?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Remove the unix token info from "struct user_struct"
[Samba/gebeck_regimport.git] / source / smbd / lanman.c
blob7ba4b64477676c69d17c59b0b1692fd1e3d064d9
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29
30 extern struct current_user current_user;
31 extern userdom_struct current_user_info;
32
33 #ifdef CHECK_TYPES
34 #undef CHECK_TYPES
35 #endif
36 #define CHECK_TYPES 0
37
38 #define NERR_Success 0
39 #define NERR_badpass 86
40 #define NERR_notsupported 50
41
42 #define NERR_BASE (2100)
43 #define NERR_BufTooSmall (NERR_BASE+23)
44 #define NERR_JobNotFound (NERR_BASE+51)
45 #define NERR_DestNotFound (NERR_BASE+52)
46
47 #define ACCESS_READ 0x01
48 #define ACCESS_WRITE 0x02
49 #define ACCESS_CREATE 0x04
50
51 #define SHPWLEN 8 /* share password length */
52
53 /* Limit size of ipc replies */
54
55 static char *smb_realloc_limit(void *ptr, size_t size)
56 {
57 char *val;
58
59 size = MAX((size),4*1024);
60 val = (char *)SMB_REALLOC(ptr,size);
61 if (val) {
62 memset(val,'\0',size);
63 }
64 return val;
65 }
66
67 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
68 char *param, int tpscnt,
69 char *data, int tdscnt,
70 int mdrcnt, int mprcnt,
71 char **rdata, char **rparam,
72 int *rdata_len, int *rparam_len);
73
74 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
75 int mdrcnt, int mprcnt,
76 char **rdata, char **rparam,
77 int *rdata_len, int *rparam_len);
78
79
80 static int CopyExpanded(connection_struct *conn,
81 int snum, char **dst, char *src, int *p_space_remaining)
82 {
83 TALLOC_CTX *ctx = talloc_tos();
84 char *buf = NULL;
85 int l;
86
87 if (!src || !dst || !p_space_remaining || !(*dst) ||
88 *p_space_remaining <= 0) {
89 return 0;
90 }
91
92 buf = talloc_strdup(ctx, src);
93 if (!buf) {
94 *p_space_remaining = 0;
95 return 0;
96 }
97 buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
98 if (!buf) {
99 *p_space_remaining = 0;
100 return 0;
101 }
102 buf = talloc_sub_advanced(ctx,
103 lp_servicename(SNUM(conn)),
104 conn->user,
105 conn->connectpath,
106 conn->gid,
107 get_current_username(),
108 current_user_info.domain,
109 buf);
110 if (!buf) {
111 *p_space_remaining = 0;
112 return 0;
113 }
114 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
115 if (l == -1) {
116 return 0;
117 }
118 (*dst) += l;
119 (*p_space_remaining) -= l;
120 return l;
121 }
122
123 static int CopyAndAdvance(char **dst, char *src, int *n)
124 {
125 int l;
126 if (!src || !dst || !n || !(*dst)) {
127 return 0;
128 }
129 l = push_ascii(*dst,src,*n, STR_TERMINATE);
130 if (l == -1) {
131 return 0;
132 }
133 (*dst) += l;
134 (*n) -= l;
135 return l;
136 }
137
138 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
139 {
140 TALLOC_CTX *ctx = talloc_tos();
141 char *buf = NULL;
142 if (!s) {
143 return 0;
144 }
145 buf = talloc_strdup(ctx,s);
146 if (!buf) {
147 return 0;
148 }
149 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
150 if (!buf) {
151 return 0;
152 }
153 buf = talloc_sub_advanced(ctx,
154 lp_servicename(SNUM(conn)),
155 conn->user,
156 conn->connectpath,
157 conn->gid,
158 get_current_username(),
159 current_user_info.domain,
160 buf);
161 if (!buf) {
162 return 0;
163 }
164 return strlen(buf) + 1;
165 }
166
167 static char *Expand(connection_struct *conn, int snum, char *s)
168 {
169 TALLOC_CTX *ctx = talloc_tos();
170 char *buf = NULL;
171
172 if (!s) {
173 return NULL;
174 }
175 buf = talloc_strdup(ctx,s);
176 if (!buf) {
177 return 0;
178 }
179 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
180 if (!buf) {
181 return 0;
182 }
183 return talloc_sub_advanced(ctx,
184 lp_servicename(SNUM(conn)),
185 conn->user,
186 conn->connectpath,
187 conn->gid,
188 get_current_username(),
189 current_user_info.domain,
190 buf);
191 }
192
193 /*******************************************************************
194 Check a API string for validity when we only need to check the prefix.
195 ******************************************************************/
196
197 static bool prefix_ok(const char *str, const char *prefix)
198 {
199 return(strncmp(str,prefix,strlen(prefix)) == 0);
200 }
201
202 struct pack_desc {
203 const char *format; /* formatstring for structure */
204 const char *subformat; /* subformat for structure */
205 char *base; /* baseaddress of buffer */
206 int buflen; /* remaining size for fixed part; on init: length of base */
207 int subcount; /* count of substructures */
208 char *structbuf; /* pointer into buffer for remaining fixed part */
209 int stringlen; /* remaining size for variable part */
210 char *stringbuf; /* pointer into buffer for remaining variable part */
211 int neededlen; /* total needed size */
212 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
213 const char *curpos; /* current position; pointer into format or subformat */
214 int errcode;
215 };
216
217 static int get_counter(const char **p)
218 {
219 int i, n;
220 if (!p || !(*p)) {
221 return 1;
222 }
223 if (!isdigit((int)**p)) {
224 return 1;
225 }
226 for (n = 0;;) {
227 i = **p;
228 if (isdigit(i)) {
229 n = 10 * n + (i - '0');
230 } else {
231 return n;
232 }
233 (*p)++;
234 }
235 }
236
237 static int getlen(const char *p)
238 {
239 int n = 0;
240 if (!p) {
241 return 0;
242 }
243
244 while (*p) {
245 switch( *p++ ) {
246 case 'W': /* word (2 byte) */
247 n += 2;
248 break;
249 case 'K': /* status word? (2 byte) */
250 n += 2;
251 break;
252 case 'N': /* count of substructures (word) at end */
253 n += 2;
254 break;
255 case 'D': /* double word (4 byte) */
256 case 'z': /* offset to zero terminated string (4 byte) */
257 case 'l': /* offset to user data (4 byte) */
258 n += 4;
259 break;
260 case 'b': /* offset to data (with counter) (4 byte) */
261 n += 4;
262 get_counter(&p);
263 break;
264 case 'B': /* byte (with optional counter) */
265 n += get_counter(&p);
266 break;
267 }
268 }
269 return n;
270 }
271
272 static bool init_package(struct pack_desc *p, int count, int subcount)
273 {
274 int n = p->buflen;
275 int i;
276
277 if (!p->format || !p->base) {
278 return False;
279 }
280
281 i = count * getlen(p->format);
282 if (p->subformat) {
283 i += subcount * getlen(p->subformat);
284 }
285 p->structbuf = p->base;
286 p->neededlen = 0;
287 p->usedlen = 0;
288 p->subcount = 0;
289 p->curpos = p->format;
290 if (i > n) {
291 p->neededlen = i;
292 i = n = 0;
293 #if 0
294 /*
295 * This is the old error code we used. Aparently
296 * WinNT/2k systems return ERRbuftoosmall (2123) and
297 * OS/2 needs this. I'm leaving this here so we can revert
298 * if needed. JRA.
299 */
300 p->errcode = ERRmoredata;
301 #else
302 p->errcode = ERRbuftoosmall;
303 #endif
304 } else {
305 p->errcode = NERR_Success;
306 }
307 p->buflen = i;
308 n -= i;
309 p->stringbuf = p->base + i;
310 p->stringlen = n;
311 return (p->errcode == NERR_Success);
312 }
313
314 static int package(struct pack_desc *p, ...)
315 {
316 va_list args;
317 int needed=0, stringneeded;
318 const char *str=NULL;
319 int is_string=0, stringused;
320 int32 temp;
321
322 va_start(args,p);
323
324 if (!*p->curpos) {
325 if (!p->subcount) {
326 p->curpos = p->format;
327 } else {
328 p->curpos = p->subformat;
329 p->subcount--;
330 }
331 }
332 #if CHECK_TYPES
333 str = va_arg(args,char*);
334 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
335 #endif
336 stringneeded = -1;
337
338 if (!p->curpos) {
339 va_end(args);
340 return 0;
341 }
342
343 switch( *p->curpos++ ) {
344 case 'W': /* word (2 byte) */
345 needed = 2;
346 temp = va_arg(args,int);
347 if (p->buflen >= needed) {
348 SSVAL(p->structbuf,0,temp);
349 }
350 break;
351 case 'K': /* status word? (2 byte) */
352 needed = 2;
353 temp = va_arg(args,int);
354 if (p->buflen >= needed) {
355 SSVAL(p->structbuf,0,temp);
356 }
357 break;
358 case 'N': /* count of substructures (word) at end */
359 needed = 2;
360 p->subcount = va_arg(args,int);
361 if (p->buflen >= needed) {
362 SSVAL(p->structbuf,0,p->subcount);
363 }
364 break;
365 case 'D': /* double word (4 byte) */
366 needed = 4;
367 temp = va_arg(args,int);
368 if (p->buflen >= needed) {
369 SIVAL(p->structbuf,0,temp);
370 }
371 break;
372 case 'B': /* byte (with optional counter) */
373 needed = get_counter(&p->curpos);
374 {
375 char *s = va_arg(args,char*);
376 if (p->buflen >= needed) {
377 StrnCpy(p->structbuf,s?s:"",needed-1);
378 }
379 }
380 break;
381 case 'z': /* offset to zero terminated string (4 byte) */
382 str = va_arg(args,char*);
383 stringneeded = (str ? strlen(str)+1 : 0);
384 is_string = 1;
385 break;
386 case 'l': /* offset to user data (4 byte) */
387 str = va_arg(args,char*);
388 stringneeded = va_arg(args,int);
389 is_string = 0;
390 break;
391 case 'b': /* offset to data (with counter) (4 byte) */
392 str = va_arg(args,char*);
393 stringneeded = get_counter(&p->curpos);
394 is_string = 0;
395 break;
396 }
397
398 va_end(args);
399 if (stringneeded >= 0) {
400 needed = 4;
401 if (p->buflen >= needed) {
402 stringused = stringneeded;
403 if (stringused > p->stringlen) {
404 stringused = (is_string ? p->stringlen : 0);
405 if (p->errcode == NERR_Success) {
406 p->errcode = ERRmoredata;
407 }
408 }
409 if (!stringused) {
410 SIVAL(p->structbuf,0,0);
411 } else {
412 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
413 memcpy(p->stringbuf,str?str:"",stringused);
414 if (is_string) {
415 p->stringbuf[stringused-1] = '\0';
416 }
417 p->stringbuf += stringused;
418 p->stringlen -= stringused;
419 p->usedlen += stringused;
420 }
421 }
422 p->neededlen += stringneeded;
423 }
424
425 p->neededlen += needed;
426 if (p->buflen >= needed) {
427 p->structbuf += needed;
428 p->buflen -= needed;
429 p->usedlen += needed;
430 } else {
431 if (p->errcode == NERR_Success) {
432 p->errcode = ERRmoredata;
433 }
434 }
435 return 1;
436 }
437
438 #if CHECK_TYPES
439 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
440 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
441 #else
442 #define PACK(desc,t,v) package(desc,v)
443 #define PACKl(desc,t,v,l) package(desc,v,l)
444 #endif
445
446 static void PACKI(struct pack_desc* desc, const char *t,int v)
447 {
448 PACK(desc,t,v);
449 }
450
451 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
452 {
453 PACK(desc,t,v);
454 }
455
456 /****************************************************************************
457 Get a print queue.
458 ****************************************************************************/
459
460 static void PackDriverData(struct pack_desc* desc)
461 {
462 char drivdata[4+4+32];
463 SIVAL(drivdata,0,sizeof drivdata); /* cb */
464 SIVAL(drivdata,4,1000); /* lVersion */
465 memset(drivdata+8,0,32); /* szDeviceName */
466 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
467 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
468 }
469
470 static int check_printq_info(struct pack_desc* desc,
471 unsigned int uLevel, char *id1, char *id2)
472 {
473 desc->subformat = NULL;
474 switch( uLevel ) {
475 case 0:
476 desc->format = "B13";
477 break;
478 case 1:
479 desc->format = "B13BWWWzzzzzWW";
480 break;
481 case 2:
482 desc->format = "B13BWWWzzzzzWN";
483 desc->subformat = "WB21BB16B10zWWzDDz";
484 break;
485 case 3:
486 desc->format = "zWWWWzzzzWWzzl";
487 break;
488 case 4:
489 desc->format = "zWWWWzzzzWNzzl";
490 desc->subformat = "WWzWWDDzz";
491 break;
492 case 5:
493 desc->format = "z";
494 break;
495 case 51:
496 desc->format = "K";
497 break;
498 case 52:
499 desc->format = "WzzzzzzzzN";
500 desc->subformat = "z";
501 break;
502 default:
503 DEBUG(0,("check_printq_info: invalid level %d\n",
504 uLevel ));
505 return False;
506 }
507 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
508 DEBUG(0,("check_printq_info: invalid format %s\n",
509 id1 ? id1 : "<NULL>" ));
510 return False;
511 }
512 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
513 DEBUG(0,("check_printq_info: invalid subformat %s\n",
514 id2 ? id2 : "<NULL>" ));
515 return False;
516 }
517 return True;
518 }
519
520
521 #define RAP_JOB_STATUS_QUEUED 0
522 #define RAP_JOB_STATUS_PAUSED 1
523 #define RAP_JOB_STATUS_SPOOLING 2
524 #define RAP_JOB_STATUS_PRINTING 3
525 #define RAP_JOB_STATUS_PRINTED 4
526
527 #define RAP_QUEUE_STATUS_PAUSED 1
528 #define RAP_QUEUE_STATUS_ERROR 2
529
530 /* turn a print job status into a on the wire status
531 */
532 static int printj_status(int v)
533 {
534 switch (v) {
535 case LPQ_QUEUED:
536 return RAP_JOB_STATUS_QUEUED;
537 case LPQ_PAUSED:
538 return RAP_JOB_STATUS_PAUSED;
539 case LPQ_SPOOLING:
540 return RAP_JOB_STATUS_SPOOLING;
541 case LPQ_PRINTING:
542 return RAP_JOB_STATUS_PRINTING;
543 }
544 return 0;
545 }
546
547 /* turn a print queue status into a on the wire status
548 */
549 static int printq_status(int v)
550 {
551 switch (v) {
552 case LPQ_QUEUED:
553 return 0;
554 case LPQ_PAUSED:
555 return RAP_QUEUE_STATUS_PAUSED;
556 }
557 return RAP_QUEUE_STATUS_ERROR;
558 }
559
560 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
561 struct pack_desc *desc,
562 print_queue_struct *queue, int n)
563 {
564 time_t t = queue->time;
565
566 /* the client expects localtime */
567 t -= get_time_zone(t);
568
569 PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
570 if (uLevel == 1) {
571 PACKS(desc,"B21",queue->fs_user); /* szUserName */
572 PACKS(desc,"B",""); /* pad */
573 PACKS(desc,"B16",""); /* szNotifyName */
574 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
575 PACKS(desc,"z",""); /* pszParms */
576 PACKI(desc,"W",n+1); /* uPosition */
577 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
578 PACKS(desc,"z",""); /* pszStatus */
579 PACKI(desc,"D",t); /* ulSubmitted */
580 PACKI(desc,"D",queue->size); /* ulSize */
581 PACKS(desc,"z",queue->fs_file); /* pszComment */
582 }
583 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
584 PACKI(desc,"W",queue->priority); /* uPriority */
585 PACKS(desc,"z",queue->fs_user); /* pszUserName */
586 PACKI(desc,"W",n+1); /* uPosition */
587 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
588 PACKI(desc,"D",t); /* ulSubmitted */
589 PACKI(desc,"D",queue->size); /* ulSize */
590 PACKS(desc,"z","Samba"); /* pszComment */
591 PACKS(desc,"z",queue->fs_file); /* pszDocument */
592 if (uLevel == 3) {
593 PACKS(desc,"z",""); /* pszNotifyName */
594 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
595 PACKS(desc,"z",""); /* pszParms */
596 PACKS(desc,"z",""); /* pszStatus */
597 PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
598 PACKS(desc,"z","lpd"); /* pszQProcName */
599 PACKS(desc,"z",""); /* pszQProcParms */
600 PACKS(desc,"z","NULL"); /* pszDriverName */
601 PackDriverData(desc); /* pDriverData */
602 PACKS(desc,"z",""); /* pszPrinterName */
603 } else if (uLevel == 4) { /* OS2 */
604 PACKS(desc,"z",""); /* pszSpoolFileName */
605 PACKS(desc,"z",""); /* pszPortName */
606 PACKS(desc,"z",""); /* pszStatus */
607 PACKI(desc,"D",0); /* ulPagesSpooled */
608 PACKI(desc,"D",0); /* ulPagesSent */
609 PACKI(desc,"D",0); /* ulPagesPrinted */
610 PACKI(desc,"D",0); /* ulTimePrinted */
611 PACKI(desc,"D",0); /* ulExtendJobStatus */
612 PACKI(desc,"D",0); /* ulStartPage */
613 PACKI(desc,"D",0); /* ulEndPage */
614 }
615 }
616 }
617
618 /********************************************************************
619 Return a driver name given an snum.
620 Returns True if from tdb, False otherwise.
621 ********************************************************************/
622
623 static bool get_driver_name(int snum, char **pp_drivername)
624 {
625 NT_PRINTER_INFO_LEVEL *info = NULL;
626 bool in_tdb = false;
627
628 get_a_printer (NULL, &info, 2, lp_servicename(snum));
629 if (info != NULL) {
630 *pp_drivername = talloc_strdup(talloc_tos(),
631 info->info_2->drivername);
632 in_tdb = true;
633 free_a_printer(&info, 2);
634 if (!*pp_drivername) {
635 return false;
636 }
637 }
638
639 return in_tdb;
640 }
641
642 /********************************************************************
643 Respond to the DosPrintQInfo command with a level of 52
644 This is used to get printer driver information for Win9x clients
645 ********************************************************************/
646 static void fill_printq_info_52(connection_struct *conn, int snum,
647 struct pack_desc* desc, int count )
648 {
649 int i;
650 fstring location;
651 NT_PRINTER_DRIVER_INFO_LEVEL driver;
652 NT_PRINTER_INFO_LEVEL *printer = NULL;
653
654 ZERO_STRUCT(driver);
655
656 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
657 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
658 lp_servicename(snum)));
659 goto err;
660 }
661
662 if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
663 "Windows 4.0", 0)) )
664 {
665 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
666 printer->info_2->drivername));
667 goto err;
668 }
669
670 trim_string(driver.info_3->driverpath, "\\print$\\WIN40\\0\\", 0);
671 trim_string(driver.info_3->datafile, "\\print$\\WIN40\\0\\", 0);
672 trim_string(driver.info_3->helpfile, "\\print$\\WIN40\\0\\", 0);
673
674 PACKI(desc, "W", 0x0400); /* don't know */
675 PACKS(desc, "z", driver.info_3->name); /* long printer name */
676 PACKS(desc, "z", driver.info_3->driverpath); /* Driverfile Name */
677 PACKS(desc, "z", driver.info_3->datafile); /* Datafile name */
678 PACKS(desc, "z", driver.info_3->monitorname); /* language monitor */
679
680 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
681 standard_sub_basic( "", "", location, sizeof(location)-1 );
682 PACKS(desc,"z", location); /* share to retrieve files */
683
684 PACKS(desc,"z", driver.info_3->defaultdatatype); /* default data type */
685 PACKS(desc,"z", driver.info_3->helpfile); /* helpfile name */
686 PACKS(desc,"z", driver.info_3->driverpath); /* driver name */
687
688 DEBUG(3,("Printer Driver Name: %s:\n",driver.info_3->name));
689 DEBUG(3,("Driver: %s:\n",driver.info_3->driverpath));
690 DEBUG(3,("Data File: %s:\n",driver.info_3->datafile));
691 DEBUG(3,("Language Monitor: %s:\n",driver.info_3->monitorname));
692 DEBUG(3,("Driver Location: %s:\n",location));
693 DEBUG(3,("Data Type: %s:\n",driver.info_3->defaultdatatype));
694 DEBUG(3,("Help File: %s:\n",driver.info_3->helpfile));
695 PACKI(desc,"N",count); /* number of files to copy */
696
697 for ( i=0; i<count && driver.info_3->dependentfiles && *driver.info_3->dependentfiles[i]; i++)
698 {
699 trim_string(driver.info_3->dependentfiles[i], "\\print$\\WIN40\\0\\", 0);
700 PACKS(desc,"z",driver.info_3->dependentfiles[i]); /* driver files to copy */
701 DEBUG(3,("Dependent File: %s:\n",driver.info_3->dependentfiles[i]));
702 }
703
704 /* sanity check */
705 if ( i != count )
706 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
707 count, i));
708
709 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
710
711 desc->errcode=NERR_Success;
712 goto done;
713
714 err:
715 DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
716 desc->errcode=NERR_notsupported;
717
718 done:
719 if ( printer )
720 free_a_printer( &printer, 2 );
721
722 if ( driver.info_3 )
723 free_a_printer_driver( driver, 3 );
724 }
725
726
727 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
728 struct pack_desc* desc,
729 int count, print_queue_struct* queue,
730 print_status_struct* status)
731 {
732 switch (uLevel) {
733 case 1:
734 case 2:
735 PACKS(desc,"B13",SERVICE(snum));
736 break;
737 case 3:
738 case 4:
739 case 5:
740 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
741 break;
742 case 51:
743 PACKI(desc,"K",printq_status(status->status));
744 break;
745 }
746
747 if (uLevel == 1 || uLevel == 2) {
748 PACKS(desc,"B",""); /* alignment */
749 PACKI(desc,"W",5); /* priority */
750 PACKI(desc,"W",0); /* start time */
751 PACKI(desc,"W",0); /* until time */
752 PACKS(desc,"z",""); /* pSepFile */
753 PACKS(desc,"z","lpd"); /* pPrProc */
754 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
755 PACKS(desc,"z",""); /* pParms */
756 if (snum < 0) {
757 PACKS(desc,"z","UNKNOWN PRINTER");
758 PACKI(desc,"W",LPSTAT_ERROR);
759 }
760 else if (!status || !status->message[0]) {
761 PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
762 PACKI(desc,"W",LPSTAT_OK); /* status */
763 } else {
764 PACKS(desc,"z",status->message);
765 PACKI(desc,"W",printq_status(status->status)); /* status */
766 }
767 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
768 }
769
770 if (uLevel == 3 || uLevel == 4) {
771 char *drivername = NULL;
772
773 PACKI(desc,"W",5); /* uPriority */
774 PACKI(desc,"W",0); /* uStarttime */
775 PACKI(desc,"W",0); /* uUntiltime */
776 PACKI(desc,"W",5); /* pad1 */
777 PACKS(desc,"z",""); /* pszSepFile */
778 PACKS(desc,"z","WinPrint"); /* pszPrProc */
779 PACKS(desc,"z",NULL); /* pszParms */
780 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
781 /* "don't ask" that it's done this way to fix corrupted
782 Win9X/ME printer comments. */
783 if (!status) {
784 PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
785 } else {
786 PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
787 }
788 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
789 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
790 get_driver_name(snum,&drivername);
791 if (!drivername) {
792 return;
793 }
794 PACKS(desc,"z",drivername); /* pszDriverName */
795 PackDriverData(desc); /* pDriverData */
796 }
797
798 if (uLevel == 2 || uLevel == 4) {
799 int i;
800 for (i=0;i<count;i++)
801 fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
802 }
803
804 if (uLevel==52)
805 fill_printq_info_52( conn, snum, desc, count );
806 }
807
808 /* This function returns the number of files for a given driver */
809 static int get_printerdrivernumber(int snum)
810 {
811 int result = 0;
812 NT_PRINTER_DRIVER_INFO_LEVEL driver;
813 NT_PRINTER_INFO_LEVEL *printer = NULL;
814
815 ZERO_STRUCT(driver);
816
817 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
818 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
819 lp_servicename(snum)));
820 goto done;
821 }
822
823 if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
824 "Windows 4.0", 0)) )
825 {
826 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
827 printer->info_2->drivername));
828 goto done;
829 }
830
831 /* count the number of files */
832 while ( driver.info_3->dependentfiles && *driver.info_3->dependentfiles[result] )
833 result++;
834 \
835 done:
836 if ( printer )
837 free_a_printer( &printer, 2 );
838
839 if ( driver.info_3 )
840 free_a_printer_driver( driver, 3 );
841
842 return result;
843 }
844
845 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
846 char *param, int tpscnt,
847 char *data, int tdscnt,
848 int mdrcnt,int mprcnt,
849 char **rdata,char **rparam,
850 int *rdata_len,int *rparam_len)
851 {
852 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
853 char *str2 = skip_string(param,tpscnt,str1);
854 char *p = skip_string(param,tpscnt,str2);
855 char *QueueName = p;
856 unsigned int uLevel;
857 int count=0;
858 int snum;
859 char *str3;
860 struct pack_desc desc;
861 print_queue_struct *queue=NULL;
862 print_status_struct status;
863 char* tmpdata=NULL;
864
865 if (!str1 || !str2 || !p) {
866 return False;
867 }
868 memset((char *)&status,'\0',sizeof(status));
869 memset((char *)&desc,'\0',sizeof(desc));
870
871 p = skip_string(param,tpscnt,p);
872 if (!p) {
873 return False;
874 }
875 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
876 str3 = get_safe_str_ptr(param,tpscnt,p,4);
877 /* str3 may be null here and is checked in check_printq_info(). */
878
879 /* remove any trailing username */
880 if ((p = strchr_m(QueueName,'%')))
881 *p = 0;
882
883 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
884
885 /* check it's a supported varient */
886 if (!prefix_ok(str1,"zWrLh"))
887 return False;
888 if (!check_printq_info(&desc,uLevel,str2,str3)) {
889 /*
890 * Patch from Scott Moomaw <scott@bridgewater.edu>
891 * to return the 'invalid info level' error if an
892 * unknown level was requested.
893 */
894 *rdata_len = 0;
895 *rparam_len = 6;
896 *rparam = smb_realloc_limit(*rparam,*rparam_len);
897 if (!*rparam) {
898 return False;
899 }
900 SSVALS(*rparam,0,ERRunknownlevel);
901 SSVAL(*rparam,2,0);
902 SSVAL(*rparam,4,0);
903 return(True);
904 }
905
906 snum = find_service(QueueName);
907 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
908 return False;
909
910 if (uLevel==52) {
911 count = get_printerdrivernumber(snum);
912 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
913 } else {
914 count = print_queue_status(snum, &queue,&status);
915 }
916
917 if (mdrcnt > 0) {
918 *rdata = smb_realloc_limit(*rdata,mdrcnt);
919 if (!*rdata) {
920 SAFE_FREE(queue);
921 return False;
922 }
923 desc.base = *rdata;
924 desc.buflen = mdrcnt;
925 } else {
926 /*
927 * Don't return data but need to get correct length
928 * init_package will return wrong size if buflen=0
929 */
930 desc.buflen = getlen(desc.format);
931 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
932 }
933
934 if (init_package(&desc,1,count)) {
935 desc.subcount = count;
936 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
937 }
938
939 *rdata_len = desc.usedlen;
940
941 /*
942 * We must set the return code to ERRbuftoosmall
943 * in order to support lanman style printing with Win NT/2k
944 * clients --jerry
945 */
946 if (!mdrcnt && lp_disable_spoolss())
947 desc.errcode = ERRbuftoosmall;
948
949 *rdata_len = desc.usedlen;
950 *rparam_len = 6;
951 *rparam = smb_realloc_limit(*rparam,*rparam_len);
952 if (!*rparam) {
953 SAFE_FREE(queue);
954 SAFE_FREE(tmpdata);
955 return False;
956 }
957 SSVALS(*rparam,0,desc.errcode);
958 SSVAL(*rparam,2,0);
959 SSVAL(*rparam,4,desc.neededlen);
960
961 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
962
963 SAFE_FREE(queue);
964 SAFE_FREE(tmpdata);
965
966 return(True);
967 }
968
969 /****************************************************************************
970 View list of all print jobs on all queues.
971 ****************************************************************************/
972
973 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
974 char *param, int tpscnt,
975 char *data, int tdscnt,
976 int mdrcnt, int mprcnt,
977 char **rdata, char** rparam,
978 int *rdata_len, int *rparam_len)
979 {
980 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
981 char *output_format1 = skip_string(param,tpscnt,param_format);
982 char *p = skip_string(param,tpscnt,output_format1);
983 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
984 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
985 int services = lp_numservices();
986 int i, n;
987 struct pack_desc desc;
988 print_queue_struct **queue = NULL;
989 print_status_struct *status = NULL;
990 int *subcntarr = NULL;
991 int queuecnt = 0, subcnt = 0, succnt = 0;
992
993 if (!param_format || !output_format1 || !p) {
994 return False;
995 }
996
997 memset((char *)&desc,'\0',sizeof(desc));
998
999 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1000
1001 if (!prefix_ok(param_format,"WrLeh")) {
1002 return False;
1003 }
1004 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1005 /*
1006 * Patch from Scott Moomaw <scott@bridgewater.edu>
1007 * to return the 'invalid info level' error if an
1008 * unknown level was requested.
1009 */
1010 *rdata_len = 0;
1011 *rparam_len = 6;
1012 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1013 if (!*rparam) {
1014 return False;
1015 }
1016 SSVALS(*rparam,0,ERRunknownlevel);
1017 SSVAL(*rparam,2,0);
1018 SSVAL(*rparam,4,0);
1019 return(True);
1020 }
1021
1022 for (i = 0; i < services; i++) {
1023 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1024 queuecnt++;
1025 }
1026 }
1027
1028 if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1029 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1030 goto err;
1031 }
1032 memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1033 if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1034 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1035 goto err;
1036 }
1037 memset(status,0,queuecnt*sizeof(print_status_struct));
1038 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1039 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1040 goto err;
1041 }
1042
1043 subcnt = 0;
1044 n = 0;
1045 for (i = 0; i < services; i++) {
1046 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1047 subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1048 subcnt += subcntarr[n];
1049 n++;
1050 }
1051 }
1052
1053 if (mdrcnt > 0) {
1054 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1055 if (!*rdata) {
1056 goto err;
1057 }
1058 }
1059 desc.base = *rdata;
1060 desc.buflen = mdrcnt;
1061
1062 if (init_package(&desc,queuecnt,subcnt)) {
1063 n = 0;
1064 succnt = 0;
1065 for (i = 0; i < services; i++) {
1066 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1067 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1068 n++;
1069 if (desc.errcode == NERR_Success) {
1070 succnt = n;
1071 }
1072 }
1073 }
1074 }
1075
1076 SAFE_FREE(subcntarr);
1077
1078 *rdata_len = desc.usedlen;
1079 *rparam_len = 8;
1080 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1081 if (!*rparam) {
1082 goto err;
1083 }
1084 SSVALS(*rparam,0,desc.errcode);
1085 SSVAL(*rparam,2,0);
1086 SSVAL(*rparam,4,succnt);
1087 SSVAL(*rparam,6,queuecnt);
1088
1089 for (i = 0; i < queuecnt; i++) {
1090 if (queue) {
1091 SAFE_FREE(queue[i]);
1092 }
1093 }
1094
1095 SAFE_FREE(queue);
1096 SAFE_FREE(status);
1097
1098 return True;
1099
1100 err:
1101
1102 SAFE_FREE(subcntarr);
1103 for (i = 0; i < queuecnt; i++) {
1104 if (queue) {
1105 SAFE_FREE(queue[i]);
1106 }
1107 }
1108 SAFE_FREE(queue);
1109 SAFE_FREE(status);
1110
1111 return False;
1112 }
1113
1114 /****************************************************************************
1115 Get info level for a server list query.
1116 ****************************************************************************/
1117
1118 static bool check_server_info(int uLevel, char* id)
1119 {
1120 switch( uLevel ) {
1121 case 0:
1122 if (strcmp(id,"B16") != 0) {
1123 return False;
1124 }
1125 break;
1126 case 1:
1127 if (strcmp(id,"B16BBDz") != 0) {
1128 return False;
1129 }
1130 break;
1131 default:
1132 return False;
1133 }
1134 return True;
1135 }
1136
1137 struct srv_info_struct {
1138 fstring name;
1139 uint32 type;
1140 fstring comment;
1141 fstring domain;
1142 bool server_added;
1143 };
1144
1145 /*******************************************************************
1146 Get server info lists from the files saved by nmbd. Return the
1147 number of entries.
1148 ******************************************************************/
1149
1150 static int get_server_info(uint32 servertype,
1151 struct srv_info_struct **servers,
1152 const char *domain)
1153 {
1154 int count=0;
1155 int alloced=0;
1156 char **lines;
1157 bool local_list_only;
1158 int i;
1159
1160 lines = file_lines_load(lock_path(SERVER_LIST), NULL, 0);
1161 if (!lines) {
1162 DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno)));
1163 return 0;
1164 }
1165
1166 /* request for everything is code for request all servers */
1167 if (servertype == SV_TYPE_ALL) {
1168 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1169 }
1170
1171 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1172
1173 DEBUG(4,("Servertype search: %8x\n",servertype));
1174
1175 for (i=0;lines[i];i++) {
1176 fstring stype;
1177 struct srv_info_struct *s;
1178 const char *ptr = lines[i];
1179 bool ok = True;
1180 TALLOC_CTX *frame = NULL;
1181 char *p;
1182
1183 if (!*ptr) {
1184 continue;
1185 }
1186
1187 if (count == alloced) {
1188 alloced += 10;
1189 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1190 if (!*servers) {
1191 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1192 file_lines_free(lines);
1193 return 0;
1194 }
1195 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1196 }
1197 s = &(*servers)[count];
1198
1199 frame = talloc_stackframe();
1200 s->name[0] = '\0';
1201 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1202 TALLOC_FREE(frame);
1203 continue;
1204 }
1205 fstrcpy(s->name, p);
1206
1207 stype[0] = '\0';
1208 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1209 TALLOC_FREE(frame);
1210 continue;
1211 }
1212 fstrcpy(stype, p);
1213
1214 s->comment[0] = '\0';
1215 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1216 TALLOC_FREE(frame);
1217 continue;
1218 }
1219 fstrcpy(s->comment, p);
1220
1221 s->domain[0] = '\0';
1222 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1223 /* this allows us to cope with an old nmbd */
1224 fstrcpy(s->domain,lp_workgroup());
1225 } else {
1226 fstrcpy(s->domain, p);
1227 }
1228 TALLOC_FREE(frame);
1229
1230 if (sscanf(stype,"%X",&s->type) != 1) {
1231 DEBUG(4,("r:host file "));
1232 ok = False;
1233 }
1234
1235 /* Filter the servers/domains we return based on what was asked for. */
1236
1237 /* Check to see if we are being asked for a local list only. */
1238 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1239 DEBUG(4,("r: local list only"));
1240 ok = False;
1241 }
1242
1243 /* doesn't match up: don't want it */
1244 if (!(servertype & s->type)) {
1245 DEBUG(4,("r:serv type "));
1246 ok = False;
1247 }
1248
1249 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1250 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1251 DEBUG(4,("s: dom mismatch "));
1252 ok = False;
1253 }
1254
1255 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1256 ok = False;
1257 }
1258
1259 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1260 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1261
1262 if (ok) {
1263 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1264 s->name, s->type, s->comment, s->domain));
1265 s->server_added = True;
1266 count++;
1267 } else {
1268 DEBUG(4,("%20s %8x %25s %15s\n",
1269 s->name, s->type, s->comment, s->domain));
1270 }
1271 }
1272
1273 file_lines_free(lines);
1274 return count;
1275 }
1276
1277 /*******************************************************************
1278 Fill in a server info structure.
1279 ******************************************************************/
1280
1281 static int fill_srv_info(struct srv_info_struct *service,
1282 int uLevel, char **buf, int *buflen,
1283 char **stringbuf, int *stringspace, char *baseaddr)
1284 {
1285 int struct_len;
1286 char* p;
1287 char* p2;
1288 int l2;
1289 int len;
1290
1291 switch (uLevel) {
1292 case 0:
1293 struct_len = 16;
1294 break;
1295 case 1:
1296 struct_len = 26;
1297 break;
1298 default:
1299 return -1;
1300 }
1301
1302 if (!buf) {
1303 len = 0;
1304 switch (uLevel) {
1305 case 1:
1306 len = strlen(service->comment)+1;
1307 break;
1308 }
1309
1310 *buflen = struct_len;
1311 *stringspace = len;
1312 return struct_len + len;
1313 }
1314
1315 len = struct_len;
1316 p = *buf;
1317 if (*buflen < struct_len) {
1318 return -1;
1319 }
1320 if (stringbuf) {
1321 p2 = *stringbuf;
1322 l2 = *stringspace;
1323 } else {
1324 p2 = p + struct_len;
1325 l2 = *buflen - struct_len;
1326 }
1327 if (!baseaddr) {
1328 baseaddr = p;
1329 }
1330
1331 switch (uLevel) {
1332 case 0:
1333 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1334 break;
1335
1336 case 1:
1337 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1338 SIVAL(p,18,service->type);
1339 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1340 len += CopyAndAdvance(&p2,service->comment,&l2);
1341 break;
1342 }
1343
1344 if (stringbuf) {
1345 *buf = p + struct_len;
1346 *buflen -= struct_len;
1347 *stringbuf = p2;
1348 *stringspace = l2;
1349 } else {
1350 *buf = p2;
1351 *buflen -= len;
1352 }
1353 return len;
1354 }
1355
1356
1357 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1358 {
1359 return(strcmp(s1->name,s2->name));
1360 }
1361
1362 /****************************************************************************
1363 View list of servers available (or possibly domains). The info is
1364 extracted from lists saved by nmbd on the local host.
1365 ****************************************************************************/
1366
1367 static bool api_RNetServerEnum(connection_struct *conn, uint16 vuid,
1368 char *param, int tpscnt,
1369 char *data, int tdscnt,
1370 int mdrcnt, int mprcnt, char **rdata,
1371 char **rparam, int *rdata_len, int *rparam_len)
1372 {
1373 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1374 char *str2 = skip_string(param,tpscnt,str1);
1375 char *p = skip_string(param,tpscnt,str2);
1376 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1377 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1378 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1379 char *p2;
1380 int data_len, fixed_len, string_len;
1381 int f_len = 0, s_len = 0;
1382 struct srv_info_struct *servers=NULL;
1383 int counted=0,total=0;
1384 int i,missed;
1385 fstring domain;
1386 bool domain_request;
1387 bool local_request;
1388
1389 if (!str1 || !str2 || !p) {
1390 return False;
1391 }
1392
1393 /* If someone sets all the bits they don't really mean to set
1394 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1395 known servers. */
1396
1397 if (servertype == SV_TYPE_ALL) {
1398 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1399 }
1400
1401 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1402 any other bit (they may just set this bit on its own) they
1403 want all the locally seen servers. However this bit can be
1404 set on its own so set the requested servers to be
1405 ALL - DOMAIN_ENUM. */
1406
1407 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1408 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1409 }
1410
1411 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1412 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1413
1414 p += 8;
1415
1416 if (!prefix_ok(str1,"WrLehD")) {
1417 return False;
1418 }
1419 if (!check_server_info(uLevel,str2)) {
1420 return False;
1421 }
1422
1423 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1424 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1425 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1426
1427 if (strcmp(str1, "WrLehDz") == 0) {
1428 if (skip_string(param,tpscnt,p) == NULL) {
1429 return False;
1430 }
1431 pull_ascii_fstring(domain, p);
1432 } else {
1433 fstrcpy(domain, lp_workgroup());
1434 }
1435
1436 if (lp_browse_list()) {
1437 total = get_server_info(servertype,&servers,domain);
1438 }
1439
1440 data_len = fixed_len = string_len = 0;
1441 missed = 0;
1442
1443 if (total > 0) {
1444 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1445 }
1446
1447 {
1448 char *lastname=NULL;
1449
1450 for (i=0;i<total;i++) {
1451 struct srv_info_struct *s = &servers[i];
1452
1453 if (lastname && strequal(lastname,s->name)) {
1454 continue;
1455 }
1456 lastname = s->name;
1457 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1458 DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1459 s->name, s->type, s->comment, s->domain));
1460
1461 if (data_len <= buf_len) {
1462 counted++;
1463 fixed_len += f_len;
1464 string_len += s_len;
1465 } else {
1466 missed++;
1467 }
1468 }
1469 }
1470
1471 *rdata_len = fixed_len + string_len;
1472 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1473 if (!*rdata) {
1474 return False;
1475 }
1476
1477 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1478 p = *rdata;
1479 f_len = fixed_len;
1480 s_len = string_len;
1481
1482 {
1483 char *lastname=NULL;
1484 int count2 = counted;
1485
1486 for (i = 0; i < total && count2;i++) {
1487 struct srv_info_struct *s = &servers[i];
1488
1489 if (lastname && strequal(lastname,s->name)) {
1490 continue;
1491 }
1492 lastname = s->name;
1493 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1494 DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1495 s->name, s->type, s->comment, s->domain));
1496 count2--;
1497 }
1498 }
1499
1500 *rparam_len = 8;
1501 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1502 if (!*rparam) {
1503 return False;
1504 }
1505 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1506 SSVAL(*rparam,2,0);
1507 SSVAL(*rparam,4,counted);
1508 SSVAL(*rparam,6,counted+missed);
1509
1510 SAFE_FREE(servers);
1511
1512 DEBUG(3,("NetServerEnum domain = %s uLevel=%d counted=%d total=%d\n",
1513 domain,uLevel,counted,counted+missed));
1514
1515 return True;
1516 }
1517
1518 /****************************************************************************
1519 command 0x34 - suspected of being a "Lookup Names" stub api
1520 ****************************************************************************/
1521
1522 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1523 char *param, int tpscnt,
1524 char *data, int tdscnt,
1525 int mdrcnt, int mprcnt, char **rdata,
1526 char **rparam, int *rdata_len, int *rparam_len)
1527 {
1528 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1529 char *str2 = skip_string(param,tpscnt,str1);
1530 char *p = skip_string(param,tpscnt,str2);
1531 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1532 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1533 int counted=0;
1534 int missed=0;
1535
1536 if (!str1 || !str2 || !p) {
1537 return False;
1538 }
1539
1540 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1541 str1, str2, p, uLevel, buf_len));
1542
1543 if (!prefix_ok(str1,"zWrLeh")) {
1544 return False;
1545 }
1546
1547 *rdata_len = 0;
1548
1549 *rparam_len = 8;
1550 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1551 if (!*rparam) {
1552 return False;
1553 }
1554
1555 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1556 SSVAL(*rparam,2,0);
1557 SSVAL(*rparam,4,counted);
1558 SSVAL(*rparam,6,counted+missed);
1559
1560 return True;
1561 }
1562
1563 /****************************************************************************
1564 get info about a share
1565 ****************************************************************************/
1566
1567 static bool check_share_info(int uLevel, char* id)
1568 {
1569 switch( uLevel ) {
1570 case 0:
1571 if (strcmp(id,"B13") != 0) {
1572 return False;
1573 }
1574 break;
1575 case 1:
1576 if (strcmp(id,"B13BWz") != 0) {
1577 return False;
1578 }
1579 break;
1580 case 2:
1581 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1582 return False;
1583 }
1584 break;
1585 case 91:
1586 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1587 return False;
1588 }
1589 break;
1590 default:
1591 return False;
1592 }
1593 return True;
1594 }
1595
1596 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1597 char** buf, int* buflen,
1598 char** stringbuf, int* stringspace, char* baseaddr)
1599 {
1600 int struct_len;
1601 char* p;
1602 char* p2;
1603 int l2;
1604 int len;
1605
1606 switch( uLevel ) {
1607 case 0:
1608 struct_len = 13;
1609 break;
1610 case 1:
1611 struct_len = 20;
1612 break;
1613 case 2:
1614 struct_len = 40;
1615 break;
1616 case 91:
1617 struct_len = 68;
1618 break;
1619 default:
1620 return -1;
1621 }
1622
1623
1624 if (!buf) {
1625 len = 0;
1626
1627 if (uLevel > 0) {
1628 len += StrlenExpanded(conn,snum,lp_comment(snum));
1629 }
1630 if (uLevel > 1) {
1631 len += strlen(lp_pathname(snum)) + 1;
1632 }
1633 if (buflen) {
1634 *buflen = struct_len;
1635 }
1636 if (stringspace) {
1637 *stringspace = len;
1638 }
1639 return struct_len + len;
1640 }
1641
1642 len = struct_len;
1643 p = *buf;
1644 if ((*buflen) < struct_len) {
1645 return -1;
1646 }
1647
1648 if (stringbuf) {
1649 p2 = *stringbuf;
1650 l2 = *stringspace;
1651 } else {
1652 p2 = p + struct_len;
1653 l2 = (*buflen) - struct_len;
1654 }
1655
1656 if (!baseaddr) {
1657 baseaddr = p;
1658 }
1659
1660 push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1661
1662 if (uLevel > 0) {
1663 int type;
1664
1665 SCVAL(p,13,0);
1666 type = STYPE_DISKTREE;
1667 if (lp_print_ok(snum)) {
1668 type = STYPE_PRINTQ;
1669 }
1670 if (strequal("IPC",lp_fstype(snum))) {
1671 type = STYPE_IPC;
1672 }
1673 SSVAL(p,14,type); /* device type */
1674 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1675 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1676 }
1677
1678 if (uLevel > 1) {
1679 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1680 SSVALS(p,22,-1); /* max uses */
1681 SSVAL(p,24,1); /* current uses */
1682 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1683 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1684 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1685 }
1686
1687 if (uLevel > 2) {
1688 memset(p+40,0,SHPWLEN+2);
1689 SSVAL(p,50,0);
1690 SIVAL(p,52,0);
1691 SSVAL(p,56,0);
1692 SSVAL(p,58,0);
1693 SIVAL(p,60,0);
1694 SSVAL(p,64,0);
1695 SSVAL(p,66,0);
1696 }
1697
1698 if (stringbuf) {
1699 (*buf) = p + struct_len;
1700 (*buflen) -= struct_len;
1701 (*stringbuf) = p2;
1702 (*stringspace) = l2;
1703 } else {
1704 (*buf) = p2;
1705 (*buflen) -= len;
1706 }
1707
1708 return len;
1709 }
1710
1711 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1712 char *param, int tpscnt,
1713 char *data, int tdscnt,
1714 int mdrcnt,int mprcnt,
1715 char **rdata,char **rparam,
1716 int *rdata_len,int *rparam_len)
1717 {
1718 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1719 char *str2 = skip_string(param,tpscnt,str1);
1720 char *netname = skip_string(param,tpscnt,str2);
1721 char *p = skip_string(param,tpscnt,netname);
1722 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1723 int snum;
1724
1725 if (!str1 || !str2 || !netname || !p) {
1726 return False;
1727 }
1728
1729 snum = find_service(netname);
1730 if (snum < 0) {
1731 return False;
1732 }
1733
1734 /* check it's a supported varient */
1735 if (!prefix_ok(str1,"zWrLh")) {
1736 return False;
1737 }
1738 if (!check_share_info(uLevel,str2)) {
1739 return False;
1740 }
1741
1742 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1743 if (!*rdata) {
1744 return False;
1745 }
1746 p = *rdata;
1747 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1748 if (*rdata_len < 0) {
1749 return False;
1750 }
1751
1752 *rparam_len = 6;
1753 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1754 if (!*rparam) {
1755 return False;
1756 }
1757 SSVAL(*rparam,0,NERR_Success);
1758 SSVAL(*rparam,2,0); /* converter word */
1759 SSVAL(*rparam,4,*rdata_len);
1760
1761 return True;
1762 }
1763
1764 /****************************************************************************
1765 View the list of available shares.
1766
1767 This function is the server side of the NetShareEnum() RAP call.
1768 It fills the return buffer with share names and share comments.
1769 Note that the return buffer normally (in all known cases) allows only
1770 twelve byte strings for share names (plus one for a nul terminator).
1771 Share names longer than 12 bytes must be skipped.
1772 ****************************************************************************/
1773
1774 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1775 char *param, int tpscnt,
1776 char *data, int tdscnt,
1777 int mdrcnt,
1778 int mprcnt,
1779 char **rdata,
1780 char **rparam,
1781 int *rdata_len,
1782 int *rparam_len )
1783 {
1784 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1785 char *str2 = skip_string(param,tpscnt,str1);
1786 char *p = skip_string(param,tpscnt,str2);
1787 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1788 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1789 char *p2;
1790 int count = 0;
1791 int total=0,counted=0;
1792 bool missed = False;
1793 int i;
1794 int data_len, fixed_len, string_len;
1795 int f_len = 0, s_len = 0;
1796
1797 if (!str1 || !str2 || !p) {
1798 return False;
1799 }
1800
1801 if (!prefix_ok(str1,"WrLeh")) {
1802 return False;
1803 }
1804 if (!check_share_info(uLevel,str2)) {
1805 return False;
1806 }
1807
1808 /* Ensure all the usershares are loaded. */
1809 become_root();
1810 load_registry_shares();
1811 count = load_usershare_shares();
1812 unbecome_root();
1813
1814 data_len = fixed_len = string_len = 0;
1815 for (i=0;i<count;i++) {
1816 fstring servicename_dos;
1817 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1818 continue;
1819 }
1820 push_ascii_fstring(servicename_dos, lp_servicename(i));
1821 /* Maximum name length = 13. */
1822 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1823 total++;
1824 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1825 if (data_len <= buf_len) {
1826 counted++;
1827 fixed_len += f_len;
1828 string_len += s_len;
1829 } else {
1830 missed = True;
1831 }
1832 }
1833 }
1834
1835 *rdata_len = fixed_len + string_len;
1836 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1837 if (!*rdata) {
1838 return False;
1839 }
1840
1841 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
1842 p = *rdata;
1843 f_len = fixed_len;
1844 s_len = string_len;
1845
1846 for( i = 0; i < count; i++ ) {
1847 fstring servicename_dos;
1848 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1849 continue;
1850 }
1851
1852 push_ascii_fstring(servicename_dos, lp_servicename(i));
1853 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1854 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1855 break;
1856 }
1857 }
1858 }
1859
1860 *rparam_len = 8;
1861 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1862 if (!*rparam) {
1863 return False;
1864 }
1865 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1866 SSVAL(*rparam,2,0);
1867 SSVAL(*rparam,4,counted);
1868 SSVAL(*rparam,6,total);
1869
1870 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1871 counted,total,uLevel,
1872 buf_len,*rdata_len,mdrcnt));
1873
1874 return True;
1875 }
1876
1877 /****************************************************************************
1878 Add a share
1879 ****************************************************************************/
1880
1881 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1882 char *param, int tpscnt,
1883 char *data, int tdscnt,
1884 int mdrcnt,int mprcnt,
1885 char **rdata,char **rparam,
1886 int *rdata_len,int *rparam_len)
1887 {
1888 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1889 char *str2 = skip_string(param,tpscnt,str1);
1890 char *p = skip_string(param,tpscnt,str2);
1891 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1892 fstring sharename;
1893 fstring comment;
1894 char *pathname = NULL;
1895 char *command, *cmdname;
1896 unsigned int offset;
1897 int snum;
1898 int res = ERRunsup;
1899
1900 if (!str1 || !str2 || !p) {
1901 return False;
1902 }
1903
1904 /* check it's a supported varient */
1905 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1906 return False;
1907 }
1908 if (!check_share_info(uLevel,str2)) {
1909 return False;
1910 }
1911 if (uLevel != 2) {
1912 return False;
1913 }
1914
1915 /* Do we have a string ? */
1916 if (skip_string(data,mdrcnt,data) == NULL) {
1917 return False;
1918 }
1919 pull_ascii_fstring(sharename,data);
1920 snum = find_service(sharename);
1921 if (snum >= 0) { /* already exists */
1922 res = ERRfilexists;
1923 goto error_exit;
1924 }
1925
1926 if (mdrcnt < 28) {
1927 return False;
1928 }
1929
1930 /* only support disk share adds */
1931 if (SVAL(data,14)!=STYPE_DISKTREE) {
1932 return False;
1933 }
1934
1935 offset = IVAL(data, 16);
1936 if (offset >= mdrcnt) {
1937 res = ERRinvalidparam;
1938 goto error_exit;
1939 }
1940
1941 /* Do we have a string ? */
1942 if (skip_string(data,mdrcnt,data+offset) == NULL) {
1943 return False;
1944 }
1945 pull_ascii_fstring(comment, offset? (data+offset) : "");
1946
1947 offset = IVAL(data, 26);
1948
1949 if (offset >= mdrcnt) {
1950 res = ERRinvalidparam;
1951 goto error_exit;
1952 }
1953
1954 /* Do we have a string ? */
1955 if (skip_string(data,mdrcnt,data+offset) == NULL) {
1956 return False;
1957 }
1958
1959 pull_ascii_talloc(talloc_tos(), &pathname, offset? (data+offset) : "");
1960 if (!pathname) {
1961 return false;
1962 }
1963
1964 string_replace(sharename, '"', ' ');
1965 string_replace(pathname, '"', ' ');
1966 string_replace(comment, '"', ' ');
1967
1968 cmdname = lp_add_share_cmd();
1969
1970 if (!cmdname || *cmdname == '\0') {
1971 return False;
1972 }
1973
1974 if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1975 lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1976 pathname, comment) == -1) {
1977 return false;
1978 }
1979
1980 DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1981
1982 if ((res = smbrun(command, NULL)) != 0) {
1983 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1984 command, res ));
1985 SAFE_FREE(command);
1986 res = ERRnoaccess;
1987 goto error_exit;
1988 } else {
1989 SAFE_FREE(command);
1990 message_send_all(smbd_messaging_context(),
1991 MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1992 }
1993
1994 *rparam_len = 6;
1995 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1996 if (!*rparam) {
1997 return False;
1998 }
1999 SSVAL(*rparam,0,NERR_Success);
2000 SSVAL(*rparam,2,0); /* converter word */
2001 SSVAL(*rparam,4,*rdata_len);
2002 *rdata_len = 0;
2003
2004 return True;
2005
2006 error_exit:
2007
2008 *rparam_len = 4;
2009 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2010 if (!*rparam) {
2011 return False;
2012 }
2013 *rdata_len = 0;
2014 SSVAL(*rparam,0,res);
2015 SSVAL(*rparam,2,0);
2016 return True;
2017 }
2018
2019 /****************************************************************************
2020 view list of groups available
2021 ****************************************************************************/
2022
2023 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2024 char *param, int tpscnt,
2025 char *data, int tdscnt,
2026 int mdrcnt,int mprcnt,
2027 char **rdata,char **rparam,
2028 int *rdata_len,int *rparam_len)
2029 {
2030 int i;
2031 int errflags=0;
2032 int resume_context, cli_buf_size;
2033 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2034 char *str2 = skip_string(param,tpscnt,str1);
2035 char *p = skip_string(param,tpscnt,str2);
2036
2037 struct pdb_search *search;
2038 struct samr_displayentry *entries;
2039
2040 int num_entries;
2041
2042 if (!str1 || !str2 || !p) {
2043 return False;
2044 }
2045
2046 if (strcmp(str1,"WrLeh") != 0) {
2047 return False;
2048 }
2049
2050 /* parameters
2051 * W-> resume context (number of users to skip)
2052 * r -> return parameter pointer to receive buffer
2053 * L -> length of receive buffer
2054 * e -> return parameter number of entries
2055 * h -> return parameter total number of users
2056 */
2057
2058 if (strcmp("B21",str2) != 0) {
2059 return False;
2060 }
2061
2062 /* get list of domain groups SID_DOMAIN_GRP=2 */
2063 become_root();
2064 search = pdb_search_groups();
2065 unbecome_root();
2066
2067 if (search == NULL) {
2068 DEBUG(3,("api_RNetGroupEnum:failed to get group list"));
2069 return False;
2070 }
2071
2072 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2073 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2074 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2075 "%d\n", resume_context, cli_buf_size));
2076
2077 become_root();
2078 num_entries = pdb_search_entries(search, resume_context, 0xffffffff,
2079 &entries);
2080 unbecome_root();
2081
2082 *rdata_len = cli_buf_size;
2083 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2084 if (!*rdata) {
2085 return False;
2086 }
2087
2088 p = *rdata;
2089
2090 for(i=0; i<num_entries; i++) {
2091 fstring name;
2092 fstrcpy(name, entries[i].account_name);
2093 if( ((PTR_DIFF(p,*rdata)+21) <= *rdata_len) ) {
2094 /* truncate the name at 21 chars. */
2095 memcpy(p, name, 21);
2096 DEBUG(10,("adding entry %d group %s\n", i, p));
2097 p += 21;
2098 p += 5; /* Both NT4 and W2k3SP1 do padding here.
2099 No idea why... */
2100 } else {
2101 /* set overflow error */
2102 DEBUG(3,("overflow on entry %d group %s\n", i, name));
2103 errflags=234;
2104 break;
2105 }
2106 }
2107
2108 pdb_search_destroy(search);
2109
2110 *rdata_len = PTR_DIFF(p,*rdata);
2111
2112 *rparam_len = 8;
2113 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2114 if (!*rparam) {
2115 return False;
2116 }
2117 SSVAL(*rparam, 0, errflags);
2118 SSVAL(*rparam, 2, 0); /* converter word */
2119 SSVAL(*rparam, 4, i); /* is this right?? */
2120 SSVAL(*rparam, 6, resume_context+num_entries); /* is this right?? */
2121
2122 return(True);
2123 }
2124
2125 /*******************************************************************
2126 Get groups that a user is a member of.
2127 ******************************************************************/
2128
2129 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2130 char *param, int tpscnt,
2131 char *data, int tdscnt,
2132 int mdrcnt,int mprcnt,
2133 char **rdata,char **rparam,
2134 int *rdata_len,int *rparam_len)
2135 {
2136 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2137 char *str2 = skip_string(param,tpscnt,str1);
2138 char *UserName = skip_string(param,tpscnt,str2);
2139 char *p = skip_string(param,tpscnt,UserName);
2140 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2141 const char *level_string;
2142 int count=0;
2143 struct samu *sampw = NULL;
2144 bool ret = False;
2145 DOM_SID *sids;
2146 gid_t *gids;
2147 size_t num_groups;
2148 size_t i;
2149 NTSTATUS result;
2150 DOM_SID user_sid;
2151 enum lsa_SidType type;
2152 char *endp = NULL;
2153 TALLOC_CTX *mem_ctx;
2154
2155 if (!str1 || !str2 || !UserName || !p) {
2156 return False;
2157 }
2158
2159 *rparam_len = 8;
2160 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2161 if (!*rparam) {
2162 return False;
2163 }
2164
2165 /* check it's a supported varient */
2166
2167 if ( strcmp(str1,"zWrLeh") != 0 )
2168 return False;
2169
2170 switch( uLevel ) {
2171 case 0:
2172 level_string = "B21";
2173 break;
2174 default:
2175 return False;
2176 }
2177
2178 if (strcmp(level_string,str2) != 0)
2179 return False;
2180
2181 *rdata_len = mdrcnt + 1024;
2182 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2183 if (!*rdata) {
2184 return False;
2185 }
2186
2187 SSVAL(*rparam,0,NERR_Success);
2188 SSVAL(*rparam,2,0); /* converter word */
2189
2190 p = *rdata;
2191 endp = *rdata + *rdata_len;
2192
2193 mem_ctx = talloc_new(NULL);
2194 if (mem_ctx == NULL) {
2195 DEBUG(0, ("talloc_new failed\n"));
2196 return False;
2197 }
2198
2199 if ( !(sampw = samu_new(mem_ctx)) ) {
2200 DEBUG(0, ("samu_new() failed!\n"));
2201 TALLOC_FREE(mem_ctx);
2202 return False;
2203 }
2204
2205 /* Lookup the user information; This should only be one of
2206 our accounts (not remote domains) */
2207
2208 become_root(); /* ROOT BLOCK */
2209
2210 if (!lookup_name(mem_ctx, UserName, LOOKUP_NAME_ALL,
2211 NULL, NULL, &user_sid, &type)) {
2212 DEBUG(10, ("lookup_name(%s) failed\n", UserName));
2213 goto done;
2214 }
2215
2216 if (type != SID_NAME_USER) {
2217 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2218 sid_type_lookup(type)));
2219 goto done;
2220 }
2221
2222 if ( !pdb_getsampwsid(sampw, &user_sid) ) {
2223 DEBUG(10, ("pdb_getsampwsid(%s) failed for user %s\n",
2224 sid_string_dbg(&user_sid), UserName));
2225 goto done;
2226 }
2227
2228 gids = NULL;
2229 sids = NULL;
2230 num_groups = 0;
2231
2232 result = pdb_enum_group_memberships(mem_ctx, sampw,
2233 &sids, &gids, &num_groups);
2234
2235 if (!NT_STATUS_IS_OK(result)) {
2236 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2237 UserName));
2238 goto done;
2239 }
2240
2241 for (i=0; i<num_groups; i++) {
2242 const char *grp_name;
2243
2244 if ( lookup_sid(mem_ctx, &sids[i], NULL, &grp_name, NULL) ) {
2245 strlcpy(p, grp_name, PTR_DIFF(endp,p));
2246 p += 21;
2247 count++;
2248 }
2249 }
2250
2251 *rdata_len = PTR_DIFF(p,*rdata);
2252
2253 SSVAL(*rparam,4,count); /* is this right?? */
2254 SSVAL(*rparam,6,count); /* is this right?? */
2255
2256 ret = True;
2257
2258 done:
2259 unbecome_root(); /* END ROOT BLOCK */
2260
2261 TALLOC_FREE(mem_ctx);
2262
2263 return ret;
2264 }
2265
2266 /*******************************************************************
2267 Get all users.
2268 ******************************************************************/
2269
2270 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2271 char *param, int tpscnt,
2272 char *data, int tdscnt,
2273 int mdrcnt,int mprcnt,
2274 char **rdata,char **rparam,
2275 int *rdata_len,int *rparam_len)
2276 {
2277 int count_sent=0;
2278 int num_users=0;
2279 int errflags=0;
2280 int i, resume_context, cli_buf_size;
2281 struct pdb_search *search;
2282 struct samr_displayentry *users;
2283
2284 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2285 char *str2 = skip_string(param,tpscnt,str1);
2286 char *p = skip_string(param,tpscnt,str2);
2287 char *endp = NULL;
2288
2289 if (!str1 || !str2 || !p) {
2290 return False;
2291 }
2292
2293 if (strcmp(str1,"WrLeh") != 0)
2294 return False;
2295 /* parameters
2296 * W-> resume context (number of users to skip)
2297 * r -> return parameter pointer to receive buffer
2298 * L -> length of receive buffer
2299 * e -> return parameter number of entries
2300 * h -> return parameter total number of users
2301 */
2302
2303 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2304 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2305 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2306 resume_context, cli_buf_size));
2307
2308 *rparam_len = 8;
2309 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2310 if (!*rparam) {
2311 return False;
2312 }
2313
2314 /* check it's a supported varient */
2315 if (strcmp("B21",str2) != 0)
2316 return False;
2317
2318 *rdata_len = cli_buf_size;
2319 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2320 if (!*rdata) {
2321 return False;
2322 }
2323
2324 p = *rdata;
2325 endp = *rdata + *rdata_len;
2326
2327 become_root();
2328 search = pdb_search_users(ACB_NORMAL);
2329 unbecome_root();
2330 if (search == NULL) {
2331 DEBUG(0, ("api_RNetUserEnum:unable to open sam database.\n"));
2332 return False;
2333 }
2334
2335 become_root();
2336 num_users = pdb_search_entries(search, resume_context, 0xffffffff,
2337 &users);
2338 unbecome_root();
2339
2340 errflags=NERR_Success;
2341
2342 for (i=0; i<num_users; i++) {
2343 const char *name = users[i].account_name;
2344
2345 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)&&(strlen(name)<=21)) {
2346 strlcpy(p,name,PTR_DIFF(endp,p));
2347 DEBUG(10,("api_RNetUserEnum:adding entry %d username "
2348 "%s\n",count_sent,p));
2349 p += 21;
2350 count_sent++;
2351 } else {
2352 /* set overflow error */
2353 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2354 "username %s\n",count_sent,name));
2355 errflags=234;
2356 break;
2357 }
2358 }
2359
2360 pdb_search_destroy(search);
2361
2362 *rdata_len = PTR_DIFF(p,*rdata);
2363
2364 SSVAL(*rparam,0,errflags);
2365 SSVAL(*rparam,2,0); /* converter word */
2366 SSVAL(*rparam,4,count_sent); /* is this right?? */
2367 SSVAL(*rparam,6,num_users); /* is this right?? */
2368
2369 return True;
2370 }
2371
2372 /****************************************************************************
2373 Get the time of day info.
2374 ****************************************************************************/
2375
2376 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2377 char *param, int tpscnt,
2378 char *data, int tdscnt,
2379 int mdrcnt,int mprcnt,
2380 char **rdata,char **rparam,
2381 int *rdata_len,int *rparam_len)
2382 {
2383 struct tm *t;
2384 time_t unixdate = time(NULL);
2385 char *p;
2386
2387 *rparam_len = 4;
2388 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2389 if (!*rparam) {
2390 return False;
2391 }
2392
2393 *rdata_len = 21;
2394 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2395 if (!*rdata) {
2396 return False;
2397 }
2398
2399 SSVAL(*rparam,0,NERR_Success);
2400 SSVAL(*rparam,2,0); /* converter word */
2401
2402 p = *rdata;
2403
2404 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2405 by NT in a "net time" operation,
2406 it seems to ignore the one below */
2407
2408 /* the client expects to get localtime, not GMT, in this bit
2409 (I think, this needs testing) */
2410 t = localtime(&unixdate);
2411 if (!t) {
2412 return False;
2413 }
2414
2415 SIVAL(p,4,0); /* msecs ? */
2416 SCVAL(p,8,t->tm_hour);
2417 SCVAL(p,9,t->tm_min);
2418 SCVAL(p,10,t->tm_sec);
2419 SCVAL(p,11,0); /* hundredths of seconds */
2420 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2421 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2422 SCVAL(p,16,t->tm_mday);
2423 SCVAL(p,17,t->tm_mon + 1);
2424 SSVAL(p,18,1900+t->tm_year);
2425 SCVAL(p,20,t->tm_wday);
2426
2427 return True;
2428 }
2429
2430 /****************************************************************************
2431 Set the user password.
2432 *****************************************************************************/
2433
2434 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2435 char *param, int tpscnt,
2436 char *data, int tdscnt,
2437 int mdrcnt,int mprcnt,
2438 char **rdata,char **rparam,
2439 int *rdata_len,int *rparam_len)
2440 {
2441 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2442 char *p = NULL;
2443 fstring user;
2444 fstring pass1,pass2;
2445
2446 /* Skip 2 strings. */
2447 p = skip_string(param,tpscnt,np);
2448 p = skip_string(param,tpscnt,p);
2449
2450 if (!np || !p) {
2451 return False;
2452 }
2453
2454 /* Do we have a string ? */
2455 if (skip_string(param,tpscnt,p) == NULL) {
2456 return False;
2457 }
2458 pull_ascii_fstring(user,p);
2459
2460 p = skip_string(param,tpscnt,p);
2461 if (!p) {
2462 return False;
2463 }
2464
2465 memset(pass1,'\0',sizeof(pass1));
2466 memset(pass2,'\0',sizeof(pass2));
2467 /*
2468 * We use 31 here not 32 as we're checking
2469 * the last byte we want to access is safe.
2470 */
2471 if (!is_offset_safe(param,tpscnt,p,31)) {
2472 return False;
2473 }
2474 memcpy(pass1,p,16);
2475 memcpy(pass2,p+16,16);
2476
2477 *rparam_len = 4;
2478 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2479 if (!*rparam) {
2480 return False;
2481 }
2482
2483 *rdata_len = 0;
2484
2485 SSVAL(*rparam,0,NERR_badpass);
2486 SSVAL(*rparam,2,0); /* converter word */
2487
2488 DEBUG(3,("Set password for <%s>\n",user));
2489
2490 /*
2491 * Attempt to verify the old password against smbpasswd entries
2492 * Win98 clients send old and new password in plaintext for this call.
2493 */
2494
2495 {
2496 auth_serversupplied_info *server_info = NULL;
2497 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2498
2499 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2500
2501 become_root();
2502 if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2503 SSVAL(*rparam,0,NERR_Success);
2504 }
2505 unbecome_root();
2506
2507 TALLOC_FREE(server_info);
2508 }
2509 data_blob_clear_free(&password);
2510 }
2511
2512 /*
2513 * If the plaintext change failed, attempt
2514 * the old encrypted method. NT will generate this
2515 * after trying the samr method. Note that this
2516 * method is done as a last resort as this
2517 * password change method loses the NT password hash
2518 * and cannot change the UNIX password as no plaintext
2519 * is received.
2520 */
2521
2522 if(SVAL(*rparam,0) != NERR_Success) {
2523 struct samu *hnd = NULL;
2524
2525 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2526 become_root();
2527 if (change_lanman_password(hnd,(uchar *)pass2)) {
2528 SSVAL(*rparam,0,NERR_Success);
2529 }
2530 unbecome_root();
2531 TALLOC_FREE(hnd);
2532 }
2533 }
2534
2535 memset((char *)pass1,'\0',sizeof(fstring));
2536 memset((char *)pass2,'\0',sizeof(fstring));
2537
2538 return(True);
2539 }
2540
2541 /****************************************************************************
2542 Set the user password (SamOEM version - gets plaintext).
2543 ****************************************************************************/
2544
2545 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2546 char *param, int tpscnt,
2547 char *data, int tdscnt,
2548 int mdrcnt,int mprcnt,
2549 char **rdata,char **rparam,
2550 int *rdata_len,int *rparam_len)
2551 {
2552 fstring user;
2553 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2554 *rparam_len = 2;
2555 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2556 if (!*rparam) {
2557 return False;
2558 }
2559
2560 if (!p) {
2561 return False;
2562 }
2563 *rdata_len = 0;
2564
2565 SSVAL(*rparam,0,NERR_badpass);
2566
2567 /*
2568 * Check the parameter definition is correct.
2569 */
2570
2571 /* Do we have a string ? */
2572 if (skip_string(param,tpscnt,p) == 0) {
2573 return False;
2574 }
2575 if(!strequal(p, "zsT")) {
2576 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2577 return False;
2578 }
2579 p = skip_string(param, tpscnt, p);
2580 if (!p) {
2581 return False;
2582 }
2583
2584 /* Do we have a string ? */
2585 if (skip_string(param,tpscnt,p) == 0) {
2586 return False;
2587 }
2588 if(!strequal(p, "B516B16")) {
2589 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2590 return False;
2591 }
2592 p = skip_string(param,tpscnt,p);
2593 if (!p) {
2594 return False;
2595 }
2596 /* Do we have a string ? */
2597 if (skip_string(param,tpscnt,p) == 0) {
2598 return False;
2599 }
2600 p += pull_ascii_fstring(user,p);
2601
2602 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2603
2604 /*
2605 * Pass the user through the NT -> unix user mapping
2606 * function.
2607 */
2608
2609 (void)map_username(user);
2610
2611 if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2612 SSVAL(*rparam,0,NERR_Success);
2613 }
2614
2615 return(True);
2616 }
2617
2618 /****************************************************************************
2619 delete a print job
2620 Form: <W> <>
2621 ****************************************************************************/
2622
2623 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2624 char *param, int tpscnt,
2625 char *data, int tdscnt,
2626 int mdrcnt,int mprcnt,
2627 char **rdata,char **rparam,
2628 int *rdata_len,int *rparam_len)
2629 {
2630 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2631 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2632 char *str2 = skip_string(param,tpscnt,str1);
2633 char *p = skip_string(param,tpscnt,str2);
2634 uint32 jobid;
2635 int snum;
2636 fstring sharename;
2637 int errcode;
2638 WERROR werr = WERR_OK;
2639
2640 if (!str1 || !str2 || !p) {
2641 return False;
2642 }
2643 /*
2644 * We use 1 here not 2 as we're checking
2645 * the last byte we want to access is safe.
2646 */
2647 if (!is_offset_safe(param,tpscnt,p,1)) {
2648 return False;
2649 }
2650 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2651 return False;
2652
2653 /* check it's a supported varient */
2654 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2655 return(False);
2656
2657 *rparam_len = 4;
2658 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2659 if (!*rparam) {
2660 return False;
2661 }
2662 *rdata_len = 0;
2663
2664 if (!print_job_exists(sharename, jobid)) {
2665 errcode = NERR_JobNotFound;
2666 goto out;
2667 }
2668
2669 snum = lp_servicenumber( sharename);
2670 if (snum == -1) {
2671 errcode = NERR_DestNotFound;
2672 goto out;
2673 }
2674
2675 errcode = NERR_notsupported;
2676
2677 switch (function) {
2678 case 81: /* delete */
2679 if (print_job_delete(&current_user, snum, jobid, &werr))
2680 errcode = NERR_Success;
2681 break;
2682 case 82: /* pause */
2683 if (print_job_pause(&current_user, snum, jobid, &werr))
2684 errcode = NERR_Success;
2685 break;
2686 case 83: /* resume */
2687 if (print_job_resume(&current_user, snum, jobid, &werr))
2688 errcode = NERR_Success;
2689 break;
2690 }
2691
2692 if (!W_ERROR_IS_OK(werr))
2693 errcode = W_ERROR_V(werr);
2694
2695 out:
2696 SSVAL(*rparam,0,errcode);
2697 SSVAL(*rparam,2,0); /* converter word */
2698
2699 return(True);
2700 }
2701
2702 /****************************************************************************
2703 Purge a print queue - or pause or resume it.
2704 ****************************************************************************/
2705
2706 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2707 char *param, int tpscnt,
2708 char *data, int tdscnt,
2709 int mdrcnt,int mprcnt,
2710 char **rdata,char **rparam,
2711 int *rdata_len,int *rparam_len)
2712 {
2713 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2714 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2715 char *str2 = skip_string(param,tpscnt,str1);
2716 char *QueueName = skip_string(param,tpscnt,str2);
2717 int errcode = NERR_notsupported;
2718 int snum;
2719 WERROR werr = WERR_OK;
2720
2721 if (!str1 || !str2 || !QueueName) {
2722 return False;
2723 }
2724
2725 /* check it's a supported varient */
2726 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2727 return(False);
2728
2729 *rparam_len = 4;
2730 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2731 if (!*rparam) {
2732 return False;
2733 }
2734 *rdata_len = 0;
2735
2736 if (skip_string(param,tpscnt,QueueName) == NULL) {
2737 return False;
2738 }
2739 snum = print_queue_snum(QueueName);
2740
2741 if (snum == -1) {
2742 errcode = NERR_JobNotFound;
2743 goto out;
2744 }
2745
2746 switch (function) {
2747 case 74: /* Pause queue */
2748 if (print_queue_pause(&current_user, snum, &werr)) errcode = NERR_Success;
2749 break;
2750 case 75: /* Resume queue */
2751 if (print_queue_resume(&current_user, snum, &werr)) errcode = NERR_Success;
2752 break;
2753 case 103: /* Purge */
2754 if (print_queue_purge(&current_user, snum, &werr)) errcode = NERR_Success;
2755 break;
2756 }
2757
2758 if (!W_ERROR_IS_OK(werr)) errcode = W_ERROR_V(werr);
2759
2760 out:
2761 SSVAL(*rparam,0,errcode);
2762 SSVAL(*rparam,2,0); /* converter word */
2763
2764 return(True);
2765 }
2766
2767 /****************************************************************************
2768 set the property of a print job (undocumented?)
2769 ? function = 0xb -> set name of print job
2770 ? function = 0x6 -> move print job up/down
2771 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2772 or <WWsTP> <WB21BB16B10zWWzDDz>
2773 ****************************************************************************/
2774
2775 static int check_printjob_info(struct pack_desc* desc,
2776 int uLevel, char* id)
2777 {
2778 desc->subformat = NULL;
2779 switch( uLevel ) {
2780 case 0: desc->format = "W"; break;
2781 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2782 case 2: desc->format = "WWzWWDDzz"; break;
2783 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2784 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2785 default:
2786 DEBUG(0,("check_printjob_info: invalid level %d\n",
2787 uLevel ));
2788 return False;
2789 }
2790 if (id == NULL || strcmp(desc->format,id) != 0) {
2791 DEBUG(0,("check_printjob_info: invalid format %s\n",
2792 id ? id : "<NULL>" ));
2793 return False;
2794 }
2795 return True;
2796 }
2797
2798 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2799 char *param, int tpscnt,
2800 char *data, int tdscnt,
2801 int mdrcnt,int mprcnt,
2802 char **rdata,char **rparam,
2803 int *rdata_len,int *rparam_len)
2804 {
2805 struct pack_desc desc;
2806 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2807 char *str2 = skip_string(param,tpscnt,str1);
2808 char *p = skip_string(param,tpscnt,str2);
2809 uint32 jobid;
2810 fstring sharename;
2811 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2812 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2813 int place, errcode;
2814
2815 if (!str1 || !str2 || !p) {
2816 return False;
2817 }
2818 /*
2819 * We use 1 here not 2 as we're checking
2820 * the last byte we want to access is safe.
2821 */
2822 if (!is_offset_safe(param,tpscnt,p,1)) {
2823 return False;
2824 }
2825 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2826 return False;
2827 *rparam_len = 4;
2828 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2829 if (!*rparam) {
2830 return False;
2831 }
2832
2833 if (!share_defined(sharename)) {
2834 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2835 sharename));
2836 return False;
2837 }
2838
2839 *rdata_len = 0;
2840
2841 /* check it's a supported varient */
2842 if ((strcmp(str1,"WWsTP")) ||
2843 (!check_printjob_info(&desc,uLevel,str2)))
2844 return(False);
2845
2846 if (!print_job_exists(sharename, jobid)) {
2847 errcode=NERR_JobNotFound;
2848 goto out;
2849 }
2850
2851 errcode = NERR_notsupported;
2852
2853 switch (function) {
2854 case 0x6:
2855 /* change job place in the queue,
2856 data gives the new place */
2857 place = SVAL(data,0);
2858 if (print_job_set_place(sharename, jobid, place)) {
2859 errcode=NERR_Success;
2860 }
2861 break;
2862
2863 case 0xb:
2864 /* change print job name, data gives the name */
2865 if (print_job_set_name(sharename, jobid, data)) {
2866 errcode=NERR_Success;
2867 }
2868 break;
2869
2870 default:
2871 return False;
2872 }
2873
2874 out:
2875 SSVALS(*rparam,0,errcode);
2876 SSVAL(*rparam,2,0); /* converter word */
2877
2878 return(True);
2879 }
2880
2881
2882 /****************************************************************************
2883 Get info about the server.
2884 ****************************************************************************/
2885
2886 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
2887 char *param, int tpscnt,
2888 char *data, int tdscnt,
2889 int mdrcnt,int mprcnt,
2890 char **rdata,char **rparam,
2891 int *rdata_len,int *rparam_len)
2892 {
2893 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2894 char *str2 = skip_string(param,tpscnt,str1);
2895 char *p = skip_string(param,tpscnt,str2);
2896 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2897 char *p2;
2898 int struct_len;
2899
2900 if (!str1 || !str2 || !p) {
2901 return False;
2902 }
2903
2904 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
2905
2906 /* check it's a supported varient */
2907 if (!prefix_ok(str1,"WrLh")) {
2908 return False;
2909 }
2910
2911 switch( uLevel ) {
2912 case 0:
2913 if (strcmp(str2,"B16") != 0) {
2914 return False;
2915 }
2916 struct_len = 16;
2917 break;
2918 case 1:
2919 if (strcmp(str2,"B16BBDz") != 0) {
2920 return False;
2921 }
2922 struct_len = 26;
2923 break;
2924 case 2:
2925 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
2926 return False;
2927 }
2928 struct_len = 134;
2929 break;
2930 case 3:
2931 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
2932 return False;
2933 }
2934 struct_len = 144;
2935 break;
2936 case 20:
2937 if (strcmp(str2,"DN") != 0) {
2938 return False;
2939 }
2940 struct_len = 6;
2941 break;
2942 case 50:
2943 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
2944 return False;
2945 }
2946 struct_len = 42;
2947 break;
2948 default:
2949 return False;
2950 }
2951
2952 *rdata_len = mdrcnt;
2953 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2954 if (!*rdata) {
2955 return False;
2956 }
2957
2958 p = *rdata;
2959 p2 = p + struct_len;
2960 if (uLevel != 20) {
2961 srvstr_push(NULL, 0, p,global_myname(),16,
2962 STR_ASCII|STR_UPPER|STR_TERMINATE);
2963 }
2964 p += 16;
2965 if (uLevel > 0) {
2966 struct srv_info_struct *servers=NULL;
2967 int i,count;
2968 char *comment = NULL;
2969 TALLOC_CTX *ctx = talloc_tos();
2970 uint32 servertype= lp_default_server_announce();
2971
2972 comment = talloc_strdup(ctx,lp_serverstring());
2973 if (!comment) {
2974 return false;
2975 }
2976
2977 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
2978 for (i=0;i<count;i++) {
2979 if (strequal(servers[i].name,global_myname())) {
2980 servertype = servers[i].type;
2981 TALLOC_FREE(comment);
2982 comment = talloc_strdup(ctx,
2983 servers[i].comment);
2984 if (comment) {
2985 return false;
2986 }
2987 }
2988 }
2989 }
2990
2991 SAFE_FREE(servers);
2992
2993 SCVAL(p,0,lp_major_announce_version());
2994 SCVAL(p,1,lp_minor_announce_version());
2995 SIVAL(p,2,servertype);
2996
2997 if (mdrcnt == struct_len) {
2998 SIVAL(p,6,0);
2999 } else {
3000 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3001 comment = talloc_sub_advanced(ctx,
3002 lp_servicename(SNUM(conn)),
3003 conn->user,
3004 conn->connectpath,
3005 conn->gid,
3006 get_current_username(),
3007 current_user_info.domain,
3008 comment);
3009 if (comment) {
3010 return false;
3011 }
3012 if (mdrcnt - struct_len <= 0) {
3013 return false;
3014 }
3015 push_ascii(p2,
3016 comment,
3017 MIN(mdrcnt - struct_len,
3018 MAX_SERVER_STRING_LENGTH),
3019 STR_TERMINATE);
3020 p2 = skip_string(*rdata,*rdata_len,p2);
3021 if (!p2) {
3022 return False;
3023 }
3024 }
3025 }
3026
3027 if (uLevel > 1) {
3028 return False; /* not yet implemented */
3029 }
3030
3031 *rdata_len = PTR_DIFF(p2,*rdata);
3032
3033 *rparam_len = 6;
3034 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3035 if (!*rparam) {
3036 return False;
3037 }
3038 SSVAL(*rparam,0,NERR_Success);
3039 SSVAL(*rparam,2,0); /* converter word */
3040 SSVAL(*rparam,4,*rdata_len);
3041
3042 return True;
3043 }
3044
3045 /****************************************************************************
3046 Get info about the server.
3047 ****************************************************************************/
3048
3049 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3050 char *param, int tpscnt,
3051 char *data, int tdscnt,
3052 int mdrcnt,int mprcnt,
3053 char **rdata,char **rparam,
3054 int *rdata_len,int *rparam_len)
3055 {
3056 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3057 char *str2 = skip_string(param,tpscnt,str1);
3058 char *p = skip_string(param,tpscnt,str2);
3059 char *p2;
3060 char *endp;
3061 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3062
3063 if (!str1 || !str2 || !p) {
3064 return False;
3065 }
3066
3067 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3068
3069 *rparam_len = 6;
3070 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3071 if (!*rparam) {
3072 return False;
3073 }
3074
3075 /* check it's a supported varient */
3076 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3077 return False;
3078 }
3079
3080 *rdata_len = mdrcnt + 1024;
3081 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3082 if (!*rdata) {
3083 return False;
3084 }
3085
3086 SSVAL(*rparam,0,NERR_Success);
3087 SSVAL(*rparam,2,0); /* converter word */
3088
3089 p = *rdata;
3090 endp = *rdata + *rdata_len;
3091
3092 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3093 if (!p2) {
3094 return False;
3095 }
3096
3097 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3098 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3099 strupper_m(p2);
3100 p2 = skip_string(*rdata,*rdata_len,p2);
3101 if (!p2) {
3102 return False;
3103 }
3104 p += 4;
3105
3106 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3107 strlcpy(p2,current_user_info.smb_name,PTR_DIFF(endp,p2));
3108 p2 = skip_string(*rdata,*rdata_len,p2);
3109 if (!p2) {
3110 return False;
3111 }
3112 p += 4;
3113
3114 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3115 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3116 strupper_m(p2);
3117 p2 = skip_string(*rdata,*rdata_len,p2);
3118 if (!p2) {
3119 return False;
3120 }
3121 p += 4;
3122
3123 SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3124 SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3125 p += 2;
3126
3127 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3128 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3129 p2 = skip_string(*rdata,*rdata_len,p2);
3130 if (!p2) {
3131 return False;
3132 }
3133 p += 4;
3134
3135 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3136 strlcpy(p2,"",PTR_DIFF(endp,p2));
3137 p2 = skip_string(*rdata,*rdata_len,p2);
3138 if (!p2) {
3139 return False;
3140 }
3141 p += 4;
3142
3143 *rdata_len = PTR_DIFF(p2,*rdata);
3144
3145 SSVAL(*rparam,4,*rdata_len);
3146
3147 return True;
3148 }
3149
3150 /****************************************************************************
3151 get info about a user
3152
3153 struct user_info_11 {
3154 char usri11_name[21]; 0-20
3155 char usri11_pad; 21
3156 char *usri11_comment; 22-25
3157 char *usri11_usr_comment; 26-29
3158 unsigned short usri11_priv; 30-31
3159 unsigned long usri11_auth_flags; 32-35
3160 long usri11_password_age; 36-39
3161 char *usri11_homedir; 40-43
3162 char *usri11_parms; 44-47
3163 long usri11_last_logon; 48-51
3164 long usri11_last_logoff; 52-55
3165 unsigned short usri11_bad_pw_count; 56-57
3166 unsigned short usri11_num_logons; 58-59
3167 char *usri11_logon_server; 60-63
3168 unsigned short usri11_country_code; 64-65
3169 char *usri11_workstations; 66-69
3170 unsigned long usri11_max_storage; 70-73
3171 unsigned short usri11_units_per_week; 74-75
3172 unsigned char *usri11_logon_hours; 76-79
3173 unsigned short usri11_code_page; 80-81
3174 };
3175
3176 where:
3177
3178 usri11_name specifies the user name for which information is retrieved
3179
3180 usri11_pad aligns the next data structure element to a word boundary
3181
3182 usri11_comment is a null terminated ASCII comment
3183
3184 usri11_user_comment is a null terminated ASCII comment about the user
3185
3186 usri11_priv specifies the level of the privilege assigned to the user.
3187 The possible values are:
3188
3189 Name Value Description
3190 USER_PRIV_GUEST 0 Guest privilege
3191 USER_PRIV_USER 1 User privilege
3192 USER_PRV_ADMIN 2 Administrator privilege
3193
3194 usri11_auth_flags specifies the account operator privileges. The
3195 possible values are:
3196
3197 Name Value Description
3198 AF_OP_PRINT 0 Print operator
3199
3200
3201 Leach, Naik [Page 28]
3202 \f
3203
3204
3205 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3206
3207
3208 AF_OP_COMM 1 Communications operator
3209 AF_OP_SERVER 2 Server operator
3210 AF_OP_ACCOUNTS 3 Accounts operator
3211
3212
3213 usri11_password_age specifies how many seconds have elapsed since the
3214 password was last changed.
3215
3216 usri11_home_dir points to a null terminated ASCII string that contains
3217 the path name of the user's home directory.
3218
3219 usri11_parms points to a null terminated ASCII string that is set
3220 aside for use by applications.
3221
3222 usri11_last_logon specifies the time when the user last logged on.
3223 This value is stored as the number of seconds elapsed since
3224 00:00:00, January 1, 1970.
3225
3226 usri11_last_logoff specifies the time when the user last logged off.
3227 This value is stored as the number of seconds elapsed since
3228 00:00:00, January 1, 1970. A value of 0 means the last logoff
3229 time is unknown.
3230
3231 usri11_bad_pw_count specifies the number of incorrect passwords
3232 entered since the last successful logon.
3233
3234 usri11_log1_num_logons specifies the number of times this user has
3235 logged on. A value of -1 means the number of logons is unknown.
3236
3237 usri11_logon_server points to a null terminated ASCII string that
3238 contains the name of the server to which logon requests are sent.
3239 A null string indicates logon requests should be sent to the
3240 domain controller.
3241
3242 usri11_country_code specifies the country code for the user's language
3243 of choice.
3244
3245 usri11_workstations points to a null terminated ASCII string that
3246 contains the names of workstations the user may log on from.
3247 There may be up to 8 workstations, with the names separated by
3248 commas. A null strings indicates there are no restrictions.
3249
3250 usri11_max_storage specifies the maximum amount of disk space the user
3251 can occupy. A value of 0xffffffff indicates there are no
3252 restrictions.
3253
3254 usri11_units_per_week specifies the equal number of time units into
3255 which a week is divided. This value must be equal to 168.
3256
3257 usri11_logon_hours points to a 21 byte (168 bits) string that
3258 specifies the time during which the user can log on. Each bit
3259 represents one unique hour in a week. The first bit (bit 0, word
3260 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3261
3262
3263
3264 Leach, Naik [Page 29]
3265 \f
3266
3267
3268 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3269
3270
3271 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3272 are no restrictions.
3273
3274 usri11_code_page specifies the code page for the user's language of
3275 choice
3276
3277 All of the pointers in this data structure need to be treated
3278 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3279 to be ignored. The converter word returned in the parameters section
3280 needs to be subtracted from the lower 16 bits to calculate an offset
3281 into the return buffer where this ASCII string resides.
3282
3283 There is no auxiliary data in the response.
3284
3285 ****************************************************************************/
3286
3287 #define usri11_name 0
3288 #define usri11_pad 21
3289 #define usri11_comment 22
3290 #define usri11_usr_comment 26
3291 #define usri11_full_name 30
3292 #define usri11_priv 34
3293 #define usri11_auth_flags 36
3294 #define usri11_password_age 40
3295 #define usri11_homedir 44
3296 #define usri11_parms 48
3297 #define usri11_last_logon 52
3298 #define usri11_last_logoff 56
3299 #define usri11_bad_pw_count 60
3300 #define usri11_num_logons 62
3301 #define usri11_logon_server 64
3302 #define usri11_country_code 68
3303 #define usri11_workstations 70
3304 #define usri11_max_storage 74
3305 #define usri11_units_per_week 78
3306 #define usri11_logon_hours 80
3307 #define usri11_code_page 84
3308 #define usri11_end 86
3309
3310 #define USER_PRIV_GUEST 0
3311 #define USER_PRIV_USER 1
3312 #define USER_PRIV_ADMIN 2
3313
3314 #define AF_OP_PRINT 0
3315 #define AF_OP_COMM 1
3316 #define AF_OP_SERVER 2
3317 #define AF_OP_ACCOUNTS 3
3318
3319
3320 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3321 char *param, int tpscnt,
3322 char *data, int tdscnt,
3323 int mdrcnt,int mprcnt,
3324 char **rdata,char **rparam,
3325 int *rdata_len,int *rparam_len)
3326 {
3327 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3328 char *str2 = skip_string(param,tpscnt,str1);
3329 char *UserName = skip_string(param,tpscnt,str2);
3330 char *p = skip_string(param,tpscnt,UserName);
3331 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3332 char *p2;
3333 char *endp;
3334 const char *level_string;
3335
3336 /* get NIS home of a previously validated user - simeon */
3337 /* With share level security vuid will always be zero.
3338 Don't depend on vuser being non-null !!. JRA */
3339 user_struct *vuser = get_valid_user_struct(vuid);
3340 if(vuser != NULL) {
3341 DEBUG(3,(" Username of UID %d is %s\n",
3342 (int)vuser->server_info->uid,
3343 vuser->user.unix_name));
3344 }
3345
3346 if (!str1 || !str2 || !UserName || !p) {
3347 return False;
3348 }
3349
3350 *rparam_len = 6;
3351 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3352 if (!*rparam) {
3353 return False;
3354 }
3355
3356 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3357
3358 /* check it's a supported variant */
3359 if (strcmp(str1,"zWrLh") != 0) {
3360 return False;
3361 }
3362 switch( uLevel ) {
3363 case 0: level_string = "B21"; break;
3364 case 1: level_string = "B21BB16DWzzWz"; break;
3365 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3366 case 10: level_string = "B21Bzzz"; break;
3367 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3368 default: return False;
3369 }
3370
3371 if (strcmp(level_string,str2) != 0) {
3372 return False;
3373 }
3374
3375 *rdata_len = mdrcnt + 1024;
3376 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3377 if (!*rdata) {
3378 return False;
3379 }
3380
3381 SSVAL(*rparam,0,NERR_Success);
3382 SSVAL(*rparam,2,0); /* converter word */
3383
3384 p = *rdata;
3385 endp = *rdata + *rdata_len;
3386 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3387 if (!p2) {
3388 return False;
3389 }
3390
3391 memset(p,0,21);
3392 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3393
3394 if (uLevel > 0) {
3395 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3396 *p2 = 0;
3397 }
3398
3399 if (uLevel >= 10) {
3400 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3401 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3402 p2 = skip_string(*rdata,*rdata_len,p2);
3403 if (!p2) {
3404 return False;
3405 }
3406
3407 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3408 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3409 p2 = skip_string(*rdata,*rdata_len,p2);
3410 if (!p2) {
3411 return False;
3412 }
3413
3414 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3415 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3416 strlcpy(p2,((vuser != NULL) ? vuser->user.full_name : UserName),PTR_DIFF(endp,p2));
3417 p2 = skip_string(*rdata,*rdata_len,p2);
3418 if (!p2) {
3419 return False;
3420 }
3421 }
3422
3423 if (uLevel == 11) {
3424 const char *homedir = "";
3425 if (vuser != NULL) {
3426 homedir = pdb_get_homedir(
3427 vuser->server_info->sam_account);
3428 }
3429 /* modelled after NTAS 3.51 reply */
3430 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3431 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
3432 SIVALS(p,usri11_password_age,-1); /* password age */
3433 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3434 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3435 p2 = skip_string(*rdata,*rdata_len,p2);
3436 if (!p2) {
3437 return False;
3438 }
3439 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3440 strlcpy(p2,"",PTR_DIFF(endp,p2));
3441 p2 = skip_string(*rdata,*rdata_len,p2);
3442 if (!p2) {
3443 return False;
3444 }
3445 SIVAL(p,usri11_last_logon,0); /* last logon */
3446 SIVAL(p,usri11_last_logoff,0); /* last logoff */
3447 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
3448 SSVALS(p,usri11_num_logons,-1); /* num logons */
3449 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3450 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3451 p2 = skip_string(*rdata,*rdata_len,p2);
3452 if (!p2) {
3453 return False;
3454 }
3455 SSVAL(p,usri11_country_code,0); /* country code */
3456
3457 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3458 strlcpy(p2,"",PTR_DIFF(endp,p2));
3459 p2 = skip_string(*rdata,*rdata_len,p2);
3460 if (!p2) {
3461 return False;
3462 }
3463
3464 SIVALS(p,usri11_max_storage,-1); /* max storage */
3465 SSVAL(p,usri11_units_per_week,168); /* units per week */
3466 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3467
3468 /* a simple way to get logon hours at all times. */
3469 memset(p2,0xff,21);
3470 SCVAL(p2,21,0); /* fix zero termination */
3471 p2 = skip_string(*rdata,*rdata_len,p2);
3472 if (!p2) {
3473 return False;
3474 }
3475
3476 SSVAL(p,usri11_code_page,0); /* code page */
3477 }
3478
3479 if (uLevel == 1 || uLevel == 2) {
3480 memset(p+22,' ',16); /* password */
3481 SIVALS(p,38,-1); /* password age */
3482 SSVAL(p,42,
3483 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3484 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3485 strlcpy(p2, vuser ? pdb_get_homedir(
3486 vuser->server_info->sam_account) : "",
3487 PTR_DIFF(endp,p2));
3488 p2 = skip_string(*rdata,*rdata_len,p2);
3489 if (!p2) {
3490 return False;
3491 }
3492 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3493 *p2++ = 0;
3494 SSVAL(p,52,0); /* flags */
3495 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
3496 strlcpy(p2, vuser ? pdb_get_logon_script(
3497 vuser->server_info->sam_account) : "",
3498 PTR_DIFF(endp,p2));
3499 p2 = skip_string(*rdata,*rdata_len,p2);
3500 if (!p2) {
3501 return False;
3502 }
3503 if (uLevel == 2) {
3504 SIVAL(p,60,0); /* auth_flags */
3505 SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3506 strlcpy(p2,((vuser != NULL) ? vuser->user.full_name : UserName),PTR_DIFF(endp,p2));
3507 p2 = skip_string(*rdata,*rdata_len,p2);
3508 if (!p2) {
3509 return False;
3510 }
3511 SIVAL(p,68,0); /* urs_comment */
3512 SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3513 strlcpy(p2,"",PTR_DIFF(endp,p2));
3514 p2 = skip_string(*rdata,*rdata_len,p2);
3515 if (!p2) {
3516 return False;
3517 }
3518 SIVAL(p,76,0); /* workstations */
3519 SIVAL(p,80,0); /* last_logon */
3520 SIVAL(p,84,0); /* last_logoff */
3521 SIVALS(p,88,-1); /* acct_expires */
3522 SIVALS(p,92,-1); /* max_storage */
3523 SSVAL(p,96,168); /* units_per_week */
3524 SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3525 memset(p2,-1,21);
3526 p2 += 21;
3527 SSVALS(p,102,-1); /* bad_pw_count */
3528 SSVALS(p,104,-1); /* num_logons */
3529 SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3530 {
3531 TALLOC_CTX *ctx = talloc_tos();
3532 int space_rem = *rdata_len - (p2 - *rdata);
3533 char *tmp;
3534
3535 if (space_rem <= 0) {
3536 return false;
3537 }
3538 tmp = talloc_strdup(ctx, "\\\\%L");
3539 if (!tmp) {
3540 return false;
3541 }
3542 tmp = talloc_sub_basic(ctx,
3543 "",
3544 "",
3545 tmp);
3546 if (!tmp) {
3547 return false;
3548 }
3549
3550 push_ascii(p2,
3551 tmp,
3552 space_rem,
3553 STR_TERMINATE);
3554 }
3555 p2 = skip_string(*rdata,*rdata_len,p2);
3556 if (!p2) {
3557 return False;
3558 }
3559 SSVAL(p,110,49); /* country_code */
3560 SSVAL(p,112,860); /* code page */
3561 }
3562 }
3563
3564 *rdata_len = PTR_DIFF(p2,*rdata);
3565
3566 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
3567
3568 return(True);
3569 }
3570
3571 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3572 char *param, int tpscnt,
3573 char *data, int tdscnt,
3574 int mdrcnt,int mprcnt,
3575 char **rdata,char **rparam,
3576 int *rdata_len,int *rparam_len)
3577 {
3578 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3579 char *str2 = skip_string(param,tpscnt,str1);
3580 char *p = skip_string(param,tpscnt,str2);
3581 int uLevel;
3582 struct pack_desc desc;
3583 char* name;
3584 /* With share level security vuid will always be zero.
3585 Don't depend on vuser being non-null !!. JRA */
3586 user_struct *vuser = get_valid_user_struct(vuid);
3587
3588 if (!str1 || !str2 || !p) {
3589 return False;
3590 }
3591
3592 if(vuser != NULL) {
3593 DEBUG(3,(" Username of UID %d is %s\n",
3594 (int)vuser->server_info->uid,
3595 vuser->user.unix_name));
3596 }
3597
3598 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3599 name = get_safe_str_ptr(param,tpscnt,p,2);
3600 if (!name) {
3601 return False;
3602 }
3603
3604 memset((char *)&desc,'\0',sizeof(desc));
3605
3606 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3607
3608 /* check it's a supported varient */
3609 if (strcmp(str1,"OOWb54WrLh") != 0) {
3610 return False;
3611 }
3612 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3613 return False;
3614 }
3615 if (mdrcnt > 0) {
3616 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3617 if (!*rdata) {
3618 return False;
3619 }
3620 }
3621
3622 desc.base = *rdata;
3623 desc.buflen = mdrcnt;
3624 desc.subformat = NULL;
3625 desc.format = str2;
3626
3627 if (init_package(&desc,1,0)) {
3628 PACKI(&desc,"W",0); /* code */
3629 PACKS(&desc,"B21",name); /* eff. name */
3630 PACKS(&desc,"B",""); /* pad */
3631 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3632 PACKI(&desc,"D",0); /* auth flags XXX */
3633 PACKI(&desc,"W",0); /* num logons */
3634 PACKI(&desc,"W",0); /* bad pw count */
3635 PACKI(&desc,"D",0); /* last logon */
3636 PACKI(&desc,"D",-1); /* last logoff */
3637 PACKI(&desc,"D",-1); /* logoff time */
3638 PACKI(&desc,"D",-1); /* kickoff time */
3639 PACKI(&desc,"D",0); /* password age */
3640 PACKI(&desc,"D",0); /* password can change */
3641 PACKI(&desc,"D",-1); /* password must change */
3642
3643 {
3644 fstring mypath;
3645 fstrcpy(mypath,"\\\\");
3646 fstrcat(mypath,get_local_machine_name());
3647 strupper_m(mypath);
3648 PACKS(&desc,"z",mypath); /* computer */
3649 }
3650
3651 PACKS(&desc,"z",lp_workgroup());/* domain */
3652 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3653 vuser->server_info->sam_account) : ""); /* script path */
3654 PACKI(&desc,"D",0x00000000); /* reserved */
3655 }
3656
3657 *rdata_len = desc.usedlen;
3658 *rparam_len = 6;
3659 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3660 if (!*rparam) {
3661 return False;
3662 }
3663 SSVALS(*rparam,0,desc.errcode);
3664 SSVAL(*rparam,2,0);
3665 SSVAL(*rparam,4,desc.neededlen);
3666
3667 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3668
3669 return True;
3670 }
3671
3672 /****************************************************************************
3673 api_WAccessGetUserPerms
3674 ****************************************************************************/
3675
3676 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3677 char *param, int tpscnt,
3678 char *data, int tdscnt,
3679 int mdrcnt,int mprcnt,
3680 char **rdata,char **rparam,
3681 int *rdata_len,int *rparam_len)
3682 {
3683 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3684 char *str2 = skip_string(param,tpscnt,str1);
3685 char *user = skip_string(param,tpscnt,str2);
3686 char *resource = skip_string(param,tpscnt,user);
3687
3688 if (!str1 || !str2 || !user || !resource) {
3689 return False;
3690 }
3691
3692 if (skip_string(param,tpscnt,resource) == NULL) {
3693 return False;
3694 }
3695 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3696
3697 /* check it's a supported varient */
3698 if (strcmp(str1,"zzh") != 0) {
3699 return False;
3700 }
3701 if (strcmp(str2,"") != 0) {
3702 return False;
3703 }
3704
3705 *rparam_len = 6;
3706 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3707 if (!*rparam) {
3708 return False;
3709 }
3710 SSVALS(*rparam,0,0); /* errorcode */
3711 SSVAL(*rparam,2,0); /* converter word */
3712 SSVAL(*rparam,4,0x7f); /* permission flags */
3713
3714 return True;
3715 }
3716
3717 /****************************************************************************
3718 api_WPrintJobEnumerate
3719 ****************************************************************************/
3720
3721 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3722 char *param, int tpscnt,
3723 char *data, int tdscnt,
3724 int mdrcnt,int mprcnt,
3725 char **rdata,char **rparam,
3726 int *rdata_len,int *rparam_len)
3727 {
3728 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3729 char *str2 = skip_string(param,tpscnt,str1);
3730 char *p = skip_string(param,tpscnt,str2);
3731 int uLevel;
3732 int count;
3733 int i;
3734 int snum;
3735 fstring sharename;
3736 uint32 jobid;
3737 struct pack_desc desc;
3738 print_queue_struct *queue=NULL;
3739 print_status_struct status;
3740 char *tmpdata=NULL;
3741
3742 if (!str1 || !str2 || !p) {
3743 return False;
3744 }
3745
3746 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3747
3748 memset((char *)&desc,'\0',sizeof(desc));
3749 memset((char *)&status,'\0',sizeof(status));
3750
3751 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3752
3753 /* check it's a supported varient */
3754 if (strcmp(str1,"WWrLh") != 0) {
3755 return False;
3756 }
3757 if (!check_printjob_info(&desc,uLevel,str2)) {
3758 return False;
3759 }
3760
3761 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3762 return False;
3763 }
3764
3765 snum = lp_servicenumber( sharename);
3766 if (snum < 0 || !VALID_SNUM(snum)) {
3767 return(False);
3768 }
3769
3770 count = print_queue_status(snum,&queue,&status);
3771 for (i = 0; i < count; i++) {
3772 if (queue[i].job == jobid) {
3773 break;
3774 }
3775 }
3776
3777 if (mdrcnt > 0) {
3778 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3779 if (!*rdata) {
3780 return False;
3781 }
3782 desc.base = *rdata;
3783 desc.buflen = mdrcnt;
3784 } else {
3785 /*
3786 * Don't return data but need to get correct length
3787 * init_package will return wrong size if buflen=0
3788 */
3789 desc.buflen = getlen(desc.format);
3790 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3791 }
3792
3793 if (init_package(&desc,1,0)) {
3794 if (i < count) {
3795 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3796 *rdata_len = desc.usedlen;
3797 } else {
3798 desc.errcode = NERR_JobNotFound;
3799 *rdata_len = 0;
3800 }
3801 }
3802
3803 *rparam_len = 6;
3804 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3805 if (!*rparam) {
3806 return False;
3807 }
3808 SSVALS(*rparam,0,desc.errcode);
3809 SSVAL(*rparam,2,0);
3810 SSVAL(*rparam,4,desc.neededlen);
3811
3812 SAFE_FREE(queue);
3813 SAFE_FREE(tmpdata);
3814
3815 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3816
3817 return True;
3818 }
3819
3820 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3821 char *param, int tpscnt,
3822 char *data, int tdscnt,
3823 int mdrcnt,int mprcnt,
3824 char **rdata,char **rparam,
3825 int *rdata_len,int *rparam_len)
3826 {
3827 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3828 char *str2 = skip_string(param,tpscnt,str1);
3829 char *p = skip_string(param,tpscnt,str2);
3830 char *name = p;
3831 int uLevel;
3832 int count;
3833 int i, succnt=0;
3834 int snum;
3835 struct pack_desc desc;
3836 print_queue_struct *queue=NULL;
3837 print_status_struct status;
3838
3839 if (!str1 || !str2 || !p) {
3840 return False;
3841 }
3842
3843 memset((char *)&desc,'\0',sizeof(desc));
3844 memset((char *)&status,'\0',sizeof(status));
3845
3846 p = skip_string(param,tpscnt,p);
3847 if (!p) {
3848 return False;
3849 }
3850 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3851
3852 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3853
3854 /* check it's a supported variant */
3855 if (strcmp(str1,"zWrLeh") != 0) {
3856 return False;
3857 }
3858
3859 if (uLevel > 2) {
3860 return False; /* defined only for uLevel 0,1,2 */
3861 }
3862
3863 if (!check_printjob_info(&desc,uLevel,str2)) {
3864 return False;
3865 }
3866
3867 snum = find_service(name);
3868 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
3869 return False;
3870 }
3871
3872 count = print_queue_status(snum,&queue,&status);
3873 if (mdrcnt > 0) {
3874 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3875 if (!*rdata) {
3876 return False;
3877 }
3878 }
3879 desc.base = *rdata;
3880 desc.buflen = mdrcnt;
3881
3882 if (init_package(&desc,count,0)) {
3883 succnt = 0;
3884 for (i = 0; i < count; i++) {
3885 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3886 if (desc.errcode == NERR_Success) {
3887 succnt = i+1;
3888 }
3889 }
3890 }
3891
3892 *rdata_len = desc.usedlen;
3893
3894 *rparam_len = 8;
3895 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3896 if (!*rparam) {
3897 return False;
3898 }
3899 SSVALS(*rparam,0,desc.errcode);
3900 SSVAL(*rparam,2,0);
3901 SSVAL(*rparam,4,succnt);
3902 SSVAL(*rparam,6,count);
3903
3904 SAFE_FREE(queue);
3905
3906 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
3907
3908 return True;
3909 }
3910
3911 static int check_printdest_info(struct pack_desc* desc,
3912 int uLevel, char* id)
3913 {
3914 desc->subformat = NULL;
3915 switch( uLevel ) {
3916 case 0:
3917 desc->format = "B9";
3918 break;
3919 case 1:
3920 desc->format = "B9B21WWzW";
3921 break;
3922 case 2:
3923 desc->format = "z";
3924 break;
3925 case 3:
3926 desc->format = "zzzWWzzzWW";
3927 break;
3928 default:
3929 DEBUG(0,("check_printdest_info: invalid level %d\n",
3930 uLevel));
3931 return False;
3932 }
3933 if (id == NULL || strcmp(desc->format,id) != 0) {
3934 DEBUG(0,("check_printdest_info: invalid string %s\n",
3935 id ? id : "<NULL>" ));
3936 return False;
3937 }
3938 return True;
3939 }
3940
3941 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
3942 struct pack_desc* desc)
3943 {
3944 char buf[100];
3945
3946 strncpy(buf,SERVICE(snum),sizeof(buf)-1);
3947 buf[sizeof(buf)-1] = 0;
3948 strupper_m(buf);
3949
3950 if (uLevel <= 1) {
3951 PACKS(desc,"B9",buf); /* szName */
3952 if (uLevel == 1) {
3953 PACKS(desc,"B21",""); /* szUserName */
3954 PACKI(desc,"W",0); /* uJobId */
3955 PACKI(desc,"W",0); /* fsStatus */
3956 PACKS(desc,"z",""); /* pszStatus */
3957 PACKI(desc,"W",0); /* time */
3958 }
3959 }
3960
3961 if (uLevel == 2 || uLevel == 3) {
3962 PACKS(desc,"z",buf); /* pszPrinterName */
3963 if (uLevel == 3) {
3964 PACKS(desc,"z",""); /* pszUserName */
3965 PACKS(desc,"z",""); /* pszLogAddr */
3966 PACKI(desc,"W",0); /* uJobId */
3967 PACKI(desc,"W",0); /* fsStatus */
3968 PACKS(desc,"z",""); /* pszStatus */
3969 PACKS(desc,"z",""); /* pszComment */
3970 PACKS(desc,"z","NULL"); /* pszDrivers */
3971 PACKI(desc,"W",0); /* time */
3972 PACKI(desc,"W",0); /* pad1 */
3973 }
3974 }
3975 }
3976
3977 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
3978 char *param, int tpscnt,
3979 char *data, int tdscnt,
3980 int mdrcnt,int mprcnt,
3981 char **rdata,char **rparam,
3982 int *rdata_len,int *rparam_len)
3983 {
3984 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3985 char *str2 = skip_string(param,tpscnt,str1);
3986 char *p = skip_string(param,tpscnt,str2);
3987 char* PrinterName = p;
3988 int uLevel;
3989 struct pack_desc desc;
3990 int snum;
3991 char *tmpdata=NULL;
3992
3993 if (!str1 || !str2 || !p) {
3994 return False;
3995 }
3996
3997 memset((char *)&desc,'\0',sizeof(desc));
3998
3999 p = skip_string(param,tpscnt,p);
4000 if (!p) {
4001 return False;
4002 }
4003 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4004
4005 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4006
4007 /* check it's a supported varient */
4008 if (strcmp(str1,"zWrLh") != 0) {
4009 return False;
4010 }
4011 if (!check_printdest_info(&desc,uLevel,str2)) {
4012 return False;
4013 }
4014
4015 snum = find_service(PrinterName);
4016 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4017 *rdata_len = 0;
4018 desc.errcode = NERR_DestNotFound;
4019 desc.neededlen = 0;
4020 } else {
4021 if (mdrcnt > 0) {
4022 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4023 if (!*rdata) {
4024 return False;
4025 }
4026 desc.base = *rdata;
4027 desc.buflen = mdrcnt;
4028 } else {
4029 /*
4030 * Don't return data but need to get correct length
4031 * init_package will return wrong size if buflen=0
4032 */
4033 desc.buflen = getlen(desc.format);
4034 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4035 }
4036 if (init_package(&desc,1,0)) {
4037 fill_printdest_info(conn,snum,uLevel,&desc);
4038 }
4039 *rdata_len = desc.usedlen;
4040 }
4041
4042 *rparam_len = 6;
4043 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4044 if (!*rparam) {
4045 return False;
4046 }
4047 SSVALS(*rparam,0,desc.errcode);
4048 SSVAL(*rparam,2,0);
4049 SSVAL(*rparam,4,desc.neededlen);
4050
4051 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4052 SAFE_FREE(tmpdata);
4053
4054 return True;
4055 }
4056
4057 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4058 char *param, int tpscnt,
4059 char *data, int tdscnt,
4060 int mdrcnt,int mprcnt,
4061 char **rdata,char **rparam,
4062 int *rdata_len,int *rparam_len)
4063 {
4064 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4065 char *str2 = skip_string(param,tpscnt,str1);
4066 char *p = skip_string(param,tpscnt,str2);
4067 int uLevel;
4068 int queuecnt;
4069 int i, n, succnt=0;
4070 struct pack_desc desc;
4071 int services = lp_numservices();
4072
4073 if (!str1 || !str2 || !p) {
4074 return False;
4075 }
4076
4077 memset((char *)&desc,'\0',sizeof(desc));
4078
4079 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4080
4081 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4082
4083 /* check it's a supported varient */
4084 if (strcmp(str1,"WrLeh") != 0) {
4085 return False;
4086 }
4087 if (!check_printdest_info(&desc,uLevel,str2)) {
4088 return False;
4089 }
4090
4091 queuecnt = 0;
4092 for (i = 0; i < services; i++) {
4093 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4094 queuecnt++;
4095 }
4096 }
4097
4098 if (mdrcnt > 0) {
4099 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4100 if (!*rdata) {
4101 return False;
4102 }
4103 }
4104
4105 desc.base = *rdata;
4106 desc.buflen = mdrcnt;
4107 if (init_package(&desc,queuecnt,0)) {
4108 succnt = 0;
4109 n = 0;
4110 for (i = 0; i < services; i++) {
4111 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4112 fill_printdest_info(conn,i,uLevel,&desc);
4113 n++;
4114 if (desc.errcode == NERR_Success) {
4115 succnt = n;
4116 }
4117 }
4118 }
4119 }
4120
4121 *rdata_len = desc.usedlen;
4122
4123 *rparam_len = 8;
4124 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4125 if (!*rparam) {
4126 return False;
4127 }
4128 SSVALS(*rparam,0,desc.errcode);
4129 SSVAL(*rparam,2,0);
4130 SSVAL(*rparam,4,succnt);
4131 SSVAL(*rparam,6,queuecnt);
4132
4133 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4134
4135 return True;
4136 }
4137
4138 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4139 char *param, int tpscnt,
4140 char *data, int tdscnt,
4141 int mdrcnt,int mprcnt,
4142 char **rdata,char **rparam,
4143 int *rdata_len,int *rparam_len)
4144 {
4145 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4146 char *str2 = skip_string(param,tpscnt,str1);
4147 char *p = skip_string(param,tpscnt,str2);
4148 int uLevel;
4149 int succnt;
4150 struct pack_desc desc;
4151
4152 if (!str1 || !str2 || !p) {
4153 return False;
4154 }
4155
4156 memset((char *)&desc,'\0',sizeof(desc));
4157
4158 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4159
4160 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4161
4162 /* check it's a supported varient */
4163 if (strcmp(str1,"WrLeh") != 0) {
4164 return False;
4165 }
4166 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4167 return False;
4168 }
4169
4170 if (mdrcnt > 0) {
4171 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4172 if (!*rdata) {
4173 return False;
4174 }
4175 }
4176 desc.base = *rdata;
4177 desc.buflen = mdrcnt;
4178 if (init_package(&desc,1,0)) {
4179 PACKS(&desc,"B41","NULL");
4180 }
4181
4182 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4183
4184 *rdata_len = desc.usedlen;
4185
4186 *rparam_len = 8;
4187 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4188 if (!*rparam) {
4189 return False;
4190 }
4191 SSVALS(*rparam,0,desc.errcode);
4192 SSVAL(*rparam,2,0);
4193 SSVAL(*rparam,4,succnt);
4194 SSVAL(*rparam,6,1);
4195
4196 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4197
4198 return True;
4199 }
4200
4201 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4202 char *param, int tpscnt,
4203 char *data, int tdscnt,
4204 int mdrcnt,int mprcnt,
4205 char **rdata,char **rparam,
4206 int *rdata_len,int *rparam_len)
4207 {
4208 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4209 char *str2 = skip_string(param,tpscnt,str1);
4210 char *p = skip_string(param,tpscnt,str2);
4211 int uLevel;
4212 int succnt;
4213 struct pack_desc desc;
4214
4215 if (!str1 || !str2 || !p) {
4216 return False;
4217 }
4218 memset((char *)&desc,'\0',sizeof(desc));
4219
4220 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4221
4222 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4223
4224 /* check it's a supported varient */
4225 if (strcmp(str1,"WrLeh") != 0) {
4226 return False;
4227 }
4228 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4229 return False;
4230 }
4231
4232 if (mdrcnt > 0) {
4233 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4234 if (!*rdata) {
4235 return False;
4236 }
4237 }
4238 desc.base = *rdata;
4239 desc.buflen = mdrcnt;
4240 desc.format = str2;
4241 if (init_package(&desc,1,0)) {
4242 PACKS(&desc,"B13","lpd");
4243 }
4244
4245 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4246
4247 *rdata_len = desc.usedlen;
4248
4249 *rparam_len = 8;
4250 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4251 if (!*rparam) {
4252 return False;
4253 }
4254 SSVALS(*rparam,0,desc.errcode);
4255 SSVAL(*rparam,2,0);
4256 SSVAL(*rparam,4,succnt);
4257 SSVAL(*rparam,6,1);
4258
4259 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4260
4261 return True;
4262 }
4263
4264 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4265 char *param, int tpscnt,
4266 char *data, int tdscnt,
4267 int mdrcnt,int mprcnt,
4268 char **rdata,char **rparam,
4269 int *rdata_len,int *rparam_len)
4270 {
4271 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4272 char *str2 = skip_string(param,tpscnt,str1);
4273 char *p = skip_string(param,tpscnt,str2);
4274 int uLevel;
4275 int succnt;
4276 struct pack_desc desc;
4277
4278 if (!str1 || !str2 || !p) {
4279 return False;
4280 }
4281
4282 memset((char *)&desc,'\0',sizeof(desc));
4283
4284 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4285
4286 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4287
4288 /* check it's a supported varient */
4289 if (strcmp(str1,"WrLeh") != 0) {
4290 return False;
4291 }
4292 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4293 return False;
4294 }
4295
4296 if (mdrcnt > 0) {
4297 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4298 if (!*rdata) {
4299 return False;
4300 }
4301 }
4302 memset((char *)&desc,'\0',sizeof(desc));
4303 desc.base = *rdata;
4304 desc.buflen = mdrcnt;
4305 desc.format = str2;
4306 if (init_package(&desc,1,0)) {
4307 PACKS(&desc,"B13","lp0");
4308 }
4309
4310 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4311
4312 *rdata_len = desc.usedlen;
4313
4314 *rparam_len = 8;
4315 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4316 if (!*rparam) {
4317 return False;
4318 }
4319 SSVALS(*rparam,0,desc.errcode);
4320 SSVAL(*rparam,2,0);
4321 SSVAL(*rparam,4,succnt);
4322 SSVAL(*rparam,6,1);
4323
4324 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4325
4326 return True;
4327 }
4328
4329 /****************************************************************************
4330 List open sessions
4331 ****************************************************************************/
4332
4333 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4334 char *param, int tpscnt,
4335 char *data, int tdscnt,
4336 int mdrcnt,int mprcnt,
4337 char **rdata,char **rparam,
4338 int *rdata_len,int *rparam_len)
4339
4340 {
4341 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4342 char *str2 = skip_string(param,tpscnt,str1);
4343 char *p = skip_string(param,tpscnt,str2);
4344 int uLevel;
4345 struct pack_desc desc;
4346 struct sessionid *session_list;
4347 int i, num_sessions;
4348
4349 if (!str1 || !str2 || !p) {
4350 return False;
4351 }
4352
4353 memset((char *)&desc,'\0',sizeof(desc));
4354
4355 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4356
4357 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4358 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4359 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4360
4361 /* check it's a supported varient */
4362 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4363 return False;
4364 }
4365 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4366 return False;
4367 }
4368
4369 num_sessions = list_sessions(talloc_tos(), &session_list);
4370
4371 if (mdrcnt > 0) {
4372 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4373 if (!*rdata) {
4374 return False;
4375 }
4376 }
4377 memset((char *)&desc,'\0',sizeof(desc));
4378 desc.base = *rdata;
4379 desc.buflen = mdrcnt;
4380 desc.format = str2;
4381 if (!init_package(&desc,num_sessions,0)) {
4382 return False;
4383 }
4384
4385 for(i=0; i<num_sessions; i++) {
4386 PACKS(&desc, "z", session_list[i].remote_machine);
4387 PACKS(&desc, "z", session_list[i].username);
4388 PACKI(&desc, "W", 1); /* num conns */
4389 PACKI(&desc, "W", 0); /* num opens */
4390 PACKI(&desc, "W", 1); /* num users */
4391 PACKI(&desc, "D", 0); /* session time */
4392 PACKI(&desc, "D", 0); /* idle time */
4393 PACKI(&desc, "D", 0); /* flags */
4394 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4395 }
4396
4397 *rdata_len = desc.usedlen;
4398
4399 *rparam_len = 8;
4400 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4401 if (!*rparam) {
4402 return False;
4403 }
4404 SSVALS(*rparam,0,desc.errcode);
4405 SSVAL(*rparam,2,0); /* converter */
4406 SSVAL(*rparam,4,num_sessions); /* count */
4407
4408 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4409
4410 return True;
4411 }
4412
4413
4414 /****************************************************************************
4415 The buffer was too small.
4416 ****************************************************************************/
4417
4418 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4419 int mdrcnt, int mprcnt,
4420 char **rdata, char **rparam,
4421 int *rdata_len, int *rparam_len)
4422 {
4423 *rparam_len = MIN(*rparam_len,mprcnt);
4424 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4425 if (!*rparam) {
4426 return False;
4427 }
4428
4429 *rdata_len = 0;
4430
4431 SSVAL(*rparam,0,NERR_BufTooSmall);
4432
4433 DEBUG(3,("Supplied buffer too small in API command\n"));
4434
4435 return True;
4436 }
4437
4438 /****************************************************************************
4439 The request is not supported.
4440 ****************************************************************************/
4441
4442 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4443 char *param, int tpscnt,
4444 char *data, int tdscnt,
4445 int mdrcnt, int mprcnt,
4446 char **rdata, char **rparam,
4447 int *rdata_len, int *rparam_len)
4448 {
4449 *rparam_len = 4;
4450 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4451 if (!*rparam) {
4452 return False;
4453 }
4454
4455 *rdata_len = 0;
4456
4457 SSVAL(*rparam,0,NERR_notsupported);
4458 SSVAL(*rparam,2,0); /* converter word */
4459
4460 DEBUG(3,("Unsupported API command\n"));
4461
4462 return True;
4463 }
4464
4465 static const struct {
4466 const char *name;
4467 int id;
4468 bool (*fn)(connection_struct *, uint16,
4469 char *, int,
4470 char *, int,
4471 int,int,char **,char **,int *,int *);
4472 bool auth_user; /* Deny anonymous access? */
4473 } api_commands[] = {
4474 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
4475 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
4476 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
4477 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
4478 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
4479 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
4480 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
4481 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
4482 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
4483 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
4484 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
4485 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
4486 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
4487 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
4488 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
4489 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
4490 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
4491 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
4492 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
4493 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
4494 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
4495 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
4496 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
4497 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
4498 {"NetServerEnum", RAP_NetServerEnum2, api_RNetServerEnum}, /* anon OK */
4499 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4500 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
4501 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
4502 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
4503 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
4504 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4505 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
4506 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4507 {NULL, -1, api_Unsupported}
4508 /* The following RAP calls are not implemented by Samba:
4509
4510 RAP_WFileEnum2 - anon not OK
4511 */
4512 };
4513
4514
4515 /****************************************************************************
4516 Handle remote api calls.
4517 ****************************************************************************/
4518
4519 void api_reply(connection_struct *conn, uint16 vuid,
4520 struct smb_request *req,
4521 char *data, char *params,
4522 int tdscnt, int tpscnt,
4523 int mdrcnt, int mprcnt)
4524 {
4525 int api_command;
4526 char *rdata = NULL;
4527 char *rparam = NULL;
4528 const char *name1 = NULL;
4529 const char *name2 = NULL;
4530 int rdata_len = 0;
4531 int rparam_len = 0;
4532 bool reply=False;
4533 int i;
4534
4535 if (!params) {
4536 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4537 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4538 return;
4539 }
4540
4541 if (tpscnt < 2) {
4542 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4543 return;
4544 }
4545 api_command = SVAL(params,0);
4546 /* Is there a string at position params+2 ? */
4547 if (skip_string(params,tpscnt,params+2)) {
4548 name1 = params + 2;
4549 } else {
4550 name1 = "";
4551 }
4552 name2 = skip_string(params,tpscnt,params+2);
4553 if (!name2) {
4554 name2 = "";
4555 }
4556
4557 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4558 api_command,
4559 name1,
4560 name2,
4561 tdscnt,tpscnt,mdrcnt,mprcnt));
4562
4563 for (i=0;api_commands[i].name;i++) {
4564 if (api_commands[i].id == api_command && api_commands[i].fn) {
4565 DEBUG(3,("Doing %s\n",api_commands[i].name));
4566 break;
4567 }
4568 }
4569
4570 /* Check whether this api call can be done anonymously */
4571
4572 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4573 user_struct *user = get_valid_user_struct(vuid);
4574
4575 if (!user || user->guest) {
4576 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4577 return;
4578 }
4579 }
4580
4581 rdata = (char *)SMB_MALLOC(1024);
4582 if (rdata) {
4583 memset(rdata,'\0',1024);
4584 }
4585
4586 rparam = (char *)SMB_MALLOC(1024);
4587 if (rparam) {
4588 memset(rparam,'\0',1024);
4589 }
4590
4591 if(!rdata || !rparam) {
4592 DEBUG(0,("api_reply: malloc fail !\n"));
4593 SAFE_FREE(rdata);
4594 SAFE_FREE(rparam);
4595 reply_nterror(req, NT_STATUS_NO_MEMORY);
4596 return;
4597 }
4598
4599 reply = api_commands[i].fn(conn,
4600 vuid,
4601 params,tpscnt, /* params + length */
4602 data,tdscnt, /* data + length */
4603 mdrcnt,mprcnt,
4604 &rdata,&rparam,&rdata_len,&rparam_len);
4605
4606
4607 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4608 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4609 &rdata,&rparam,&rdata_len,&rparam_len);
4610 }
4611
4612 /* if we get False back then it's actually unsupported */
4613 if (!reply) {
4614 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4615 &rdata,&rparam,&rdata_len,&rparam_len);
4616 }
4617
4618 /* If api_Unsupported returns false we can't return anything. */
4619 if (reply) {
4620 send_trans_reply(conn, req, rparam, rparam_len,
4621 rdata, rdata_len, False);
4622 }
4623
4624 SAFE_FREE(rdata);
4625 SAFE_FREE(rparam);
4626 return;
4627 }
reg import