?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: use StrCaseCmp() instead of strcasecmp
[Samba/nascimento.git] / source3 / smbd / lanman.c
blobeed0cd2fe62c1f5ddbed47c8eb64572f100c85e0
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 SMB Version handling
8 Copyright (C) John H Terpstra 1995-1998
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23 /*
24 This file handles the named pipe and mailslot calls
25 in the SMBtrans protocol
26 */
27
28 #include "includes.h"
29 #include "smbd/globals.h"
30 #include "../librpc/gen_ndr/cli_samr.h"
31 #include "../librpc/gen_ndr/srv_samr.h"
32 #include "../lib/util/binsearch.h"
33
34 #ifdef CHECK_TYPES
35 #undef CHECK_TYPES
36 #endif
37 #define CHECK_TYPES 0
38
39 #define NERR_Success 0
40 #define NERR_badpass 86
41 #define NERR_notsupported 50
42
43 #define NERR_BASE (2100)
44 #define NERR_BufTooSmall (NERR_BASE+23)
45 #define NERR_JobNotFound (NERR_BASE+51)
46 #define NERR_DestNotFound (NERR_BASE+52)
47
48 #define ACCESS_READ 0x01
49 #define ACCESS_WRITE 0x02
50 #define ACCESS_CREATE 0x04
51
52 #define SHPWLEN 8 /* share password length */
53
54 /* Limit size of ipc replies */
55
56 static char *smb_realloc_limit(void *ptr, size_t size)
57 {
58 char *val;
59
60 size = MAX((size),4*1024);
61 val = (char *)SMB_REALLOC(ptr,size);
62 if (val) {
63 memset(val,'\0',size);
64 }
65 return val;
66 }
67
68 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
69 char *param, int tpscnt,
70 char *data, int tdscnt,
71 int mdrcnt, int mprcnt,
72 char **rdata, char **rparam,
73 int *rdata_len, int *rparam_len);
74
75 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
76 int mdrcnt, int mprcnt,
77 char **rdata, char **rparam,
78 int *rdata_len, int *rparam_len);
79
80
81 static int CopyExpanded(connection_struct *conn,
82 int snum, char **dst, char *src, int *p_space_remaining)
83 {
84 TALLOC_CTX *ctx = talloc_tos();
85 char *buf = NULL;
86 int l;
87
88 if (!src || !dst || !p_space_remaining || !(*dst) ||
89 *p_space_remaining <= 0) {
90 return 0;
91 }
92
93 buf = talloc_strdup(ctx, src);
94 if (!buf) {
95 *p_space_remaining = 0;
96 return 0;
97 }
98 buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
99 if (!buf) {
100 *p_space_remaining = 0;
101 return 0;
102 }
103 buf = talloc_sub_advanced(ctx,
104 lp_servicename(SNUM(conn)),
105 conn->server_info->unix_name,
106 conn->connectpath,
107 conn->server_info->utok.gid,
108 conn->server_info->sanitized_username,
109 pdb_get_domain(conn->server_info->sam_account),
110 buf);
111 if (!buf) {
112 *p_space_remaining = 0;
113 return 0;
114 }
115 l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
116 if (l == -1) {
117 return 0;
118 }
119 (*dst) += l;
120 (*p_space_remaining) -= l;
121 return l;
122 }
123
124 static int CopyAndAdvance(char **dst, char *src, int *n)
125 {
126 int l;
127 if (!src || !dst || !n || !(*dst)) {
128 return 0;
129 }
130 l = push_ascii(*dst,src,*n, STR_TERMINATE);
131 if (l == -1) {
132 return 0;
133 }
134 (*dst) += l;
135 (*n) -= l;
136 return l;
137 }
138
139 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
140 {
141 TALLOC_CTX *ctx = talloc_tos();
142 char *buf = NULL;
143 if (!s) {
144 return 0;
145 }
146 buf = talloc_strdup(ctx,s);
147 if (!buf) {
148 return 0;
149 }
150 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
151 if (!buf) {
152 return 0;
153 }
154 buf = talloc_sub_advanced(ctx,
155 lp_servicename(SNUM(conn)),
156 conn->server_info->unix_name,
157 conn->connectpath,
158 conn->server_info->utok.gid,
159 conn->server_info->sanitized_username,
160 pdb_get_domain(conn->server_info->sam_account),
161 buf);
162 if (!buf) {
163 return 0;
164 }
165 return strlen(buf) + 1;
166 }
167
168 static char *Expand(connection_struct *conn, int snum, char *s)
169 {
170 TALLOC_CTX *ctx = talloc_tos();
171 char *buf = NULL;
172
173 if (!s) {
174 return NULL;
175 }
176 buf = talloc_strdup(ctx,s);
177 if (!buf) {
178 return 0;
179 }
180 buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
181 if (!buf) {
182 return 0;
183 }
184 return talloc_sub_advanced(ctx,
185 lp_servicename(SNUM(conn)),
186 conn->server_info->unix_name,
187 conn->connectpath,
188 conn->server_info->utok.gid,
189 conn->server_info->sanitized_username,
190 pdb_get_domain(conn->server_info->sam_account),
191 buf);
192 }
193
194 /*******************************************************************
195 Check a API string for validity when we only need to check the prefix.
196 ******************************************************************/
197
198 static bool prefix_ok(const char *str, const char *prefix)
199 {
200 return(strncmp(str,prefix,strlen(prefix)) == 0);
201 }
202
203 struct pack_desc {
204 const char *format; /* formatstring for structure */
205 const char *subformat; /* subformat for structure */
206 char *base; /* baseaddress of buffer */
207 int buflen; /* remaining size for fixed part; on init: length of base */
208 int subcount; /* count of substructures */
209 char *structbuf; /* pointer into buffer for remaining fixed part */
210 int stringlen; /* remaining size for variable part */
211 char *stringbuf; /* pointer into buffer for remaining variable part */
212 int neededlen; /* total needed size */
213 int usedlen; /* total used size (usedlen <= neededlen and usedlen <= buflen) */
214 const char *curpos; /* current position; pointer into format or subformat */
215 int errcode;
216 };
217
218 static int get_counter(const char **p)
219 {
220 int i, n;
221 if (!p || !(*p)) {
222 return 1;
223 }
224 if (!isdigit((int)**p)) {
225 return 1;
226 }
227 for (n = 0;;) {
228 i = **p;
229 if (isdigit(i)) {
230 n = 10 * n + (i - '0');
231 } else {
232 return n;
233 }
234 (*p)++;
235 }
236 }
237
238 static int getlen(const char *p)
239 {
240 int n = 0;
241 if (!p) {
242 return 0;
243 }
244
245 while (*p) {
246 switch( *p++ ) {
247 case 'W': /* word (2 byte) */
248 n += 2;
249 break;
250 case 'K': /* status word? (2 byte) */
251 n += 2;
252 break;
253 case 'N': /* count of substructures (word) at end */
254 n += 2;
255 break;
256 case 'D': /* double word (4 byte) */
257 case 'z': /* offset to zero terminated string (4 byte) */
258 case 'l': /* offset to user data (4 byte) */
259 n += 4;
260 break;
261 case 'b': /* offset to data (with counter) (4 byte) */
262 n += 4;
263 get_counter(&p);
264 break;
265 case 'B': /* byte (with optional counter) */
266 n += get_counter(&p);
267 break;
268 }
269 }
270 return n;
271 }
272
273 static bool init_package(struct pack_desc *p, int count, int subcount)
274 {
275 int n = p->buflen;
276 int i;
277
278 if (!p->format || !p->base) {
279 return False;
280 }
281
282 i = count * getlen(p->format);
283 if (p->subformat) {
284 i += subcount * getlen(p->subformat);
285 }
286 p->structbuf = p->base;
287 p->neededlen = 0;
288 p->usedlen = 0;
289 p->subcount = 0;
290 p->curpos = p->format;
291 if (i > n) {
292 p->neededlen = i;
293 i = n = 0;
294 #if 0
295 /*
296 * This is the old error code we used. Aparently
297 * WinNT/2k systems return ERRbuftoosmall (2123) and
298 * OS/2 needs this. I'm leaving this here so we can revert
299 * if needed. JRA.
300 */
301 p->errcode = ERRmoredata;
302 #else
303 p->errcode = ERRbuftoosmall;
304 #endif
305 } else {
306 p->errcode = NERR_Success;
307 }
308 p->buflen = i;
309 n -= i;
310 p->stringbuf = p->base + i;
311 p->stringlen = n;
312 return (p->errcode == NERR_Success);
313 }
314
315 static int package(struct pack_desc *p, ...)
316 {
317 va_list args;
318 int needed=0, stringneeded;
319 const char *str=NULL;
320 int is_string=0, stringused;
321 int32 temp;
322
323 va_start(args,p);
324
325 if (!*p->curpos) {
326 if (!p->subcount) {
327 p->curpos = p->format;
328 } else {
329 p->curpos = p->subformat;
330 p->subcount--;
331 }
332 }
333 #if CHECK_TYPES
334 str = va_arg(args,char*);
335 SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
336 #endif
337 stringneeded = -1;
338
339 if (!p->curpos) {
340 va_end(args);
341 return 0;
342 }
343
344 switch( *p->curpos++ ) {
345 case 'W': /* word (2 byte) */
346 needed = 2;
347 temp = va_arg(args,int);
348 if (p->buflen >= needed) {
349 SSVAL(p->structbuf,0,temp);
350 }
351 break;
352 case 'K': /* status word? (2 byte) */
353 needed = 2;
354 temp = va_arg(args,int);
355 if (p->buflen >= needed) {
356 SSVAL(p->structbuf,0,temp);
357 }
358 break;
359 case 'N': /* count of substructures (word) at end */
360 needed = 2;
361 p->subcount = va_arg(args,int);
362 if (p->buflen >= needed) {
363 SSVAL(p->structbuf,0,p->subcount);
364 }
365 break;
366 case 'D': /* double word (4 byte) */
367 needed = 4;
368 temp = va_arg(args,int);
369 if (p->buflen >= needed) {
370 SIVAL(p->structbuf,0,temp);
371 }
372 break;
373 case 'B': /* byte (with optional counter) */
374 needed = get_counter(&p->curpos);
375 {
376 char *s = va_arg(args,char*);
377 if (p->buflen >= needed) {
378 StrnCpy(p->structbuf,s?s:"",needed-1);
379 }
380 }
381 break;
382 case 'z': /* offset to zero terminated string (4 byte) */
383 str = va_arg(args,char*);
384 stringneeded = (str ? strlen(str)+1 : 0);
385 is_string = 1;
386 break;
387 case 'l': /* offset to user data (4 byte) */
388 str = va_arg(args,char*);
389 stringneeded = va_arg(args,int);
390 is_string = 0;
391 break;
392 case 'b': /* offset to data (with counter) (4 byte) */
393 str = va_arg(args,char*);
394 stringneeded = get_counter(&p->curpos);
395 is_string = 0;
396 break;
397 }
398
399 va_end(args);
400 if (stringneeded >= 0) {
401 needed = 4;
402 if (p->buflen >= needed) {
403 stringused = stringneeded;
404 if (stringused > p->stringlen) {
405 stringused = (is_string ? p->stringlen : 0);
406 if (p->errcode == NERR_Success) {
407 p->errcode = ERRmoredata;
408 }
409 }
410 if (!stringused) {
411 SIVAL(p->structbuf,0,0);
412 } else {
413 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
414 memcpy(p->stringbuf,str?str:"",stringused);
415 if (is_string) {
416 p->stringbuf[stringused-1] = '\0';
417 }
418 p->stringbuf += stringused;
419 p->stringlen -= stringused;
420 p->usedlen += stringused;
421 }
422 }
423 p->neededlen += stringneeded;
424 }
425
426 p->neededlen += needed;
427 if (p->buflen >= needed) {
428 p->structbuf += needed;
429 p->buflen -= needed;
430 p->usedlen += needed;
431 } else {
432 if (p->errcode == NERR_Success) {
433 p->errcode = ERRmoredata;
434 }
435 }
436 return 1;
437 }
438
439 #if CHECK_TYPES
440 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
441 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
442 #else
443 #define PACK(desc,t,v) package(desc,v)
444 #define PACKl(desc,t,v,l) package(desc,v,l)
445 #endif
446
447 static void PACKI(struct pack_desc* desc, const char *t,int v)
448 {
449 PACK(desc,t,v);
450 }
451
452 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
453 {
454 PACK(desc,t,v);
455 }
456
457 /****************************************************************************
458 Get a print queue.
459 ****************************************************************************/
460
461 static void PackDriverData(struct pack_desc* desc)
462 {
463 char drivdata[4+4+32];
464 SIVAL(drivdata,0,sizeof drivdata); /* cb */
465 SIVAL(drivdata,4,1000); /* lVersion */
466 memset(drivdata+8,0,32); /* szDeviceName */
467 push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
468 PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
469 }
470
471 static int check_printq_info(struct pack_desc* desc,
472 unsigned int uLevel, char *id1, char *id2)
473 {
474 desc->subformat = NULL;
475 switch( uLevel ) {
476 case 0:
477 desc->format = "B13";
478 break;
479 case 1:
480 desc->format = "B13BWWWzzzzzWW";
481 break;
482 case 2:
483 desc->format = "B13BWWWzzzzzWN";
484 desc->subformat = "WB21BB16B10zWWzDDz";
485 break;
486 case 3:
487 desc->format = "zWWWWzzzzWWzzl";
488 break;
489 case 4:
490 desc->format = "zWWWWzzzzWNzzl";
491 desc->subformat = "WWzWWDDzz";
492 break;
493 case 5:
494 desc->format = "z";
495 break;
496 case 51:
497 desc->format = "K";
498 break;
499 case 52:
500 desc->format = "WzzzzzzzzN";
501 desc->subformat = "z";
502 break;
503 default:
504 DEBUG(0,("check_printq_info: invalid level %d\n",
505 uLevel ));
506 return False;
507 }
508 if (id1 == NULL || strcmp(desc->format,id1) != 0) {
509 DEBUG(0,("check_printq_info: invalid format %s\n",
510 id1 ? id1 : "<NULL>" ));
511 return False;
512 }
513 if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
514 DEBUG(0,("check_printq_info: invalid subformat %s\n",
515 id2 ? id2 : "<NULL>" ));
516 return False;
517 }
518 return True;
519 }
520
521
522 #define RAP_JOB_STATUS_QUEUED 0
523 #define RAP_JOB_STATUS_PAUSED 1
524 #define RAP_JOB_STATUS_SPOOLING 2
525 #define RAP_JOB_STATUS_PRINTING 3
526 #define RAP_JOB_STATUS_PRINTED 4
527
528 #define RAP_QUEUE_STATUS_PAUSED 1
529 #define RAP_QUEUE_STATUS_ERROR 2
530
531 /* turn a print job status into a on the wire status
532 */
533 static int printj_status(int v)
534 {
535 switch (v) {
536 case LPQ_QUEUED:
537 return RAP_JOB_STATUS_QUEUED;
538 case LPQ_PAUSED:
539 return RAP_JOB_STATUS_PAUSED;
540 case LPQ_SPOOLING:
541 return RAP_JOB_STATUS_SPOOLING;
542 case LPQ_PRINTING:
543 return RAP_JOB_STATUS_PRINTING;
544 }
545 return 0;
546 }
547
548 /* turn a print queue status into a on the wire status
549 */
550 static int printq_status(int v)
551 {
552 switch (v) {
553 case LPQ_QUEUED:
554 return 0;
555 case LPQ_PAUSED:
556 return RAP_QUEUE_STATUS_PAUSED;
557 }
558 return RAP_QUEUE_STATUS_ERROR;
559 }
560
561 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
562 struct pack_desc *desc,
563 print_queue_struct *queue, int n)
564 {
565 time_t t = queue->time;
566
567 /* the client expects localtime */
568 t -= get_time_zone(t);
569
570 PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
571 if (uLevel == 1) {
572 PACKS(desc,"B21",queue->fs_user); /* szUserName */
573 PACKS(desc,"B",""); /* pad */
574 PACKS(desc,"B16",""); /* szNotifyName */
575 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
576 PACKS(desc,"z",""); /* pszParms */
577 PACKI(desc,"W",n+1); /* uPosition */
578 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
579 PACKS(desc,"z",""); /* pszStatus */
580 PACKI(desc,"D",t); /* ulSubmitted */
581 PACKI(desc,"D",queue->size); /* ulSize */
582 PACKS(desc,"z",queue->fs_file); /* pszComment */
583 }
584 if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
585 PACKI(desc,"W",queue->priority); /* uPriority */
586 PACKS(desc,"z",queue->fs_user); /* pszUserName */
587 PACKI(desc,"W",n+1); /* uPosition */
588 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
589 PACKI(desc,"D",t); /* ulSubmitted */
590 PACKI(desc,"D",queue->size); /* ulSize */
591 PACKS(desc,"z","Samba"); /* pszComment */
592 PACKS(desc,"z",queue->fs_file); /* pszDocument */
593 if (uLevel == 3) {
594 PACKS(desc,"z",""); /* pszNotifyName */
595 PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
596 PACKS(desc,"z",""); /* pszParms */
597 PACKS(desc,"z",""); /* pszStatus */
598 PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
599 PACKS(desc,"z","lpd"); /* pszQProcName */
600 PACKS(desc,"z",""); /* pszQProcParms */
601 PACKS(desc,"z","NULL"); /* pszDriverName */
602 PackDriverData(desc); /* pDriverData */
603 PACKS(desc,"z",""); /* pszPrinterName */
604 } else if (uLevel == 4) { /* OS2 */
605 PACKS(desc,"z",""); /* pszSpoolFileName */
606 PACKS(desc,"z",""); /* pszPortName */
607 PACKS(desc,"z",""); /* pszStatus */
608 PACKI(desc,"D",0); /* ulPagesSpooled */
609 PACKI(desc,"D",0); /* ulPagesSent */
610 PACKI(desc,"D",0); /* ulPagesPrinted */
611 PACKI(desc,"D",0); /* ulTimePrinted */
612 PACKI(desc,"D",0); /* ulExtendJobStatus */
613 PACKI(desc,"D",0); /* ulStartPage */
614 PACKI(desc,"D",0); /* ulEndPage */
615 }
616 }
617 }
618
619 /********************************************************************
620 Return a driver name given an snum.
621 Returns True if from tdb, False otherwise.
622 ********************************************************************/
623
624 static bool get_driver_name(int snum, char **pp_drivername)
625 {
626 NT_PRINTER_INFO_LEVEL *info = NULL;
627 bool in_tdb = false;
628
629 get_a_printer (NULL, &info, 2, lp_servicename(snum));
630 if (info != NULL) {
631 *pp_drivername = talloc_strdup(talloc_tos(),
632 info->info_2->drivername);
633 in_tdb = true;
634 free_a_printer(&info, 2);
635 if (!*pp_drivername) {
636 return false;
637 }
638 }
639
640 return in_tdb;
641 }
642
643 /********************************************************************
644 Respond to the DosPrintQInfo command with a level of 52
645 This is used to get printer driver information for Win9x clients
646 ********************************************************************/
647 static void fill_printq_info_52(connection_struct *conn, int snum,
648 struct pack_desc* desc, int count )
649 {
650 int i;
651 fstring location;
652 struct spoolss_DriverInfo8 *driver = NULL;
653 NT_PRINTER_INFO_LEVEL *printer = NULL;
654
655 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
656 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
657 lp_servicename(snum)));
658 goto err;
659 }
660
661 if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
662 "Windows 4.0", 0)) )
663 {
664 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
665 printer->info_2->drivername));
666 goto err;
667 }
668
669 trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
670 trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
671 trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
672
673 PACKI(desc, "W", 0x0400); /* don't know */
674 PACKS(desc, "z", driver->driver_name); /* long printer name */
675 PACKS(desc, "z", driver->driver_path); /* Driverfile Name */
676 PACKS(desc, "z", driver->data_file); /* Datafile name */
677 PACKS(desc, "z", driver->monitor_name); /* language monitor */
678
679 fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
680 standard_sub_basic( "", "", location, sizeof(location)-1 );
681 PACKS(desc,"z", location); /* share to retrieve files */
682
683 PACKS(desc,"z", driver->default_datatype); /* default data type */
684 PACKS(desc,"z", driver->help_file); /* helpfile name */
685 PACKS(desc,"z", driver->driver_path); /* driver name */
686
687 DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
688 DEBUG(3,("Driver: %s:\n",driver->driver_path));
689 DEBUG(3,("Data File: %s:\n",driver->data_file));
690 DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
691 DEBUG(3,("Driver Location: %s:\n",location));
692 DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
693 DEBUG(3,("Help File: %s:\n",driver->help_file));
694 PACKI(desc,"N",count); /* number of files to copy */
695
696 for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
697 {
698 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
699 PACKS(desc,"z",driver->dependent_files[i]); /* driver files to copy */
700 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
701 }
702
703 /* sanity check */
704 if ( i != count )
705 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
706 count, i));
707
708 DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
709
710 desc->errcode=NERR_Success;
711 goto done;
712
713 err:
714 DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
715 desc->errcode=NERR_notsupported;
716
717 done:
718 if ( printer )
719 free_a_printer( &printer, 2 );
720
721 free_a_printer_driver(driver);
722 }
723
724
725 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
726 struct pack_desc* desc,
727 int count, print_queue_struct* queue,
728 print_status_struct* status)
729 {
730 switch (uLevel) {
731 case 1:
732 case 2:
733 PACKS(desc,"B13",SERVICE(snum));
734 break;
735 case 3:
736 case 4:
737 case 5:
738 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
739 break;
740 case 51:
741 PACKI(desc,"K",printq_status(status->status));
742 break;
743 }
744
745 if (uLevel == 1 || uLevel == 2) {
746 PACKS(desc,"B",""); /* alignment */
747 PACKI(desc,"W",5); /* priority */
748 PACKI(desc,"W",0); /* start time */
749 PACKI(desc,"W",0); /* until time */
750 PACKS(desc,"z",""); /* pSepFile */
751 PACKS(desc,"z","lpd"); /* pPrProc */
752 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
753 PACKS(desc,"z",""); /* pParms */
754 if (snum < 0) {
755 PACKS(desc,"z","UNKNOWN PRINTER");
756 PACKI(desc,"W",LPSTAT_ERROR);
757 }
758 else if (!status || !status->message[0]) {
759 PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
760 PACKI(desc,"W",LPSTAT_OK); /* status */
761 } else {
762 PACKS(desc,"z",status->message);
763 PACKI(desc,"W",printq_status(status->status)); /* status */
764 }
765 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
766 }
767
768 if (uLevel == 3 || uLevel == 4) {
769 char *drivername = NULL;
770
771 PACKI(desc,"W",5); /* uPriority */
772 PACKI(desc,"W",0); /* uStarttime */
773 PACKI(desc,"W",0); /* uUntiltime */
774 PACKI(desc,"W",5); /* pad1 */
775 PACKS(desc,"z",""); /* pszSepFile */
776 PACKS(desc,"z","WinPrint"); /* pszPrProc */
777 PACKS(desc,"z",NULL); /* pszParms */
778 PACKS(desc,"z",NULL); /* pszComment - don't ask.... JRA */
779 /* "don't ask" that it's done this way to fix corrupted
780 Win9X/ME printer comments. */
781 if (!status) {
782 PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
783 } else {
784 PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
785 }
786 PACKI(desc,(uLevel == 3 ? "W" : "N"),count); /* cJobs */
787 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
788 get_driver_name(snum,&drivername);
789 if (!drivername) {
790 return;
791 }
792 PACKS(desc,"z",drivername); /* pszDriverName */
793 PackDriverData(desc); /* pDriverData */
794 }
795
796 if (uLevel == 2 || uLevel == 4) {
797 int i;
798 for (i=0;i<count;i++)
799 fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
800 }
801
802 if (uLevel==52)
803 fill_printq_info_52( conn, snum, desc, count );
804 }
805
806 /* This function returns the number of files for a given driver */
807 static int get_printerdrivernumber(int snum)
808 {
809 int result = 0;
810 struct spoolss_DriverInfo8 *driver;
811 NT_PRINTER_INFO_LEVEL *printer = NULL;
812
813 ZERO_STRUCT(driver);
814
815 if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
816 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
817 lp_servicename(snum)));
818 goto done;
819 }
820
821 if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
822 "Windows 4.0", 0)) )
823 {
824 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
825 printer->info_2->drivername));
826 goto done;
827 }
828
829 /* count the number of files */
830 while (driver->dependent_files && *driver->dependent_files[result])
831 result++;
832 done:
833 if ( printer )
834 free_a_printer( &printer, 2 );
835
836 free_a_printer_driver(driver);
837
838 return result;
839 }
840
841 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
842 char *param, int tpscnt,
843 char *data, int tdscnt,
844 int mdrcnt,int mprcnt,
845 char **rdata,char **rparam,
846 int *rdata_len,int *rparam_len)
847 {
848 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
849 char *str2 = skip_string(param,tpscnt,str1);
850 char *p = skip_string(param,tpscnt,str2);
851 char *QueueName = p;
852 unsigned int uLevel;
853 int count=0;
854 int snum;
855 char *str3;
856 struct pack_desc desc;
857 print_queue_struct *queue=NULL;
858 print_status_struct status;
859 char* tmpdata=NULL;
860
861 if (!str1 || !str2 || !p) {
862 return False;
863 }
864 memset((char *)&status,'\0',sizeof(status));
865 memset((char *)&desc,'\0',sizeof(desc));
866
867 p = skip_string(param,tpscnt,p);
868 if (!p) {
869 return False;
870 }
871 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
872 str3 = get_safe_str_ptr(param,tpscnt,p,4);
873 /* str3 may be null here and is checked in check_printq_info(). */
874
875 /* remove any trailing username */
876 if ((p = strchr_m(QueueName,'%')))
877 *p = 0;
878
879 DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
880
881 /* check it's a supported varient */
882 if (!prefix_ok(str1,"zWrLh"))
883 return False;
884 if (!check_printq_info(&desc,uLevel,str2,str3)) {
885 /*
886 * Patch from Scott Moomaw <scott@bridgewater.edu>
887 * to return the 'invalid info level' error if an
888 * unknown level was requested.
889 */
890 *rdata_len = 0;
891 *rparam_len = 6;
892 *rparam = smb_realloc_limit(*rparam,*rparam_len);
893 if (!*rparam) {
894 return False;
895 }
896 SSVALS(*rparam,0,ERRunknownlevel);
897 SSVAL(*rparam,2,0);
898 SSVAL(*rparam,4,0);
899 return(True);
900 }
901
902 snum = find_service(QueueName);
903 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
904 return False;
905
906 if (uLevel==52) {
907 count = get_printerdrivernumber(snum);
908 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
909 } else {
910 count = print_queue_status(snum, &queue,&status);
911 }
912
913 if (mdrcnt > 0) {
914 *rdata = smb_realloc_limit(*rdata,mdrcnt);
915 if (!*rdata) {
916 SAFE_FREE(queue);
917 return False;
918 }
919 desc.base = *rdata;
920 desc.buflen = mdrcnt;
921 } else {
922 /*
923 * Don't return data but need to get correct length
924 * init_package will return wrong size if buflen=0
925 */
926 desc.buflen = getlen(desc.format);
927 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
928 }
929
930 if (init_package(&desc,1,count)) {
931 desc.subcount = count;
932 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
933 }
934
935 *rdata_len = desc.usedlen;
936
937 /*
938 * We must set the return code to ERRbuftoosmall
939 * in order to support lanman style printing with Win NT/2k
940 * clients --jerry
941 */
942 if (!mdrcnt && lp_disable_spoolss())
943 desc.errcode = ERRbuftoosmall;
944
945 *rdata_len = desc.usedlen;
946 *rparam_len = 6;
947 *rparam = smb_realloc_limit(*rparam,*rparam_len);
948 if (!*rparam) {
949 SAFE_FREE(queue);
950 SAFE_FREE(tmpdata);
951 return False;
952 }
953 SSVALS(*rparam,0,desc.errcode);
954 SSVAL(*rparam,2,0);
955 SSVAL(*rparam,4,desc.neededlen);
956
957 DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
958
959 SAFE_FREE(queue);
960 SAFE_FREE(tmpdata);
961
962 return(True);
963 }
964
965 /****************************************************************************
966 View list of all print jobs on all queues.
967 ****************************************************************************/
968
969 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
970 char *param, int tpscnt,
971 char *data, int tdscnt,
972 int mdrcnt, int mprcnt,
973 char **rdata, char** rparam,
974 int *rdata_len, int *rparam_len)
975 {
976 char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
977 char *output_format1 = skip_string(param,tpscnt,param_format);
978 char *p = skip_string(param,tpscnt,output_format1);
979 unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
980 char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
981 int services = lp_numservices();
982 int i, n;
983 struct pack_desc desc;
984 print_queue_struct **queue = NULL;
985 print_status_struct *status = NULL;
986 int *subcntarr = NULL;
987 int queuecnt = 0, subcnt = 0, succnt = 0;
988
989 if (!param_format || !output_format1 || !p) {
990 return False;
991 }
992
993 memset((char *)&desc,'\0',sizeof(desc));
994
995 DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
996
997 if (!prefix_ok(param_format,"WrLeh")) {
998 return False;
999 }
1000 if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1001 /*
1002 * Patch from Scott Moomaw <scott@bridgewater.edu>
1003 * to return the 'invalid info level' error if an
1004 * unknown level was requested.
1005 */
1006 *rdata_len = 0;
1007 *rparam_len = 6;
1008 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1009 if (!*rparam) {
1010 return False;
1011 }
1012 SSVALS(*rparam,0,ERRunknownlevel);
1013 SSVAL(*rparam,2,0);
1014 SSVAL(*rparam,4,0);
1015 return(True);
1016 }
1017
1018 for (i = 0; i < services; i++) {
1019 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1020 queuecnt++;
1021 }
1022 }
1023
1024 if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1025 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1026 goto err;
1027 }
1028 memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1029 if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1030 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1031 goto err;
1032 }
1033 memset(status,0,queuecnt*sizeof(print_status_struct));
1034 if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1035 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1036 goto err;
1037 }
1038
1039 subcnt = 0;
1040 n = 0;
1041 for (i = 0; i < services; i++) {
1042 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1043 subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1044 subcnt += subcntarr[n];
1045 n++;
1046 }
1047 }
1048
1049 if (mdrcnt > 0) {
1050 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1051 if (!*rdata) {
1052 goto err;
1053 }
1054 }
1055 desc.base = *rdata;
1056 desc.buflen = mdrcnt;
1057
1058 if (init_package(&desc,queuecnt,subcnt)) {
1059 n = 0;
1060 succnt = 0;
1061 for (i = 0; i < services; i++) {
1062 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1063 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1064 n++;
1065 if (desc.errcode == NERR_Success) {
1066 succnt = n;
1067 }
1068 }
1069 }
1070 }
1071
1072 SAFE_FREE(subcntarr);
1073
1074 *rdata_len = desc.usedlen;
1075 *rparam_len = 8;
1076 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1077 if (!*rparam) {
1078 goto err;
1079 }
1080 SSVALS(*rparam,0,desc.errcode);
1081 SSVAL(*rparam,2,0);
1082 SSVAL(*rparam,4,succnt);
1083 SSVAL(*rparam,6,queuecnt);
1084
1085 for (i = 0; i < queuecnt; i++) {
1086 if (queue) {
1087 SAFE_FREE(queue[i]);
1088 }
1089 }
1090
1091 SAFE_FREE(queue);
1092 SAFE_FREE(status);
1093
1094 return True;
1095
1096 err:
1097
1098 SAFE_FREE(subcntarr);
1099 for (i = 0; i < queuecnt; i++) {
1100 if (queue) {
1101 SAFE_FREE(queue[i]);
1102 }
1103 }
1104 SAFE_FREE(queue);
1105 SAFE_FREE(status);
1106
1107 return False;
1108 }
1109
1110 /****************************************************************************
1111 Get info level for a server list query.
1112 ****************************************************************************/
1113
1114 static bool check_server_info(int uLevel, char* id)
1115 {
1116 switch( uLevel ) {
1117 case 0:
1118 if (strcmp(id,"B16") != 0) {
1119 return False;
1120 }
1121 break;
1122 case 1:
1123 if (strcmp(id,"B16BBDz") != 0) {
1124 return False;
1125 }
1126 break;
1127 default:
1128 return False;
1129 }
1130 return True;
1131 }
1132
1133 struct srv_info_struct {
1134 fstring name;
1135 uint32 type;
1136 fstring comment;
1137 fstring domain;
1138 bool server_added;
1139 };
1140
1141 /*******************************************************************
1142 Get server info lists from the files saved by nmbd. Return the
1143 number of entries.
1144 ******************************************************************/
1145
1146 static int get_server_info(uint32 servertype,
1147 struct srv_info_struct **servers,
1148 const char *domain)
1149 {
1150 int count=0;
1151 int alloced=0;
1152 char **lines;
1153 bool local_list_only;
1154 int i;
1155
1156 lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1157 if (!lines) {
1158 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1159 return 0;
1160 }
1161
1162 /* request for everything is code for request all servers */
1163 if (servertype == SV_TYPE_ALL) {
1164 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1165 }
1166
1167 local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1168
1169 DEBUG(4,("Servertype search: %8x\n",servertype));
1170
1171 for (i=0;lines[i];i++) {
1172 fstring stype;
1173 struct srv_info_struct *s;
1174 const char *ptr = lines[i];
1175 bool ok = True;
1176 TALLOC_CTX *frame = NULL;
1177 char *p;
1178
1179 if (!*ptr) {
1180 continue;
1181 }
1182
1183 if (count == alloced) {
1184 alloced += 10;
1185 *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1186 if (!*servers) {
1187 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1188 TALLOC_FREE(lines);
1189 return 0;
1190 }
1191 memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1192 }
1193 s = &(*servers)[count];
1194
1195 frame = talloc_stackframe();
1196 s->name[0] = '\0';
1197 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1198 TALLOC_FREE(frame);
1199 continue;
1200 }
1201 fstrcpy(s->name, p);
1202
1203 stype[0] = '\0';
1204 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1205 TALLOC_FREE(frame);
1206 continue;
1207 }
1208 fstrcpy(stype, p);
1209
1210 s->comment[0] = '\0';
1211 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1212 TALLOC_FREE(frame);
1213 continue;
1214 }
1215 fstrcpy(s->comment, p);
1216 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1217
1218 s->domain[0] = '\0';
1219 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1220 /* this allows us to cope with an old nmbd */
1221 fstrcpy(s->domain,lp_workgroup());
1222 } else {
1223 fstrcpy(s->domain, p);
1224 }
1225 TALLOC_FREE(frame);
1226
1227 if (sscanf(stype,"%X",&s->type) != 1) {
1228 DEBUG(4,("r:host file "));
1229 ok = False;
1230 }
1231
1232 /* Filter the servers/domains we return based on what was asked for. */
1233
1234 /* Check to see if we are being asked for a local list only. */
1235 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1236 DEBUG(4,("r: local list only"));
1237 ok = False;
1238 }
1239
1240 /* doesn't match up: don't want it */
1241 if (!(servertype & s->type)) {
1242 DEBUG(4,("r:serv type "));
1243 ok = False;
1244 }
1245
1246 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1247 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1248 DEBUG(4,("s: dom mismatch "));
1249 ok = False;
1250 }
1251
1252 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1253 ok = False;
1254 }
1255
1256 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1257 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1258
1259 if (ok) {
1260 DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1261 s->name, s->type, s->comment, s->domain));
1262 s->server_added = True;
1263 count++;
1264 } else {
1265 DEBUG(4,("%20s %8x %25s %15s\n",
1266 s->name, s->type, s->comment, s->domain));
1267 }
1268 }
1269
1270 TALLOC_FREE(lines);
1271 return count;
1272 }
1273
1274 /*******************************************************************
1275 Fill in a server info structure.
1276 ******************************************************************/
1277
1278 static int fill_srv_info(struct srv_info_struct *service,
1279 int uLevel, char **buf, int *buflen,
1280 char **stringbuf, int *stringspace, char *baseaddr)
1281 {
1282 int struct_len;
1283 char* p;
1284 char* p2;
1285 int l2;
1286 int len;
1287
1288 switch (uLevel) {
1289 case 0:
1290 struct_len = 16;
1291 break;
1292 case 1:
1293 struct_len = 26;
1294 break;
1295 default:
1296 return -1;
1297 }
1298
1299 if (!buf) {
1300 len = 0;
1301 switch (uLevel) {
1302 case 1:
1303 len = strlen(service->comment)+1;
1304 break;
1305 }
1306
1307 *buflen = struct_len;
1308 *stringspace = len;
1309 return struct_len + len;
1310 }
1311
1312 len = struct_len;
1313 p = *buf;
1314 if (*buflen < struct_len) {
1315 return -1;
1316 }
1317 if (stringbuf) {
1318 p2 = *stringbuf;
1319 l2 = *stringspace;
1320 } else {
1321 p2 = p + struct_len;
1322 l2 = *buflen - struct_len;
1323 }
1324 if (!baseaddr) {
1325 baseaddr = p;
1326 }
1327
1328 switch (uLevel) {
1329 case 0:
1330 push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1331 break;
1332
1333 case 1:
1334 push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1335 SIVAL(p,18,service->type);
1336 SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1337 len += CopyAndAdvance(&p2,service->comment,&l2);
1338 break;
1339 }
1340
1341 if (stringbuf) {
1342 *buf = p + struct_len;
1343 *buflen -= struct_len;
1344 *stringbuf = p2;
1345 *stringspace = l2;
1346 } else {
1347 *buf = p2;
1348 *buflen -= len;
1349 }
1350 return len;
1351 }
1352
1353
1354 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1355 {
1356 return StrCaseCmp(s1->name,s2->name);
1357 }
1358
1359 /****************************************************************************
1360 View list of servers available (or possibly domains). The info is
1361 extracted from lists saved by nmbd on the local host.
1362 ****************************************************************************/
1363
1364 static bool api_RNetServerEnum2(connection_struct *conn, uint16 vuid,
1365 char *param, int tpscnt,
1366 char *data, int tdscnt,
1367 int mdrcnt, int mprcnt, char **rdata,
1368 char **rparam, int *rdata_len, int *rparam_len)
1369 {
1370 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1371 char *str2 = skip_string(param,tpscnt,str1);
1372 char *p = skip_string(param,tpscnt,str2);
1373 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1374 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1375 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1376 char *p2;
1377 int data_len, fixed_len, string_len;
1378 int f_len = 0, s_len = 0;
1379 struct srv_info_struct *servers=NULL;
1380 int counted=0,total=0;
1381 int i,missed;
1382 fstring domain;
1383 bool domain_request;
1384 bool local_request;
1385
1386 if (!str1 || !str2 || !p) {
1387 return False;
1388 }
1389
1390 /* If someone sets all the bits they don't really mean to set
1391 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1392 known servers. */
1393
1394 if (servertype == SV_TYPE_ALL) {
1395 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1396 }
1397
1398 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1399 any other bit (they may just set this bit on its own) they
1400 want all the locally seen servers. However this bit can be
1401 set on its own so set the requested servers to be
1402 ALL - DOMAIN_ENUM. */
1403
1404 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1405 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1406 }
1407
1408 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1409 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1410
1411 p += 8;
1412
1413 if (!prefix_ok(str1,"WrLehD")) {
1414 return False;
1415 }
1416 if (!check_server_info(uLevel,str2)) {
1417 return False;
1418 }
1419
1420 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1421 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1422 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1423
1424 if (strcmp(str1, "WrLehDz") == 0) {
1425 if (skip_string(param,tpscnt,p) == NULL) {
1426 return False;
1427 }
1428 pull_ascii_fstring(domain, p);
1429 } else {
1430 fstrcpy(domain, lp_workgroup());
1431 }
1432
1433 DEBUG(4, ("domain [%s]\n", domain));
1434
1435 if (lp_browse_list()) {
1436 total = get_server_info(servertype,&servers,domain);
1437 }
1438
1439 data_len = fixed_len = string_len = 0;
1440 missed = 0;
1441
1442 if (total > 0) {
1443 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1444 }
1445
1446 {
1447 char *lastname=NULL;
1448
1449 for (i=0;i<total;i++) {
1450 struct srv_info_struct *s = &servers[i];
1451
1452 if (lastname && strequal(lastname,s->name)) {
1453 continue;
1454 }
1455 lastname = s->name;
1456 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1457 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1458 i, s->name, s->type, s->comment, s->domain));
1459
1460 if (data_len <= buf_len) {
1461 counted++;
1462 fixed_len += f_len;
1463 string_len += s_len;
1464 } else {
1465 missed++;
1466 }
1467 }
1468 }
1469
1470 *rdata_len = fixed_len + string_len;
1471 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1472 if (!*rdata) {
1473 return False;
1474 }
1475
1476 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1477 p = *rdata;
1478 f_len = fixed_len;
1479 s_len = string_len;
1480
1481 {
1482 char *lastname=NULL;
1483 int count2 = counted;
1484
1485 for (i = 0; i < total && count2;i++) {
1486 struct srv_info_struct *s = &servers[i];
1487
1488 if (lastname && strequal(lastname,s->name)) {
1489 continue;
1490 }
1491 lastname = s->name;
1492 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1493 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1494 i, s->name, s->type, s->comment, s->domain));
1495 count2--;
1496 }
1497 }
1498
1499 *rparam_len = 8;
1500 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1501 if (!*rparam) {
1502 return False;
1503 }
1504 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1505 SSVAL(*rparam,2,0);
1506 SSVAL(*rparam,4,counted);
1507 SSVAL(*rparam,6,counted+missed);
1508
1509 SAFE_FREE(servers);
1510
1511 DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1512 domain,uLevel,counted,counted+missed));
1513
1514 return True;
1515 }
1516
1517 static int srv_name_match(const char *n1, const char *n2)
1518 {
1519 /*
1520 * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1521 *
1522 * In Windows, FirstNameToReturn need not be an exact match:
1523 * the server will return a list of servers that exist on
1524 * the network greater than or equal to the FirstNameToReturn.
1525 */
1526 int ret = StrCaseCmp(n1, n2);
1527
1528 if (ret <= 0) {
1529 return 0;
1530 }
1531
1532 return ret;
1533 }
1534
1535 static bool api_RNetServerEnum3(connection_struct *conn, uint16 vuid,
1536 char *param, int tpscnt,
1537 char *data, int tdscnt,
1538 int mdrcnt, int mprcnt, char **rdata,
1539 char **rparam, int *rdata_len, int *rparam_len)
1540 {
1541 char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1542 char *str2 = skip_string(param,tpscnt,str1);
1543 char *p = skip_string(param,tpscnt,str2);
1544 int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1545 int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1546 uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1547 char *p2;
1548 int data_len, fixed_len, string_len;
1549 int f_len = 0, s_len = 0;
1550 struct srv_info_struct *servers=NULL;
1551 int counted=0,first=0,total=0;
1552 int i,missed;
1553 fstring domain;
1554 fstring first_name;
1555 bool domain_request;
1556 bool local_request;
1557
1558 if (!str1 || !str2 || !p) {
1559 return False;
1560 }
1561
1562 /* If someone sets all the bits they don't really mean to set
1563 DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1564 known servers. */
1565
1566 if (servertype == SV_TYPE_ALL) {
1567 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1568 }
1569
1570 /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1571 any other bit (they may just set this bit on its own) they
1572 want all the locally seen servers. However this bit can be
1573 set on its own so set the requested servers to be
1574 ALL - DOMAIN_ENUM. */
1575
1576 if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1577 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1578 }
1579
1580 domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1581 local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1582
1583 p += 8;
1584
1585 if (strcmp(str1, "WrLehDzz") != 0) {
1586 return false;
1587 }
1588 if (!check_server_info(uLevel,str2)) {
1589 return False;
1590 }
1591
1592 DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1593 DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1594 DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1595
1596 if (skip_string(param,tpscnt,p) == NULL) {
1597 return False;
1598 }
1599 pull_ascii_fstring(domain, p);
1600 if (domain[0] == '\0') {
1601 fstrcpy(domain, lp_workgroup());
1602 }
1603 p = skip_string(param,tpscnt,p);
1604 if (skip_string(param,tpscnt,p) == NULL) {
1605 return False;
1606 }
1607 pull_ascii_fstring(first_name, p);
1608
1609 DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1610 domain, first_name));
1611
1612 if (lp_browse_list()) {
1613 total = get_server_info(servertype,&servers,domain);
1614 }
1615
1616 data_len = fixed_len = string_len = 0;
1617 missed = 0;
1618
1619 if (total > 0) {
1620 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1621 }
1622
1623 if (first_name[0] != '\0') {
1624 struct srv_info_struct *first_server = NULL;
1625
1626 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1627 srv_name_match, first_server);
1628 if (first_server) {
1629 first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1630 /*
1631 * The binary search may not find the exact match
1632 * so we need to search backward to find the first match
1633 *
1634 * This implements the strange matching windows
1635 * implements. (see the comment in srv_name_match().
1636 */
1637 for (;first > 0;) {
1638 int ret;
1639 ret = StrCaseCmp(first_name,
1640 servers[first-1].name);
1641 if (ret > 0) {
1642 break;
1643 }
1644 first--;
1645 }
1646 } else {
1647 /* we should return no entries */
1648 first = total;
1649 }
1650 }
1651
1652 {
1653 char *lastname=NULL;
1654
1655 for (i=first;i<total;i++) {
1656 struct srv_info_struct *s = &servers[i];
1657
1658 if (lastname && strequal(lastname,s->name)) {
1659 continue;
1660 }
1661 lastname = s->name;
1662 data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1663 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1664 i, s->name, s->type, s->comment, s->domain));
1665
1666 if (data_len <= buf_len) {
1667 counted++;
1668 fixed_len += f_len;
1669 string_len += s_len;
1670 } else {
1671 missed++;
1672 }
1673 }
1674 }
1675
1676 *rdata_len = fixed_len + string_len;
1677 *rdata = smb_realloc_limit(*rdata,*rdata_len);
1678 if (!*rdata) {
1679 return False;
1680 }
1681
1682 p2 = (*rdata) + fixed_len; /* auxilliary data (strings) will go here */
1683 p = *rdata;
1684 f_len = fixed_len;
1685 s_len = string_len;
1686
1687 {
1688 char *lastname=NULL;
1689 int count2 = counted;
1690
1691 for (i = first; i < total && count2;i++) {
1692 struct srv_info_struct *s = &servers[i];
1693
1694 if (lastname && strequal(lastname,s->name)) {
1695 continue;
1696 }
1697 lastname = s->name;
1698 fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1699 DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1700 i, s->name, s->type, s->comment, s->domain));
1701 count2--;
1702 }
1703 }
1704
1705 *rparam_len = 8;
1706 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1707 if (!*rparam) {
1708 return False;
1709 }
1710 SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1711 SSVAL(*rparam,2,0);
1712 SSVAL(*rparam,4,counted);
1713 SSVAL(*rparam,6,counted+missed);
1714
1715 DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1716 domain,uLevel,first,first_name,
1717 first < total ? servers[first].name : "",
1718 counted,counted+missed));
1719
1720 SAFE_FREE(servers);
1721
1722 return True;
1723 }
1724
1725 /****************************************************************************
1726 command 0x34 - suspected of being a "Lookup Names" stub api
1727 ****************************************************************************/
1728
1729 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1730 char *param, int tpscnt,
1731 char *data, int tdscnt,
1732 int mdrcnt, int mprcnt, char **rdata,
1733 char **rparam, int *rdata_len, int *rparam_len)
1734 {
1735 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1736 char *str2 = skip_string(param,tpscnt,str1);
1737 char *p = skip_string(param,tpscnt,str2);
1738 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1739 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1740 int counted=0;
1741 int missed=0;
1742
1743 if (!str1 || !str2 || !p) {
1744 return False;
1745 }
1746
1747 DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1748 str1, str2, p, uLevel, buf_len));
1749
1750 if (!prefix_ok(str1,"zWrLeh")) {
1751 return False;
1752 }
1753
1754 *rdata_len = 0;
1755
1756 *rparam_len = 8;
1757 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1758 if (!*rparam) {
1759 return False;
1760 }
1761
1762 SSVAL(*rparam,0,0x08AC); /* informational warning message */
1763 SSVAL(*rparam,2,0);
1764 SSVAL(*rparam,4,counted);
1765 SSVAL(*rparam,6,counted+missed);
1766
1767 return True;
1768 }
1769
1770 /****************************************************************************
1771 get info about a share
1772 ****************************************************************************/
1773
1774 static bool check_share_info(int uLevel, char* id)
1775 {
1776 switch( uLevel ) {
1777 case 0:
1778 if (strcmp(id,"B13") != 0) {
1779 return False;
1780 }
1781 break;
1782 case 1:
1783 /* Level-2 descriptor is allowed (and ignored) */
1784 if (strcmp(id,"B13BWz") != 0 &&
1785 strcmp(id,"B13BWzWWWzB9B") != 0) {
1786 return False;
1787 }
1788 break;
1789 case 2:
1790 if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1791 return False;
1792 }
1793 break;
1794 case 91:
1795 if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1796 return False;
1797 }
1798 break;
1799 default:
1800 return False;
1801 }
1802 return True;
1803 }
1804
1805 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1806 char** buf, int* buflen,
1807 char** stringbuf, int* stringspace, char* baseaddr)
1808 {
1809 int struct_len;
1810 char* p;
1811 char* p2;
1812 int l2;
1813 int len;
1814
1815 switch( uLevel ) {
1816 case 0:
1817 struct_len = 13;
1818 break;
1819 case 1:
1820 struct_len = 20;
1821 break;
1822 case 2:
1823 struct_len = 40;
1824 break;
1825 case 91:
1826 struct_len = 68;
1827 break;
1828 default:
1829 return -1;
1830 }
1831
1832 if (!buf) {
1833 len = 0;
1834
1835 if (uLevel > 0) {
1836 len += StrlenExpanded(conn,snum,lp_comment(snum));
1837 }
1838 if (uLevel > 1) {
1839 len += strlen(lp_pathname(snum)) + 1;
1840 }
1841 if (buflen) {
1842 *buflen = struct_len;
1843 }
1844 if (stringspace) {
1845 *stringspace = len;
1846 }
1847 return struct_len + len;
1848 }
1849
1850 len = struct_len;
1851 p = *buf;
1852 if ((*buflen) < struct_len) {
1853 return -1;
1854 }
1855
1856 if (stringbuf) {
1857 p2 = *stringbuf;
1858 l2 = *stringspace;
1859 } else {
1860 p2 = p + struct_len;
1861 l2 = (*buflen) - struct_len;
1862 }
1863
1864 if (!baseaddr) {
1865 baseaddr = p;
1866 }
1867
1868 push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1869
1870 if (uLevel > 0) {
1871 int type;
1872
1873 SCVAL(p,13,0);
1874 type = STYPE_DISKTREE;
1875 if (lp_print_ok(snum)) {
1876 type = STYPE_PRINTQ;
1877 }
1878 if (strequal("IPC",lp_fstype(snum))) {
1879 type = STYPE_IPC;
1880 }
1881 SSVAL(p,14,type); /* device type */
1882 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1883 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1884 }
1885
1886 if (uLevel > 1) {
1887 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1888 SSVALS(p,22,-1); /* max uses */
1889 SSVAL(p,24,1); /* current uses */
1890 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1891 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1892 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1893 }
1894
1895 if (uLevel > 2) {
1896 memset(p+40,0,SHPWLEN+2);
1897 SSVAL(p,50,0);
1898 SIVAL(p,52,0);
1899 SSVAL(p,56,0);
1900 SSVAL(p,58,0);
1901 SIVAL(p,60,0);
1902 SSVAL(p,64,0);
1903 SSVAL(p,66,0);
1904 }
1905
1906 if (stringbuf) {
1907 (*buf) = p + struct_len;
1908 (*buflen) -= struct_len;
1909 (*stringbuf) = p2;
1910 (*stringspace) = l2;
1911 } else {
1912 (*buf) = p2;
1913 (*buflen) -= len;
1914 }
1915
1916 return len;
1917 }
1918
1919 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1920 char *param, int tpscnt,
1921 char *data, int tdscnt,
1922 int mdrcnt,int mprcnt,
1923 char **rdata,char **rparam,
1924 int *rdata_len,int *rparam_len)
1925 {
1926 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1927 char *str2 = skip_string(param,tpscnt,str1);
1928 char *netname = skip_string(param,tpscnt,str2);
1929 char *p = skip_string(param,tpscnt,netname);
1930 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1931 int snum;
1932
1933 if (!str1 || !str2 || !netname || !p) {
1934 return False;
1935 }
1936
1937 snum = find_service(netname);
1938 if (snum < 0) {
1939 return False;
1940 }
1941
1942 /* check it's a supported varient */
1943 if (!prefix_ok(str1,"zWrLh")) {
1944 return False;
1945 }
1946 if (!check_share_info(uLevel,str2)) {
1947 return False;
1948 }
1949
1950 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1951 if (!*rdata) {
1952 return False;
1953 }
1954 p = *rdata;
1955 *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1956 if (*rdata_len < 0) {
1957 return False;
1958 }
1959
1960 *rparam_len = 6;
1961 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1962 if (!*rparam) {
1963 return False;
1964 }
1965 SSVAL(*rparam,0,NERR_Success);
1966 SSVAL(*rparam,2,0); /* converter word */
1967 SSVAL(*rparam,4,*rdata_len);
1968
1969 return True;
1970 }
1971
1972 /****************************************************************************
1973 View the list of available shares.
1974
1975 This function is the server side of the NetShareEnum() RAP call.
1976 It fills the return buffer with share names and share comments.
1977 Note that the return buffer normally (in all known cases) allows only
1978 twelve byte strings for share names (plus one for a nul terminator).
1979 Share names longer than 12 bytes must be skipped.
1980 ****************************************************************************/
1981
1982 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1983 char *param, int tpscnt,
1984 char *data, int tdscnt,
1985 int mdrcnt,
1986 int mprcnt,
1987 char **rdata,
1988 char **rparam,
1989 int *rdata_len,
1990 int *rparam_len )
1991 {
1992 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1993 char *str2 = skip_string(param,tpscnt,str1);
1994 char *p = skip_string(param,tpscnt,str2);
1995 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1996 int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1997 char *p2;
1998 int count = 0;
1999 int total=0,counted=0;
2000 bool missed = False;
2001 int i;
2002 int data_len, fixed_len, string_len;
2003 int f_len = 0, s_len = 0;
2004
2005 if (!str1 || !str2 || !p) {
2006 return False;
2007 }
2008
2009 if (!prefix_ok(str1,"WrLeh")) {
2010 return False;
2011 }
2012 if (!check_share_info(uLevel,str2)) {
2013 return False;
2014 }
2015
2016 /* Ensure all the usershares are loaded. */
2017 become_root();
2018 load_registry_shares();
2019 count = load_usershare_shares();
2020 unbecome_root();
2021
2022 data_len = fixed_len = string_len = 0;
2023 for (i=0;i<count;i++) {
2024 fstring servicename_dos;
2025 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2026 continue;
2027 }
2028 push_ascii_fstring(servicename_dos, lp_servicename(i));
2029 /* Maximum name length = 13. */
2030 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2031 total++;
2032 data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2033 if (data_len <= buf_len) {
2034 counted++;
2035 fixed_len += f_len;
2036 string_len += s_len;
2037 } else {
2038 missed = True;
2039 }
2040 }
2041 }
2042
2043 *rdata_len = fixed_len + string_len;
2044 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2045 if (!*rdata) {
2046 return False;
2047 }
2048
2049 p2 = (*rdata) + fixed_len; /* auxiliary data (strings) will go here */
2050 p = *rdata;
2051 f_len = fixed_len;
2052 s_len = string_len;
2053
2054 for( i = 0; i < count; i++ ) {
2055 fstring servicename_dos;
2056 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2057 continue;
2058 }
2059
2060 push_ascii_fstring(servicename_dos, lp_servicename(i));
2061 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2062 if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2063 break;
2064 }
2065 }
2066 }
2067
2068 *rparam_len = 8;
2069 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2070 if (!*rparam) {
2071 return False;
2072 }
2073 SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2074 SSVAL(*rparam,2,0);
2075 SSVAL(*rparam,4,counted);
2076 SSVAL(*rparam,6,total);
2077
2078 DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2079 counted,total,uLevel,
2080 buf_len,*rdata_len,mdrcnt));
2081
2082 return True;
2083 }
2084
2085 /****************************************************************************
2086 Add a share
2087 ****************************************************************************/
2088
2089 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
2090 char *param, int tpscnt,
2091 char *data, int tdscnt,
2092 int mdrcnt,int mprcnt,
2093 char **rdata,char **rparam,
2094 int *rdata_len,int *rparam_len)
2095 {
2096 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2097 char *str2 = skip_string(param,tpscnt,str1);
2098 char *p = skip_string(param,tpscnt,str2);
2099 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2100 fstring sharename;
2101 fstring comment;
2102 char *pathname = NULL;
2103 char *command, *cmdname;
2104 unsigned int offset;
2105 int snum;
2106 int res = ERRunsup;
2107 size_t converted_size;
2108
2109 if (!str1 || !str2 || !p) {
2110 return False;
2111 }
2112
2113 /* check it's a supported varient */
2114 if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2115 return False;
2116 }
2117 if (!check_share_info(uLevel,str2)) {
2118 return False;
2119 }
2120 if (uLevel != 2) {
2121 return False;
2122 }
2123
2124 /* Do we have a string ? */
2125 if (skip_string(data,mdrcnt,data) == NULL) {
2126 return False;
2127 }
2128 pull_ascii_fstring(sharename,data);
2129 snum = find_service(sharename);
2130 if (snum >= 0) { /* already exists */
2131 res = ERRfilexists;
2132 goto error_exit;
2133 }
2134
2135 if (mdrcnt < 28) {
2136 return False;
2137 }
2138
2139 /* only support disk share adds */
2140 if (SVAL(data,14)!=STYPE_DISKTREE) {
2141 return False;
2142 }
2143
2144 offset = IVAL(data, 16);
2145 if (offset >= mdrcnt) {
2146 res = ERRinvalidparam;
2147 goto error_exit;
2148 }
2149
2150 /* Do we have a string ? */
2151 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2152 return False;
2153 }
2154 pull_ascii_fstring(comment, offset? (data+offset) : "");
2155
2156 offset = IVAL(data, 26);
2157
2158 if (offset >= mdrcnt) {
2159 res = ERRinvalidparam;
2160 goto error_exit;
2161 }
2162
2163 /* Do we have a string ? */
2164 if (skip_string(data,mdrcnt,data+offset) == NULL) {
2165 return False;
2166 }
2167
2168 if (!pull_ascii_talloc(talloc_tos(), &pathname,
2169 offset ? (data+offset) : "", &converted_size))
2170 {
2171 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2172 strerror(errno)));
2173 }
2174
2175 if (!pathname) {
2176 return false;
2177 }
2178
2179 string_replace(sharename, '"', ' ');
2180 string_replace(pathname, '"', ' ');
2181 string_replace(comment, '"', ' ');
2182
2183 cmdname = lp_add_share_cmd();
2184
2185 if (!cmdname || *cmdname == '\0') {
2186 return False;
2187 }
2188
2189 if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
2190 lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
2191 pathname, comment) == -1) {
2192 return false;
2193 }
2194
2195 DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
2196
2197 if ((res = smbrun(command, NULL)) != 0) {
2198 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
2199 command, res ));
2200 SAFE_FREE(command);
2201 res = ERRnoaccess;
2202 goto error_exit;
2203 } else {
2204 SAFE_FREE(command);
2205 message_send_all(smbd_messaging_context(),
2206 MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
2207 }
2208
2209 *rparam_len = 6;
2210 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2211 if (!*rparam) {
2212 return False;
2213 }
2214 SSVAL(*rparam,0,NERR_Success);
2215 SSVAL(*rparam,2,0); /* converter word */
2216 SSVAL(*rparam,4,*rdata_len);
2217 *rdata_len = 0;
2218
2219 return True;
2220
2221 error_exit:
2222
2223 *rparam_len = 4;
2224 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2225 if (!*rparam) {
2226 return False;
2227 }
2228 *rdata_len = 0;
2229 SSVAL(*rparam,0,res);
2230 SSVAL(*rparam,2,0);
2231 return True;
2232 }
2233
2234 /****************************************************************************
2235 view list of groups available
2236 ****************************************************************************/
2237
2238 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2239 char *param, int tpscnt,
2240 char *data, int tdscnt,
2241 int mdrcnt,int mprcnt,
2242 char **rdata,char **rparam,
2243 int *rdata_len,int *rparam_len)
2244 {
2245 int i;
2246 int errflags=0;
2247 int resume_context, cli_buf_size;
2248 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2249 char *str2 = skip_string(param,tpscnt,str1);
2250 char *p = skip_string(param,tpscnt,str2);
2251
2252 uint32_t num_groups;
2253 uint32_t resume_handle;
2254 struct rpc_pipe_client *samr_pipe;
2255 struct policy_handle samr_handle, domain_handle;
2256 NTSTATUS status;
2257
2258 if (!str1 || !str2 || !p) {
2259 return False;
2260 }
2261
2262 if (strcmp(str1,"WrLeh") != 0) {
2263 return False;
2264 }
2265
2266 /* parameters
2267 * W-> resume context (number of users to skip)
2268 * r -> return parameter pointer to receive buffer
2269 * L -> length of receive buffer
2270 * e -> return parameter number of entries
2271 * h -> return parameter total number of users
2272 */
2273
2274 if (strcmp("B21",str2) != 0) {
2275 return False;
2276 }
2277
2278 status = rpc_pipe_open_internal(
2279 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2280 conn->server_info, &samr_pipe);
2281 if (!NT_STATUS_IS_OK(status)) {
2282 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2283 nt_errstr(status)));
2284 return false;
2285 }
2286
2287 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2288 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2289 if (!NT_STATUS_IS_OK(status)) {
2290 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2291 nt_errstr(status)));
2292 return false;
2293 }
2294
2295 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2296 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2297 get_global_sam_sid(), &domain_handle);
2298 if (!NT_STATUS_IS_OK(status)) {
2299 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2300 nt_errstr(status)));
2301 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2302 return false;
2303 }
2304
2305 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2306 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2307 DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2308 "%d\n", resume_context, cli_buf_size));
2309
2310 *rdata_len = cli_buf_size;
2311 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2312 if (!*rdata) {
2313 return False;
2314 }
2315
2316 p = *rdata;
2317
2318 errflags = NERR_Success;
2319 num_groups = 0;
2320 resume_handle = 0;
2321
2322 while (true) {
2323 struct samr_SamArray *sam_entries;
2324 uint32_t num_entries;
2325
2326 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2327 &domain_handle,
2328 &resume_handle,
2329 &sam_entries, 1,
2330 &num_entries);
2331 if (!NT_STATUS_IS_OK(status)) {
2332 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2333 "%s\n", nt_errstr(status)));
2334 break;
2335 }
2336
2337 if (num_entries == 0) {
2338 DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2339 "no entries -- done\n"));
2340 break;
2341 }
2342
2343 for(i=0; i<num_entries; i++) {
2344 const char *name;
2345
2346 name = sam_entries->entries[i].name.string;
2347
2348 if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2349 /* set overflow error */
2350 DEBUG(3,("overflow on entry %d group %s\n", i,
2351 name));
2352 errflags=234;
2353 break;
2354 }
2355
2356 /* truncate the name at 21 chars. */
2357 memset(p, 0, 21);
2358 strlcpy(p, name, 21);
2359 DEBUG(10,("adding entry %d group %s\n", i, p));
2360 p += 21;
2361 p += 5; /* Both NT4 and W2k3SP1 do padding here. No
2362 * idea why... */
2363 num_groups += 1;
2364 }
2365
2366 if (errflags != NERR_Success) {
2367 break;
2368 }
2369
2370 TALLOC_FREE(sam_entries);
2371 }
2372
2373 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2374 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2375
2376 *rdata_len = PTR_DIFF(p,*rdata);
2377
2378 *rparam_len = 8;
2379 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2380 if (!*rparam) {
2381 return False;
2382 }
2383 SSVAL(*rparam, 0, errflags);
2384 SSVAL(*rparam, 2, 0); /* converter word */
2385 SSVAL(*rparam, 4, num_groups); /* is this right?? */
2386 SSVAL(*rparam, 6, resume_context+num_groups); /* is this right?? */
2387
2388 return(True);
2389 }
2390
2391 /*******************************************************************
2392 Get groups that a user is a member of.
2393 ******************************************************************/
2394
2395 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2396 char *param, int tpscnt,
2397 char *data, int tdscnt,
2398 int mdrcnt,int mprcnt,
2399 char **rdata,char **rparam,
2400 int *rdata_len,int *rparam_len)
2401 {
2402 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2403 char *str2 = skip_string(param,tpscnt,str1);
2404 char *UserName = skip_string(param,tpscnt,str2);
2405 char *p = skip_string(param,tpscnt,UserName);
2406 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2407 const char *level_string;
2408 int count=0;
2409 bool ret = False;
2410 uint32_t i;
2411 char *endp = NULL;
2412
2413 struct rpc_pipe_client *samr_pipe;
2414 struct policy_handle samr_handle, domain_handle, user_handle;
2415 struct lsa_String name;
2416 struct lsa_Strings names;
2417 struct samr_Ids type, rid;
2418 struct samr_RidWithAttributeArray *rids;
2419 NTSTATUS status;
2420
2421 if (!str1 || !str2 || !UserName || !p) {
2422 return False;
2423 }
2424
2425 *rparam_len = 8;
2426 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2427 if (!*rparam) {
2428 return False;
2429 }
2430
2431 /* check it's a supported varient */
2432
2433 if ( strcmp(str1,"zWrLeh") != 0 )
2434 return False;
2435
2436 switch( uLevel ) {
2437 case 0:
2438 level_string = "B21";
2439 break;
2440 default:
2441 return False;
2442 }
2443
2444 if (strcmp(level_string,str2) != 0)
2445 return False;
2446
2447 *rdata_len = mdrcnt + 1024;
2448 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2449 if (!*rdata) {
2450 return False;
2451 }
2452
2453 SSVAL(*rparam,0,NERR_Success);
2454 SSVAL(*rparam,2,0); /* converter word */
2455
2456 p = *rdata;
2457 endp = *rdata + *rdata_len;
2458
2459 status = rpc_pipe_open_internal(
2460 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2461 conn->server_info, &samr_pipe);
2462 if (!NT_STATUS_IS_OK(status)) {
2463 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2464 nt_errstr(status)));
2465 return false;
2466 }
2467
2468 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2469 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2470 if (!NT_STATUS_IS_OK(status)) {
2471 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2472 nt_errstr(status)));
2473 return false;
2474 }
2475
2476 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2477 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2478 get_global_sam_sid(), &domain_handle);
2479 if (!NT_STATUS_IS_OK(status)) {
2480 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2481 nt_errstr(status)));
2482 goto close_sam;
2483 }
2484
2485 name.string = UserName;
2486
2487 status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2488 &domain_handle, 1, &name,
2489 &rid, &type);
2490 if (!NT_STATUS_IS_OK(status)) {
2491 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2492 nt_errstr(status)));
2493 goto close_domain;
2494 }
2495
2496 if (type.ids[0] != SID_NAME_USER) {
2497 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2498 sid_type_lookup(type.ids[0])));
2499 goto close_domain;
2500 }
2501
2502 status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2503 &domain_handle,
2504 SAMR_USER_ACCESS_GET_GROUPS,
2505 rid.ids[0], &user_handle);
2506 if (!NT_STATUS_IS_OK(status)) {
2507 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2508 nt_errstr(status)));
2509 goto close_domain;
2510 }
2511
2512 status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2513 &user_handle, &rids);
2514 if (!NT_STATUS_IS_OK(status)) {
2515 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2516 nt_errstr(status)));
2517 goto close_user;
2518 }
2519
2520 for (i=0; i<rids->count; i++) {
2521
2522 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2523 &domain_handle,
2524 1, &rids->rids[i].rid,
2525 &names, &type);
2526 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2527 strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2528 p += 21;
2529 count++;
2530 }
2531 }
2532
2533 *rdata_len = PTR_DIFF(p,*rdata);
2534
2535 SSVAL(*rparam,4,count); /* is this right?? */
2536 SSVAL(*rparam,6,count); /* is this right?? */
2537
2538 ret = True;
2539
2540 close_user:
2541 rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2542 close_domain:
2543 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2544 close_sam:
2545 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2546
2547 return ret;
2548 }
2549
2550 /*******************************************************************
2551 Get all users.
2552 ******************************************************************/
2553
2554 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2555 char *param, int tpscnt,
2556 char *data, int tdscnt,
2557 int mdrcnt,int mprcnt,
2558 char **rdata,char **rparam,
2559 int *rdata_len,int *rparam_len)
2560 {
2561 int count_sent=0;
2562 int num_users=0;
2563 int errflags=0;
2564 int i, resume_context, cli_buf_size;
2565 uint32_t resume_handle;
2566
2567 struct rpc_pipe_client *samr_pipe;
2568 struct policy_handle samr_handle, domain_handle;
2569 NTSTATUS status;
2570
2571 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2572 char *str2 = skip_string(param,tpscnt,str1);
2573 char *p = skip_string(param,tpscnt,str2);
2574 char *endp = NULL;
2575
2576 if (!str1 || !str2 || !p) {
2577 return False;
2578 }
2579
2580 if (strcmp(str1,"WrLeh") != 0)
2581 return False;
2582 /* parameters
2583 * W-> resume context (number of users to skip)
2584 * r -> return parameter pointer to receive buffer
2585 * L -> length of receive buffer
2586 * e -> return parameter number of entries
2587 * h -> return parameter total number of users
2588 */
2589
2590 resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2591 cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2592 DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2593 resume_context, cli_buf_size));
2594
2595 *rparam_len = 8;
2596 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2597 if (!*rparam) {
2598 return False;
2599 }
2600
2601 /* check it's a supported varient */
2602 if (strcmp("B21",str2) != 0)
2603 return False;
2604
2605 *rdata_len = cli_buf_size;
2606 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2607 if (!*rdata) {
2608 return False;
2609 }
2610
2611 p = *rdata;
2612 endp = *rdata + *rdata_len;
2613
2614 status = rpc_pipe_open_internal(
2615 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2616 conn->server_info, &samr_pipe);
2617 if (!NT_STATUS_IS_OK(status)) {
2618 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2619 nt_errstr(status)));
2620 return false;
2621 }
2622
2623 status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2624 SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2625 if (!NT_STATUS_IS_OK(status)) {
2626 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2627 nt_errstr(status)));
2628 return false;
2629 }
2630
2631 status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2632 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2633 get_global_sam_sid(), &domain_handle);
2634 if (!NT_STATUS_IS_OK(status)) {
2635 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2636 nt_errstr(status)));
2637 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2638 return false;
2639 }
2640
2641 errflags=NERR_Success;
2642
2643 resume_handle = 0;
2644
2645 while (true) {
2646 struct samr_SamArray *sam_entries;
2647 uint32_t num_entries;
2648
2649 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2650 &domain_handle,
2651 &resume_handle,
2652 0, &sam_entries, 1,
2653 &num_entries);
2654
2655 if (!NT_STATUS_IS_OK(status)) {
2656 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2657 "%s\n", nt_errstr(status)));
2658 break;
2659 }
2660
2661 if (num_entries == 0) {
2662 DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2663 "no entries -- done\n"));
2664 break;
2665 }
2666
2667 for (i=0; i<num_entries; i++) {
2668 const char *name;
2669
2670 name = sam_entries->entries[i].name.string;
2671
2672 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2673 &&(strlen(name)<=21)) {
2674 strlcpy(p,name,PTR_DIFF(endp,p));
2675 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2676 "username %s\n",count_sent,p));
2677 p += 21;
2678 count_sent++;
2679 } else {
2680 /* set overflow error */
2681 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2682 "username %s\n",count_sent,name));
2683 errflags=234;
2684 break;
2685 }
2686 }
2687
2688 if (errflags != NERR_Success) {
2689 break;
2690 }
2691
2692 TALLOC_FREE(sam_entries);
2693 }
2694
2695 rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2696 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2697
2698 *rdata_len = PTR_DIFF(p,*rdata);
2699
2700 SSVAL(*rparam,0,errflags);
2701 SSVAL(*rparam,2,0); /* converter word */
2702 SSVAL(*rparam,4,count_sent); /* is this right?? */
2703 SSVAL(*rparam,6,num_users); /* is this right?? */
2704
2705 return True;
2706 }
2707
2708 /****************************************************************************
2709 Get the time of day info.
2710 ****************************************************************************/
2711
2712 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2713 char *param, int tpscnt,
2714 char *data, int tdscnt,
2715 int mdrcnt,int mprcnt,
2716 char **rdata,char **rparam,
2717 int *rdata_len,int *rparam_len)
2718 {
2719 struct tm *t;
2720 time_t unixdate = time(NULL);
2721 char *p;
2722
2723 *rparam_len = 4;
2724 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2725 if (!*rparam) {
2726 return False;
2727 }
2728
2729 *rdata_len = 21;
2730 *rdata = smb_realloc_limit(*rdata,*rdata_len);
2731 if (!*rdata) {
2732 return False;
2733 }
2734
2735 SSVAL(*rparam,0,NERR_Success);
2736 SSVAL(*rparam,2,0); /* converter word */
2737
2738 p = *rdata;
2739
2740 srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2741 by NT in a "net time" operation,
2742 it seems to ignore the one below */
2743
2744 /* the client expects to get localtime, not GMT, in this bit
2745 (I think, this needs testing) */
2746 t = localtime(&unixdate);
2747 if (!t) {
2748 return False;
2749 }
2750
2751 SIVAL(p,4,0); /* msecs ? */
2752 SCVAL(p,8,t->tm_hour);
2753 SCVAL(p,9,t->tm_min);
2754 SCVAL(p,10,t->tm_sec);
2755 SCVAL(p,11,0); /* hundredths of seconds */
2756 SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2757 SSVAL(p,14,10000); /* timer interval in 0.0001 of sec */
2758 SCVAL(p,16,t->tm_mday);
2759 SCVAL(p,17,t->tm_mon + 1);
2760 SSVAL(p,18,1900+t->tm_year);
2761 SCVAL(p,20,t->tm_wday);
2762
2763 return True;
2764 }
2765
2766 /****************************************************************************
2767 Set the user password.
2768 *****************************************************************************/
2769
2770 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2771 char *param, int tpscnt,
2772 char *data, int tdscnt,
2773 int mdrcnt,int mprcnt,
2774 char **rdata,char **rparam,
2775 int *rdata_len,int *rparam_len)
2776 {
2777 char *np = get_safe_str_ptr(param,tpscnt,param,2);
2778 char *p = NULL;
2779 fstring user;
2780 fstring pass1,pass2;
2781
2782 /* Skip 2 strings. */
2783 p = skip_string(param,tpscnt,np);
2784 p = skip_string(param,tpscnt,p);
2785
2786 if (!np || !p) {
2787 return False;
2788 }
2789
2790 /* Do we have a string ? */
2791 if (skip_string(param,tpscnt,p) == NULL) {
2792 return False;
2793 }
2794 pull_ascii_fstring(user,p);
2795
2796 p = skip_string(param,tpscnt,p);
2797 if (!p) {
2798 return False;
2799 }
2800
2801 memset(pass1,'\0',sizeof(pass1));
2802 memset(pass2,'\0',sizeof(pass2));
2803 /*
2804 * We use 31 here not 32 as we're checking
2805 * the last byte we want to access is safe.
2806 */
2807 if (!is_offset_safe(param,tpscnt,p,31)) {
2808 return False;
2809 }
2810 memcpy(pass1,p,16);
2811 memcpy(pass2,p+16,16);
2812
2813 *rparam_len = 4;
2814 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2815 if (!*rparam) {
2816 return False;
2817 }
2818
2819 *rdata_len = 0;
2820
2821 SSVAL(*rparam,0,NERR_badpass);
2822 SSVAL(*rparam,2,0); /* converter word */
2823
2824 DEBUG(3,("Set password for <%s>\n",user));
2825
2826 /*
2827 * Attempt to verify the old password against smbpasswd entries
2828 * Win98 clients send old and new password in plaintext for this call.
2829 */
2830
2831 {
2832 struct auth_serversupplied_info *server_info = NULL;
2833 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2834
2835 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2836
2837 become_root();
2838 if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2839 SSVAL(*rparam,0,NERR_Success);
2840 }
2841 unbecome_root();
2842
2843 TALLOC_FREE(server_info);
2844 }
2845 data_blob_clear_free(&password);
2846 }
2847
2848 /*
2849 * If the plaintext change failed, attempt
2850 * the old encrypted method. NT will generate this
2851 * after trying the samr method. Note that this
2852 * method is done as a last resort as this
2853 * password change method loses the NT password hash
2854 * and cannot change the UNIX password as no plaintext
2855 * is received.
2856 */
2857
2858 if(SVAL(*rparam,0) != NERR_Success) {
2859 struct samu *hnd = NULL;
2860
2861 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2862 become_root();
2863 if (change_lanman_password(hnd,(uchar *)pass2)) {
2864 SSVAL(*rparam,0,NERR_Success);
2865 }
2866 unbecome_root();
2867 TALLOC_FREE(hnd);
2868 }
2869 }
2870
2871 memset((char *)pass1,'\0',sizeof(fstring));
2872 memset((char *)pass2,'\0',sizeof(fstring));
2873
2874 return(True);
2875 }
2876
2877 /****************************************************************************
2878 Set the user password (SamOEM version - gets plaintext).
2879 ****************************************************************************/
2880
2881 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2882 char *param, int tpscnt,
2883 char *data, int tdscnt,
2884 int mdrcnt,int mprcnt,
2885 char **rdata,char **rparam,
2886 int *rdata_len,int *rparam_len)
2887 {
2888 struct smbd_server_connection *sconn = smbd_server_conn;
2889 fstring user;
2890 char *p = get_safe_str_ptr(param,tpscnt,param,2);
2891 *rparam_len = 2;
2892 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2893 if (!*rparam) {
2894 return False;
2895 }
2896
2897 if (!p) {
2898 return False;
2899 }
2900 *rdata_len = 0;
2901
2902 SSVAL(*rparam,0,NERR_badpass);
2903
2904 /*
2905 * Check the parameter definition is correct.
2906 */
2907
2908 /* Do we have a string ? */
2909 if (skip_string(param,tpscnt,p) == 0) {
2910 return False;
2911 }
2912 if(!strequal(p, "zsT")) {
2913 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2914 return False;
2915 }
2916 p = skip_string(param, tpscnt, p);
2917 if (!p) {
2918 return False;
2919 }
2920
2921 /* Do we have a string ? */
2922 if (skip_string(param,tpscnt,p) == 0) {
2923 return False;
2924 }
2925 if(!strequal(p, "B516B16")) {
2926 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2927 return False;
2928 }
2929 p = skip_string(param,tpscnt,p);
2930 if (!p) {
2931 return False;
2932 }
2933 /* Do we have a string ? */
2934 if (skip_string(param,tpscnt,p) == 0) {
2935 return False;
2936 }
2937 p += pull_ascii_fstring(user,p);
2938
2939 DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2940
2941 /*
2942 * Pass the user through the NT -> unix user mapping
2943 * function.
2944 */
2945
2946 (void)map_username(sconn, user);
2947
2948 if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2949 SSVAL(*rparam,0,NERR_Success);
2950 }
2951
2952 return(True);
2953 }
2954
2955 /****************************************************************************
2956 delete a print job
2957 Form: <W> <>
2958 ****************************************************************************/
2959
2960 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2961 char *param, int tpscnt,
2962 char *data, int tdscnt,
2963 int mdrcnt,int mprcnt,
2964 char **rdata,char **rparam,
2965 int *rdata_len,int *rparam_len)
2966 {
2967 int function = get_safe_SVAL(param,tpscnt,param,0,0);
2968 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2969 char *str2 = skip_string(param,tpscnt,str1);
2970 char *p = skip_string(param,tpscnt,str2);
2971 uint32 jobid;
2972 int snum;
2973 fstring sharename;
2974 int errcode;
2975 WERROR werr = WERR_OK;
2976
2977 if (!str1 || !str2 || !p) {
2978 return False;
2979 }
2980 /*
2981 * We use 1 here not 2 as we're checking
2982 * the last byte we want to access is safe.
2983 */
2984 if (!is_offset_safe(param,tpscnt,p,1)) {
2985 return False;
2986 }
2987 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2988 return False;
2989
2990 /* check it's a supported varient */
2991 if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2992 return(False);
2993
2994 *rparam_len = 4;
2995 *rparam = smb_realloc_limit(*rparam,*rparam_len);
2996 if (!*rparam) {
2997 return False;
2998 }
2999 *rdata_len = 0;
3000
3001 if (!print_job_exists(sharename, jobid)) {
3002 errcode = NERR_JobNotFound;
3003 goto out;
3004 }
3005
3006 snum = lp_servicenumber( sharename);
3007 if (snum == -1) {
3008 errcode = NERR_DestNotFound;
3009 goto out;
3010 }
3011
3012 errcode = NERR_notsupported;
3013
3014 switch (function) {
3015 case 81: /* delete */
3016 if (print_job_delete(conn->server_info, snum, jobid, &werr))
3017 errcode = NERR_Success;
3018 break;
3019 case 82: /* pause */
3020 if (print_job_pause(conn->server_info, snum, jobid, &werr))
3021 errcode = NERR_Success;
3022 break;
3023 case 83: /* resume */
3024 if (print_job_resume(conn->server_info, snum, jobid, &werr))
3025 errcode = NERR_Success;
3026 break;
3027 }
3028
3029 if (!W_ERROR_IS_OK(werr))
3030 errcode = W_ERROR_V(werr);
3031
3032 out:
3033 SSVAL(*rparam,0,errcode);
3034 SSVAL(*rparam,2,0); /* converter word */
3035
3036 return(True);
3037 }
3038
3039 /****************************************************************************
3040 Purge a print queue - or pause or resume it.
3041 ****************************************************************************/
3042
3043 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
3044 char *param, int tpscnt,
3045 char *data, int tdscnt,
3046 int mdrcnt,int mprcnt,
3047 char **rdata,char **rparam,
3048 int *rdata_len,int *rparam_len)
3049 {
3050 int function = get_safe_SVAL(param,tpscnt,param,0,0);
3051 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3052 char *str2 = skip_string(param,tpscnt,str1);
3053 char *QueueName = skip_string(param,tpscnt,str2);
3054 int errcode = NERR_notsupported;
3055 int snum;
3056 WERROR werr = WERR_OK;
3057
3058 if (!str1 || !str2 || !QueueName) {
3059 return False;
3060 }
3061
3062 /* check it's a supported varient */
3063 if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3064 return(False);
3065
3066 *rparam_len = 4;
3067 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3068 if (!*rparam) {
3069 return False;
3070 }
3071 *rdata_len = 0;
3072
3073 if (skip_string(param,tpscnt,QueueName) == NULL) {
3074 return False;
3075 }
3076 snum = print_queue_snum(QueueName);
3077
3078 if (snum == -1) {
3079 errcode = NERR_JobNotFound;
3080 goto out;
3081 }
3082
3083 switch (function) {
3084 case 74: /* Pause queue */
3085 werr = print_queue_pause(conn->server_info, snum);
3086 break;
3087 case 75: /* Resume queue */
3088 werr = print_queue_resume(conn->server_info, snum);
3089 break;
3090 case 103: /* Purge */
3091 werr = print_queue_purge(conn->server_info, snum);
3092 break;
3093 default:
3094 werr = WERR_NOT_SUPPORTED;
3095 break;
3096 }
3097
3098 errcode = W_ERROR_V(werr);
3099
3100 out:
3101 SSVAL(*rparam,0,errcode);
3102 SSVAL(*rparam,2,0); /* converter word */
3103
3104 return(True);
3105 }
3106
3107 /****************************************************************************
3108 set the property of a print job (undocumented?)
3109 ? function = 0xb -> set name of print job
3110 ? function = 0x6 -> move print job up/down
3111 Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3112 or <WWsTP> <WB21BB16B10zWWzDDz>
3113 ****************************************************************************/
3114
3115 static int check_printjob_info(struct pack_desc* desc,
3116 int uLevel, char* id)
3117 {
3118 desc->subformat = NULL;
3119 switch( uLevel ) {
3120 case 0: desc->format = "W"; break;
3121 case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3122 case 2: desc->format = "WWzWWDDzz"; break;
3123 case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3124 case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3125 default:
3126 DEBUG(0,("check_printjob_info: invalid level %d\n",
3127 uLevel ));
3128 return False;
3129 }
3130 if (id == NULL || strcmp(desc->format,id) != 0) {
3131 DEBUG(0,("check_printjob_info: invalid format %s\n",
3132 id ? id : "<NULL>" ));
3133 return False;
3134 }
3135 return True;
3136 }
3137
3138 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
3139 char *param, int tpscnt,
3140 char *data, int tdscnt,
3141 int mdrcnt,int mprcnt,
3142 char **rdata,char **rparam,
3143 int *rdata_len,int *rparam_len)
3144 {
3145 struct pack_desc desc;
3146 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3147 char *str2 = skip_string(param,tpscnt,str1);
3148 char *p = skip_string(param,tpscnt,str2);
3149 uint32 jobid;
3150 fstring sharename;
3151 int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3152 int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3153 int place, errcode;
3154
3155 if (!str1 || !str2 || !p) {
3156 return False;
3157 }
3158 /*
3159 * We use 1 here not 2 as we're checking
3160 * the last byte we want to access is safe.
3161 */
3162 if (!is_offset_safe(param,tpscnt,p,1)) {
3163 return False;
3164 }
3165 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3166 return False;
3167 *rparam_len = 4;
3168 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3169 if (!*rparam) {
3170 return False;
3171 }
3172
3173 if (!share_defined(sharename)) {
3174 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
3175 sharename));
3176 return False;
3177 }
3178
3179 *rdata_len = 0;
3180
3181 /* check it's a supported varient */
3182 if ((strcmp(str1,"WWsTP")) ||
3183 (!check_printjob_info(&desc,uLevel,str2)))
3184 return(False);
3185
3186 if (!print_job_exists(sharename, jobid)) {
3187 errcode=NERR_JobNotFound;
3188 goto out;
3189 }
3190
3191 errcode = NERR_notsupported;
3192
3193 switch (function) {
3194 case 0x6:
3195 /* change job place in the queue,
3196 data gives the new place */
3197 place = SVAL(data,0);
3198 if (print_job_set_place(sharename, jobid, place)) {
3199 errcode=NERR_Success;
3200 }
3201 break;
3202
3203 case 0xb:
3204 /* change print job name, data gives the name */
3205 if (print_job_set_name(sharename, jobid, data)) {
3206 errcode=NERR_Success;
3207 }
3208 break;
3209
3210 default:
3211 return False;
3212 }
3213
3214 out:
3215 SSVALS(*rparam,0,errcode);
3216 SSVAL(*rparam,2,0); /* converter word */
3217
3218 return(True);
3219 }
3220
3221
3222 /****************************************************************************
3223 Get info about the server.
3224 ****************************************************************************/
3225
3226 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3227 char *param, int tpscnt,
3228 char *data, int tdscnt,
3229 int mdrcnt,int mprcnt,
3230 char **rdata,char **rparam,
3231 int *rdata_len,int *rparam_len)
3232 {
3233 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3234 char *str2 = skip_string(param,tpscnt,str1);
3235 char *p = skip_string(param,tpscnt,str2);
3236 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3237 char *p2;
3238 int struct_len;
3239
3240 if (!str1 || !str2 || !p) {
3241 return False;
3242 }
3243
3244 DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3245
3246 /* check it's a supported varient */
3247 if (!prefix_ok(str1,"WrLh")) {
3248 return False;
3249 }
3250
3251 switch( uLevel ) {
3252 case 0:
3253 if (strcmp(str2,"B16") != 0) {
3254 return False;
3255 }
3256 struct_len = 16;
3257 break;
3258 case 1:
3259 if (strcmp(str2,"B16BBDz") != 0) {
3260 return False;
3261 }
3262 struct_len = 26;
3263 break;
3264 case 2:
3265 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3266 return False;
3267 }
3268 struct_len = 134;
3269 break;
3270 case 3:
3271 if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3272 return False;
3273 }
3274 struct_len = 144;
3275 break;
3276 case 20:
3277 if (strcmp(str2,"DN") != 0) {
3278 return False;
3279 }
3280 struct_len = 6;
3281 break;
3282 case 50:
3283 if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3284 return False;
3285 }
3286 struct_len = 42;
3287 break;
3288 default:
3289 return False;
3290 }
3291
3292 *rdata_len = mdrcnt;
3293 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3294 if (!*rdata) {
3295 return False;
3296 }
3297
3298 p = *rdata;
3299 p2 = p + struct_len;
3300 if (uLevel != 20) {
3301 srvstr_push(NULL, 0, p,global_myname(),16,
3302 STR_ASCII|STR_UPPER|STR_TERMINATE);
3303 }
3304 p += 16;
3305 if (uLevel > 0) {
3306 struct srv_info_struct *servers=NULL;
3307 int i,count;
3308 char *comment = NULL;
3309 TALLOC_CTX *ctx = talloc_tos();
3310 uint32 servertype= lp_default_server_announce();
3311
3312 comment = talloc_strdup(ctx,lp_serverstring());
3313 if (!comment) {
3314 return false;
3315 }
3316
3317 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3318 for (i=0;i<count;i++) {
3319 if (strequal(servers[i].name,global_myname())) {
3320 servertype = servers[i].type;
3321 TALLOC_FREE(comment);
3322 comment = talloc_strdup(ctx,
3323 servers[i].comment);
3324 if (comment) {
3325 return false;
3326 }
3327 }
3328 }
3329 }
3330
3331 SAFE_FREE(servers);
3332
3333 SCVAL(p,0,lp_major_announce_version());
3334 SCVAL(p,1,lp_minor_announce_version());
3335 SIVAL(p,2,servertype);
3336
3337 if (mdrcnt == struct_len) {
3338 SIVAL(p,6,0);
3339 } else {
3340 SIVAL(p,6,PTR_DIFF(p2,*rdata));
3341 comment = talloc_sub_advanced(
3342 ctx,
3343 lp_servicename(SNUM(conn)),
3344 conn->server_info->unix_name,
3345 conn->connectpath,
3346 conn->server_info->utok.gid,
3347 conn->server_info->sanitized_username,
3348 pdb_get_domain(conn->server_info->sam_account),
3349 comment);
3350 if (comment) {
3351 return false;
3352 }
3353 if (mdrcnt - struct_len <= 0) {
3354 return false;
3355 }
3356 push_ascii(p2,
3357 comment,
3358 MIN(mdrcnt - struct_len,
3359 MAX_SERVER_STRING_LENGTH),
3360 STR_TERMINATE);
3361 p2 = skip_string(*rdata,*rdata_len,p2);
3362 if (!p2) {
3363 return False;
3364 }
3365 }
3366 }
3367
3368 if (uLevel > 1) {
3369 return False; /* not yet implemented */
3370 }
3371
3372 *rdata_len = PTR_DIFF(p2,*rdata);
3373
3374 *rparam_len = 6;
3375 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3376 if (!*rparam) {
3377 return False;
3378 }
3379 SSVAL(*rparam,0,NERR_Success);
3380 SSVAL(*rparam,2,0); /* converter word */
3381 SSVAL(*rparam,4,*rdata_len);
3382
3383 return True;
3384 }
3385
3386 /****************************************************************************
3387 Get info about the server.
3388 ****************************************************************************/
3389
3390 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3391 char *param, int tpscnt,
3392 char *data, int tdscnt,
3393 int mdrcnt,int mprcnt,
3394 char **rdata,char **rparam,
3395 int *rdata_len,int *rparam_len)
3396 {
3397 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3398 char *str2 = skip_string(param,tpscnt,str1);
3399 char *p = skip_string(param,tpscnt,str2);
3400 char *p2;
3401 char *endp;
3402 int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3403
3404 if (!str1 || !str2 || !p) {
3405 return False;
3406 }
3407
3408 DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3409
3410 *rparam_len = 6;
3411 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3412 if (!*rparam) {
3413 return False;
3414 }
3415
3416 /* check it's a supported varient */
3417 if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3418 return False;
3419 }
3420
3421 *rdata_len = mdrcnt + 1024;
3422 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3423 if (!*rdata) {
3424 return False;
3425 }
3426
3427 SSVAL(*rparam,0,NERR_Success);
3428 SSVAL(*rparam,2,0); /* converter word */
3429
3430 p = *rdata;
3431 endp = *rdata + *rdata_len;
3432
3433 p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3434 if (!p2) {
3435 return False;
3436 }
3437
3438 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3439 strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3440 strupper_m(p2);
3441 p2 = skip_string(*rdata,*rdata_len,p2);
3442 if (!p2) {
3443 return False;
3444 }
3445 p += 4;
3446
3447 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3448 strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3449 p2 = skip_string(*rdata,*rdata_len,p2);
3450 if (!p2) {
3451 return False;
3452 }
3453 p += 4;
3454
3455 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3456 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3457 strupper_m(p2);
3458 p2 = skip_string(*rdata,*rdata_len,p2);
3459 if (!p2) {
3460 return False;
3461 }
3462 p += 4;
3463
3464 SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3465 SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3466 p += 2;
3467
3468 SIVAL(p,0,PTR_DIFF(p2,*rdata));
3469 strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2)); /* don't know. login domain?? */
3470 p2 = skip_string(*rdata,*rdata_len,p2);
3471 if (!p2) {
3472 return False;
3473 }
3474 p += 4;
3475
3476 SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3477 strlcpy(p2,"",PTR_DIFF(endp,p2));
3478 p2 = skip_string(*rdata,*rdata_len,p2);
3479 if (!p2) {
3480 return False;
3481 }
3482 p += 4;
3483
3484 *rdata_len = PTR_DIFF(p2,*rdata);
3485
3486 SSVAL(*rparam,4,*rdata_len);
3487
3488 return True;
3489 }
3490
3491 /****************************************************************************
3492 get info about a user
3493
3494 struct user_info_11 {
3495 char usri11_name[21]; 0-20
3496 char usri11_pad; 21
3497 char *usri11_comment; 22-25
3498 char *usri11_usr_comment; 26-29
3499 unsigned short usri11_priv; 30-31
3500 unsigned long usri11_auth_flags; 32-35
3501 long usri11_password_age; 36-39
3502 char *usri11_homedir; 40-43
3503 char *usri11_parms; 44-47
3504 long usri11_last_logon; 48-51
3505 long usri11_last_logoff; 52-55
3506 unsigned short usri11_bad_pw_count; 56-57
3507 unsigned short usri11_num_logons; 58-59
3508 char *usri11_logon_server; 60-63
3509 unsigned short usri11_country_code; 64-65
3510 char *usri11_workstations; 66-69
3511 unsigned long usri11_max_storage; 70-73
3512 unsigned short usri11_units_per_week; 74-75
3513 unsigned char *usri11_logon_hours; 76-79
3514 unsigned short usri11_code_page; 80-81
3515 };
3516
3517 where:
3518
3519 usri11_name specifies the user name for which information is retrieved
3520
3521 usri11_pad aligns the next data structure element to a word boundary
3522
3523 usri11_comment is a null terminated ASCII comment
3524
3525 usri11_user_comment is a null terminated ASCII comment about the user
3526
3527 usri11_priv specifies the level of the privilege assigned to the user.
3528 The possible values are:
3529
3530 Name Value Description
3531 USER_PRIV_GUEST 0 Guest privilege
3532 USER_PRIV_USER 1 User privilege
3533 USER_PRV_ADMIN 2 Administrator privilege
3534
3535 usri11_auth_flags specifies the account operator privileges. The
3536 possible values are:
3537
3538 Name Value Description
3539 AF_OP_PRINT 0 Print operator
3540
3541
3542 Leach, Naik [Page 28]
3543 \f
3544
3545
3546 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3547
3548
3549 AF_OP_COMM 1 Communications operator
3550 AF_OP_SERVER 2 Server operator
3551 AF_OP_ACCOUNTS 3 Accounts operator
3552
3553
3554 usri11_password_age specifies how many seconds have elapsed since the
3555 password was last changed.
3556
3557 usri11_home_dir points to a null terminated ASCII string that contains
3558 the path name of the user's home directory.
3559
3560 usri11_parms points to a null terminated ASCII string that is set
3561 aside for use by applications.
3562
3563 usri11_last_logon specifies the time when the user last logged on.
3564 This value is stored as the number of seconds elapsed since
3565 00:00:00, January 1, 1970.
3566
3567 usri11_last_logoff specifies the time when the user last logged off.
3568 This value is stored as the number of seconds elapsed since
3569 00:00:00, January 1, 1970. A value of 0 means the last logoff
3570 time is unknown.
3571
3572 usri11_bad_pw_count specifies the number of incorrect passwords
3573 entered since the last successful logon.
3574
3575 usri11_log1_num_logons specifies the number of times this user has
3576 logged on. A value of -1 means the number of logons is unknown.
3577
3578 usri11_logon_server points to a null terminated ASCII string that
3579 contains the name of the server to which logon requests are sent.
3580 A null string indicates logon requests should be sent to the
3581 domain controller.
3582
3583 usri11_country_code specifies the country code for the user's language
3584 of choice.
3585
3586 usri11_workstations points to a null terminated ASCII string that
3587 contains the names of workstations the user may log on from.
3588 There may be up to 8 workstations, with the names separated by
3589 commas. A null strings indicates there are no restrictions.
3590
3591 usri11_max_storage specifies the maximum amount of disk space the user
3592 can occupy. A value of 0xffffffff indicates there are no
3593 restrictions.
3594
3595 usri11_units_per_week specifies the equal number of time units into
3596 which a week is divided. This value must be equal to 168.
3597
3598 usri11_logon_hours points to a 21 byte (168 bits) string that
3599 specifies the time during which the user can log on. Each bit
3600 represents one unique hour in a week. The first bit (bit 0, word
3601 0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3602
3603
3604
3605 Leach, Naik [Page 29]
3606 \f
3607
3608
3609 INTERNET-DRAFT CIFS Remote Admin Protocol January 10, 1997
3610
3611
3612 Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3613 are no restrictions.
3614
3615 usri11_code_page specifies the code page for the user's language of
3616 choice
3617
3618 All of the pointers in this data structure need to be treated
3619 specially. The pointer is a 32 bit pointer. The higher 16 bits need
3620 to be ignored. The converter word returned in the parameters section
3621 needs to be subtracted from the lower 16 bits to calculate an offset
3622 into the return buffer where this ASCII string resides.
3623
3624 There is no auxiliary data in the response.
3625
3626 ****************************************************************************/
3627
3628 #define usri11_name 0
3629 #define usri11_pad 21
3630 #define usri11_comment 22
3631 #define usri11_usr_comment 26
3632 #define usri11_full_name 30
3633 #define usri11_priv 34
3634 #define usri11_auth_flags 36
3635 #define usri11_password_age 40
3636 #define usri11_homedir 44
3637 #define usri11_parms 48
3638 #define usri11_last_logon 52
3639 #define usri11_last_logoff 56
3640 #define usri11_bad_pw_count 60
3641 #define usri11_num_logons 62
3642 #define usri11_logon_server 64
3643 #define usri11_country_code 68
3644 #define usri11_workstations 70
3645 #define usri11_max_storage 74
3646 #define usri11_units_per_week 78
3647 #define usri11_logon_hours 80
3648 #define usri11_code_page 84
3649 #define usri11_end 86
3650
3651 #define USER_PRIV_GUEST 0
3652 #define USER_PRIV_USER 1
3653 #define USER_PRIV_ADMIN 2
3654
3655 #define AF_OP_PRINT 0
3656 #define AF_OP_COMM 1
3657 #define AF_OP_SERVER 2
3658 #define AF_OP_ACCOUNTS 3
3659
3660
3661 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3662 char *param, int tpscnt,
3663 char *data, int tdscnt,
3664 int mdrcnt,int mprcnt,
3665 char **rdata,char **rparam,
3666 int *rdata_len,int *rparam_len)
3667 {
3668 struct smbd_server_connection *sconn = smbd_server_conn;
3669 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3670 char *str2 = skip_string(param,tpscnt,str1);
3671 char *UserName = skip_string(param,tpscnt,str2);
3672 char *p = skip_string(param,tpscnt,UserName);
3673 int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3674 char *p2;
3675 char *endp;
3676 const char *level_string;
3677
3678 /* get NIS home of a previously validated user - simeon */
3679 /* With share level security vuid will always be zero.
3680 Don't depend on vuser being non-null !!. JRA */
3681 user_struct *vuser = get_valid_user_struct(sconn, vuid);
3682 if(vuser != NULL) {
3683 DEBUG(3,(" Username of UID %d is %s\n",
3684 (int)vuser->server_info->utok.uid,
3685 vuser->server_info->unix_name));
3686 }
3687
3688 if (!str1 || !str2 || !UserName || !p) {
3689 return False;
3690 }
3691
3692 *rparam_len = 6;
3693 *rparam = smb_realloc_limit(*rparam,*rparam_len);
3694 if (!*rparam) {
3695 return False;
3696 }
3697
3698 DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3699
3700 /* check it's a supported variant */
3701 if (strcmp(str1,"zWrLh") != 0) {
3702 return False;
3703 }
3704 switch( uLevel ) {
3705 case 0: level_string = "B21"; break;
3706 case 1: level_string = "B21BB16DWzzWz"; break;
3707 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3708 case 10: level_string = "B21Bzzz"; break;
3709 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3710 default: return False;
3711 }
3712
3713 if (strcmp(level_string,str2) != 0) {
3714 return False;
3715 }
3716
3717 *rdata_len = mdrcnt + 1024;
3718 *rdata = smb_realloc_limit(*rdata,*rdata_len);
3719 if (!*rdata) {
3720 return False;
3721 }
3722
3723 SSVAL(*rparam,0,NERR_Success);
3724 SSVAL(*rparam,2,0); /* converter word */
3725
3726 p = *rdata;
3727 endp = *rdata + *rdata_len;
3728 p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3729 if (!p2) {
3730 return False;
3731 }
3732
3733 memset(p,0,21);
3734 fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3735
3736 if (uLevel > 0) {
3737 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3738 *p2 = 0;
3739 }
3740
3741 if (uLevel >= 10) {
3742 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3743 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3744 p2 = skip_string(*rdata,*rdata_len,p2);
3745 if (!p2) {
3746 return False;
3747 }
3748
3749 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3750 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3751 p2 = skip_string(*rdata,*rdata_len,p2);
3752 if (!p2) {
3753 return False;
3754 }
3755
3756 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3757 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3758 strlcpy(p2,((vuser != NULL)
3759 ? pdb_get_fullname(vuser->server_info->sam_account)
3760 : UserName),PTR_DIFF(endp,p2));
3761 p2 = skip_string(*rdata,*rdata_len,p2);
3762 if (!p2) {
3763 return False;
3764 }
3765 }
3766
3767 if (uLevel == 11) {
3768 const char *homedir = "";
3769 if (vuser != NULL) {
3770 homedir = pdb_get_homedir(
3771 vuser->server_info->sam_account);
3772 }
3773 /* modelled after NTAS 3.51 reply */
3774 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3775 SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
3776 SIVALS(p,usri11_password_age,-1); /* password age */
3777 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3778 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3779 p2 = skip_string(*rdata,*rdata_len,p2);
3780 if (!p2) {
3781 return False;
3782 }
3783 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3784 strlcpy(p2,"",PTR_DIFF(endp,p2));
3785 p2 = skip_string(*rdata,*rdata_len,p2);
3786 if (!p2) {
3787 return False;
3788 }
3789 SIVAL(p,usri11_last_logon,0); /* last logon */
3790 SIVAL(p,usri11_last_logoff,0); /* last logoff */
3791 SSVALS(p,usri11_bad_pw_count,-1); /* bad pw counts */
3792 SSVALS(p,usri11_num_logons,-1); /* num logons */
3793 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3794 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3795 p2 = skip_string(*rdata,*rdata_len,p2);
3796 if (!p2) {
3797 return False;
3798 }
3799 SSVAL(p,usri11_country_code,0); /* country code */
3800
3801 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3802 strlcpy(p2,"",PTR_DIFF(endp,p2));
3803 p2 = skip_string(*rdata,*rdata_len,p2);
3804 if (!p2) {
3805 return False;
3806 }
3807
3808 SIVALS(p,usri11_max_storage,-1); /* max storage */
3809 SSVAL(p,usri11_units_per_week,168); /* units per week */
3810 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3811
3812 /* a simple way to get logon hours at all times. */
3813 memset(p2,0xff,21);
3814 SCVAL(p2,21,0); /* fix zero termination */
3815 p2 = skip_string(*rdata,*rdata_len,p2);
3816 if (!p2) {
3817 return False;
3818 }
3819
3820 SSVAL(p,usri11_code_page,0); /* code page */
3821 }
3822
3823 if (uLevel == 1 || uLevel == 2) {
3824 memset(p+22,' ',16); /* password */
3825 SIVALS(p,38,-1); /* password age */
3826 SSVAL(p,42,
3827 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3828 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3829 strlcpy(p2, vuser ? pdb_get_homedir(
3830 vuser->server_info->sam_account) : "",
3831 PTR_DIFF(endp,p2));
3832 p2 = skip_string(*rdata,*rdata_len,p2);
3833 if (!p2) {
3834 return False;
3835 }
3836 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3837 *p2++ = 0;
3838 SSVAL(p,52,0); /* flags */
3839 SIVAL(p,54,PTR_DIFF(p2,*rdata)); /* script_path */
3840 strlcpy(p2, vuser ? pdb_get_logon_script(
3841 vuser->server_info->sam_account) : "",
3842 PTR_DIFF(endp,p2));
3843 p2 = skip_string(*rdata,*rdata_len,p2);
3844 if (!p2) {
3845 return False;
3846 }
3847 if (uLevel == 2) {
3848 SIVAL(p,60,0); /* auth_flags */
3849 SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3850 strlcpy(p2,((vuser != NULL)
3851 ? pdb_get_fullname(vuser->server_info->sam_account)
3852 : UserName),PTR_DIFF(endp,p2));
3853 p2 = skip_string(*rdata,*rdata_len,p2);
3854 if (!p2) {
3855 return False;
3856 }
3857 SIVAL(p,68,0); /* urs_comment */
3858 SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3859 strlcpy(p2,"",PTR_DIFF(endp,p2));
3860 p2 = skip_string(*rdata,*rdata_len,p2);
3861 if (!p2) {
3862 return False;
3863 }
3864 SIVAL(p,76,0); /* workstations */
3865 SIVAL(p,80,0); /* last_logon */
3866 SIVAL(p,84,0); /* last_logoff */
3867 SIVALS(p,88,-1); /* acct_expires */
3868 SIVALS(p,92,-1); /* max_storage */
3869 SSVAL(p,96,168); /* units_per_week */
3870 SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3871 memset(p2,-1,21);
3872 p2 += 21;
3873 SSVALS(p,102,-1); /* bad_pw_count */
3874 SSVALS(p,104,-1); /* num_logons */
3875 SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3876 {
3877 TALLOC_CTX *ctx = talloc_tos();
3878 int space_rem = *rdata_len - (p2 - *rdata);
3879 char *tmp;
3880
3881 if (space_rem <= 0) {
3882 return false;
3883 }
3884 tmp = talloc_strdup(ctx, "\\\\%L");
3885 if (!tmp) {
3886 return false;
3887 }
3888 tmp = talloc_sub_basic(ctx,
3889 "",
3890 "",
3891 tmp);
3892 if (!tmp) {
3893 return false;
3894 }
3895
3896 push_ascii(p2,
3897 tmp,
3898 space_rem,
3899 STR_TERMINATE);
3900 }
3901 p2 = skip_string(*rdata,*rdata_len,p2);
3902 if (!p2) {
3903 return False;
3904 }
3905 SSVAL(p,110,49); /* country_code */
3906 SSVAL(p,112,860); /* code page */
3907 }
3908 }
3909
3910 *rdata_len = PTR_DIFF(p2,*rdata);
3911
3912 SSVAL(*rparam,4,*rdata_len); /* is this right?? */
3913
3914 return(True);
3915 }
3916
3917 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3918 char *param, int tpscnt,
3919 char *data, int tdscnt,
3920 int mdrcnt,int mprcnt,
3921 char **rdata,char **rparam,
3922 int *rdata_len,int *rparam_len)
3923 {
3924 struct smbd_server_connection *sconn = smbd_server_conn;
3925 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3926 char *str2 = skip_string(param,tpscnt,str1);
3927 char *p = skip_string(param,tpscnt,str2);
3928 int uLevel;
3929 struct pack_desc desc;
3930 char* name;
3931 /* With share level security vuid will always be zero.
3932 Don't depend on vuser being non-null !!. JRA */
3933 user_struct *vuser = get_valid_user_struct(sconn, vuid);
3934
3935 if (!str1 || !str2 || !p) {
3936 return False;
3937 }
3938
3939 if(vuser != NULL) {
3940 DEBUG(3,(" Username of UID %d is %s\n",
3941 (int)vuser->server_info->utok.uid,
3942 vuser->server_info->unix_name));
3943 }
3944
3945 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3946 name = get_safe_str_ptr(param,tpscnt,p,2);
3947 if (!name) {
3948 return False;
3949 }
3950
3951 memset((char *)&desc,'\0',sizeof(desc));
3952
3953 DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3954
3955 /* check it's a supported varient */
3956 if (strcmp(str1,"OOWb54WrLh") != 0) {
3957 return False;
3958 }
3959 if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3960 return False;
3961 }
3962 if (mdrcnt > 0) {
3963 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3964 if (!*rdata) {
3965 return False;
3966 }
3967 }
3968
3969 desc.base = *rdata;
3970 desc.buflen = mdrcnt;
3971 desc.subformat = NULL;
3972 desc.format = str2;
3973
3974 if (init_package(&desc,1,0)) {
3975 PACKI(&desc,"W",0); /* code */
3976 PACKS(&desc,"B21",name); /* eff. name */
3977 PACKS(&desc,"B",""); /* pad */
3978 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3979 PACKI(&desc,"D",0); /* auth flags XXX */
3980 PACKI(&desc,"W",0); /* num logons */
3981 PACKI(&desc,"W",0); /* bad pw count */
3982 PACKI(&desc,"D",0); /* last logon */
3983 PACKI(&desc,"D",-1); /* last logoff */
3984 PACKI(&desc,"D",-1); /* logoff time */
3985 PACKI(&desc,"D",-1); /* kickoff time */
3986 PACKI(&desc,"D",0); /* password age */
3987 PACKI(&desc,"D",0); /* password can change */
3988 PACKI(&desc,"D",-1); /* password must change */
3989
3990 {
3991 fstring mypath;
3992 fstrcpy(mypath,"\\\\");
3993 fstrcat(mypath,get_local_machine_name());
3994 strupper_m(mypath);
3995 PACKS(&desc,"z",mypath); /* computer */
3996 }
3997
3998 PACKS(&desc,"z",lp_workgroup());/* domain */
3999 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
4000 vuser->server_info->sam_account) : ""); /* script path */
4001 PACKI(&desc,"D",0x00000000); /* reserved */
4002 }
4003
4004 *rdata_len = desc.usedlen;
4005 *rparam_len = 6;
4006 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4007 if (!*rparam) {
4008 return False;
4009 }
4010 SSVALS(*rparam,0,desc.errcode);
4011 SSVAL(*rparam,2,0);
4012 SSVAL(*rparam,4,desc.neededlen);
4013
4014 DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4015
4016 return True;
4017 }
4018
4019 /****************************************************************************
4020 api_WAccessGetUserPerms
4021 ****************************************************************************/
4022
4023 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
4024 char *param, int tpscnt,
4025 char *data, int tdscnt,
4026 int mdrcnt,int mprcnt,
4027 char **rdata,char **rparam,
4028 int *rdata_len,int *rparam_len)
4029 {
4030 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4031 char *str2 = skip_string(param,tpscnt,str1);
4032 char *user = skip_string(param,tpscnt,str2);
4033 char *resource = skip_string(param,tpscnt,user);
4034
4035 if (!str1 || !str2 || !user || !resource) {
4036 return False;
4037 }
4038
4039 if (skip_string(param,tpscnt,resource) == NULL) {
4040 return False;
4041 }
4042 DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4043
4044 /* check it's a supported varient */
4045 if (strcmp(str1,"zzh") != 0) {
4046 return False;
4047 }
4048 if (strcmp(str2,"") != 0) {
4049 return False;
4050 }
4051
4052 *rparam_len = 6;
4053 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4054 if (!*rparam) {
4055 return False;
4056 }
4057 SSVALS(*rparam,0,0); /* errorcode */
4058 SSVAL(*rparam,2,0); /* converter word */
4059 SSVAL(*rparam,4,0x7f); /* permission flags */
4060
4061 return True;
4062 }
4063
4064 /****************************************************************************
4065 api_WPrintJobEnumerate
4066 ****************************************************************************/
4067
4068 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
4069 char *param, int tpscnt,
4070 char *data, int tdscnt,
4071 int mdrcnt,int mprcnt,
4072 char **rdata,char **rparam,
4073 int *rdata_len,int *rparam_len)
4074 {
4075 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4076 char *str2 = skip_string(param,tpscnt,str1);
4077 char *p = skip_string(param,tpscnt,str2);
4078 int uLevel;
4079 int count;
4080 int i;
4081 int snum;
4082 fstring sharename;
4083 uint32 jobid;
4084 struct pack_desc desc;
4085 print_queue_struct *queue=NULL;
4086 print_status_struct status;
4087 char *tmpdata=NULL;
4088
4089 if (!str1 || !str2 || !p) {
4090 return False;
4091 }
4092
4093 uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4094
4095 memset((char *)&desc,'\0',sizeof(desc));
4096 memset((char *)&status,'\0',sizeof(status));
4097
4098 DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4099
4100 /* check it's a supported varient */
4101 if (strcmp(str1,"WWrLh") != 0) {
4102 return False;
4103 }
4104 if (!check_printjob_info(&desc,uLevel,str2)) {
4105 return False;
4106 }
4107
4108 if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4109 return False;
4110 }
4111
4112 snum = lp_servicenumber( sharename);
4113 if (snum < 0 || !VALID_SNUM(snum)) {
4114 return(False);
4115 }
4116
4117 count = print_queue_status(snum,&queue,&status);
4118 for (i = 0; i < count; i++) {
4119 if (queue[i].job == jobid) {
4120 break;
4121 }
4122 }
4123
4124 if (mdrcnt > 0) {
4125 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4126 if (!*rdata) {
4127 return False;
4128 }
4129 desc.base = *rdata;
4130 desc.buflen = mdrcnt;
4131 } else {
4132 /*
4133 * Don't return data but need to get correct length
4134 * init_package will return wrong size if buflen=0
4135 */
4136 desc.buflen = getlen(desc.format);
4137 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4138 }
4139
4140 if (init_package(&desc,1,0)) {
4141 if (i < count) {
4142 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4143 *rdata_len = desc.usedlen;
4144 } else {
4145 desc.errcode = NERR_JobNotFound;
4146 *rdata_len = 0;
4147 }
4148 }
4149
4150 *rparam_len = 6;
4151 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4152 if (!*rparam) {
4153 return False;
4154 }
4155 SSVALS(*rparam,0,desc.errcode);
4156 SSVAL(*rparam,2,0);
4157 SSVAL(*rparam,4,desc.neededlen);
4158
4159 SAFE_FREE(queue);
4160 SAFE_FREE(tmpdata);
4161
4162 DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4163
4164 return True;
4165 }
4166
4167 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
4168 char *param, int tpscnt,
4169 char *data, int tdscnt,
4170 int mdrcnt,int mprcnt,
4171 char **rdata,char **rparam,
4172 int *rdata_len,int *rparam_len)
4173 {
4174 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4175 char *str2 = skip_string(param,tpscnt,str1);
4176 char *p = skip_string(param,tpscnt,str2);
4177 char *name = p;
4178 int uLevel;
4179 int count;
4180 int i, succnt=0;
4181 int snum;
4182 struct pack_desc desc;
4183 print_queue_struct *queue=NULL;
4184 print_status_struct status;
4185
4186 if (!str1 || !str2 || !p) {
4187 return False;
4188 }
4189
4190 memset((char *)&desc,'\0',sizeof(desc));
4191 memset((char *)&status,'\0',sizeof(status));
4192
4193 p = skip_string(param,tpscnt,p);
4194 if (!p) {
4195 return False;
4196 }
4197 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4198
4199 DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4200
4201 /* check it's a supported variant */
4202 if (strcmp(str1,"zWrLeh") != 0) {
4203 return False;
4204 }
4205
4206 if (uLevel > 2) {
4207 return False; /* defined only for uLevel 0,1,2 */
4208 }
4209
4210 if (!check_printjob_info(&desc,uLevel,str2)) {
4211 return False;
4212 }
4213
4214 snum = find_service(name);
4215 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4216 return False;
4217 }
4218
4219 count = print_queue_status(snum,&queue,&status);
4220 if (mdrcnt > 0) {
4221 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4222 if (!*rdata) {
4223 return False;
4224 }
4225 }
4226 desc.base = *rdata;
4227 desc.buflen = mdrcnt;
4228
4229 if (init_package(&desc,count,0)) {
4230 succnt = 0;
4231 for (i = 0; i < count; i++) {
4232 fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4233 if (desc.errcode == NERR_Success) {
4234 succnt = i+1;
4235 }
4236 }
4237 }
4238
4239 *rdata_len = desc.usedlen;
4240
4241 *rparam_len = 8;
4242 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4243 if (!*rparam) {
4244 return False;
4245 }
4246 SSVALS(*rparam,0,desc.errcode);
4247 SSVAL(*rparam,2,0);
4248 SSVAL(*rparam,4,succnt);
4249 SSVAL(*rparam,6,count);
4250
4251 SAFE_FREE(queue);
4252
4253 DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4254
4255 return True;
4256 }
4257
4258 static int check_printdest_info(struct pack_desc* desc,
4259 int uLevel, char* id)
4260 {
4261 desc->subformat = NULL;
4262 switch( uLevel ) {
4263 case 0:
4264 desc->format = "B9";
4265 break;
4266 case 1:
4267 desc->format = "B9B21WWzW";
4268 break;
4269 case 2:
4270 desc->format = "z";
4271 break;
4272 case 3:
4273 desc->format = "zzzWWzzzWW";
4274 break;
4275 default:
4276 DEBUG(0,("check_printdest_info: invalid level %d\n",
4277 uLevel));
4278 return False;
4279 }
4280 if (id == NULL || strcmp(desc->format,id) != 0) {
4281 DEBUG(0,("check_printdest_info: invalid string %s\n",
4282 id ? id : "<NULL>" ));
4283 return False;
4284 }
4285 return True;
4286 }
4287
4288 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4289 struct pack_desc* desc)
4290 {
4291 char buf[100];
4292
4293 strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4294 buf[sizeof(buf)-1] = 0;
4295 strupper_m(buf);
4296
4297 if (uLevel <= 1) {
4298 PACKS(desc,"B9",buf); /* szName */
4299 if (uLevel == 1) {
4300 PACKS(desc,"B21",""); /* szUserName */
4301 PACKI(desc,"W",0); /* uJobId */
4302 PACKI(desc,"W",0); /* fsStatus */
4303 PACKS(desc,"z",""); /* pszStatus */
4304 PACKI(desc,"W",0); /* time */
4305 }
4306 }
4307
4308 if (uLevel == 2 || uLevel == 3) {
4309 PACKS(desc,"z",buf); /* pszPrinterName */
4310 if (uLevel == 3) {
4311 PACKS(desc,"z",""); /* pszUserName */
4312 PACKS(desc,"z",""); /* pszLogAddr */
4313 PACKI(desc,"W",0); /* uJobId */
4314 PACKI(desc,"W",0); /* fsStatus */
4315 PACKS(desc,"z",""); /* pszStatus */
4316 PACKS(desc,"z",""); /* pszComment */
4317 PACKS(desc,"z","NULL"); /* pszDrivers */
4318 PACKI(desc,"W",0); /* time */
4319 PACKI(desc,"W",0); /* pad1 */
4320 }
4321 }
4322 }
4323
4324 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4325 char *param, int tpscnt,
4326 char *data, int tdscnt,
4327 int mdrcnt,int mprcnt,
4328 char **rdata,char **rparam,
4329 int *rdata_len,int *rparam_len)
4330 {
4331 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4332 char *str2 = skip_string(param,tpscnt,str1);
4333 char *p = skip_string(param,tpscnt,str2);
4334 char* PrinterName = p;
4335 int uLevel;
4336 struct pack_desc desc;
4337 int snum;
4338 char *tmpdata=NULL;
4339
4340 if (!str1 || !str2 || !p) {
4341 return False;
4342 }
4343
4344 memset((char *)&desc,'\0',sizeof(desc));
4345
4346 p = skip_string(param,tpscnt,p);
4347 if (!p) {
4348 return False;
4349 }
4350 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4351
4352 DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4353
4354 /* check it's a supported varient */
4355 if (strcmp(str1,"zWrLh") != 0) {
4356 return False;
4357 }
4358 if (!check_printdest_info(&desc,uLevel,str2)) {
4359 return False;
4360 }
4361
4362 snum = find_service(PrinterName);
4363 if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4364 *rdata_len = 0;
4365 desc.errcode = NERR_DestNotFound;
4366 desc.neededlen = 0;
4367 } else {
4368 if (mdrcnt > 0) {
4369 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4370 if (!*rdata) {
4371 return False;
4372 }
4373 desc.base = *rdata;
4374 desc.buflen = mdrcnt;
4375 } else {
4376 /*
4377 * Don't return data but need to get correct length
4378 * init_package will return wrong size if buflen=0
4379 */
4380 desc.buflen = getlen(desc.format);
4381 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4382 }
4383 if (init_package(&desc,1,0)) {
4384 fill_printdest_info(conn,snum,uLevel,&desc);
4385 }
4386 *rdata_len = desc.usedlen;
4387 }
4388
4389 *rparam_len = 6;
4390 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4391 if (!*rparam) {
4392 return False;
4393 }
4394 SSVALS(*rparam,0,desc.errcode);
4395 SSVAL(*rparam,2,0);
4396 SSVAL(*rparam,4,desc.neededlen);
4397
4398 DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4399 SAFE_FREE(tmpdata);
4400
4401 return True;
4402 }
4403
4404 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4405 char *param, int tpscnt,
4406 char *data, int tdscnt,
4407 int mdrcnt,int mprcnt,
4408 char **rdata,char **rparam,
4409 int *rdata_len,int *rparam_len)
4410 {
4411 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4412 char *str2 = skip_string(param,tpscnt,str1);
4413 char *p = skip_string(param,tpscnt,str2);
4414 int uLevel;
4415 int queuecnt;
4416 int i, n, succnt=0;
4417 struct pack_desc desc;
4418 int services = lp_numservices();
4419
4420 if (!str1 || !str2 || !p) {
4421 return False;
4422 }
4423
4424 memset((char *)&desc,'\0',sizeof(desc));
4425
4426 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4427
4428 DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4429
4430 /* check it's a supported varient */
4431 if (strcmp(str1,"WrLeh") != 0) {
4432 return False;
4433 }
4434 if (!check_printdest_info(&desc,uLevel,str2)) {
4435 return False;
4436 }
4437
4438 queuecnt = 0;
4439 for (i = 0; i < services; i++) {
4440 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4441 queuecnt++;
4442 }
4443 }
4444
4445 if (mdrcnt > 0) {
4446 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4447 if (!*rdata) {
4448 return False;
4449 }
4450 }
4451
4452 desc.base = *rdata;
4453 desc.buflen = mdrcnt;
4454 if (init_package(&desc,queuecnt,0)) {
4455 succnt = 0;
4456 n = 0;
4457 for (i = 0; i < services; i++) {
4458 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4459 fill_printdest_info(conn,i,uLevel,&desc);
4460 n++;
4461 if (desc.errcode == NERR_Success) {
4462 succnt = n;
4463 }
4464 }
4465 }
4466 }
4467
4468 *rdata_len = desc.usedlen;
4469
4470 *rparam_len = 8;
4471 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4472 if (!*rparam) {
4473 return False;
4474 }
4475 SSVALS(*rparam,0,desc.errcode);
4476 SSVAL(*rparam,2,0);
4477 SSVAL(*rparam,4,succnt);
4478 SSVAL(*rparam,6,queuecnt);
4479
4480 DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4481
4482 return True;
4483 }
4484
4485 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4486 char *param, int tpscnt,
4487 char *data, int tdscnt,
4488 int mdrcnt,int mprcnt,
4489 char **rdata,char **rparam,
4490 int *rdata_len,int *rparam_len)
4491 {
4492 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4493 char *str2 = skip_string(param,tpscnt,str1);
4494 char *p = skip_string(param,tpscnt,str2);
4495 int uLevel;
4496 int succnt;
4497 struct pack_desc desc;
4498
4499 if (!str1 || !str2 || !p) {
4500 return False;
4501 }
4502
4503 memset((char *)&desc,'\0',sizeof(desc));
4504
4505 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4506
4507 DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4508
4509 /* check it's a supported varient */
4510 if (strcmp(str1,"WrLeh") != 0) {
4511 return False;
4512 }
4513 if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4514 return False;
4515 }
4516
4517 if (mdrcnt > 0) {
4518 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4519 if (!*rdata) {
4520 return False;
4521 }
4522 }
4523 desc.base = *rdata;
4524 desc.buflen = mdrcnt;
4525 if (init_package(&desc,1,0)) {
4526 PACKS(&desc,"B41","NULL");
4527 }
4528
4529 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4530
4531 *rdata_len = desc.usedlen;
4532
4533 *rparam_len = 8;
4534 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4535 if (!*rparam) {
4536 return False;
4537 }
4538 SSVALS(*rparam,0,desc.errcode);
4539 SSVAL(*rparam,2,0);
4540 SSVAL(*rparam,4,succnt);
4541 SSVAL(*rparam,6,1);
4542
4543 DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4544
4545 return True;
4546 }
4547
4548 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4549 char *param, int tpscnt,
4550 char *data, int tdscnt,
4551 int mdrcnt,int mprcnt,
4552 char **rdata,char **rparam,
4553 int *rdata_len,int *rparam_len)
4554 {
4555 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4556 char *str2 = skip_string(param,tpscnt,str1);
4557 char *p = skip_string(param,tpscnt,str2);
4558 int uLevel;
4559 int succnt;
4560 struct pack_desc desc;
4561
4562 if (!str1 || !str2 || !p) {
4563 return False;
4564 }
4565 memset((char *)&desc,'\0',sizeof(desc));
4566
4567 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4568
4569 DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4570
4571 /* check it's a supported varient */
4572 if (strcmp(str1,"WrLeh") != 0) {
4573 return False;
4574 }
4575 if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4576 return False;
4577 }
4578
4579 if (mdrcnt > 0) {
4580 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4581 if (!*rdata) {
4582 return False;
4583 }
4584 }
4585 desc.base = *rdata;
4586 desc.buflen = mdrcnt;
4587 desc.format = str2;
4588 if (init_package(&desc,1,0)) {
4589 PACKS(&desc,"B13","lpd");
4590 }
4591
4592 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4593
4594 *rdata_len = desc.usedlen;
4595
4596 *rparam_len = 8;
4597 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4598 if (!*rparam) {
4599 return False;
4600 }
4601 SSVALS(*rparam,0,desc.errcode);
4602 SSVAL(*rparam,2,0);
4603 SSVAL(*rparam,4,succnt);
4604 SSVAL(*rparam,6,1);
4605
4606 DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4607
4608 return True;
4609 }
4610
4611 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4612 char *param, int tpscnt,
4613 char *data, int tdscnt,
4614 int mdrcnt,int mprcnt,
4615 char **rdata,char **rparam,
4616 int *rdata_len,int *rparam_len)
4617 {
4618 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4619 char *str2 = skip_string(param,tpscnt,str1);
4620 char *p = skip_string(param,tpscnt,str2);
4621 int uLevel;
4622 int succnt;
4623 struct pack_desc desc;
4624
4625 if (!str1 || !str2 || !p) {
4626 return False;
4627 }
4628
4629 memset((char *)&desc,'\0',sizeof(desc));
4630
4631 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4632
4633 DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4634
4635 /* check it's a supported varient */
4636 if (strcmp(str1,"WrLeh") != 0) {
4637 return False;
4638 }
4639 if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4640 return False;
4641 }
4642
4643 if (mdrcnt > 0) {
4644 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4645 if (!*rdata) {
4646 return False;
4647 }
4648 }
4649 memset((char *)&desc,'\0',sizeof(desc));
4650 desc.base = *rdata;
4651 desc.buflen = mdrcnt;
4652 desc.format = str2;
4653 if (init_package(&desc,1,0)) {
4654 PACKS(&desc,"B13","lp0");
4655 }
4656
4657 succnt = (desc.errcode == NERR_Success ? 1 : 0);
4658
4659 *rdata_len = desc.usedlen;
4660
4661 *rparam_len = 8;
4662 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4663 if (!*rparam) {
4664 return False;
4665 }
4666 SSVALS(*rparam,0,desc.errcode);
4667 SSVAL(*rparam,2,0);
4668 SSVAL(*rparam,4,succnt);
4669 SSVAL(*rparam,6,1);
4670
4671 DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4672
4673 return True;
4674 }
4675
4676 /****************************************************************************
4677 List open sessions
4678 ****************************************************************************/
4679
4680 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4681 char *param, int tpscnt,
4682 char *data, int tdscnt,
4683 int mdrcnt,int mprcnt,
4684 char **rdata,char **rparam,
4685 int *rdata_len,int *rparam_len)
4686
4687 {
4688 char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4689 char *str2 = skip_string(param,tpscnt,str1);
4690 char *p = skip_string(param,tpscnt,str2);
4691 int uLevel;
4692 struct pack_desc desc;
4693 struct sessionid *session_list;
4694 int i, num_sessions;
4695
4696 if (!str1 || !str2 || !p) {
4697 return False;
4698 }
4699
4700 memset((char *)&desc,'\0',sizeof(desc));
4701
4702 uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4703
4704 DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4705 DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4706 DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4707
4708 /* check it's a supported varient */
4709 if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4710 return False;
4711 }
4712 if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4713 return False;
4714 }
4715
4716 num_sessions = list_sessions(talloc_tos(), &session_list);
4717
4718 if (mdrcnt > 0) {
4719 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4720 if (!*rdata) {
4721 return False;
4722 }
4723 }
4724 memset((char *)&desc,'\0',sizeof(desc));
4725 desc.base = *rdata;
4726 desc.buflen = mdrcnt;
4727 desc.format = str2;
4728 if (!init_package(&desc,num_sessions,0)) {
4729 return False;
4730 }
4731
4732 for(i=0; i<num_sessions; i++) {
4733 PACKS(&desc, "z", session_list[i].remote_machine);
4734 PACKS(&desc, "z", session_list[i].username);
4735 PACKI(&desc, "W", 1); /* num conns */
4736 PACKI(&desc, "W", 0); /* num opens */
4737 PACKI(&desc, "W", 1); /* num users */
4738 PACKI(&desc, "D", 0); /* session time */
4739 PACKI(&desc, "D", 0); /* idle time */
4740 PACKI(&desc, "D", 0); /* flags */
4741 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4742 }
4743
4744 *rdata_len = desc.usedlen;
4745
4746 *rparam_len = 8;
4747 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4748 if (!*rparam) {
4749 return False;
4750 }
4751 SSVALS(*rparam,0,desc.errcode);
4752 SSVAL(*rparam,2,0); /* converter */
4753 SSVAL(*rparam,4,num_sessions); /* count */
4754
4755 DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4756
4757 return True;
4758 }
4759
4760
4761 /****************************************************************************
4762 The buffer was too small.
4763 ****************************************************************************/
4764
4765 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4766 int mdrcnt, int mprcnt,
4767 char **rdata, char **rparam,
4768 int *rdata_len, int *rparam_len)
4769 {
4770 *rparam_len = MIN(*rparam_len,mprcnt);
4771 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4772 if (!*rparam) {
4773 return False;
4774 }
4775
4776 *rdata_len = 0;
4777
4778 SSVAL(*rparam,0,NERR_BufTooSmall);
4779
4780 DEBUG(3,("Supplied buffer too small in API command\n"));
4781
4782 return True;
4783 }
4784
4785 /****************************************************************************
4786 The request is not supported.
4787 ****************************************************************************/
4788
4789 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4790 char *param, int tpscnt,
4791 char *data, int tdscnt,
4792 int mdrcnt, int mprcnt,
4793 char **rdata, char **rparam,
4794 int *rdata_len, int *rparam_len)
4795 {
4796 *rparam_len = 4;
4797 *rparam = smb_realloc_limit(*rparam,*rparam_len);
4798 if (!*rparam) {
4799 return False;
4800 }
4801
4802 *rdata_len = 0;
4803
4804 SSVAL(*rparam,0,NERR_notsupported);
4805 SSVAL(*rparam,2,0); /* converter word */
4806
4807 DEBUG(3,("Unsupported API command\n"));
4808
4809 return True;
4810 }
4811
4812 static const struct {
4813 const char *name;
4814 int id;
4815 bool (*fn)(connection_struct *, uint16,
4816 char *, int,
4817 char *, int,
4818 int,int,char **,char **,int *,int *);
4819 bool auth_user; /* Deny anonymous access? */
4820 } api_commands[] = {
4821 {"RNetShareEnum", RAP_WshareEnum, api_RNetShareEnum, True},
4822 {"RNetShareGetInfo", RAP_WshareGetInfo, api_RNetShareGetInfo},
4823 {"RNetShareAdd", RAP_WshareAdd, api_RNetShareAdd},
4824 {"RNetSessionEnum", RAP_WsessionEnum, api_RNetSessionEnum, True},
4825 {"RNetServerGetInfo", RAP_WserverGetInfo, api_RNetServerGetInfo},
4826 {"RNetGroupEnum", RAP_WGroupEnum, api_RNetGroupEnum, True},
4827 {"RNetGroupGetUsers", RAP_WGroupGetUsers, api_RNetGroupGetUsers, True},
4828 {"RNetUserEnum", RAP_WUserEnum, api_RNetUserEnum, True},
4829 {"RNetUserGetInfo", RAP_WUserGetInfo, api_RNetUserGetInfo},
4830 {"NetUserGetGroups", RAP_WUserGetGroups, api_NetUserGetGroups},
4831 {"NetWkstaGetInfo", RAP_WWkstaGetInfo, api_NetWkstaGetInfo},
4832 {"DosPrintQEnum", RAP_WPrintQEnum, api_DosPrintQEnum, True},
4833 {"DosPrintQGetInfo", RAP_WPrintQGetInfo, api_DosPrintQGetInfo},
4834 {"WPrintQueuePause", RAP_WPrintQPause, api_WPrintQueueCtrl},
4835 {"WPrintQueueResume", RAP_WPrintQContinue, api_WPrintQueueCtrl},
4836 {"WPrintJobEnumerate",RAP_WPrintJobEnum, api_WPrintJobEnumerate},
4837 {"WPrintJobGetInfo", RAP_WPrintJobGetInfo, api_WPrintJobGetInfo},
4838 {"RDosPrintJobDel", RAP_WPrintJobDel, api_RDosPrintJobDel},
4839 {"RDosPrintJobPause", RAP_WPrintJobPause, api_RDosPrintJobDel},
4840 {"RDosPrintJobResume",RAP_WPrintJobContinue, api_RDosPrintJobDel},
4841 {"WPrintDestEnum", RAP_WPrintDestEnum, api_WPrintDestEnum},
4842 {"WPrintDestGetInfo", RAP_WPrintDestGetInfo, api_WPrintDestGetInfo},
4843 {"NetRemoteTOD", RAP_NetRemoteTOD, api_NetRemoteTOD},
4844 {"WPrintQueuePurge", RAP_WPrintQPurge, api_WPrintQueueCtrl},
4845 {"NetServerEnum2", RAP_NetServerEnum2, api_RNetServerEnum2}, /* anon OK */
4846 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */
4847 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4848 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},
4849 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon},
4850 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
4851 {"WPrintDriverEnum", RAP_WPrintDriverEnum, api_WPrintDriverEnum},
4852 {"WPrintQProcEnum", RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4853 {"WPrintPortEnum", RAP_WPrintPortEnum, api_WPrintPortEnum},
4854 {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4855 {NULL, -1, api_Unsupported}
4856 /* The following RAP calls are not implemented by Samba:
4857
4858 RAP_WFileEnum2 - anon not OK
4859 */
4860 };
4861
4862
4863 /****************************************************************************
4864 Handle remote api calls.
4865 ****************************************************************************/
4866
4867 void api_reply(connection_struct *conn, uint16 vuid,
4868 struct smb_request *req,
4869 char *data, char *params,
4870 int tdscnt, int tpscnt,
4871 int mdrcnt, int mprcnt)
4872 {
4873 struct smbd_server_connection *sconn = smbd_server_conn;
4874 int api_command;
4875 char *rdata = NULL;
4876 char *rparam = NULL;
4877 const char *name1 = NULL;
4878 const char *name2 = NULL;
4879 int rdata_len = 0;
4880 int rparam_len = 0;
4881 bool reply=False;
4882 int i;
4883
4884 if (!params) {
4885 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4886 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4887 return;
4888 }
4889
4890 if (tpscnt < 2) {
4891 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4892 return;
4893 }
4894 api_command = SVAL(params,0);
4895 /* Is there a string at position params+2 ? */
4896 if (skip_string(params,tpscnt,params+2)) {
4897 name1 = params + 2;
4898 } else {
4899 name1 = "";
4900 }
4901 name2 = skip_string(params,tpscnt,params+2);
4902 if (!name2) {
4903 name2 = "";
4904 }
4905
4906 DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4907 api_command,
4908 name1,
4909 name2,
4910 tdscnt,tpscnt,mdrcnt,mprcnt));
4911
4912 for (i=0;api_commands[i].name;i++) {
4913 if (api_commands[i].id == api_command && api_commands[i].fn) {
4914 DEBUG(3,("Doing %s\n",api_commands[i].name));
4915 break;
4916 }
4917 }
4918
4919 /* Check whether this api call can be done anonymously */
4920
4921 if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4922 user_struct *user = get_valid_user_struct(sconn, vuid);
4923
4924 if (!user || user->server_info->guest) {
4925 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4926 return;
4927 }
4928 }
4929
4930 rdata = (char *)SMB_MALLOC(1024);
4931 if (rdata) {
4932 memset(rdata,'\0',1024);
4933 }
4934
4935 rparam = (char *)SMB_MALLOC(1024);
4936 if (rparam) {
4937 memset(rparam,'\0',1024);
4938 }
4939
4940 if(!rdata || !rparam) {
4941 DEBUG(0,("api_reply: malloc fail !\n"));
4942 SAFE_FREE(rdata);
4943 SAFE_FREE(rparam);
4944 reply_nterror(req, NT_STATUS_NO_MEMORY);
4945 return;
4946 }
4947
4948 reply = api_commands[i].fn(conn,
4949 vuid,
4950 params,tpscnt, /* params + length */
4951 data,tdscnt, /* data + length */
4952 mdrcnt,mprcnt,
4953 &rdata,&rparam,&rdata_len,&rparam_len);
4954
4955
4956 if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4957 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4958 &rdata,&rparam,&rdata_len,&rparam_len);
4959 }
4960
4961 /* if we get False back then it's actually unsupported */
4962 if (!reply) {
4963 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4964 &rdata,&rparam,&rdata_len,&rparam_len);
4965 }
4966
4967 /* If api_Unsupported returns false we can't return anything. */
4968 if (reply) {
4969 send_trans_reply(conn, req, rparam, rparam_len,
4970 rdata, rdata_len, False);
4971 }
4972
4973 SAFE_FREE(rdata);
4974 SAFE_FREE(rparam);
4975 return;
4976 }