smbd: fix creation of BUILTIN\{Administrators,Users} when "tdbsam:map builtin = false"
[Samba/wip.git] / source3 / client / smbspool.c
blobddae1a678521885846c1b90c243dde3e5b933cae
1 /*
2 Unix SMB/CIFS implementation.
3 SMB backend for the Common UNIX Printing System ("CUPS")
5 Copyright (C) Michael R Sweet 1999
6 Copyright (C) Andrew Tridgell 1994-1998
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Rodrigo Fernandez-Vizarra 2005
9 Copyright (C) James Peach 2008
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "includes.h"
26 #include "system/filesys.h"
27 #include "system/passwd.h"
28 #include "libsmb/libsmb.h"
31 * Starting with CUPS 1.3, Kerberos support is provided by cupsd including
32 * the forwarding of user credentials via the authenticated session between
33 * user and server and the KRB5CCNAME environment variable which will point
34 * to a temporary file or an in-memory representation depending on the version
35 * of Kerberos you use. As a result, all of the ticket code that used to
36 * live here has been removed, and we depend on the user session (if you
37 * run smbspool by hand) or cupsd to provide the necessary Kerberos info.
39 * Also, the AUTH_USERNAME and AUTH_PASSWORD environment variables provide
40 * for per-job authentication for non-Kerberized printing. We use those
41 * if there is no username and password specified in the device URI.
43 * Finally, if we have an authentication failure we return exit code 2
44 * which tells CUPS to hold the job for authentication and bug the user
45 * to get the necessary credentials.
48 #define MAX_RETRY_CONNECT 3
52 * Globals...
58 * Local functions...
61 static int get_exit_code(struct cli_state * cli, NTSTATUS nt_status);
62 static void list_devices(void);
63 static struct cli_state *smb_complete_connection(const char *, const char *,
64 int, const char *, const char *, const char *, const char *, int, bool *need_auth);
65 static struct cli_state *smb_connect(const char *, const char *, int, const
66 char *, const char *, const char *, const char *, bool *need_auth);
67 static int smb_print(struct cli_state *, char *, FILE *);
68 static char *uri_unescape_alloc(const char *);
69 #if 0
70 static bool smb_encrypt;
71 #endif
74 * 'main()' - Main entry for SMB backend.
77 int /* O - Exit status */
78 main(int argc, /* I - Number of command-line arguments */
79 char *argv[])
80 { /* I - Command-line arguments */
81 int i; /* Looping var */
82 int copies; /* Number of copies */
83 int port; /* Port number */
84 char uri[1024], /* URI */
85 *sep, /* Pointer to separator */
86 *tmp, *tmp2, /* Temp pointers to do escaping */
87 *password; /* Password */
88 char *username, /* Username */
89 *server, /* Server name */
90 *printer;/* Printer name */
91 const char *workgroup; /* Workgroup */
92 FILE *fp; /* File to print */
93 int status = 1; /* Status of LPD job */
94 struct cli_state *cli; /* SMB interface */
95 char null_str[1];
96 int tries = 0;
97 bool need_auth = true;
98 const char *dev_uri;
99 TALLOC_CTX *frame = talloc_stackframe();
101 null_str[0] = '\0';
104 * we expect the URI in argv[0]. Detect the case where it is in
105 * argv[1] and cope
107 if (argc > 2 && strncmp(argv[0], "smb://", 6) &&
108 strncmp(argv[1], "smb://", 6) == 0) {
109 argv++;
110 argc--;
113 if (argc == 1) {
115 * NEW! In CUPS 1.1 the backends are run with no arguments
116 * to list the available devices. These can be devices
117 * served by this backend or any other backends (i.e. you
118 * can have an SNMP backend that is only used to enumerate
119 * the available network printers... :)
122 list_devices();
123 status = 0;
124 goto done;
127 if (argc < 6 || argc > 7) {
128 fprintf(stderr,
129 "Usage: %s [DEVICE_URI] job-id user title copies options [file]\n"
130 " The DEVICE_URI environment variable can also contain the\n"
131 " destination printer:\n"
132 "\n"
133 " smb://[username:password@][workgroup/]server[:port]/printer\n",
134 argv[0]);
135 goto done;
139 * If we have 7 arguments, print the file named on the command-line.
140 * Otherwise, print data from stdin...
143 if (argc == 6) {
145 * Print from Copy stdin to a temporary file...
148 fp = stdin;
149 copies = 1;
150 } else if ((fp = fopen(argv[6], "rb")) == NULL) {
151 perror("ERROR: Unable to open print file");
152 goto done;
153 } else {
154 copies = atoi(argv[4]);
158 * Find the URI...
161 dev_uri = getenv("DEVICE_URI");
162 if (dev_uri) {
163 strncpy(uri, dev_uri, sizeof(uri) - 1);
164 } else if (strncmp(argv[0], "smb://", 6) == 0) {
165 strncpy(uri, argv[0], sizeof(uri) - 1);
166 } else {
167 fputs("ERROR: No device URI found in DEVICE_URI environment variable or argv[0] !\n", stderr);
168 goto done;
171 uri[sizeof(uri) - 1] = '\0';
174 * Extract the destination from the URI...
177 if ((sep = strrchr_m(uri, '@')) != NULL) {
178 tmp = uri + 6;
179 *sep++ = '\0';
181 /* username is in tmp */
183 server = sep;
186 * Extract password as needed...
189 if ((tmp2 = strchr_m(tmp, ':')) != NULL) {
190 *tmp2++ = '\0';
191 password = uri_unescape_alloc(tmp2);
192 } else {
193 password = null_str;
195 username = uri_unescape_alloc(tmp);
196 } else {
197 if ((username = getenv("AUTH_USERNAME")) == NULL) {
198 username = null_str;
201 if ((password = getenv("AUTH_PASSWORD")) == NULL) {
202 password = null_str;
205 server = uri + 6;
208 tmp = server;
210 if ((sep = strchr_m(tmp, '/')) == NULL) {
211 fputs("ERROR: Bad URI - need printer name!\n", stderr);
212 goto done;
215 *sep++ = '\0';
216 tmp2 = sep;
218 if ((sep = strchr_m(tmp2, '/')) != NULL) {
220 * Convert to smb://[username:password@]workgroup/server/printer...
223 *sep++ = '\0';
225 workgroup = uri_unescape_alloc(tmp);
226 server = uri_unescape_alloc(tmp2);
227 printer = uri_unescape_alloc(sep);
228 } else {
229 workgroup = NULL;
230 server = uri_unescape_alloc(tmp);
231 printer = uri_unescape_alloc(tmp2);
234 if ((sep = strrchr_m(server, ':')) != NULL) {
235 *sep++ = '\0';
237 port = atoi(sep);
238 } else {
239 port = 0;
243 * Setup the SAMBA server state...
246 setup_logging("smbspool", DEBUG_STDOUT);
248 load_case_tables();
250 if (!lp_load_client(get_dyn_CONFIGFILE())) {
251 fprintf(stderr, "ERROR: Can't load %s - run testparm to debug it\n", get_dyn_CONFIGFILE());
252 goto done;
255 if (workgroup == NULL) {
256 workgroup = lp_workgroup();
259 load_interfaces();
261 do {
262 cli = smb_connect(workgroup, server, port, printer,
263 username, password, argv[2], &need_auth);
264 if (cli == NULL) {
265 if (need_auth) {
266 exit(2);
267 } else if (getenv("CLASS") == NULL) {
268 fprintf(stderr, "ERROR: Unable to connect to CIFS host, will retry in 60 seconds...\n");
269 sleep(60);
270 tries++;
271 } else {
272 fprintf(stderr, "ERROR: Unable to connect to CIFS host, trying next printer...\n");
273 goto done;
276 } while ((cli == NULL) && (tries < MAX_RETRY_CONNECT));
278 if (cli == NULL) {
279 fprintf(stderr, "ERROR: Unable to connect to CIFS host after (tried %d times)\n", tries);
280 goto done;
284 * Now that we are connected to the server, ignore SIGTERM so that we
285 * can finish out any page data the driver sends (e.g. to eject the
286 * current page... Only ignore SIGTERM if we are printing data from
287 * stdin (otherwise you can't cancel raw jobs...)
290 if (argc < 7) {
291 CatchSignal(SIGTERM, SIG_IGN);
295 * Queue the job...
298 for (i = 0; i < copies; i++) {
299 status = smb_print(cli, argv[3] /* title */ , fp);
300 if (status != 0) {
301 break;
305 cli_shutdown(cli);
308 * Return the queue status...
311 done:
313 TALLOC_FREE(frame);
314 return (status);
319 * 'get_exit_code()' - Get the backend exit code based on the current error.
322 static int
323 get_exit_code(struct cli_state * cli,
324 NTSTATUS nt_status)
326 int i;
328 /* List of NTSTATUS errors that are considered
329 * authentication errors
331 static const NTSTATUS auth_errors[] =
333 NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCESS_VIOLATION,
334 NT_STATUS_SHARING_VIOLATION, NT_STATUS_PRIVILEGE_NOT_HELD,
335 NT_STATUS_INVALID_ACCOUNT_NAME, NT_STATUS_NO_SUCH_USER,
336 NT_STATUS_WRONG_PASSWORD, NT_STATUS_LOGON_FAILURE,
337 NT_STATUS_ACCOUNT_RESTRICTION, NT_STATUS_INVALID_LOGON_HOURS,
338 NT_STATUS_PASSWORD_EXPIRED, NT_STATUS_ACCOUNT_DISABLED
342 fprintf(stderr, "DEBUG: get_exit_code(cli=%p, nt_status=%x)\n",
343 cli, NT_STATUS_V(nt_status));
345 for (i = 0; i < ARRAY_SIZE(auth_errors); i++) {
346 if (!NT_STATUS_EQUAL(nt_status, auth_errors[i])) {
347 continue;
350 if (cli) {
351 if (cli->use_kerberos && cli->got_kerberos_mechanism)
352 fputs("ATTR: auth-info-required=negotiate\n", stderr);
353 else
354 fputs("ATTR: auth-info-required=username,password\n", stderr);
358 * 2 = authentication required...
361 return (2);
366 * 1 = fail
369 return (1);
374 * 'list_devices()' - List the available printers seen on the network...
377 static void
378 list_devices(void)
381 * Eventually, search the local workgroup for available hosts and printers.
384 puts("network smb \"Unknown\" \"Windows Printer via SAMBA\"");
388 static struct cli_state *
389 smb_complete_connection(const char *myname,
390 const char *server,
391 int port,
392 const char *username,
393 const char *password,
394 const char *workgroup,
395 const char *share,
396 int flags,
397 bool *need_auth)
399 struct cli_state *cli; /* New connection */
400 NTSTATUS nt_status;
402 /* Start the SMB connection */
403 *need_auth = false;
404 nt_status = cli_start_connection(&cli, myname, server, NULL, port,
405 SMB_SIGNING_DEFAULT, flags);
406 if (!NT_STATUS_IS_OK(nt_status)) {
407 fprintf(stderr, "ERROR: Connection failed: %s\n", nt_errstr(nt_status));
408 return NULL;
412 * We pretty much guarantee password must be valid or a pointer to a
413 * 0 char.
415 if (!password) {
416 *need_auth = true;
417 return NULL;
420 nt_status = cli_session_setup(cli, username,
421 password, strlen(password) + 1,
422 password, strlen(password) + 1,
423 workgroup);
424 if (!NT_STATUS_IS_OK(nt_status)) {
425 fprintf(stderr, "ERROR: Session setup failed: %s\n", nt_errstr(nt_status));
427 if (get_exit_code(cli, nt_status) == 2) {
428 *need_auth = true;
431 cli_shutdown(cli);
433 return NULL;
436 nt_status = cli_tree_connect(cli, share, "?????", password,
437 strlen(password) + 1);
438 if (!NT_STATUS_IS_OK(nt_status)) {
439 fprintf(stderr, "ERROR: Tree connect failed (%s)\n",
440 nt_errstr(nt_status));
442 if (get_exit_code(cli, nt_status) == 2) {
443 *need_auth = true;
446 cli_shutdown(cli);
448 return NULL;
450 #if 0
451 /* Need to work out how to specify this on the URL. */
452 if (smb_encrypt) {
453 if (!cli_cm_force_encryption(cli,
454 username,
455 password,
456 workgroup,
457 share)) {
458 fprintf(stderr, "ERROR: encryption setup failed\n");
459 cli_shutdown(cli);
460 return NULL;
463 #endif
465 return cli;
469 * 'smb_connect()' - Return a connection to a server.
472 static struct cli_state * /* O - SMB connection */
473 smb_connect(const char *workgroup, /* I - Workgroup */
474 const char *server, /* I - Server */
475 const int port, /* I - Port */
476 const char *share, /* I - Printer */
477 const char *username, /* I - Username */
478 const char *password, /* I - Password */
479 const char *jobusername, /* I - User who issued the print job */
480 bool *need_auth)
481 { /* O - Need authentication? */
482 struct cli_state *cli; /* New connection */
483 char *myname = NULL; /* Client name */
484 struct passwd *pwd;
487 * Get the names and addresses of the client and server...
489 myname = get_myname(talloc_tos());
490 if (!myname) {
491 return NULL;
495 * See if we have a username first. This is for backwards compatible
496 * behavior with 3.0.14a
499 if (username && *username && !getenv("KRB5CCNAME")) {
500 cli = smb_complete_connection(myname, server, port, username,
501 password, workgroup, share, 0, need_auth);
502 if (cli) {
503 fputs("DEBUG: Connected with username/password...\n", stderr);
504 return (cli);
509 * Try to use the user kerberos credentials (if any) to authenticate
511 cli = smb_complete_connection(myname, server, port, jobusername, "",
512 workgroup, share,
513 CLI_FULL_CONNECTION_USE_KERBEROS, need_auth);
515 if (cli) {
516 fputs("DEBUG: Connected using Kerberos...\n", stderr);
517 return (cli);
520 /* give a chance for a passwordless NTLMSSP session setup */
521 pwd = getpwuid(geteuid());
522 if (pwd == NULL) {
523 return NULL;
526 cli = smb_complete_connection(myname, server, port, pwd->pw_name, "",
527 workgroup, share, 0, need_auth);
529 if (cli) {
530 fputs("DEBUG: Connected with NTLMSSP...\n", stderr);
531 return (cli);
535 * last try. Use anonymous authentication
538 cli = smb_complete_connection(myname, server, port, "", "",
539 workgroup, share, 0, need_auth);
541 * Return the new connection...
544 return (cli);
549 * 'smb_print()' - Queue a job for printing using the SMB protocol.
552 static int /* O - 0 = success, non-0 = failure */
553 smb_print(struct cli_state * cli, /* I - SMB connection */
554 char *title, /* I - Title/job name */
555 FILE * fp)
556 { /* I - File to print */
557 uint16_t fnum; /* File number */
558 int nbytes, /* Number of bytes read */
559 tbytes; /* Total bytes read */
560 char buffer[8192], /* Buffer for copy */
561 *ptr; /* Pointer into title */
562 NTSTATUS nt_status;
566 * Sanitize the title...
569 for (ptr = title; *ptr; ptr++) {
570 if (!isalnum((int) *ptr) && !isspace((int) *ptr)) {
571 *ptr = '_';
576 * Open the printer device...
579 nt_status = cli_open(cli, title, O_RDWR | O_CREAT | O_TRUNC, DENY_NONE,
580 &fnum);
581 if (!NT_STATUS_IS_OK(nt_status)) {
582 fprintf(stderr, "ERROR: %s opening remote spool %s\n",
583 nt_errstr(nt_status), title);
584 return get_exit_code(cli, nt_status);
588 * Copy the file to the printer...
591 if (fp != stdin)
592 rewind(fp);
594 tbytes = 0;
596 while ((nbytes = fread(buffer, 1, sizeof(buffer), fp)) > 0) {
597 NTSTATUS status;
599 status = cli_writeall(cli, fnum, 0, (uint8_t *)buffer,
600 tbytes, nbytes, NULL);
601 if (!NT_STATUS_IS_OK(status)) {
602 int ret = get_exit_code(cli, status);
603 fprintf(stderr, "ERROR: Error writing spool: %s\n",
604 nt_errstr(status));
605 fprintf(stderr, "DEBUG: Returning status %d...\n",
606 ret);
607 cli_close(cli, fnum);
609 return (ret);
611 tbytes += nbytes;
614 nt_status = cli_close(cli, fnum);
615 if (!NT_STATUS_IS_OK(nt_status)) {
616 fprintf(stderr, "ERROR: %s closing remote spool %s\n",
617 nt_errstr(nt_status), title);
618 return get_exit_code(cli, nt_status);
619 } else {
620 return (0);
624 static char *
625 uri_unescape_alloc(const char *uritok)
627 char *ret;
629 ret = (char *) SMB_STRDUP(uritok);
630 if (!ret) {
631 return NULL;
634 rfc1738_unescape(ret);
635 return ret;