
648 fstring location;
649 NT_PRINTER_DRIVER_INFO_LEVEL driver;
650 NT_PRINTER_INFO_LEVEL *printer = NULL;
651
652 ZERO_STRUCT(driver);
653
654 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
655 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
656 lp_servicename(snum)));
657 goto err;
658 }
659
660 if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
661 "Windows 4.0", 0)) )
662 {
663 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
664 printer->info_2->drivername));
665 goto err;
666 }
667
668 trim_string(driver.info_3->driverpath, "\\print$\\WIN40\\0\\", 0);
669 trim_string(driver.info_3->datafile, "\\print$\\WIN40\\0\\", 0);
670 trim_string(driver.info_3->helpfile, "\\print$\\WIN40\\0\\", 0);
671
672 PACKI(desc, "W", 0x0400); /* don't know */
673 PACKS(desc, "z", driver.info_3->name); /* long printer name */
674 PACKS(desc, "z", driver.info_3->driverpath); /* Driverfile Name */
675 PACKS(desc, "z", driver.info_3->datafile); /* Datafile name */
676 PACKS(desc, "z", driver.info_3->monitorname); /* language monitor */
677
678 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
679 standard_sub_basic( "", "", location, sizeof(location)-1 );
680 PACKS(desc,"z", location); /* share to retrieve files */
681
682 PACKS(desc,"z", driver.info_3->defaultdatatype); /* default data type */
683 PACKS(desc,"z", driver.info_3->helpfile); /* helpfile name */
684 PACKS(desc,"z", driver.info_3->driverpath); /* driver name */
685
686 DEBUG(3,("Printer Driver Name: %s:\n",driver.info_3->name));
687 DEBUG(3,("Driver: %s:\n",driver.info_3->driverpath));
688 DEBUG(3,("Data File: %s:\n",driver.info_3->datafile));
689 DEBUG(3,("Language Monitor: %s:\n",driver.info_3->monitorname));
690 DEBUG(3,("Driver Location: %s:\n",location));
691 DEBUG(3,("Data Type: %s:\n",driver.info_3->defaultdatatype));
692 DEBUG(3,("Help File: %s:\n",driver.info_3->helpfile));
693 PACKI(desc,"N",count); /* number of files to copy */
694
695 for ( i=0; i<count && driver.info_3->dependentfiles && *driver.info_3->dependentfiles[i]; i++)
696 {
697 trim_string(driver.info_3->dependentfiles[i], "\\print$\\WIN40\\0\\", 0);
698 PACKS(desc,"z",driver.info_3->dependentfiles[i]); /* driver files to copy */
699 DEBUG(3,("Dependent File: %s:\n",driver.info_3->dependentfiles[i]));
700 }
701
702 /* sanity check */
703 if ( i != count )
704 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
705 count, i));
706
707 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
708
709 desc->errcode=NERR_Success;
710 goto done;
711
712 err:
713 DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
714 desc->errcode=NERR_notsupported;
715
716 done:
717 if ( printer )
718 free_a_printer( &printer, 2 );
719
720 if ( driver.info_3 )
721 free_a_printer_driver( driver, 3 );
722 }
723
724
725 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
726 struct pack_desc* desc,
727 int count, print_queue_struct* queue,
728 print_status_struct* status)
729 {
730 switch (uLevel) {
731 case 1:
732 case 2:
733 PACKS(desc,"B13",SERVICE(snum));
734 break;
735 case 3:
736 case 4:
737 case 5:
738 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
739 break;
740 case 51:
741 PACKI(desc,"K",printq_status(status->status));
742 break;
743 }
744
745 if (uLevel == 1 || uLevel == 2) {
746 PACKS(desc,"B",""); /* alignment */
747 PACKI(desc,"W",5); /* priority */
748 PACKI(desc,"W",0); /* start time */
749 PACKI(desc,"W",0); /* until time */
750 PACKS(desc,"z",""); /* pSepFile */
751 PACKS(desc,"z","lpd"); /* pPrProc */
752 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
753 PACKS(desc,"z",""); /* pParms */
754 if (snum < 0) {
755 PACKS(desc,"z","UNKNOWN PRINTER");
756 PACKI(desc,"W",LPSTAT_ERROR);
757 }
758 else if (!status || !status->message[0]) {
759 PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
760 PACKI(desc,"W",LPSTAT_OK); /* status */
761 } else {
762 PACKS(desc,"z",status->message);
763 PACKI(desc,"W",printq_status(status->status)); /* status */
764 }
765 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
766 }
767
768 if (uLevel == 3 || uLevel == 4) {
769 char *drivername = NULL;
770
771 PACKI(desc,"W",5); /* uPriority */
772 PACKI(desc,"W",0); /* uStarttime */
773 PACKI(desc,"W",0); /* uUntiltime */
774 PACKI(desc,"W",5); /* pad1 */
775 PACKS(desc,"z",""); /* pszSepFile */
776 PACKS(desc,"z","WinPrint"); /* pszPrProc */
777 PACKS(desc,"z",NULL); /* pszParms */
778 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
779 /* "don't ask" that it's done this way to fix corrupted
780 Win9X/ME printer comments. */
781 if (!status) {
782 PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
783 } else {
784 PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
785 }
786 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
787 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
788 get_driver_name(snum,&drivername);
789 if (!drivername) {
790 return;
791 }
792 PACKS(desc,"z",drivername); /* pszDriverName */
793 PackDriverData(desc); /* pDriverData */
794 }
795
796 if (uLevel == 2 || uLevel == 4) {
797 int i;
798 for (i=0;i<count;i++)
799 fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
800 }
801
802 if (uLevel==52)
803 fill_printq_info_52( conn, snum, desc, count );
804 }
805
806 /* This function returns the number of files for a given driver */
807 static int get_printerdrivernumber(int snum)
808 {
809 int result = 0;
810 NT_PRINTER_DRIVER_INFO_LEVEL driver;
811 NT_PRINTER_INFO_LEVEL *printer = NULL;
812
813 ZERO_STRUCT(driver);
814
815 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
816 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
817 lp_servicename(snum)));
818 goto done;
819 }
820
821 if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
822 "Windows 4.0", 0)) )
823 {
824 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
825 printer->info_2->drivername));
826 goto done;
827 }
828
829 /* count the number of files */
830 while ( driver.info_3->dependentfiles && *driver.info_3->dependentfiles[result] )
831 result++;
832 \
833 done:
834 if ( printer )
835 free_a_printer( &printer, 2 );
836
837 if ( driver.info_3 )
838 free_a_printer_driver( driver, 3 );
839
840 return result;
841 }
842
843 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
844 char *param, int tpscnt,
845 char *data, int tdscnt,
846 int mdrcnt,int mprcnt,
847 char **rdata,char **rparam,
848 int *rdata_len,int *rparam_len)
849 {
850 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
851 char *str2 = skip_string(param,tpscnt,str1);
852 char *p = skip_string(param,tpscnt,str2);
853 char *QueueName = p;
854 unsigned int uLevel;
855 int count=0;
856 int snum;
857 char *str3;
858 struct pack_desc desc;
859 print_queue_struct *queue=NULL;
860 print_status_struct status;
861 char* tmpdata=NULL;
862
863 if (!str1 || !str2 || !p) {
864 return False;
865 }
866 memset((char *)&status,'\0',sizeof(status));
867 memset((char *)&desc,'\0',sizeof(desc));
868
869 p = skip_string(param,tpscnt,p);
870 if (!p) {
871 return False;
872 }
873 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
874 str3 = get_safe_str_ptr(param,tpscnt,p,4);
875 /* str3 may be null here and is checked in check_printq_info(). */
876
877 /* remove any trailing username */
878 if ((p = strchr_m(QueueName,'%')))
879 *p = 0;
880
881 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
882
883 /* check it's a supported varient */
884 if (!prefix_ok(str1,"zWrLh"))
885 return False;
886 if (!check_printq_info(&desc,uLevel,str2,str3)) {
887 /*
888 * Patch from Scott Moomaw <scott@bridgewater.edu>
889 * to return the 'invalid info level' error if an
890 * unknown level was requested.
891 */
892 *rdata_len = 0;
893 *rparam_len = 6;
894 *rparam = smb_realloc_limit(*rparam,*rparam_len);
895 if (!*rparam) {
896 return False;
897 }
898 SSVALS(*rparam,0,ERRunknownlevel);
899 SSVAL(*rparam,2,0);
900 SSVAL(*rparam,4,0);
901 return(True);
902 }
903
904 snum = find_service(QueueName);
905 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
906 return False;
907
908 if (uLevel==52) {
909 count = get_printerdrivernumber(snum);
910 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
911 } else {
912 count = print_queue_status(snum, &queue,&status);
913 }
914
915 if (mdrcnt > 0) {
916 *rdata = smb_realloc_limit(*rdata,mdrcnt);
917 if (!*rdata) {
918 SAFE_FREE(queue);
919 return False;
920 }
921 desc.base = *rdata;
922 desc.buflen = mdrcnt;
923 } else {
924 /*
925 * Don't return data but need to get correct length
926 * init_package will return wrong size if buflen=0
927 */
928 desc.buflen = getlen(desc.format);
929 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
930 }
931
932 if (init_package(&desc,1,count)) {
933 desc.subcount = count;
934 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
935 }
936
937 *rdata_len = desc.usedlen;
938
939 /*
940 * We must set the return code to ERRbuftoosmall
941 * in order to support lanman style printing with Win NT/2k
942 * clients --jerry
943 */
944 if (!mdrcnt && lp_disable_spoolss())
945 desc.errcode = ERRbuftoosmall;
946
947 *rdata_len = desc.usedlen;
948 *rparam_len = 6;
949 *rparam = smb_realloc_limit(*rparam,*rparam_len);
950 if (!*rparam) {
951 SAFE_FREE(queue);
952 SAFE_FREE(tmpdata);
953 return False;
954 }
955 SSVALS(*rparam,0,desc.errcode);
956 SSVAL(*rparam,2,0);
957 SSVAL(*rparam,4,desc.neededlen);
958
959 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
960
961 SAFE_FREE(queue);
962 SAFE_FREE(tmpdata);
963
964 return(True);
965 }
966
967 /****************************************************************************
968 View list of all print jobs on all queues.
969 ****************************************************************************/
970
971 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
972 char *param, int tpscnt,
973 char *data, int tdscnt,
974 int mdrcnt, int mprcnt,
975 char **rdata, char** rparam,
976 int *rdata_len, int *rparam_len)
977 {
978 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
979 char *output_format1 = skip_string(param,tpscnt,param_format);
980 char *p = skip_string(param,tpscnt,output_format1);
981 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
982 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
983 int services = lp_numservices();
984 int i, n;
985 struct pack_desc desc;
986 print_queue_struct **queue = NULL;
987 print_status_struct *status = NULL;
988 int *subcntarr = NULL;
989 int queuecnt = 0, subcnt = 0, succnt = 0;
990
991 if (!param_format || !output_format1 || !p) {
992 return False;
993 }
994
995 memset((char *)&desc,'\0',sizeof(desc));
996
997 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
998
999 if (!prefix_ok(param_format,"WrLeh")) {
1000 return False;
1001 }
1002 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1003 /*
1004 * Patch from Scott Moomaw <scott@bridgewater.edu>
1005 * to return the 'invalid info level' error if an
1006 * unknown level was requested.
1007 */
1008 *rdata_len = 0;
1009 *rparam_len = 6;
1010 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1011 if (!*rparam) {
1012 return False;
1013 }
1014 SSVALS(*rparam,0,ERRunknownlevel);
1015 SSVAL(*rparam,2,0);
1016 SSVAL(*rparam,4,0);
1017 return(True);
1018 }
1019
1020 for (i = 0; i < services; i++) {
1021 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1022 queuecnt++;
1023 }
1024 }
1025
1026 if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1027 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1028 goto err;
1029 }
1030 memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1031 if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1032 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1033 goto err;
1034 }
1035 memset(status,0,queuecnt*sizeof(print_status_struct));
1036 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1037 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1038 goto err;
1039 }
1040
1041 subcnt = 0;
1042 n = 0;
1043 for (i = 0; i < services; i++) {
1044 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1045 subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1046 subcnt += subcntarr[n];
1047 n++;
1048 }
1049 }
1050
1051 if (mdrcnt > 0) {
1052 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1053 if (!*rdata) {
1054 goto err;
1055 }
1056 }
1057 desc.base = *rdata;
1058 desc.buflen = mdrcnt;
1059
1060 if (init_package(&desc,queuecnt,subcnt)) {
1061 n = 0;
1062 succnt = 0;
1063 for (i = 0; i < services; i++) {
1064 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1065 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1066 n++;
1067 if (desc.errcode == NERR_Success) {
1068 succnt = n;
1069 }
1070 }
1071 }
1072 }
1073
1074 SAFE_FREE(subcntarr);
1075
1076 *rdata_len = desc.usedlen;
1077 *rparam_len = 8;
1078 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1079 if (!*rparam) {
1080 goto err;
1081 }
1082 SSVALS(*rparam,0,desc.errcode);
1083 SSVAL(*rparam,2,0);
1084 SSVAL(*rparam,4,succnt);
1085 SSVAL(*rparam,6,queuecnt);
1086
1087 for (i = 0; i < queuecnt; i++) {
1088 if (queue) {
1089 SAFE_FREE(queue[i]);
1090 }
1091 }
1092
1093 SAFE_FREE(queue);
1094 SAFE_FREE(status);
1095
1096 return True;
1097
1098 err:
1099
1100 SAFE_FREE(subcntarr);
1101 for (i = 0; i < queuecnt; i++) {
1102 if (queue) {
1103 SAFE_FREE(queue[i]);
1104 }
1105 }
1106 SAFE_FREE(queue);
1107 SAFE_FREE(status);
1108
1109 return False;
1110 }
1111
1112 /****************************************************************************
1113 Get info level for a server list query.
1114 ****************************************************************************/
1115
1116 static bool check_server_info(int uLevel, char* id)
1117 {
1118 switch( uLevel ) {
1119 case 0:
1120 if (strcmp(id,"B16") != 0) {
1121 return False;
1122 }
1123 break;
1124 case 1:
1125 if (strcmp(id,"B16BBDz") != 0) {
1126 return False;
1127 }
1128 break;
1129 default:
1130 return False;
1131 }
1132 return True;
1133 }
1134
1135 struct srv_info_struct {
1136 fstring name;
1137 uint32 type;
1138 fstring comment;
1139 fstring domain;
1140 bool server_added;
1141 };
1142
1143 /*******************************************************************
1144 Get server info lists from the files saved by nmbd. Return the
1145 number of entries.
1146 ******************************************************************/
1147
1148 static int get_server_info(uint32 servertype,
1149 struct srv_info_struct **servers,
1150 const char *domain)
1151 {
1152 int count=0;
1153 int alloced=0;
1154 char **lines;
1155 bool local_list_only;
1156 int i;
1157
1158 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1159 if (!lines) {
1160 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1161 return 0;
1162 }
1163
1164 /* request for everything is code for request all servers */
1165 if (servertype == SV_TYPE_ALL) {
1166 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1167 }
1168
1169 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1170
1171 DEBUG(4,("Servertype search: %8x\n",servertype));
1172
1173 for (i=0;lines[i];i++) {
1174 fstring stype;
1175 struct srv_info_struct *s;
1176 const char *ptr = lines[i];
1177 bool ok = True;
1178 TALLOC_CTX *frame = NULL;
1179 char *p;
1180
1181 if (!*ptr) {
1182 continue;
1183 }
1184
1185 if (count == alloced) {
1186 alloced += 10;
1187 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1188 if (!*servers) {
1189 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1190 TALLOC_FREE(lines);
1191 return 0;
1192 }
1193 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1194 }
1195 s = &(*servers)[count];
1196
1197 frame = talloc_stackframe();
1198 s->name[0] = '\0';
1199 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1200 TALLOC_FREE(frame);
1201 continue;
1202 }
1203 fstrcpy(s->name, p);
1204
1205 stype[0] = '\0';
1206 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1207 TALLOC_FREE(frame);
1208 continue;
1209 }
1210 fstrcpy(stype, p);
1211
1212 s->comment[0] = '\0';
1213 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1214 TALLOC_FREE(frame);
1215 continue;
1216 }
1217 fstrcpy(s->comment, p);
1218
1219 s->domain[0] = '\0';
1220 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1221 /* this allows us to cope with an old nmbd */
1222 fstrcpy(s->domain,lp_workgroup());
1223 } else {
1224 fstrcpy(s->domain, p);
1225 }
1226 TALLOC_FREE(frame);
1227
1228 if (sscanf(stype,"%X",&s->type) != 1) {
1229 DEBUG(4,("r:host file "));
1230 ok = False;
1231 }
1232
1233 /* Filter the servers/domains we return based on what was asked for. */
1234
1235 /* Check to see if we are being asked for a local list only. */
1236 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1237 DEBUG(4,("r: local list only"));
1238 ok = False;
1239 }
1240
1241 /* doesn't match up: don't want it */
1242 if (!(servertype & s->type)) {
1243 DEBUG(4,("r:serv type "));
1244 ok = False;
1245 }
1246
1247 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1248 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1249 DEBUG(4,("s: dom mismatch "));
1250 ok = False;
1251 }
1252
1253 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1254 ok = False;
1255 }
1256
1257 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1258 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1259
1260 if (ok) {
1261 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1262 s->name, s->type, s->comment, s->domain));
1263 s->server_added = True;
1264 count++;
1265 } else {
1266 DEBUG(4,("%20s %8x %25s %15s\n",
1267 s->name, s->type, s->comment, s->domain));
1268 }
1269 }
1270
1271 TALLOC_FREE(lines);
1272 return count;
1273 }
1274
1275 /*******************************************************************
1276 Fill in a server info structure.
1277 ******************************************************************/
1278
1279 static int fill_srv_info(struct srv_info_struct *service,
1280 int uLevel, char **buf, int *buflen,
1281 char **stringbuf, int *stringspace, char *baseaddr)
1282 {
1283 int struct_len;
1284 char* p;
1285 char* p2;
1286 int l2;
1287 int len;
1288
1289 switch (uLevel) {
1290 case 0:
1291 struct_len = 16;
1292 break;
1293 case 1:
1294 struct_len = 26;
1295 break;
1296 default:
1297 return -1;
1298 }
1299
1300 if (!buf) {
1301 len = 0;
1302 switch (uLevel) {
1303 case 1:
1304 len = strlen(service->comment)+1;
1305 break;
1306 }
1307
1308 *buflen = struct_len;
1309 *stringspace = len;
1310 return struct_len + len;
1311 }
1312
1313 len = struct_len;
1314 p = *buf;
1315 if (*buflen < struct_len) {
1316 return -1;
1317 }
1318 if (stringbuf) {
1319 p2 = *stringbuf;
1320 l2 = *stringspace;
1321 } else {
1322 p2 = p + struct_len;
1323 l2 = *buflen - struct_len;
1324 }
1325 if (!baseaddr) {
1326 baseaddr = p;
1327 }
1328
1329 switch (uLevel) {
1330 case 0:
1331 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1332 break;
1333
1334 case 1:
1335 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1336 SIVAL(p,18,service->type);
1337 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1338 len += CopyAndAdvance(&p2,service->comment,&l2);
1339 break;
1340 }
1341
1342 if (stringbuf) {
1343 *buf = p + struct_len;
1344 *buflen -= struct_len;
1345 *stringbuf = p2;
1346 *stringspace = l2;
1347 } else {
1348 *buf = p2;
1349 *buflen -= len;
1350 }
1351 return len;
1352 }
1353
1354
1355 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1356 {
1357 return(strcmp(s1->name,s2->name));
1358 }
1359
1360 /****************************************************************************
1361 View list of servers available (or possibly domains). The info is
1362 extracted from lists saved by nmbd on the local host.
1363 ****************************************************************************/
1364
1365 static bool api_RNetServerEnum(connection_struct *conn, uint16 vuid,
1366 char *param, int tpscnt,
1367 char *data, int tdscnt,
1368 int mdrcnt, int mprcnt, char **rdata,
1369 char **rparam, int *rdata_len, int *rparam_len)
1370 {
1371 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1372 char *str2 = skip_string(param,tpscnt,str1);
1373 char *p = skip_string(param,tpscnt,str2);
1374 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1375 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1376 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1377 char *p2;
1378 int data_len, fixed_len, string_len;
1379 int f_len = 0, s_len = 0;
1380 struct srv_info_struct *servers=NULL;
1381 int counted=0,total=0;
1382 int i,missed;
1383 fstring domain;
1384 bool domain_request;
1385 bool local_request;
1386
1387 if (!str1 || !str2 || !p) {
1388 return False;
1389 }
1390
1391 /* If someone sets all the bits they don't really mean to set
1392 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1393 known servers. */
1394
1395 if (servertype == SV_TYPE_ALL) {
1396 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1397 }
1398
1399 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1400 any other bit (they may just set this bit on its own) they
1401 want all the locally seen servers. However this bit can be
1402 set on its own so set the requested servers to be
1403 ALL - DOMAIN_ENUM. */
1404
1405 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1406 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1407 }
1408
1409 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1410 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1411
1412 p += 8;
1413
1414 if (!prefix_ok(str1,"WrLehD")) {
1415 return False;
1416 }
1417 if (!check_server_info(uLevel,str2)) {
1418 return False;
1419 }
1420
1421 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1422 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1423 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1424
1425 if (strcmp(str1, "WrLehDz") == 0) {
1426 if (skip_string(param,tpscnt,p) == NULL) {
1427 return False;
1428 }
1429 pull_ascii_fstring(domain, p);
1430 } else {
1431 fstrcpy(domain, lp_workgroup());
1432 }
1433
1434 if (lp_browse_list()) {
1435 total = get_server_info(servertype,&servers,domain);
1436 }
1437
1438 data_len = fixed_len = string_len = 0;
1439 missed = 0;
1440
1441 if (total > 0) {
1442 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1443 }
1444
1445 {
1446 char *lastname=NULL;
1447
1448 for (i=0;i<total;i++) {
1449 struct srv_info_struct *s = &servers[i];
1450
1451 if (lastname && strequal(lastname,s->name)) {
1452 continue;
1453 }
1454 lastname = s->name;
1455 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1456 DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1457 s->name, s->type, s->comment, s->domain));
1458
1459 if (data_len <= buf_len) {
1460 counted++;
1461 fixed_len += f_len;
1462 string_len += s_len;
1463 } else {
1464 missed++;
1465 }
1466 }
1467 }
1468
1469 *rdata_len = fixed_len + string_len;
1470 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1471 if (!*rdata) {
1472 return False;
1473 }
1474
1475 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1476 p = *rdata;
1477 f_len = fixed_len;
1478 s_len = string_len;
1479
1480 {
1481 char *lastname=NULL;
1482 int count2 = counted;
1483
1484 for (i = 0; i < total && count2;i++) {
1485 struct srv_info_struct *s = &servers[i];
1486
1487 if (lastname && strequal(lastname,s->name)) {
1488 continue;
1489 }
1490 lastname = s->name;
1491 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1492 DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1493 s->name, s->type, s->comment, s->domain));
1494 count2--;
1495 }
1496 }
1497
1498 *rparam_len = 8;
1499 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1500 if (!*rparam) {
1501 return False;
1502 }
1503 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1504 SSVAL(*rparam,2,0);
1505 SSVAL(*rparam,4,counted);
1506 SSVAL(*rparam,6,counted+missed);
1507
1508 SAFE_FREE(servers);
1509
1510 DEBUG(3,("NetServerEnum domain = %s uLevel=%d counted=%d total=%d\n",
1511 domain,uLevel,counted,counted+missed));
1512
1513 return True;
1514 }
1515
1516 /****************************************************************************
1517 command 0x34 - suspected of being a "Lookup Names" stub api
1518 ****************************************************************************/
1519
1520 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1521 char *param, int tpscnt,
1522 char *data, int tdscnt,
1523 int mdrcnt, int mprcnt, char **rdata,
1524 char **rparam, int *rdata_len, int *rparam_len)
1525 {
1526 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1527 char *str2 = skip_string(param,tpscnt,str1);
1528 char *p = skip_string(param,tpscnt,str2);
1529 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1530 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1531 int counted=0;
1532 int missed=0;
1533
1534 if (!str1 || !str2 || !p) {
1535 return False;
1536 }
1537
1538 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1539 str1, str2, p, uLevel, buf_len));
1540
1541 if (!prefix_ok(str1,"zWrLeh")) {
1542 return False;
1543 }
1544
1545 *rdata_len = 0;
1546
1547 *rparam_len = 8;
1548 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1549 if (!*rparam) {
1550 return False;
1551 }
1552
1553 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1554 SSVAL(*rparam,2,0);
1555 SSVAL(*rparam,4,counted);
1556 SSVAL(*rparam,6,counted+missed);
1557
1558 return True;
1559 }
1560
1561 /****************************************************************************
1562 get info about a share
1563 ****************************************************************************/
1564
1565 static bool check_share_info(int uLevel, char* id)
1566 {
1567 switch( uLevel ) {
1568 case 0:
1569 if (strcmp(id,"B13") != 0) {
1570 return False;
1571 }
1572 break;
1573 case 1:
1574 if (strcmp(id,"B13BWz") != 0) {
1575 return False;
1576 }
1577 break;
1578 case 2:
1579 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1580 return False;
1581 }
1582 break;
1583 case 91:
1584 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1585 return False;
1586 }
1587 break;
1588 default:
1589 return False;
1590 }
1591 return True;
1592 }
1593
1594 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1595 char** buf, int* buflen,
1596 char** stringbuf, int* stringspace, char* baseaddr)
1597 {
1598 int struct_len;
1599 char* p;
1600 char* p2;
1601 int l2;
1602 int len;
1603
1604 switch( uLevel ) {
1605 case 0:
1606 struct_len = 13;
1607 break;
1608 case 1:
1609 struct_len = 20;
1610 break;
1611 case 2:
1612 struct_len = 40;
1613 break;
1614 case 91:
1615 struct_len = 68;
1616 break;
1617 default:
1618 return -1;
1619 }
1620
1621 if (!buf) {
1622 len = 0;
1623
1624 if (uLevel > 0) {
1625 len += StrlenExpanded(conn,snum,lp_comment(snum));
1626 }
1627 if (uLevel > 1) {
1628 len += strlen(lp_pathname(snum)) + 1;
1629 }
1630 if (buflen) {
1631 *buflen = struct_len;
1632 }
1633 if (stringspace) {
1634 *stringspace = len;
1635 }
1636 return struct_len + len;
1637 }
1638
1639 len = struct_len;
1640 p = *buf;
1641 if ((*buflen) < struct_len) {
1642 return -1;
1643 }
1644
1645 if (stringbuf) {
1646 p2 = *stringbuf;
1647 l2 = *stringspace;
1648 } else {
1649 p2 = p + struct_len;
1650 l2 = (*buflen) - struct_len;
1651 }
1652
1653 if (!baseaddr) {
1654 baseaddr = p;
1655 }
1656
1657 push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1658
1659 if (uLevel > 0) {
1660 int type;
1661
1662 SCVAL(p,13,0);
1663 type = STYPE_DISKTREE;
1664 if (lp_print_ok(snum)) {
1665 type = STYPE_PRINTQ;
1666 }
1667 if (strequal("IPC",lp_fstype(snum))) {
1668 type = STYPE_IPC;
1669 }
1670 SSVAL(p,14,type); /* device type */
1671 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1672 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1673 }
1674
1675 if (uLevel > 1) {
1676 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1677 SSVALS(p,22,-1); /* max uses */
1678 SSVAL(p,24,1); /* current uses */
1679 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1680 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1681 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1682 }
1683
1684 if (uLevel > 2) {
1685 memset(p+40,0,SHPWLEN+2);
1686 SSVAL(p,50,0);
1687 SIVAL(p,52,0);
1688 SSVAL(p,56,0);
1689 SSVAL(p,58,0);
1690 SIVAL(p,60,0);
1691 SSVAL(p,64,0);
1692 SSVAL(p,66,0);
1693 }
1694
1695 if (stringbuf) {
1696 (*buf) = p + struct_len;
1697 (*buflen) -= struct_len;
1698 (*stringbuf) = p2;
1699 (*stringspace) = l2;
1700 } else {
1701 (*buf) = p2;
1702 (*buflen) -= len;
1703 }
1704
1705 return len;
1706 }
1707
1708 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1709 char *param, int tpscnt,
1710 char *data, int tdscnt,
1711 int mdrcnt,int mprcnt,
1712 char **rdata,char **rparam,
1713 int *rdata_len,int *rparam_len)
1714 {
1715 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1716 char *str2 = skip_string(param,tpscnt,str1);
1717 char *netname = skip_string(param,tpscnt,str2);
1718 char *p = skip_string(param,tpscnt,netname);
1719 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1720 int snum;
1721
1722 if (!str1 || !str2 || !netname || !p) {
1723 return False;
1724 }
1725
1726 snum = find_service(netname);
1727 if (snum < 0) {
1728 return False;
1729 }
1730
1731 /* check it's a supported varient */
1732 if (!prefix_ok(str1,"zWrLh")) {
1733 return False;
1734 }
1735 if (!check_share_info(uLevel,str2)) {
1736 return False;
1737 }
1738
1739 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1740 if (!*rdata) {
1741 return False;
1742 }
1743 p = *rdata;
1744 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1745 if (*rdata_len < 0) {
1746 return False;
1747 }
1748
1749 *rparam_len = 6;
1750 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1751 if (!*rparam) {
1752 return False;
1753 }
1754 SSVAL(*rparam,0,NERR_Success);
1755 SSVAL(*rparam,2,0); /* converter word */
1756 SSVAL(*rparam,4,*rdata_len);
1757
1758 return True;
1759 }
1760
1761 /****************************************************************************
1762 View the list of available shares.
1763
1764 This function is the server side of the NetShareEnum() RAP call.
1765 It fills the return buffer with share names and share comments.
1766 Note that the return buffer normally (in all known cases) allows only
1767 twelve byte strings for share names (plus one for a nul terminator).
1768 Share names longer than 12 bytes must be skipped.
1769 ****************************************************************************/
1770
1771 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1772 char *param, int tpscnt,
1773 char *data, int tdscnt,
1774 int mdrcnt,
1775 int mprcnt,
1776 char **rdata,
1777 char **rparam,
1778 int *rdata_len,
1779 int *rparam_len )
1780 {
1781 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1782 char *str2 = skip_string(param,tpscnt,str1);
1783 char *p = skip_string(param,tpscnt,str2);
1784 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1785 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1786 char *p2;
1787 int count = 0;
1788 int total=0,counted=0;
1789 bool missed = False;
1790 int i;
1791 int data_len, fixed_len, string_len;
1792 int f_len = 0, s_len = 0;
1793
1794 if (!str1 || !str2 || !p) {
1795 return False;
1796 }
1797
1798 if (!prefix_ok(str1,"WrLeh")) {
1799 return False;
1800 }
1801 if (!check_share_info(uLevel,str2)) {
1802 return False;
1803 }
1804
1805 /* Ensure all the usershares are loaded. */
1806 become_root();
1807 load_registry_shares();
1808 count = load_usershare_shares();
1809 unbecome_root();
1810
1811 data_len = fixed_len = string_len = 0;
1812 for (i=0;i<count;i++) {
1813 fstring servicename_dos;
1814 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1815 continue;
1816 }
1817 push_ascii_fstring(servicename_dos, lp_servicename(i));
1818 /* Maximum name length = 13. */
1819 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1820 total++;
1821 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1822 if (data_len <= buf_len) {
1823 counted++;
1824 fixed_len += f_len;
1825 string_len += s_len;
1826 } else {
1827 missed = True;
1828 }
1829 }
1830 }
1831
1832 *rdata_len = fixed_len + string_len;
1833 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1834 if (!*rdata) {
1835 return False;
1836 }
1837
1838 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
1839 p = *rdata;
1840 f_len = fixed_len;
1841 s_len = string_len;
1842
1843 for( i = 0; i < count; i++ ) {
1844 fstring servicename_dos;
1845 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1846 continue;
1847 }
1848
1849 push_ascii_fstring(servicename_dos, lp_servicename(i));
1850 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1851 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1852 break;
1853 }
1854 }
1855 }
1856
1857 *rparam_len = 8;
1858 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1859 if (!*rparam) {
1860 return False;
1861 }
1862 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1863 SSVAL(*rparam,2,0);
1864 SSVAL(*rparam,4,counted);
1865 SSVAL(*rparam,6,total);
1866
1867 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1868 counted,total,uLevel,
1869 buf_len,*rdata_len,mdrcnt));
1870
1871 return True;
1872 }
1873
1874 /****************************************************************************
1875 Add a share
1876 ****************************************************************************/
1877
1878 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1879 char *param, int tpscnt,
1880 char *data, int tdscnt,
1881 int mdrcnt,int mprcnt,
1882 char **rdata,char **rparam,
1883 int *rdata_len,int *rparam_len)
1884 {
1885 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1886 char *str2 = skip_string(param,tpscnt,str1);
1887 char *p = skip_string(param,tpscnt,str2);
1888 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1889 fstring sharename;
1890 fstring comment;
1891 char *pathname = NULL;
1892 char *command, *cmdname;
1893 unsigned int offset;
1894 int snum;
1895 int res = ERRunsup;
1896 size_t converted_size;
1897
1898 if (!str1 || !str2 || !p) {
1899 return False;
1900 }
1901
1902 /* check it's a supported varient */
1903 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1904 return False;
1905 }
1906 if (!check_share_info(uLevel,str2)) {
1907 return False;
1908 }
1909 if (uLevel != 2) {
1910 return False;
1911 }
1912
1913 /* Do we have a string ? */
1914 if (skip_string(data,mdrcnt,data) == NULL) {
1915 return False;
1916 }
1917 pull_ascii_fstring(sharename,data);
1918 snum = find_service(sharename);
1919 if (snum >= 0) { /* already exists */
1920 res = ERRfilexists;
1921 goto error_exit;
1922 }
1923
1924 if (mdrcnt < 28) {
1925 return False;
1926 }
1927
1928 /* only support disk share adds */
1929 if (SVAL(data,14)!=STYPE_DISKTREE) {
1930 return False;
1931 }
1932
1933 offset = IVAL(data, 16);
1934 if (offset >= mdrcnt) {
1935 res = ERRinvalidparam;
1936 goto error_exit;
1937 }
1938
1939 /* Do we have a string ? */
1940 if (skip_string(data,mdrcnt,data+offset) == NULL) {
1941 return False;
1942 }
1943 pull_ascii_fstring(comment, offset? (data+offset) : "");
1944
1945 offset = IVAL(data, 26);
1946
1947 if (offset >= mdrcnt) {
1948 res = ERRinvalidparam;
1949 goto error_exit;
1950 }
1951
1952 /* Do we have a string ? */
1953 if (skip_string(data,mdrcnt,data+offset) == NULL) {
1954 return False;
1955 }
1956
1957 if (!pull_ascii_talloc(talloc_tos(), &pathname,
1958 offset ? (data+offset) : "", &converted_size))
1959 {
1960 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
1961 strerror(errno)));
1962 }
1963
1964 if (!pathname) {
1965 return false;
1966 }
1967
1968 string_replace(sharename, '"', ' ');
1969 string_replace(pathname, '"', ' ');
1970 string_replace(comment, '"', ' ');
1971
1972 cmdname = lp_add_share_cmd();
1973
1974 if (!cmdname || *cmdname == '\0') {
1975 return False;
1976 }
1977
1978 if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1979 lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1980 pathname, comment) == -1) {
1981 return false;
1982 }
1983
1984 DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1985
1986 if ((res = smbrun(command, NULL)) != 0) {
1987 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1988 command, res ));
1989 SAFE_FREE(command);
1990 res = ERRnoaccess;
1991 goto error_exit;
1992 } else {
1993 SAFE_FREE(command);
1994 message_send_all(smbd_messaging_context(),
1995 MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1996 }
1997
1998 *rparam_len = 6;
1999 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2000 if (!*rparam) {
2001 return False;
2002 }
2003 SSVAL(*rparam,0,NERR_Success);
2004 SSVAL(*rparam,2,0); /* converter word */
2005 SSVAL(*rparam,4,*rdata_len);
2006 *rdata_len = 0;
2007
2008 return True;
2009
2010 error_exit:
2011
2012 *rparam_len = 4;
2013 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2014 if (!*rparam) {
2015 return False;
2016 }
2017 *rdata_len = 0;
2018 SSVAL(*rparam,0,res);
2019 SSVAL(*rparam,2,0);
2020 return True;
2021 }
2022
2023 /****************************************************************************
2024 view list of groups available
2025 ****************************************************************************/
2026
2027 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2028 char *param, int tpscnt,
2029 char *data, int tdscnt,
2030 int mdrcnt,int mprcnt,
2031 char **rdata,char **rparam,
2032 int *rdata_len,int *rparam_len)
2033 {
2034 int i;
2035 int errflags=0;
2036 int resume_context, cli_buf_size;
2037 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2038 char *str2 = skip_string(param,tpscnt,str1);
2039 char *p = skip_string(param,tpscnt,str2);
2040
2041 uint32_t num_groups;
2042 uint32_t resume_handle;
2043 struct rpc_pipe_client *samr_pipe;
2044 struct policy_handle samr_handle, domain_handle;
2045 NTSTATUS status;
2046
2047 if (!str1 || !str2 || !p) {
2048 return False;
2049 }
2050
2051 if (strcmp(str1,"WrLeh") != 0) {
2052 return False;
2053 }
2054
2055 /* parameters
2056 * W-> resume context (number of users to skip)
2057 * r -> return parameter pointer to receive buffer
2058 * L -> length of receive buffer
2059 * e -> return parameter number of entries
2060 * h -> return parameter total number of users
2061 */
2062
2063 if (strcmp("B21",str2) != 0) {
2064 return False;
2065 }
2066
2067 status = rpc_pipe_open_internal(
2068 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2069 conn->server_info, &samr_pipe);
2070 if (!NT_STATUS_IS_OK(status)) {
2071 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2072 nt_errstr(status)));
2073 return false;
2074 }
2075
2076 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2077 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2078 if (!NT_STATUS_IS_OK(status)) {
2079 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2080 nt_errstr(status)));
2081 return false;
2082 }
2083
2084 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2085 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2086 get_global_sam_sid(), &domain_handle);
2087 if (!NT_STATUS_IS_OK(status)) {
2088 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2089 nt_errstr(status)));
2090 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2091 return false;
2092 }
2093
2094 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2095 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2096 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2097 "%d\n", resume_context, cli_buf_size));
2098
2099 *rdata_len = cli_buf_size;
2100 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2101 if (!*rdata) {
2102 return False;
2103 }
2104
2105 p = *rdata;
2106
2107 errflags = NERR_Success;
2108 num_groups = 0;
2109 resume_handle = 0;
2110
2111 while (true) {
2112 struct samr_SamArray *sam_entries;
2113 uint32_t num_entries;
2114
2115 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2116 &domain_handle,
2117 &resume_handle,
2118 &sam_entries, 1,
2119 &num_entries);
2120 if (!NT_STATUS_IS_OK(status)) {
2121 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2122 "%s\n", nt_errstr(status)));
2123 break;
2124 }
2125
2126 if (num_entries == 0) {
2127 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2128 "no entries -- done\n"));
2129 break;
2130 }
2131
2132 for(i=0; i<num_entries; i++) {
2133 const char *name;
2134
2135 name = sam_entries->entries[i].name.string;
2136
2137 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2138 /* set overflow error */
2139 DEBUG(3,("overflow on entry %d group %s\n", i,
2140 name));
2141 errflags=234;
2142 break;
2143 }
2144
2145 /* truncate the name at 21 chars. */
2146 memset(p, 0, 21);
2147 strlcpy(p, name, 21);
2148 DEBUG(10,("adding entry %d group %s\n", i, p));
2149 p += 21;
2150 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2151 * idea why... */
2152 num_groups += 1;
2153 }
2154
2155 if (errflags != NERR_Success) {
2156 break;
2157 }
2158
2159 TALLOC_FREE(sam_entries);
2160 }
2161
2162 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2163 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2164
2165 *rdata_len = PTR_DIFF(p,*rdata);
2166
2167 *rparam_len = 8;
2168 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2169 if (!*rparam) {
2170 return False;
2171 }
2172 SSVAL(*rparam, 0, errflags);
2173 SSVAL(*rparam, 2, 0); /* converter word */
2174 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2175 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2176
2177 return(True);
2178 }
2179
2180 /*******************************************************************
2181 Get groups that a user is a member of.
2182 ******************************************************************/
2183
2184 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2185 char *param, int tpscnt,
2186 char *data, int tdscnt,
2187 int mdrcnt,int mprcnt,
2188 char **rdata,char **rparam,
2189 int *rdata_len,int *rparam_len)
2190 {
2191 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2192 char *str2 = skip_string(param,tpscnt,str1);
2193 char *UserName = skip_string(param,tpscnt,str2);
2194 char *p = skip_string(param,tpscnt,UserName);
2195 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2196 const char *level_string;
2197 int count=0;
2198 bool ret = False;
2199 uint32_t i;
2200 char *endp = NULL;
2201
2202 struct rpc_pipe_client *samr_pipe;
2203 struct policy_handle samr_handle, domain_handle, user_handle;
2204 struct lsa_String name;
2205 struct lsa_Strings names;
2206 struct samr_Ids type, rid;
2207 struct samr_RidWithAttributeArray *rids;
2208 NTSTATUS status;
2209
2210 if (!str1 || !str2 || !UserName || !p) {
2211 return False;
2212 }
2213
2214 *rparam_len = 8;
2215 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2216 if (!*rparam) {
2217 return False;
2218 }
2219
2220 /* check it's a supported varient */
2221
2222 if ( strcmp(str1,"zWrLeh") != 0 )
2223 return False;
2224
2225 switch( uLevel ) {
2226 case 0:
2227 level_string = "B21";
2228 break;
2229 default:
2230 return False;
2231 }
2232
2233 if (strcmp(level_string,str2) != 0)
2234 return False;
2235
2236 *rdata_len = mdrcnt + 1024;
2237 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2238 if (!*rdata) {
2239 return False;
2240 }
2241
2242 SSVAL(*rparam,0,NERR_Success);
2243 SSVAL(*rparam,2,0); /* converter word */
2244
2245 p = *rdata;
2246 endp = *rdata + *rdata_len;
2247
2248 status = rpc_pipe_open_internal(
2249 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2250 conn->server_info, &samr_pipe);
2251 if (!NT_STATUS_IS_OK(status)) {
2252 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2253 nt_errstr(status)));
2254 return false;
2255 }
2256
2257 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2258 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2259 if (!NT_STATUS_IS_OK(status)) {
2260 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2261 nt_errstr(status)));
2262 return false;
2263 }
2264
2265 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2266 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2267 get_global_sam_sid(), &domain_handle);
2268 if (!NT_STATUS_IS_OK(status)) {
2269 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2270 nt_errstr(status)));
2271 goto close_sam;
2272 }
2273
2274 name.string = UserName;
2275
2276 status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2277 &domain_handle, 1, &name,
2278 &rid, &type);
2279 if (!NT_STATUS_IS_OK(status)) {
2280 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2281 nt_errstr(status)));
2282 goto close_domain;
2283 }
2284
2285 if (type.ids[0] != SID_NAME_USER) {
2286 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2287 sid_type_lookup(type.ids[0])));
2288 goto close_domain;
2289 }
2290
2291 status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2292 &domain_handle,
2293 SAMR_USER_ACCESS_GET_GROUPS,
2294 rid.ids[0], &user_handle);
2295 if (!NT_STATUS_IS_OK(status)) {
2296 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2297 nt_errstr(status)));
2298 goto close_domain;
2299 }
2300
2301 status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2302 &user_handle, &rids);
2303 if (!NT_STATUS_IS_OK(status)) {
2304 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2305 nt_errstr(status)));
2306 goto close_user;
2307 }
2308
2309 for (i=0; i<rids->count; i++) {
2310
2311 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2312 &domain_handle,
2313 1, &rids->rids[i].rid,
2314 &names, &type);
2315 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2316 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2317 p += 21;
2318 count++;
2319 }
2320 }
2321
2322 *rdata_len = PTR_DIFF(p,*rdata);
2323
2324 SSVAL(*rparam,4,count); /* is this right?? */
2325 SSVAL(*rparam,6,count); /* is this right?? */
2326
2327 ret = True;
2328
2329 close_user:
2330 rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2331 close_domain:
2332 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2333 close_sam:
2334 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2335
2336 return ret;
2337 }
2338
2339 /*******************************************************************
2340 Get all users.
2341 ******************************************************************/
2342
2343 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2344 char *param, int tpscnt,
2345 char *data, int tdscnt,
2346 int mdrcnt,int mprcnt,
2347 char **rdata,char **rparam,
2348 int *rdata_len,int *rparam_len)
2349 {
2350 int count_sent=0;
2351 int num_users=0;
2352 int errflags=0;
2353 int i, resume_context, cli_buf_size;
2354 uint32_t resume_handle;
2355
2356 struct rpc_pipe_client *samr_pipe;
2357 struct policy_handle samr_handle, domain_handle;
2358 NTSTATUS status;
2359
2360 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2361 char *str2 = skip_string(param,tpscnt,str1);
2362 char *p = skip_string(param,tpscnt,str2);
2363 char *endp = NULL;
2364
2365 if (!str1 || !str2 || !p) {
2366 return False;
2367 }
2368
2369 if (strcmp(str1,"WrLeh") != 0)
2370 return False;
2371 /* parameters
2372 * W-> resume context (number of users to skip)
2373 * r -> return parameter pointer to receive buffer
2374 * L -> length of receive buffer
2375 * e -> return parameter number of entries
2376 * h -> return parameter total number of users
2377 */
2378
2379 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2380 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2381 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2382 resume_context, cli_buf_size));
2383
2384 *rparam_len = 8;
2385 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2386 if (!*rparam) {
2387 return False;
2388 }
2389
2390 /* check it's a supported varient */
2391 if (strcmp("B21",str2) != 0)
2392 return False;
2393
2394 *rdata_len = cli_buf_size;
2395 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2396 if (!*rdata) {
2397 return False;
2398 }
2399
2400 p = *rdata;
2401 endp = *rdata + *rdata_len;
2402
2403 status = rpc_pipe_open_internal(
2404 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2405 conn->server_info, &samr_pipe);
2406 if (!NT_STATUS_IS_OK(status)) {
2407 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2408 nt_errstr(status)));
2409 return false;
2410 }
2411
2412 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2413 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2414 if (!NT_STATUS_IS_OK(status)) {
2415 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2416 nt_errstr(status)));
2417 return false;
2418 }
2419
2420 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2421 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2422 get_global_sam_sid(), &domain_handle);
2423 if (!NT_STATUS_IS_OK(status)) {
2424 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2425 nt_errstr(status)));
2426 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2427 return false;
2428 }
2429
2430 errflags=NERR_Success;
2431
2432 resume_handle = 0;
2433
2434 while (true) {
2435 struct samr_SamArray *sam_entries;
2436 uint32_t num_entries;
2437
2438 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2439 &domain_handle,
2440 &resume_handle,
2441 0, &sam_entries, 1,
2442 &num_entries);
2443
2444 if (!NT_STATUS_IS_OK(status)) {
2445 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2446 "%s\n", nt_errstr(status)));
2447 break;
2448 }
2449
2450 if (num_entries == 0) {
2451 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2452 "no entries -- done\n"));
2453 break;
2454 }
2455
2456 for (i=0; i<num_entries; i++) {
2457 const char *name;
2458
2459 name = sam_entries->entries[i].name.string;
2460
2461 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2462 &&(strlen(name)<=21)) {
2463 strlcpy(p,name,PTR_DIFF(endp,p));
2464 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2465 "username %s\n",count_sent,p));
2466 p += 21;
2467 count_sent++;
2468 } else {
2469 /* set overflow error */
2470 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2471 "username %s\n",count_sent,name));
2472 errflags=234;
2473 break;
2474 }
2475 }
2476
2477 if (errflags != NERR_Success) {
2478 break;
2479 }
2480
2481 TALLOC_FREE(sam_entries);
2482 }
2483
2484 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2485 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2486
2487 *rdata_len = PTR_DIFF(p,*rdata);
2488
2489 SSVAL(*rparam,0,errflags);
2490 SSVAL(*rparam,2,0); /* converter word */
2491 SSVAL(*rparam,4,count_sent); /* is this right?? */
2492 SSVAL(*rparam,6,num_users); /* is this right?? */
2493
2494 return True;
2495 }
2496
2497 /****************************************************************************
2498 Get the time of day info.
2499 ****************************************************************************/
2500
2501 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2502 char *param, int tpscnt,
2503 char *data, int tdscnt,
2504 int mdrcnt,int mprcnt,
2505 char **rdata,char **rparam,
2506 int *rdata_len,int *rparam_len)
2507 {
2508 struct tm *t;
2509 time_t unixdate = time(NULL);
2510 char *p;
2511
2512 *rparam_len = 4;
2513 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2514 if (!*rparam) {
2515 return False;
2516 }
2517
2518 *rdata_len = 21;
2519 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2520 if (!*rdata) {
2521 return False;
2522 }
2523
2524 SSVAL(*rparam,0,NERR_Success);
2525 SSVAL(*rparam,2,0); /* converter word */
2526
2527 p = *rdata;
2528
2529 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2530 by NT in a "net time" operation,
2531 it seems to ignore the one below */
2532
2533 /* the client expects to get localtime, not GMT, in this bit
2534 (I think, this needs testing) */
2535 t = localtime(&unixdate);
2536 if (!t) {
2537 return False;
2538 }
2539
2540 SIVAL(p,4,0); /* msecs ? */
2541 SCVAL(p,8,t->tm_hour);
2542 SCVAL(p,9,t->tm_min);
2543 SCVAL(p,10,t->tm_sec);
2544 SCVAL(p,11,0); /* hundredths of seconds */
2545 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2546 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2547 SCVAL(p,16,t->tm_mday);
2548 SCVAL(p,17,t->tm_mon + 1);
2549 SSVAL(p,18,1900+t->tm_year);
2550 SCVAL(p,20,t->tm_wday);
2551
2552 return True;
2553 }
2554
2555 /****************************************************************************
2556 Set the user password.
2557 *****************************************************************************/
2558
2559 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2560 char *param, int tpscnt,
2561 char *data, int tdscnt,
2562 int mdrcnt,int mprcnt,
2563 char **rdata,char **rparam,
2564 int *rdata_len,int *rparam_len)
2565 {
2566 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2567 char *p = NULL;
2568 fstring user;
2569 fstring pass1,pass2;
2570
2571 /* Skip 2 strings. */
2572 p = skip_string(param,tpscnt,np);
2573 p = skip_string(param,tpscnt,p);
2574
2575 if (!np || !p) {
2576 return False;
2577 }
2578
2579 /* Do we have a string ? */
2580 if (skip_string(param,tpscnt,p) == NULL) {
2581 return False;
2582 }
2583 pull_ascii_fstring(user,p);
2584
2585 p = skip_string(param,tpscnt,p);
2586 if (!p) {
2587 return False;
2588 }
2589
2590 memset(pass1,'\0',sizeof(pass1));
2591 memset(pass2,'\0',sizeof(pass2));
2592 /*
2593 * We use 31 here not 32 as we're checking
2594 * the last byte we want to access is safe.
2595 */
2596 if (!is_offset_safe(param,tpscnt,p,31)) {
2597 return False;
2598 }
2599 memcpy(pass1,p,16);
2600 memcpy(pass2,p+16,16);
2601
2602 *rparam_len = 4;
2603 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2604 if (!*rparam) {
2605 return False;
2606 }
2607
2608 *rdata_len = 0;
2609
2610 SSVAL(*rparam,0,NERR_badpass);
2611 SSVAL(*rparam,2,0); /* converter word */
2612
2613 DEBUG(3,("Set password for <%s>\n",user));
2614
2615 /*
2616 * Attempt to verify the old password against smbpasswd entries
2617 * Win98 clients send old and new password in plaintext for this call.
2618 */
2619
2620 {
2621 auth_serversupplied_info *server_info = NULL;
2622 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2623
2624 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2625
2626 become_root();
2627 if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2628 SSVAL(*rparam,0,NERR_Success);
2629 }
2630 unbecome_root();
2631
2632 TALLOC_FREE(server_info);
2633 }
2634 data_blob_clear_free(&password);
2635 }
2636
2637 /*
2638 * If the plaintext change failed, attempt
2639 * the old encrypted method. NT will generate this
2640 * after trying the samr method. Note that this
2641 * method is done as a last resort as this
2642 * password change method loses the NT password hash
2643 * and cannot change the UNIX password as no plaintext
2644 * is received.
2645 */
2646
2647 if(SVAL(*rparam,0) != NERR_Success) {
2648 struct samu *hnd = NULL;
2649
2650 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2651 become_root();
2652 if (change_lanman_password(hnd,(uchar *)pass2)) {
2653 SSVAL(*rparam,0,NERR_Success);
2654 }
2655 unbecome_root();
2656 TALLOC_FREE(hnd);
2657 }
2658 }
2659
2660 memset((char *)pass1,'\0',sizeof(fstring));
2661 memset((char *)pass2,'\0',sizeof(fstring));
2662
2663 return(True);
2664 }
2665
2666 /****************************************************************************
2667 Set the user password (SamOEM version - gets plaintext).
2668 ****************************************************************************/
2669
2670 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2671 char *param, int tpscnt,
2672 char *data, int tdscnt,
2673 int mdrcnt,int mprcnt,
2674 char **rdata,char **rparam,
2675 int *rdata_len,int *rparam_len)
2676 {
2677 struct smbd_server_connection *sconn = smbd_server_conn;
2678 fstring user;
2679 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2680 *rparam_len = 2;
2681 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2682 if (!*rparam) {
2683 return False;
2684 }
2685
2686 if (!p) {
2687 return False;
2688 }
2689 *rdata_len = 0;
2690
2691 SSVAL(*rparam,0,NERR_badpass);
2692
2693 /*
2694 * Check the parameter definition is correct.
2695 */
2696
2697 /* Do we have a string ? */
2698 if (skip_string(param,tpscnt,p) == 0) {
2699 return False;
2700 }
2701 if(!strequal(p, "zsT")) {
2702 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2703 return False;
2704 }
2705 p = skip_string(param, tpscnt, p);
2706 if (!p) {
2707 return False;
2708 }
2709
2710 /* Do we have a string ? */
2711 if (skip_string(param,tpscnt,p) == 0) {
2712 return False;
2713 }
2714 if(!strequal(p, "B516B16")) {
2715 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2716 return False;
2717 }
2718 p = skip_string(param,tpscnt,p);
2719 if (!p) {
2720 return False;
2721 }
2722 /* Do we have a string ? */
2723 if (skip_string(param,tpscnt,p) == 0) {
2724 return False;
2725 }
2726 p += pull_ascii_fstring(user,p);
2727
2728 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2729
2730 /*
2731 * Pass the user through the NT -> unix user mapping
2732 * function.
2733 */
2734
2735 (void)map_username(sconn, user);
2736
2737 if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2738 SSVAL(*rparam,0,NERR_Success);
2739 }
2740
2741 return(True);
2742 }
2743
2744 /****************************************************************************
2745 delete a print job
2746 Form: <W> <>
2747 ****************************************************************************/
2748
2749 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2750 char *param, int tpscnt,
2751 char *data, int tdscnt,
2752 int mdrcnt,int mprcnt,
2753 char **rdata,char **rparam,
2754 int *rdata_len,int *rparam_len)
2755 {
2756 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2757 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2758 char *str2 = skip_string(param,tpscnt,str1);
2759 char *p = skip_string(param,tpscnt,str2);
2760 uint32 jobid;
2761 int snum;
2762 fstring sharename;
2763 int errcode;
2764 WERROR werr = WERR_OK;
2765
2766 if (!str1 || !str2 || !p) {
2767 return False;
2768 }
2769 /*
2770 * We use 1 here not 2 as we're checking
2771 * the last byte we want to access is safe.
2772 */
2773 if (!is_offset_safe(param,tpscnt,p,1)) {
2774 return False;
2775 }
2776 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2777 return False;
2778
2779 /* check it's a supported varient */
2780 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2781 return(False);
2782
2783 *rparam_len = 4;
2784 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2785 if (!*rparam) {
2786 return False;
2787 }
2788 *rdata_len = 0;
2789
2790 if (!print_job_exists(sharename, jobid)) {
2791 errcode = NERR_JobNotFound;
2792 goto out;
2793 }
2794
2795 snum = lp_servicenumber( sharename);
2796 if (snum == -1) {
2797 errcode = NERR_DestNotFound;
2798 goto out;
2799 }
2800
2801 errcode = NERR_notsupported;
2802
2803 switch (function) {
2804 case 81: /* delete */
2805 if (print_job_delete(conn->server_info, snum, jobid, &werr))
2806 errcode = NERR_Success;
2807 break;
2808 case 82: /* pause */
2809 if (print_job_pause(conn->server_info, snum, jobid, &werr))
2810 errcode = NERR_Success;
2811 break;
2812 case 83: /* resume */
2813 if (print_job_resume(conn->server_info, snum, jobid, &werr))
2814 errcode = NERR_Success;
2815 break;
2816 }
2817
2818 if (!W_ERROR_IS_OK(werr))
2819 errcode = W_ERROR_V(werr);
2820
2821 out:
2822 SSVAL(*rparam,0,errcode);
2823 SSVAL(*rparam,2,0); /* converter word */
2824
2825 return(True);
2826 }
2827
2828 /****************************************************************************
2829 Purge a print queue - or pause or resume it.
2830 ****************************************************************************/
2831
2832 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2833 char *param, int tpscnt,
2834 char *data, int tdscnt,
2835 int mdrcnt,int mprcnt,
2836 char **rdata,char **rparam,
2837 int *rdata_len,int *rparam_len)
2838 {
2839 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2840 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2841 char *str2 = skip_string(param,tpscnt,str1);
2842 char *QueueName = skip_string(param,tpscnt,str2);
2843 int errcode = NERR_notsupported;
2844 int snum;
2845 WERROR werr = WERR_OK;
2846
2847 if (!str1 || !str2 || !QueueName) {
2848 return False;
2849 }
2850
2851 /* check it's a supported varient */
2852 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2853 return(False);
2854
2855 *rparam_len = 4;
2856 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2857 if (!*rparam) {
2858 return False;
2859 }
2860 *rdata_len = 0;
2861
2862 if (skip_string(param,tpscnt,QueueName) == NULL) {
2863 return False;
2864 }
2865 snum = print_queue_snum(QueueName);
2866
2867 if (snum == -1) {
2868 errcode = NERR_JobNotFound;
2869 goto out;
2870 }
2871
2872 switch (function) {
2873 case 74: /* Pause queue */
2874 werr = print_queue_pause(conn->server_info, snum);
2875 break;
2876 case 75: /* Resume queue */
2877 werr = print_queue_resume(conn->server_info, snum);
2878 break;
2879 case 103: /* Purge */
2880 werr = print_queue_purge(conn->server_info, snum);
2881 break;
2882 default:
2883 werr = WERR_NOT_SUPPORTED;
2884 break;
2885 }
2886
2887 errcode = W_ERROR_V(werr);
2888
2889 out:
2890 SSVAL(*rparam,0,errcode);
2891 SSVAL(*rparam,2,0); /* converter word */
2892
2893 return(True);
2894 }
2895
2896 /****************************************************************************
2897 set the property of a print job (undocumented?)
2898 ? function = 0xb -> set name of print job
2899 ? function = 0x6 -> move print job up/down
2900 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2901 or <WWsTP> <WB21BB16B10zWWzDDz>
2902 ****************************************************************************/
2903
2904 static int check_printjob_info(struct pack_desc* desc,
2905 int uLevel, char* id)
2906 {
2907 desc->subformat = NULL;
2908 switch( uLevel ) {
2909 case 0: desc->format = "W"; break;
2910 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2911 case 2: desc->format = "WWzWWDDzz"; break;
2912 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2913 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2914 default:
2915 DEBUG(0,("check_printjob_info: invalid level %d\n",
2916 uLevel ));
2917 return False;
2918 }
2919 if (id == NULL || strcmp(desc->format,id) != 0) {
2920 DEBUG(0,("check_printjob_info: invalid format %s\n",
2921 id ? id : "<NULL>" ));
2922 return False;
2923 }
2924 return True;
2925 }
2926
2927 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2928 char *param, int tpscnt,
2929 char *data, int tdscnt,
2930 int mdrcnt,int mprcnt,
2931 char **rdata,char **rparam,
2932 int *rdata_len,int *rparam_len)
2933 {
2934 struct pack_desc desc;
2935 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2936 char *str2 = skip_string(param,tpscnt,str1);
2937 char *p = skip_string(param,tpscnt,str2);
2938 uint32 jobid;
2939 fstring sharename;
2940 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2941 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2942 int place, errcode;
2943
2944 if (!str1 || !str2 || !p) {
2945 return False;
2946 }
2947 /*
2948 * We use 1 here not 2 as we're checking
2949 * the last byte we want to access is safe.
2950 */
2951 if (!is_offset_safe(param,tpscnt,p,1)) {
2952 return False;
2953 }
2954 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2955 return False;
2956 *rparam_len = 4;
2957 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2958 if (!*rparam) {
2959 return False;
2960 }
2961
2962 if (!share_defined(sharename)) {
2963 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2964 sharename));
2965 return False;
2966 }
2967
2968 *rdata_len = 0;
2969
2970 /* check it's a supported varient */
2971 if ((strcmp(str1,"WWsTP")) ||
2972 (!check_printjob_info(&desc,uLevel,str2)))
2973 return(False);
2974
2975 if (!print_job_exists(sharename, jobid)) {
2976 errcode=NERR_JobNotFound;
2977 goto out;
2978 }
2979
2980 errcode = NERR_notsupported;
2981
2982 switch (function) {
2983 case 0x6:
2984 /* change job place in the queue,
2985 data gives the new place */
2986 place = SVAL(data,0);
2987 if (print_job_set_place(sharename, jobid, place)) {
2988 errcode=NERR_Success;
2989 }
2990 break;
2991
2992 case 0xb:
2993 /* change print job name, data gives the name */
2994 if (print_job_set_name(sharename, jobid, data)) {
2995 errcode=NERR_Success;
2996 }
2997 break;
2998
2999 default:
3000 return False;
3001 }
3002
3003 out:
3004 SSVALS(*rparam,0,errcode);
3005 SSVAL(*rparam,2,0); /* converter word */
3006
3007 return(True);
3008 }
3009
3010
3011 /****************************************************************************
3012 Get info about the server.
3013 ****************************************************************************/
3014
3015 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3016 char *param, int tpscnt,
3017 char *data, int tdscnt,
3018 int mdrcnt,int mprcnt,
3019 char **rdata,char **rparam,
3020 int *rdata_len,int *rparam_len)
3021 {
3022 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3023 char *str2 = skip_string(param,tpscnt,str1);
3024 char *p = skip_string(param,tpscnt,str2);
3025 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3026 char *p2;
3027 int struct_len;
3028
3029 if (!str1 || !str2 || !p) {
3030 return False;
3031 }
3032
3033 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3034
3035 /* check it's a supported varient */
3036 if (!prefix_ok(str1,"WrLh")) {
3037 return False;
3038 }
3039
3040 switch( uLevel ) {
3041 case 0:
3042 if (strcmp(str2,"B16") != 0) {
3043 return False;
3044 }
3045 struct_len = 16;
3046 break;
3047 case 1:
3048 if (strcmp(str2,"B16BBDz") != 0) {
3049 return False;
3050 }
3051 struct_len = 26;
3052 break;
3053 case 2:
3054 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3055 return False;
3056 }
3057 struct_len = 134;
3058 break;
3059 case 3:
3060 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3061 return False;
3062 }
3063 struct_len = 144;
3064 break;
3065 case 20:
3066 if (strcmp(str2,"DN") != 0) {
3067 return False;
3068 }
3069 struct_len = 6;
3070 break;
3071 case 50:
3072 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3073 return False;
3074 }
3075 struct_len = 42;
3076 break;
3077 default:
3078 return False;
3079 }
3080
3081 *rdata_len = mdrcnt;
3082 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3083 if (!*rdata) {
3084 return False;
3085 }
3086
3087 p = *rdata;
3088 p2 = p + struct_len;
3089 if (uLevel != 20) {
3090 srvstr_push(NULL, 0, p,global_myname(),16,
3091 STR_ASCII|STR_UPPER|STR_TERMINATE);
3092 }
3093 p += 16;
3094 if (uLevel > 0) {
3095 struct srv_info_struct *servers=NULL;
3096 int i,count;
3097 char *comment = NULL;
3098 TALLOC_CTX *ctx = talloc_tos();
3099 uint32 servertype= lp_default_server_announce();
3100
3101 comment = talloc_strdup(ctx,lp_serverstring());
3102 if (!comment) {
3103 return false;
3104 }
3105
3106 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3107 for (i=0;i<count;i++) {
3108 if (strequal(servers[i].name,global_myname())) {
3109 servertype = servers[i].type;
3110 TALLOC_FREE(comment);
3111 comment = talloc_strdup(ctx,
3112 servers[i].comment);
3113 if (comment) {
3114 return false;
3115 }
3116 }
3117 }
3118 }
3119
3120 SAFE_FREE(servers);
3121
3122 SCVAL(p,0,lp_major_announce_version());
3123 SCVAL(p,1,lp_minor_announce_version());
3124 SIVAL(p,2,servertype);
3125
3126 if (mdrcnt == struct_len) {
3127 SIVAL(p,6,0);
3128 } else {
3129 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3130 comment = talloc_sub_advanced(
3131 ctx,
3132 lp_servicename(SNUM(conn)),
3133 conn->server_info->unix_name,
3134 conn->connectpath,
3135 conn->server_info->utok.gid,
3136 conn->server_info->sanitized_username,
3137 pdb_get_domain(conn->server_info->sam_account),
3138 comment);
3139 if (comment) {
3140 return false;
3141 }
3142 if (mdrcnt - struct_len <= 0) {
3143 return false;
3144 }
3145 push_ascii(p2,
3146 comment,
3147 MIN(mdrcnt - struct_len,
3148 MAX_SERVER_STRING_LENGTH),
3149 STR_TERMINATE);
3150 p2 = skip_string(*rdata,*rdata_len,p2);
3151 if (!p2) {
3152 return False;
3153 }
3154 }
3155 }
3156
3157 if (uLevel > 1) {
3158 return False; /* not yet implemented */
3159 }
3160
3161 *rdata_len = PTR_DIFF(p2,*rdata);
3162
3163 *rparam_len = 6;
3164 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3165 if (!*rparam) {
3166 return False;
3167 }
3168 SSVAL(*rparam,0,NERR_Success);
3169 SSVAL(*rparam,2,0); /* converter word */
3170 SSVAL(*rparam,4,*rdata_len);
3171
3172 return True;
3173 }
3174
3175 /****************************************************************************
3176 Get info about the server.
3177 ****************************************************************************/
3178
3179 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3180 char *param, int tpscnt,
3181 char *data, int tdscnt,
3182 int mdrcnt,int mprcnt,
3183 char **rdata,char **rparam,
3184 int *rdata_len,int *rparam_len)
3185 {
3186 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3187 char *str2 = skip_string(param,tpscnt,str1);
3188 char *p = skip_string(param,tpscnt,str2);
3189 char *p2;
3190 char *endp;
3191 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3192
3193 if (!str1 || !str2 || !p) {
3194 return False;
3195 }
3196
3197 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3198
3199 *rparam_len = 6;
3200 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3201 if (!*rparam) {
3202 return False;
3203 }
3204
3205 /* check it's a supported varient */
3206 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3207 return False;
3208 }
3209
3210 *rdata_len = mdrcnt + 1024;
3211 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3212 if (!*rdata) {
3213 return False;
3214 }
3215
3216 SSVAL(*rparam,0,NERR_Success);
3217 SSVAL(*rparam,2,0); /* converter word */
3218
3219 p = *rdata;
3220 endp = *rdata + *rdata_len;
3221
3222 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3223 if (!p2) {
3224 return False;
3225 }
3226
3227 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3228 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3229 strupper_m(p2);
3230 p2 = skip_string(*rdata,*rdata_len,p2);
3231 if (!p2) {
3232 return False;
3233 }
3234 p += 4;
3235
3236 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3237 strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3238 p2 = skip_string(*rdata,*rdata_len,p2);
3239 if (!p2) {
3240 return False;
3241 }
3242 p += 4;
3243
3244 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3245 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3246 strupper_m(p2);
3247 p2 = skip_string(*rdata,*rdata_len,p2);
3248 if (!p2) {
3249 return False;
3250 }
3251 p += 4;
3252
3253 SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3254 SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3255 p += 2;
3256
3257 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3258 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3259 p2 = skip_string(*rdata,*rdata_len,p2);
3260 if (!p2) {
3261 return False;
3262 }
3263 p += 4;
3264
3265 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3266 strlcpy(p2,"",PTR_DIFF(endp,p2));
3267 p2 = skip_string(*rdata,*rdata_len,p2);
3268 if (!p2) {
3269 return False;
3270 }
3271 p += 4;
3272
3273 *rdata_len = PTR_DIFF(p2,*rdata);
3274
3275 SSVAL(*rparam,4,*rdata_len);
3276
3277 return True;
3278 }
3279
3280 /****************************************************************************
3281 get info about a user
3282
3283 struct user_info_11 {
3284 char usri11_name[21]; 0-20
3285 char usri11_pad; 21
3286 char *usri11_comment; 22-25
3287 char *usri11_usr_comment; 26-29
3288 unsigned short usri11_priv; 30-31
3289 unsigned long usri11_auth_flags; 32-35
3290 long usri11_password_age; 36-39
3291 char *usri11_homedir; 40-43
3292 char *usri11_parms; 44-47
3293 long usri11_last_logon; 48-51
3294 long usri11_last_logoff; 52-55
3295 unsigned short usri11_bad_pw_count; 56-57
3296 unsigned short usri11_num_logons; 58-59
3297 char *usri11_logon_server; 60-63
3298 unsigned short usri11_country_code; 64-65
3299 char *usri11_workstations; 66-69
3300 unsigned long usri11_max_storage; 70-73
3301 unsigned short usri11_units_per_week; 74-75
3302 unsigned char *usri11_logon_hours; 76-79
3303 unsigned short usri11_code_page; 80-81
3304 };
3305
3306 where:
3307
3308 usri11_name specifies the user name for which information is retrieved
3309
3310 usri11_pad aligns the next data structure element to a word boundary
3311
3312 usri11_comment is a null terminated ASCII comment
3313
3314 usri11_user_comment is a null terminated ASCII comment about the user
3315
3316 usri11_priv specifies the level of the privilege assigned to the user.
3317 The possible values are:
3318
3319 Name Value Description
3320 USER_PRIV_GUEST 0 Guest privilege
3321 USER_PRIV_USER 1 User privilege
3322 USER_PRV_ADMIN 2 Administrator privilege
3323
3324 usri11_auth_flags specifies the account operator privileges. The
3325 possible values are:
3326
3327 Name Value Description
3328 AF_OP_PRINT 0 Print operator
3329
3330
3331 Leach, Naik [Page 28]
3332 \f
3333
3334
3335 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3336
3337
3338 AF_OP_COMM 1 Communications operator
3339 AF_OP_SERVER 2 Server operator
3340 AF_OP_ACCOUNTS 3 Accounts operator
3341
3342
3343 usri11_password_age specifies how many seconds have elapsed since the
3344 password was last changed.
3345
3346 usri11_home_dir points to a null terminated ASCII string that contains
3347 the path name of the user's home directory.
3348
3349 usri11_parms points to a null terminated ASCII string that is set
3350 aside for use by applications.
3351
3352 usri11_last_logon specifies the time when the user last logged on.
3353 This value is stored as the number of seconds elapsed since
3354 00:00:00, January 1, 1970.
3355
3356 usri11_last_logoff specifies the time when the user last logged off.
3357 This value is stored as the number of seconds elapsed since
3358 00:00:00, January 1, 1970. A value of 0 means the last logoff
3359 time is unknown.
3360
3361 usri11_bad_pw_count specifies the number of incorrect passwords
3362 entered since the last successful logon.
3363
3364 usri11_log1_num_logons specifies the number of times this user has
3365 logged on. A value of -1 means the number of logons is unknown.
3366
3367 usri11_logon_server points to a null terminated ASCII string that
3368 contains the name of the server to which logon requests are sent.
3369 A null string indicates logon requests should be sent to the
3370 domain controller.
3371
3372 usri11_country_code specifies the country code for the user's language
3373 of choice.
3374
3375 usri11_workstations points to a null terminated ASCII string that
3376 contains the names of workstations the user may log on from.
3377 There may be up to 8 workstations, with the names separated by
3378 commas. A null strings indicates there are no restrictions.
3379
3380 usri11_max_storage specifies the maximum amount of disk space the user
3381 can occupy. A value of 0xffffffff indicates there are no
3382 restrictions.
3383
3384 usri11_units_per_week specifies the equal number of time units into
3385 which a week is divided. This value must be equal to 168.
3386
3387 usri11_logon_hours points to a 21 byte (168 bits) string that
3388 specifies the time during which the user can log on. Each bit
3389 represents one unique hour in a week. The first bit (bit 0, word
3390 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3391
3392
3393
3394 Leach, Naik [Page 29]
3395 \f
3396
3397
3398 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3399
3400
3401 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3402 are no restrictions.
3403
3404 usri11_code_page specifies the code page for the user's language of
3405 choice
3406
3407 All of the pointers in this data structure need to be treated
3408 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3409 to be ignored. The converter word returned in the parameters section
3410 needs to be subtracted from the lower 16 bits to calculate an offset
3411 into the return buffer where this ASCII string resides.
3412
3413 There is no auxiliary data in the response.
3414
3415 ****************************************************************************/
3416
3417 #define usri11_name 0
3418 #define usri11_pad 21
3419 #define usri11_comment 22
3420 #define usri11_usr_comment 26
3421 #define usri11_full_name 30
3422 #define usri11_priv 34
3423 #define usri11_auth_flags 36
3424 #define usri11_password_age 40
3425 #define usri11_homedir 44
3426 #define usri11_parms 48
3427 #define usri11_last_logon 52
3428 #define usri11_last_logoff 56
3429 #define usri11_bad_pw_count 60
3430 #define usri11_num_logons 62
3431 #define usri11_logon_server 64
3432 #define usri11_country_code 68
3433 #define usri11_workstations 70
3434 #define usri11_max_storage 74
3435 #define usri11_units_per_week 78
3436 #define usri11_logon_hours 80
3437 #define usri11_code_page 84
3438 #define usri11_end 86
3439
3440 #define USER_PRIV_GUEST 0
3441 #define USER_PRIV_USER 1
3442 #define USER_PRIV_ADMIN 2
3443
3444 #define AF_OP_PRINT 0
3445 #define AF_OP_COMM 1
3446 #define AF_OP_SERVER 2
3447 #define AF_OP_ACCOUNTS 3
3448
3449
3450 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3451 char *param, int tpscnt,
3452 char *data, int tdscnt,
3453 int mdrcnt,int mprcnt,
3454 char **rdata,char **rparam,
3455 int *rdata_len,int *rparam_len)
3456 {
3457 struct smbd_server_connection *sconn = smbd_server_conn;
3458 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3459 char *str2 = skip_string(param,tpscnt,str1);
3460 char *UserName = skip_string(param,tpscnt,str2);
3461 char *p = skip_string(param,tpscnt,UserName);
3462 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3463 char *p2;
3464 char *endp;
3465 const char *level_string;
3466
3467 /* get NIS home of a previously validated user - simeon */
3468 /* With share level security vuid will always be zero.
3469 Don't depend on vuser being non-null !!. JRA */
3470 user_struct *vuser = get_valid_user_struct(sconn, vuid);
3471 if(vuser != NULL) {
3472 DEBUG(3,(" Username of UID %d is %s\n",
3473 (int)vuser->server_info->utok.uid,
3474 vuser->server_info->unix_name));
3475 }
3476
3477 if (!str1 || !str2 || !UserName || !p) {
3478 return False;
3479 }
3480
3481 *rparam_len = 6;
3482 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3483 if (!*rparam) {
3484 return False;
3485 }
3486
3487 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3488
3489 /* check it's a supported variant */
3490 if (strcmp(str1,"zWrLh") != 0) {
3491 return False;
3492 }
3493 switch( uLevel ) {
3494 case 0: level_string = "B21"; break;
3495 case 1: level_string = "B21BB16DWzzWz"; break;
3496 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3497 case 10: level_string = "B21Bzzz"; break;
3498 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3499 default: return False;
3500 }
3501
3502 if (strcmp(level_string,str2) != 0) {
3503 return False;
3504 }
3505
3506 *rdata_len = mdrcnt + 1024;
3507 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3508 if (!*rdata) {
3509 return False;
3510 }
3511
3512 SSVAL(*rparam,0,NERR_Success);
3513 SSVAL(*rparam,2,0); /* converter word */
3514
3515 p = *rdata;
3516 endp = *rdata + *rdata_len;
3517 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3518 if (!p2) {
3519 return False;
3520 }
3521
3522 memset(p,0,21);
3523 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3524
3525 if (uLevel > 0) {
3526 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3527 *p2 = 0;
3528 }
3529
3530 if (uLevel >= 10) {
3531 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3532 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3533 p2 = skip_string(*rdata,*rdata_len,p2);
3534 if (!p2) {
3535 return False;
3536 }
3537
3538 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3539 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3540 p2 = skip_string(*rdata,*rdata_len,p2);
3541 if (!p2) {
3542 return False;
3543 }
3544
3545 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3546 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3547 strlcpy(p2,((vuser != NULL)
3548 ? pdb_get_fullname(vuser->server_info->sam_account)
3549 : UserName),PTR_DIFF(endp,p2));
3550 p2 = skip_string(*rdata,*rdata_len,p2);
3551 if (!p2) {
3552 return False;
3553 }
3554 }
3555
3556 if (uLevel == 11) {
3557 const char *homedir = "";
3558 if (vuser != NULL) {
3559 homedir = pdb_get_homedir(
3560 vuser->server_info->sam_account);
3561 }
3562 /* modelled after NTAS 3.51 reply */
3563 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3564 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
3565 SIVALS(p,usri11_password_age,-1); /* password age */
3566 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3567 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3568 p2 = skip_string(*rdata,*rdata_len,p2);
3569 if (!p2) {
3570 return False;
3571 }
3572 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3573 strlcpy(p2,"",PTR_DIFF(endp,p2));
3574 p2 = skip_string(*rdata,*rdata_len,p2);
3575 if (!p2) {
3576 return False;
3577 }
3578 SIVAL(p,usri11_last_logon,0); /* last logon */
3579 SIVAL(p,usri11_last_logoff,0); /* last logoff */
3580 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
3581 SSVALS(p,usri11_num_logons,-1); /* num logons */
3582 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3583 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3584 p2 = skip_string(*rdata,*rdata_len,p2);
3585 if (!p2) {
3586 return False;
3587 }
3588 SSVAL(p,usri11_country_code,0); /* country code */
3589
3590 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3591 strlcpy(p2,"",PTR_DIFF(endp,p2));
3592 p2 = skip_string(*rdata,*rdata_len,p2);
3593 if (!p2) {
3594 return False;
3595 }
3596
3597 SIVALS(p,usri11_max_storage,-1); /* max storage */
3598 SSVAL(p,usri11_units_per_week,168); /* units per week */
3599 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3600
3601 /* a simple way to get logon hours at all times. */
3602 memset(p2,0xff,21);
3603 SCVAL(p2,21,0); /* fix zero termination */
3604 p2 = skip_string(*rdata,*rdata_len,p2);
3605 if (!p2) {
3606 return False;
3607 }
3608
3609 SSVAL(p,usri11_code_page,0); /* code page */
3610 }
3611
3612 if (uLevel == 1 || uLevel == 2) {
3613 memset(p+22,' ',16); /* password */
3614 SIVALS(p,38,-1); /* password age */
3615 SSVAL(p,42,
3616 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3617 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3618 strlcpy(p2, vuser ? pdb_get_homedir(
3619 vuser->server_info->sam_account) : "",
3620 PTR_DIFF(endp,p2));
3621 p2 = skip_string(*rdata,*rdata_len,p2);
3622 if (!p2) {
3623 return False;
3624 }
3625 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3626 *p2++ = 0;
3627 SSVAL(p,52,0); /* flags */
3628 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
3629 strlcpy(p2, vuser ? pdb_get_logon_script(
3630 vuser->server_info->sam_account) : "",
3631 PTR_DIFF(endp,p2));
3632 p2 = skip_string(*rdata,*rdata_len,p2);
3633 if (!p2) {
3634 return False;
3635 }
3636 if (uLevel == 2) {
3637 SIVAL(p,60,0); /* auth_flags */
3638 SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3639 strlcpy(p2,((vuser != NULL)
3640 ? pdb_get_fullname(vuser->server_info->sam_account)
3641 : UserName),PTR_DIFF(endp,p2));
3642 p2 = skip_string(*rdata,*rdata_len,p2);
3643 if (!p2) {
3644 return False;
3645 }
3646 SIVAL(p,68,0); /* urs_comment */
3647 SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3648 strlcpy(p2,"",PTR_DIFF(endp,p2));
3649 p2 = skip_string(*rdata,*rdata_len,p2);
3650 if (!p2) {
3651 return False;
3652 }
3653 SIVAL(p,76,0); /* workstations */
3654 SIVAL(p,80,0); /* last_logon */
3655 SIVAL(p,84,0); /* last_logoff */
3656 SIVALS(p,88,-1); /* acct_expires */
3657 SIVALS(p,92,-1); /* max_storage */
3658 SSVAL(p,96,168); /* units_per_week */
3659 SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3660 memset(p2,-1,21);
3661 p2 += 21;
3662 SSVALS(p,102,-1); /* bad_pw_count */
3663 SSVALS(p,104,-1); /* num_logons */
3664 SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3665 {
3666 TALLOC_CTX *ctx = talloc_tos();
3667 int space_rem = *rdata_len - (p2 - *rdata);
3668 char *tmp;
3669
3670 if (space_rem <= 0) {
3671 return false;
3672 }
3673 tmp = talloc_strdup(ctx, "\\\\%L");
3674 if (!tmp) {
3675 return false;
3676 }
3677 tmp = talloc_sub_basic(ctx,
3678 "",
3679 "",
3680 tmp);
3681 if (!tmp) {
3682 return false;
3683 }
3684
3685 push_ascii(p2,
3686 tmp,
3687 space_rem,
3688 STR_TERMINATE);
3689 }
3690 p2 = skip_string(*rdata,*rdata_len,p2);
3691 if (!p2) {
3692 return False;
3693 }
3694 SSVAL(p,110,49); /* country_code */
3695 SSVAL(p,112,860); /* code page */
3696 }
3697 }
3698
3699 *rdata_len = PTR_DIFF(p2,*rdata);
3700
3701 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
3702
3703 return(True);
3704 }
3705
3706 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3707 char *param, int tpscnt,
3708 char *data, int tdscnt,
3709 int mdrcnt,int mprcnt,
3710 char **rdata,char **rparam,
3711 int *rdata_len,int *rparam_len)
3712 {
3713 struct smbd_server_connection *sconn = smbd_server_conn;
3714 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3715 char *str2 = skip_string(param,tpscnt,str1);
3716 char *p = skip_string(param,tpscnt,str2);
3717 int uLevel;
3718 struct pack_desc desc;
3719 char* name;
3720 /* With share level security vuid will always be zero.
3721 Don't depend on vuser being non-null !!. JRA */
3722 user_struct *vuser = get_valid_user_struct(sconn, vuid);
3723
3724 if (!str1 || !str2 || !p) {
3725 return False;
3726 }
3727
3728 if(vuser != NULL) {
3729 DEBUG(3,(" Username of UID %d is %s\n",
3730 (int)vuser->server_info->utok.uid,
3731 vuser->server_info->unix_name));
3732 }
3733
3734 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3735 name = get_safe_str_ptr(param,tpscnt,p,2);
3736 if (!name) {
3737 return False;
3738 }
3739
3740 memset((char *)&desc,'\0',sizeof(desc));
3741
3742 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3743
3744 /* check it's a supported varient */
3745 if (strcmp(str1,"OOWb54WrLh") != 0) {
3746 return False;
3747 }
3748 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3749 return False;
3750 }
3751 if (mdrcnt > 0) {
3752 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3753 if (!*rdata) {
3754 return False;
3755 }
3756 }
3757
3758 desc.base = *rdata;
3759 desc.buflen = mdrcnt;
3760 desc.subformat = NULL;
3761 desc.format = str2;
3762
3763 if (init_package(&desc,1,0)) {
3764 PACKI(&desc,"W",0); /* code */
3765 PACKS(&desc,"B21",name); /* eff. name */
3766 PACKS(&desc,"B",""); /* pad */
3767 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3768 PACKI(&desc,"D",0); /* auth flags XXX */
3769 PACKI(&desc,"W",0); /* num logons */
3770 PACKI(&desc,"W",0); /* bad pw count */
3771 PACKI(&desc,"D",0); /* last logon */
3772 PACKI(&desc,"D",-1); /* last logoff */
3773 PACKI(&desc,"D",-1); /* logoff time */
3774 PACKI(&desc,"D",-1); /* kickoff time */
3775 PACKI(&desc,"D",0); /* password age */
3776 PACKI(&desc,"D",0); /* password can change */
3777 PACKI(&desc,"D",-1); /* password must change */
3778
3779 {
3780 fstring mypath;
3781 fstrcpy(mypath,"\\\\");
3782 fstrcat(mypath,get_local_machine_name());
3783 strupper_m(mypath);
3784 PACKS(&desc,"z",mypath); /* computer */
3785 }
3786
3787 PACKS(&desc,"z",lp_workgroup());/* domain */
3788 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3789 vuser->server_info->sam_account) : ""); /* script path */
3790 PACKI(&desc,"D",0x00000000); /* reserved */
3791 }
3792
3793 *rdata_len = desc.usedlen;
3794 *rparam_len = 6;
3795 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3796 if (!*rparam) {
3797 return False;
3798 }
3799 SSVALS(*rparam,0,desc.errcode);
3800 SSVAL(*rparam,2,0);
3801 SSVAL(*rparam,4,desc.neededlen);
3802
3803 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3804
3805 return True;
3806 }
3807
3808 /****************************************************************************
3809 api_WAccessGetUserPerms
3810 ****************************************************************************/
3811
3812 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3813 char *param, int tpscnt,
3814 char *data, int tdscnt,
3815 int mdrcnt,int mprcnt,
3816 char **rdata,char **rparam,
3817 int *rdata_len,int *rparam_len)
3818 {
3819 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3820 char *str2 = skip_string(param,tpscnt,str1);
3821 char *user = skip_string(param,tpscnt,str2);
3822 char *resource = skip_string(param,tpscnt,user);
3823
3824 if (!str1 || !str2 || !user || !resource) {
3825 return False;
3826 }
3827
3828 if (skip_string(param,tpscnt,resource) == NULL) {
3829 return False;
3830 }
3831 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3832
3833 /* check it's a supported varient */
3834 if (strcmp(str1,"zzh") != 0) {
3835 return False;
3836 }
3837 if (strcmp(str2,"") != 0) {
3838 return False;
3839 }
3840
3841 *rparam_len = 6;
3842 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3843 if (!*rparam) {
3844 return False;
3845 }
3846 SSVALS(*rparam,0,0); /* errorcode */
3847 SSVAL(*rparam,2,0); /* converter word */
3848 SSVAL(*rparam,4,0x7f); /* permission flags */
3849
3850 return True;
3851 }
3852
3853 /****************************************************************************
3854 api_WPrintJobEnumerate
3855 ****************************************************************************/
3856
3857 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3858 char *param, int tpscnt,
3859 char *data, int tdscnt,
3860 int mdrcnt,int mprcnt,
3861 char **rdata,char **rparam,
3862 int *rdata_len,int *rparam_len)
3863 {
3864 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3865 char *str2 = skip_string(param,tpscnt,str1);
3866 char *p = skip_string(param,tpscnt,str2);
3867 int uLevel;
3868 int count;
3869 int i;
3870 int snum;
3871 fstring sharename;
3872 uint32 jobid;
3873 struct pack_desc desc;
3874 print_queue_struct *queue=NULL;
3875 print_status_struct status;
3876 char *tmpdata=NULL;
3877
3878 if (!str1 || !str2 || !p) {
3879 return False;
3880 }
3881
3882 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3883
3884 memset((char *)&desc,'\0',sizeof(desc));
3885 memset((char *)&status,'\0',sizeof(status));
3886
3887 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3888
3889 /* check it's a supported varient */
3890 if (strcmp(str1,"WWrLh") != 0) {
3891 return False;
3892 }
3893 if (!check_printjob_info(&desc,uLevel,str2)) {
3894 return False;
3895 }
3896
3897 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3898 return False;
3899 }
3900
3901 snum = lp_servicenumber( sharename);
3902 if (snum < 0 || !VALID_SNUM(snum)) {
3903 return(False);
3904 }
3905
3906 count = print_queue_status(snum,&queue,&status);
3907 for (i = 0; i < count; i++) {
3908 if (queue[i].job == jobid) {
3909 break;
3910 }
3911 }
3912
3913 if (mdrcnt > 0) {
3914 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3915 if (!*rdata) {
3916 return False;
3917 }
3918 desc.base = *rdata;
3919 desc.buflen = mdrcnt;
3920 } else {
3921 /*
3922 * Don't return data but need to get correct length
3923 * init_package will return wrong size if buflen=0
3924 */
3925 desc.buflen = getlen(desc.format);
3926 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3927 }
3928
3929 if (init_package(&desc,1,0)) {
3930 if (i < count) {
3931 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3932 *rdata_len = desc.usedlen;
3933 } else {
3934 desc.errcode = NERR_JobNotFound;
3935 *rdata_len = 0;
3936 }
3937 }
3938
3939 *rparam_len = 6;
3940 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3941 if (!*rparam) {
3942 return False;
3943 }
3944 SSVALS(*rparam,0,desc.errcode);
3945 SSVAL(*rparam,2,0);
3946 SSVAL(*rparam,4,desc.neededlen);
3947
3948 SAFE_FREE(queue);
3949 SAFE_FREE(tmpdata);
3950
3951 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3952
3953 return True;
3954 }
3955
3956 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3957 char *param, int tpscnt,
3958 char *data, int tdscnt,
3959 int mdrcnt,int mprcnt,
3960 char **rdata,char **rparam,
3961 int *rdata_len,int *rparam_len)
3962 {
3963 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3964 char *str2 = skip_string(param,tpscnt,str1);
3965 char *p = skip_string(param,tpscnt,str2);
3966 char *name = p;
3967 int uLevel;
3968 int count;
3969 int i, succnt=0;
3970 int snum;
3971 struct pack_desc desc;
3972 print_queue_struct *queue=NULL;
3973 print_status_struct status;
3974
3975 if (!str1 || !str2 || !p) {
3976 return False;
3977 }
3978
3979 memset((char *)&desc,'\0',sizeof(desc));
3980 memset((char *)&status,'\0',sizeof(status));
3981
3982 p = skip_string(param,tpscnt,p);
3983 if (!p) {
3984 return False;
3985 }
3986 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3987
3988 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3989
3990 /* check it's a supported variant */
3991 if (strcmp(str1,"zWrLeh") != 0) {
3992 return False;
3993 }
3994
3995 if (uLevel > 2) {
3996 return False; /* defined only for uLevel 0,1,2 */
3997 }
3998
3999 if (!check_printjob_info(&desc,uLevel,str2)) {
4000 return False;
4001 }
4002
4003 snum = find_service(name);
4004 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4005 return False;
4006 }
4007
4008 count = print_queue_status(snum,&queue,&status);
4009 if (mdrcnt > 0) {
4010 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4011 if (!*rdata) {
4012 return False;
4013 }
4014 }
4015 desc.base = *rdata;
4016 desc.buflen = mdrcnt;
4017
4018 if (init_package(&desc,count,0)) {
4019 succnt = 0;
4020 for (i = 0; i < count; i++) {
4021 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4022 if (desc.errcode == NERR_Success) {
4023 succnt = i+1;
4024 }
4025 }
4026 }
4027
4028 *rdata_len = desc.usedlen;
4029
4030 *rparam_len = 8;
4031 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4032 if (!*rparam) {
4033 return False;
4034 }
4035 SSVALS(*rparam,0,desc.errcode);
4036 SSVAL(*rparam,2,0);
4037 SSVAL(*rparam,4,succnt);
4038 SSVAL(*rparam,6,count);
4039
4040 SAFE_FREE(queue);
4041
4042 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4043
4044 return True;
4045 }
4046
4047 static int check_printdest_info(struct pack_desc* desc,
4048 int uLevel, char* id)
4049 {
4050 desc->subformat = NULL;
4051 switch( uLevel ) {
4052 case 0:
4053 desc->format = "B9";
4054 break;
4055 case 1:
4056 desc->format = "B9B21WWzW";
4057 break;
4058 case 2:
4059 desc->format = "z";
4060 break;
4061 case 3:
4062 desc->format = "zzzWWzzzWW";
4063 break;
4064 default:
4065 DEBUG(0,("check_printdest_info: invalid level %d\n",
4066 uLevel));
4067 return False;
4068 }
4069 if (id == NULL || strcmp(desc->format,id) != 0) {
4070 DEBUG(0,("check_printdest_info: invalid string %s\n",
4071 id ? id : "<NULL>" ));
4072 return False;
4073 }
4074 return True;
4075 }
4076
4077 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4078 struct pack_desc* desc)
4079 {
4080 char buf[100];
4081
4082 strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4083 buf[sizeof(buf)-1] = 0;
4084 strupper_m(buf);
4085
4086 if (uLevel <= 1) {
4087 PACKS(desc,"B9",buf); /* szName */
4088 if (uLevel == 1) {
4089 PACKS(desc,"B21",""); /* szUserName */
4090 PACKI(desc,"W",0); /* uJobId */
4091 PACKI(desc,"W",0); /* fsStatus */
4092 PACKS(desc,"z",""); /* pszStatus */
4093 PACKI(desc,"W",0); /* time */
4094 }
4095 }
4096
4097 if (uLevel == 2 || uLevel == 3) {
4098 PACKS(desc,"z",buf); /* pszPrinterName */
4099 if (uLevel == 3) {
4100 PACKS(desc,"z",""); /* pszUserName */
4101 PACKS(desc,"z",""); /* pszLogAddr */
4102 PACKI(desc,"W",0); /* uJobId */
4103 PACKI(desc,"W",0); /* fsStatus */
4104 PACKS(desc,"z",""); /* pszStatus */
4105 PACKS(desc,"z",""); /* pszComment */
4106 PACKS(desc,"z","NULL"); /* pszDrivers */
4107 PACKI(desc,"W",0); /* time */
4108 PACKI(desc,"W",0); /* pad1 */
4109 }
4110 }
4111 }
4112
4113 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4114 char *param, int tpscnt,
4115 char *data, int tdscnt,
4116 int mdrcnt,int mprcnt,
4117 char **rdata,char **rparam,
4118 int *rdata_len,int *rparam_len)
4119 {
4120 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4121 char *str2 = skip_string(param,tpscnt,str1);
4122 char *p = skip_string(param,tpscnt,str2);
4123 char* PrinterName = p;
4124 int uLevel;
4125 struct pack_desc desc;
4126 int snum;
4127 char *tmpdata=NULL;
4128
4129 if (!str1 || !str2 || !p) {
4130 return False;
4131 }
4132
4133 memset((char *)&desc,'\0',sizeof(desc));
4134
4135 p = skip_string(param,tpscnt,p);
4136 if (!p) {
4137 return False;
4138 }
4139 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4140
4141 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4142
4143 /* check it's a supported varient */
4144 if (strcmp(str1,"zWrLh") != 0) {
4145 return False;
4146 }
4147 if (!check_printdest_info(&desc,uLevel,str2)) {
4148 return False;
4149 }
4150
4151 snum = find_service(PrinterName);
4152 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4153 *rdata_len = 0;
4154 desc.errcode = NERR_DestNotFound;
4155 desc.neededlen = 0;
4156 } else {
4157 if (mdrcnt > 0) {
4158 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4159 if (!*rdata) {
4160 return False;
4161 }
4162 desc.base = *rdata;
4163 desc.buflen = mdrcnt;
4164 } else {
4165 /*
4166 * Don't return data but need to get correct length
4167 * init_package will return wrong size if buflen=0
4168 */
4169 desc.buflen = getlen(desc.format);
4170 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4171 }
4172 if (init_package(&desc,1,0)) {
4173 fill_printdest_info(conn,snum,uLevel,&desc);
4174 }
4175 *rdata_len = desc.usedlen;
4176 }
4177
4178 *rparam_len = 6;
4179 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4180 if (!*rparam) {
4181 return False;
4182 }
4183 SSVALS(*rparam,0,desc.errcode);
4184 SSVAL(*rparam,2,0);
4185 SSVAL(*rparam,4,desc.neededlen);
4186
4187 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4188 SAFE_FREE(tmpdata);
4189
4190 return True;
4191 }
4192
4193 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4194 char *param, int tpscnt,
4195 char *data, int tdscnt,
4196 int mdrcnt,int mprcnt,
4197 char **rdata,char **rparam,
4198 int *rdata_len,int *rparam_len)
4199 {
4200 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4201 char *str2 = skip_string(param,tpscnt,str1);
4202 char *p = skip_string(param,tpscnt,str2);
4203 int uLevel;
4204 int queuecnt;
4205 int i, n, succnt=0;
4206 struct pack_desc desc;
4207 int services = lp_numservices();
4208
4209 if (!str1 || !str2 || !p) {
4210 return False;
4211 }
4212
4213 memset((char *)&desc,'\0',sizeof(desc));
4214
4215 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4216
4217 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4218
4219 /* check it's a supported varient */
4220 if (strcmp(str1,"WrLeh") != 0) {
4221 return False;
4222 }
4223 if (!check_printdest_info(&desc,uLevel,str2)) {
4224 return False;
4225 }
4226
4227 queuecnt = 0;
4228 for (i = 0; i < services; i++) {
4229 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4230 queuecnt++;
4231 }
4232 }
4233
4234 if (mdrcnt > 0) {
4235 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4236 if (!*rdata) {
4237 return False;
4238 }
4239 }
4240
4241 desc.base = *rdata;
4242 desc.buflen = mdrcnt;
4243 if (init_package(&desc,queuecnt,0)) {
4244 succnt = 0;
4245 n = 0;
4246 for (i = 0; i < services; i++) {
4247 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4248 fill_printdest_info(conn,i,uLevel,&desc);
4249 n++;
4250 if (desc.errcode == NERR_Success) {
4251 succnt = n;
4252 }
4253 }
4254 }
4255 }
4256
4257 *rdata_len = desc.usedlen;
4258
4259 *rparam_len = 8;
4260 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4261 if (!*rparam) {
4262 return False;
4263 }
4264 SSVALS(*rparam,0,desc.errcode);
4265 SSVAL(*rparam,2,0);
4266 SSVAL(*rparam,4,succnt);
4267 SSVAL(*rparam,6,queuecnt);
4268
4269 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4270
4271 return True;
4272 }
4273
4274 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4275 char *param, int tpscnt,
4276 char *data, int tdscnt,
4277 int mdrcnt,int mprcnt,
4278 char **rdata,char **rparam,
4279 int *rdata_len,int *rparam_len)
4280 {
4281 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4282 char *str2 = skip_string(param,tpscnt,str1);
4283 char *p = skip_string(param,tpscnt,str2);
4284 int uLevel;
4285 int succnt;
4286 struct pack_desc desc;
4287
4288 if (!str1 || !str2 || !p) {
4289 return False;
4290 }
4291
4292 memset((char *)&desc,'\0',sizeof(desc));
4293
4294 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4295
4296 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4297
4298 /* check it's a supported varient */
4299 if (strcmp(str1,"WrLeh") != 0) {
4300 return False;
4301 }
4302 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4303 return False;
4304 }
4305
4306 if (mdrcnt > 0) {
4307 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4308 if (!*rdata) {
4309 return False;
4310 }
4311 }
4312 desc.base = *rdata;
4313 desc.buflen = mdrcnt;
4314 if (init_package(&desc,1,0)) {
4315 PACKS(&desc,"B41","NULL");
4316 }
4317
4318 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4319
4320 *rdata_len = desc.usedlen;
4321
4322 *rparam_len = 8;
4323 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4324 if (!*rparam) {
4325 return False;
4326 }
4327 SSVALS(*rparam,0,desc.errcode);
4328 SSVAL(*rparam,2,0);
4329 SSVAL(*rparam,4,succnt);
4330 SSVAL(*rparam,6,1);
4331
4332 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4333
4334 return True;
4335 }
4336
4337 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4338 char *param, int tpscnt,
4339 char *data, int tdscnt,
4340 int mdrcnt,int mprcnt,
4341 char **rdata,char **rparam,
4342 int *rdata_len,int *rparam_len)
4343 {
4344 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4345 char *str2 = skip_string(param,tpscnt,str1);
4346 char *p = skip_string(param,tpscnt,str2);
4347 int uLevel;
4348 int succnt;
4349 struct pack_desc desc;
4350
4351 if (!str1 || !str2 || !p) {
4352 return False;
4353 }
4354 memset((char *)&desc,'\0',sizeof(desc));
4355
4356 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4357
4358 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4359
4360 /* check it's a supported varient */
4361 if (strcmp(str1,"WrLeh") != 0) {
4362 return False;
4363 }
4364 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4365 return False;
4366 }
4367
4368 if (mdrcnt > 0) {
4369 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4370 if (!*rdata) {
4371 return False;
4372 }
4373 }
4374 desc.base = *rdata;
4375 desc.buflen = mdrcnt;
4376 desc.format = str2;
4377 if (init_package(&desc,1,0)) {
4378 PACKS(&desc,"B13","lpd");
4379 }
4380
4381 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4382
4383 *rdata_len = desc.usedlen;
4384
4385 *rparam_len = 8;
4386 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4387 if (!*rparam) {
4388 return False;
4389 }
4390 SSVALS(*rparam,0,desc.errcode);
4391 SSVAL(*rparam,2,0);
4392 SSVAL(*rparam,4,succnt);
4393 SSVAL(*rparam,6,1);
4394
4395 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4396
4397 return True;
4398 }
4399
4400 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4401 char *param, int tpscnt,
4402 char *data, int tdscnt,
4403 int mdrcnt,int mprcnt,
4404 char **rdata,char **rparam,
4405 int *rdata_len,int *rparam_len)
4406 {
4407 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4408 char *str2 = skip_string(param,tpscnt,str1);
4409 char *p = skip_string(param,tpscnt,str2);
4410 int uLevel;
4411 int succnt;
4412 struct pack_desc desc;
4413
4414 if (!str1 || !str2 || !p) {
4415 return False;
4416 }
4417
4418 memset((char *)&desc,'\0',sizeof(desc));
4419
4420 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4421
4422 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4423
4424 /* check it's a supported varient */
4425 if (strcmp(str1,"WrLeh") != 0) {
4426 return False;
4427 }
4428 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4429 return False;
4430 }
4431
4432 if (mdrcnt > 0) {
4433 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4434 if (!*rdata) {
4435 return False;
4436 }
4437 }
4438 memset((char *)&desc,'\0',sizeof(desc));
4439 desc.base = *rdata;
4440 desc.buflen = mdrcnt;
4441 desc.format = str2;
4442 if (init_package(&desc,1,0)) {
4443 PACKS(&desc,"B13","lp0");
4444 }
4445
4446 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4447
4448 *rdata_len = desc.usedlen;
4449
4450 *rparam_len = 8;
4451 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4452 if (!*rparam) {
4453 return False;
4454 }
4455 SSVALS(*rparam,0,desc.errcode);
4456 SSVAL(*rparam,2,0);
4457 SSVAL(*rparam,4,succnt);
4458 SSVAL(*rparam,6,1);
4459
4460 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4461
4462 return True;
4463 }
4464
4465 /****************************************************************************
4466 List open sessions
4467 ****************************************************************************/
4468
4469 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4470 char *param, int tpscnt,
4471 char *data, int tdscnt,
4472 int mdrcnt,int mprcnt,
4473 char **rdata,char **rparam,
4474 int *rdata_len,int *rparam_len)
4475
4476 {
4477 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4478 char *str2 = skip_string(param,tpscnt,str1);
4479 char *p = skip_string(param,tpscnt,str2);
4480 int uLevel;
4481 struct pack_desc desc;
4482 struct sessionid *session_list;
4483 int i, num_sessions;
4484
4485 if (!str1 || !str2 || !p) {
4486 return False;
4487 }
4488
4489 memset((char *)&desc,'\0',sizeof(desc));
4490
4491 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4492
4493 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4494 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4495 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4496
4497 /* check it's a supported varient */
4498 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4499 return False;
4500 }
4501 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4502 return False;
4503 }
4504
4505 num_sessions = list_sessions(talloc_tos(), &session_list);
4506
4507 if (mdrcnt > 0) {
4508 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4509 if (!*rdata) {
4510 return False;
4511 }
4512 }
4513 memset((char *)&desc,'\0',sizeof(desc));
4514 desc.base = *rdata;
4515 desc.buflen = mdrcnt;
4516 desc.format = str2;
4517 if (!init_package(&desc,num_sessions,0)) {
4518 return False;
4519 }
4520
4521 for(i=0; i<num_sessions; i++) {
4522 PACKS(&desc, "z", session_list[i].remote_machine);
4523 PACKS(&desc, "z", session_list[i].username);
4524 PACKI(&desc, "W", 1); /* num conns */
4525 PACKI(&desc, "W", 0); /* num opens */
4526 PACKI(&desc, "W", 1); /* num users */
4527 PACKI(&desc, "D", 0); /* session time */
4528 PACKI(&desc, "D", 0); /* idle time */
4529 PACKI(&desc, "D", 0); /* flags */
4530 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4531 }
4532
4533 *rdata_len = desc.usedlen;
4534
4535 *rparam_len = 8;
4536 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4537 if (!*rparam) {
4538 return False;
4539 }
4540 SSVALS(*rparam,0,desc.errcode);
4541 SSVAL(*rparam,2,0); /* converter */
4542 SSVAL(*rparam,4,num_sessions); /* count */
4543
4544 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4545
4546 return True;
4547 }
4548
4549
4550 /****************************************************************************
4551 The buffer was too small.
4552 ****************************************************************************/
4553
4554 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4555 int mdrcnt, int mprcnt,
4556 char **rdata, char **rparam,
4557 int *rdata_len, int *rparam_len)
4558 {
4559 *rparam_len = MIN(*rparam_len,mprcnt);
4560 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4561 if (!*rparam) {
4562 return False;
4563 }
4564
4565 *rdata_len = 0;
4566
4567 SSVAL(*rparam,0,NERR_BufTooSmall);
4568
4569 DEBUG(3,("Supplied buffer too small in API command\n"));
4570
4571 return True;
4572 }
4573
4574 /****************************************************************************
4575 The request is not supported.
4576 ****************************************************************************/
4577
4578 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4579 char *param, int tpscnt,
4580 char *data, int tdscnt,
4581 int mdrcnt, int mprcnt,
4582 char **rdata, char **rparam,
4583 int *rdata_len, int *rparam_len)
4584 {
4585 *rparam_len = 4;
4586 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4587 if (!*rparam) {
4588 return False;
4589 }
4590
4591 *rdata_len = 0;
4592
4593 SSVAL(*rparam,0,NERR_notsupported);
4594 SSVAL(*rparam,2,0); /* converter word */
4595
4596 DEBUG(3,("Unsupported API command\n"));
4597
4598 return True;
4599 }
4600
4601 static const struct {
4602 const char *name;
4603 int id;
4604 bool (*fn)(connection_struct *, uint16,
4605 char *, int,
4606 char *, int,
4607 int,int,char **,char **,int *,int *);
4608 bool auth_user; /* Deny anonymous access? */
4609 } api_commands[] = {
4610 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
4611 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
4612 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
4613 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
4614 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
4615 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
4616 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
4617 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
4618 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
4619 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
4620 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
4621 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
4622 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
4623 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
4624 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
4625 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
4626 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
4627 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
4628 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
4629 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
4630 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
4631 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
4632 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
4633 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
4634 {"NetServerEnum", RAP_NetServerEnum2, api_RNetServerEnum}, /* anon OK */
4635 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4636 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
4637 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
4638 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
4639 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
4640 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4641 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
4642 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4643 {NULL, -1, api_Unsupported}
4644 /* The following RAP calls are not implemented by Samba:
4645
4646 RAP_WFileEnum2 - anon not OK
4647 */
4648 };
4649
4650
4651 /****************************************************************************
4652 Handle remote api calls.
4653 ****************************************************************************/
4654
4655 void api_reply(connection_struct *conn, uint16 vuid,
4656 struct smb_request *req,
4657 char *data, char *params,
4658 int tdscnt, int tpscnt,
4659 int mdrcnt, int mprcnt)
4660 {
4661 struct smbd_server_connection *sconn = smbd_server_conn;
4662 int api_command;
4663 char *rdata = NULL;
4664 char *rparam = NULL;
4665 const char *name1 = NULL;
4666 const char *name2 = NULL;
4667 int rdata_len = 0;
4668 int rparam_len = 0;
4669 bool reply=False;
4670 int i;
4671
4672 if (!params) {
4673 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4674 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4675 return;
4676 }
4677
4678 if (tpscnt < 2) {
4679 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4680 return;
4681 }
4682 api_command = SVAL(params,0);
4683 /* Is there a string at position params+2 ? */
4684 if (skip_string(params,tpscnt,params+2)) {
4685 name1 = params + 2;
4686 } else {
4687 name1 = "";
4688 }
4689 name2 = skip_string(params,tpscnt,params+2);
4690 if (!name2) {
4691 name2 = "";
4692 }
4693
4694 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4695 api_command,
4696 name1,
4697 name2,
4698 tdscnt,tpscnt,mdrcnt,mprcnt));
4699
4700 for (i=0;api_commands[i].name;i++) {
4701 if (api_commands[i].id == api_command && api_commands[i].fn) {
4702 DEBUG(3,("Doing %s\n",api_commands[i].name));
4703 break;
4704 }
4705 }
4706
4707 /* Check whether this api call can be done anonymously */
4708
4709 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4710 user_struct *user = get_valid_user_struct(sconn, vuid);
4711
4712 if (!user || user->server_info->guest) {
4713 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4714 return;
4715 }
4716 }
4717
4718 rdata = (char *)SMB_MALLOC(1024);
4719 if (rdata) {
4720 memset(rdata,'\0',1024);
4721 }
4722
4723 rparam = (char *)SMB_MALLOC(1024);
4724 if (rparam) {
4725 memset(rparam,'\0',1024);
4726 }
4727
4728 if(!rdata || !rparam) {
4729 DEBUG(0,("api_reply: malloc fail !\n"));
4730 SAFE_FREE(rdata);
4731 SAFE_FREE(rparam);
4732 reply_nterror(req, NT_STATUS_NO_MEMORY);
4733 return;
4734 }
4735
4736 reply = api_commands[i].fn(conn,
4737 vuid,
4738 params,tpscnt, /* params + length */
4739 data,tdscnt, /* data + length */
4740 mdrcnt,mprcnt,
4741 &rdata,&rparam,&rdata_len,&rparam_len);
4742
4743
4744 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4745 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4746 &rdata,&rparam,&rdata_len,&rparam_len);
4747 }
4748
4749 /* if we get False back then it's actually unsupported */
4750 if (!reply) {
4751 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4752 &rdata,&rparam,&rdata_len,&rparam_len);
4753 }
4754
4755 /* If api_Unsupported returns false we can't return anything. */
4756 if (reply) {
4757 send_trans_reply(conn, req, rparam, rparam_len,
4758 rdata, rdata_len, False);
4759 }
4760
4761 SAFE_FREE(rdata);
4762 SAFE_FREE(rparam);
4763 return;
4764 }
reg import