?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:libcli/smb_composite: make use of smb1cli_session_set_session_key()
[Samba/gebeck_regimport.git] / source3 / smbd / lanman.c
blob1b5de57ad4e580402dd5ea0ef238e11749f39a17
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "rpc_client/rpc_client.h"
32 #include "../librpc/gen_ndr/ndr_samr_c.h"
33 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
34 #include "rpc_client/cli_spoolss.h"
35 #include "rpc_client/init_spoolss.h"
36 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
37 #include "../librpc/gen_ndr/rap.h"
38 #include "../lib/util/binsearch.h"
39 #include "../libcli/auth/libcli_auth.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "printing.h"
43 #include "passdb/machine_sid.h"
44 #include "auth.h"
45 #include "rpc_server/rpc_ncacn_np.h"
46
47 #ifdef CHECK_TYPES
48 #undef CHECK_TYPES
49 #endif
50 #define CHECK_TYPES 0
51
52 #define NERR_Success 0
53 #define NERR_badpass 86
54 #define NERR_notsupported 50
55
56 #define NERR_BASE (2100)
57 #define NERR_BufTooSmall (NERR_BASE+23)
58 #define NERR_JobNotFound (NERR_BASE+51)
59 #define NERR_DestNotFound (NERR_BASE+52)
60
61 #define ACCESS_READ 0x01
62 #define ACCESS_WRITE 0x02
63 #define ACCESS_CREATE 0x04
64
65 #define SHPWLEN 8 /* share password length */
66
67 /* Limit size of ipc replies */
68
69 static char *smb_realloc_limit(void *ptr, size_t size)
70 {
71 char *val;
72
73 size = MAX((size),4*1024);
74 val = (char *)SMB_REALLOC(ptr,size);
75 if (val) {
76 memset(val,'\0',size);
77 }
78 return val;
79 }
80
81 static bool api_Unsupported(struct smbd_server_connection *sconn,
82 connection_struct *conn, uint64_t vuid,
83 char *param, int tpscnt,
84 char *data, int tdscnt,
85 int mdrcnt, int mprcnt,
86 char **rdata, char **rparam,
87 int *rdata_len, int *rparam_len);
88
89 static bool api_TooSmall(struct smbd_server_connection *sconn,
90 connection_struct *conn, uint64_t vuid, char *param, char *data,
91 int mdrcnt, int mprcnt,
92 char **rdata, char **rparam,
93 int *rdata_len, int *rparam_len);
94
95
96 static int CopyExpanded(connection_struct *conn,
97 int snum, char **dst, char *src, int *p_space_remaining)
98 {
99 TALLOC_CTX *ctx = talloc_tos();
100 char *buf = NULL;
101 int l;
102
103 if (!src || !dst || !p_space_remaining || !(*dst) ||
104 *p_space_remaining <= 0) {
105 return 0;
106 }
107
108 buf = talloc_strdup(ctx, src);
109 if (!buf) {
110 *p_space_remaining = 0;
111 return 0;
112 }
113 buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, snum));
114 if (!buf) {
115 *p_space_remaining = 0;
116 return 0;
117 }
118 buf = talloc_sub_advanced(ctx,
119 lp_servicename(ctx, SNUM(conn)),
120 conn->session_info->unix_info->unix_name,
121 conn->connectpath,
122 conn->session_info->unix_token->gid,
123 conn->session_info->unix_info->sanitized_username,
124 conn->session_info->info->domain_name,
125 buf);
126 if (!buf) {
127 *p_space_remaining = 0;
128 return 0;
129 }
130 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
131 if (l == -1) {
132 return 0;
133 }
134 (*dst) += l;
135 (*p_space_remaining) -= l;
136 return l;
137 }
138
139 static int CopyAndAdvance(char **dst, char *src, int *n)
140 {
141 int l;
142 if (!src || !dst || !n || !(*dst)) {
143 return 0;
144 }
145 l = push_ascii(*dst,src,*n, STR_TERMINATE);
146 if (l == -1) {
147 return 0;
148 }
149 (*dst) += l;
150 (*n) -= l;
151 return l;
152 }
153
154 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
155 {
156 TALLOC_CTX *ctx = talloc_tos();
157 char *buf = NULL;
158 if (!s) {
159 return 0;
160 }
161 buf = talloc_strdup(ctx,s);
162 if (!buf) {
163 return 0;
164 }
165 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, snum));
166 if (!buf) {
167 return 0;
168 }
169 buf = talloc_sub_advanced(ctx,
170 lp_servicename(ctx, SNUM(conn)),
171 conn->session_info->unix_info->unix_name,
172 conn->connectpath,
173 conn->session_info->unix_token->gid,
174 conn->session_info->unix_info->sanitized_username,
175 conn->session_info->info->domain_name,
176 buf);
177 if (!buf) {
178 return 0;
179 }
180 return strlen(buf) + 1;
181 }
182
183 /*******************************************************************
184 Check a API string for validity when we only need to check the prefix.
185 ******************************************************************/
186
187 static bool prefix_ok(const char *str, const char *prefix)
188 {
189 return(strncmp(str,prefix,strlen(prefix)) == 0);
190 }
191
192 struct pack_desc {
193 const char *format; /* formatstring for structure */
194 const char *subformat; /* subformat for structure */
195 char *base; /* baseaddress of buffer */
196 int buflen; /* remaining size for fixed part; on init: length of base */
197 int subcount; /* count of substructures */
198 char *structbuf; /* pointer into buffer for remaining fixed part */
199 int stringlen; /* remaining size for variable part */
200 char *stringbuf; /* pointer into buffer for remaining variable part */
201 int neededlen; /* total needed size */
202 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
203 const char *curpos; /* current position; pointer into format or subformat */
204 int errcode;
205 };
206
207 static int get_counter(const char **p)
208 {
209 int i, n;
210 if (!p || !(*p)) {
211 return 1;
212 }
213 if (!isdigit((int)**p)) {
214 return 1;
215 }
216 for (n = 0;;) {
217 i = **p;
218 if (isdigit(i)) {
219 n = 10 * n + (i - '0');
220 } else {
221 return n;
222 }
223 (*p)++;
224 }
225 }
226
227 static int getlen(const char *p)
228 {
229 int n = 0;
230 if (!p) {
231 return 0;
232 }
233
234 while (*p) {
235 switch( *p++ ) {
236 case 'W': /* word (2 byte) */
237 n += 2;
238 break;
239 case 'K': /* status word? (2 byte) */
240 n += 2;
241 break;
242 case 'N': /* count of substructures (word) at end */
243 n += 2;
244 break;
245 case 'D': /* double word (4 byte) */
246 case 'z': /* offset to zero terminated string (4 byte) */
247 case 'l': /* offset to user data (4 byte) */
248 n += 4;
249 break;
250 case 'b': /* offset to data (with counter) (4 byte) */
251 n += 4;
252 get_counter(&p);
253 break;
254 case 'B': /* byte (with optional counter) */
255 n += get_counter(&p);
256 break;
257 }
258 }
259 return n;
260 }
261
262 static bool init_package(struct pack_desc *p, int count, int subcount)
263 {
264 int n = p->buflen;
265 int i;
266
267 if (!p->format || !p->base) {
268 return False;
269 }
270
271 i = count * getlen(p->format);
272 if (p->subformat) {
273 i += subcount * getlen(p->subformat);
274 }
275 p->structbuf = p->base;
276 p->neededlen = 0;
277 p->usedlen = 0;
278 p->subcount = 0;
279 p->curpos = p->format;
280 if (i > n) {
281 p->neededlen = i;
282 i = n = 0;
283 #if 0
284 /*
285 * This is the old error code we used. Aparently
286 * WinNT/2k systems return ERRbuftoosmall (2123) and
287 * OS/2 needs this. I'm leaving this here so we can revert
288 * if needed. JRA.
289 */
290 p->errcode = ERRmoredata;
291 #else
292 p->errcode = ERRbuftoosmall;
293 #endif
294 } else {
295 p->errcode = NERR_Success;
296 }
297 p->buflen = i;
298 n -= i;
299 p->stringbuf = p->base + i;
300 p->stringlen = n;
301 return (p->errcode == NERR_Success);
302 }
303
304 static int package(struct pack_desc *p, ...)
305 {
306 va_list args;
307 int needed=0, stringneeded;
308 const char *str=NULL;
309 int is_string=0, stringused;
310 int32 temp;
311
312 va_start(args,p);
313
314 if (!*p->curpos) {
315 if (!p->subcount) {
316 p->curpos = p->format;
317 } else {
318 p->curpos = p->subformat;
319 p->subcount--;
320 }
321 }
322 #if CHECK_TYPES
323 str = va_arg(args,char*);
324 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
325 #endif
326 stringneeded = -1;
327
328 if (!p->curpos) {
329 va_end(args);
330 return 0;
331 }
332
333 switch( *p->curpos++ ) {
334 case 'W': /* word (2 byte) */
335 needed = 2;
336 temp = va_arg(args,int);
337 if (p->buflen >= needed) {
338 SSVAL(p->structbuf,0,temp);
339 }
340 break;
341 case 'K': /* status word? (2 byte) */
342 needed = 2;
343 temp = va_arg(args,int);
344 if (p->buflen >= needed) {
345 SSVAL(p->structbuf,0,temp);
346 }
347 break;
348 case 'N': /* count of substructures (word) at end */
349 needed = 2;
350 p->subcount = va_arg(args,int);
351 if (p->buflen >= needed) {
352 SSVAL(p->structbuf,0,p->subcount);
353 }
354 break;
355 case 'D': /* double word (4 byte) */
356 needed = 4;
357 temp = va_arg(args,int);
358 if (p->buflen >= needed) {
359 SIVAL(p->structbuf,0,temp);
360 }
361 break;
362 case 'B': /* byte (with optional counter) */
363 needed = get_counter(&p->curpos);
364 {
365 char *s = va_arg(args,char*);
366 if (p->buflen >= needed) {
367 StrnCpy(p->structbuf,s?s:"",needed-1);
368 }
369 }
370 break;
371 case 'z': /* offset to zero terminated string (4 byte) */
372 str = va_arg(args,char*);
373 stringneeded = (str ? strlen(str)+1 : 0);
374 is_string = 1;
375 break;
376 case 'l': /* offset to user data (4 byte) */
377 str = va_arg(args,char*);
378 stringneeded = va_arg(args,int);
379 is_string = 0;
380 break;
381 case 'b': /* offset to data (with counter) (4 byte) */
382 str = va_arg(args,char*);
383 stringneeded = get_counter(&p->curpos);
384 is_string = 0;
385 break;
386 }
387
388 va_end(args);
389 if (stringneeded >= 0) {
390 needed = 4;
391 if (p->buflen >= needed) {
392 stringused = stringneeded;
393 if (stringused > p->stringlen) {
394 stringused = (is_string ? p->stringlen : 0);
395 if (p->errcode == NERR_Success) {
396 p->errcode = ERRmoredata;
397 }
398 }
399 if (!stringused) {
400 SIVAL(p->structbuf,0,0);
401 } else {
402 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
403 memcpy(p->stringbuf,str?str:"",stringused);
404 if (is_string) {
405 p->stringbuf[stringused-1] = '\0';
406 }
407 p->stringbuf += stringused;
408 p->stringlen -= stringused;
409 p->usedlen += stringused;
410 }
411 }
412 p->neededlen += stringneeded;
413 }
414
415 p->neededlen += needed;
416 if (p->buflen >= needed) {
417 p->structbuf += needed;
418 p->buflen -= needed;
419 p->usedlen += needed;
420 } else {
421 if (p->errcode == NERR_Success) {
422 p->errcode = ERRmoredata;
423 }
424 }
425 return 1;
426 }
427
428 #if CHECK_TYPES
429 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
430 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
431 #else
432 #define PACK(desc,t,v) package(desc,v)
433 #define PACKl(desc,t,v,l) package(desc,v,l)
434 #endif
435
436 static void PACKI(struct pack_desc* desc, const char *t,int v)
437 {
438 PACK(desc,t,v);
439 }
440
441 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
442 {
443 PACK(desc,t,v);
444 }
445
446 /****************************************************************************
447 Get a print queue.
448 ****************************************************************************/
449
450 static void PackDriverData(struct pack_desc* desc)
451 {
452 char drivdata[4+4+32];
453 SIVAL(drivdata,0,sizeof drivdata); /* cb */
454 SIVAL(drivdata,4,1000); /* lVersion */
455 memset(drivdata+8,0,32); /* szDeviceName */
456 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
457 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
458 }
459
460 static int check_printq_info(struct pack_desc* desc,
461 unsigned int uLevel, char *id1, char *id2)
462 {
463 desc->subformat = NULL;
464 switch( uLevel ) {
465 case 0:
466 desc->format = "B13";
467 break;
468 case 1:
469 desc->format = "B13BWWWzzzzzWW";
470 break;
471 case 2:
472 desc->format = "B13BWWWzzzzzWN";
473 desc->subformat = "WB21BB16B10zWWzDDz";
474 break;
475 case 3:
476 desc->format = "zWWWWzzzzWWzzl";
477 break;
478 case 4:
479 desc->format = "zWWWWzzzzWNzzl";
480 desc->subformat = "WWzWWDDzz";
481 break;
482 case 5:
483 desc->format = "z";
484 break;
485 case 51:
486 desc->format = "K";
487 break;
488 case 52:
489 desc->format = "WzzzzzzzzN";
490 desc->subformat = "z";
491 break;
492 default:
493 DEBUG(0,("check_printq_info: invalid level %d\n",
494 uLevel ));
495 return False;
496 }
497 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
498 DEBUG(0,("check_printq_info: invalid format %s\n",
499 id1 ? id1 : "<NULL>" ));
500 return False;
501 }
502 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
503 DEBUG(0,("check_printq_info: invalid subformat %s\n",
504 id2 ? id2 : "<NULL>" ));
505 return False;
506 }
507 return True;
508 }
509
510
511 #define RAP_JOB_STATUS_QUEUED 0
512 #define RAP_JOB_STATUS_PAUSED 1
513 #define RAP_JOB_STATUS_SPOOLING 2
514 #define RAP_JOB_STATUS_PRINTING 3
515 #define RAP_JOB_STATUS_PRINTED 4
516
517 #define RAP_QUEUE_STATUS_PAUSED 1
518 #define RAP_QUEUE_STATUS_ERROR 2
519
520 /* turn a print job status into a on the wire status
521 */
522 static int printj_spoolss_status(int v)
523 {
524 if (v == JOB_STATUS_QUEUED)
525 return RAP_JOB_STATUS_QUEUED;
526 if (v & JOB_STATUS_PAUSED)
527 return RAP_JOB_STATUS_PAUSED;
528 if (v & JOB_STATUS_SPOOLING)
529 return RAP_JOB_STATUS_SPOOLING;
530 if (v & JOB_STATUS_PRINTING)
531 return RAP_JOB_STATUS_PRINTING;
532 return 0;
533 }
534
535 /* turn a print queue status into a on the wire status
536 */
537 static int printq_spoolss_status(int v)
538 {
539 if (v == PRINTER_STATUS_OK)
540 return 0;
541 if (v & PRINTER_STATUS_PAUSED)
542 return RAP_QUEUE_STATUS_PAUSED;
543 return RAP_QUEUE_STATUS_ERROR;
544 }
545
546 static void fill_spoolss_printjob_info(int uLevel,
547 struct pack_desc *desc,
548 struct spoolss_JobInfo2 *info2,
549 int n)
550 {
551 time_t t = spoolss_Time_to_time_t(&info2->submitted);
552
553 /* the client expects localtime */
554 t -= get_time_zone(t);
555
556 PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
557 if (uLevel == 1) {
558 PACKS(desc,"B21", info2->user_name); /* szUserName */
559 PACKS(desc,"B",""); /* pad */
560 PACKS(desc,"B16",""); /* szNotifyName */
561 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
562 PACKS(desc,"z",""); /* pszParms */
563 PACKI(desc,"W",n+1); /* uPosition */
564 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
565 PACKS(desc,"z",""); /* pszStatus */
566 PACKI(desc,"D", t); /* ulSubmitted */
567 PACKI(desc,"D", info2->size); /* ulSize */
568 PACKS(desc,"z", info2->document_name); /* pszComment */
569 }
570 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
571 PACKI(desc,"W", info2->priority); /* uPriority */
572 PACKS(desc,"z", info2->user_name); /* pszUserName */
573 PACKI(desc,"W",n+1); /* uPosition */
574 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
575 PACKI(desc,"D",t); /* ulSubmitted */
576 PACKI(desc,"D", info2->size); /* ulSize */
577 PACKS(desc,"z","Samba"); /* pszComment */
578 PACKS(desc,"z", info2->document_name); /* pszDocument */
579 if (uLevel == 3) {
580 PACKS(desc,"z",""); /* pszNotifyName */
581 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
582 PACKS(desc,"z",""); /* pszParms */
583 PACKS(desc,"z",""); /* pszStatus */
584 PACKS(desc,"z", info2->printer_name); /* pszQueue */
585 PACKS(desc,"z","lpd"); /* pszQProcName */
586 PACKS(desc,"z",""); /* pszQProcParms */
587 PACKS(desc,"z","NULL"); /* pszDriverName */
588 PackDriverData(desc); /* pDriverData */
589 PACKS(desc,"z",""); /* pszPrinterName */
590 } else if (uLevel == 4) { /* OS2 */
591 PACKS(desc,"z",""); /* pszSpoolFileName */
592 PACKS(desc,"z",""); /* pszPortName */
593 PACKS(desc,"z",""); /* pszStatus */
594 PACKI(desc,"D",0); /* ulPagesSpooled */
595 PACKI(desc,"D",0); /* ulPagesSent */
596 PACKI(desc,"D",0); /* ulPagesPrinted */
597 PACKI(desc,"D",0); /* ulTimePrinted */
598 PACKI(desc,"D",0); /* ulExtendJobStatus */
599 PACKI(desc,"D",0); /* ulStartPage */
600 PACKI(desc,"D",0); /* ulEndPage */
601 }
602 }
603 }
604
605 /********************************************************************
606 Respond to the DosPrintQInfo command with a level of 52
607 This is used to get printer driver information for Win9x clients
608 ********************************************************************/
609 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
610 struct pack_desc* desc, int count,
611 const char *printer_name)
612 {
613 int i;
614 fstring location;
615 trim_string(discard_const_p(char, driver->driver_path), "\\print$\\WIN40\\0\\", 0);
616 trim_string(discard_const_p(char, driver->data_file), "\\print$\\WIN40\\0\\", 0);
617 trim_string(discard_const_p(char, driver->help_file), "\\print$\\WIN40\\0\\", 0);
618
619 PACKI(desc, "W", 0x0400); /* don't know */
620 PACKS(desc, "z", driver->driver_name); /* long printer name */
621 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
622 PACKS(desc, "z", driver->data_file); /* Datafile name */
623 PACKS(desc, "z", driver->monitor_name); /* language monitor */
624
625 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
626 standard_sub_basic( "", "", location, sizeof(location)-1 );
627 PACKS(desc,"z", location); /* share to retrieve files */
628
629 PACKS(desc,"z", driver->default_datatype); /* default data type */
630 PACKS(desc,"z", driver->help_file); /* helpfile name */
631 PACKS(desc,"z", driver->driver_path); /* driver name */
632
633 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
634 DEBUG(3,("Driver: %s:\n",driver->driver_path));
635 DEBUG(3,("Data File: %s:\n",driver->data_file));
636 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
637 DEBUG(3,("Driver Location: %s:\n",location));
638 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
639 DEBUG(3,("Help File: %s:\n",driver->help_file));
640 PACKI(desc,"N",count); /* number of files to copy */
641
642 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
643 {
644 trim_string(discard_const_p(char, driver->dependent_files[i]), "\\print$\\WIN40\\0\\", 0);
645 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
646 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
647 }
648
649 /* sanity check */
650 if ( i != count )
651 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
652 count, i));
653
654 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
655
656 desc->errcode=NERR_Success;
657
658 }
659
660 static const char *strip_unc(const char *unc)
661 {
662 char *p;
663
664 if (unc == NULL) {
665 return NULL;
666 }
667
668 if ((p = strrchr(unc, '\\')) != NULL) {
669 return p+1;
670 }
671
672 return unc;
673 }
674
675 static void fill_printq_info(int uLevel,
676 struct pack_desc* desc,
677 int count,
678 union spoolss_JobInfo *job_info,
679 struct spoolss_DriverInfo3 *driver_info,
680 struct spoolss_PrinterInfo2 *printer_info)
681 {
682 switch (uLevel) {
683 case 0:
684 case 1:
685 case 2:
686 PACKS(desc,"B13", strip_unc(printer_info->printername));
687 break;
688 case 3:
689 case 4:
690 case 5:
691 PACKS(desc,"z", strip_unc(printer_info->printername));
692 break;
693 case 51:
694 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
695 break;
696 }
697
698 if (uLevel == 1 || uLevel == 2) {
699 PACKS(desc,"B",""); /* alignment */
700 PACKI(desc,"W",5); /* priority */
701 PACKI(desc,"W",0); /* start time */
702 PACKI(desc,"W",0); /* until time */
703 PACKS(desc,"z",""); /* pSepFile */
704 PACKS(desc,"z","lpd"); /* pPrProc */
705 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
706 PACKS(desc,"z",""); /* pParms */
707 if (printer_info->printername == NULL) {
708 PACKS(desc,"z","UNKNOWN PRINTER");
709 PACKI(desc,"W",LPSTAT_ERROR);
710 } else {
711 PACKS(desc,"z", printer_info->comment);
712 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
713 }
714 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
715 }
716
717 if (uLevel == 3 || uLevel == 4) {
718 PACKI(desc,"W",5); /* uPriority */
719 PACKI(desc,"W",0); /* uStarttime */
720 PACKI(desc,"W",0); /* uUntiltime */
721 PACKI(desc,"W",5); /* pad1 */
722 PACKS(desc,"z",""); /* pszSepFile */
723 PACKS(desc,"z","WinPrint"); /* pszPrProc */
724 PACKS(desc,"z",NULL); /* pszParms */
725 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
726 /* "don't ask" that it's done this way to fix corrupted
727 Win9X/ME printer comments. */
728 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
729 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
730 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
731 PACKS(desc,"z", printer_info->drivername); /* pszDriverName */
732 PackDriverData(desc); /* pDriverData */
733 }
734
735 if (uLevel == 2 || uLevel == 4) {
736 int i;
737 for (i = 0; i < count; i++) {
738 fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
739 }
740 }
741
742 if (uLevel==52)
743 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
744 }
745
746 /* This function returns the number of files for a given driver */
747 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
748 {
749 int result = 0;
750
751 /* count the number of files */
752 while (driver->dependent_files && *driver->dependent_files[result])
753 result++;
754
755 return result;
756 }
757
758 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
759 connection_struct *conn, uint64_t vuid,
760 char *param, int tpscnt,
761 char *data, int tdscnt,
762 int mdrcnt,int mprcnt,
763 char **rdata,char **rparam,
764 int *rdata_len,int *rparam_len)
765 {
766 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
767 char *str2 = skip_string(param,tpscnt,str1);
768 char *p = skip_string(param,tpscnt,str2);
769 char *QueueName = p;
770 unsigned int uLevel;
771 uint32_t count = 0;
772 char *str3;
773 struct pack_desc desc;
774 char* tmpdata=NULL;
775
776 WERROR werr = WERR_OK;
777 TALLOC_CTX *mem_ctx = talloc_tos();
778 NTSTATUS status;
779 struct rpc_pipe_client *cli = NULL;
780 struct dcerpc_binding_handle *b = NULL;
781 struct policy_handle handle;
782 struct spoolss_DevmodeContainer devmode_ctr;
783 union spoolss_DriverInfo driver_info;
784 union spoolss_JobInfo *job_info = NULL;
785 union spoolss_PrinterInfo printer_info;
786
787 if (!str1 || !str2 || !p) {
788 return False;
789 }
790 memset((char *)&desc,'\0',sizeof(desc));
791
792 p = skip_string(param,tpscnt,p);
793 if (!p) {
794 return False;
795 }
796 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
797 str3 = get_safe_str_ptr(param,tpscnt,p,4);
798 /* str3 may be null here and is checked in check_printq_info(). */
799
800 /* remove any trailing username */
801 if ((p = strchr_m(QueueName,'%')))
802 *p = 0;
803
804 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
805
806 /* check it's a supported varient */
807 if (!prefix_ok(str1,"zWrLh"))
808 return False;
809 if (!check_printq_info(&desc,uLevel,str2,str3)) {
810 /*
811 * Patch from Scott Moomaw <scott@bridgewater.edu>
812 * to return the 'invalid info level' error if an
813 * unknown level was requested.
814 */
815 *rdata_len = 0;
816 *rparam_len = 6;
817 *rparam = smb_realloc_limit(*rparam,*rparam_len);
818 if (!*rparam) {
819 return False;
820 }
821 SSVALS(*rparam,0,ERRunknownlevel);
822 SSVAL(*rparam,2,0);
823 SSVAL(*rparam,4,0);
824 return(True);
825 }
826
827 ZERO_STRUCT(handle);
828
829 if (QueueName == NULL || (strlen(QueueName) < 1)) {
830 desc.errcode = W_ERROR_V(WERR_INVALID_PARAM);
831 goto out;
832 }
833
834 status = rpc_pipe_open_interface(conn,
835 &ndr_table_spoolss.syntax_id,
836 conn->session_info,
837 conn->sconn->remote_address,
838 conn->sconn->msg_ctx,
839 &cli);
840 if (!NT_STATUS_IS_OK(status)) {
841 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
842 nt_errstr(status)));
843 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
844 goto out;
845 }
846 b = cli->binding_handle;
847
848 ZERO_STRUCT(devmode_ctr);
849
850 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
851 QueueName,
852 "RAW",
853 devmode_ctr,
854 PRINTER_ACCESS_USE,
855 &handle,
856 &werr);
857 if (!NT_STATUS_IS_OK(status)) {
858 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
859 goto out;
860 }
861 if (!W_ERROR_IS_OK(werr)) {
862 desc.errcode = W_ERROR_V(werr);
863 goto out;
864 }
865
866 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
867 &handle,
868 2,
869 0,
870 &printer_info);
871 if (!W_ERROR_IS_OK(werr)) {
872 desc.errcode = W_ERROR_V(werr);
873 goto out;
874 }
875
876 if (uLevel==52) {
877 uint32_t server_major_version;
878 uint32_t server_minor_version;
879
880 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
881 &handle,
882 "Windows 4.0",
883 3, /* level */
884 0,
885 0, /* version */
886 0,
887 &driver_info,
888 &server_major_version,
889 &server_minor_version);
890 if (!W_ERROR_IS_OK(werr)) {
891 desc.errcode = W_ERROR_V(werr);
892 goto out;
893 }
894
895 count = get_printerdrivernumber(&driver_info.info3);
896 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
897 } else {
898 uint32_t num_jobs;
899 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
900 &handle,
901 0, /* firstjob */
902 0xff, /* numjobs */
903 2, /* level */
904 0, /* offered */
905 &num_jobs,
906 &job_info);
907 if (!W_ERROR_IS_OK(werr)) {
908 desc.errcode = W_ERROR_V(werr);
909 goto out;
910 }
911
912 count = num_jobs;
913 }
914
915 if (mdrcnt > 0) {
916 *rdata = smb_realloc_limit(*rdata,mdrcnt);
917 if (!*rdata) {
918 return False;
919 }
920 desc.base = *rdata;
921 desc.buflen = mdrcnt;
922 } else {
923 /*
924 * Don't return data but need to get correct length
925 * init_package will return wrong size if buflen=0
926 */
927 desc.buflen = getlen(desc.format);
928 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
929 }
930
931 if (init_package(&desc,1,count)) {
932 desc.subcount = count;
933 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
934 }
935
936 *rdata_len = desc.usedlen;
937
938 /*
939 * We must set the return code to ERRbuftoosmall
940 * in order to support lanman style printing with Win NT/2k
941 * clients --jerry
942 */
943 if (!mdrcnt && lp_disable_spoolss())
944 desc.errcode = ERRbuftoosmall;
945
946 out:
947 if (b && is_valid_policy_hnd(&handle)) {
948 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
949 }
950
951 *rdata_len = desc.usedlen;
952 *rparam_len = 6;
953 *rparam = smb_realloc_limit(*rparam,*rparam_len);
954 if (!*rparam) {
955 SAFE_FREE(tmpdata);
956 return False;
957 }
958 SSVALS(*rparam,0,desc.errcode);
959 SSVAL(*rparam,2,0);
960 SSVAL(*rparam,4,desc.neededlen);
961
962 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
963
964 SAFE_FREE(tmpdata);
965
966 return(True);
967 }
968
969 /****************************************************************************
970 View list of all print jobs on all queues.
971 ****************************************************************************/
972
973 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
974 connection_struct *conn, uint64_t vuid,
975 char *param, int tpscnt,
976 char *data, int tdscnt,
977 int mdrcnt, int mprcnt,
978 char **rdata, char** rparam,
979 int *rdata_len, int *rparam_len)
980 {
981 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
982 char *output_format1 = skip_string(param,tpscnt,param_format);
983 char *p = skip_string(param,tpscnt,output_format1);
984 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
985 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
986 int i;
987 struct pack_desc desc;
988 int *subcntarr = NULL;
989 int queuecnt = 0, subcnt = 0, succnt = 0;
990
991 WERROR werr = WERR_OK;
992 TALLOC_CTX *mem_ctx = talloc_tos();
993 NTSTATUS status;
994 struct rpc_pipe_client *cli = NULL;
995 struct dcerpc_binding_handle *b = NULL;
996 struct spoolss_DevmodeContainer devmode_ctr;
997 uint32_t num_printers;
998 union spoolss_PrinterInfo *printer_info;
999 union spoolss_DriverInfo *driver_info;
1000 union spoolss_JobInfo **job_info;
1001
1002 if (!param_format || !output_format1 || !p) {
1003 return False;
1004 }
1005
1006 memset((char *)&desc,'\0',sizeof(desc));
1007
1008 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1009
1010 if (!prefix_ok(param_format,"WrLeh")) {
1011 return False;
1012 }
1013 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1014 /*
1015 * Patch from Scott Moomaw <scott@bridgewater.edu>
1016 * to return the 'invalid info level' error if an
1017 * unknown level was requested.
1018 */
1019 *rdata_len = 0;
1020 *rparam_len = 6;
1021 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1022 if (!*rparam) {
1023 return False;
1024 }
1025 SSVALS(*rparam,0,ERRunknownlevel);
1026 SSVAL(*rparam,2,0);
1027 SSVAL(*rparam,4,0);
1028 return(True);
1029 }
1030
1031 status = rpc_pipe_open_interface(conn,
1032 &ndr_table_spoolss.syntax_id,
1033 conn->session_info,
1034 conn->sconn->remote_address,
1035 conn->sconn->msg_ctx,
1036 &cli);
1037 if (!NT_STATUS_IS_OK(status)) {
1038 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1039 nt_errstr(status)));
1040 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1041 goto out;
1042 }
1043 b = cli->binding_handle;
1044
1045 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1046 PRINTER_ENUM_LOCAL,
1047 cli->srv_name_slash,
1048 2,
1049 0,
1050 &num_printers,
1051 &printer_info);
1052 if (!W_ERROR_IS_OK(werr)) {
1053 desc.errcode = W_ERROR_V(werr);
1054 goto out;
1055 }
1056
1057 queuecnt = num_printers;
1058
1059 job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1060 if (job_info == NULL) {
1061 goto err;
1062 }
1063
1064 driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1065 if (driver_info == NULL) {
1066 goto err;
1067 }
1068
1069 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1070 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1071 goto err;
1072 }
1073
1074 if (mdrcnt > 0) {
1075 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1076 if (!*rdata) {
1077 goto err;
1078 }
1079 }
1080 desc.base = *rdata;
1081 desc.buflen = mdrcnt;
1082
1083 subcnt = 0;
1084 for (i = 0; i < num_printers; i++) {
1085
1086 uint32_t num_jobs;
1087 struct policy_handle handle;
1088 const char *printername;
1089
1090 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1091 if (printername == NULL) {
1092 goto err;
1093 }
1094
1095 ZERO_STRUCT(handle);
1096 ZERO_STRUCT(devmode_ctr);
1097
1098 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1099 printername,
1100 "RAW",
1101 devmode_ctr,
1102 PRINTER_ACCESS_USE,
1103 &handle,
1104 &werr);
1105 if (!NT_STATUS_IS_OK(status)) {
1106 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1107 goto out;
1108 }
1109 if (!W_ERROR_IS_OK(werr)) {
1110 desc.errcode = W_ERROR_V(werr);
1111 goto out;
1112 }
1113
1114 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1115 &handle,
1116 0, /* firstjob */
1117 0xff, /* numjobs */
1118 2, /* level */
1119 0, /* offered */
1120 &num_jobs,
1121 &job_info[i]);
1122 if (!W_ERROR_IS_OK(werr)) {
1123 desc.errcode = W_ERROR_V(werr);
1124 goto out;
1125 }
1126
1127 if (uLevel==52) {
1128 uint32_t server_major_version;
1129 uint32_t server_minor_version;
1130
1131 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1132 &handle,
1133 "Windows 4.0",
1134 3, /* level */
1135 0,
1136 0, /* version */
1137 0,
1138 &driver_info[i],
1139 &server_major_version,
1140 &server_minor_version);
1141 if (!W_ERROR_IS_OK(werr)) {
1142 desc.errcode = W_ERROR_V(werr);
1143 goto out;
1144 }
1145 }
1146
1147 subcntarr[i] = num_jobs;
1148 subcnt += subcntarr[i];
1149
1150 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1151 }
1152
1153 if (init_package(&desc,queuecnt,subcnt)) {
1154 for (i = 0; i < num_printers; i++) {
1155 fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1156 if (desc.errcode == NERR_Success) {
1157 succnt = i;
1158 }
1159 }
1160 }
1161
1162 SAFE_FREE(subcntarr);
1163 out:
1164 *rdata_len = desc.usedlen;
1165 *rparam_len = 8;
1166 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1167 if (!*rparam) {
1168 goto err;
1169 }
1170 SSVALS(*rparam,0,desc.errcode);
1171 SSVAL(*rparam,2,0);
1172 SSVAL(*rparam,4,succnt);
1173 SSVAL(*rparam,6,queuecnt);
1174
1175 return True;
1176
1177 err:
1178
1179 SAFE_FREE(subcntarr);
1180
1181 return False;
1182 }
1183
1184 /****************************************************************************
1185 Get info level for a server list query.
1186 ****************************************************************************/
1187
1188 static bool check_session_info(int uLevel, char* id)
1189 {
1190 switch( uLevel ) {
1191 case 0:
1192 if (strcmp(id,"B16") != 0) {
1193 return False;
1194 }
1195 break;
1196 case 1:
1197 if (strcmp(id,"B16BBDz") != 0) {
1198 return False;
1199 }
1200 break;
1201 default:
1202 return False;
1203 }
1204 return True;
1205 }
1206
1207 struct srv_info_struct {
1208 fstring name;
1209 uint32 type;
1210 fstring comment;
1211 fstring domain;
1212 bool server_added;
1213 };
1214
1215 /*******************************************************************
1216 Get server info lists from the files saved by nmbd. Return the
1217 number of entries.
1218 ******************************************************************/
1219
1220 static int get_session_info(uint32 servertype,
1221 struct srv_info_struct **servers,
1222 const char *domain)
1223 {
1224 int count=0;
1225 int alloced=0;
1226 char **lines;
1227 bool local_list_only;
1228 int i;
1229
1230 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1231 if (!lines) {
1232 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1233 return 0;
1234 }
1235
1236 /* request for everything is code for request all servers */
1237 if (servertype == SV_TYPE_ALL) {
1238 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1239 }
1240
1241 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1242
1243 DEBUG(4,("Servertype search: %8x\n",servertype));
1244
1245 for (i=0;lines[i];i++) {
1246 fstring stype;
1247 struct srv_info_struct *s;
1248 const char *ptr = lines[i];
1249 bool ok = True;
1250 TALLOC_CTX *frame = NULL;
1251 char *p;
1252
1253 if (!*ptr) {
1254 continue;
1255 }
1256
1257 if (count == alloced) {
1258 alloced += 10;
1259 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1260 if (!*servers) {
1261 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1262 TALLOC_FREE(lines);
1263 return 0;
1264 }
1265 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1266 }
1267 s = &(*servers)[count];
1268
1269 frame = talloc_stackframe();
1270 s->name[0] = '\0';
1271 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1272 TALLOC_FREE(frame);
1273 continue;
1274 }
1275 fstrcpy(s->name, p);
1276
1277 stype[0] = '\0';
1278 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1279 TALLOC_FREE(frame);
1280 continue;
1281 }
1282 fstrcpy(stype, p);
1283
1284 s->comment[0] = '\0';
1285 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1286 TALLOC_FREE(frame);
1287 continue;
1288 }
1289 fstrcpy(s->comment, p);
1290 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1291
1292 s->domain[0] = '\0';
1293 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1294 /* this allows us to cope with an old nmbd */
1295 fstrcpy(s->domain,lp_workgroup());
1296 } else {
1297 fstrcpy(s->domain, p);
1298 }
1299 TALLOC_FREE(frame);
1300
1301 if (sscanf(stype,"%X",&s->type) != 1) {
1302 DEBUG(4,("r:host file "));
1303 ok = False;
1304 }
1305
1306 /* Filter the servers/domains we return based on what was asked for. */
1307
1308 /* Check to see if we are being asked for a local list only. */
1309 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1310 DEBUG(4,("r: local list only"));
1311 ok = False;
1312 }
1313
1314 /* doesn't match up: don't want it */
1315 if (!(servertype & s->type)) {
1316 DEBUG(4,("r:serv type "));
1317 ok = False;
1318 }
1319
1320 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1321 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1322 DEBUG(4,("s: dom mismatch "));
1323 ok = False;
1324 }
1325
1326 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1327 ok = False;
1328 }
1329
1330 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1331 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1332
1333 if (ok) {
1334 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1335 s->name, s->type, s->comment, s->domain));
1336 s->server_added = True;
1337 count++;
1338 } else {
1339 DEBUG(4,("%20s %8x %25s %15s\n",
1340 s->name, s->type, s->comment, s->domain));
1341 }
1342 }
1343
1344 TALLOC_FREE(lines);
1345 return count;
1346 }
1347
1348 /*******************************************************************
1349 Fill in a server info structure.
1350 ******************************************************************/
1351
1352 static int fill_srv_info(struct srv_info_struct *service,
1353 int uLevel, char **buf, int *buflen,
1354 char **stringbuf, int *stringspace, char *baseaddr)
1355 {
1356 int struct_len;
1357 char* p;
1358 char* p2;
1359 int l2;
1360 int len;
1361
1362 switch (uLevel) {
1363 case 0:
1364 struct_len = 16;
1365 break;
1366 case 1:
1367 struct_len = 26;
1368 break;
1369 default:
1370 return -1;
1371 }
1372
1373 if (!buf) {
1374 len = 0;
1375 switch (uLevel) {
1376 case 1:
1377 len = strlen(service->comment)+1;
1378 break;
1379 }
1380
1381 *buflen = struct_len;
1382 *stringspace = len;
1383 return struct_len + len;
1384 }
1385
1386 len = struct_len;
1387 p = *buf;
1388 if (*buflen < struct_len) {
1389 return -1;
1390 }
1391 if (stringbuf) {
1392 p2 = *stringbuf;
1393 l2 = *stringspace;
1394 } else {
1395 p2 = p + struct_len;
1396 l2 = *buflen - struct_len;
1397 }
1398 if (!baseaddr) {
1399 baseaddr = p;
1400 }
1401
1402 switch (uLevel) {
1403 case 0:
1404 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1405 break;
1406
1407 case 1:
1408 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1409 SIVAL(p,18,service->type);
1410 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1411 len += CopyAndAdvance(&p2,service->comment,&l2);
1412 break;
1413 }
1414
1415 if (stringbuf) {
1416 *buf = p + struct_len;
1417 *buflen -= struct_len;
1418 *stringbuf = p2;
1419 *stringspace = l2;
1420 } else {
1421 *buf = p2;
1422 *buflen -= len;
1423 }
1424 return len;
1425 }
1426
1427
1428 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1429 {
1430 return strcasecmp_m(s1->name,s2->name);
1431 }
1432
1433 /****************************************************************************
1434 View list of servers available (or possibly domains). The info is
1435 extracted from lists saved by nmbd on the local host.
1436 ****************************************************************************/
1437
1438 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1439 connection_struct *conn, uint64_t vuid,
1440 char *param, int tpscnt,
1441 char *data, int tdscnt,
1442 int mdrcnt, int mprcnt, char **rdata,
1443 char **rparam, int *rdata_len, int *rparam_len)
1444 {
1445 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1446 char *str2 = skip_string(param,tpscnt,str1);
1447 char *p = skip_string(param,tpscnt,str2);
1448 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1449 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1450 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1451 char *p2;
1452 int data_len, fixed_len, string_len;
1453 int f_len = 0, s_len = 0;
1454 struct srv_info_struct *servers=NULL;
1455 int counted=0,total=0;
1456 int i,missed;
1457 fstring domain;
1458 bool domain_request;
1459 bool local_request;
1460
1461 if (!str1 || !str2 || !p) {
1462 return False;
1463 }
1464
1465 /* If someone sets all the bits they don't really mean to set
1466 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1467 known servers. */
1468
1469 if (servertype == SV_TYPE_ALL) {
1470 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1471 }
1472
1473 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1474 any other bit (they may just set this bit on its own) they
1475 want all the locally seen servers. However this bit can be
1476 set on its own so set the requested servers to be
1477 ALL - DOMAIN_ENUM. */
1478
1479 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1480 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1481 }
1482
1483 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1484 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1485
1486 p += 8;
1487
1488 if (!prefix_ok(str1,"WrLehD")) {
1489 return False;
1490 }
1491 if (!check_session_info(uLevel,str2)) {
1492 return False;
1493 }
1494
1495 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1496 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1497 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1498
1499 if (strcmp(str1, "WrLehDz") == 0) {
1500 if (skip_string(param,tpscnt,p) == NULL) {
1501 return False;
1502 }
1503 pull_ascii_fstring(domain, p);
1504 } else {
1505 fstrcpy(domain, lp_workgroup());
1506 }
1507
1508 DEBUG(4, ("domain [%s]\n", domain));
1509
1510 if (lp_browse_list()) {
1511 total = get_session_info(servertype,&servers,domain);
1512 }
1513
1514 data_len = fixed_len = string_len = 0;
1515 missed = 0;
1516
1517 TYPESAFE_QSORT(servers, total, srv_comp);
1518
1519 {
1520 char *lastname=NULL;
1521
1522 for (i=0;i<total;i++) {
1523 struct srv_info_struct *s = &servers[i];
1524
1525 if (lastname && strequal(lastname,s->name)) {
1526 continue;
1527 }
1528 lastname = s->name;
1529 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1530 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1531 i, s->name, s->type, s->comment, s->domain));
1532
1533 if (data_len < buf_len) {
1534 counted++;
1535 fixed_len += f_len;
1536 string_len += s_len;
1537 } else {
1538 missed++;
1539 }
1540 }
1541 }
1542
1543 *rdata_len = fixed_len + string_len;
1544 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1545 if (!*rdata) {
1546 return False;
1547 }
1548
1549 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1550 p = *rdata;
1551 f_len = fixed_len;
1552 s_len = string_len;
1553
1554 {
1555 char *lastname=NULL;
1556 int count2 = counted;
1557
1558 for (i = 0; i < total && count2;i++) {
1559 struct srv_info_struct *s = &servers[i];
1560
1561 if (lastname && strequal(lastname,s->name)) {
1562 continue;
1563 }
1564 lastname = s->name;
1565 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1566 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1567 i, s->name, s->type, s->comment, s->domain));
1568 count2--;
1569 }
1570 }
1571
1572 *rparam_len = 8;
1573 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1574 if (!*rparam) {
1575 return False;
1576 }
1577 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1578 SSVAL(*rparam,2,0);
1579 SSVAL(*rparam,4,counted);
1580 SSVAL(*rparam,6,counted+missed);
1581
1582 SAFE_FREE(servers);
1583
1584 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1585 domain,uLevel,counted,counted+missed));
1586
1587 return True;
1588 }
1589
1590 static int srv_name_match(const char *n1, const char *n2)
1591 {
1592 /*
1593 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1594 *
1595 * In Windows, FirstNameToReturn need not be an exact match:
1596 * the server will return a list of servers that exist on
1597 * the network greater than or equal to the FirstNameToReturn.
1598 */
1599 int ret = strcasecmp_m(n1, n2);
1600
1601 if (ret <= 0) {
1602 return 0;
1603 }
1604
1605 return ret;
1606 }
1607
1608 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1609 connection_struct *conn, uint64_t vuid,
1610 char *param, int tpscnt,
1611 char *data, int tdscnt,
1612 int mdrcnt, int mprcnt, char **rdata,
1613 char **rparam, int *rdata_len, int *rparam_len)
1614 {
1615 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1616 char *str2 = skip_string(param,tpscnt,str1);
1617 char *p = skip_string(param,tpscnt,str2);
1618 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1619 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1620 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1621 char *p2;
1622 int data_len, fixed_len, string_len;
1623 int f_len = 0, s_len = 0;
1624 struct srv_info_struct *servers=NULL;
1625 int counted=0,first=0,total=0;
1626 int i,missed;
1627 fstring domain;
1628 fstring first_name;
1629 bool domain_request;
1630 bool local_request;
1631
1632 if (!str1 || !str2 || !p) {
1633 return False;
1634 }
1635
1636 /* If someone sets all the bits they don't really mean to set
1637 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1638 known servers. */
1639
1640 if (servertype == SV_TYPE_ALL) {
1641 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1642 }
1643
1644 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1645 any other bit (they may just set this bit on its own) they
1646 want all the locally seen servers. However this bit can be
1647 set on its own so set the requested servers to be
1648 ALL - DOMAIN_ENUM. */
1649
1650 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1651 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1652 }
1653
1654 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1655 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1656
1657 p += 8;
1658
1659 if (strcmp(str1, "WrLehDzz") != 0) {
1660 return false;
1661 }
1662 if (!check_session_info(uLevel,str2)) {
1663 return False;
1664 }
1665
1666 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1667 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1668 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1669
1670 if (skip_string(param,tpscnt,p) == NULL) {
1671 return False;
1672 }
1673 pull_ascii_fstring(domain, p);
1674 if (domain[0] == '\0') {
1675 fstrcpy(domain, lp_workgroup());
1676 }
1677 p = skip_string(param,tpscnt,p);
1678 if (skip_string(param,tpscnt,p) == NULL) {
1679 return False;
1680 }
1681 pull_ascii_fstring(first_name, p);
1682
1683 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1684 domain, first_name));
1685
1686 if (lp_browse_list()) {
1687 total = get_session_info(servertype,&servers,domain);
1688 }
1689
1690 data_len = fixed_len = string_len = 0;
1691 missed = 0;
1692
1693 TYPESAFE_QSORT(servers, total, srv_comp);
1694
1695 if (first_name[0] != '\0') {
1696 struct srv_info_struct *first_server = NULL;
1697
1698 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1699 srv_name_match, first_server);
1700 if (first_server) {
1701 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1702 /*
1703 * The binary search may not find the exact match
1704 * so we need to search backward to find the first match
1705 *
1706 * This implements the strange matching windows
1707 * implements. (see the comment in srv_name_match().
1708 */
1709 for (;first > 0;) {
1710 int ret;
1711 ret = strcasecmp_m(first_name,
1712 servers[first-1].name);
1713 if (ret > 0) {
1714 break;
1715 }
1716 first--;
1717 }
1718 } else {
1719 /* we should return no entries */
1720 first = total;
1721 }
1722 }
1723
1724 {
1725 char *lastname=NULL;
1726
1727 for (i=first;i<total;i++) {
1728 struct srv_info_struct *s = &servers[i];
1729
1730 if (lastname && strequal(lastname,s->name)) {
1731 continue;
1732 }
1733 lastname = s->name;
1734 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1735 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1736 i, s->name, s->type, s->comment, s->domain));
1737
1738 if (data_len < buf_len) {
1739 counted++;
1740 fixed_len += f_len;
1741 string_len += s_len;
1742 } else {
1743 missed++;
1744 }
1745 }
1746 }
1747
1748 *rdata_len = fixed_len + string_len;
1749 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1750 if (!*rdata) {
1751 return False;
1752 }
1753
1754 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1755 p = *rdata;
1756 f_len = fixed_len;
1757 s_len = string_len;
1758
1759 {
1760 char *lastname=NULL;
1761 int count2 = counted;
1762
1763 for (i = first; i < total && count2;i++) {
1764 struct srv_info_struct *s = &servers[i];
1765
1766 if (lastname && strequal(lastname,s->name)) {
1767 continue;
1768 }
1769 lastname = s->name;
1770 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1771 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1772 i, s->name, s->type, s->comment, s->domain));
1773 count2--;
1774 }
1775 }
1776
1777 *rparam_len = 8;
1778 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1779 if (!*rparam) {
1780 return False;
1781 }
1782 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1783 SSVAL(*rparam,2,0);
1784 SSVAL(*rparam,4,counted);
1785 SSVAL(*rparam,6,counted+missed);
1786
1787 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1788 domain,uLevel,first,first_name,
1789 first < total ? servers[first].name : "",
1790 counted,counted+missed));
1791
1792 SAFE_FREE(servers);
1793
1794 return True;
1795 }
1796
1797 /****************************************************************************
1798 command 0x34 - suspected of being a "Lookup Names" stub api
1799 ****************************************************************************/
1800
1801 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1802 connection_struct *conn, uint64_t vuid,
1803 char *param, int tpscnt,
1804 char *data, int tdscnt,
1805 int mdrcnt, int mprcnt, char **rdata,
1806 char **rparam, int *rdata_len, int *rparam_len)
1807 {
1808 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1809 char *str2 = skip_string(param,tpscnt,str1);
1810 char *p = skip_string(param,tpscnt,str2);
1811 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1812 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1813 int counted=0;
1814 int missed=0;
1815
1816 if (!str1 || !str2 || !p) {
1817 return False;
1818 }
1819
1820 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1821 str1, str2, p, uLevel, buf_len));
1822
1823 if (!prefix_ok(str1,"zWrLeh")) {
1824 return False;
1825 }
1826
1827 *rdata_len = 0;
1828
1829 *rparam_len = 8;
1830 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1831 if (!*rparam) {
1832 return False;
1833 }
1834
1835 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1836 SSVAL(*rparam,2,0);
1837 SSVAL(*rparam,4,counted);
1838 SSVAL(*rparam,6,counted+missed);
1839
1840 return True;
1841 }
1842
1843 /****************************************************************************
1844 get info about a share
1845 ****************************************************************************/
1846
1847 static bool check_share_info(int uLevel, char* id)
1848 {
1849 switch( uLevel ) {
1850 case 0:
1851 if (strcmp(id,"B13") != 0) {
1852 return False;
1853 }
1854 break;
1855 case 1:
1856 /* Level-2 descriptor is allowed (and ignored) */
1857 if (strcmp(id,"B13BWz") != 0 &&
1858 strcmp(id,"B13BWzWWWzB9B") != 0) {
1859 return False;
1860 }
1861 break;
1862 case 2:
1863 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1864 return False;
1865 }
1866 break;
1867 case 91:
1868 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1869 return False;
1870 }
1871 break;
1872 default:
1873 return False;
1874 }
1875 return True;
1876 }
1877
1878 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1879 char** buf, int* buflen,
1880 char** stringbuf, int* stringspace, char* baseaddr)
1881 {
1882 int struct_len;
1883 char* p;
1884 char* p2;
1885 int l2;
1886 int len;
1887
1888 switch( uLevel ) {
1889 case 0:
1890 struct_len = 13;
1891 break;
1892 case 1:
1893 struct_len = 20;
1894 break;
1895 case 2:
1896 struct_len = 40;
1897 break;
1898 case 91:
1899 struct_len = 68;
1900 break;
1901 default:
1902 return -1;
1903 }
1904
1905 if (!buf) {
1906 len = 0;
1907
1908 if (uLevel > 0) {
1909 len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), snum));
1910 }
1911 if (uLevel > 1) {
1912 len += strlen(lp_pathname(talloc_tos(), snum)) + 1;
1913 }
1914 if (buflen) {
1915 *buflen = struct_len;
1916 }
1917 if (stringspace) {
1918 *stringspace = len;
1919 }
1920 return struct_len + len;
1921 }
1922
1923 len = struct_len;
1924 p = *buf;
1925 if ((*buflen) < struct_len) {
1926 return -1;
1927 }
1928
1929 if (stringbuf) {
1930 p2 = *stringbuf;
1931 l2 = *stringspace;
1932 } else {
1933 p2 = p + struct_len;
1934 l2 = (*buflen) - struct_len;
1935 }
1936
1937 if (!baseaddr) {
1938 baseaddr = p;
1939 }
1940
1941 push_ascii(p,lp_servicename(talloc_tos(), snum),13, STR_TERMINATE);
1942
1943 if (uLevel > 0) {
1944 int type;
1945
1946 SCVAL(p,13,0);
1947 type = STYPE_DISKTREE;
1948 if (lp_print_ok(snum)) {
1949 type = STYPE_PRINTQ;
1950 }
1951 if (strequal("IPC",lp_fstype(talloc_tos(),snum))) {
1952 type = STYPE_IPC;
1953 }
1954 SSVAL(p,14,type); /* device type */
1955 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1956 len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(),snum),&l2);
1957 }
1958
1959 if (uLevel > 1) {
1960 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1961 SSVALS(p,22,-1); /* max uses */
1962 SSVAL(p,24,1); /* current uses */
1963 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1964 len += CopyAndAdvance(&p2,lp_pathname(talloc_tos(),snum),&l2);
1965 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1966 }
1967
1968 if (uLevel > 2) {
1969 memset(p+40,0,SHPWLEN+2);
1970 SSVAL(p,50,0);
1971 SIVAL(p,52,0);
1972 SSVAL(p,56,0);
1973 SSVAL(p,58,0);
1974 SIVAL(p,60,0);
1975 SSVAL(p,64,0);
1976 SSVAL(p,66,0);
1977 }
1978
1979 if (stringbuf) {
1980 (*buf) = p + struct_len;
1981 (*buflen) -= struct_len;
1982 (*stringbuf) = p2;
1983 (*stringspace) = l2;
1984 } else {
1985 (*buf) = p2;
1986 (*buflen) -= len;
1987 }
1988
1989 return len;
1990 }
1991
1992 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
1993 connection_struct *conn,uint64_t vuid,
1994 char *param, int tpscnt,
1995 char *data, int tdscnt,
1996 int mdrcnt,int mprcnt,
1997 char **rdata,char **rparam,
1998 int *rdata_len,int *rparam_len)
1999 {
2000 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2001 char *str2 = skip_string(param,tpscnt,str1);
2002 char *netname_in = skip_string(param,tpscnt,str2);
2003 char *netname = NULL;
2004 char *p = skip_string(param,tpscnt,netname);
2005 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2006 int snum;
2007
2008 if (!str1 || !str2 || !netname_in || !p) {
2009 return False;
2010 }
2011
2012 snum = find_service(talloc_tos(), netname_in, &netname);
2013 if (snum < 0 || !netname) {
2014 return False;
2015 }
2016
2017 /* check it's a supported varient */
2018 if (!prefix_ok(str1,"zWrLh")) {
2019 return False;
2020 }
2021 if (!check_share_info(uLevel,str2)) {
2022 return False;
2023 }
2024
2025 *rdata = smb_realloc_limit(*rdata,mdrcnt);
2026 if (!*rdata) {
2027 return False;
2028 }
2029 p = *rdata;
2030 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2031 if (*rdata_len < 0) {
2032 return False;
2033 }
2034
2035 *rparam_len = 6;
2036 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2037 if (!*rparam) {
2038 return False;
2039 }
2040 SSVAL(*rparam,0,NERR_Success);
2041 SSVAL(*rparam,2,0); /* converter word */
2042 SSVAL(*rparam,4,*rdata_len);
2043
2044 return True;
2045 }
2046
2047 /****************************************************************************
2048 View the list of available shares.
2049
2050 This function is the server side of the NetShareEnum() RAP call.
2051 It fills the return buffer with share names and share comments.
2052 Note that the return buffer normally (in all known cases) allows only
2053 twelve byte strings for share names (plus one for a nul terminator).
2054 Share names longer than 12 bytes must be skipped.
2055 ****************************************************************************/
2056
2057 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2058 connection_struct *conn, uint64_t vuid,
2059 char *param, int tpscnt,
2060 char *data, int tdscnt,
2061 int mdrcnt,
2062 int mprcnt,
2063 char **rdata,
2064 char **rparam,
2065 int *rdata_len,
2066 int *rparam_len )
2067 {
2068 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2069 char *str2 = skip_string(param,tpscnt,str1);
2070 char *p = skip_string(param,tpscnt,str2);
2071 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2072 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2073 char *p2;
2074 int count = 0;
2075 int total=0,counted=0;
2076 bool missed = False;
2077 int i;
2078 int data_len, fixed_len, string_len;
2079 int f_len = 0, s_len = 0;
2080
2081 if (!str1 || !str2 || !p) {
2082 return False;
2083 }
2084
2085 if (!prefix_ok(str1,"WrLeh")) {
2086 return False;
2087 }
2088 if (!check_share_info(uLevel,str2)) {
2089 return False;
2090 }
2091
2092 /* Ensure all the usershares are loaded. */
2093 become_root();
2094 load_registry_shares();
2095 count = load_usershare_shares(NULL, connections_snum_used);
2096 unbecome_root();
2097
2098 data_len = fixed_len = string_len = 0;
2099 for (i=0;i<count;i++) {
2100 fstring servicename_dos;
2101 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2102 continue;
2103 }
2104 push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), i));
2105 /* Maximum name length = 13. */
2106 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2107 total++;
2108 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2109 if (data_len < buf_len) {
2110 counted++;
2111 fixed_len += f_len;
2112 string_len += s_len;
2113 } else {
2114 missed = True;
2115 }
2116 }
2117 }
2118
2119 *rdata_len = fixed_len + string_len;
2120 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2121 if (!*rdata) {
2122 return False;
2123 }
2124
2125 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2126 p = *rdata;
2127 f_len = fixed_len;
2128 s_len = string_len;
2129
2130 for( i = 0; i < count; i++ ) {
2131 fstring servicename_dos;
2132 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2133 continue;
2134 }
2135
2136 push_ascii_fstring(servicename_dos,
2137 lp_servicename(talloc_tos(), i));
2138 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2139 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2140 break;
2141 }
2142 }
2143 }
2144
2145 *rparam_len = 8;
2146 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2147 if (!*rparam) {
2148 return False;
2149 }
2150 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2151 SSVAL(*rparam,2,0);
2152 SSVAL(*rparam,4,counted);
2153 SSVAL(*rparam,6,total);
2154
2155 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2156 counted,total,uLevel,
2157 buf_len,*rdata_len,mdrcnt));
2158
2159 return True;
2160 }
2161
2162 /****************************************************************************
2163 Add a share
2164 ****************************************************************************/
2165
2166 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2167 connection_struct *conn,uint64_t vuid,
2168 char *param, int tpscnt,
2169 char *data, int tdscnt,
2170 int mdrcnt,int mprcnt,
2171 char **rdata,char **rparam,
2172 int *rdata_len,int *rparam_len)
2173 {
2174 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2175 char *str2 = skip_string(param,tpscnt,str1);
2176 char *p = skip_string(param,tpscnt,str2);
2177 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2178 fstring sharename;
2179 fstring comment;
2180 char *pathname = NULL;
2181 unsigned int offset;
2182 int res = ERRunsup;
2183 size_t converted_size;
2184
2185 WERROR werr = WERR_OK;
2186 TALLOC_CTX *mem_ctx = talloc_tos();
2187 NTSTATUS status;
2188 struct rpc_pipe_client *cli = NULL;
2189 union srvsvc_NetShareInfo info;
2190 struct srvsvc_NetShareInfo2 info2;
2191 struct dcerpc_binding_handle *b;
2192
2193 if (!str1 || !str2 || !p) {
2194 return False;
2195 }
2196
2197 /* check it's a supported varient */
2198 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2199 return False;
2200 }
2201 if (!check_share_info(uLevel,str2)) {
2202 return False;
2203 }
2204 if (uLevel != 2) {
2205 return False;
2206 }
2207
2208 /* Do we have a string ? */
2209 if (skip_string(data,mdrcnt,data) == NULL) {
2210 return False;
2211 }
2212 pull_ascii_fstring(sharename,data);
2213
2214 if (mdrcnt < 28) {
2215 return False;
2216 }
2217
2218 /* only support disk share adds */
2219 if (SVAL(data,14)!=STYPE_DISKTREE) {
2220 return False;
2221 }
2222
2223 offset = IVAL(data, 16);
2224 if (offset >= mdrcnt) {
2225 res = ERRinvalidparam;
2226 goto out;
2227 }
2228
2229 /* Do we have a string ? */
2230 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2231 return False;
2232 }
2233 pull_ascii_fstring(comment, offset? (data+offset) : "");
2234
2235 offset = IVAL(data, 26);
2236
2237 if (offset >= mdrcnt) {
2238 res = ERRinvalidparam;
2239 goto out;
2240 }
2241
2242 /* Do we have a string ? */
2243 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2244 return False;
2245 }
2246
2247 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2248 offset ? (data+offset) : "", &converted_size))
2249 {
2250 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2251 strerror(errno)));
2252 }
2253
2254 if (!pathname) {
2255 return false;
2256 }
2257
2258 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc.syntax_id,
2259 conn->session_info,
2260 conn->sconn->remote_address,
2261 conn->sconn->msg_ctx,
2262 &cli);
2263 if (!NT_STATUS_IS_OK(status)) {
2264 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2265 nt_errstr(status)));
2266 res = W_ERROR_V(ntstatus_to_werror(status));
2267 goto out;
2268 }
2269
2270 b = cli->binding_handle;
2271
2272 info2.name = sharename;
2273 info2.type = STYPE_DISKTREE;
2274 info2.comment = comment;
2275 info2.permissions = 0;
2276 info2.max_users = 0;
2277 info2.current_users = 0;
2278 info2.path = pathname;
2279 info2.password = NULL;
2280
2281 info.info2 = &info2;
2282
2283 status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2284 cli->srv_name_slash,
2285 2,
2286 &info,
2287 NULL,
2288 &werr);
2289 if (!NT_STATUS_IS_OK(status)) {
2290 res = W_ERROR_V(ntstatus_to_werror(status));
2291 goto out;
2292 }
2293 if (!W_ERROR_IS_OK(werr)) {
2294 res = W_ERROR_V(werr);
2295 goto out;
2296 }
2297
2298 *rparam_len = 6;
2299 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2300 if (!*rparam) {
2301 return False;
2302 }
2303 SSVAL(*rparam,0,NERR_Success);
2304 SSVAL(*rparam,2,0); /* converter word */
2305 SSVAL(*rparam,4,*rdata_len);
2306 *rdata_len = 0;
2307
2308 return True;
2309
2310 out:
2311
2312 *rparam_len = 4;
2313 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2314 if (!*rparam) {
2315 return False;
2316 }
2317 *rdata_len = 0;
2318 SSVAL(*rparam,0,res);
2319 SSVAL(*rparam,2,0);
2320 return True;
2321 }
2322
2323 /****************************************************************************
2324 view list of groups available
2325 ****************************************************************************/
2326
2327 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2328 connection_struct *conn,uint64_t vuid,
2329 char *param, int tpscnt,
2330 char *data, int tdscnt,
2331 int mdrcnt,int mprcnt,
2332 char **rdata,char **rparam,
2333 int *rdata_len,int *rparam_len)
2334 {
2335 int i;
2336 int errflags=0;
2337 int resume_context, cli_buf_size;
2338 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2339 char *str2 = skip_string(param,tpscnt,str1);
2340 char *p = skip_string(param,tpscnt,str2);
2341
2342 uint32_t num_groups;
2343 uint32_t resume_handle;
2344 struct rpc_pipe_client *samr_pipe;
2345 struct policy_handle samr_handle, domain_handle;
2346 NTSTATUS status, result;
2347 struct dcerpc_binding_handle *b;
2348
2349 if (!str1 || !str2 || !p) {
2350 return False;
2351 }
2352
2353 if (strcmp(str1,"WrLeh") != 0) {
2354 return False;
2355 }
2356
2357 /* parameters
2358 * W-> resume context (number of users to skip)
2359 * r -> return parameter pointer to receive buffer
2360 * L -> length of receive buffer
2361 * e -> return parameter number of entries
2362 * h -> return parameter total number of users
2363 */
2364
2365 if (strcmp("B21",str2) != 0) {
2366 return False;
2367 }
2368
2369 status = rpc_pipe_open_interface(
2370 talloc_tos(), &ndr_table_samr.syntax_id,
2371 conn->session_info, conn->sconn->remote_address,
2372 conn->sconn->msg_ctx, &samr_pipe);
2373 if (!NT_STATUS_IS_OK(status)) {
2374 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2375 nt_errstr(status)));
2376 return false;
2377 }
2378
2379 b = samr_pipe->binding_handle;
2380
2381 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2382 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2383 &result);
2384 if (!NT_STATUS_IS_OK(status)) {
2385 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2386 nt_errstr(status)));
2387 return false;
2388 }
2389 if (!NT_STATUS_IS_OK(result)) {
2390 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2391 nt_errstr(result)));
2392 return false;
2393 }
2394
2395 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2396 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2397 get_global_sam_sid(), &domain_handle,
2398 &result);
2399 if (!NT_STATUS_IS_OK(status)) {
2400 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2401 nt_errstr(status)));
2402 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2403 return false;
2404 }
2405 if (!NT_STATUS_IS_OK(result)) {
2406 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2407 nt_errstr(result)));
2408 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2409 return false;
2410 }
2411
2412 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2413 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2414 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2415 "%d\n", resume_context, cli_buf_size));
2416
2417 *rdata_len = cli_buf_size;
2418 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2419 if (!*rdata) {
2420 return False;
2421 }
2422
2423 p = *rdata;
2424
2425 errflags = NERR_Success;
2426 num_groups = 0;
2427 resume_handle = 0;
2428
2429 while (true) {
2430 struct samr_SamArray *sam_entries;
2431 uint32_t num_entries;
2432
2433 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2434 &domain_handle,
2435 &resume_handle,
2436 &sam_entries, 1,
2437 &num_entries,
2438 &result);
2439 if (!NT_STATUS_IS_OK(status)) {
2440 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2441 "%s\n", nt_errstr(status)));
2442 break;
2443 }
2444 if (!NT_STATUS_IS_OK(result)) {
2445 status = result;
2446 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2447 "%s\n", nt_errstr(result)));
2448 break;
2449 }
2450
2451 if (num_entries == 0) {
2452 DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2453 "no entries -- done\n"));
2454 break;
2455 }
2456
2457 for(i=0; i<num_entries; i++) {
2458 const char *name;
2459
2460 name = sam_entries->entries[i].name.string;
2461
2462 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2463 /* set overflow error */
2464 DEBUG(3,("overflow on entry %d group %s\n", i,
2465 name));
2466 errflags=234;
2467 break;
2468 }
2469
2470 /* truncate the name at 21 chars. */
2471 memset(p, 0, 21);
2472 strlcpy(p, name, 21);
2473 DEBUG(10,("adding entry %d group %s\n", i, p));
2474 p += 21;
2475 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2476 * idea why... */
2477 num_groups += 1;
2478 }
2479
2480 if (errflags != NERR_Success) {
2481 break;
2482 }
2483
2484 TALLOC_FREE(sam_entries);
2485 }
2486
2487 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2488 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2489
2490 *rdata_len = PTR_DIFF(p,*rdata);
2491
2492 *rparam_len = 8;
2493 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2494 if (!*rparam) {
2495 return False;
2496 }
2497 SSVAL(*rparam, 0, errflags);
2498 SSVAL(*rparam, 2, 0); /* converter word */
2499 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2500 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2501
2502 return(True);
2503 }
2504
2505 /*******************************************************************
2506 Get groups that a user is a member of.
2507 ******************************************************************/
2508
2509 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2510 connection_struct *conn,uint64_t vuid,
2511 char *param, int tpscnt,
2512 char *data, int tdscnt,
2513 int mdrcnt,int mprcnt,
2514 char **rdata,char **rparam,
2515 int *rdata_len,int *rparam_len)
2516 {
2517 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2518 char *str2 = skip_string(param,tpscnt,str1);
2519 char *UserName = skip_string(param,tpscnt,str2);
2520 char *p = skip_string(param,tpscnt,UserName);
2521 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2522 const char *level_string;
2523 int count=0;
2524 bool ret = False;
2525 uint32_t i;
2526 char *endp = NULL;
2527
2528 struct rpc_pipe_client *samr_pipe;
2529 struct policy_handle samr_handle, domain_handle, user_handle;
2530 struct lsa_String name;
2531 struct lsa_Strings names;
2532 struct samr_Ids type, rid;
2533 struct samr_RidWithAttributeArray *rids;
2534 NTSTATUS status, result;
2535 struct dcerpc_binding_handle *b;
2536
2537 if (!str1 || !str2 || !UserName || !p) {
2538 return False;
2539 }
2540
2541 *rparam_len = 8;
2542 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2543 if (!*rparam) {
2544 return False;
2545 }
2546
2547 /* check it's a supported varient */
2548
2549 if ( strcmp(str1,"zWrLeh") != 0 )
2550 return False;
2551
2552 switch( uLevel ) {
2553 case 0:
2554 level_string = "B21";
2555 break;
2556 default:
2557 return False;
2558 }
2559
2560 if (strcmp(level_string,str2) != 0)
2561 return False;
2562
2563 *rdata_len = mdrcnt + 1024;
2564 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2565 if (!*rdata) {
2566 return False;
2567 }
2568
2569 SSVAL(*rparam,0,NERR_Success);
2570 SSVAL(*rparam,2,0); /* converter word */
2571
2572 p = *rdata;
2573 endp = *rdata + *rdata_len;
2574
2575 status = rpc_pipe_open_interface(
2576 talloc_tos(), &ndr_table_samr.syntax_id,
2577 conn->session_info, conn->sconn->remote_address,
2578 conn->sconn->msg_ctx, &samr_pipe);
2579 if (!NT_STATUS_IS_OK(status)) {
2580 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2581 nt_errstr(status)));
2582 return false;
2583 }
2584
2585 b = samr_pipe->binding_handle;
2586
2587 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2588 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2589 &result);
2590 if (!NT_STATUS_IS_OK(status)) {
2591 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2592 nt_errstr(status)));
2593 return false;
2594 }
2595 if (!NT_STATUS_IS_OK(result)) {
2596 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2597 nt_errstr(result)));
2598 return false;
2599 }
2600
2601 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2602 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2603 get_global_sam_sid(), &domain_handle,
2604 &result);
2605 if (!NT_STATUS_IS_OK(status)) {
2606 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2607 nt_errstr(status)));
2608 goto close_sam;
2609 }
2610 if (!NT_STATUS_IS_OK(result)) {
2611 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2612 nt_errstr(result)));
2613 goto close_sam;
2614 }
2615
2616 name.string = UserName;
2617
2618 status = dcerpc_samr_LookupNames(b, talloc_tos(),
2619 &domain_handle, 1, &name,
2620 &rid, &type,
2621 &result);
2622 if (!NT_STATUS_IS_OK(status)) {
2623 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2624 nt_errstr(status)));
2625 goto close_domain;
2626 }
2627 if (!NT_STATUS_IS_OK(result)) {
2628 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2629 nt_errstr(result)));
2630 goto close_domain;
2631 }
2632
2633 if (type.ids[0] != SID_NAME_USER) {
2634 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2635 sid_type_lookup(type.ids[0])));
2636 goto close_domain;
2637 }
2638
2639 status = dcerpc_samr_OpenUser(b, talloc_tos(),
2640 &domain_handle,
2641 SAMR_USER_ACCESS_GET_GROUPS,
2642 rid.ids[0], &user_handle,
2643 &result);
2644 if (!NT_STATUS_IS_OK(status)) {
2645 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2646 nt_errstr(status)));
2647 goto close_domain;
2648 }
2649 if (!NT_STATUS_IS_OK(result)) {
2650 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2651 nt_errstr(result)));
2652 goto close_domain;
2653 }
2654
2655 status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2656 &user_handle, &rids,
2657 &result);
2658 if (!NT_STATUS_IS_OK(status)) {
2659 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2660 nt_errstr(status)));
2661 goto close_user;
2662 }
2663 if (!NT_STATUS_IS_OK(result)) {
2664 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2665 nt_errstr(result)));
2666 goto close_user;
2667 }
2668
2669 for (i=0; i<rids->count; i++) {
2670
2671 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2672 &domain_handle,
2673 1, &rids->rids[i].rid,
2674 &names, &type,
2675 &result);
2676 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2677 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2678 p += 21;
2679 count++;
2680 }
2681 }
2682
2683 *rdata_len = PTR_DIFF(p,*rdata);
2684
2685 SSVAL(*rparam,4,count); /* is this right?? */
2686 SSVAL(*rparam,6,count); /* is this right?? */
2687
2688 ret = True;
2689
2690 close_user:
2691 dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2692 close_domain:
2693 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2694 close_sam:
2695 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2696
2697 return ret;
2698 }
2699
2700 /*******************************************************************
2701 Get all users.
2702 ******************************************************************/
2703
2704 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2705 connection_struct *conn, uint64_t vuid,
2706 char *param, int tpscnt,
2707 char *data, int tdscnt,
2708 int mdrcnt,int mprcnt,
2709 char **rdata,char **rparam,
2710 int *rdata_len,int *rparam_len)
2711 {
2712 int count_sent=0;
2713 int num_users=0;
2714 int errflags=0;
2715 int i, resume_context, cli_buf_size;
2716 uint32_t resume_handle;
2717
2718 struct rpc_pipe_client *samr_pipe;
2719 struct policy_handle samr_handle, domain_handle;
2720 NTSTATUS status, result;
2721
2722 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2723 char *str2 = skip_string(param,tpscnt,str1);
2724 char *p = skip_string(param,tpscnt,str2);
2725 char *endp = NULL;
2726
2727 struct dcerpc_binding_handle *b;
2728
2729 if (!str1 || !str2 || !p) {
2730 return False;
2731 }
2732
2733 if (strcmp(str1,"WrLeh") != 0)
2734 return False;
2735 /* parameters
2736 * W-> resume context (number of users to skip)
2737 * r -> return parameter pointer to receive buffer
2738 * L -> length of receive buffer
2739 * e -> return parameter number of entries
2740 * h -> return parameter total number of users
2741 */
2742
2743 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2744 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2745 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2746 resume_context, cli_buf_size));
2747
2748 *rparam_len = 8;
2749 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2750 if (!*rparam) {
2751 return False;
2752 }
2753
2754 /* check it's a supported varient */
2755 if (strcmp("B21",str2) != 0)
2756 return False;
2757
2758 *rdata_len = cli_buf_size;
2759 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2760 if (!*rdata) {
2761 return False;
2762 }
2763
2764 p = *rdata;
2765 endp = *rdata + *rdata_len;
2766
2767 status = rpc_pipe_open_interface(
2768 talloc_tos(), &ndr_table_samr.syntax_id,
2769 conn->session_info, conn->sconn->remote_address,
2770 conn->sconn->msg_ctx, &samr_pipe);
2771 if (!NT_STATUS_IS_OK(status)) {
2772 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2773 nt_errstr(status)));
2774 return false;
2775 }
2776
2777 b = samr_pipe->binding_handle;
2778
2779 status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2780 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2781 &result);
2782 if (!NT_STATUS_IS_OK(status)) {
2783 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2784 nt_errstr(status)));
2785 return false;
2786 }
2787 if (!NT_STATUS_IS_OK(result)) {
2788 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2789 nt_errstr(result)));
2790 return false;
2791 }
2792
2793 status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2794 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2795 get_global_sam_sid(), &domain_handle,
2796 &result);
2797 if (!NT_STATUS_IS_OK(status)) {
2798 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2799 nt_errstr(status)));
2800 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2801 return false;
2802 }
2803 if (!NT_STATUS_IS_OK(result)) {
2804 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2805 nt_errstr(result)));
2806 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2807 return false;
2808 }
2809
2810 errflags=NERR_Success;
2811
2812 resume_handle = 0;
2813
2814 while (true) {
2815 struct samr_SamArray *sam_entries;
2816 uint32_t num_entries;
2817
2818 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2819 &domain_handle,
2820 &resume_handle,
2821 0, &sam_entries, 1,
2822 &num_entries,
2823 &result);
2824
2825 if (!NT_STATUS_IS_OK(status)) {
2826 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2827 "%s\n", nt_errstr(status)));
2828 break;
2829 }
2830 if (!NT_STATUS_IS_OK(result)) {
2831 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2832 "%s\n", nt_errstr(result)));
2833 break;
2834 }
2835
2836 if (num_entries == 0) {
2837 DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2838 "no entries -- done\n"));
2839 break;
2840 }
2841
2842 for (i=0; i<num_entries; i++) {
2843 const char *name;
2844
2845 name = sam_entries->entries[i].name.string;
2846
2847 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2848 &&(strlen(name)<=21)) {
2849 strlcpy(p,name,PTR_DIFF(endp,p));
2850 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2851 "username %s\n",count_sent,p));
2852 p += 21;
2853 count_sent++;
2854 } else {
2855 /* set overflow error */
2856 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2857 "username %s\n",count_sent,name));
2858 errflags=234;
2859 break;
2860 }
2861 }
2862
2863 if (errflags != NERR_Success) {
2864 break;
2865 }
2866
2867 TALLOC_FREE(sam_entries);
2868 }
2869
2870 dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2871 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2872
2873 *rdata_len = PTR_DIFF(p,*rdata);
2874
2875 SSVAL(*rparam,0,errflags);
2876 SSVAL(*rparam,2,0); /* converter word */
2877 SSVAL(*rparam,4,count_sent); /* is this right?? */
2878 SSVAL(*rparam,6,num_users); /* is this right?? */
2879
2880 return True;
2881 }
2882
2883 /****************************************************************************
2884 Get the time of day info.
2885 ****************************************************************************/
2886
2887 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2888 connection_struct *conn,uint64_t vuid,
2889 char *param, int tpscnt,
2890 char *data, int tdscnt,
2891 int mdrcnt,int mprcnt,
2892 char **rdata,char **rparam,
2893 int *rdata_len,int *rparam_len)
2894 {
2895 struct tm *t;
2896 time_t unixdate = time(NULL);
2897 char *p;
2898
2899 *rparam_len = 4;
2900 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2901 if (!*rparam) {
2902 return False;
2903 }
2904
2905 *rdata_len = 21;
2906 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2907 if (!*rdata) {
2908 return False;
2909 }
2910
2911 SSVAL(*rparam,0,NERR_Success);
2912 SSVAL(*rparam,2,0); /* converter word */
2913
2914 p = *rdata;
2915
2916 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2917 by NT in a "net time" operation,
2918 it seems to ignore the one below */
2919
2920 /* the client expects to get localtime, not GMT, in this bit
2921 (I think, this needs testing) */
2922 t = localtime(&unixdate);
2923 if (!t) {
2924 return False;
2925 }
2926
2927 SIVAL(p,4,0); /* msecs ? */
2928 SCVAL(p,8,t->tm_hour);
2929 SCVAL(p,9,t->tm_min);
2930 SCVAL(p,10,t->tm_sec);
2931 SCVAL(p,11,0); /* hundredths of seconds */
2932 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2933 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2934 SCVAL(p,16,t->tm_mday);
2935 SCVAL(p,17,t->tm_mon + 1);
2936 SSVAL(p,18,1900+t->tm_year);
2937 SCVAL(p,20,t->tm_wday);
2938
2939 return True;
2940 }
2941
2942 /****************************************************************************
2943 Set the user password.
2944 *****************************************************************************/
2945
2946 static bool api_SetUserPassword(struct smbd_server_connection *sconn,
2947 connection_struct *conn,uint64_t vuid,
2948 char *param, int tpscnt,
2949 char *data, int tdscnt,
2950 int mdrcnt,int mprcnt,
2951 char **rdata,char **rparam,
2952 int *rdata_len,int *rparam_len)
2953 {
2954 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2955 char *p = NULL;
2956 fstring user;
2957 fstring pass1,pass2;
2958 TALLOC_CTX *mem_ctx = talloc_tos();
2959 NTSTATUS status, result;
2960 struct rpc_pipe_client *cli = NULL;
2961 struct policy_handle connect_handle, domain_handle, user_handle;
2962 struct lsa_String domain_name;
2963 struct dom_sid2 *domain_sid;
2964 struct lsa_String names;
2965 struct samr_Ids rids;
2966 struct samr_Ids types;
2967 struct samr_Password old_lm_hash;
2968 struct samr_Password new_lm_hash;
2969 int errcode = NERR_badpass;
2970 uint32_t rid;
2971 int encrypted;
2972 int min_pwd_length;
2973 struct dcerpc_binding_handle *b = NULL;
2974
2975 /* Skip 2 strings. */
2976 p = skip_string(param,tpscnt,np);
2977 p = skip_string(param,tpscnt,p);
2978
2979 if (!np || !p) {
2980 return False;
2981 }
2982
2983 /* Do we have a string ? */
2984 if (skip_string(param,tpscnt,p) == NULL) {
2985 return False;
2986 }
2987 pull_ascii_fstring(user,p);
2988
2989 p = skip_string(param,tpscnt,p);
2990 if (!p) {
2991 return False;
2992 }
2993
2994 memset(pass1,'\0',sizeof(pass1));
2995 memset(pass2,'\0',sizeof(pass2));
2996 /*
2997 * We use 31 here not 32 as we're checking
2998 * the last byte we want to access is safe.
2999 */
3000 if (!is_offset_safe(param,tpscnt,p,31)) {
3001 return False;
3002 }
3003 memcpy(pass1,p,16);
3004 memcpy(pass2,p+16,16);
3005
3006 encrypted = get_safe_SVAL(param,tpscnt,p+32,0,-1);
3007 if (encrypted == -1) {
3008 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3009 goto out;
3010 }
3011
3012 min_pwd_length = get_safe_SVAL(param,tpscnt,p+34,0,-1);
3013 if (min_pwd_length == -1) {
3014 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3015 goto out;
3016 }
3017
3018 *rparam_len = 4;
3019 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3020 if (!*rparam) {
3021 return False;
3022 }
3023
3024 *rdata_len = 0;
3025
3026 DEBUG(3,("Set password for <%s> (encrypted: %d, min_pwd_length: %d)\n",
3027 user, encrypted, min_pwd_length));
3028
3029 ZERO_STRUCT(connect_handle);
3030 ZERO_STRUCT(domain_handle);
3031 ZERO_STRUCT(user_handle);
3032
3033 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,
3034 conn->session_info,
3035 conn->sconn->remote_address,
3036 conn->sconn->msg_ctx,
3037 &cli);
3038 if (!NT_STATUS_IS_OK(status)) {
3039 DEBUG(0,("api_SetUserPassword: could not connect to samr: %s\n",
3040 nt_errstr(status)));
3041 errcode = W_ERROR_V(ntstatus_to_werror(status));
3042 goto out;
3043 }
3044
3045 b = cli->binding_handle;
3046
3047 status = dcerpc_samr_Connect2(b, mem_ctx,
3048 lp_netbios_name(),
3049 SAMR_ACCESS_CONNECT_TO_SERVER |
3050 SAMR_ACCESS_ENUM_DOMAINS |
3051 SAMR_ACCESS_LOOKUP_DOMAIN,
3052 &connect_handle,
3053 &result);
3054 if (!NT_STATUS_IS_OK(status)) {
3055 errcode = W_ERROR_V(ntstatus_to_werror(status));
3056 goto out;
3057 }
3058 if (!NT_STATUS_IS_OK(result)) {
3059 errcode = W_ERROR_V(ntstatus_to_werror(result));
3060 goto out;
3061 }
3062
3063 init_lsa_String(&domain_name, get_global_sam_name());
3064
3065 status = dcerpc_samr_LookupDomain(b, mem_ctx,
3066 &connect_handle,
3067 &domain_name,
3068 &domain_sid,
3069 &result);
3070 if (!NT_STATUS_IS_OK(status)) {
3071 errcode = W_ERROR_V(ntstatus_to_werror(status));
3072 goto out;
3073 }
3074 if (!NT_STATUS_IS_OK(result)) {
3075 errcode = W_ERROR_V(ntstatus_to_werror(result));
3076 goto out;
3077 }
3078
3079 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3080 &connect_handle,
3081 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
3082 domain_sid,
3083 &domain_handle,
3084 &result);
3085 if (!NT_STATUS_IS_OK(status)) {
3086 errcode = W_ERROR_V(ntstatus_to_werror(status));
3087 goto out;
3088 }
3089 if (!NT_STATUS_IS_OK(result)) {
3090 errcode = W_ERROR_V(ntstatus_to_werror(result));
3091 goto out;
3092 }
3093
3094 init_lsa_String(&names, user);
3095
3096 status = dcerpc_samr_LookupNames(b, mem_ctx,
3097 &domain_handle,
3098 1,
3099 &names,
3100 &rids,
3101 &types,
3102 &result);
3103 if (!NT_STATUS_IS_OK(status)) {
3104 errcode = W_ERROR_V(ntstatus_to_werror(status));
3105 goto out;
3106 }
3107 if (!NT_STATUS_IS_OK(result)) {
3108 errcode = W_ERROR_V(ntstatus_to_werror(result));
3109 goto out;
3110 }
3111
3112 if (rids.count != 1) {
3113 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
3114 goto out;
3115 }
3116 if (rids.count != types.count) {
3117 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3118 goto out;
3119 }
3120 if (types.ids[0] != SID_NAME_USER) {
3121 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3122 goto out;
3123 }
3124
3125 rid = rids.ids[0];
3126
3127 status = dcerpc_samr_OpenUser(b, mem_ctx,
3128 &domain_handle,
3129 SAMR_USER_ACCESS_CHANGE_PASSWORD,
3130 rid,
3131 &user_handle,
3132 &result);
3133 if (!NT_STATUS_IS_OK(status)) {
3134 errcode = W_ERROR_V(ntstatus_to_werror(status));
3135 goto out;
3136 }
3137 if (!NT_STATUS_IS_OK(result)) {
3138 errcode = W_ERROR_V(ntstatus_to_werror(result));
3139 goto out;
3140 }
3141
3142 if (encrypted == 0) {
3143 E_deshash(pass1, old_lm_hash.hash);
3144 E_deshash(pass2, new_lm_hash.hash);
3145 } else {
3146 ZERO_STRUCT(old_lm_hash);
3147 ZERO_STRUCT(new_lm_hash);
3148 memcpy(old_lm_hash.hash, pass1, MIN(strlen(pass1), 16));
3149 memcpy(new_lm_hash.hash, pass2, MIN(strlen(pass2), 16));
3150 }
3151
3152 status = dcerpc_samr_ChangePasswordUser(b, mem_ctx,
3153 &user_handle,
3154 true, /* lm_present */
3155 &old_lm_hash,
3156 &new_lm_hash,
3157 false, /* nt_present */
3158 NULL, /* old_nt_crypted */
3159 NULL, /* new_nt_crypted */
3160 false, /* cross1_present */
3161 NULL, /* nt_cross */
3162 false, /* cross2_present */
3163 NULL, /* lm_cross */
3164 &result);
3165 if (!NT_STATUS_IS_OK(status)) {
3166 errcode = W_ERROR_V(ntstatus_to_werror(status));
3167 goto out;
3168 }
3169 if (!NT_STATUS_IS_OK(result)) {
3170 errcode = W_ERROR_V(ntstatus_to_werror(result));
3171 goto out;
3172 }
3173
3174 errcode = NERR_Success;
3175 out:
3176
3177 if (b && is_valid_policy_hnd(&user_handle)) {
3178 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
3179 }
3180 if (b && is_valid_policy_hnd(&domain_handle)) {
3181 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
3182 }
3183 if (b && is_valid_policy_hnd(&connect_handle)) {
3184 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
3185 }
3186
3187 memset((char *)pass1,'\0',sizeof(fstring));
3188 memset((char *)pass2,'\0',sizeof(fstring));
3189
3190 SSVAL(*rparam,0,errcode);
3191 SSVAL(*rparam,2,0); /* converter word */
3192 return(True);
3193 }
3194
3195 /****************************************************************************
3196 Set the user password (SamOEM version - gets plaintext).
3197 ****************************************************************************/
3198
3199 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
3200 connection_struct *conn,uint64_t vuid,
3201 char *param, int tpscnt,
3202 char *data, int tdscnt,
3203 int mdrcnt,int mprcnt,
3204 char **rdata,char **rparam,
3205 int *rdata_len,int *rparam_len)
3206 {
3207 fstring user;
3208 char *p = get_safe_str_ptr(param,tpscnt,param,2);
3209
3210 TALLOC_CTX *mem_ctx = talloc_tos();
3211 NTSTATUS status, result;
3212 struct rpc_pipe_client *cli = NULL;
3213 struct lsa_AsciiString server, account;
3214 struct samr_CryptPassword password;
3215 struct samr_Password hash;
3216 int errcode = NERR_badpass;
3217 int bufsize;
3218 struct dcerpc_binding_handle *b;
3219
3220 *rparam_len = 4;
3221 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3222 if (!*rparam) {
3223 return False;
3224 }
3225
3226 if (!p) {
3227 return False;
3228 }
3229 *rdata_len = 0;
3230
3231 SSVAL(*rparam,0,NERR_badpass);
3232
3233 /*
3234 * Check the parameter definition is correct.
3235 */
3236
3237 /* Do we have a string ? */
3238 if (skip_string(param,tpscnt,p) == 0) {
3239 return False;
3240 }
3241 if(!strequal(p, "zsT")) {
3242 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
3243 return False;
3244 }
3245 p = skip_string(param, tpscnt, p);
3246 if (!p) {
3247 return False;
3248 }
3249
3250 /* Do we have a string ? */
3251 if (skip_string(param,tpscnt,p) == 0) {
3252 return False;
3253 }
3254 if(!strequal(p, "B516B16")) {
3255 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3256 return False;
3257 }
3258 p = skip_string(param,tpscnt,p);
3259 if (!p) {
3260 return False;
3261 }
3262 /* Do we have a string ? */
3263 if (skip_string(param,tpscnt,p) == 0) {
3264 return False;
3265 }
3266 p += pull_ascii_fstring(user,p);
3267
3268 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3269
3270 if (tdscnt != 532) {
3271 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3272 goto out;
3273 }
3274
3275 bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3276 if (bufsize != 532) {
3277 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3278 goto out;
3279 }
3280
3281 memcpy(password.data, data, 516);
3282 memcpy(hash.hash, data+516, 16);
3283
3284 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,
3285 conn->session_info,
3286 conn->sconn->remote_address,
3287 conn->sconn->msg_ctx,
3288 &cli);
3289 if (!NT_STATUS_IS_OK(status)) {
3290 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3291 nt_errstr(status)));
3292 errcode = W_ERROR_V(ntstatus_to_werror(status));
3293 goto out;
3294 }
3295
3296 b = cli->binding_handle;
3297
3298 init_lsa_AsciiString(&server, lp_netbios_name());
3299 init_lsa_AsciiString(&account, user);
3300
3301 status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3302 &server,
3303 &account,
3304 &password,
3305 &hash,
3306 &result);
3307 if (!NT_STATUS_IS_OK(status)) {
3308 errcode = W_ERROR_V(ntstatus_to_werror(status));
3309 goto out;
3310 }
3311 if (!NT_STATUS_IS_OK(result)) {
3312 errcode = W_ERROR_V(ntstatus_to_werror(result));
3313 goto out;
3314 }
3315
3316 errcode = NERR_Success;
3317 out:
3318 SSVAL(*rparam,0,errcode);
3319 SSVAL(*rparam,2,0); /* converter word */
3320
3321 return(True);
3322 }
3323
3324 /****************************************************************************
3325 delete a print job
3326 Form: <W> <>
3327 ****************************************************************************/
3328
3329 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3330 connection_struct *conn,uint64_t vuid,
3331 char *param, int tpscnt,
3332 char *data, int tdscnt,
3333 int mdrcnt,int mprcnt,
3334 char **rdata,char **rparam,
3335 int *rdata_len,int *rparam_len)
3336 {
3337 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3338 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3339 char *str2 = skip_string(param,tpscnt,str1);
3340 char *p = skip_string(param,tpscnt,str2);
3341 uint32 jobid;
3342 fstring sharename;
3343 int errcode;
3344 WERROR werr = WERR_OK;
3345
3346 TALLOC_CTX *mem_ctx = talloc_tos();
3347 NTSTATUS status;
3348 struct rpc_pipe_client *cli = NULL;
3349 struct dcerpc_binding_handle *b = NULL;
3350 struct policy_handle handle;
3351 struct spoolss_DevmodeContainer devmode_ctr;
3352 enum spoolss_JobControl command;
3353
3354 if (!str1 || !str2 || !p) {
3355 return False;
3356 }
3357 /*
3358 * We use 1 here not 2 as we're checking
3359 * the last byte we want to access is safe.
3360 */
3361 if (!is_offset_safe(param,tpscnt,p,1)) {
3362 return False;
3363 }
3364 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3365 return False;
3366
3367 /* check it's a supported varient */
3368 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3369 return(False);
3370
3371 *rparam_len = 4;
3372 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3373 if (!*rparam) {
3374 return False;
3375 }
3376 *rdata_len = 0;
3377
3378 ZERO_STRUCT(handle);
3379
3380 status = rpc_pipe_open_interface(conn,
3381 &ndr_table_spoolss.syntax_id,
3382 conn->session_info,
3383 conn->sconn->remote_address,
3384 conn->sconn->msg_ctx,
3385 &cli);
3386 if (!NT_STATUS_IS_OK(status)) {
3387 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3388 nt_errstr(status)));
3389 errcode = W_ERROR_V(ntstatus_to_werror(status));
3390 goto out;
3391 }
3392 b = cli->binding_handle;
3393
3394 ZERO_STRUCT(devmode_ctr);
3395
3396 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3397 sharename,
3398 "RAW",
3399 devmode_ctr,
3400 JOB_ACCESS_ADMINISTER,
3401 &handle,
3402 &werr);
3403 if (!NT_STATUS_IS_OK(status)) {
3404 errcode = W_ERROR_V(ntstatus_to_werror(status));
3405 goto out;
3406 }
3407 if (!W_ERROR_IS_OK(werr)) {
3408 errcode = W_ERROR_V(werr);
3409 goto out;
3410 }
3411
3412 /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3413 * and NERR_DestNotFound if share did not exist */
3414
3415 errcode = NERR_Success;
3416
3417 switch (function) {
3418 case 81: /* delete */
3419 command = SPOOLSS_JOB_CONTROL_DELETE;
3420 break;
3421 case 82: /* pause */
3422 command = SPOOLSS_JOB_CONTROL_PAUSE;
3423 break;
3424 case 83: /* resume */
3425 command = SPOOLSS_JOB_CONTROL_RESUME;
3426 break;
3427 default:
3428 errcode = NERR_notsupported;
3429 goto out;
3430 }
3431
3432 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3433 &handle,
3434 jobid,
3435 NULL, /* unique ptr ctr */
3436 command,
3437 &werr);
3438 if (!NT_STATUS_IS_OK(status)) {
3439 errcode = W_ERROR_V(ntstatus_to_werror(status));
3440 goto out;
3441 }
3442 if (!W_ERROR_IS_OK(werr)) {
3443 errcode = W_ERROR_V(werr);
3444 goto out;
3445 }
3446
3447 out:
3448 if (b && is_valid_policy_hnd(&handle)) {
3449 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3450 }
3451
3452 SSVAL(*rparam,0,errcode);
3453 SSVAL(*rparam,2,0); /* converter word */
3454
3455 return(True);
3456 }
3457
3458 /****************************************************************************
3459 Purge a print queue - or pause or resume it.
3460 ****************************************************************************/
3461
3462 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3463 connection_struct *conn,uint64_t vuid,
3464 char *param, int tpscnt,
3465 char *data, int tdscnt,
3466 int mdrcnt,int mprcnt,
3467 char **rdata,char **rparam,
3468 int *rdata_len,int *rparam_len)
3469 {
3470 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3471 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3472 char *str2 = skip_string(param,tpscnt,str1);
3473 char *QueueName = skip_string(param,tpscnt,str2);
3474 int errcode = NERR_notsupported;
3475 WERROR werr = WERR_OK;
3476 NTSTATUS status;
3477
3478 TALLOC_CTX *mem_ctx = talloc_tos();
3479 struct rpc_pipe_client *cli = NULL;
3480 struct dcerpc_binding_handle *b = NULL;
3481 struct policy_handle handle;
3482 struct spoolss_SetPrinterInfoCtr info_ctr;
3483 struct spoolss_DevmodeContainer devmode_ctr;
3484 struct sec_desc_buf secdesc_ctr;
3485 enum spoolss_PrinterControl command;
3486
3487 if (!str1 || !str2 || !QueueName) {
3488 return False;
3489 }
3490
3491 /* check it's a supported varient */
3492 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3493 return(False);
3494
3495 *rparam_len = 4;
3496 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3497 if (!*rparam) {
3498 return False;
3499 }
3500 *rdata_len = 0;
3501
3502 if (skip_string(param,tpscnt,QueueName) == NULL) {
3503 return False;
3504 }
3505
3506 ZERO_STRUCT(handle);
3507
3508 status = rpc_pipe_open_interface(conn,
3509 &ndr_table_spoolss.syntax_id,
3510 conn->session_info,
3511 conn->sconn->remote_address,
3512 conn->sconn->msg_ctx,
3513 &cli);
3514 if (!NT_STATUS_IS_OK(status)) {
3515 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3516 nt_errstr(status)));
3517 errcode = W_ERROR_V(ntstatus_to_werror(status));
3518 goto out;
3519 }
3520 b = cli->binding_handle;
3521
3522 ZERO_STRUCT(devmode_ctr);
3523
3524 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3525 QueueName,
3526 NULL,
3527 devmode_ctr,
3528 SEC_FLAG_MAXIMUM_ALLOWED,
3529 &handle,
3530 &werr);
3531 if (!NT_STATUS_IS_OK(status)) {
3532 errcode = W_ERROR_V(ntstatus_to_werror(status));
3533 goto out;
3534 }
3535 if (!W_ERROR_IS_OK(werr)) {
3536 errcode = W_ERROR_V(werr);
3537 goto out;
3538 }
3539
3540 switch (function) {
3541 case 74: /* Pause queue */
3542 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3543 break;
3544 case 75: /* Resume queue */
3545 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3546 break;
3547 case 103: /* Purge */
3548 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3549 break;
3550 default:
3551 werr = WERR_NOT_SUPPORTED;
3552 break;
3553 }
3554
3555 if (!W_ERROR_IS_OK(werr)) {
3556 errcode = W_ERROR_V(werr);
3557 goto out;
3558 }
3559
3560 ZERO_STRUCT(info_ctr);
3561 ZERO_STRUCT(secdesc_ctr);
3562
3563 status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3564 &handle,
3565 &info_ctr,
3566 &devmode_ctr,
3567 &secdesc_ctr,
3568 command,
3569 &werr);
3570 if (!NT_STATUS_IS_OK(status)) {
3571 errcode = W_ERROR_V(ntstatus_to_werror(status));
3572 goto out;
3573 }
3574 if (!W_ERROR_IS_OK(werr)) {
3575 errcode = W_ERROR_V(werr);
3576 goto out;
3577 }
3578
3579 errcode = W_ERROR_V(werr);
3580
3581 out:
3582
3583 if (b && is_valid_policy_hnd(&handle)) {
3584 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3585 }
3586
3587 SSVAL(*rparam,0,errcode);
3588 SSVAL(*rparam,2,0); /* converter word */
3589
3590 return(True);
3591 }
3592
3593 /****************************************************************************
3594 set the property of a print job (undocumented?)
3595 ? function = 0xb -> set name of print job
3596 ? function = 0x6 -> move print job up/down
3597 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3598 or <WWsTP> <WB21BB16B10zWWzDDz>
3599 ****************************************************************************/
3600
3601 static int check_printjob_info(struct pack_desc* desc,
3602 int uLevel, char* id)
3603 {
3604 desc->subformat = NULL;
3605 switch( uLevel ) {
3606 case 0: desc->format = "W"; break;
3607 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3608 case 2: desc->format = "WWzWWDDzz"; break;
3609 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3610 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3611 default:
3612 DEBUG(0,("check_printjob_info: invalid level %d\n",
3613 uLevel ));
3614 return False;
3615 }
3616 if (id == NULL || strcmp(desc->format,id) != 0) {
3617 DEBUG(0,("check_printjob_info: invalid format %s\n",
3618 id ? id : "<NULL>" ));
3619 return False;
3620 }
3621 return True;
3622 }
3623
3624 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3625 connection_struct *conn, uint64_t vuid,
3626 char *param, int tpscnt,
3627 char *data, int tdscnt,
3628 int mdrcnt,int mprcnt,
3629 char **rdata,char **rparam,
3630 int *rdata_len,int *rparam_len)
3631 {
3632 struct pack_desc desc;
3633 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3634 char *str2 = skip_string(param,tpscnt,str1);
3635 char *p = skip_string(param,tpscnt,str2);
3636 uint32 jobid;
3637 fstring sharename;
3638 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3639 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3640 int errcode;
3641
3642 TALLOC_CTX *mem_ctx = talloc_tos();
3643 WERROR werr;
3644 NTSTATUS status;
3645 struct rpc_pipe_client *cli = NULL;
3646 struct dcerpc_binding_handle *b = NULL;
3647 struct policy_handle handle;
3648 struct spoolss_DevmodeContainer devmode_ctr;
3649 struct spoolss_JobInfoContainer ctr;
3650 union spoolss_JobInfo info;
3651 struct spoolss_SetJobInfo1 info1;
3652
3653 if (!str1 || !str2 || !p) {
3654 return False;
3655 }
3656 /*
3657 * We use 1 here not 2 as we're checking
3658 * the last byte we want to access is safe.
3659 */
3660 if (!is_offset_safe(param,tpscnt,p,1)) {
3661 return False;
3662 }
3663 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3664 return False;
3665 *rparam_len = 4;
3666 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3667 if (!*rparam) {
3668 return False;
3669 }
3670
3671 *rdata_len = 0;
3672
3673 /* check it's a supported varient */
3674 if ((strcmp(str1,"WWsTP")) ||
3675 (!check_printjob_info(&desc,uLevel,str2)))
3676 return(False);
3677
3678 errcode = NERR_notsupported;
3679
3680 switch (function) {
3681 case 0xb:
3682 /* change print job name, data gives the name */
3683 break;
3684 default:
3685 goto out;
3686 }
3687
3688 ZERO_STRUCT(handle);
3689
3690 status = rpc_pipe_open_interface(conn,
3691 &ndr_table_spoolss.syntax_id,
3692 conn->session_info,
3693 conn->sconn->remote_address,
3694 conn->sconn->msg_ctx,
3695 &cli);
3696 if (!NT_STATUS_IS_OK(status)) {
3697 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3698 nt_errstr(status)));
3699 errcode = W_ERROR_V(ntstatus_to_werror(status));
3700 goto out;
3701 }
3702 b = cli->binding_handle;
3703
3704 ZERO_STRUCT(devmode_ctr);
3705
3706 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3707 sharename,
3708 "RAW",
3709 devmode_ctr,
3710 PRINTER_ACCESS_USE,
3711 &handle,
3712 &werr);
3713 if (!NT_STATUS_IS_OK(status)) {
3714 errcode = W_ERROR_V(ntstatus_to_werror(status));
3715 goto out;
3716 }
3717 if (!W_ERROR_IS_OK(werr)) {
3718 errcode = W_ERROR_V(werr);
3719 goto out;
3720 }
3721
3722 werr = rpccli_spoolss_getjob(cli, mem_ctx,
3723 &handle,
3724 jobid,
3725 1, /* level */
3726 0, /* offered */
3727 &info);
3728 if (!W_ERROR_IS_OK(werr)) {
3729 errcode = W_ERROR_V(werr);
3730 goto out;
3731 }
3732
3733 ZERO_STRUCT(ctr);
3734
3735 info1.job_id = info.info1.job_id;
3736 info1.printer_name = info.info1.printer_name;
3737 info1.user_name = info.info1.user_name;
3738 info1.document_name = data;
3739 info1.data_type = info.info1.data_type;
3740 info1.text_status = info.info1.text_status;
3741 info1.status = info.info1.status;
3742 info1.priority = info.info1.priority;
3743 info1.position = info.info1.position;
3744 info1.total_pages = info.info1.total_pages;
3745 info1.pages_printed = info.info1.pages_printed;
3746 info1.submitted = info.info1.submitted;
3747
3748 ctr.level = 1;
3749 ctr.info.info1 = &info1;
3750
3751 status = dcerpc_spoolss_SetJob(b, mem_ctx,
3752 &handle,
3753 jobid,
3754 &ctr,
3755 0,
3756 &werr);
3757 if (!NT_STATUS_IS_OK(status)) {
3758 errcode = W_ERROR_V(ntstatus_to_werror(status));
3759 goto out;
3760 }
3761 if (!W_ERROR_IS_OK(werr)) {
3762 errcode = W_ERROR_V(werr);
3763 goto out;
3764 }
3765
3766 errcode = NERR_Success;
3767 out:
3768
3769 if (b && is_valid_policy_hnd(&handle)) {
3770 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3771 }
3772
3773 SSVALS(*rparam,0,errcode);
3774 SSVAL(*rparam,2,0); /* converter word */
3775
3776 return(True);
3777 }
3778
3779
3780 /****************************************************************************
3781 Get info about the server.
3782 ****************************************************************************/
3783
3784 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3785 connection_struct *conn,uint64_t vuid,
3786 char *param, int tpscnt,
3787 char *data, int tdscnt,
3788 int mdrcnt,int mprcnt,
3789 char **rdata,char **rparam,
3790 int *rdata_len,int *rparam_len)
3791 {
3792 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3793 char *str2 = skip_string(param,tpscnt,str1);
3794 char *p = skip_string(param,tpscnt,str2);
3795 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3796 char *p2;
3797 int struct_len;
3798
3799 NTSTATUS status;
3800 WERROR werr;
3801 TALLOC_CTX *mem_ctx = talloc_tos();
3802 struct rpc_pipe_client *cli = NULL;
3803 union srvsvc_NetSrvInfo info;
3804 int errcode;
3805 struct dcerpc_binding_handle *b;
3806
3807 if (!str1 || !str2 || !p) {
3808 return False;
3809 }
3810
3811 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3812
3813 /* check it's a supported varient */
3814 if (!prefix_ok(str1,"WrLh")) {
3815 return False;
3816 }
3817
3818 switch( uLevel ) {
3819 case 0:
3820 if (strcmp(str2,"B16") != 0) {
3821 return False;
3822 }
3823 struct_len = 16;
3824 break;
3825 case 1:
3826 if (strcmp(str2,"B16BBDz") != 0) {
3827 return False;
3828 }
3829 struct_len = 26;
3830 break;
3831 case 2:
3832 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3833 return False;
3834 }
3835 struct_len = 134;
3836 break;
3837 case 3:
3838 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3839 return False;
3840 }
3841 struct_len = 144;
3842 break;
3843 case 20:
3844 if (strcmp(str2,"DN") != 0) {
3845 return False;
3846 }
3847 struct_len = 6;
3848 break;
3849 case 50:
3850 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3851 return False;
3852 }
3853 struct_len = 42;
3854 break;
3855 default:
3856 return False;
3857 }
3858
3859 *rdata_len = mdrcnt;
3860 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3861 if (!*rdata) {
3862 return False;
3863 }
3864
3865 p = *rdata;
3866 p2 = p + struct_len;
3867
3868 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc.syntax_id,
3869 conn->session_info,
3870 conn->sconn->remote_address,
3871 conn->sconn->msg_ctx,
3872 &cli);
3873 if (!NT_STATUS_IS_OK(status)) {
3874 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3875 nt_errstr(status)));
3876 errcode = W_ERROR_V(ntstatus_to_werror(status));
3877 goto out;
3878 }
3879
3880 b = cli->binding_handle;
3881
3882 status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3883 NULL,
3884 101,
3885 &info,
3886 &werr);
3887 if (!NT_STATUS_IS_OK(status)) {
3888 errcode = W_ERROR_V(ntstatus_to_werror(status));
3889 goto out;
3890 }
3891 if (!W_ERROR_IS_OK(werr)) {
3892 errcode = W_ERROR_V(werr);
3893 goto out;
3894 }
3895
3896 if (info.info101 == NULL) {
3897 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3898 goto out;
3899 }
3900
3901 if (uLevel != 20) {
3902 srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3903 STR_ASCII|STR_UPPER|STR_TERMINATE);
3904 }
3905 p += 16;
3906 if (uLevel > 0) {
3907 SCVAL(p,0,info.info101->version_major);
3908 SCVAL(p,1,info.info101->version_minor);
3909 SIVAL(p,2,info.info101->server_type);
3910
3911 if (mdrcnt == struct_len) {
3912 SIVAL(p,6,0);
3913 } else {
3914 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3915 if (mdrcnt - struct_len <= 0) {
3916 return false;
3917 }
3918 push_ascii(p2,
3919 info.info101->comment,
3920 MIN(mdrcnt - struct_len,
3921 MAX_SERVER_STRING_LENGTH),
3922 STR_TERMINATE);
3923 p2 = skip_string(*rdata,*rdata_len,p2);
3924 if (!p2) {
3925 return False;
3926 }
3927 }
3928 }
3929
3930 if (uLevel > 1) {
3931 return False; /* not yet implemented */
3932 }
3933
3934 errcode = NERR_Success;
3935
3936 out:
3937
3938 *rdata_len = PTR_DIFF(p2,*rdata);
3939
3940 *rparam_len = 6;
3941 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3942 if (!*rparam) {
3943 return False;
3944 }
3945 SSVAL(*rparam,0,errcode);
3946 SSVAL(*rparam,2,0); /* converter word */
3947 SSVAL(*rparam,4,*rdata_len);
3948
3949 return True;
3950 }
3951
3952 /****************************************************************************
3953 Get info about the server.
3954 ****************************************************************************/
3955
3956 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3957 connection_struct *conn,uint64_t vuid,
3958 char *param, int tpscnt,
3959 char *data, int tdscnt,
3960 int mdrcnt,int mprcnt,
3961 char **rdata,char **rparam,
3962 int *rdata_len,int *rparam_len)
3963 {
3964 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3965 char *str2 = skip_string(param,tpscnt,str1);
3966 char *p = skip_string(param,tpscnt,str2);
3967 char *p2;
3968 char *endp;
3969 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3970
3971 if (!str1 || !str2 || !p) {
3972 return False;
3973 }
3974
3975 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3976
3977 *rparam_len = 6;
3978 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3979 if (!*rparam) {
3980 return False;
3981 }
3982
3983 /* check it's a supported varient */
3984 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3985 return False;
3986 }
3987
3988 *rdata_len = mdrcnt + 1024;
3989 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3990 if (!*rdata) {
3991 return False;
3992 }
3993
3994 SSVAL(*rparam,0,NERR_Success);
3995 SSVAL(*rparam,2,0); /* converter word */
3996
3997 p = *rdata;
3998 endp = *rdata + *rdata_len;
3999
4000 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
4001 if (!p2) {
4002 return False;
4003 }
4004
4005 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
4006 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
4007 strupper_m(p2);
4008 p2 = skip_string(*rdata,*rdata_len,p2);
4009 if (!p2) {
4010 return False;
4011 }
4012 p += 4;
4013
4014 SIVAL(p,0,PTR_DIFF(p2,*rdata));
4015 strlcpy(p2,conn->session_info->unix_info->sanitized_username,PTR_DIFF(endp,p2));
4016 p2 = skip_string(*rdata,*rdata_len,p2);
4017 if (!p2) {
4018 return False;
4019 }
4020 p += 4;
4021
4022 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
4023 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
4024 strupper_m(p2);
4025 p2 = skip_string(*rdata,*rdata_len,p2);
4026 if (!p2) {
4027 return False;
4028 }
4029 p += 4;
4030
4031 SCVAL(p,0,SAMBA_MAJOR_NBT_ANNOUNCE_VERSION); /* system version - e.g 4 in 4.1 */
4032 SCVAL(p,1,SAMBA_MINOR_NBT_ANNOUNCE_VERSION); /* system version - e.g .1 in 4.1 */
4033 p += 2;
4034
4035 SIVAL(p,0,PTR_DIFF(p2,*rdata));
4036 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
4037 p2 = skip_string(*rdata,*rdata_len,p2);
4038 if (!p2) {
4039 return False;
4040 }
4041 p += 4;
4042
4043 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
4044 strlcpy(p2,"",PTR_DIFF(endp,p2));
4045 p2 = skip_string(*rdata,*rdata_len,p2);
4046 if (!p2) {
4047 return False;
4048 }
4049 p += 4;
4050
4051 *rdata_len = PTR_DIFF(p2,*rdata);
4052
4053 SSVAL(*rparam,4,*rdata_len);
4054
4055 return True;
4056 }
4057
4058 /****************************************************************************
4059 get info about a user
4060
4061 struct user_info_11 {
4062 char usri11_name[21]; 0-20
4063 char usri11_pad; 21
4064 char *usri11_comment; 22-25
4065 char *usri11_usr_comment; 26-29
4066 unsigned short usri11_priv; 30-31
4067 unsigned long usri11_auth_flags; 32-35
4068 long usri11_password_age; 36-39
4069 char *usri11_homedir; 40-43
4070 char *usri11_parms; 44-47
4071 long usri11_last_logon; 48-51
4072 long usri11_last_logoff; 52-55
4073 unsigned short usri11_bad_pw_count; 56-57
4074 unsigned short usri11_num_logons; 58-59
4075 char *usri11_logon_server; 60-63
4076 unsigned short usri11_country_code; 64-65
4077 char *usri11_workstations; 66-69
4078 unsigned long usri11_max_storage; 70-73
4079 unsigned short usri11_units_per_week; 74-75
4080 unsigned char *usri11_logon_hours; 76-79
4081 unsigned short usri11_code_page; 80-81
4082 };
4083
4084 where:
4085
4086 usri11_name specifies the user name for which information is retrieved
4087
4088 usri11_pad aligns the next data structure element to a word boundary
4089
4090 usri11_comment is a null terminated ASCII comment
4091
4092 usri11_user_comment is a null terminated ASCII comment about the user
4093
4094 usri11_priv specifies the level of the privilege assigned to the user.
4095 The possible values are:
4096
4097 Name Value Description
4098 USER_PRIV_GUEST 0 Guest privilege
4099 USER_PRIV_USER 1 User privilege
4100 USER_PRV_ADMIN 2 Administrator privilege
4101
4102 usri11_auth_flags specifies the account operator privileges. The
4103 possible values are:
4104
4105 Name Value Description
4106 AF_OP_PRINT 0 Print operator
4107
4108
4109 Leach, Naik [Page 28]
4110 \f
4111
4112
4113 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
4114
4115
4116 AF_OP_COMM 1 Communications operator
4117 AF_OP_SERVER 2 Server operator
4118 AF_OP_ACCOUNTS 3 Accounts operator
4119
4120
4121 usri11_password_age specifies how many seconds have elapsed since the
4122 password was last changed.
4123
4124 usri11_home_dir points to a null terminated ASCII string that contains
4125 the path name of the user's home directory.
4126
4127 usri11_parms points to a null terminated ASCII string that is set
4128 aside for use by applications.
4129
4130 usri11_last_logon specifies the time when the user last logged on.
4131 This value is stored as the number of seconds elapsed since
4132 00:00:00, January 1, 1970.
4133
4134 usri11_last_logoff specifies the time when the user last logged off.
4135 This value is stored as the number of seconds elapsed since
4136 00:00:00, January 1, 1970. A value of 0 means the last logoff
4137 time is unknown.
4138
4139 usri11_bad_pw_count specifies the number of incorrect passwords
4140 entered since the last successful logon.
4141
4142 usri11_log1_num_logons specifies the number of times this user has
4143 logged on. A value of -1 means the number of logons is unknown.
4144
4145 usri11_logon_server points to a null terminated ASCII string that
4146 contains the name of the server to which logon requests are sent.
4147 A null string indicates logon requests should be sent to the
4148 domain controller.
4149
4150 usri11_country_code specifies the country code for the user's language
4151 of choice.
4152
4153 usri11_workstations points to a null terminated ASCII string that
4154 contains the names of workstations the user may log on from.
4155 There may be up to 8 workstations, with the names separated by
4156 commas. A null strings indicates there are no restrictions.
4157
4158 usri11_max_storage specifies the maximum amount of disk space the user
4159 can occupy. A value of 0xffffffff indicates there are no
4160 restrictions.
4161
4162 usri11_units_per_week specifies the equal number of time units into
4163 which a week is divided. This value must be equal to 168.
4164
4165 usri11_logon_hours points to a 21 byte (168 bits) string that
4166 specifies the time during which the user can log on. Each bit
4167 represents one unique hour in a week. The first bit (bit 0, word
4168 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
4169
4170
4171
4172 Leach, Naik [Page 29]
4173 \f
4174
4175
4176 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
4177
4178
4179 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
4180 are no restrictions.
4181
4182 usri11_code_page specifies the code page for the user's language of
4183 choice
4184
4185 All of the pointers in this data structure need to be treated
4186 specially. The pointer is a 32 bit pointer. The higher 16 bits need
4187 to be ignored. The converter word returned in the parameters section
4188 needs to be subtracted from the lower 16 bits to calculate an offset
4189 into the return buffer where this ASCII string resides.
4190
4191 There is no auxiliary data in the response.
4192
4193 ****************************************************************************/
4194
4195 #define usri11_name 0
4196 #define usri11_pad 21
4197 #define usri11_comment 22
4198 #define usri11_usr_comment 26
4199 #define usri11_full_name 30
4200 #define usri11_priv 34
4201 #define usri11_auth_flags 36
4202 #define usri11_password_age 40
4203 #define usri11_homedir 44
4204 #define usri11_parms 48
4205 #define usri11_last_logon 52
4206 #define usri11_last_logoff 56
4207 #define usri11_bad_pw_count 60
4208 #define usri11_num_logons 62
4209 #define usri11_logon_server 64
4210 #define usri11_country_code 68
4211 #define usri11_workstations 70
4212 #define usri11_max_storage 74
4213 #define usri11_units_per_week 78
4214 #define usri11_logon_hours 80
4215 #define usri11_code_page 84
4216 #define usri11_end 86
4217
4218 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
4219 connection_struct *conn, uint64_t vuid,
4220 char *param, int tpscnt,
4221 char *data, int tdscnt,
4222 int mdrcnt,int mprcnt,
4223 char **rdata,char **rparam,
4224 int *rdata_len,int *rparam_len)
4225 {
4226 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4227 char *str2 = skip_string(param,tpscnt,str1);
4228 char *UserName = skip_string(param,tpscnt,str2);
4229 char *p = skip_string(param,tpscnt,UserName);
4230 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4231 char *p2;
4232 char *endp;
4233 const char *level_string;
4234
4235 TALLOC_CTX *mem_ctx = talloc_tos();
4236 NTSTATUS status, result;
4237 struct rpc_pipe_client *cli = NULL;
4238 struct policy_handle connect_handle, domain_handle, user_handle;
4239 struct lsa_String domain_name;
4240 struct dom_sid2 *domain_sid;
4241 struct lsa_String names;
4242 struct samr_Ids rids;
4243 struct samr_Ids types;
4244 int errcode = W_ERROR_V(WERR_USER_NOT_FOUND);
4245 uint32_t rid;
4246 union samr_UserInfo *info;
4247 struct dcerpc_binding_handle *b = NULL;
4248
4249 if (!str1 || !str2 || !UserName || !p) {
4250 return False;
4251 }
4252
4253 *rparam_len = 6;
4254 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4255 if (!*rparam) {
4256 return False;
4257 }
4258
4259 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4260
4261 /* check it's a supported variant */
4262 if (strcmp(str1,"zWrLh") != 0) {
4263 return False;
4264 }
4265 switch( uLevel ) {
4266 case 0: level_string = "B21"; break;
4267 case 1: level_string = "B21BB16DWzzWz"; break;
4268 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4269 case 10: level_string = "B21Bzzz"; break;
4270 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4271 default: return False;
4272 }
4273
4274 if (strcmp(level_string,str2) != 0) {
4275 return False;
4276 }
4277
4278 *rdata_len = mdrcnt + 1024;
4279 *rdata = smb_realloc_limit(*rdata,*rdata_len);
4280 if (!*rdata) {
4281 return False;
4282 }
4283
4284 p = *rdata;
4285 endp = *rdata + *rdata_len;
4286 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4287 if (!p2) {
4288 return False;
4289 }
4290
4291 ZERO_STRUCT(connect_handle);
4292 ZERO_STRUCT(domain_handle);
4293 ZERO_STRUCT(user_handle);
4294
4295 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,
4296 conn->session_info,
4297 conn->sconn->remote_address,
4298 conn->sconn->msg_ctx,
4299 &cli);
4300 if (!NT_STATUS_IS_OK(status)) {
4301 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4302 nt_errstr(status)));
4303 errcode = W_ERROR_V(ntstatus_to_werror(status));
4304 goto out;
4305 }
4306
4307 b = cli->binding_handle;
4308
4309 status = dcerpc_samr_Connect2(b, mem_ctx,
4310 lp_netbios_name(),
4311 SAMR_ACCESS_CONNECT_TO_SERVER |
4312 SAMR_ACCESS_ENUM_DOMAINS |
4313 SAMR_ACCESS_LOOKUP_DOMAIN,
4314 &connect_handle,
4315 &result);
4316 if (!NT_STATUS_IS_OK(status)) {
4317 errcode = W_ERROR_V(ntstatus_to_werror(status));
4318 goto out;
4319 }
4320 if (!NT_STATUS_IS_OK(result)) {
4321 errcode = W_ERROR_V(ntstatus_to_werror(result));
4322 goto out;
4323 }
4324
4325 init_lsa_String(&domain_name, get_global_sam_name());
4326
4327 status = dcerpc_samr_LookupDomain(b, mem_ctx,
4328 &connect_handle,
4329 &domain_name,
4330 &domain_sid,
4331 &result);
4332 if (!NT_STATUS_IS_OK(status)) {
4333 errcode = W_ERROR_V(ntstatus_to_werror(status));
4334 goto out;
4335 }
4336 if (!NT_STATUS_IS_OK(result)) {
4337 errcode = W_ERROR_V(ntstatus_to_werror(result));
4338 goto out;
4339 }
4340
4341 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4342 &connect_handle,
4343 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4344 domain_sid,
4345 &domain_handle,
4346 &result);
4347 if (!NT_STATUS_IS_OK(status)) {
4348 errcode = W_ERROR_V(ntstatus_to_werror(status));
4349 goto out;
4350 }
4351 if (!NT_STATUS_IS_OK(result)) {
4352 errcode = W_ERROR_V(ntstatus_to_werror(result));
4353 goto out;
4354 }
4355
4356 init_lsa_String(&names, UserName);
4357
4358 status = dcerpc_samr_LookupNames(b, mem_ctx,
4359 &domain_handle,
4360 1,
4361 &names,
4362 &rids,
4363 &types,
4364 &result);
4365 if (!NT_STATUS_IS_OK(status)) {
4366 errcode = W_ERROR_V(ntstatus_to_werror(status));
4367 goto out;
4368 }
4369 if (!NT_STATUS_IS_OK(result)) {
4370 errcode = W_ERROR_V(ntstatus_to_werror(result));
4371 goto out;
4372 }
4373
4374 if (rids.count != 1) {
4375 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4376 goto out;
4377 }
4378 if (rids.count != types.count) {
4379 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4380 goto out;
4381 }
4382 if (types.ids[0] != SID_NAME_USER) {
4383 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4384 goto out;
4385 }
4386
4387 rid = rids.ids[0];
4388
4389 status = dcerpc_samr_OpenUser(b, mem_ctx,
4390 &domain_handle,
4391 SAMR_USER_ACCESS_GET_LOCALE |
4392 SAMR_USER_ACCESS_GET_LOGONINFO |
4393 SAMR_USER_ACCESS_GET_ATTRIBUTES |
4394 SAMR_USER_ACCESS_GET_GROUPS |
4395 SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4396 SEC_STD_READ_CONTROL,
4397 rid,
4398 &user_handle,
4399 &result);
4400 if (!NT_STATUS_IS_OK(status)) {
4401 errcode = W_ERROR_V(ntstatus_to_werror(status));
4402 goto out;
4403 }
4404 if (!NT_STATUS_IS_OK(result)) {
4405 errcode = W_ERROR_V(ntstatus_to_werror(result));
4406 goto out;
4407 }
4408
4409 status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4410 &user_handle,
4411 UserAllInformation,
4412 &info,
4413 &result);
4414 if (!NT_STATUS_IS_OK(status)) {
4415 errcode = W_ERROR_V(ntstatus_to_werror(status));
4416 goto out;
4417 }
4418 if (!NT_STATUS_IS_OK(result)) {
4419 errcode = W_ERROR_V(ntstatus_to_werror(result));
4420 goto out;
4421 }
4422
4423 memset(p,0,21);
4424 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4425
4426 if (uLevel > 0) {
4427 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4428 *p2 = 0;
4429 }
4430
4431 if (uLevel >= 10) {
4432 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4433 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4434 p2 = skip_string(*rdata,*rdata_len,p2);
4435 if (!p2) {
4436 return False;
4437 }
4438
4439 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4440 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4441 p2 = skip_string(*rdata,*rdata_len,p2);
4442 if (!p2) {
4443 return False;
4444 }
4445
4446 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4447 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4448 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4449 p2 = skip_string(*rdata,*rdata_len,p2);
4450 if (!p2) {
4451 return False;
4452 }
4453 }
4454
4455 if (uLevel == 11) {
4456 const char *homedir = info->info21.home_directory.string;
4457 /* modelled after NTAS 3.51 reply */
4458 SSVAL(p,usri11_priv,
4459 (get_current_uid(conn) == sec_initial_uid())?
4460 USER_PRIV_ADMIN:USER_PRIV_USER);
4461 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
4462 SIVALS(p,usri11_password_age,-1); /* password age */
4463 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4464 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4465 p2 = skip_string(*rdata,*rdata_len,p2);
4466 if (!p2) {
4467 return False;
4468 }
4469 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4470 strlcpy(p2,"",PTR_DIFF(endp,p2));
4471 p2 = skip_string(*rdata,*rdata_len,p2);
4472 if (!p2) {
4473 return False;
4474 }
4475 SIVAL(p,usri11_last_logon,0); /* last logon */
4476 SIVAL(p,usri11_last_logoff,0); /* last logoff */
4477 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
4478 SSVALS(p,usri11_num_logons,-1); /* num logons */
4479 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4480 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4481 p2 = skip_string(*rdata,*rdata_len,p2);
4482 if (!p2) {
4483 return False;
4484 }
4485 SSVAL(p,usri11_country_code,0); /* country code */
4486
4487 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4488 strlcpy(p2,"",PTR_DIFF(endp,p2));
4489 p2 = skip_string(*rdata,*rdata_len,p2);
4490 if (!p2) {
4491 return False;
4492 }
4493
4494 SIVALS(p,usri11_max_storage,-1); /* max storage */
4495 SSVAL(p,usri11_units_per_week,168); /* units per week */
4496 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4497
4498 /* a simple way to get logon hours at all times. */
4499 memset(p2,0xff,21);
4500 SCVAL(p2,21,0); /* fix zero termination */
4501 p2 = skip_string(*rdata,*rdata_len,p2);
4502 if (!p2) {
4503 return False;
4504 }
4505
4506 SSVAL(p,usri11_code_page,0); /* code page */
4507 }
4508
4509 if (uLevel == 1 || uLevel == 2) {
4510 memset(p+22,' ',16); /* password */
4511 SIVALS(p,38,-1); /* password age */
4512 SSVAL(p,42,
4513 (get_current_uid(conn) == sec_initial_uid())?
4514 USER_PRIV_ADMIN:USER_PRIV_USER);
4515 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4516 strlcpy(p2, info->info21.home_directory.string,
4517 PTR_DIFF(endp,p2));
4518 p2 = skip_string(*rdata,*rdata_len,p2);
4519 if (!p2) {
4520 return False;
4521 }
4522 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4523 *p2++ = 0;
4524 SSVAL(p,52,0); /* flags */
4525 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
4526 strlcpy(p2, info->info21.logon_script.string,
4527 PTR_DIFF(endp,p2));
4528 p2 = skip_string(*rdata,*rdata_len,p2);
4529 if (!p2) {
4530 return False;
4531 }
4532 if (uLevel == 2) {
4533 SIVAL(p,58,0); /* auth_flags */
4534 SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4535 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4536 p2 = skip_string(*rdata,*rdata_len,p2);
4537 if (!p2) {
4538 return False;
4539 }
4540 SIVAL(p,66,0); /* urs_comment */
4541 SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4542 strlcpy(p2,"",PTR_DIFF(endp,p2));
4543 p2 = skip_string(*rdata,*rdata_len,p2);
4544 if (!p2) {
4545 return False;
4546 }
4547 SIVAL(p,74,0); /* workstations */
4548 SIVAL(p,78,0); /* last_logon */
4549 SIVAL(p,82,0); /* last_logoff */
4550 SIVALS(p,86,-1); /* acct_expires */
4551 SIVALS(p,90,-1); /* max_storage */
4552 SSVAL(p,94,168); /* units_per_week */
4553 SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4554 memset(p2,-1,21);
4555 p2 += 21;
4556 SSVALS(p,100,-1); /* bad_pw_count */
4557 SSVALS(p,102,-1); /* num_logons */
4558 SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4559 {
4560 TALLOC_CTX *ctx = talloc_tos();
4561 int space_rem = *rdata_len - (p2 - *rdata);
4562 char *tmp;
4563
4564 if (space_rem <= 0) {
4565 return false;
4566 }
4567 tmp = talloc_strdup(ctx, "\\\\%L");
4568 if (!tmp) {
4569 return false;
4570 }
4571 tmp = talloc_sub_basic(ctx,
4572 "",
4573 "",
4574 tmp);
4575 if (!tmp) {
4576 return false;
4577 }
4578
4579 push_ascii(p2,
4580 tmp,
4581 space_rem,
4582 STR_TERMINATE);
4583 }
4584 p2 = skip_string(*rdata,*rdata_len,p2);
4585 if (!p2) {
4586 return False;
4587 }
4588 SSVAL(p,108,49); /* country_code */
4589 SSVAL(p,110,860); /* code page */
4590 }
4591 }
4592
4593 errcode = NERR_Success;
4594
4595 out:
4596 *rdata_len = PTR_DIFF(p2,*rdata);
4597
4598 if (b && is_valid_policy_hnd(&user_handle)) {
4599 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4600 }
4601 if (b && is_valid_policy_hnd(&domain_handle)) {
4602 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4603 }
4604 if (b && is_valid_policy_hnd(&connect_handle)) {
4605 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4606 }
4607
4608 SSVAL(*rparam,0,errcode);
4609 SSVAL(*rparam,2,0); /* converter word */
4610 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
4611
4612 return(True);
4613 }
4614
4615 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4616 connection_struct *conn,uint64_t vuid,
4617 char *param, int tpscnt,
4618 char *data, int tdscnt,
4619 int mdrcnt,int mprcnt,
4620 char **rdata,char **rparam,
4621 int *rdata_len,int *rparam_len)
4622 {
4623 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4624 char *str2 = skip_string(param,tpscnt,str1);
4625 char *p = skip_string(param,tpscnt,str2);
4626 int uLevel;
4627 struct pack_desc desc;
4628 char* name;
4629 /* With share level security vuid will always be zero.
4630 Don't depend on vuser being non-null !!. JRA */
4631 struct user_struct *vuser = get_valid_user_struct(sconn, vuid);
4632
4633 if (!str1 || !str2 || !p) {
4634 return False;
4635 }
4636
4637 if(vuser != NULL) {
4638 DEBUG(3,(" Username of UID %d is %s\n",
4639 (int)vuser->session_info->unix_token->uid,
4640 vuser->session_info->unix_info->unix_name));
4641 }
4642
4643 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4644 name = get_safe_str_ptr(param,tpscnt,p,2);
4645 if (!name) {
4646 return False;
4647 }
4648
4649 memset((char *)&desc,'\0',sizeof(desc));
4650
4651 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4652
4653 /* check it's a supported varient */
4654 if (strcmp(str1,"OOWb54WrLh") != 0) {
4655 return False;
4656 }
4657 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4658 return False;
4659 }
4660 if (mdrcnt > 0) {
4661 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4662 if (!*rdata) {
4663 return False;
4664 }
4665 }
4666
4667 desc.base = *rdata;
4668 desc.buflen = mdrcnt;
4669 desc.subformat = NULL;
4670 desc.format = str2;
4671
4672 if (init_package(&desc,1,0)) {
4673 PACKI(&desc,"W",0); /* code */
4674 PACKS(&desc,"B21",name); /* eff. name */
4675 PACKS(&desc,"B",""); /* pad */
4676 PACKI(&desc,"W",
4677 (get_current_uid(conn) == sec_initial_uid())?
4678 USER_PRIV_ADMIN:USER_PRIV_USER);
4679 PACKI(&desc,"D",0); /* auth flags XXX */
4680 PACKI(&desc,"W",0); /* num logons */
4681 PACKI(&desc,"W",0); /* bad pw count */
4682 PACKI(&desc,"D",0); /* last logon */
4683 PACKI(&desc,"D",-1); /* last logoff */
4684 PACKI(&desc,"D",-1); /* logoff time */
4685 PACKI(&desc,"D",-1); /* kickoff time */
4686 PACKI(&desc,"D",0); /* password age */
4687 PACKI(&desc,"D",0); /* password can change */
4688 PACKI(&desc,"D",-1); /* password must change */
4689
4690 {
4691 fstring mypath;
4692 fstrcpy(mypath,"\\\\");
4693 fstrcat(mypath,get_local_machine_name());
4694 strupper_m(mypath);
4695 PACKS(&desc,"z",mypath); /* computer */
4696 }
4697
4698 PACKS(&desc,"z",lp_workgroup());/* domain */
4699 PACKS(&desc,"z", vuser ?
4700 vuser->session_info->info->logon_script
4701 : ""); /* script path */
4702 PACKI(&desc,"D",0x00000000); /* reserved */
4703 }
4704
4705 *rdata_len = desc.usedlen;
4706 *rparam_len = 6;
4707 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4708 if (!*rparam) {
4709 return False;
4710 }
4711 SSVALS(*rparam,0,desc.errcode);
4712 SSVAL(*rparam,2,0);
4713 SSVAL(*rparam,4,desc.neededlen);
4714
4715 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4716
4717 return True;
4718 }
4719
4720 /****************************************************************************
4721 api_WAccessGetUserPerms
4722 ****************************************************************************/
4723
4724 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4725 connection_struct *conn,uint64_t vuid,
4726 char *param, int tpscnt,
4727 char *data, int tdscnt,
4728 int mdrcnt,int mprcnt,
4729 char **rdata,char **rparam,
4730 int *rdata_len,int *rparam_len)
4731 {
4732 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4733 char *str2 = skip_string(param,tpscnt,str1);
4734 char *user = skip_string(param,tpscnt,str2);
4735 char *resource = skip_string(param,tpscnt,user);
4736
4737 if (!str1 || !str2 || !user || !resource) {
4738 return False;
4739 }
4740
4741 if (skip_string(param,tpscnt,resource) == NULL) {
4742 return False;
4743 }
4744 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4745
4746 /* check it's a supported varient */
4747 if (strcmp(str1,"zzh") != 0) {
4748 return False;
4749 }
4750 if (strcmp(str2,"") != 0) {
4751 return False;
4752 }
4753
4754 *rparam_len = 6;
4755 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4756 if (!*rparam) {
4757 return False;
4758 }
4759 SSVALS(*rparam,0,0); /* errorcode */
4760 SSVAL(*rparam,2,0); /* converter word */
4761 SSVAL(*rparam,4,0x7f); /* permission flags */
4762
4763 return True;
4764 }
4765
4766 /****************************************************************************
4767 api_WPrintJobEnumerate
4768 ****************************************************************************/
4769
4770 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4771 connection_struct *conn, uint64_t vuid,
4772 char *param, int tpscnt,
4773 char *data, int tdscnt,
4774 int mdrcnt,int mprcnt,
4775 char **rdata,char **rparam,
4776 int *rdata_len,int *rparam_len)
4777 {
4778 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4779 char *str2 = skip_string(param,tpscnt,str1);
4780 char *p = skip_string(param,tpscnt,str2);
4781 int uLevel;
4782 fstring sharename;
4783 uint32 jobid;
4784 struct pack_desc desc;
4785 char *tmpdata=NULL;
4786
4787 TALLOC_CTX *mem_ctx = talloc_tos();
4788 WERROR werr;
4789 NTSTATUS status;
4790 struct rpc_pipe_client *cli = NULL;
4791 struct dcerpc_binding_handle *b = NULL;
4792 struct policy_handle handle;
4793 struct spoolss_DevmodeContainer devmode_ctr;
4794 union spoolss_JobInfo info;
4795
4796 if (!str1 || !str2 || !p) {
4797 return False;
4798 }
4799
4800 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4801
4802 memset((char *)&desc,'\0',sizeof(desc));
4803 memset((char *)&status,'\0',sizeof(status));
4804
4805 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4806
4807 /* check it's a supported varient */
4808 if (strcmp(str1,"WWrLh") != 0) {
4809 return False;
4810 }
4811 if (!check_printjob_info(&desc,uLevel,str2)) {
4812 return False;
4813 }
4814
4815 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4816 return False;
4817 }
4818
4819 ZERO_STRUCT(handle);
4820
4821 status = rpc_pipe_open_interface(conn,
4822 &ndr_table_spoolss.syntax_id,
4823 conn->session_info,
4824 conn->sconn->remote_address,
4825 conn->sconn->msg_ctx,
4826 &cli);
4827 if (!NT_STATUS_IS_OK(status)) {
4828 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4829 nt_errstr(status)));
4830 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4831 goto out;
4832 }
4833 b = cli->binding_handle;
4834
4835 ZERO_STRUCT(devmode_ctr);
4836
4837 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4838 sharename,
4839 "RAW",
4840 devmode_ctr,
4841 PRINTER_ACCESS_USE,
4842 &handle,
4843 &werr);
4844 if (!NT_STATUS_IS_OK(status)) {
4845 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4846 goto out;
4847 }
4848 if (!W_ERROR_IS_OK(werr)) {
4849 desc.errcode = W_ERROR_V(werr);
4850 goto out;
4851 }
4852
4853 werr = rpccli_spoolss_getjob(cli, mem_ctx,
4854 &handle,
4855 jobid,
4856 2, /* level */
4857 0, /* offered */
4858 &info);
4859 if (!W_ERROR_IS_OK(werr)) {
4860 desc.errcode = W_ERROR_V(werr);
4861 goto out;
4862 }
4863
4864 if (mdrcnt > 0) {
4865 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4866 if (!*rdata) {
4867 return False;
4868 }
4869 desc.base = *rdata;
4870 desc.buflen = mdrcnt;
4871 } else {
4872 /*
4873 * Don't return data but need to get correct length
4874 * init_package will return wrong size if buflen=0
4875 */
4876 desc.buflen = getlen(desc.format);
4877 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4878 }
4879
4880 if (init_package(&desc,1,0)) {
4881 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4882 *rdata_len = desc.usedlen;
4883 } else {
4884 desc.errcode = NERR_JobNotFound;
4885 *rdata_len = 0;
4886 }
4887 out:
4888 if (b && is_valid_policy_hnd(&handle)) {
4889 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4890 }
4891
4892 *rparam_len = 6;
4893 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4894 if (!*rparam) {
4895 return False;
4896 }
4897 SSVALS(*rparam,0,desc.errcode);
4898 SSVAL(*rparam,2,0);
4899 SSVAL(*rparam,4,desc.neededlen);
4900
4901 SAFE_FREE(tmpdata);
4902
4903 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4904
4905 return True;
4906 }
4907
4908 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4909 connection_struct *conn, uint64_t vuid,
4910 char *param, int tpscnt,
4911 char *data, int tdscnt,
4912 int mdrcnt,int mprcnt,
4913 char **rdata,char **rparam,
4914 int *rdata_len,int *rparam_len)
4915 {
4916 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4917 char *str2 = skip_string(param,tpscnt,str1);
4918 char *p = skip_string(param,tpscnt,str2);
4919 char *name = p;
4920 int uLevel;
4921 int i, succnt=0;
4922 struct pack_desc desc;
4923
4924 TALLOC_CTX *mem_ctx = talloc_tos();
4925 WERROR werr;
4926 NTSTATUS status;
4927 struct rpc_pipe_client *cli = NULL;
4928 struct dcerpc_binding_handle *b = NULL;
4929 struct policy_handle handle;
4930 struct spoolss_DevmodeContainer devmode_ctr;
4931 uint32_t count = 0;
4932 union spoolss_JobInfo *info;
4933
4934 if (!str1 || !str2 || !p) {
4935 return False;
4936 }
4937
4938 memset((char *)&desc,'\0',sizeof(desc));
4939
4940 p = skip_string(param,tpscnt,p);
4941 if (!p) {
4942 return False;
4943 }
4944 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4945
4946 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4947
4948 /* check it's a supported variant */
4949 if (strcmp(str1,"zWrLeh") != 0) {
4950 return False;
4951 }
4952
4953 if (uLevel > 2) {
4954 return False; /* defined only for uLevel 0,1,2 */
4955 }
4956
4957 if (!check_printjob_info(&desc,uLevel,str2)) {
4958 return False;
4959 }
4960
4961 ZERO_STRUCT(handle);
4962
4963 status = rpc_pipe_open_interface(conn,
4964 &ndr_table_spoolss.syntax_id,
4965 conn->session_info,
4966 conn->sconn->remote_address,
4967 conn->sconn->msg_ctx,
4968 &cli);
4969 if (!NT_STATUS_IS_OK(status)) {
4970 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4971 nt_errstr(status)));
4972 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4973 goto out;
4974 }
4975 b = cli->binding_handle;
4976
4977 ZERO_STRUCT(devmode_ctr);
4978
4979 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4980 name,
4981 NULL,
4982 devmode_ctr,
4983 SEC_FLAG_MAXIMUM_ALLOWED,
4984 &handle,
4985 &werr);
4986 if (!NT_STATUS_IS_OK(status)) {
4987 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4988 goto out;
4989 }
4990 if (!W_ERROR_IS_OK(werr)) {
4991 desc.errcode = W_ERROR_V(werr);
4992 goto out;
4993 }
4994
4995 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4996 &handle,
4997 0, /* firstjob */
4998 0xff, /* numjobs */
4999 2, /* level */
5000 0, /* offered */
5001 &count,
5002 &info);
5003 if (!W_ERROR_IS_OK(werr)) {
5004 desc.errcode = W_ERROR_V(werr);
5005 goto out;
5006 }
5007
5008 if (mdrcnt > 0) {
5009 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5010 if (!*rdata) {
5011 return False;
5012 }
5013 }
5014 desc.base = *rdata;
5015 desc.buflen = mdrcnt;
5016
5017 if (init_package(&desc,count,0)) {
5018 succnt = 0;
5019 for (i = 0; i < count; i++) {
5020 fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
5021 if (desc.errcode == NERR_Success) {
5022 succnt = i+1;
5023 }
5024 }
5025 }
5026 out:
5027 if (b && is_valid_policy_hnd(&handle)) {
5028 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5029 }
5030
5031 *rdata_len = desc.usedlen;
5032
5033 *rparam_len = 8;
5034 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5035 if (!*rparam) {
5036 return False;
5037 }
5038 SSVALS(*rparam,0,desc.errcode);
5039 SSVAL(*rparam,2,0);
5040 SSVAL(*rparam,4,succnt);
5041 SSVAL(*rparam,6,count);
5042
5043 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
5044
5045 return True;
5046 }
5047
5048 static int check_printdest_info(struct pack_desc* desc,
5049 int uLevel, char* id)
5050 {
5051 desc->subformat = NULL;
5052 switch( uLevel ) {
5053 case 0:
5054 desc->format = "B9";
5055 break;
5056 case 1:
5057 desc->format = "B9B21WWzW";
5058 break;
5059 case 2:
5060 desc->format = "z";
5061 break;
5062 case 3:
5063 desc->format = "zzzWWzzzWW";
5064 break;
5065 default:
5066 DEBUG(0,("check_printdest_info: invalid level %d\n",
5067 uLevel));
5068 return False;
5069 }
5070 if (id == NULL || strcmp(desc->format,id) != 0) {
5071 DEBUG(0,("check_printdest_info: invalid string %s\n",
5072 id ? id : "<NULL>" ));
5073 return False;
5074 }
5075 return True;
5076 }
5077
5078 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
5079 struct pack_desc* desc)
5080 {
5081 char buf[100];
5082
5083 strncpy(buf, info2->printername, sizeof(buf)-1);
5084 buf[sizeof(buf)-1] = 0;
5085 strupper_m(buf);
5086
5087 if (uLevel <= 1) {
5088 PACKS(desc,"B9",buf); /* szName */
5089 if (uLevel == 1) {
5090 PACKS(desc,"B21",""); /* szUserName */
5091 PACKI(desc,"W",0); /* uJobId */
5092 PACKI(desc,"W",0); /* fsStatus */
5093 PACKS(desc,"z",""); /* pszStatus */
5094 PACKI(desc,"W",0); /* time */
5095 }
5096 }
5097
5098 if (uLevel == 2 || uLevel == 3) {
5099 PACKS(desc,"z",buf); /* pszPrinterName */
5100 if (uLevel == 3) {
5101 PACKS(desc,"z",""); /* pszUserName */
5102 PACKS(desc,"z",""); /* pszLogAddr */
5103 PACKI(desc,"W",0); /* uJobId */
5104 PACKI(desc,"W",0); /* fsStatus */
5105 PACKS(desc,"z",""); /* pszStatus */
5106 PACKS(desc,"z",""); /* pszComment */
5107 PACKS(desc,"z","NULL"); /* pszDrivers */
5108 PACKI(desc,"W",0); /* time */
5109 PACKI(desc,"W",0); /* pad1 */
5110 }
5111 }
5112 }
5113
5114 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
5115 connection_struct *conn, uint64_t vuid,
5116 char *param, int tpscnt,
5117 char *data, int tdscnt,
5118 int mdrcnt,int mprcnt,
5119 char **rdata,char **rparam,
5120 int *rdata_len,int *rparam_len)
5121 {
5122 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5123 char *str2 = skip_string(param,tpscnt,str1);
5124 char *p = skip_string(param,tpscnt,str2);
5125 char* PrinterName = p;
5126 int uLevel;
5127 struct pack_desc desc;
5128 char *tmpdata=NULL;
5129
5130 TALLOC_CTX *mem_ctx = talloc_tos();
5131 WERROR werr;
5132 NTSTATUS status;
5133 struct rpc_pipe_client *cli = NULL;
5134 struct dcerpc_binding_handle *b = NULL;
5135 struct policy_handle handle;
5136 struct spoolss_DevmodeContainer devmode_ctr;
5137 union spoolss_PrinterInfo info;
5138
5139 if (!str1 || !str2 || !p) {
5140 return False;
5141 }
5142
5143 memset((char *)&desc,'\0',sizeof(desc));
5144
5145 p = skip_string(param,tpscnt,p);
5146 if (!p) {
5147 return False;
5148 }
5149 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5150
5151 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
5152
5153 /* check it's a supported varient */
5154 if (strcmp(str1,"zWrLh") != 0) {
5155 return False;
5156 }
5157 if (!check_printdest_info(&desc,uLevel,str2)) {
5158 return False;
5159 }
5160
5161 ZERO_STRUCT(handle);
5162
5163 status = rpc_pipe_open_interface(conn,
5164 &ndr_table_spoolss.syntax_id,
5165 conn->session_info,
5166 conn->sconn->remote_address,
5167 conn->sconn->msg_ctx,
5168 &cli);
5169 if (!NT_STATUS_IS_OK(status)) {
5170 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
5171 nt_errstr(status)));
5172 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5173 goto out;
5174 }
5175 b = cli->binding_handle;
5176
5177 ZERO_STRUCT(devmode_ctr);
5178
5179 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5180 PrinterName,
5181 NULL,
5182 devmode_ctr,
5183 SEC_FLAG_MAXIMUM_ALLOWED,
5184 &handle,
5185 &werr);
5186 if (!NT_STATUS_IS_OK(status)) {
5187 *rdata_len = 0;
5188 desc.errcode = NERR_DestNotFound;
5189 desc.neededlen = 0;
5190 goto out;
5191 }
5192 if (!W_ERROR_IS_OK(werr)) {
5193 *rdata_len = 0;
5194 desc.errcode = NERR_DestNotFound;
5195 desc.neededlen = 0;
5196 goto out;
5197 }
5198
5199 werr = rpccli_spoolss_getprinter(cli, mem_ctx,
5200 &handle,
5201 2,
5202 0,
5203 &info);
5204 if (!W_ERROR_IS_OK(werr)) {
5205 *rdata_len = 0;
5206 desc.errcode = NERR_DestNotFound;
5207 desc.neededlen = 0;
5208 goto out;
5209 }
5210
5211 if (mdrcnt > 0) {
5212 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5213 if (!*rdata) {
5214 return False;
5215 }
5216 desc.base = *rdata;
5217 desc.buflen = mdrcnt;
5218 } else {
5219 /*
5220 * Don't return data but need to get correct length
5221 * init_package will return wrong size if buflen=0
5222 */
5223 desc.buflen = getlen(desc.format);
5224 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
5225 }
5226 if (init_package(&desc,1,0)) {
5227 fill_printdest_info(&info.info2, uLevel,&desc);
5228 }
5229
5230 out:
5231 if (b && is_valid_policy_hnd(&handle)) {
5232 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5233 }
5234
5235 *rdata_len = desc.usedlen;
5236
5237 *rparam_len = 6;
5238 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5239 if (!*rparam) {
5240 return False;
5241 }
5242 SSVALS(*rparam,0,desc.errcode);
5243 SSVAL(*rparam,2,0);
5244 SSVAL(*rparam,4,desc.neededlen);
5245
5246 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5247 SAFE_FREE(tmpdata);
5248
5249 return True;
5250 }
5251
5252 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5253 connection_struct *conn, uint64_t vuid,
5254 char *param, int tpscnt,
5255 char *data, int tdscnt,
5256 int mdrcnt,int mprcnt,
5257 char **rdata,char **rparam,
5258 int *rdata_len,int *rparam_len)
5259 {
5260 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5261 char *str2 = skip_string(param,tpscnt,str1);
5262 char *p = skip_string(param,tpscnt,str2);
5263 int uLevel;
5264 int queuecnt;
5265 int i, n, succnt=0;
5266 struct pack_desc desc;
5267
5268 TALLOC_CTX *mem_ctx = talloc_tos();
5269 WERROR werr;
5270 NTSTATUS status;
5271 struct rpc_pipe_client *cli = NULL;
5272 union spoolss_PrinterInfo *info;
5273 uint32_t count;
5274
5275 if (!str1 || !str2 || !p) {
5276 return False;
5277 }
5278
5279 memset((char *)&desc,'\0',sizeof(desc));
5280
5281 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5282
5283 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5284
5285 /* check it's a supported varient */
5286 if (strcmp(str1,"WrLeh") != 0) {
5287 return False;
5288 }
5289 if (!check_printdest_info(&desc,uLevel,str2)) {
5290 return False;
5291 }
5292
5293 queuecnt = 0;
5294
5295 status = rpc_pipe_open_interface(conn,
5296 &ndr_table_spoolss.syntax_id,
5297 conn->session_info,
5298 conn->sconn->remote_address,
5299 conn->sconn->msg_ctx,
5300 &cli);
5301 if (!NT_STATUS_IS_OK(status)) {
5302 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5303 nt_errstr(status)));
5304 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5305 goto out;
5306 }
5307
5308 werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5309 PRINTER_ENUM_LOCAL,
5310 cli->srv_name_slash,
5311 2,
5312 0,
5313 &count,
5314 &info);
5315 if (!W_ERROR_IS_OK(werr)) {
5316 desc.errcode = W_ERROR_V(werr);
5317 *rdata_len = 0;
5318 desc.errcode = NERR_DestNotFound;
5319 desc.neededlen = 0;
5320 goto out;
5321 }
5322
5323 queuecnt = count;
5324
5325 if (mdrcnt > 0) {
5326 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5327 if (!*rdata) {
5328 return False;
5329 }
5330 }
5331
5332 desc.base = *rdata;
5333 desc.buflen = mdrcnt;
5334 if (init_package(&desc,queuecnt,0)) {
5335 succnt = 0;
5336 n = 0;
5337 for (i = 0; i < count; i++) {
5338 fill_printdest_info(&info[i].info2, uLevel,&desc);
5339 n++;
5340 if (desc.errcode == NERR_Success) {
5341 succnt = n;
5342 }
5343 }
5344 }
5345 out:
5346 *rdata_len = desc.usedlen;
5347
5348 *rparam_len = 8;
5349 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5350 if (!*rparam) {
5351 return False;
5352 }
5353 SSVALS(*rparam,0,desc.errcode);
5354 SSVAL(*rparam,2,0);
5355 SSVAL(*rparam,4,succnt);
5356 SSVAL(*rparam,6,queuecnt);
5357
5358 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5359
5360 return True;
5361 }
5362
5363 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5364 connection_struct *conn, uint64_t vuid,
5365 char *param, int tpscnt,
5366 char *data, int tdscnt,
5367 int mdrcnt,int mprcnt,
5368 char **rdata,char **rparam,
5369 int *rdata_len,int *rparam_len)
5370 {
5371 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5372 char *str2 = skip_string(param,tpscnt,str1);
5373 char *p = skip_string(param,tpscnt,str2);
5374 int uLevel;
5375 int succnt;
5376 struct pack_desc desc;
5377
5378 if (!str1 || !str2 || !p) {
5379 return False;
5380 }
5381
5382 memset((char *)&desc,'\0',sizeof(desc));
5383
5384 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5385
5386 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5387
5388 /* check it's a supported varient */
5389 if (strcmp(str1,"WrLeh") != 0) {
5390 return False;
5391 }
5392 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5393 return False;
5394 }
5395
5396 if (mdrcnt > 0) {
5397 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5398 if (!*rdata) {
5399 return False;
5400 }
5401 }
5402 desc.base = *rdata;
5403 desc.buflen = mdrcnt;
5404 if (init_package(&desc,1,0)) {
5405 PACKS(&desc,"B41","NULL");
5406 }
5407
5408 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5409
5410 *rdata_len = desc.usedlen;
5411
5412 *rparam_len = 8;
5413 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5414 if (!*rparam) {
5415 return False;
5416 }
5417 SSVALS(*rparam,0,desc.errcode);
5418 SSVAL(*rparam,2,0);
5419 SSVAL(*rparam,4,succnt);
5420 SSVAL(*rparam,6,1);
5421
5422 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5423
5424 return True;
5425 }
5426
5427 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5428 connection_struct *conn, uint64_t vuid,
5429 char *param, int tpscnt,
5430 char *data, int tdscnt,
5431 int mdrcnt,int mprcnt,
5432 char **rdata,char **rparam,
5433 int *rdata_len,int *rparam_len)
5434 {
5435 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5436 char *str2 = skip_string(param,tpscnt,str1);
5437 char *p = skip_string(param,tpscnt,str2);
5438 int uLevel;
5439 int succnt;
5440 struct pack_desc desc;
5441
5442 if (!str1 || !str2 || !p) {
5443 return False;
5444 }
5445 memset((char *)&desc,'\0',sizeof(desc));
5446
5447 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5448
5449 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5450
5451 /* check it's a supported varient */
5452 if (strcmp(str1,"WrLeh") != 0) {
5453 return False;
5454 }
5455 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5456 return False;
5457 }
5458
5459 if (mdrcnt > 0) {
5460 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5461 if (!*rdata) {
5462 return False;
5463 }
5464 }
5465 desc.base = *rdata;
5466 desc.buflen = mdrcnt;
5467 desc.format = str2;
5468 if (init_package(&desc,1,0)) {
5469 PACKS(&desc,"B13","lpd");
5470 }
5471
5472 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5473
5474 *rdata_len = desc.usedlen;
5475
5476 *rparam_len = 8;
5477 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5478 if (!*rparam) {
5479 return False;
5480 }
5481 SSVALS(*rparam,0,desc.errcode);
5482 SSVAL(*rparam,2,0);
5483 SSVAL(*rparam,4,succnt);
5484 SSVAL(*rparam,6,1);
5485
5486 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5487
5488 return True;
5489 }
5490
5491 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5492 connection_struct *conn, uint64_t vuid,
5493 char *param, int tpscnt,
5494 char *data, int tdscnt,
5495 int mdrcnt,int mprcnt,
5496 char **rdata,char **rparam,
5497 int *rdata_len,int *rparam_len)
5498 {
5499 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5500 char *str2 = skip_string(param,tpscnt,str1);
5501 char *p = skip_string(param,tpscnt,str2);
5502 int uLevel;
5503 int succnt;
5504 struct pack_desc desc;
5505
5506 if (!str1 || !str2 || !p) {
5507 return False;
5508 }
5509
5510 memset((char *)&desc,'\0',sizeof(desc));
5511
5512 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5513
5514 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5515
5516 /* check it's a supported varient */
5517 if (strcmp(str1,"WrLeh") != 0) {
5518 return False;
5519 }
5520 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5521 return False;
5522 }
5523
5524 if (mdrcnt > 0) {
5525 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5526 if (!*rdata) {
5527 return False;
5528 }
5529 }
5530 memset((char *)&desc,'\0',sizeof(desc));
5531 desc.base = *rdata;
5532 desc.buflen = mdrcnt;
5533 desc.format = str2;
5534 if (init_package(&desc,1,0)) {
5535 PACKS(&desc,"B13","lp0");
5536 }
5537
5538 succnt = (desc.errcode == NERR_Success ? 1 : 0);
5539
5540 *rdata_len = desc.usedlen;
5541
5542 *rparam_len = 8;
5543 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5544 if (!*rparam) {
5545 return False;
5546 }
5547 SSVALS(*rparam,0,desc.errcode);
5548 SSVAL(*rparam,2,0);
5549 SSVAL(*rparam,4,succnt);
5550 SSVAL(*rparam,6,1);
5551
5552 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5553
5554 return True;
5555 }
5556
5557 /****************************************************************************
5558 List open sessions
5559 ****************************************************************************/
5560
5561 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5562 connection_struct *conn, uint64_t vuid,
5563 char *param, int tpscnt,
5564 char *data, int tdscnt,
5565 int mdrcnt,int mprcnt,
5566 char **rdata,char **rparam,
5567 int *rdata_len,int *rparam_len)
5568
5569 {
5570 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5571 char *str2 = skip_string(param,tpscnt,str1);
5572 char *p = skip_string(param,tpscnt,str2);
5573 int uLevel;
5574 struct pack_desc desc;
5575 int i;
5576
5577 TALLOC_CTX *mem_ctx = talloc_tos();
5578 WERROR werr;
5579 NTSTATUS status;
5580 struct rpc_pipe_client *cli = NULL;
5581 struct dcerpc_binding_handle *b = NULL;
5582 struct srvsvc_NetSessInfoCtr info_ctr;
5583 uint32_t totalentries, resume_handle = 0;
5584 uint32_t count = 0;
5585
5586 if (!str1 || !str2 || !p) {
5587 return False;
5588 }
5589
5590 ZERO_STRUCT(desc);
5591
5592 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5593
5594 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5595 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5596 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5597
5598 /* check it's a supported varient */
5599 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5600 return False;
5601 }
5602 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5603 return False;
5604 }
5605
5606 status = rpc_pipe_open_interface(conn,
5607 &ndr_table_srvsvc.syntax_id,
5608 conn->session_info,
5609 conn->sconn->remote_address,
5610 conn->sconn->msg_ctx,
5611 &cli);
5612 if (!NT_STATUS_IS_OK(status)) {
5613 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5614 nt_errstr(status)));
5615 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5616 goto out;
5617 }
5618 b = cli->binding_handle;
5619
5620 info_ctr.level = 1;
5621 info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5622 if (info_ctr.ctr.ctr1 == NULL) {
5623 desc.errcode = W_ERROR_V(WERR_NOMEM);
5624 goto out;
5625 }
5626
5627 status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5628 cli->srv_name_slash,
5629 NULL, /* client */
5630 NULL, /* user */
5631 &info_ctr,
5632 (uint32_t)-1, /* max_buffer */
5633 &totalentries,
5634 &resume_handle,
5635 &werr);
5636 if (!NT_STATUS_IS_OK(status)) {
5637 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5638 nt_errstr(status)));
5639 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5640 goto out;
5641 }
5642
5643 if (!W_ERROR_IS_OK(werr)) {
5644 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5645 win_errstr(werr)));
5646 desc.errcode = W_ERROR_V(werr);
5647 goto out;
5648 }
5649
5650 count = info_ctr.ctr.ctr1->count;
5651
5652 out:
5653 if (mdrcnt > 0) {
5654 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5655 if (!*rdata) {
5656 return False;
5657 }
5658 }
5659
5660 desc.base = *rdata;
5661 desc.buflen = mdrcnt;
5662 desc.format = str2;
5663 if (!init_package(&desc, count,0)) {
5664 return False;
5665 }
5666
5667 for(i=0; i < count; i++) {
5668 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5669 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5670 PACKI(&desc, "W", 1); /* num conns */
5671 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5672 PACKI(&desc, "W", 1); /* num users */
5673 PACKI(&desc, "D", 0); /* session time */
5674 PACKI(&desc, "D", 0); /* idle time */
5675 PACKI(&desc, "D", 0); /* flags */
5676 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5677 }
5678
5679 *rdata_len = desc.usedlen;
5680
5681 *rparam_len = 8;
5682 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5683 if (!*rparam) {
5684 return False;
5685 }
5686 SSVALS(*rparam,0,desc.errcode);
5687 SSVAL(*rparam,2,0); /* converter */
5688 SSVAL(*rparam,4, count); /* count */
5689
5690 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5691
5692 return True;
5693 }
5694
5695
5696 /****************************************************************************
5697 The buffer was too small.
5698 ****************************************************************************/
5699
5700 static bool api_TooSmall(struct smbd_server_connection *sconn,
5701 connection_struct *conn,uint64_t vuid, char *param, char *data,
5702 int mdrcnt, int mprcnt,
5703 char **rdata, char **rparam,
5704 int *rdata_len, int *rparam_len)
5705 {
5706 *rparam_len = MIN(*rparam_len,mprcnt);
5707 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5708 if (!*rparam) {
5709 return False;
5710 }
5711
5712 *rdata_len = 0;
5713
5714 SSVAL(*rparam,0,NERR_BufTooSmall);
5715
5716 DEBUG(3,("Supplied buffer too small in API command\n"));
5717
5718 return True;
5719 }
5720
5721 /****************************************************************************
5722 The request is not supported.
5723 ****************************************************************************/
5724
5725 static bool api_Unsupported(struct smbd_server_connection *sconn,
5726 connection_struct *conn, uint64_t vuid,
5727 char *param, int tpscnt,
5728 char *data, int tdscnt,
5729 int mdrcnt, int mprcnt,
5730 char **rdata, char **rparam,
5731 int *rdata_len, int *rparam_len)
5732 {
5733 *rparam_len = 4;
5734 *rparam = smb_realloc_limit(*rparam,*rparam_len);
5735 if (!*rparam) {
5736 return False;
5737 }
5738
5739 *rdata_len = 0;
5740
5741 SSVAL(*rparam,0,NERR_notsupported);
5742 SSVAL(*rparam,2,0); /* converter word */
5743
5744 DEBUG(3,("Unsupported API command\n"));
5745
5746 return True;
5747 }
5748
5749 static const struct {
5750 const char *name;
5751 int id;
5752 bool (*fn)(struct smbd_server_connection *sconn,
5753 connection_struct *, uint64_t,
5754 char *, int,
5755 char *, int,
5756 int,int,char **,char **,int *,int *);
5757 bool auth_user; /* Deny anonymous access? */
5758 } api_commands[] = {
5759 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
5760 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
5761 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
5762 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
5763 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
5764 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
5765 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
5766 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
5767 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
5768 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
5769 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
5770 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
5771 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
5772 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
5773 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
5774 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
5775 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
5776 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
5777 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
5778 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
5779 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
5780 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
5781 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
5782 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
5783 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
5784 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
5785 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5786 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
5787 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
5788 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
5789 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
5790 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5791 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
5792 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5793 {NULL, -1, api_Unsupported}
5794 /* The following RAP calls are not implemented by Samba:
5795
5796 RAP_WFileEnum2 - anon not OK
5797 */
5798 };
5799
5800
5801 /****************************************************************************
5802 Handle remote api calls.
5803 ****************************************************************************/
5804
5805 void api_reply(connection_struct *conn, uint64_t vuid,
5806 struct smb_request *req,
5807 char *data, char *params,
5808 int tdscnt, int tpscnt,
5809 int mdrcnt, int mprcnt)
5810 {
5811 int api_command;
5812 char *rdata = NULL;
5813 char *rparam = NULL;
5814 const char *name1 = NULL;
5815 const char *name2 = NULL;
5816 int rdata_len = 0;
5817 int rparam_len = 0;
5818 bool reply=False;
5819 int i;
5820
5821 if (!params) {
5822 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5823 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5824 return;
5825 }
5826
5827 if (tpscnt < 2) {
5828 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5829 return;
5830 }
5831 api_command = SVAL(params,0);
5832 /* Is there a string at position params+2 ? */
5833 if (skip_string(params,tpscnt,params+2)) {
5834 name1 = params + 2;
5835 } else {
5836 name1 = "";
5837 }
5838 name2 = skip_string(params,tpscnt,params+2);
5839 if (!name2) {
5840 name2 = "";
5841 }
5842
5843 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5844 api_command,
5845 name1,
5846 name2,
5847 tdscnt,tpscnt,mdrcnt,mprcnt));
5848
5849 for (i=0;api_commands[i].name;i++) {
5850 if (api_commands[i].id == api_command && api_commands[i].fn) {
5851 DEBUG(3,("Doing %s\n",api_commands[i].name));
5852 break;
5853 }
5854 }
5855
5856 /* Check whether this api call can be done anonymously */
5857
5858 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5859 struct user_struct *user = get_valid_user_struct(req->sconn, vuid);
5860
5861 if (!user || security_session_user_level(user->session_info, NULL) < SECURITY_USER) {
5862 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5863 return;
5864 }
5865 }
5866
5867 rdata = (char *)SMB_MALLOC(1024);
5868 if (rdata) {
5869 memset(rdata,'\0',1024);
5870 }
5871
5872 rparam = (char *)SMB_MALLOC(1024);
5873 if (rparam) {
5874 memset(rparam,'\0',1024);
5875 }
5876
5877 if(!rdata || !rparam) {
5878 DEBUG(0,("api_reply: malloc fail !\n"));
5879 SAFE_FREE(rdata);
5880 SAFE_FREE(rparam);
5881 reply_nterror(req, NT_STATUS_NO_MEMORY);
5882 return;
5883 }
5884
5885 reply = api_commands[i].fn(req->sconn, conn,
5886 vuid,
5887 params,tpscnt, /* params + length */
5888 data,tdscnt, /* data + length */
5889 mdrcnt,mprcnt,
5890 &rdata,&rparam,&rdata_len,&rparam_len);
5891
5892
5893 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5894 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5895 mdrcnt,mprcnt,
5896 &rdata,&rparam,&rdata_len,&rparam_len);
5897 }
5898
5899 /* if we get False back then it's actually unsupported */
5900 if (!reply) {
5901 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5902 data,
5903 tdscnt,mdrcnt,mprcnt,
5904 &rdata,&rparam,&rdata_len,&rparam_len);
5905 }
5906
5907 /* If api_Unsupported returns false we can't return anything. */
5908 if (reply) {
5909 send_trans_reply(conn, req, rparam, rparam_len,
5910 rdata, rdata_len, False);
5911 }
5912
5913 SAFE_FREE(rdata);
5914 SAFE_FREE(rparam);
5915 return;
5916 }
reg import